@thednp/rpc 0.3.4 → 0.3.5

package/dist/fastify/plugin/fastify/plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.mjs","names":[],"sources":["../../../../src/options.ts","../../../../src/functionsMap.ts","../../../../src/constants.ts","../../../../src/fastify/helpers.ts","../../../../src/fastify/createMiddleware.ts","../../../../src/fastify/plugin.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// @thednp/rpc/src/fastify/helpers.ts\nimport type { FastifyReply, FastifyRequest } from \"fastify\";\nimport type { ViteDevServer } from \"vite\";\nimport type { FastifyInstance } from \"fastify\";\nimport type { Buffer } from \"node:buffer\";\nimport type { BodyResult, JsonValue } from \"../types.d.ts\";\nimport fastifyRpcPlugin from \"./plugin.ts\";\n\n/**\n * Convenience function to load RPC config and register the RPC plugin to a Fastify instance.\n * Dynamically imports loadRPCConfig and registers the fastify-rpc plugin.\n * @param app - Fastify instance\n */\nexport async function attachRPC(app: FastifyInstance) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  await app.register(fastifyRpcPlugin, options);\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Fastify instance for development mode.\n * Uses an `onRequest` hook to delegate to Vite's connect-compatible middleware stack.\n * @param app - Fastify instance\n * @param vite - Running Vite dev server\n */\nexport function attachVite(app: FastifyInstance, vite: ViteDevServer) {\n  app.addHook(\"onRequest\", async (request, reply) => {\n    const next = () =>\n      new Promise((resolve) => {\n        vite.middlewares(request.raw, reply.raw, resolve);\n      });\n    await next();\n  });\n}\n\n/**\n * Creates a Fastify `onRequest` hook handler that delegates to Vite's\n * connect-compatible middleware stack. Use with `app.addHook(\"onRequest\", ...)`.\n *\n * @example\n * ```ts\n * import Fastify from \"fastify\";\n * import { createServer } from \"vite\";\n * import { viteMiddleware } from \"@thednp/rpc/fastify\";\n *\n * const app = Fastify();\n * const vite = await createServer({ server: { middlewareMode: true } });\n * app.addHook(\"onRequest\", viteMiddleware(vite));\n * ```\n * @param vite - Running Vite dev server\n * @returns A Fastify `onRequest` hook handler\n */\nexport function viteMiddleware(\n  vite: ViteDevServer,\n): (request: FastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request, reply) => {\n    reply.hijack();\n    await new Promise<void>((resolve, reject) => {\n      const next = (err?: unknown) => (err ? reject(err) : resolve());\n      vite.middlewares(request.raw, reply.raw, next);\n    });\n  };\n}\n\n/**\n * Reads and parses the HTTP request body from a Fastify request.\n * If Fastify's body parser already consumed the stream, uses the pre-parsed body from `req.body`.\n * @param req - Fastify request object\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = (\n  req: FastifyRequest,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n    const reqBody = req.body as JsonValue;\n\n    if (reqBody !== undefined) {\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      const isUrlEncoded = contentType.includes(\"urlencoded\");\n      resolve({\n        contentType: isMultipart\n          ? \"multipart/form-data\"\n          : isJSON\n          ? \"application/json\"\n          : isUrlEncoded\n          ? \"application/x-www-form-urlencoded\"\n          : \"text/plain\",\n        data: isMultipart\n          ? (reqBody as Record<string, unknown>)\n          : isJSON\n          ? reqBody\n          : isUrlEncoded\n          ? (reqBody as Record<string, unknown>)\n          : String(reqBody),\n      } as BodyResult);\n      return;\n    }\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req.raw[method](\"data\", onData);\n      req.raw[method](\"end\", onEnd);\n      req.raw[method](\"error\", onError);\n    };\n\n    let body = \"\";\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      const isUrlEncoded = contentType.includes(\"urlencoded\");\n      try {\n        const data = isMultipart\n          ? { raw: body }\n          : isUrlEncoded\n          ? Object.fromEntries(new URLSearchParams(body))\n          : JSON.parse(body);\n        resolve({\n          contentType: isMultipart\n            ? \"multipart/form-data\"\n            : isJSON\n            ? \"application/json\"\n            : isUrlEncoded\n            ? \"application/x-www-form-urlencoded\"\n            : \"text/plain\",\n          data: isMultipart ? (data as Record<string, unknown>) : data,\n        } as BodyResult);\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n    const onError = (err: Error) => {\n      toggleListeners();\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\n/**\n * Issues an HTTP redirect on a Fastify reply using the native\n * `reply.redirect(location, status)` API (Fastify v5 signature: destination\n * URL first, status code optional). Defaults to `303 See Other` for\n * convention (Post/Redirect/Get).\n * @param reply - Fastify reply object\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n */\nexport const redirect = (\n  reply: FastifyReply,\n  location: string,\n  status = 303,\n): void => {\n  reply.redirect(location, status);\n};\n","// src/fastify/createMiddleware.ts\nimport type {\n  FastifyReply,\n  FastifyRequest,\n  HookHandlerDoneFunction,\n} from \"fastify\";\nimport type {\n  FastifyMiddlewareFn,\n  FastifyMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  provideRequestContext,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody, redirect as fastifyRedirect } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Fastify preHandler hook with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Fastify preHandler hook function\n */\nexport const createMiddleware: FastifyMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as FastifyMiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: FastifyRequest,\n    reply: FastifyReply,\n    done: HookHandlerDoneFunction,\n  ) => {\n    const reqUrl = safeURL(req.url);\n    const url = reqUrl.pathname;\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      done();\n      return;\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) {\n      done();\n      return;\n    }\n\n    // rpcPrefix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      done();\n      return;\n    }\n\n    rpcPrefix = (rpcPrefix ?? defaultPrefix) as string;\n\n    // When serving from production server, scan for server files\n    if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n      await scanForServerFiles({\n        rpcPrefix,\n        serverFiles: (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n          .serverFiles,\n        scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n      } as never);\n    }\n\n    // Execute handler\n    await handler(req, reply, done);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Fastify RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and sends the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Fastify preHandler hook function\n */\nexport const createRPCMiddleware: FastifyMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as FastifyMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: FastifyRequest,\n      reply: FastifyReply,\n      _done: HookHandlerDoneFunction,\n    ) => {\n      const reqUrl = safeURL(req.url);\n      const url = reqUrl.pathname;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = req.headers.origin;\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        reply.status(403).send({ error: REQUEST_FORBIDDEN });\n        return;\n      }\n\n      const functionName = url.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        reply.status(404).send({\n          error: FUNCTION_NOT_FOUND,\n        });\n        return;\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (req.method.toUpperCase() !== method) {\n          reply.status(405).send({ error: METHOD_NOT_ALLOWED });\n          return;\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = reqUrl.searchParams.get(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              reply.status(400).send({ error: BAD_REQUEST });\n              return;\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              req.headers[\"content-type\"],\n            )\n          ) {\n            reply.status(415).send({ error: UNSUPPORTED_MEDIA_TYPE });\n            return;\n          }\n          const body = await readBody(req);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: req,\n          response: reply,\n          nativeEvent: req,\n          locals: {},\n          functionName,\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n            fastifyRedirect(reply, location, status);\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n            if (headers) {\n              for (const [name, value] of Object.entries(headers)) {\n                reply.header(name, value);\n              }\n            }\n            reply.status(status).send(body);\n          },\n        };\n        const { data: dataResult, cancel } = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onClose = () => cancel(CLIENT_DISCONNECTED);\n\n        req.raw.on(\"close\", onClose);\n        const data = await dataResult;\n        req.raw.off(\"close\", onClose);\n\n        // istanbul ignore else\n        if (\n          !requestEvent.redirected &&\n          !requestEvent.sent &&\n          !reply.raw.headersSent\n        ) {\n          reply.status(200).send({ data });\n        }\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        reply.status(500).send(formatError(err, isProduction));\n      }\n    },\n  });\n};\n","/** @module Fastify plugin. Exports the RPC plugin wrapped with `fastify-plugin` for lifecycle-compatible registration. */\n// inspired by https://github.com/royalswe/vike-fastify-boilerplate/blob/main/server/index.ts\nimport fp from \"fastify-plugin\";\nimport type { MiddlewareOptions } from \"../types.d.ts\";\nimport type {\n  FastifyRPCPlugin,\n  RegisteredFastifyRPCPlugin,\n} from \"./types.d.ts\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\nexport type { MiddlewareOptions };\n\nconst RpcPlugin: FastifyRPCPlugin = (\n  fastify,\n  initialOptions,\n  done,\n) => {\n  // Register RPC middleware as preHandler hook\n  const rpcMiddleware = createRPCMiddleware(initialOptions);\n  fastify.addHook(\"preHandler\", async (request, reply) => {\n    const next = () =>\n      new Promise((resolve) => {\n        rpcMiddleware(request, reply, resolve);\n      });\n    await next();\n  });\n\n  done();\n};\n\n// Export the plugin wrapped with fastify-plugin\nconst rpcPlugin = fp(RpcPlugin, {\n  name: \"uni-rpc-fastify-plugin\",\n}) as RegisteredFastifyRPCPlugin;\n\nexport { rpcPlugin as default };\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;;AC+C/B,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,cAAc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;EAClE,MAAM,UAAU,IAAI;EAEpB,IAAI,YAAY,KAAA,GAAW;GACzB,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;GACtD,QAAQ;IACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;IACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;GACpB,CAAe;GACf;EACF;EAEA,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC9B,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;GAC5B,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO;EAClC;EAEA,IAAI,OAAO;EAEX,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAChB,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;GACtD,IAAI;IACF,MAAM,OAAO,cACT,EAAE,KAAK,KAAK,IACZ,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,KAAK,MAAM,IAAI;IACnB,QAAQ;KACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;KACJ,MAAM,cAAe,OAAmC;IAC1D,CAAe;GACjB,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EACA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAChB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;;;;;;;;;;AAWA,MAAa,YACX,OACA,UACA,SAAS,QACA;CACT,MAAM,SAAS,UAAU,MAAM;AACjC;;;AC/HA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;AAQxC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,OACA,SACG;EAEH,MAAM,MADS,QAAQ,IAAI,GACV,CAAC,CAAC;EAGnB,IAAI,CAAC,SAAS;GACZ,KAAK;GACL;EACF;EAGA,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG;GACzC,KAAK;GACL;EACF;EAGA,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG;GACzC,KAAK;GACL;EACF;EAEA,YAAa,aAAA;EAGb,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aAAc,QACX;GACH,UAAW,QAA6C;EAC1D,CAAU;EAIZ,MAAM,QAAQ,KAAK,OAAO,IAAI;CAChC;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,OACA,UACG;GACH,MAAM,SAAS,QAAQ,IAAI,GAAG;GAC9B,MAAM,MAAM,OAAO;GAKnB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,IAAI,QAAQ;GAClC,IAAI,UAAU,iBAAiB,kBAAkB,QAAQ;IACvD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,kBAAkB,CAAC;IACnD;GACF;GAEA,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE;GAClD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBAAgB;IACnB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EACrB,OAAO,mBACT,CAAC;IACD;GACF;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,IAAI,OAAO,YAAY,MAAM,QAAQ;KACvC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;KACpD;IACF;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,OAAO,aAAa,IAAI,MAAM;KAC1C,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;OAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,YAAY,CAAC;OAC7C;MACF;MACA,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,IAAI,QAAQ,eACd,GACA;MACA,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,uBAAuB,CAAC;MACxD;KACF;KACA,MAAM,OAAO,MAAM,SAAS,GAAG;KAC/B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS;KACT,UAAU;KACV,aAAa;KACb,QAAQ,CAAC;KACT;KACA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;MAC7C,SAAgB,OAAO,UAAU,MAAM;KACzC;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;MAC5C,IAAI,SACF,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,MAAM,OAAO,MAAM,KAAK;MAG5B,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,IAAI;KAChC;IACF;IACA,MAAM,EAAE,MAAM,YAAY,WAAW,sBACnC,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,OAAO,mBAAmB;IAEhD,IAAI,IAAI,GAAG,SAAS,OAAO;IAC3B,MAAM,OAAO,MAAM;IACnB,IAAI,IAAI,IAAI,SAAS,OAAO;IAG5B,IACE,CAAC,aAAa,cACd,CAAC,aAAa,QACd,CAAC,MAAM,IAAI,aAEX,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC;GAEnC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,YAAY,KAAK,YAAY,CAAC;GACvD;EACF;CACF,CAAC;AACH;;;;ACnQA,MAAM,aACJ,SACA,gBACA,SACG;CAEH,MAAM,gBAAgB,oBAAoB,cAAc;CACxD,QAAQ,QAAQ,cAAc,OAAO,SAAS,UAAU;EACtD,MAAM,aACJ,IAAI,SAAS,YAAY;GACvB,cAAc,SAAS,OAAO,OAAO;EACvC,CAAC;EACH,MAAM,KAAK;CACb,CAAC;CAED,KAAK;AACP;AAGA,MAAM,YAAY,GAAG,WAAW,EAC9B,MAAM,yBACR,CAAC"}
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../../../../src/options.ts","../../../../src/functionsMap.ts","../../../../src/constants.ts","../../../../src/fastify/helpers.ts","../../../../src/fastify/createMiddleware.ts","../../../../src/fastify/plugin.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// @thednp/rpc/src/fastify/helpers.ts\nimport type { FastifyReply, FastifyRequest } from \"fastify\";\nimport type { ViteDevServer } from \"vite\";\nimport type { FastifyInstance } from \"fastify\";\nimport type { Buffer } from \"node:buffer\";\nimport type { BodyResult, JsonValue } from \"../types.d.ts\";\nimport fastifyRpcPlugin from \"./plugin.ts\";\n\n/**\n * Convenience function to load RPC config and register the RPC plugin to a Fastify instance.\n * Dynamically imports loadRPCConfig and registers the fastify-rpc plugin.\n * @param app - Fastify instance\n */\nexport async function attachRPC(app: FastifyInstance) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  await app.register(fastifyRpcPlugin, options);\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Fastify instance for development mode.\n * Uses an `onRequest` hook to delegate to Vite's connect-compatible middleware stack.\n * @param app - Fastify instance\n * @param vite - Running Vite dev server\n */\nexport function attachVite(app: FastifyInstance, vite: ViteDevServer) {\n  app.addHook(\"onRequest\", async (request, reply) => {\n    const next = () =>\n      new Promise((resolve) => {\n        vite.middlewares(request.raw, reply.raw, resolve);\n      });\n    await next();\n  });\n}\n\n/**\n * Creates a Fastify `onRequest` hook handler that delegates to Vite's\n * connect-compatible middleware stack. Use with `app.addHook(\"onRequest\", ...)`.\n *\n * @example\n * ```ts\n * import Fastify from \"fastify\";\n * import { createServer } from \"vite\";\n * import { viteMiddleware } from \"@thednp/rpc/fastify\";\n *\n * const app = Fastify();\n * const vite = await createServer({ server: { middlewareMode: true } });\n * app.addHook(\"onRequest\", viteMiddleware(vite));\n * ```\n * @param vite - Running Vite dev server\n * @returns A Fastify `onRequest` hook handler\n */\nexport function viteMiddleware(\n  vite: ViteDevServer,\n): (request: FastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request, reply) => {\n    reply.hijack();\n    await new Promise<void>((resolve, reject) => {\n      const next = (err?: unknown) => (err ? reject(err) : resolve());\n      vite.middlewares(request.raw, reply.raw, next);\n    });\n  };\n}\n\n/**\n * Reads and parses the HTTP request body from a Fastify request.\n * If Fastify's body parser already consumed the stream, uses the pre-parsed body from `req.body`.\n * @param req - Fastify request object\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = (\n  req: FastifyRequest,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n    const reqBody = req.body as JsonValue;\n\n    if (reqBody !== undefined) {\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      const isUrlEncoded = contentType.includes(\"urlencoded\");\n      resolve({\n        contentType: isMultipart\n          ? \"multipart/form-data\"\n          : isJSON\n          ? \"application/json\"\n          : isUrlEncoded\n          ? \"application/x-www-form-urlencoded\"\n          : \"text/plain\",\n        data: isMultipart\n          ? (reqBody as Record<string, unknown>)\n          : isJSON\n          ? reqBody\n          : isUrlEncoded\n          ? (reqBody as Record<string, unknown>)\n          : String(reqBody),\n      } as BodyResult);\n      return;\n    }\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req.raw[method](\"data\", onData);\n      req.raw[method](\"end\", onEnd);\n      req.raw[method](\"error\", onError);\n    };\n\n    let body = \"\";\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      const isUrlEncoded = contentType.includes(\"urlencoded\");\n      try {\n        const data = isMultipart\n          ? { raw: body }\n          : isUrlEncoded\n          ? Object.fromEntries(new URLSearchParams(body))\n          : JSON.parse(body);\n        resolve({\n          contentType: isMultipart\n            ? \"multipart/form-data\"\n            : isJSON\n            ? \"application/json\"\n            : isUrlEncoded\n            ? \"application/x-www-form-urlencoded\"\n            : \"text/plain\",\n          data: isMultipart ? (data as Record<string, unknown>) : data,\n        } as BodyResult);\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n    const onError = (err: Error) => {\n      toggleListeners();\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\n/**\n * Issues an HTTP redirect on a Fastify reply using the native\n * `reply.redirect(location, status)` API (Fastify v5 signature: destination\n * URL first, status code optional). Defaults to `303 See Other` for\n * convention (Post/Redirect/Get).\n * @param reply - Fastify reply object\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n */\nexport const redirect = (\n  reply: FastifyReply,\n  location: string,\n  status = 303,\n): void => {\n  reply.redirect(location, status);\n};\n","// src/fastify/createMiddleware.ts\nimport type {\n  FastifyReply,\n  FastifyRequest,\n  HookHandlerDoneFunction,\n} from \"fastify\";\nimport type {\n  FastifyMiddlewareFn,\n  FastifyMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  isOriginAllowed,\n  provideRequestContext,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody, redirect as fastifyRedirect } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Fastify preHandler hook with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Fastify preHandler hook function\n */\nexport const createMiddleware: FastifyMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as FastifyMiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: FastifyRequest,\n    reply: FastifyReply,\n    done: HookHandlerDoneFunction,\n  ) => {\n    const reqUrl = safeURL(req.url);\n    const url = reqUrl.pathname;\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      done();\n      return;\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) {\n      done();\n      return;\n    }\n\n    // rpcPrefix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      done();\n      return;\n    }\n\n    rpcPrefix = (rpcPrefix ?? defaultPrefix) as string;\n\n    // When serving from production server, scan for server files\n    if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n      await scanForServerFiles({\n        rpcPrefix,\n        serverFiles: (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n          .serverFiles,\n        scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n      } as never);\n    }\n\n    // Execute handler\n    await handler(req, reply, done);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Fastify RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and sends the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Fastify preHandler hook function\n */\nexport const createRPCMiddleware: FastifyMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as FastifyMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: FastifyRequest,\n      reply: FastifyReply,\n      _done: HookHandlerDoneFunction,\n    ) => {\n      const reqUrl = safeURL(req.url);\n      const url = reqUrl.pathname;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header is not in\n      // the configured allowlist. