@thednp/rpc 0.3.0 → 0.3.1

package/AGENTS.md

@@ -81,6 +81,7 @@ Each example follows the same structure:
 The tsdown.config.ts produces multiple entries:
 
 - `dist/index.mjs` — main Vite plugin
+- `dist/config/config.mjs` — vite-free `defineConfig` (safe for serverless bundles)
 - `dist/server/server.mjs` — standalone server
 - `dist/express/express.mjs` — Express middleware
 - `dist/fastify/fastify.mjs` — Fastify middleware

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [0.3.1] - 2026-08-21
+
+### Breaking Changes
+
+- **`defineConfig` moved to `@thednp/rpc/config`**: the config helper no longer ships from the main plugin entry. `@thednp/rpc` statically imports Vite (it *is* a Vite plugin), so any server-side file importing it — including a serverless function bundle that merely reads your `rpc.config.ts` — would emit a runtime `require("vite")` and crash at cold start on platforms where Vite isn't installed (Netlify: `Runtime.ImportModuleError: Cannot find module 'vite'` → 502). The new `/config` subpath has zero dependencies, making serverless deployments behave like any other Express server. Update one import line in `rpc.config.ts`: `import { defineConfig } from "@thednp/rpc/config"`. All examples and the demo updated; `tests/fixtures/*` configs now import from source to stay resolution-safe before publish
+- **demo Netlify function hardened** (`demo/netlify/functions/rpc.ts`): URL rewrite reconstructs the path from `cfg.rpcPrefix` instead of a hardcoded `"/@demo/"`; `serverless-http` moved from devDependencies to dependencies (it is runtime code inside the function bundle)
+
+### Added
+
+- **Vite-free `defineConfig` module** (`src/config.ts`, built to `dist/config/config.mjs`): merges partial config over `defaultRPCOptions`, skipping explicitly `undefined` values so callers can't accidentally blank out defaults; zero runtime dependencies (type-only import erased at build)
+- **`./config` subpath export**: wired into `package.json` exports and `deno.json` exports/imports maps; new tsdown build entry alongside the existing adapter/helper entries
+
+### Removed
+
+- **`ensurePrefixFromGlobal` deleted** (`src/functionsMap.ts`) together with its call sites across all five adapter `createMiddleware` files — the copy-from-default-prefix fallback is superseded by the explicit prefix bootstrap below; also removed dead commented `setGlobalPrefix` calls from the adapters and `src/index.ts`
+- **Serverless prefix bootstrap made explicit**: `setGlobalPrefix(cfg.rpcPrefix)` at the top of `src/api/server.ts` replaces implicit framework magic — static-import hoisting guarantees it runs before any `createServerFunction`, regardless of import order in the host function bundle (`demo/src/api/server.ts`)
+
+### Docs
+
+- `wiki/adapters.md` **Serverless section rewritten** around two rules: (1) import `defineConfig` from `@thednp/rpc/config`, never the main entry, with the cold-start crash explained; (2) set the prefix at the top of `src/api/server.ts`; references the working [demo/netlify/functions/rpc.ts](../demo/netlify/functions/rpc.ts) and keeps `netlify.toml external_node_modules = ["vite"]` documented as a size optimization
+- `wiki/configuration.md` — `defineConfig` section documents the `/config` subpath and why the main entry must never be imported server-side
+- `README.md`, `wiki/quickstart.md`, `wiki/getting-started.md` — all `rpc.config.ts` snippets switched to `@thednp/rpc/config`
+- `AGENTS.md` — h3 added to the adapter list and body-size-limits row (`bodyLimit`/`assertBodySize`); build output table gains `dist/config/config.mjs`
+- `llms.txt` — config section notes the vite-free subpath and its serverless rationale
+
+### Tests
+
+- Fixtures (`tests/fixtures/*.config.ts`) import `defineConfig` from source instead of the main entry, keeping `loadRPCConfig` suites green before publish
+- "load config from file" suite targets `examples/advanced/rpc.config.ts` (the `link:../..` example) so it resolves current source including the unpublished `./config` export
+- New coverage: `defineConfig` skips explicitly `undefined` values back to defaults — **428 tests, 100% on all metrics**
+
+### Fixed
+
+- **Graceful scan without Vite** (`src/scanForServerFiles.ts`): the lazy `import("vite")` is now wrapped in try/catch — when Vite isn't installed (serverless bundles where it's externalized or absent), the scan exits silently instead of crashing the host cold start with `Runtime.ImportModuleError: Cannot find module 'vite'` → 502. Defense-in-depth for deployments whose function bundle doesn't import its server module directly; covered by a new suite that mocks Vite as missing (`tests/scan.test.ts`) — **429 tests, 100% on all metrics**
+- **demo `rpc.config.ts` restored to `defineConfig`**: the plain-object workaround from the Netlify debugging session is retired — the config file now uses the documented `defineConfig({ rpcPrefix: "@demo" })` from `@thednp/rpc/config`, proving the vite-free subpath works end-to-end inside the live Netlify function bundle
+
 ## [0.3.0] - 2026-08-21
 
 ### Features

package/README.md

@@ -169,7 +169,7 @@ npm i @thednp/rpc
 Create `rpc.config.ts` at your project root:
 
 ```ts
-import { defineConfig } from "@thednp/rpc";
+import { defineConfig } from "@thednp/rpc/config";
 
 export default defineConfig({
   adapter: "express",

package/dist/config/config.d.mts

@@ -0,0 +1,65 @@
+import "vite";
+import "@thednp/rpc";
+import "express";
+import "hono";
+import "@hono/node-server";
+import "hono/utils/http-status";
+import "hono/factory";
+import "fastify";
+import "fastify-plugin";
+import "koa";
+import "h3";
+//#region src/types.d.ts
+/**
+ * ### @thednp/rpc
+ * The plugin configuration allows for granular control of your
+ * application RPC calls. The default settings are optimized for development
+ * environments while providing a secure foundation for production use.
+ */
+interface RpcPluginOptions {
+  // RPC Middleware Options
+  /**
+   * RPC prefix without leading slash (e.g. "__rpc")
+   * Leading slash will be added automatically by the middleware.
+   * This prefix defines the base path for all RPC endpoints.
+   * @default "__rpc"
+   * @example
+   * // Results in endpoints like: /api/rpc/myFunction
+   * rpcPrefix: "api/rpc"
+   */
+  rpcPrefix: "__rpc" | string;
+  /**
+   * Option to set an adapter for the middleware connection. The default is _express_,
+   * which is the most popular and battle tested server app. The _express_ adapter is
+   * also compatible with the vite's Connect development server.
+   * @default express
+   */
+  adapter: "express" | "hono" | "h3" | "fastify" | "koa";
+  /**
+   * Root directory from which the plugin scans for server files.
+   * Defaults to `<root>/src/api`. Use this in monorepos where server files
+   * live in a shared package outside the current project root.
+   * @default undefined (resolves to src/api relative to the Vite root)
+   */
+  scanRoot?: string;
+  /**
+   * Server file matching mode. Use `"exact"` (default) for the classic
+   * `server.ts|js|mjs|mts` names, or `"glob"` to match `**\/*.server.{ts,js,mjs,mts}`
+   * inside the scan root.
+   * @default "exact"
+   */
+  serverFiles?: "exact" | "glob";
+}
+//#endregion
+//#region src/config.d.ts
+/**
+ * Type-safe helper to create an RPC configuration object.
+ * Merges the provided partial config over the built-in defaults,
+ * skipping explicitly `undefined` values.
+ * @param uniConfig - System-wide RPC configuration overrides
+ * @returns Complete RPC plugin options with defaults applied
+ */
+declare const defineConfig: (c: Partial<RpcPluginOptions>) => RpcPluginOptions;
+//#endregion
+export { defineConfig };
+//# sourceMappingURL=config.d.mts.map

package/dist/config/config.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.mts","names":[],"sources":["../../src/types.d.ts","../../src/config.ts"],"mappings":";;;;;;;;;;;;;;;;;;UAsPiB;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;;;;;;;;;;cCvQW,eACX,GAAG,QAAQ,sBACR"}

package/dist/config/config.mjs

@@ -0,0 +1,24 @@
+const defaultRPCOptions = {
+	rpcPrefix: "__rpc",
+	adapter: "express",
+	serverFiles: "exact",
+	scanRoot: void 0
+};
+//#endregion
+//#region src/config.ts
+/**
+* Type-safe helper to create an RPC configuration object.
+* Merges the provided partial config over the built-in defaults,
+* skipping explicitly `undefined` values.
+* @param uniConfig - System-wide RPC configuration overrides
+* @returns Complete RPC plugin options with defaults applied
+*/
+const defineConfig = (uniConfig) => {
+	const merged = { ...defaultRPCOptions };
+	for (const [key, value] of Object.entries(uniConfig)) if (value !== void 0) merged[key] = value;
+	return merged;
+};
+//#endregion
+export { defineConfig };
+
+//# sourceMappingURL=config.mjs.map

package/dist/config/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":[],"sources":["../../src/options.ts","../../src/config.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","/**\n * Vite-free configuration helpers.\n *\n * This module intentionally has zero runtime dependencies (not even on `vite`),\n * so `rpc.config.ts` files that import it stay safe to load in serverless\n * bundles where Vite is not installed. Importing the main plugin entry\n * (`@thednp/rpc`) instead would drag Vite into every server-side consumer.\n */\nimport type { RpcPluginOptions } from \"./types.d.ts\";\nimport { defaultRPCOptions } from \"./options.ts\";\n\n/**\n * Type-safe helper to create an RPC configuration object.\n * Merges the provided partial config over the built-in defaults,\n * skipping explicitly `undefined` values.\n * @param uniConfig - System-wide RPC configuration overrides\n * @returns Complete RPC plugin options with defaults applied\n */\nexport const defineConfig: (\n  c: Partial<RpcPluginOptions>,\n) => RpcPluginOptions = (uniConfig: Partial<RpcPluginOptions>) => {\n  const merged: RpcPluginOptions & Record<string, string> = {\n    ...defaultRPCOptions,\n  };\n  for (const [key, value] of Object.entries(uniConfig)) {\n    // istanbul ignore else\n    if (value !== undefined) {\n      merged[key] = value;\n    }\n  }\n  return merged;\n};\n"],"mappings":"AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;;;;;;;;;;ACDA,MAAa,gBAEY,cAAyC;CAChE,MAAM,SAAoD,EACxD,GAAG,kBACL;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAEjD,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO;CAGlB,OAAO;AACT"}

package/dist/index.d.mts

@@ -448,13 +448,6 @@ type InnerModReturn<T extends JsonValue> = {
 };
 //#endregion
 //#region src/index.d.ts
-/**
- * Type-safe helper to create an RPC configuration object.
- * Merges the provided partial config with built-in defaults.