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      if (!isOriginAllowed(options.origin, req.headers.origin)) {\n        reply.status(403).send({ error: REQUEST_FORBIDDEN });\n        return;\n      }\n\n      const functionName = url.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        reply.status(404).send({\n          error: FUNCTION_NOT_FOUND,\n        });\n        return;\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (req.method.toUpperCase() !== method) {\n          reply.status(405).send({ error: METHOD_NOT_ALLOWED });\n          return;\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = reqUrl.searchParams.get(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              reply.status(400).send({ error: BAD_REQUEST });\n              return;\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              req.headers[\"content-type\"],\n            )\n          ) {\n            reply.status(415).send({ error: UNSUPPORTED_MEDIA_TYPE });\n            return;\n          }\n          const body = await readBody(req);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: req,\n          response: reply,\n          nativeEvent: req,\n          locals: {},\n          functionName,\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n            fastifyRedirect(reply, location, status);\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n            if (headers) {\n              for (const [name, value] of Object.entries(headers)) {\n                reply.header(name, value);\n              }\n            }\n            reply.status(status).send(body);\n          },\n        };\n        const { data: dataResult, cancel } = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onClose = () => cancel(CLIENT_DISCONNECTED);\n\n        req.raw.on(\"close\", onClose);\n        const data = await dataResult;\n        req.raw.off(\"close\", onClose);\n\n        // istanbul ignore else\n        if (\n          !requestEvent.redirected &&\n          !requestEvent.sent &&\n          !reply.raw.headersSent\n        ) {\n          reply.status(200).send({ data });\n        }\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        reply.status(500).send(formatError(err, isProduction));\n      }\n    },\n  });\n};\n","/** @module Fastify plugin. Exports the RPC plugin wrapped with `fastify-plugin` for lifecycle-compatible registration. */\n// inspired by https://github.com/royalswe/vike-fastify-boilerplate/blob/main/server/index.ts\nimport fp from \"fastify-plugin\";\nimport type { MiddlewareOptions } from \"../types.d.ts\";\nimport type {\n  FastifyRPCPlugin,\n  RegisteredFastifyRPCPlugin,\n} from \"./types.d.ts\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\nexport type { MiddlewareOptions };\n\nconst RpcPlugin: FastifyRPCPlugin = (\n  fastify,\n  initialOptions,\n  done,\n) => {\n  // Register RPC middleware as preHandler hook\n  const rpcMiddleware = createRPCMiddleware(initialOptions);\n  fastify.addHook(\"preHandler\", async (request, reply) => {\n    const next = () =>\n      new Promise((resolve) => {\n        rpcMiddleware(request, reply, resolve);\n      });\n    await next();\n  });\n\n  done();\n};\n\n// Export the plugin wrapped with fastify-plugin\nconst rpcPlugin = fp(RpcPlugin, {\n  name: \"uni-rpc-fastify-plugin\",\n}) as RegisteredFastifyRPCPlugin;\n\nexport { rpcPlugin as default };\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;;AC+C/B,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,cAAc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;EAClE,MAAM,UAAU,IAAI;EAEpB,IAAI,YAAY,KAAA,GAAW;GACzB,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;GACtD,QAAQ;IACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;IACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;GACpB,CAAe;GACf;EACF;EAEA,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC9B,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;GAC5B,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO;EAClC;EAEA,IAAI,OAAO;EAEX,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAChB,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;GACtD,IAAI;IACF,MAAM,OAAO,cACT,EAAE,KAAK,KAAK,IACZ,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,KAAK,MAAM,IAAI;IACnB,QAAQ;KACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;KACJ,MAAM,cAAe,OAAmC;IAC1D,CAAe;GACjB,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EACA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAChB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;;;;;;;;;;AAWA,MAAa,YACX,OACA,UACA,SAAS,QACA;CACT,MAAM,SAAS,UAAU,MAAM;AACjC;;;AC9HA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;AAQxC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,OACA,SACG;EAEH,MAAM,MADS,QAAQ,IAAI,GACV,CAAC,CAAC;EAGnB,IAAI,CAAC,SAAS;GACZ,KAAK;GACL;EACF;EAGA,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG;GACzC,KAAK;GACL;EACF;EAGA,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG;GACzC,KAAK;GACL;EACF;EAEA,YAAa,aAAA;EAGb,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aAAc,QACX;GACH,UAAW,QAA6C;EAC1D,CAAU;EAIZ,MAAM,QAAQ,KAAK,OAAO,IAAI;CAChC;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,OACA,UACG;GACH,MAAM,SAAS,QAAQ,IAAI,GAAG;GAC9B,MAAM,MAAM,OAAO;GAKnB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC;GAMF,IAAI,CAAC,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,MAAM,GAAG;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,kBAAkB,CAAC;IACnD;GACF;GAEA,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE;GAClD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBAAgB;IACnB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EACrB,OAAO,mBACT,CAAC;IACD;GACF;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,IAAI,OAAO,YAAY,MAAM,QAAQ;KACvC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;KACpD;IACF;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,OAAO,aAAa,IAAI,MAAM;KAC1C,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;OAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,YAAY,CAAC;OAC7C;MACF;MACA,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,IAAI,QAAQ,eACd,GACA;MACA,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,uBAAuB,CAAC;MACxD;KACF;KACA,MAAM,OAAO,MAAM,SAAS,GAAG;KAC/B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS;KACT,UAAU;KACV,aAAa;KACb,QAAQ,CAAC;KACT;KACA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;MAC7C,SAAgB,OAAO,UAAU,MAAM;KACzC;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;MAC5C,IAAI,SACF,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,MAAM,OAAO,MAAM,KAAK;MAG5B,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,IAAI;KAChC;IACF;IACA,MAAM,EAAE,MAAM,YAAY,WAAW,sBACnC,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,OAAO,mBAAmB;IAEhD,IAAI,IAAI,GAAG,SAAS,OAAO;IAC3B,MAAM,OAAO,MAAM;IACnB,IAAI,IAAI,IAAI,SAAS,OAAO;IAG5B,IACE,CAAC,aAAa,cACd,CAAC,aAAa,QACd,CAAC,MAAM,IAAI,aAEX,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC;GAEnC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,YAAY,KAAK,YAAY,CAAC;GACvD;EACF;CACF,CAAC;AACH;;;;AClQA,MAAM,aACJ,SACA,gBACA,SACG;CAEH,MAAM,gBAAgB,oBAAoB,cAAc;CACxD,QAAQ,QAAQ,cAAc,OAAO,SAAS,UAAU;EACtD,MAAM,aACJ,IAAI,SAAS,YAAY;GACvB,cAAc,SAAS,OAAO,OAAO;EACvC,CAAC;EACH,MAAM,KAAK;CACb,CAAC;CAED,KAAK;AACP;AAGA,MAAM,YAAY,GAAG,WAAW,EAC9B,MAAM,yBACR,CAAC"}

package/dist/h3/h3.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"h3.d.mts","names":["H3","H3Event","H3Event"],"sources":["../../src/h3/types.d.ts","../../src/h3/createMiddleware.ts","../../src/h3/helpers.ts"],"mappings":";;;;;;;KAOY,sBAAsB;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAU,oCACtC,iBAAiB,QAAQ,yBACtB;;;;KAKO,QAAQA;;;;KAKR,kBAAkBC;EAAY;;;;;;;;;;;qBCG7B,kBAAkB;;;;;;;;qBA4ElB,qBAAqB;;;;;;;;wBCtGZ,UAAU,KAAK,QAAK;;;;;;;qBAgB7B,aAAU,KAAS,OAAK,MAAQ;;;;;;;;qBAWhC,iBAAc,MAAU,kBAAgB;;;;;;;qBA6ExC,WAAQ,OAAiBC,cAAU,QAAQ;;;;;;;;;qBAmC3C,WAAQ,kBACH,oBAEf"}
+{"version":3,"file":"h3.d.mts","names":["H3","H3Event","H3Event"],"sources":["../../src/h3/types.d.ts","../../src/h3/createMiddleware.ts","../../src/h3/helpers.ts"],"mappings":";;;;;;;KAOY,sBAAsB;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAU,oCACtC,iBAAiB,QAAQ,yBACtB;;;;KAKO,QAAQA;;;;KAKR,kBAAkBC;EAAY;;;;;;;;;;;qBCI7B,kBAAkB;;;;;;;;qBA4ElB,qBAAqB;;;;;;;;wBCvGZ,UAAU,KAAK,QAAK;;;;;;;qBAgB7B,aAAU,KAAS,OAAK,MAAQ;;;;;;;;qBAWhC,iBAAc,MAAU,kBAAgB;;;;;;;qBA6ExC,WAAQ,OAAiBC,cAAU,QAAQ;;;;;;;;;qBAmC3C,WAAQ,kBACH,oBAEf"}

package/dist/h3/h3.mjs

@@ -1,4 +1,4 @@
-import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, provideRequestContext, scanForServerFiles } from "@thednp/rpc/server";
+import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, isOriginAllowed, provideRequestContext, scanForServerFiles } from "@thednp/rpc/server";
 import { HTTPResponse, redirect as redirect$1 } from "h3";
 const defaultRPCOptions = {
 	rpcPrefix: "__rpc",
@@ -212,9 +212,7 @@ const createRPCMiddleware = (initialOptions = {}) => {
 		handler: async (event, _next) => {
 			const url = event.url.pathname;
 			if (prefixRegex && !prefixRegex.test(url)) return;
-			const origin = options.origin;
-			const requestOrigin = event.req.headers.get("origin") ?? void 0;
-			if (origin && requestOrigin && requestOrigin !== origin) {
+			if (!isOriginAllowed(options.origin, event.req.headers.get("origin") ?? void 0)) {
 				event.res.status = 403;
 				return { error: REQUEST_FORBIDDEN };
 			}

package/dist/h3/h3.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"h3.mjs","names":["h3Redirect","h3Redirect"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/h3/helpers.ts","../../src/h3/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/h3/helpers.ts\nimport type { H3Event, Middleware } from \"h3\";\nimport { HTTPResponse, redirect as h3Redirect } from \"h3\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ViteDevServer } from \"vite\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { H3App } from \"./types.d.ts\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to an h3 app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - h3 application instance\n */\nexport async function attachRPC(app: H3App) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to an h3 app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into h3.\n * @param app - h3 application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: H3App, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates an h3-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to h3's event-based request/response model.\n * Supports both Node.js and web runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns An h3 middleware function\n */\nexport const viteMiddleware = (vite: ViteDevServer): Middleware => {\n  return (event, next) =>\n    new Promise((resolve) => {\n      const node = event.runtime?.node;\n      if (node?.req && node?.res) {\n        const nodeReq = node.req;\n        const nodeRes = node.res;\n        // ─── Node.js runtime ─────────────────────────────────────────────\n        // Forward to the real node req/res: if the Vite/Connect stack writes\n        // the response, the socket is already flushed (dev-mode asset serving,\n        // HMR). Connect never calls the final callback once a middleware has\n        // written the response, so also settle on the response lifecycle\n        // events. Stop the chain with an empty response once the socket is\n        // used; the runtime's write guard prevents a second write. When the\n        // stack passes through, continue to the next middleware.\n        let settled = false;\n        const settle = (value: unknown) => {\n          // istanbul ignore if\n          if (settled) return;\n          settled = true;\n          resolve(value);\n        };\n        nodeRes.once(\"close\", () => settle(new Response(null)));\n        nodeRes.once(\"finish\", () => settle(new Response(null)));\n        vite.middlewares(\n          nodeReq as IncomingMessage,\n          nodeRes as ServerResponse,\n          () => {\n            if (nodeRes.writableEnded || nodeRes.headersSent) {\n              settle(new Response(null));\n            } else {\n              settle(next());\n            }\n          },\n        );\n        return;\n      }\n\n      // ─── Web runtime fallback ──────────────────────────────────────────\n      let sent = false;\n      const headers = new Headers();\n      const req = {\n        url: event.url.pathname + event.url.search,\n        method: event.req.method,\n        headers: Object.fromEntries(event.req.headers),\n      } as IncomingMessage;\n      const res = {\n        setHeader(name: string, value: unknown) {\n          headers.set(name, String(value));\n          return this;\n        },\n        writeHead(status: number) {\n          void status;\n          return this;\n        },\n        end(body?: unknown) {\n          sent = true;\n          resolve(\n            new HTTPResponse(body == null ? \"\" : (body as BodyInit), {\n              headers,\n            }),\n          );\n          return this;\n        },\n      } as ServerResponse;\n      vite.middlewares(req, res, () => {\n        if (!sent) resolve(next());\n      });\n    });\n};\n\n/**\n * Reads and parses the HTTP request body from an h3 event.\n * Supports JSON, text, urlencoded, and multipart content types.\n * @param event - h3 event object\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (event: H3Event): Promise<BodyResult> => {\n  const contentType = event.req.headers.get(\"content-type\")?.toLowerCase() ||\n    \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  const text = await event.req.text();\n  if (isJSON) {\n    return {\n      contentType: \"application/json\",\n      data: JSON.parse(text),\n    } as BodyResult;\n  }\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect. h3's `redirect()` returns an `HTTPResponse`\n * object that the handler must return (it never writes directly). Defaults\n * to `303 See Other` for convention (Post/Redirect/Get).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns An h3 `HTTPResponse` to return from the handler\n */\nexport const redirect = (\n  location: string,\n  status = 303,\n): HTTPResponse => {\n  return h3Redirect(\n    location,\n    status,\n    status === 303 ? \"See Other\" : undefined,\n  );\n};\n","// src/h3/createMiddleware.ts\nimport type { H3Event, Middleware } from \"h3\";\nimport type { H3MiddlewareFn, H3MiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  provideRequestContext,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport { readBody, redirect as h3Redirect } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates an h3 middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * h3 URL is normalized via `event.url` (query strings are not part of the pathname).\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns An h3 middleware function\n */\nexport const createMiddleware: H3MiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as H3MiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler: Middleware = async (event: H3Event, next) => {\n    const url = event.url.pathname;\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next();\n    }\n\n    if (pathMatcher && !pathMatcher.test(url)) {\n      return next();\n    }\n\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next();\n    }\n\n    rpcPrefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n    // When serving from production server, scan for server files\n    if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n      await scanForServerFiles({\n        rpcPrefix,\n        serverFiles: (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n          .serverFiles,\n        scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n      } as never);\n    }\n\n    return handler(event, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the h3 RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns An h3 middleware function\n */\nexport const createRPCMiddleware: H3MiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as H3MiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (event: H3Event, _next?: () => unknown) => {\n      const url = event.url.pathname;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(url)) {\n        /* istanbul ignore next */\n        return undefined;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = event.req.headers.get(\"origin\") ?? undefined;\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        event.res.status = 403;\n        return { error: REQUEST_FORBIDDEN };\n      }\n\n      const functionName = url.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        event.res.status = 404;\n        return { error: FUNCTION_NOT_FOUND };\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (event.req.method.toUpperCase() !== method) {\n          event.res.status = 405;\n          return { error: METHOD_NOT_ALLOWED };\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = event.url.searchParams.get(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              event.res.status = 400;\n              return { error: BAD_REQUEST };\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              event.req.headers.get(\"content-type\") ?? undefined,\n            )\n          ) {\n            event.res.status = 415;\n            return { error: UNSUPPORTED_MEDIA_TYPE };\n          }\n          const body = await readBody(event);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: event.req,\n          response: event.res,\n          nativeEvent: event,\n          locals: event.context,\n          functionName,\n          // h3's `redirect()` returns an `HTTPResponse` (never writes directly),\n          // so the bound redirect/send only record the intent; the middleware\n          // uses them after the dispatch to return the response body.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onClose = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The node runtime gives us the raw incoming stream for close events;\n        // other runtimes have no node req, so the abort hook is skipped.\n        const nodeReq = event.runtime?.node?.req;\n        if (nodeReq) nodeReq.on(\"close\", onClose);\n        const result = await fnResult.data;\n        if (nodeReq) nodeReq.off(\"close\", onClose);\n\n        if (requestEvent.redirected) {\n          return h3Redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status,\n          );\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          event.res.status = status;\n          if (headers) {\n            for (const [name, value] of Object.entries(headers)) {\n              event.res.headers.set(name, value);\n            }\n          }\n          return body;\n        }\n\n        return { data: result };\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        event.res.status = 500;\n\n        return formatError(err, isProduction);\n      }\n    },\n  });\n};\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACZ/B,eAAsB,UAAU,KAAY;CAI1C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAE9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAY,SAA8B;CACnE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;AASA,MAAa,kBAAkB,SAAoC;CACjE,QAAQ,OAAO,SACb,IAAI,SAAS,YAAY;EACvB,MAAM,OAAO,MAAM,SAAS;EAC5B,IAAI,MAAM,OAAO,MAAM,KAAK;GAC1B,MAAM,UAAU,KAAK;GACrB,MAAM,UAAU,KAAK;GASrB,IAAI,UAAU;GACd,MAAM,UAAU,UAAmB;IAEjC,IAAI,SAAS;IACb,UAAU;IACV,QAAQ,KAAK;GACf;GACA,QAAQ,KAAK,eAAe,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC;GACtD,QAAQ,KAAK,gBAAgB,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC;GACvD,KAAK,YACH,SACA,eACM;IACJ,IAAI,QAAQ,iBAAiB,QAAQ,aACnC,OAAO,IAAI,SAAS,IAAI,CAAC;SAEzB,OAAO,KAAK,CAAC;GAEjB,CACF;GACA;EACF;EAGA,IAAI,OAAO;EACX,MAAM,UAAU,IAAI,QAAQ;EAC5B,MAAM,MAAM;GACV,KAAK,MAAM,IAAI,WAAW,MAAM,IAAI;GACpC,QAAQ,MAAM,IAAI;GAClB,SAAS,OAAO,YAAY,MAAM,IAAI,OAAO;EAC/C;EAoBA,KAAK,YAAY,KAAK;GAlBpB,UAAU,MAAc,OAAgB;IACtC,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;IAC/B,OAAO;GACT;GACA,UAAU,QAAgB;IAExB,OAAO;GACT;GACA,IAAI,MAAgB;IAClB,OAAO;IACP,QACE,IAAI,aAAa,QAAQ,OAAO,KAAM,MAAmB,EACvD,QACF,CAAC,CACH;IACA,OAAO;GACT;EAEsB,SAAS;GAC/B,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC;EAC3B,CAAC;CACH,CAAC;AACL;;;;;;;AAQA,MAAa,WAAW,OAAO,UAAwC;CACrE,MAAM,cAAc,MAAM,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KACrE;CACF,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CACtD,MAAM,OAAO,MAAM,MAAM,IAAI,KAAK;CAClC,IAAI,QACF,OAAO;EACL,aAAa;EACb,MAAM,KAAK,MAAM,IAAI;CACvB;CAEF,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;AAUA,MAAa,YACX,UACA,SAAS,QACQ;CACjB,OAAOA,WACL,UACA,QACA,WAAW,MAAM,cAAc,KAAA,CACjC;AACF;;;ACpIA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAoC,iBAAiB,CAAC,MAAM;CACvE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAgC,OAAO,OAAgB,SAAS;EACpE,MAAM,MAAM,MAAM,IAAI;EAGtB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,YAAY,aAAa,gBAAgB,KAAA;EAGzC,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aAAc,QACX;GACH,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAO,QAAQ,OAAO,IAAI;CAC5B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAuC,iBAAiB,CAAC,MAAM;CAC1E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OAAO,OAAgB,UAA0B;GACxD,MAAM,MAAM,MAAM,IAAI;GAKtB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAEtC;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,MAAM,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAA;GACzD,IAAI,UAAU,iBAAiB,kBAAkB,QAAQ;IACvD,MAAM,IAAI,SAAS;IACnB,OAAO,EAAE,OAAO,kBAAkB;GACpC;GAEA,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE;GAClD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBAAgB;IACnB,MAAM,IAAI,SAAS;IACnB,OAAO,EAAE,OAAO,mBAAmB;GACrC;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,MAAM,IAAI,OAAO,YAAY,MAAM,QAAQ;KAC7C,MAAM,IAAI,SAAS;KACnB,OAAO,EAAE,OAAO,mBAAmB;IACrC;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;KAC7C,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;OAC1B,MAAM,IAAI,SAAS;OACnB,OAAO,EAAE,OAAO,YAAY;MAC9B;MACA,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,MAAM,IAAI,QAAQ,IAAI,cAAc,KAAK,KAAA,CAC3C,GACA;MACA,MAAM,IAAI,SAAS;MACnB,OAAO,EAAE,OAAO,uBAAuB;KACzC;KACA,MAAM,OAAO,MAAM,SAAS,KAAK;KACjC,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,MAAM;KACf,UAAU,MAAM;KAChB,aAAa;KACb,QAAQ,MAAM;KACd;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;IACrC,IAAI,SAAS,QAAQ,GAAG,SAAS,OAAO;IACxC,MAAM,SAAS,MAAM,SAAS;IAC9B,IAAI,SAAS,QAAQ,IAAI,SAAS,OAAO;IAEzC,IAAI,aAAa,YACf,OAAOC,SACL,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,MAAM,IAAI,SAAS;KACnB,IAAI,SACF,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,MAAM,IAAI,QAAQ,IAAI,MAAM,KAAK;KAGrC,OAAO;IACT;IAEA,OAAO,EAAE,MAAM,OAAO;GACxB,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,MAAM,IAAI,SAAS;IAEnB,OAAO,YAAY,KAAK,YAAY;GACtC;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"h3.mjs","names":["h3Redirect","h3Redirect"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/h3/helpers.ts","../../src/h3/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/h3/helpers.ts\nimport type { H3Event, Middleware } from \"h3\";\nimport { HTTPResponse, redirect as h3Redirect } from \"h3\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ViteDevServer } from \"vite\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { H3App } from \"./types.d.ts\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to an h3 app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - h3 application instance\n */\nexport async function attachRPC(app: H3App) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to an h3 app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into h3.\n * @param app - h3 application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: H3App, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates an h3-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to h3's event-based request/response model.\n * Supports both Node.js and web runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns An h3 middleware function\n */\nexport const viteMiddleware = (vite: ViteDevServer): Middleware => {\n  return (event, next) =>\n    new Promise((resolve) => {\n      const node = event.runtime?.node;\n      if (node?.req && node?.res) {\n        const nodeReq = node.req;\n        const nodeRes = node.res;\n        // ─── Node.js runtime ─────────────────────────────────────────────\n        // Forward to the real node req/res: if the Vite/Connect stack writes\n        // the response, the socket is already flushed (dev-mode asset serving,\n        // HMR). Connect never calls the final callback once a middleware has\n        // written the response, so also settle on the response lifecycle\n        // events. Stop the chain with an empty response once the socket is\n        // used; the runtime's write guard prevents a second write. When the\n        // stack passes through, continue to the next middleware.\n        let settled = false;\n        const settle = (value: unknown) => {\n          // istanbul ignore if\n          if (settled) return;\n          settled = true;\n          resolve(value);\n        };\n        nodeRes.once(\"close\", () => settle(new Response(null)));\n        nodeRes.once(\"finish\", () => settle(new Response(null)));\n        vite.middlewares(\n          nodeReq as IncomingMessage,\n          nodeRes as ServerResponse,\n          () => {\n            if (nodeRes.writableEnded || nodeRes.headersSent) {\n              settle(new Response(null));\n            } else {\n              settle(next());\n            }\n          },\n        );\n        return;\n      }\n\n      // ─── Web runtime fallback ──────────────────────────────────────────\n      let sent = false;\n      const headers = new Headers();\n      const req = {\n        url: event.url.pathname + event.url.search,\n        method: event.req.method,\n        headers: Object.fromEntries(event.req.headers),\n      } as IncomingMessage;\n      const res = {\n        setHeader(name: string, value: unknown) {\n          headers.set(name, String(value));\n          return this;\n        },\n        writeHead(status: number) {\n          void status;\n          return this;\n        },\n        end(body?: unknown) {\n          sent = true;\n          resolve(\n            new HTTPResponse(body == null ? \"\" : (body as BodyInit), {\n              headers,\n            }),\n          );\n          return this;\n        },\n      } as ServerResponse;\n      vite.middlewares(req, res, () => {\n        if (!sent) resolve(next());\n      });\n    });\n};\n\n/**\n * Reads and parses the HTTP request body from an h3 event.\n * Supports JSON, text, urlencoded, and multipart content types.\n * @param event - h3 event object\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (event: H3Event): Promise<BodyResult> => {\n  const contentType = event.req.headers.get(\"content-type\")?.toLowerCase() ||\n    \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  const text = await event.req.text();\n  if (isJSON) {\n    return {\n      contentType: \"application/json\",\n      data: JSON.parse(text),\n    } as BodyResult;\n  }\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect. h3's `redirect()` returns an `HTTPResponse`\n * object that the handler must return (it never writes directly). Defaults\n * to `303 See Other` for convention (Post/Redirect/Get).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns An h3 `HTTPResponse` to return from the handler\n */\nexport const redirect = (\n  location: string,\n  status = 303,\n): HTTPResponse => {\n  return h3Redirect(\n    location,\n    status,\n    status === 303 ? \"See Other\" : undefined,\n  );\n};\n","// src/h3/createMiddleware.ts\nimport type { H3Event, Middleware } from \"h3\";\nimport type { H3MiddlewareFn, H3MiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  isOriginAllowed,\n  provideRequestContext,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport { readBody, redirect as h3Redirect } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates an h3 middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * h3 URL is normalized via `event.url` (query strings are not part of the pathname).\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns An h3 middleware function\n */\nexport const createMiddleware: H3MiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as H3MiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler: Middleware = async (event: H3Event, next) => {\n    const url = event.url.pathname;\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next();\n    }\n\n    if (pathMatcher && !pathMatcher.test(url)) {\n      return next();\n    }\n\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next();\n    }\n\n    rpcPrefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n    // When serving from production server, scan for server files\n    if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n      await scanForServerFiles({\n        rpcPrefix,\n        serverFiles: (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n          .serverFiles,\n        scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n      } as never);\n    }\n\n    return handler(event, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the h3 RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns An h3 middleware function\n */\nexport const createRPCMiddleware: H3MiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as H3MiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (event: H3Event, _next?: () => unknown) => {\n      const url = event.url.pathname;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(url)) {\n        /* istanbul ignore next */\n        return undefined;\n      }\n\n      // Optional origin check: reject requests whose Origin header is not in\n      // the configured allowlist. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      if (\n        !isOriginAllowed(\n          options.origin,\n          event.req.headers.get(\"origin\") ?? undefined,\n        )\n      ) {\n        event.res.status = 403;\n        return { error: REQUEST_FORBIDDEN };\n      }\n\n      const functionName = url.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        event.res.status = 404;\n        return { error: FUNCTION_NOT_FOUND };\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (event.req.method.toUpperCase() !== method) {\n          event.res.status = 405;\n          return { error: METHOD_NOT_ALLOWED };\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = event.url.searchParams.get(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              event.res.status = 400;\n              return { error: BAD_REQUEST };\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              event.req.headers.get(\"content-type\") ?? undefined,\n            )\n          ) {\n            event.res.status = 415;\n            return { error: UNSUPPORTED_MEDIA_TYPE };\n          }\n          const body = await readBody(event);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: event.req,\n          response: event.res,\n          nativeEvent: event,\n          locals: event.context,\n          functionName,\n          // h3's `redirect()` returns an `HTTPResponse` (never writes directly),\n          // so the bound redirect/send only record the intent; the middleware\n          // uses them after the dispatch to return the response body.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onClose = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The node runtime gives us the raw incoming stream for close events;\n        // other runtimes have no node req, so the abort hook is skipped.