- * @param uniConfig - System-wide RPC configuration overrides
- * @returns Complete RPC plugin options with defaults applied
- */
-declare const defineConfig: (c: Partial<RpcPluginOptions>) => RpcPluginOptions;
 /**
  * Loads the RPC configuration by searching for config files in the project root.
  * Searches in order: `rpc.config.ts`, `rpc.config.js`, `rpc.config.mjs`, `rpc.config.mts`,
@@ -472,5 +465,5 @@ declare const loadRPCConfig: (f?: string) => Promise<RpcPluginOptions>;
  */
 declare function rpcPlugin(devOptions?: Partial<RpcPluginOptions>): Plugin;
 //#endregion
-export { type BodyResult, type ClientFunction, type ClientFunctionWithOptions, type ContentType, type Credentials, type FrameworkHooks, type FrameworkMiddlewareFn, type InnerModReturn, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, type MiddlewareOptions, type RpcPluginOptions, type RpcPluginOptionsInternal, type ScanConfig, type ServerFnArgs, type ServerFnEntry, type ServerFunction, type ServerFunctionInit, type ServerFunctionOptions, type StubOptions, type SupportableContentType, rpcPlugin as default, defineConfig, loadRPCConfig };
+export { type BodyResult, type ClientFunction, type ClientFunctionWithOptions, type ContentType, type Credentials, type FrameworkHooks, type FrameworkMiddlewareFn, type InnerModReturn, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, type MiddlewareOptions, type RpcPluginOptions, type RpcPluginOptionsInternal, type ScanConfig, type ServerFnArgs, type ServerFnEntry, type ServerFunction, type ServerFunctionInit, type ServerFunctionOptions, type StubOptions, type SupportableContentType, rpcPlugin as default, loadRPCConfig };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/h3/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,YACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;;UCzBU;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,wCACxC,iBAAiB,QAAQ,oBAAkB,QACxC;;;;;;KCWO,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;;;KCtDK,uBAAuB;;;;UAalB;;;;;;EAMf,UAAU,KAAK,SAAS,MAAM,SAAS;;;;;;KAO7B,mBAAmB,UAAU,uCACvC,iBAAiB,QAAQ,0BACtB;;;;;;KChCO,sBAAsB;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAU,sCACtC,iBAAiB,QAAQ,yBACtB;;;;;;;UCJY;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;UAMW;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;;KAOM;;;;KAUA;;;;KASA;;;;KAKA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;EAE7B;EACA,MAAM;;EAEJ;EAAoC,MAAM;;;;;;UAM/B;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;EAKA;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;KAuBxC,mBAAmB;;;;;KAMnB,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;KAMzC,mBACV,cAAc,WAAW,YAAY,WACrC,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;UAMe,mBAAmB,KAAK;EACvC;EACA,SAAS,QAAQ;EACjB;EACA;;EAEA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;EASA;;;;;;;;EASA;;;;;EAMA;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;UAOV;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;cCxVL,eAAe,GAAG,QAAQ,sBAAsB;;;;;;;;cAehD,gBAAgB,eAAe,QAAQ;;;;;;;;iBAkGpC,UACP,aAAY,QAAQ,oBACnB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/h3/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,YACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;;UCzBU;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,wCACxC,iBAAiB,QAAQ,oBAAkB,QACxC;;;;;;KCWO,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;;;KCtDK,uBAAuB;;;;UAalB;;;;;;EAMf,UAAU,KAAK,SAAS,MAAM,SAAS;;;;;;KAO7B,mBAAmB,UAAU,uCACvC,iBAAiB,QAAQ,0BACtB;;;;;;KChCO,sBAAsB;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAU,sCACtC,iBAAiB,QAAQ,yBACtB;;;;;;;UCJY;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;UAMW;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;;KAOM;;;;KAUA;;;;KASA;;;;KAKA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;EAE7B;EACA,MAAM;;EAEJ;EAAoC,MAAM;;;;;;UAM/B;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;EAKA;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;KAuBxC,mBAAmB;;;;;KAMnB,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;KAMzC,mBACV,cAAc,WAAW,YAAY,WACrC,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;UAMe,mBAAmB,KAAK;EACvC;EACA,SAAS,QAAQ;EACjB;EACA;;EAEA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;EASA;;;;;;;;EASA;;;;;EAMA;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;UAOV;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;;cCrVL,gBAAgB,eAAe,QAAQ;;;;;;;;iBA+FpC,UACP,aAAY,QAAQ,oBACnB"}

package/dist/index.mjs

@@ -222,7 +222,13 @@ const EXACT_NAMES = [
 */
 const scanForServerFiles = async (initialCfg, devServer) => {
 	if (isScanned && !devServer) return;
-	const { createServer, normalizePath } = await import("vite");
+	let createServer;
+	let normalizePath;
+	try {
+		({createServer, normalizePath} = await import("vite"));
+	} catch {
+		return;
+	}
 	const config = !initialCfg && !devServer || !initialCfg ? {
 		root: process.cwd(),
 		base: process.env.BASE || "/",
@@ -311,15 +317,6 @@ const loadConfigFile = async (env, file) => {
 		}
 	} : null;
 };
-/**
-* Type-safe helper to create an RPC configuration object.
-* Merges the provided partial config with built-in defaults.
-* @param uniConfig - System-wide RPC configuration overrides
-* @returns Complete RPC plugin options with defaults applied
-*/
-const defineConfig = (uniConfig) => {
-	return mergeConfig(defaultRPCOptions, uniConfig);
-};
 let RPCConfig;
 /**
 * Loads the RPC configuration by searching for config files in the project root.
@@ -466,6 +463,6 @@ function rpcPlugin(devOptions = {}) {
 	};
 }
 //#endregion
-export { rpcPlugin as default, defineConfig, loadRPCConfig };
+export { rpcPlugin as default, loadRPCConfig };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/options.ts","../src/constants.ts","../src/functionsMap.ts","../src/validate.ts","../src/getClientModules.ts","../src/server-helpers.ts","../src/scanForServerFiles.ts","../src/index.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  const { createServer, normalizePath } = await import(\"vite\");\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","/** @module Main entrypoint for the RPC Vite plugin. Exports `rpcPlugin` (default), `defineConfig`, and `loadRPCConfig`. */\nimport type { ConfigEnv, Plugin, ResolvedConfig, ViteDevServer } from \"vite\";\nimport { loadConfigFromFile, mergeConfig } from \"vite\";\nimport { resolve } from \"node:path\";\nimport process from \"node:process\";\nimport { existsSync } from \"node:fs\";\nimport { defaultRPCOptions } from \"./options.ts\";\nimport type { RpcPluginOptions, ScanConfig } from \"./types.d.ts\";\nimport {\n  CONFIG_FILE_NOT_FOUND,\n  FAILED_LOAD_CONFIG,\n  NO_CONFIG_FOUND,\n} from \"./constants.ts\";\n\nimport { getClientModules } from \"./getClientModules.ts\";\n// DEV server only\nimport {\n  scanForServerFiles,\n  scannedServerFiles,\n} from \"./scanForServerFiles.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\n\nimport { setGlobalPrefix } from \"@thednp/rpc/server\";\nimport { createRPCMiddleware } from \"@thednp/rpc/express\";\n\n/**\n * Loads and transforms a single RPC config file using Vite's config loader.\n * @param env - Vite config environment\n * @param file - Config file path (e.g. \"rpc.config.ts\")\n * @returns The loaded config augmented with the configFile path, or null on failure\n */\nconst loadConfigFile = async (env: ConfigEnv, file: string) => {\n  const result = await loadConfigFromFile(env, file) as {\n    path: string;\n    config: Partial<RpcPluginOptions>;\n    dependencies: string[];\n  } | null;\n  return result\n    ? { ...result, config: { ...result.config, configFile: file } }\n    : /* istanbul ignore next */ null;\n};\n\n/**\n * Type-safe helper to create an RPC configuration object.\n * Merges the provided partial config with built-in defaults.\n * @param uniConfig - System-wide RPC configuration overrides\n * @returns Complete RPC plugin options with defaults applied\n */\nconst defineConfig: (c: Partial<RpcPluginOptions>) => RpcPluginOptions = (\n  uniConfig: Partial<RpcPluginOptions>,\n) => {\n  return mergeConfig(defaultRPCOptions, uniConfig) as RpcPluginOptions;\n};\n\nlet RPCConfig: RpcPluginOptions;\n\n/**\n * Loads the RPC configuration by searching for config files in the project root.\n * Searches in order: `rpc.config.ts`, `rpc.config.js`, `rpc.config.mjs`, `rpc.config.mts`,\n * `.rpcrc.ts`, `.rpcrc.js`. Falls back to defaults if none found.\n * @param configFile - Optional explicit config file path; skips file search when provided\n * @returns Resolved RPC plugin options\n */\nconst loadRPCConfig: (f?: string) => Promise<RpcPluginOptions> = async (\n  configFile?: string,\n) => {\n  try {\n    // istanbul ignore next\n    const env: ConfigEnv & { root: string } = {\n      command: \"serve\",\n      root: process.cwd(),\n      mode: process.env.NODE_ENV || \"development\",\n    };\n    const defaultConfigFiles = [\n      \"rpc.config.ts\",\n      \"rpc.config.js\",\n      \"rpc.config.mjs\",\n      \"rpc.config.mts\",\n      \".rpcrc.ts\",\n      \".rpcrc.js\",\n    ];\n\n    // If specific config file provided\n    if (configFile) {\n      const configFilePath = resolve(env.root, configFile);\n      if (!existsSync(configFilePath)) {\n        console.warn(CONFIG_FILE_NOT_FOUND(configFile, configFilePath));\n        RPCConfig = defaultRPCOptions;\n        setGlobalPrefix(defaultRPCOptions.rpcPrefix);\n        return defaultRPCOptions as RpcPluginOptions;\n      }\n\n      const result = await loadConfigFile(env, configFile);\n      // istanbul ignore else\n      if (result && typeof result === \"object\") {\n        RPCConfig = mergeConfig(\n          {\n            ...defaultRPCOptions,\n            configFile: configFilePath,\n          },\n          result.config,\n        ) as RpcPluginOptions;\n\n        setGlobalPrefix(RPCConfig.rpcPrefix);\n        return RPCConfig;\n      }\n      // istanbul ignore next - this is a necessary fallback here\n      RPCConfig = defaultRPCOptions;\n    }\n\n    if (RPCConfig !