\n        const nodeReq = event.runtime?.node?.req;\n        if (nodeReq) nodeReq.on(\"close\", onClose);\n        const result = await fnResult.data;\n        if (nodeReq) nodeReq.off(\"close\", onClose);\n\n        if (requestEvent.redirected) {\n          return h3Redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status,\n          );\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          event.res.status = status;\n          if (headers) {\n            for (const [name, value] of Object.entries(headers)) {\n              event.res.headers.set(name, value);\n            }\n          }\n          return body;\n        }\n\n        return { data: result };\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        event.res.status = 500;\n\n        return formatError(err, isProduction);\n      }\n    },\n  });\n};\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACZ/B,eAAsB,UAAU,KAAY;CAI1C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAE9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAY,SAA8B;CACnE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;AASA,MAAa,kBAAkB,SAAoC;CACjE,QAAQ,OAAO,SACb,IAAI,SAAS,YAAY;EACvB,MAAM,OAAO,MAAM,SAAS;EAC5B,IAAI,MAAM,OAAO,MAAM,KAAK;GAC1B,MAAM,UAAU,KAAK;GACrB,MAAM,UAAU,KAAK;GASrB,IAAI,UAAU;GACd,MAAM,UAAU,UAAmB;IAEjC,IAAI,SAAS;IACb,UAAU;IACV,QAAQ,KAAK;GACf;GACA,QAAQ,KAAK,eAAe,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC;GACtD,QAAQ,KAAK,gBAAgB,OAAO,IAAI,SAAS,IAAI,CAAC,CAAC;GACvD,KAAK,YACH,SACA,eACM;IACJ,IAAI,QAAQ,iBAAiB,QAAQ,aACnC,OAAO,IAAI,SAAS,IAAI,CAAC;SAEzB,OAAO,KAAK,CAAC;GAEjB,CACF;GACA;EACF;EAGA,IAAI,OAAO;EACX,MAAM,UAAU,IAAI,QAAQ;EAC5B,MAAM,MAAM;GACV,KAAK,MAAM,IAAI,WAAW,MAAM,IAAI;GACpC,QAAQ,MAAM,IAAI;GAClB,SAAS,OAAO,YAAY,MAAM,IAAI,OAAO;EAC/C;EAoBA,KAAK,YAAY,KAAK;GAlBpB,UAAU,MAAc,OAAgB;IACtC,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;IAC/B,OAAO;GACT;GACA,UAAU,QAAgB;IAExB,OAAO;GACT;GACA,IAAI,MAAgB;IAClB,OAAO;IACP,QACE,IAAI,aAAa,QAAQ,OAAO,KAAM,MAAmB,EACvD,QACF,CAAC,CACH;IACA,OAAO;GACT;EAEsB,SAAS;GAC/B,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC;EAC3B,CAAC;CACH,CAAC;AACL;;;;;;;AAQA,MAAa,WAAW,OAAO,UAAwC;CACrE,MAAM,cAAc,MAAM,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KACrE;CACF,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CACtD,MAAM,OAAO,MAAM,MAAM,IAAI,KAAK;CAClC,IAAI,QACF,OAAO;EACL,aAAa;EACb,MAAM,KAAK,MAAM,IAAI;CACvB;CAEF,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;AAUA,MAAa,YACX,UACA,SAAS,QACQ;CACjB,OAAOA,WACL,UACA,QACA,WAAW,MAAM,cAAc,KAAA,CACjC;AACF;;;ACnIA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAoC,iBAAiB,CAAC,MAAM;CACvE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAgC,OAAO,OAAgB,SAAS;EACpE,MAAM,MAAM,MAAM,IAAI;EAGtB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,YAAY,aAAa,gBAAgB,KAAA;EAGzC,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aAAc,QACX;GACH,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAO,QAAQ,OAAO,IAAI;CAC5B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAuC,iBAAiB,CAAC,MAAM;CAC1E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OAAO,OAAgB,UAA0B;GACxD,MAAM,MAAM,MAAM,IAAI;GAKtB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAEtC;GAMF,IACE,CAAC,gBACC,QAAQ,QACR,MAAM,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAA,CACrC,GACA;IACA,MAAM,IAAI,SAAS;IACnB,OAAO,EAAE,OAAO,kBAAkB;GACpC;GAEA,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE;GAClD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBAAgB;IACnB,MAAM,IAAI,SAAS;IACnB,OAAO,EAAE,OAAO,mBAAmB;GACrC;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,MAAM,IAAI,OAAO,YAAY,MAAM,QAAQ;KAC7C,MAAM,IAAI,SAAS;KACnB,OAAO,EAAE,OAAO,mBAAmB;IACrC;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;KAC7C,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;OAC1B,MAAM,IAAI,SAAS;OACnB,OAAO,EAAE,OAAO,YAAY;MAC9B;MACA,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,MAAM,IAAI,QAAQ,IAAI,cAAc,KAAK,KAAA,CAC3C,GACA;MACA,MAAM,IAAI,SAAS;MACnB,OAAO,EAAE,OAAO,uBAAuB;KACzC;KACA,MAAM,OAAO,MAAM,SAAS,KAAK;KACjC,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,MAAM;KACf,UAAU,MAAM;KAChB,aAAa;KACb,QAAQ,MAAM;KACd;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAGzD,MAAM,UAAU,MAAM,SAAS,MAAM;IACrC,IAAI,SAAS,QAAQ,GAAG,SAAS,OAAO;IACxC,MAAM,SAAS,MAAM,SAAS;IAC9B,IAAI,SAAS,QAAQ,IAAI,SAAS,OAAO;IAEzC,IAAI,aAAa,YACf,OAAOC,SACL,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,MAAM,IAAI,SAAS;KACnB,IAAI,SACF,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,MAAM,IAAI,QAAQ,IAAI,MAAM,KAAK;KAGrC,OAAO;IACT;IAEA,OAAO,EAAE,MAAM,OAAO;GACxB,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,MAAM,IAAI,SAAS;IAEnB,OAAO,YAAY,KAAK,YAAY;GACtC;EACF;CACF,CAAC;AACH"}

package/dist/helpers/helpers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.mts","names":[],"sources":["../../src/types.d.ts","../../src/client-helpers.ts"],"mappings":";;;;;;;;;;;;;;;KAkEY;;;;KASA;;;;;KA+CA;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;KAgDxC,eACV,cAAc,YAAY,WAC1B,UAAU,iBACJ,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;UAuLM;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;;;qBC7XE,iBAAwB,UAAU,WAAS,UAC5C,aACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;qBAkCE,iBAAkB,GAAC,kBAAkB;;;;;;;;;;;;;;;;;;;;wBA0HlC,cAAc,UAAU,WAAW,UAAU,WAC3D,gBACA,cACA,UAAU,QAAQ,eACjB,eAAe,GAAG;;;;;;;;;;;;;;qBAiBR,cAAe,UAAU,WAAS,MACvC,UAAQ,SACL,aAAW,aACP,aAAW,gBACV,cACF,4BAEX,eAAe"}
+{"version":3,"file":"helpers.d.mts","names":[],"sources":["../../src/types.d.ts","../../src/client-helpers.ts"],"mappings":";;;;;;;;;;;;;;;KAkEY;;;;KASA;;;;;KA+CA;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;KAgDxC,eACV,cAAc,YAAY,WAC1B,UAAU,iBACJ,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;UA6LM;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;;;qBCnYE,iBAAwB,UAAU,WAAS,UAC5C,aACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;qBAkCE,iBAAkB,GAAC,kBAAkB;;;;;;;;;;;;;;;;;;;;wBA0HlC,cAAc,UAAU,WAAW,UAAU,WAC3D,gBACA,cACA,UAAU,QAAQ,eACjB,eAAe,GAAG;;;;;;;;;;;;;;qBAiBR,cAAe,UAAU,WAAS,MACvC,UAAQ,SACL,aAAW,aACP,aAAW,gBACV,cACF,4BAEX,eAAe"}

package/dist/hono/hono.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"hono.d.mts","names":["Hono","createMiddleware"],"sources":["../../src/hono/types.d.ts","../../src/hono/createMiddleware.ts","../../src/hono/helpers.ts"],"mappings":";;;;;;;;;;;KAOY,mBAAmB;EAAoB;;;;;KAKvC,wBAAwB;;;;UAKnB;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,sCACxC,iBAAiB,QAAQ,kBAAkB,QACxC;;;;;;;;;;qBCkBQ,kBAAkB;;;;;;;;qBAgFlB,qBAAqB;;;;;;;;wBC3GZ,UAAU,KAAKA,SAAI;;;;;;;qBAgB5B,aAAU,KAASA,QAAI,MAAQ;;;;;;;;;qBAY/B,iBAAc,MACnB,kBACL,kBAAkBC;EAAmB,UAAU;;;;;;;;qBAgDrC,WAAQ,GAChB,YACF,QAAQ;;;;;;;;;;;qBA4DE,WAAQ,GAChB,SAAO,kBACM,SACR,uBACP"}
+{"version":3,"file":"hono.d.mts","names":["Hono","createMiddleware"],"sources":["../../src/hono/types.d.ts","../../src/hono/createMiddleware.ts","../../src/hono/helpers.ts"],"mappings":";;;;;;;;;;;KAOY,mBAAmB;EAAoB;;;;;KAKvC,wBAAwB;;;;UAKnB;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,sCACxC,iBAAiB,QAAQ,kBAAkB,QACxC;;;;;;;;;;qBCmBQ,kBAAkB;;;;;;;;qBAgFlB,qBAAqB;;;;;;;;wBC5GZ,UAAU,KAAKA,SAAI;;;;;;;qBAgB5B,aAAU,KAASA,QAAI,MAAQ;;;;;;;;;qBAY/B,iBAAc,MACnB,kBACL,kBAAkBC;EAAmB,UAAU;;;;;;;;qBAgDrC,WAAQ,GAChB,YACF,QAAQ;;;;;;;;;;;qBA4DE,WAAQ,GAChB,SAAO,kBACM,SACR,uBACP"}

package/dist/hono/hono.mjs

@@ -1,5 +1,5 @@
 import { createMiddleware as createMiddleware$1 } from "hono/factory";
-import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, provideRequestContext, safeURL, scanForServerFiles } from "@thednp/rpc/server";
+import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, isOriginAllowed, provideRequestContext, safeURL, scanForServerFiles } from "@thednp/rpc/server";
 const defaultRPCOptions = {
 	rpcPrefix: "__rpc",
 	adapter: "express",
@@ -206,9 +206,7 @@ const createRPCMiddleware = (initialOptions = {}) => {
 		handler: async (c, _next) => {
 			const { path: reqPath } = c.req;
 			if (prefixRegex && !prefixRegex.test(reqPath)) return;
-			const origin = options.origin;
-			const requestOrigin = c.req.header("origin");
-			if (origin && requestOrigin && requestOrigin !== origin) return c.json({ error: REQUEST_FORBIDDEN }, 403);
+			if (!isOriginAllowed(options.origin, c.req.header("origin"))) return c.json({ error: REQUEST_FORBIDDEN }, 403);
 			const functionName = reqPath.replace(prefixReplace, "");
 			const serverFunction = getFunctionsForPrefix(prefix).get(functionName);
 			if (!serverFunction) return c.json({ error: FUNCTION_NOT_FOUND }, 404);

package/dist/hono/hono.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hono.mjs","names":["createMiddleware","createHonoMiddleware"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/hono/helpers.ts","../../src/hono/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/hono/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { HttpBindings } from \"@hono/node-server\";\nimport type { Context, Hono } from \"hono\";\nimport type { ViteDevServer } from \"vite\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { IncomingWithBody } from \"./types.d.ts\";\nimport { createMiddleware } from \"hono/factory\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to a Hono app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - Hono application instance\n */\nexport async function attachRPC(app: Hono) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Hono app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into Hono.\n * @param app - Hono application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: Hono, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates a Hono-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to Hono's context-based request/response model.\n * Supports both Node.js and Bun runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns A Hono middleware function\n * @see https://github.com/honojs/hono/issues/3162#issuecomment-2331118049\n */\nexport const viteMiddleware = (\n  vite: ViteDevServer,\n): ReturnType<typeof createMiddleware<{ Bindings: HttpBindings }>> => {\n  return createMiddleware<{ Bindings: HttpBindings }>((c, next) => {\n    return new Promise((resolve) => {\n      // Node.js\n      // @ts-expect-error - NodeJS is different\n      // istanbul ignore if\n      if (typeof Bun === \"undefined\") {\n        vite.middlewares(c.env.incoming, c.env.outgoing, () => resolve(next()));\n        return;\n      }\n\n      /* istanbul ignore next */ {\n        // Bun\n        let sent = false;\n        const headers = new Headers();\n        // Polyfill the node:http IncommingMessage and ServerResponse\n        vite.middlewares(\n          {\n            url: new URL(c.req.path, \"http://localhost\").pathname,\n            method: c.req.raw.method,\n            headers: Object.fromEntries(c.req.raw.headers),\n          } as IncomingMessage,\n          {\n            setHeader(name, value: string) {\n              headers.set(name, value);\n              return this;\n            },\n            end(body) {\n              sent = true;\n              resolve(\n                // @ts-expect-error - weird\n                c.body(body, c.res.status as ContentfulStatusCode, headers),\n              );\n            },\n          } as ServerResponse,\n          () => sent || resolve(next()),\n        );\n      }\n    });\n  });\n};\n\n/**\n * Reads and parses the HTTP request body from a Hono context.\n * Supports JSON and text content types, with pre-parsed body detection for server-side environments.\n * @param c - Hono request context\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (\n  c: Context,\n): Promise<BodyResult> => {\n  const contentType = c.req.header(\"content-type\")?.toLowerCase() || \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  const incoming = (c.env as HttpBindings).incoming as\n    | IncomingWithBody\n    | undefined;\n  if (incoming?.body !== undefined) {\n    const reqBody = incoming.body;\n    return {\n      contentType: isMultipart\n        ? \"multipart/form-data\"\n        : isJSON\n        ? \"application/json\"\n        : isUrlEncoded\n        ? \"application/x-www-form-urlencoded\"\n        : \"text/plain\",\n      data: isMultipart\n        ? (reqBody as Record<string, unknown>)\n        : isJSON\n        ? reqBody\n        : isUrlEncoded\n        ? (reqBody as Record<string, unknown>)\n        : String(reqBody),\n    } as BodyResult;\n  }\n  if (isJSON) {\n    const data = await c.req.json();\n    return {\n      contentType: \"application/json\",\n      data,\n    };\n  }\n\n  const text = await c.req.text();\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect on a Hono context. Hono's `c.redirect(location,\n * status)` returns a `Response` object that the handler must return (it never\n * writes directly). Defaults to `303 See Other` for convention\n * (Post/Redirect/Get).\n * @param c - Hono context\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns A Hono `Response` to return from the handler\n */\nexport const redirect = (\n  c: Context,\n  location: string,\n  status: RedirectStatusCode = 303,\n): Response => {\n  return c.redirect(location, status);\n};\n","// src/hono/createMiddleware.ts\nimport type { Context, Next } from \"hono\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { HonoMiddlewareFn, HonoMiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport { createMiddleware as createHonoMiddleware } from \"hono/factory\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  provideRequestContext,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Hono middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * Uses Hono's factory `createMiddleware` to wrap the handler.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Hono middleware function\n */\nexport const createMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = createHonoMiddleware(\n    async (c: Context, next: Next) => {\n      const reqUrl = safeURL(c.req.path);\n      const url = reqUrl.pathname;\n\n      // No need to continue when no handler provided\n      if (!handler) {\n        return next();\n      }\n\n      if (pathMatcher && !pathMatcher.test(url)) {\n        return next();\n      }\n\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return next();\n      }\n\n      rpcPrefix = (rpcPrefix ?? defaultPrefix) as string;\n\n      // When serving from production server, scan for server files\n      if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n        await scanForServerFiles({\n          rpcPrefix,\n          serverFiles:\n            (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n              .serverFiles,\n          scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n        } as never);\n      }\n\n      return (await handler(c, next)) as Response;\n    },\n  );\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Hono RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Hono middleware function\n */\nexport const createRPCMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (c: Context, _next: Next) => {\n      const { path: reqPath } = c.req;\n      // const { rpcPrefix: prefix } = options;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(reqPath)) {\n        /* istanbul ignore next */\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = c.req.header(\"origin\");\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        return c.json({ error: REQUEST_FORBIDDEN }, 403);\n      }\n\n      const functionName = reqPath.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        return c.json({ error: FUNCTION_NOT_FOUND }, 404);\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (c.req.method.toUpperCase() !== method) {\n          return c.json({ error: METHOD_NOT_ALLOWED }, 405);\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = c.req.query(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              return c.json({ error: BAD_REQUEST }, 400);\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              c.req.header(\"content-type\"),\n            )\n          ) {\n            return c.json({ error: UNSUPPORTED_MEDIA_TYPE }, 415);\n          }\n          const body = await readBody(c);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: c.req,\n          response: c.res,\n          nativeEvent: c,\n          locals: {},\n          functionName,\n          // Hono's `c.redirect`/`c.json` return a `Response` (never write\n          // directly), so the bound redirect/send only record the intent; the\n          // middleware uses them after the dispatch to return the Response.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onAbort = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The runtime adapter may be absent in some Hono environments\n        // (e.g. standalone serverless adapters), so guard the close hook.\n        c.env.incoming?.on(\"close\", onAbort);\n        const result = await fnResult.data;\n        c.env.incoming?.off(\"close\", onAbort);\n\n        if (requestEvent.redirected) {\n          return c.redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status as RedirectStatusCode,\n          ) as Response;\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          return c.body(JSON.stringify(body), status as ContentfulStatusCode, {\n            \"content-type\": \"application/json\",\n            ...headers,\n          });\n        }\n\n        return c.json({ data: result }, 200);\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        return c.json(formatError(err, isProduction), 500);\n      }\n    },\n  });\n};\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACP/B,eAAsB,UAAU,KAAW;CAIzC,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAE9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAW,SAA8B;CAClE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;;AAUA,MAAa,kBACX,SACoE;CACpE,OAAOA,oBAA8C,GAAG,SAAS;EAC/D,OAAO,IAAI,SAAS,YAAY;GAI9B,IAAI,OAAO,QAAQ,aAAa;IAC9B,KAAK,YAAY,EAAE,IAAI,UAAU,EAAE,IAAI,gBAAgB,QAAQ,KAAK,CAAC,CAAC;IACtE;GACF;GAEC;IAEC,IAAI,OAAO;IACX,MAAM,UAAU,IAAI,QAAQ;IAE5B,KAAK,YACH;KACE,KAAK,IAAI,IAAI,EAAE,IAAI,MAAM,kBAAkB,CAAC,CAAC;KAC7C,QAAQ,EAAE,IAAI,IAAI;KAClB,SAAS,OAAO,YAAY,EAAE,IAAI,IAAI,OAAO;IAC/C,GACA;KACE,UAAU,MAAM,OAAe;MAC7B,QAAQ,IAAI,MAAM,KAAK;MACvB,OAAO;KACT;KACA,IAAI,MAAM;MACR,OAAO;MACP,QAEE,EAAE,KAAK,MAAM,EAAE,IAAI,QAAgC,OAAO,CAC5D;KACF;IACF,SACM,QAAQ,QAAQ,KAAK,CAAC,CAC9B;GACF;EACF,CAAC;CACH,CAAC;AACH;;;;;;;AAQA,MAAa,WAAW,OACtB,MACwB;CACxB,MAAM,cAAc,EAAE,IAAI,OAAO,cAAc,CAAC,EAAE,YAAY,KAAK;CACnE,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CACtD,MAAM,WAAY,EAAE,IAAqB;CAGzC,IAAI,UAAU,SAAS,KAAA,GAAW;EAChC,MAAM,UAAU,SAAS;EACzB,OAAO;GACL,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;GACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;EACpB;CACF;CACA,IAAI,QAEF,OAAO;EACL,aAAa;EACb,MAAA,MAHiB,EAAE,IAAI,KAAK;CAI9B;CAGF,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK;CAC9B,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;;;AAYA,MAAa,YACX,GACA,UACA,SAA6B,QAChB;CACb,OAAO,EAAE,SAAS,UAAU,MAAM;AACpC;;;ACjIA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAsC,iBAAiB,CAAC,MAAM;CACzE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoBC,mBACxB,OAAO,GAAY,SAAe;EAEhC,MAAM,MADS,QAAQ,EAAE,IAAI,IACZ,CAAC,CAAC;EAGnB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,YAAa,aAAA;EAGb,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aACG,QACE;GACL,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAQ,MAAM,QAAQ,GAAG,IAAI;CAC/B,CACF;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OAAO,GAAY,UAAgB;GAC1C,MAAM,EAAE,MAAM,YAAY,EAAE;GAM5B,IAAI,eAAe,CAAC,YAAY,KAAK,OAAO,GAE1C;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,EAAE,IAAI,OAAO,QAAQ;GAC3C,IAAI,UAAU,iBAAiB,kBAAkB,QAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAGjD,MAAM,eAAe,QAAQ,QAAQ,eAAe,EAAE;GACtD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBACH,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;GAGlD,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;IAGlD,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;KAC9B,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;MAE3C,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,EAAE,IAAI,OAAO,cAAc,CAC7B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;KAEtD,MAAM,OAAO,MAAM,SAAS,CAAC;KAC7B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,EAAE;KACX,UAAU,EAAE;KACZ,aAAa;KACb,QAAQ,CAAC;KACT;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAGzD,EAAE,IAAI,UAAU,GAAG,SAAS,OAAO;IACnC,MAAM,SAAS,MAAM,SAAS;IAC9B,EAAE,IAAI,UAAU,IAAI,SAAS,OAAO;IAEpC,IAAI,aAAa,YACf,OAAO,EAAE,SACP,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,GAAG,QAAgC;MAClE,gBAAgB;MAChB,GAAG;KACL,CAAC;IACH;IAEA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,GAAG;GACrC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,OAAO,EAAE,KAAK,YAAY,KAAK,YAAY,GAAG,GAAG;GACnD;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"hono.mjs","names":["createMiddleware","createHonoMiddleware"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/hono/helpers.ts","../../src/hono/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/hono/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { HttpBindings } from \"@hono/node-server\";\nimport type { Context, Hono } from \"hono\";\nimport type { ViteDevServer } from \"vite\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { IncomingWithBody } from \"./types.d.ts\";\nimport { createMiddleware } from \"hono/factory\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to a Hono app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - Hono application instance\n */\nexport async function attachRPC(app: Hono) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Hono app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into Hono.