== undefined) {\n      setGlobalPrefix(RPCConfig.rpcPrefix);\n\n      return RPCConfig;\n    }\n\n    // Try default config files\n    for (const file of defaultConfigFiles) {\n      const configFilePath = resolve(env.root, file);\n      // istanbul ignore else\n      if (!existsSync(configFilePath)) {\n        continue;\n      }\n\n      const result = await loadConfigFile(env, file);\n      // istanbul ignore else\n      if (result) {\n        RPCConfig = mergeConfig(\n          {\n            ...defaultRPCOptions,\n            configFile: configFilePath,\n          },\n          result.config,\n        ) as RpcPluginOptions;\n\n        return RPCConfig;\n      }\n    }\n    RPCConfig = defaultRPCOptions;\n    // Last call load defaults no matter what\n    console.warn(NO_CONFIG_FOUND);\n    // return defaultRPCOptions as RpcPluginOptions;\n    // RPCConfig = defaultRPCOptions;\n  } catch (error) {\n    RPCConfig = defaultRPCOptions;\n    console.warn(FAILED_LOAD_CONFIG, error);\n    // return defaultRPCOptions as RpcPluginOptions;\n  }\n\n  setGlobalPrefix(RPCConfig.rpcPrefix);\n\n  return RPCConfig;\n};\n\n/**\n * Vite plugin that enables automatic RPC generation.\n * Transforms server function imports into fetch-based client stubs during development and production builds.\n * In dev mode, attaches the RPC middleware to Vite's Connect server.\n * @param devOptions - Development-only overrides (merged on top of config file values)\n * @returns A Vite plugin object\n */\nfunction rpcPlugin(\n  devOptions: Partial<RpcPluginOptions> = {},\n): Plugin {\n  // Internal type - adapters are handled at runtime\n  let options: RpcPluginOptions & { rpcPrefix: string } = mergeConfig(\n    defaultRPCOptions,\n    devOptions,\n  ) as RpcPluginOptions;\n  let config: ResolvedConfig;\n  let viteServer: ViteDevServer;\n  let isOxc = true;\n\n  return {\n    name: \"vite-plugin-universal-rpc\",\n    enforce: \"pre\",\n    // Plugin methods\n    async configResolved(resolvedConfig) {\n      const uniConfig = await loadRPCConfig();\n      options = mergeConfig(uniConfig, devOptions) as RpcPluginOptions;\n      // setGlobalPrefix(options.rpcPrefix);\n\n      config = resolvedConfig;\n    },\n    async configureServer(server) {\n      viteServer = server;\n      const { adapter: _adapter, ...rest } = options;\n      // istanbul ignore else\n      if (serverFunctionsMap.size === 0) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg, viteServer);\n      }\n\n      // in dev mode we always use express/connect adapter\n      server.middlewares.use(createRPCMiddleware(rest));\n    },\n\n    async buildStart() {\n      const viteVersion = this.meta?.viteVersion;\n      isOxc = Number(viteVersion[0]) >= 8;\n\n      // Prepare the server functions\n      if (!viteServer && config) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg);\n      }\n    },\n    async transform(code: string, id: string, ops?: { ssr?: boolean }) {\n      // Only transform files with server functions for client builds\n      if (\n        !code.includes(\"createServerFunction\") || // any other file is unchanged\n        ops?.ssr || // file loaded on server remains unchanged\n        (code.includes(\"createServerFunction\") &&\n          typeof process === \"undefined\") // file loaded in client IS CHANGED\n      ) {\n        return null;\n      }\n\n      const vite = await import(\"vite\");\n\n      if (serverFunctionsMap.size === 0) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg);\n      }\n\n      // Only transform modules that were scanned as server function files:\n      // pages or docs mentioning `createServerFunction` in prose must not\n      // be rewritten into the generated client bundle.\n      const idPath = vite.normalizePath(id.split(\"?\")[0]);\n      if (!scannedServerFiles.has(idPath)) {\n        return null;\n      }\n\n      const transformer = isOxc ? \"transformWithOxc\" : \"transformWithEsbuild\";\n      const langProp = isOxc ? \"lang\" : \"loader\";\n      const source = getClientModules({\n        rpcPrefix: options.rpcPrefix,\n        adapter: options.adapter,\n      });\n\n      const result = await vite[transformer](source, id, {\n        [langProp]: \"js\",\n        sourcemap: true,\n        // target: \"es2023\"\n      });\n\n      return {\n        code: result.code,\n        map: result.map\n          ? typeof result.map === \"string\"\n            ? JSON.parse(result.map)\n            : /* istanbul ignore next @preserve */ result.map\n          : /* istanbul ignore next @preserve */ null,\n      };\n    },\n  } satisfies Plugin;\n}\n\nexport { rpcPlugin as default };\nexport { defineConfig, loadRPCConfig };\nexport type * from \"./types.d.ts\";\nexport {};\n"],"mappings":";;;;;;;;AAYA,MAAa,gBAAgB;AAE7B,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;;;ACbA,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;;AAqBlC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAGhC,MAAa,yBACX,YACA,mBAEA,sCAAsC,WAAW,sBAAsB,eAAe;AAExF,MAAa,kBAAkB;AAE/B,MAAa,qBAAqB;;AAGlC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;;;;;;;;;ACtCrC,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;AC9DA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;AChFA,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;ACnBA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,MAAM,EAAE,cAAc,kBAAkB,MAAM,OAAO;CACrD,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAKF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;;;;;;;AC1IA,MAAM,iBAAiB,OAAO,KAAgB,SAAiB;CAC7D,MAAM,SAAS,MAAM,mBAAmB,KAAK,IAAI;CAKjD,OAAO,SACH;EAAE,GAAG;EAAQ,QAAQ;GAAE,GAAG,OAAO;GAAQ,YAAY;EAAK;CAAE,IAC3D;AACP;;;;;;;AAQA,MAAM,gBACJ,cACG;CACH,OAAO,YAAY,mBAAmB,SAAS;AACjD;AAEA,IAAI;;;;;;;;AASJ,MAAM,gBAA2D,OAC/D,eACG;CACH,IAAI;EAEF,MAAM,MAAoC;GACxC,SAAS;GACT,MAAM,QAAQ,IAAI;GAClB,MAAM,QAAQ,IAAI,YAAY;EAChC;EACA,MAAM,qBAAqB;GACzB;GACA;GACA;GACA;GACA;GACA;EACF;EAGA,IAAI,YAAY;GACd,MAAM,iBAAiB,QAAQ,IAAI,MAAM,UAAU;GACnD,IAAI,CAAC,WAAW,cAAc,GAAG;IAC/B,QAAQ,KAAK,sBAAsB,YAAY,cAAc,CAAC;IAC9D,YAAY;IACZ,gBAAgB,kBAAkB,SAAS;IAC3C,OAAO;GACT;GAEA,MAAM,SAAS,MAAM,eAAe,KAAK,UAAU;GAEnD,IAAI,UAAU,OAAO,WAAW,UAAU;IACxC,YAAY,YACV;KACE,GAAG;KACH,YAAY;IACd,GACA,OAAO,MACT;IAEA,gBAAgB,UAAU,SAAS;IACnC,OAAO;GACT;GAEA,YAAY;EACd;EAEA,IAAI,cAAc,KAAA,GAAW;GAC3B,gBAAgB,UAAU,SAAS;GAEnC,OAAO;EACT;EAGA,KAAK,MAAM,QAAQ,oBAAoB;GACrC,MAAM,iBAAiB,QAAQ,IAAI,MAAM,IAAI;GAE7C,IAAI,CAAC,WAAW,cAAc,GAC5B;GAGF,MAAM,SAAS,MAAM,eAAe,KAAK,IAAI;GAE7C,IAAI,QAAQ;IACV,YAAY,YACV;KACE,GAAG;KACH,YAAY;IACd,GACA,OAAO,MACT;IAEA,OAAO;GACT;EACF;EACA,YAAY;EAEZ,QAAQ,KAAK,eAAe;CAG9B,SAAS,OAAO;EACd,YAAY;EACZ,QAAQ,KAAK,oBAAoB,KAAK;CAExC;CAEA,gBAAgB,UAAU,SAAS;CAEnC,OAAO;AACT;;;;;;;;AASA,SAAS,UACP,aAAwC,CAAC,GACjC;CAER,IAAI,UAAoD,YACtD,mBACA,UACF;CACA,IAAI;CACJ,IAAI;CACJ,IAAI,QAAQ;CAEZ,OAAO;EACL,MAAM;EACN,SAAS;EAET,MAAM,eAAe,gBAAgB;GACnC,MAAM,YAAY,MAAM,cAAc;GACtC,UAAU,YAAY,WAAW,UAAU;GAG3C,SAAS;EACX;EACA,MAAM,gBAAgB,QAAQ;GAC5B,aAAa;GACb,MAAM,EAAE,SAAS,UAAU,GAAG,SAAS;GAEvC,IAAI,mBAAmB,SAAS,GAAG;IACjC,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,SAAS,UAAU;GAC9C;GAGA,OAAO,YAAY,IAAI,oBAAoB,IAAI,CAAC;EAClD;EAEA,MAAM,aAAa;GACjB,MAAM,cAAc,KAAK,MAAM;GAC/B,QAAQ,OAAO,YAAY,EAAE,KAAK;GAGlC,IAAI,CAAC,cAAc,QAAQ;IACzB,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,OAAO;GAClC;EACF;EACA,MAAM,UAAU,MAAc,IAAY,KAAyB;GAEjE,IACE,CAAC,KAAK,SAAS,sBAAsB,KACrC,KAAK,OACJ,KAAK,SAAS,sBAAsB,KACnC,OAAO,YAAY,aAErB,OAAO;GAGT,MAAM,OAAO,MAAM,OAAO;GAE1B,IAAI,mBAAmB,SAAS,GAAG;IACjC,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,OAAO;GAClC;GAKA,MAAM,SAAS,KAAK,cAAc,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE;GAClD,IAAI,CAAC,mBAAmB,IAAI,MAAM,GAChC,OAAO;GAGT,MAAM,cAAc,QAAQ,qBAAqB;GACjD,MAAM,WAAW,QAAQ,SAAS;GAClC,MAAM,SAAS,iBAAiB;IAC9B,WAAW,QAAQ;IACnB,SAAS,QAAQ;GACnB,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,YAAY,CAAC,QAAQ,IAAI;KAChD,WAAW;IACZ,WAAW;GAEb,CAAC;GAED,OAAO;IACL,MAAM,OAAO;IACb,KAAK,OAAO,MACR,OAAO,OAAO,QAAQ,WACpB,KAAK,MAAM,OAAO,GAAG,IACpB,OAAO,MACT;GACP;EACF;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/options.ts","../src/constants.ts","../src/functionsMap.ts","../src/validate.ts","../src/getClientModules.ts","../src/server-helpers.ts","../src/scanForServerFiles.ts","../src/index.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  let createServer: typeof import(\"vite\").createServer;\n  let normalizePath: typeof import(\"vite\").normalizePath;\n  try {\n    ({ createServer, normalizePath } = await import(\"vite\"));\n  } catch {\n    // Vite is not installed in this environment (e.g. a serverless bundle\n    // where Vite is externalized or absent). Server functions must have been\n    // imported directly into the prefix-scoped map; nothing to scan — exit\n    // gracefully instead of crashing the host's cold start with\n    // `Cannot find module 'vite'`.\n    return;\n  }\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","/** @module Main entrypoint for the RPC Vite plugin. Exports `rpcPlugin` (default) and `loadRPCConfig`. For a Vite-free `defineConfig`, use `@thednp/rpc/config`. */\nimport type { ConfigEnv, Plugin, ResolvedConfig, ViteDevServer } from \"vite\";\nimport { loadConfigFromFile, mergeConfig } from \"vite\";\nimport { resolve } from \"node:path\";\nimport process from \"node:process\";\nimport { existsSync } from \"node:fs\";\nimport { defaultRPCOptions } from \"./options.ts\";\nimport type { RpcPluginOptions, ScanConfig } from \"./types.d.ts\";\nimport {\n  CONFIG_FILE_NOT_FOUND,\n  FAILED_LOAD_CONFIG,\n  NO_CONFIG_FOUND,\n} from \"./constants.ts\";\n\nimport { getClientModules } from \"./getClientModules.ts\";\n// DEV server only\nimport {\n  scanForServerFiles,\n  scannedServerFiles,\n} from \"./scanForServerFiles.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\n\nimport { setGlobalPrefix } from \"@thednp/rpc/server\";\nimport { createRPCMiddleware } from \"@thednp/rpc/express\";\n\n/**\n * Loads and transforms a single RPC config file using Vite's config loader.\n * @param env - Vite config environment\n * @param file - Config file path (e.g. \"rpc.config.ts\")\n * @returns The loaded config augmented with the configFile path, or null on failure\n */\nconst loadConfigFile = async (env: ConfigEnv, file: string) => {\n  const result = await loadConfigFromFile(env, file) as {\n    path: string;\n    config: Partial<RpcPluginOptions>;\n    dependencies: string[];\n  } | null;\n  return result\n    ? { ...result, config: { ...result.config, configFile: file } }\n    : /* istanbul ignore next */ null;\n};\n\nlet RPCConfig: RpcPluginOptions;\n\n/**\n * Loads the RPC configuration by searching for config files in the project root.\n * Searches in order: `rpc.config.ts`, `rpc.config.js`, `rpc.config.mjs`, `rpc.config.mts`,\n * `.rpcrc.ts`, `.rpcrc.js`. Falls back to defaults if none found.\n * @param configFile - Optional explicit config file path; skips file search when provided\n * @returns Resolved RPC plugin options\n */\nconst loadRPCConfig: (f?: string) => Promise<RpcPluginOptions> = async (\n  configFile?: string,\n) => {\n  try {\n    // istanbul ignore next\n    const env: ConfigEnv & { root: string } = {\n      command: \"serve\",\n      root: process.cwd(),\n      mode: process.env.NODE_ENV || \"development\",\n    };\n    const defaultConfigFiles = [\n      \"rpc.config.ts\",\n      \"rpc.config.js\",\n      \"rpc.config.mjs\",\n      \"rpc.config.mts\",\n      \".rpcrc.ts\",\n      \".rpcrc.js\",\n    ];\n\n    // If specific config file provided\n    if (configFile) {\n      const configFilePath = resolve(env.root, configFile);\n      if (!existsSync(configFilePath)) {\n        console.warn(CONFIG_FILE_NOT_FOUND(configFile, configFilePath));\n        RPCConfig = defaultRPCOptions;\n        setGlobalPrefix(defaultRPCOptions.rpcPrefix);\n        return defaultRPCOptions as RpcPluginOptions;\n      }\n\n      const result = await loadConfigFile(env, configFile);\n      // istanbul ignore else\n      if (result && typeof result === \"object\") {\n        RPCConfig = mergeConfig(\n          {\n            ...defaultRPCOptions,\n            configFile: configFilePath,\n          },\n          result.config,\n        ) as RpcPluginOptions;\n\n        setGlobalPrefix(RPCConfig.rpcPrefix);\n        return RPCConfig;\n      }\n      // istanbul ignore next - this is a necessary fallback here\n      RPCConfig = defaultRPCOptions;\n    }\n\n    if (RPCConfig !== undefined) {\n      setGlobalPrefix(RPCConfig.rpcPrefix);\n\n      return RPCConfig;\n    }\n\n    // Try default config files\n    for (const file of defaultConfigFiles) {\n      const configFilePath = resolve(env.root, file);\n      // istanbul ignore else\n      if (!existsSync(configFilePath)) {\n        continue;\n      }\n\n      const result = await loadConfigFile(env, file);\n      // istanbul ignore else\n      if (result) {\n        RPCConfig = mergeConfig(\n          {\n            ...defaultRPCOptions,\n            configFile: configFilePath,\n          },\n          result.config,\n        ) as RpcPluginOptions;\n\n        return RPCConfig;\n      }\n    }\n    RPCConfig = defaultRPCOptions;\n    // Last call load defaults no matter what\n    console.warn(NO_CONFIG_FOUND);\n  } catch (error) {\n    RPCConfig = defaultRPCOptions;\n    console.warn(FAILED_LOAD_CONFIG, error);\n  }\n\n  setGlobalPrefix(RPCConfig.rpcPrefix);\n\n  return RPCConfig;\n};\n\n/**\n * Vite plugin that enables automatic RPC generation.\n * Transforms server function imports into fetch-based client stubs during development and production builds.\n * In dev mode, attaches the RPC middleware to Vite's Connect server.\n * @param devOptions - Development-only overrides (merged on top of config file values)\n * @returns A Vite plugin object\n */\nfunction rpcPlugin(\n  devOptions: Partial<RpcPluginOptions> = {},\n): Plugin {\n  // Internal type - adapters are handled at runtime\n  let options: RpcPluginOptions & { rpcPrefix: string } = mergeConfig(\n    defaultRPCOptions,\n    devOptions,\n  ) as RpcPluginOptions;\n  let config: ResolvedConfig;\n  let viteServer: ViteDevServer;\n  let isOxc = true;\n\n  return {\n    name: \"vite-plugin-universal-rpc\",\n    enforce: \"pre\",\n    // Plugin methods\n    async configResolved(resolvedConfig) {\n      const uniConfig = await loadRPCConfig();\n      options = mergeConfig(uniConfig, devOptions) as RpcPluginOptions;\n\n      config = resolvedConfig;\n    },\n    async configureServer(server) {\n      viteServer = server;\n      const { adapter: _adapter, ...rest } = options;\n      // istanbul ignore else\n      if (serverFunctionsMap.size === 0) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg, viteServer);\n      }\n\n      // in dev mode we always use express/connect adapter\n      server.middlewares.use(createRPCMiddleware(rest));\n    },\n\n    async buildStart() {\n      const viteVersion = this.meta?.viteVersion;\n      isOxc = Number(viteVersion[0]) >= 8;\n\n      // Prepare the server functions\n      if (!viteServer && config) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg);\n      }\n    },\n    async transform(code: string, id: string, ops?: { ssr?: boolean }) {\n      // Only transform files with server functions for client builds\n      if (\n        !code.includes(\"createServerFunction\") || // any other file is unchanged\n        ops?.ssr || // file loaded on server remains unchanged\n        (code.includes(\"createServerFunction\") &&\n          typeof process === \"undefined\") // file loaded in client IS CHANGED\n      ) {\n        return null;\n      }\n\n      const vite = await import(\"vite\");\n\n      if (serverFunctionsMap.size === 0) {\n        const scanCfg: ScanConfig = {\n          ...config,\n          serverFiles: options.serverFiles,\n          scanRoot: options.scanRoot,\n          rpcPrefix: options.rpcPrefix,\n        };\n        await scanForServerFiles(scanCfg);\n      }\n\n      // Only transform modules that were scanned as server function files:\n      // pages or docs mentioning `createServerFunction` in prose must not\n      // be rewritten into the generated client bundle.\n      const idPath = vite.normalizePath(id.split(\"?\")[0]);\n      if (!scannedServerFiles.has(idPath)) {\n        return null;\n      }\n\n      const transformer = isOxc ? \"transformWithOxc\" : \"transformWithEsbuild\";\n      const langProp = isOxc ? \"lang\" : \"loader\";\n      const source = getClientModules({\n        rpcPrefix: options.rpcPrefix,\n        adapter: options.adapter,\n      });\n\n      const result = await vite[transformer](source, id, {\n        [langProp]: \"js\",\n        sourcemap: true,\n        // target: \"es2023\"\n      });\n\n      return {\n        code: result.code,\n        map: result.map\n          ? typeof result.map === \"string\"\n            ? JSON.parse(result.map)\n            : /* istanbul ignore next @preserve */ result.map\n          : /* istanbul ignore next @preserve */ null,\n      };\n    },\n  } satisfies Plugin;\n}\n\nexport { rpcPlugin as default };\nexport { loadRPCConfig };\nexport type * from \"./types.d.ts\";\nexport {};\n"],"mappings":";;;;;;;;AAYA,MAAa,gBAAgB;AAE7B,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;;;ACbA,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;;AAqBlC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAGhC,MAAa,yBACX,YACA,mBAEA,sCAAsC,WAAW,sBAAsB,eAAe;AAExF,MAAa,kBAAkB;AAE/B,MAAa,qBAAqB;;AAGlC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;;;;;;;;;ACtCrC,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;AC9DA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;AChFA,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;ACnBA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,cAAc,iBAAkB,MAAM,OAAO;CAClD,QAAQ;EAMN;CACF;CACA,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAKF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;;;;;;;ACrJA,MAAM,iBAAiB,OAAO,KAAgB,SAAiB;CAC7D,MAAM,SAAS,MAAM,mBAAmB,KAAK,IAAI;CAKjD,OAAO,SACH;EAAE,GAAG;EAAQ,QAAQ;GAAE,GAAG,OAAO;GAAQ,YAAY;EAAK;CAAE,IAC3D;AACP;AAEA,IAAI;;;;;;;;AASJ,MAAM,gBAA2D,OAC/D,eACG;CACH,IAAI;EAEF,MAAM,MAAoC;GACxC,SAAS;GACT,MAAM,QAAQ,IAAI;GAClB,MAAM,QAAQ,IAAI,YAAY;EAChC;EACA,MAAM,qBAAqB;GACzB;GACA;GACA;GACA;GACA;GACA;EACF;EAGA,IAAI,YAAY;GACd,MAAM,iBAAiB,QAAQ,IAAI,MAAM,UAAU;GACnD,IAAI,CAAC,WAAW,cAAc,GAAG;IAC/B,QAAQ,KAAK,sBAAsB,YAAY,cAAc,CAAC;IAC9D,YAAY;IACZ,gBAAgB,kBAAkB,SAAS;IAC3C,OAAO;GACT;GAEA,MAAM,SAAS,MAAM,eAAe,KAAK,UAAU;GAEnD,IAAI,UAAU,OAAO,WAAW,UAAU;IACxC,YAAY,YACV;KACE,GAAG;KACH,YAAY;IACd,GACA,OAAO,MACT;IAEA,gBAAgB,UAAU,SAAS;IACnC,OAAO;GACT;GAEA,YAAY;EACd;EAEA,IAAI,cAAc,KAAA,GAAW;GAC3B,gBAAgB,UAAU,SAAS;GAEnC,OAAO;EACT;EAGA,KAAK,MAAM,QAAQ,oBAAoB;GACrC,MAAM,iBAAiB,QAAQ,IAAI,MAAM,IAAI;GAE7C,IAAI,CAAC,WAAW,cAAc,GAC5B;GAGF,MAAM,SAAS,MAAM,eAAe,KAAK,IAAI;GAE7C,IAAI,QAAQ;IACV,YAAY,YACV;KACE,GAAG;KACH,YAAY;IACd,GACA,OAAO,MACT;IAEA,OAAO;GACT;EACF;EACA,YAAY;EAEZ,QAAQ,KAAK,eAAe;CAC9B,SAAS,OAAO;EACd,YAAY;EACZ,QAAQ,KAAK,oBAAoB,KAAK;CACxC;CAEA,gBAAgB,UAAU,SAAS;CAEnC,OAAO;AACT;;;;;;;;AASA,SAAS,UACP,aAAwC,CAAC,GACjC;CAER,IAAI,UAAoD,YACtD,mBACA,UACF;CACA,IAAI;CACJ,IAAI;CACJ,IAAI,QAAQ;CAEZ,OAAO;EACL,MAAM;EACN,SAAS;EAET,MAAM,eAAe,gBAAgB;GACnC,MAAM,YAAY,MAAM,cAAc;GACtC,UAAU,YAAY,WAAW,UAAU;GAE3C,SAAS;EACX;EACA,MAAM,gBAAgB,QAAQ;GAC5B,aAAa;GACb,MAAM,EAAE,SAAS,UAAU,GAAG,SAAS;GAEvC,IAAI,mBAAmB,SAAS,GAAG;IACjC,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,SAAS,UAAU;GAC9C;GAGA,OAAO,YAAY,IAAI,oBAAoB,IAAI,CAAC;EAClD;EAEA,MAAM,aAAa;GACjB,MAAM,cAAc,KAAK,MAAM;GAC/B,QAAQ,OAAO,YAAY,EAAE,KAAK;GAGlC,IAAI,CAAC,cAAc,QAAQ;IACzB,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,OAAO;GAClC;EACF;EACA,MAAM,UAAU,MAAc,IAAY,KAAyB;GAEjE,IACE,CAAC,KAAK,SAAS,sBAAsB,KACrC,KAAK,OACJ,KAAK,SAAS,sBAAsB,KACnC,OAAO,YAAY,aAErB,OAAO;GAGT,MAAM,OAAO,MAAM,OAAO;GAE1B,IAAI,mBAAmB,SAAS,GAAG;IACjC,MAAM,UAAsB;KAC1B,GAAG;KACH,aAAa,QAAQ;KACrB,UAAU,QAAQ;KAClB,WAAW,QAAQ;IACrB;IACA,MAAM,mBAAmB,OAAO;GAClC;GAKA,MAAM,SAAS,KAAK,cAAc,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE;GAClD,IAAI,CAAC,mBAAmB,IAAI,MAAM,GAChC,OAAO;GAGT,MAAM,cAAc,QAAQ,qBAAqB;GACjD,MAAM,WAAW,QAAQ,SAAS;GAClC,MAAM,SAAS,iBAAiB;IAC9B,WAAW,QAAQ;IACnB,SAAS,QAAQ;GACnB,CAAC;GAED,MAAM,SAAS,MAAM,KAAK,YAAY,CAAC,QAAQ,IAAI;KAChD,WAAW;IACZ,WAAW;GAEb,CAAC;GAED,OAAO;IACL,MAAM,OAAO;IACb,KAAK,OAAO,MACR,OAAO,OAAO,QAAQ,WACpB,KAAK,MAAM,OAAO,GAAG,IACpB,OAAO,MACT;GACP;EACF;CACF;AACF"}

package/dist/server/server.mjs

@@ -225,7 +225,13 @@ const EXACT_NAMES = [
 */
 const scanForServerFiles = async (initialCfg, devServer) => {
 	if (isScanned && !devServer) return;
-	const { createServer, normalizePath } = await import("vite");
+	let createServer;
+	let normalizePath;
+	try {
+		({createServer, normalizePath} = await import("vite"));
+	} catch {
+		return;
+	}
 	const config = !initialCfg && !devServer || !initialCfg ? {
 		root: process.cwd(),
 		base: process.env.BASE || "/",

package/dist/server/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts","../../src/context.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  const { createServer, normalizePath } = await import(\"vite\");\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","/** @module Server function creation and registration. */\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix, defaultServerFnOptions } from \"./options.ts\";\nimport { getGlobalPrefix } from \"./server-helpers.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Extended options for createServerFunction, including rpcPrefix for multi-instance support.\n */\nexport interface CreateServerFunctionOptions\n  extends Partial<ServerFunctionOptions> {\n  /**\n   * RPC prefix for this function. Enables multiple RPC instances with different prefixes.\n   * When using multi-prefix setup, functions with the same name but different prefixes\n   * can coexist without collision.\n   * @default \"__rpc\"\n   * @example\n   * // v1 API\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, email, password) => ({...}),\n   *   { rpcPrefix: \"v1:rpc\" },\n   * );\n   *\n   * // v2 API - same function name, different prefix\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, credentials) => ({...}),\n   *   { rpcPrefix: \"v2:rpc\" },\n   * );\n   */\n  rpcPrefix?: string;\n}\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map (scoped by rpcPrefix) and returns\n * a client-compatible wrapper that exposes `data` (Promise) and `cancel` (function)\n * for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType, credentials, and rpcPrefix settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult extends JsonValue = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: CreateServerFunctionOptions = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n  const rpcPrefix = fnOptions.rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  // Register to prefix-scoped map\n  const prefixMap = getFunctionsForPrefix(rpcPrefix);\n  prefixMap.set(name, {\n    name,\n    handler: wrappedFunction as never,\n    options,\n  });\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, `redirect` and `sendResponse` for framework-level short-circuits, and `getRequestMeta` for normalized request access. Never import this module in client code — it is server-only. */\n\n// @thednp/rpc/src/context.ts\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { JsonValue } from \"./types.d.ts\";\nimport { safeURL } from \"./server-helpers.ts\";\n\n/**\n * Global symbol under which the shared `AsyncLocalStorage` instance is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across module copies and dev-server hot reloads, mirroring\n * `solid-js/web`'s own request-context storage.\n */\nconst requestContextSymbol = Symbol.for(\"thednp.rpc.requestContext\");\n\n/**\n * A per-request context established by the framework adapters around\n * server-function dispatch, mirroring Solid Start's `FetchEvent`. Any code\n * running in the async tree of a dispatch can read the current context through\n * {@link getRequestContext} instead of threading `req`/`res` (or the framework\n * `Context` object) through every nested call. This module is server-only and\n * must never be imported by client code.\n *\n * Each adapter extends this with framework-specific request/response accessors:\n * - Express: `req`/`res` plus `nativeEvent = { req, res }`\n * - Fastify: `request`/`reply` plus `nativeEvent = request`\n * - Koa: `ctx` plus `nativeEvent = ctx`\n * - Hono: `c` (the Hono `Context`) plus `nativeEvent = c`\n * - h3: `event` (the h3 `H3Event`) plus `nativeEvent = event`\n */\nexport interface RequestEvent {\n  /** Adapter-specific native event kept for deep framework access */\n  nativeEvent?: unknown;\n  /** Adapter request object */\n  request: unknown;\n  /** Adapter response object */\n  response: unknown;\n  /**\n   * Bound adapter-native redirect. Performing a redirect sets `redirected`\n   * so the middleware can skip the JSON `{ data }` send.\n   * @param location - The URL to redirect to\n   * @param status - HTTP status code, defaults to `303 See Other`\n   */\n  redirect: (location: string, status?: number) => void;\n  /**\n   * Set by `redirect` once a redirect has been issued. The middleware checks\n   * this after `await`ing the server function to avoid double-responding.\n   */\n  redirected?: { location: string; status: number };\n  /**\n   * Bound adapter-native response short-circuit. Writes the given status and\n   * JSON body (plus optional headers) directly, bypassing the standard\n   * `{ data }` response. Setting `sent` makes the middleware skip the JSON\n   * `{ data }` send, mirroring `redirect`/`redirected`.\n   * @param status - HTTP status code (e.g. 401, 413, 429)\n   * @param body - JSON-serializable response body\n   * @param headers - Optional response headers (e.g. `{ \"Retry-After\": \"60\" }`)\n   */\n  send: (\n    status: number,\n    body: JsonValue,\n    headers?: Record<string, string>,\n  ) => void;\n  /**\n   * Set by `send` once a response has been issued. The middleware checks this\n   * after `await`ing the server function to avoid double-responding.\n   */\n  sent?: { status: number; body: JsonValue; headers?: Record<string, string> };\n  /**\n   * The matched RPC function name for the current request, when available.\n   * Useful for per-function rate limiting or auditing inside middleware.\n   */\n  functionName?: string;\n  /** Per-request app data shared across the async tree of the dispatch */\n  locals: Record<string, unknown>;\n  [prop: string]: unknown;\n}\n\n// Instance-stable across module copies and dev-server hot reloads, exactly like\n// `solid-js/web`'s `provideRequestEvent` (which stores on a globalThis symbol).\nconst requestContextStorage: AsyncLocalStorage<RequestEvent> =\n  ((globalThis as Record<symbol, AsyncLocalStorage<RequestEvent>>)[\n    requestContextSymbol\n  ] ??= new AsyncLocalStorage<RequestEvent>());\n\n/**\n * Runs `cb` with `init` as the current request context. Use inside the\n * adapters around server-function dispatch (the async tree under `cb` can then\n * read the context via {@link getRequestContext}).\n * @param init - The request context for the duration of `cb`\n * @param cb - The work that needs access to the request context\n */\nexport const provideRequestContext = <T>(\n  init: RequestEvent,\n  cb: () => T,\n): T => requestContextStorage.run(init, cb);\n\n/**\n * Returns the current request context, or throws when called outside of a\n * request (e.g. module scope or a background task).\n * @throws When no request context is established\n */\nexport const getRequestContext = (): RequestEvent => {\n  const ctx = requestContextStorage.getStore();\n  if (!ctx) {\n    throw new Error(\"RequestEvent is not available outside of a request\");\n  }\n  return ctx;\n};\n\n/**\n * Redirects the current request to `location`. Reads the adapter-bound\n * `redirect` from the current request context — callable from anywhere inside\n * a server-function tree (no `res` threading needed).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to `303 See Other`\n * @throws When called outside of a request\n */\nexport const redirect = (location: string, status = 303): void => {\n  getRequestContext().redirect(location, status);\n};\n\n/**\n * Sends a raw JSON response for the current request, bypassing the standard\n * `{ data }` shape. Reads the adapter-bound `send` from the current request\n * context — callable from anywhere inside a server-function tree. Any code in\n * the async tree of a dispatch can call this (e.g. custom middleware) to\n * short-circuit with a specific status code (401, 413, 429, ...).\n * @param status - HTTP status code\n * @param body - JSON-serializable response body\n * @param headers - Optional response headers\n * @throws When called outside of a request\n */\nexport const sendResponse = (\n  status: number,\n  body: JsonValue,\n  headers?: Record<string, string>,\n): void => {\n  getRequestContext().send(status, body, headers);\n};\n\n/**\n * Normalized, adapter-agnostic view of the current request. Reads the request\n * object off the current request context and normalizes it across the five\n * adapter request shapes (Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req`, h3 `event.req`) so middleware can be written once.\n */\nexport interface RequestMeta {\n  /** HTTP method, upper-cased (e.g. \"GET\", \"POST\") */\n  method: string;\n  /** URL pathname (e.g. \"/__rpc/greet\") */\n  pathname: string;\n  /** Raw search string including the leading \"?\", or \"\" when absent */\n  search: string;\n  /** Parsed search params */\n  searchParams: URLSearchParams;\n  /** Request headers, lower-cased */\n  headers: Record<string, string | string[] | undefined>;\n  /** Host header value (e.g. \"localhost:5173\"), when present */\n  host?: string;\n  /** Client IP when the framework exposes it (e.g. Fastify `req.ip`) */\n  ip?: string;\n  /** Request protocol (\"http\" or \"https\"), when determinable */\n  protocol?: string;\n}\n\nconst pickHeader = (\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined => {\n  const value = headers[name];\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[0];\n  return undefined;\n};\n\n/** Normalizes any headers shape into a plain lower-cased record. */\nconst toHeaderRecord = (\n  headers: unknown,\n): Record<string, string | string[] | undefined> => {\n  if (!headers) return {};\n  // Headers-like object (h3 Request, Hono c.req.raw.headers, fetch Headers)\n  if (typeof (headers as Headers).forEach === \"function\") {\n    const record: Record<string, string> = {};\n    (headers as Headers).forEach((value, key) => {\n      record[key] = value;\n    });\n    return record;\n  }\n  // Plain map (Express req.headers, Fastify req.headers, Koa ctx.req.headers)\n  return headers as Record<string, string | string[] | undefined>;\n};\n\n/**\n * Reads normalized, adapter-agnostic request metadata from the current request\n * context. Works with Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req` and h3 `event.req` by feature-detecting the request shape\n * (`originalUrl`/`url`/`path`, raw `headers` map vs `Headers`-like API).\n * @param event - The request context to read, typically the result of\n *   {@link getRequestContext}\n */\nexport const getRequestMeta = (event: RequestEvent): RequestMeta => {\n  const req = event.request as {\n    method?: string;\n    originalUrl?: string;\n    url?: string;\n    path?: string;\n    headers?: unknown;\n    header?: (name: string) => string | string[] | undefined;\n    ip?: string;\n    protocol?: string;\n    socket?: { remoteAddress?: string };\n  } | undefined;\n\n  const method = (req?.method ?? \"GET\").toUpperCase();\n  const rawUrl = req?.originalUrl ?? req?.url ?? req?.path ?? \"\";\n  const url = safeURL(rawUrl);\n  const headers = toHeaderRecord(req?.headers);\n  const hostHeader = pickHeader(headers, \"host\");\n\n  return {\n    method,\n    pathname: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers,\n    host: hostHeader,\n    ip: req?.ip ?? req?.socket?.remoteAddress,\n    protocol: req?.protocol ?? url.protocol.replace(\":\", \"\"),\n  };\n};\n"],"mappings":";;;;;AAMA,MAAa,yBAAgD;CAC3D,aAAa;CACb,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,gBAAgB;AAE7B,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;ACjEA,MAAa,oBAAoB;AAMjC,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;AAYlC,MAAa,wBAAwB;;AASrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAchC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;AC1CrC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;;;;;AAQA,MAAa,qBAAqB,gBAChC,gBAAgB,yBAChB,gBAAgB;;;;;;;;;;;AAYlB,MAAa,0BACX,UACA,cACY;CAEZ,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;CACvE,IAAI,kBAAkB,QAAQ,GAE5B,OAAO,CAAC,kBAAkB,YAAY;CAExC,OAAO,iBAAiB;AAC1B;;;;;;;;AASA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAEA,MAAM,gBAAgB;;;;;;;;;;;;;;AAetB,MAAa,WAAW,QAAgB,OAAO,kBAAuB;CACpE,IAAI;EACF,OAAO,IAAI,IAAI,QAAQ,IAAI;CAC7B,QAAQ;EACN,OAAO,IAAI,IAAI,KAAK,IAAI;CAC1B;AACF;AAEA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;AAG/D,MAAa,wBACV,WACC;AAGJ,MAAa,mBAAmB,WAAqC;CACnE,IAAI,QACF,WACE,sBACE;MAEJ,OAAQ,WACN;AAGN;;;ACxJA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,MAAM,EAAE,cAAc,kBAAkB,MAAM,OAAO;CACrD,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAKF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;;;;;;;;;;;ACtHA,SAAgB,qBAId,MACA,SACA,YAAyC,CAAC,GACV;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CACnE,MAAM,YAAY,UAAU,aAAa,gBAAgB,KAAA;CAEzD,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAID,sBADwC,SAChC,CAAC,CAAC,IAAI,MAAM;EAClB;EACA,SAAS;EACT;CACF,CAAC;CAED,OAAO;AACT;;;AC3FA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;;;;;;;;AC1EA,MAAM,uBAAuB,OAAO,IAAI,2BAA2B;AAmEnE,MAAM,wBACH,WACC,0BACI,IAAI,kBAAgC;;;;;;;;AAS5C,MAAa,yBACX,MACA,OACM,sBAAsB,IAAI,MAAM,EAAE;;;;;;AAO1C,MAAa,0BAAwC;CACnD,MAAM,MAAM,sBAAsB,SAAS;CAC3C,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;AACT;;;;;;;;;AAUA,MAAa,YAAY,UAAkB,SAAS,QAAc;CAChE,kBAAkB,CAAC,CAAC,SAAS,UAAU,MAAM;AAC/C;;;;;;;;;;;;AAaA,MAAa,gBACX,QACA,MACA,YACS;CACT,kBAAkB,CAAC,CAAC,KAAK,QAAQ,MAAM,OAAO;AAChD;AA2BA,MAAM,cACJ,SACA,SACuB;CACvB,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;AAEzC;;AAGA,MAAM,kBACJ,YACkD;CAClD,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,IAAI,OAAQ,QAAoB,YAAY,YAAY;EACtD,MAAM,SAAiC,CAAC;EACxC,QAAqB,SAAS,OAAO,QAAQ;GAC3C,OAAO,OAAO;EAChB,CAAC;EACD,OAAO;CACT;CAEA,OAAO;AACT;;;;;;;;;AAUA,MAAa,kBAAkB,UAAqC;CAClE,MAAM,MAAM,MAAM;CAYlB,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;CAClD,MAAM,SAAS,KAAK,eAAe,KAAK,OAAO,KAAK,QAAQ;CAC5D,MAAM,MAAM,QAAQ,MAAM;CAC1B,MAAM,UAAU,eAAe,KAAK,OAAO;CAC3C,MAAM,aAAa,WAAW,SAAS,MAAM;CAE7C,OAAO;EACL;EACA,UAAU,IAAI;EACd,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB;EACA,MAAM;EACN,IAAI,KAAK,MAAM,KAAK,QAAQ;EAC5B,UAAU,KAAK,YAAY,IAAI,SAAS,QAAQ,KAAK,EAAE;CACzD;AACF"}
+{"version":3,"file":"server.mjs","names":[],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts","../../src/context.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  let createServer: typeof import(\"vite\").createServer;\n  let normalizePath: typeof import(\"vite\").normalizePath;\n  try {\n    ({ createServer, normalizePath } = await import(\"vite\"));\n  } catch {\n    // Vite is not installed in this environment (e.g. a serverless bundle\n    // where Vite is externalized or absent). Server functions must have been\n    // imported directly into the prefix-scoped map; nothing to scan — exit\n    // gracefully instead of crashing the host's cold start with\n    // `Cannot find module 'vite'`.\n    return;\n  }\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","/** @module Server function creation and registration. */\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix, defaultServerFnOptions } from \"./options.ts\";\nimport { getGlobalPrefix } from \"./server-helpers.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Extended options for createServerFunction, including rpcPrefix for multi-instance support.\n */\nexport interface CreateServerFunctionOptions\n  extends Partial<ServerFunctionOptions> {\n  /**\n   * RPC prefix for this function. Enables multiple RPC instances with different prefixes.\n   * When using multi-prefix setup, functions with the same name but different prefixes\n   * can coexist without collision.\n   * @default \"__rpc\"\n   * @example\n   * // v1 API\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, email, password) => ({...}),\n   *   { rpcPrefix: \"v1:rpc\" },\n   * );\n   *\n   * // v2 API - same function name, different prefix\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, credentials) => ({...}),\n   *   { rpcPrefix: \"v2:rpc\" },\n   * );\n   */\n  rpcPrefix?: string;\n}\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map (scoped by rpcPrefix) and returns\n * a client-compatible wrapper that exposes `data` (Promise) and `cancel` (function)\n * for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType, credentials, and rpcPrefix settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult extends JsonValue = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: CreateServerFunctionOptions = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n  const rpcPrefix = fnOptions.rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  // Register to prefix-scoped map\n  const prefixMap = getFunctionsForPrefix(rpcPrefix);\n  prefixMap.set(name, {\n    name,\n    handler: wrappedFunction as never,\n    options,\n  });\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, `redirect` and `sendResponse` for framework-level short-circuits, and `getRequestMeta` for normalized request access. Never import this module in client code — it is server-only. */\n\n// @thednp/rpc/src/context.ts\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { JsonValue } from \"./types.d.ts\";\nimport { safeURL } from \"./server-helpers.ts\";\n\n/**\n * Global symbol under which the shared `AsyncLocalStorage` instance is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across module copies and dev-server hot reloads, mirroring\n * `solid-js/web`'s own request-context storage.\n */\nconst requestContextSymbol = Symbol.for(\"thednp.rpc.requestContext\");\n\n/**\n * A per-request context established by the framework adapters around\n * server-function dispatch, mirroring Solid Start's `FetchEvent`. Any code\n * running in the async tree of a dispatch can read the current context through\n * {@link getRequestContext} instead of threading `req`/`res` (or the framework\n * `Context` object) through every nested call. This module is server-only and\n * must never be imported by client code.\n *\n * Each adapter extends this with framework-specific request/response accessors:\n * - Express: `req`/`res` plus `nativeEvent = { req, res }`\n * - Fastify: `request`/`reply` plus `nativeEvent = request`\n * - Koa: `ctx` plus `nativeEvent = ctx`\n * - Hono: `c` (the Hono `Context`) plus `nativeEvent = c`\n * - h3: `event` (the h3 `H3Event`) plus `nativeEvent = event`\n */\nexport interface RequestEvent {\n  /** Adapter-specific native event kept for deep framework access */\n  nativeEvent?: unknown;\n  /** Adapter request object */\n  request: unknown;\n  /** Adapter response object */\n  response: unknown;\n  /**\n   * Bound adapter-native redirect. Performing a redirect sets `redirected`\n   * so the middleware can skip the JSON `{ data }` send.\n   * @param location - The URL to redirect to\n   * @param status - HTTP status code, defaults to `303 See Other`\n   */\n  redirect: (location: string, status?: number) => void;\n  /**\n   * Set by `redirect` once a redirect has been issued. The middleware checks\n   * this after `await`ing the server function to avoid double-responding.\n   */\n  redirected?: { location: string; status: number };\n  /**\n   * Bound adapter-native response short-circuit. Writes the given status and\n   * JSON body (plus optional headers) directly, bypassing the standard\n   * `{ data }` response. Setting `sent` makes the middleware skip the JSON\n   * `{ data }` send, mirroring `redirect`/`redirected`.\n   * @param status - HTTP status code (e.g. 401, 413, 429)\n   * @param body - JSON-serializable response body\n   * @param headers - Optional response headers (e.g. `{ \"Retry-After\": \"60\" }`)\n   */\n  send: (\n    status: number,\n    body: JsonValue,\n    headers?: Record<string, string>,\n  ) => void;\n  /**\n   * Set by `send` once a response has been issued. The middleware checks this\n   * after `await`ing the server function to avoid double-responding.\n   */\n  sent?: { status: number; body: JsonValue; headers?: Record<string, string> };\n  /**\n   * The matched RPC function name for the current request, when available.\n   * Useful for per-function rate limiting or auditing inside middleware.\n   */\n  functionName?: string;\n  /** Per-request app data shared across the async tree of the dispatch */\n  locals: Record<string, unknown>;\n  [prop: string]: unknown;\n}\n\n// Instance-stable across module copies and dev-server hot reloads, exactly like\n// `solid-js/web`'s `provideRequestEvent` (which stores on a globalThis symbol).\nconst requestContextStorage: AsyncLocalStorage<RequestEvent> =\n  ((globalThis as Record<symbol, AsyncLocalStorage<RequestEvent>>)[\n    requestContextSymbol\n  ] ??= new AsyncLocalStorage<RequestEvent>());\n\n/**\n * Runs `cb` with `init` as the current request context. Use inside the\n * adapters around server-function dispatch (the async tree under `cb` can then\n * read the context via {@link getRequestContext}).\n * @param init - The request context for the duration of `cb`\n * @param cb - The work that needs access to the request context\n */\nexport const provideRequestContext = <T>(\n  init: RequestEvent,\n  cb: () => T,\n): T => requestContextStorage.run(init, cb);\n\n/**\n * Returns the current request context, or throws when called outside of a\n * request (e.g. module scope or a background task).\n * @throws When no request context is established\n */\nexport const getRequestContext = (): RequestEvent => {\n  const ctx = requestContextStorage.getStore();\n  if (!ctx) {\n    throw new Error(\"RequestEvent is not available outside of a request\");\n  }\n  return ctx;\n};\n\n/**\n * Redirects the current request to `location`. Reads the adapter-bound\n * `redirect` from the current request context — callable from anywhere inside\n * a server-function tree (no `res` threading needed).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to `303 See Other`\n * @throws When called outside of a request\n */\nexport const redirect = (location: string, status = 303): void => {\n  getRequestContext().redirect(location, status);\n};\n\n/**\n * Sends a raw JSON response for the current request, bypassing the standard\n * `{ data }` shape. Reads the adapter-bound `send` from the current request\n * context — callable from anywhere inside a server-function tree. Any code in\n * the async tree of a dispatch can call this (e.g. custom middleware) to\n * short-circuit with a specific status code (401, 413, 429, ...).\n * @param status - HTTP status code\n * @param body - JSON-serializable response body\n * @param headers - Optional response headers\n * @throws When called outside of a request\n */\nexport const sendResponse = (\n  status: number,\n  body: JsonValue,\n  headers?: Record<string, string>,\n): void => {\n  getRequestContext().send(status, body, headers);\n};\n\n/**\n * Normalized, adapter-agnostic view of the current request. Reads the request\n * object off the current request context and normalizes it across the five\n * adapter request shapes (Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req`, h3 `event.req`) so middleware can be written once.\n */\nexport interface RequestMeta {\n  /** HTTP method, upper-cased (e.g. \"GET\", \"POST\") */\n  method: string;\n  /** URL pathname (e.g. \"/__rpc/greet\") */\n  pathname: string;\n  /** Raw search string including the leading \"?\", or \"\" when absent */\n  search: string;\n  /** Parsed search params */\n  searchParams: URLSearchParams;\n  /** Request headers, lower-cased */\n  headers: Record<string, string | string[] | undefined>;\n  /** Host header value (e.g. \"localhost:5173\"), when present */\n  host?: string;\n  /** Client IP when the framework exposes it (e.g. Fastify `req.ip`) */\n  ip?: string;\n  /** Request protocol (\"http\" or \"https\"), when determinable */\n  protocol?: string;\n}\n\nconst pickHeader = (\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined => {\n  const value = headers[name];\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[0];\n  return undefined;\n};\n\n/** Normalizes any headers shape into a plain lower-cased record. */\nconst toHeaderRecord = (\n  headers: unknown,\n): Record<string, string | string[] | undefined> => {\n  if (!headers) return {};\n  // Headers-like object (h3 Request, Hono c.req.raw.headers, fetch Headers)\n  if (typeof (headers as Headers).forEach === \"function\") {\n    const record: Record<string, string> = {};\n    (headers as Headers).forEach((value, key) => {\n      record[key] = value;\n    });\n    return record;\n  }\n  // Plain map (Express req.headers, Fastify req.headers, Koa ctx.req.headers)\n  return headers as Record<string, string | string[] | undefined>;\n};\n\n/**\n * Reads normalized, adapter-agnostic request metadata from the current request\n * context. Works with Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req` and h3 `event.req` by feature-detecting the request shape\n * (`originalUrl`/`url`/`path`, raw `headers` map vs `Headers`-like API).\n * @param event - The request context to read, typically the result of\n *   {@link getRequestContext}\n */\nexport const getRequestMeta = (event: RequestEvent): RequestMeta => {\n  const req = event.request as {\n    method?: string;\n    originalUrl?: string;\n    url?: string;\n    path?: string;\n    headers?: unknown;\n    header?: (name: string) => string | string[] | undefined;\n    ip?: string;\n    protocol?: string;\n    socket?: { remoteAddress?: string };\n  } | undefined;\n\n  const method = (req?.method ?? \"GET\").toUpperCase();\n  const rawUrl = req?.originalUrl ?? req?.url ?? req?.path ?? \"\";\n  const url = safeURL(rawUrl);\n  const headers = toHeaderRecord(req?.headers);\n  const hostHeader = pickHeader(headers, \"host\");\n\n  return {\n    method,\n    pathname: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers,\n    host: hostHeader,\n    ip: req?.ip ?? req?.socket?.remoteAddress,\n    protocol: req?.protocol ?? url.protocol.replace(\":\", \"\"),\n  };\n};\n"],"mappings":";;;;;AAMA,MAAa,yBAAgD;CAC3D,aAAa;CACb,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,gBAAgB;AAE7B,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;ACjEA,MAAa,oBAAoB;AAMjC,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;AAYlC,MAAa,wBAAwB;;AASrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAchC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;AC1CrC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;;;;;AAQA,MAAa,qBAAqB,gBAChC,gBAAgB,yBAChB,gBAAgB;;;;;;;;;;;AAYlB,MAAa,0BACX,UACA,cACY;CAEZ,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;CACvE,IAAI,kBAAkB,QAAQ,GAE5B,OAAO,CAAC,kBAAkB,YAAY;CAExC,OAAO,iBAAiB;AAC1B;;;;;;;;AASA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAEA,MAAM,gBAAgB;;;;;;;;;;;;;;AAetB,MAAa,WAAW,QAAgB,OAAO,kBAAuB;CACpE,IAAI;EACF,OAAO,IAAI,IAAI,QAAQ,IAAI;CAC7B,QAAQ;EACN,OAAO,IAAI,IAAI,KAAK,IAAI;CAC1B;AACF;AAEA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;AAG/D,MAAa,wBACV,WACC;AAGJ,MAAa,mBAAmB,WAAqC;CACnE,IAAI,QACF,WACE,sBACE;MAEJ,OAAQ,WACN;AAGN;;;ACxJA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,cAAc,iBAAkB,MAAM,OAAO;CAClD,QAAQ;EAMN;CACF;CACA,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAKF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;;;;;;;;;;;ACjIA,SAAgB,qBAId,MACA,SACA,YAAyC,CAAC,GACV;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CACnE,MAAM,YAAY,UAAU,aAAa,gBAAgB,KAAA;CAEzD,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAID,sBADwC,SAChC,CAAC,CAAC,IAAI,MAAM;EAClB;EACA,SAAS;EACT;CACF,CAAC;CAED,OAAO;AACT;;;AC3FA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;;;;;;;;AC1EA,MAAM,uBAAuB,OAAO,IAAI,2BAA2B;AAmEnE,MAAM,wBACH,WACC,0BACI,IAAI,kBAAgC;;;;;;;;AAS5C,MAAa,yBACX,MACA,OACM,sBAAsB,IAAI,MAAM,EAAE;;;;;;AAO1C,MAAa,0BAAwC;CACnD,MAAM,MAAM,sBAAsB,SAAS;CAC3C,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;AACT;;;;;;;;;AAUA,MAAa,YAAY,UAAkB,SAAS,QAAc;CAChE,kBAAkB,CAAC,CAAC,SAAS,UAAU,MAAM;AAC/C;;;;;;;;;;;;AAaA,MAAa,gBACX,QACA,MACA,YACS;CACT,kBAAkB,CAAC,CAAC,KAAK,QAAQ,MAAM,OAAO;AAChD;AA2BA,MAAM,cACJ,SACA,SACuB;CACvB,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;AAEzC;;AAGA,MAAM,kBACJ,YACkD;CAClD,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,IAAI,OAAQ,QAAoB,YAAY,YAAY;EACtD,MAAM,SAAiC,CAAC;EACxC,QAAqB,SAAS,OAAO,QAAQ;GAC3C,OAAO,OAAO;EAChB,CAAC;EACD,OAAO;CACT;CAEA,OAAO;AACT;;;;;;;;;AAUA,MAAa,kBAAkB,UAAqC;CAClE,MAAM,MAAM,MAAM;CAYlB,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;CAClD,MAAM,SAAS,KAAK,eAAe,KAAK,OAAO,KAAK,QAAQ;CAC5D,MAAM,MAAM,QAAQ,MAAM;CAC1B,MAAM,UAAU,eAAe,KAAK,OAAO;CAC3C,MAAM,aAAa,WAAW,SAAS,MAAM;CAE7C,OAAO;EACL;EACA,UAAU,IAAI;EACd,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB;EACA,MAAM;EACN,IAAI,KAAK,MAAM,KAAK,QAAQ;EAC5B,UAAU,KAAK,YAAY,IAAI,SAAS,QAAQ,KAAK,EAAE;CACzD;AACF"}

package/llms.txt

@@ -0,0 +1,81 @@
+# @thednp/rpc
+
+Vite plugin for automatic RPC generation from server functions. One module (`src/api/server.ts`), two resolutions: real functions on SSR/Node, fetch stubs in the browser. Types flow through because tsc sees the source module — only the Vite bundler swaps the implementation.
+
+## Core API
+- `createServerFunction(name, handler, options?)` — define a server function: first arg is `AbortSignal`, remaining args are JSON-serializable
+- `import { fn } from "./api"` — on the server calls the real handler, in the browser calls auto-generated `fetch` stubs
+- Returns `{ data: Promise<T>, cancel: (reason: string) => void }`
+- Options: `{ method: "GET" | "POST", contentType: "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data", credentials, rpcPrefix }`
+- **Multi-prefix**: `rpcPrefix` (default `"__rpc"` via the exported `defaultPrefix` constant) registers the function in a prefix-scoped map (`getFunctionsForPrefix(prefix)`). Same names can coexist under different prefixes (versioned/namespaced APIs); middleware dispatches to the prefix-scoped map; the plugin generates client stubs per prefix. See `wiki/multi-prefix-guide.md`
+- `RPCError(message, code?, data?)` — throwable typed error, exported from `@thednp/rpc/server` (as is `formatError`); throw for server-side failures (not validation — return `{ error }` for expected user-facing problems). Dev 500 body: `{ error, code, data }`; prod: generic `{ error: "Internal Server Error" }` only. Client rejection `message` = the error string
+- `provideRequestContext(init, cb)` / `getRequestContext()` — per-request `AsyncLocalStorage` context available to all server function code; `RequestEvent` includes `nativeEvent`, `locals`, adapter-bound `redirect`; works across Express/Fastify/Hono/Koa/h3
+- Registered function names become URL paths: `POST /{prefix}/{name}` with body `JSON.stringify(args)`
+
+## Wire Protocol (client module → server)
+- **POST (default):** `/{prefix}/{fnName}` body = `JSON.stringify(args)` (bare JSON array, not `{data:[...]}`)
+- **text/plain** POST: body = `args[0]` as raw string
+- **application/x-www-form-urlencoded** POST: body = `new URLSearchParams(args[0]).toString()` (single object arg; server parses back to an object of strings via `URLSearchParams`)
+- **multipart/form-data** POST: client sends the `FormData` passed as the first argument (browser sets the boundary). Server-side, parse before the handler runs — framework multipart middleware BEFORE the RPC middleware (multer, @fastify/multipart, koa-body, hono formData) and the parsed fields object becomes the function argument; without a parser the handler gets `{ raw: "<body>" }`, which you must parse yourself (busboy or formidable — Node has no built-in multipart parser)
+- **GET:** `/{prefix}/{fnName}?args=encodeURIComponent(JSON.stringify(args))`
+- **Response:** always `{ data: <result> }` — 200 wraps everything, even `{ error }` responses (they resolve as data, not thrown)
+- **Status codes:** 200 (success or validation-as-data), 404/405/415/500 (transport errors → data promise rejects). 415 = request Content-Type doesn't match the function's declared contentType (json/text strict, forms lenient between urlencoded and multipart; headerless requests exempt). 500 body: generic `{ error: "Internal Server Error" }` in production; dev includes the message (and `code`/`data` for `RPCError`)
+- See `wiki/wire-protocol.md` for full curl examples
+
+## Config
+- `rpc.config.ts` imports `defineConfig` from `@thednp/rpc/config` (vite-free subpath — safe for serverless bundles): `defineConfig({ rpcPrefix: "__rpc", adapter: "express" | "fastify" | "hono" | "koa" | "h3" })`
+- `serverFiles: "exact" | "glob"` — `"exact"` (default) matches `server.ts|js|mjs|mts`; `"glob"` recursively matches `*.server.{ts,js,mjs,mts}` under the scan root
+- `scanRoot: string` — scan directory (default `<root>/src/api`); point it at a shared package in monorepos
+- `loadRPCConfig()` loads config programmatically
+- `createRPCMiddleware({ origin })` — optional origin check: requests with a mismatching `Origin` header get 403; requests without one pass through
+- Plugin options in `vite.config.ts` (`rpc()`) override `rpc.config.ts` in dev only
+- Config discovery: `rpc.config.ts` > `.js` > `.mjs` > `.mts` > `.rpcrc.ts` > `.rpcrc.js`
+
+## Project Structure
+- `src/api/server.ts` — server functions (auto-scanned). Aliases: `server.js`, `.mjs`, `.mts`; glob mode matches `*.server.{ts,js,mjs,mts}`
+- `src/api/index.ts` — `export * from "./server"` (single import point for SSR + client — types flow through this)
+- SSR: `src/entry-server.ts` (imports real functions) and `src/entry-client.ts` (imports fetch stubs)
+- SPA: just import from `./api` in client code
+- Example apps: `examples/` — `spa`, `express`, `fastify`, `h3`, `hono`, `koa`, `ssr` (plain RPC + DOM update), plus `react-query` and `solid-query` (show `@tanstack/*-query` integration on top of RPC), plus `advanced` (Express multi-prefix `public:rpc`/`admin:rpc` + universal middleware)
+
+## Rules
+- First handler argument is always `(signal: AbortSignal, ...args)`
+- Handler args must be JSON-serializable (string, number, boolean, null, array, plain object) — or a `FormData` instance as the single arg of a `multipart/form-data` function
+- Do NOT pass DOM nodes, functions, class instances, or circular refs
+- Export functions individually (named exports). No default export or bundled objects
+- Re-export from `src/api/index.ts` — this is non-negotiable for SSR/client duality
+
+## Security Boundaries
+- Prefix regex: `new RegExp("^/" + escapeRegExp(prefix) + "/")` — not `startsWith` (prevents segment bypass like `/__rpc-evil/foo`)
+- Default POST methods — CSRF-safe (no `<img>`/form GET can trigger mutations)
+- Content-Type enforcement — mismatched content types get 415 (json/text strict; forms interoperable; headerless exempt)
+- 404s are generic (no function name echoed); status code still distinguishes unknown (404) from known (405/415/403) — names ship in the client bundle so are not secret
+- 500s: always generic (no message/stack leak); dev mode includes `RPCError` payloads (`code`/`data`) only
+- Duplicate function names: throw in dev, warn + keep first in production
+- Auth, rate limiting, origin checks: all middleware-host, registered before `createRPCMiddleware()`
+- Body limits: host framework's parser (express.json, bodyLimit, koa-body, hono/body-limit)
+
+## Development Scripts
+- `pnpm test` — run tests once with coverage (`vitest run --coverage`); project aims for 100% coverage on all metrics
+- `pnpm test:watch` — run tests in watch mode with coverage
+- `pnpm test:ui` — run tests with UI
+- `pnpm test:dev` — run examples in dev mode (scripts/dev-test)
+- `pnpm test:prod` — run examples in prod preview (scripts/dev-test --mode=preview)
+- `pnpm lint` — lint + typecheck (`deno lint src` + `tsc -noEmit`)
+- `pnpm format` — `deno fmt src tests examples/**/src`
+- `pnpm clean` — remove build artifacts and caches
+- `pnpm build` — tsdown bundle (outputs to `dist/`)
+
+## Wiki Pages (in learning order)
+- `wiki/quickstart.md` — Rebuild the Express SSR example from `create-vite` in under a minute
+- `wiki/getting-started.md` — Installation, project structure, auto-scanning, and your first function
+- `wiki/configuration.md` — `rpc.config.ts`, `vite.config.ts`, `loadRPCConfig`
+- `wiki/server-functions.md` — `createServerFunction` API, methods, content types (JSON/text/urlencoded/multipart), validation (zod + valibot), typed errors (`RPCError`), AbortSignal, request context (`RequestEvent`, `send`, `functionName`)
+- `wiki/multi-prefix-guide.md` — Parallel RPC instances: versioned/public/admin API layouts, per-prefix middleware, canary deployments, origin validation per instance
+- `wiki/middleware.md` — Universal adapter-agnostic middleware via the request context (`locals` bridge, `getRequestMeta`, `sendResponse` short-circuits, wrapping official framework middleware)
+- `wiki/nojs-fallback.md` — Progressive enhancement: making an RPC endpoint work as a no-JS `<form>` action (detection rule, shared validation, PRG 303 redirects, state recovery)
+- `wiki/client-usage.md` — Generated client modules, type safety, error handling, multipart uploads, `@tanstack/react-query` integration, and an SSR gotcha for disabled queries (solid-query hangs `renderToStringAsync`; use `queryClient.fetchQuery()` on submit instead)
+- `wiki/wire-protocol.md` — HTTP contract: request/response bodies, status codes, curl debugging
+- `wiki/adapters.md` — Express, Fastify, Hono, Koa, h3 (`attachRPC`, `attachVite`, body limits)
+- `wiki/security.md` — Prefix guards, method enforcement, origin, CSRF hardening
+- `wiki/best-practices.md` — Auth middleware, rate limiting, per-function authorization, body limits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thednp/rpc",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "author": "thednp",
   "description": "⚡ A Vite plugin for creating server functions with automatic Remote Procedure Calls (RPC)",
@@ -34,10 +34,12 @@
     "AGENTS.md",
     "CLAUDE.md",
     "CHANGELOG.md",
+    "llms.txt",
     "LICENSE"
   ],
   "exports": {
     ".": "./dist/index.mjs",
+    "./config": "./dist/config/config.mjs",
     "./express": "./dist/express/express.mjs",
     "./fastify": "./dist/fastify/fastify.mjs",
     "./fastify/plugin": "./dist/fastify/plugin/fastify/plugin.mjs",
@@ -72,7 +74,7 @@
     "check:ts": "tsc -noEmit",
     "up:examples": "pnpm up -r --latest --filter \"./examples/*\"",
     "up:examples:lib": "deno run -A scripts/update-examples.js",
-    "up:root": "pnpm up --latest",
+    "up:root": "pnpm install && pnpm up --latest",
     "release": "node scripts/release.js",
     "up:deno": "deno update && deno -A scripts/update-deno.js",
     "upd": "pnpm up:examples && pnpm up:root && pnpm up:examples:lib",
@@ -85,7 +87,7 @@
     "express": "^5.2.1",
     "fastify": "^5.12.1",
     "fastify-plugin": "^6.0.0",
-    "h3": "2.0.1-rc.28",
+    "h3": "2.0.1-rc.29",
     "hono": "^4.13.3",
     "koa": "^3.2.1",
     "vite": "^8.2.2"