\n * @param app - Hono application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: Hono, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates a Hono-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to Hono's context-based request/response model.\n * Supports both Node.js and Bun runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns A Hono middleware function\n * @see https://github.com/honojs/hono/issues/3162#issuecomment-2331118049\n */\nexport const viteMiddleware = (\n  vite: ViteDevServer,\n): ReturnType<typeof createMiddleware<{ Bindings: HttpBindings }>> => {\n  return createMiddleware<{ Bindings: HttpBindings }>((c, next) => {\n    return new Promise((resolve) => {\n      // Node.js\n      // @ts-expect-error - NodeJS is different\n      // istanbul ignore if\n      if (typeof Bun === \"undefined\") {\n        vite.middlewares(c.env.incoming, c.env.outgoing, () => resolve(next()));\n        return;\n      }\n\n      /* istanbul ignore next */ {\n        // Bun\n        let sent = false;\n        const headers = new Headers();\n        // Polyfill the node:http IncommingMessage and ServerResponse\n        vite.middlewares(\n          {\n            url: new URL(c.req.path, \"http://localhost\").pathname,\n            method: c.req.raw.method,\n            headers: Object.fromEntries(c.req.raw.headers),\n          } as IncomingMessage,\n          {\n            setHeader(name, value: string) {\n              headers.set(name, value);\n              return this;\n            },\n            end(body) {\n              sent = true;\n              resolve(\n                // @ts-expect-error - weird\n                c.body(body, c.res.status as ContentfulStatusCode, headers),\n              );\n            },\n          } as ServerResponse,\n          () => sent || resolve(next()),\n        );\n      }\n    });\n  });\n};\n\n/**\n * Reads and parses the HTTP request body from a Hono context.\n * Supports JSON and text content types, with pre-parsed body detection for server-side environments.\n * @param c - Hono request context\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (\n  c: Context,\n): Promise<BodyResult> => {\n  const contentType = c.req.header(\"content-type\")?.toLowerCase() || \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  const incoming = (c.env as HttpBindings).incoming as\n    | IncomingWithBody\n    | undefined;\n  if (incoming?.body !== undefined) {\n    const reqBody = incoming.body;\n    return {\n      contentType: isMultipart\n        ? \"multipart/form-data\"\n        : isJSON\n        ? \"application/json\"\n        : isUrlEncoded\n        ? \"application/x-www-form-urlencoded\"\n        : \"text/plain\",\n      data: isMultipart\n        ? (reqBody as Record<string, unknown>)\n        : isJSON\n        ? reqBody\n        : isUrlEncoded\n        ? (reqBody as Record<string, unknown>)\n        : String(reqBody),\n    } as BodyResult;\n  }\n  if (isJSON) {\n    const data = await c.req.json();\n    return {\n      contentType: \"application/json\",\n      data,\n    };\n  }\n\n  const text = await c.req.text();\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect on a Hono context. Hono's `c.redirect(location,\n * status)` returns a `Response` object that the handler must return (it never\n * writes directly). Defaults to `303 See Other` for convention\n * (Post/Redirect/Get).\n * @param c - Hono context\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns A Hono `Response` to return from the handler\n */\nexport const redirect = (\n  c: Context,\n  location: string,\n  status: RedirectStatusCode = 303,\n): Response => {\n  return c.redirect(location, status);\n};\n","// src/hono/createMiddleware.ts\nimport type { Context, Next } from \"hono\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { HonoMiddlewareFn, HonoMiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport { createMiddleware as createHonoMiddleware } from \"hono/factory\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  isOriginAllowed,\n  provideRequestContext,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Hono middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * Uses Hono's factory `createMiddleware` to wrap the handler.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Hono middleware function\n */\nexport const createMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = createHonoMiddleware(\n    async (c: Context, next: Next) => {\n      const reqUrl = safeURL(c.req.path);\n      const url = reqUrl.pathname;\n\n      // No need to continue when no handler provided\n      if (!handler) {\n        return next();\n      }\n\n      if (pathMatcher && !pathMatcher.test(url)) {\n        return next();\n      }\n\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return next();\n      }\n\n      rpcPrefix = (rpcPrefix ?? defaultPrefix) as string;\n\n      // When serving from production server, scan for server files\n      if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n        await scanForServerFiles({\n          rpcPrefix,\n          serverFiles:\n            (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n              .serverFiles,\n          scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n        } as never);\n      }\n\n      return (await handler(c, next)) as Response;\n    },\n  );\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Hono RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Hono middleware function\n */\nexport const createRPCMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (c: Context, _next: Next) => {\n      const { path: reqPath } = c.req;\n      // const { rpcPrefix: prefix } = options;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(reqPath)) {\n        /* istanbul ignore next */\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header is not in\n      // the configured allowlist. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      if (!isOriginAllowed(options.origin, c.req.header(\"origin\"))) {\n        return c.json({ error: REQUEST_FORBIDDEN }, 403);\n      }\n\n      const functionName = reqPath.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        return c.json({ error: FUNCTION_NOT_FOUND }, 404);\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (c.req.method.toUpperCase() !== method) {\n          return c.json({ error: METHOD_NOT_ALLOWED }, 405);\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = c.req.query(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              return c.json({ error: BAD_REQUEST }, 400);\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              c.req.header(\"content-type\"),\n            )\n          ) {\n            return c.json({ error: UNSUPPORTED_MEDIA_TYPE }, 415);\n          }\n          const body = await readBody(c);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: c.req,\n          response: c.res,\n          nativeEvent: c,\n          locals: {},\n          functionName,\n          // Hono's `c.redirect`/`c.json` return a `Response` (never write\n          // directly), so the bound redirect/send only record the intent; the\n          // middleware uses them after the dispatch to return the Response.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onAbort = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The runtime adapter may be absent in some Hono environments\n        // (e.g. standalone serverless adapters), so guard the close hook.\n        c.env.incoming?.on(\"close\", onAbort);\n        const result = await fnResult.data;\n        c.env.incoming?.off(\"close\", onAbort);\n\n        if (requestEvent.redirected) {\n          return c.redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status as RedirectStatusCode,\n          ) as Response;\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          return c.body(JSON.stringify(body), status as ContentfulStatusCode, {\n            \"content-type\": \"application/json\",\n            ...headers,\n          });\n        }\n\n        return c.json({ data: result }, 200);\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        return c.json(formatError(err, isProduction), 500);\n      }\n    },\n  });\n};\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACP/B,eAAsB,UAAU,KAAW;CAIzC,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAE9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAW,SAA8B;CAClE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;;AAUA,MAAa,kBACX,SACoE;CACpE,OAAOA,oBAA8C,GAAG,SAAS;EAC/D,OAAO,IAAI,SAAS,YAAY;GAI9B,IAAI,OAAO,QAAQ,aAAa;IAC9B,KAAK,YAAY,EAAE,IAAI,UAAU,EAAE,IAAI,gBAAgB,QAAQ,KAAK,CAAC,CAAC;IACtE;GACF;GAEC;IAEC,IAAI,OAAO;IACX,MAAM,UAAU,IAAI,QAAQ;IAE5B,KAAK,YACH;KACE,KAAK,IAAI,IAAI,EAAE,IAAI,MAAM,kBAAkB,CAAC,CAAC;KAC7C,QAAQ,EAAE,IAAI,IAAI;KAClB,SAAS,OAAO,YAAY,EAAE,IAAI,IAAI,OAAO;IAC/C,GACA;KACE,UAAU,MAAM,OAAe;MAC7B,QAAQ,IAAI,MAAM,KAAK;MACvB,OAAO;KACT;KACA,IAAI,MAAM;MACR,OAAO;MACP,QAEE,EAAE,KAAK,MAAM,EAAE,IAAI,QAAgC,OAAO,CAC5D;KACF;IACF,SACM,QAAQ,QAAQ,KAAK,CAAC,CAC9B;GACF;EACF,CAAC;CACH,CAAC;AACH;;;;;;;AAQA,MAAa,WAAW,OACtB,MACwB;CACxB,MAAM,cAAc,EAAE,IAAI,OAAO,cAAc,CAAC,EAAE,YAAY,KAAK;CACnE,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CACtD,MAAM,WAAY,EAAE,IAAqB;CAGzC,IAAI,UAAU,SAAS,KAAA,GAAW;EAChC,MAAM,UAAU,SAAS;EACzB,OAAO;GACL,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;GACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;EACpB;CACF;CACA,IAAI,QAEF,OAAO;EACL,aAAa;EACb,MAAA,MAHiB,EAAE,IAAI,KAAK;CAI9B;CAGF,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK;CAC9B,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;;;AAYA,MAAa,YACX,GACA,UACA,SAA6B,QAChB;CACb,OAAO,EAAE,SAAS,UAAU,MAAM;AACpC;;;AChIA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAsC,iBAAiB,CAAC,MAAM;CACzE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoBC,mBACxB,OAAO,GAAY,SAAe;EAEhC,MAAM,MADS,QAAQ,EAAE,IAAI,IACZ,CAAC,CAAC;EAGnB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,YAAa,aAAA;EAGb,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aACG,QACE;GACL,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAQ,MAAM,QAAQ,GAAG,IAAI;CAC/B,CACF;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OAAO,GAAY,UAAgB;GAC1C,MAAM,EAAE,MAAM,YAAY,EAAE;GAM5B,IAAI,eAAe,CAAC,YAAY,KAAK,OAAO,GAE1C;GAMF,IAAI,CAAC,gBAAgB,QAAQ,QAAQ,EAAE,IAAI,OAAO,QAAQ,CAAC,GACzD,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAGjD,MAAM,eAAe,QAAQ,QAAQ,eAAe,EAAE;GACtD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBACH,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;GAGlD,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;IAGlD,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;KAC9B,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;MAE3C,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,EAAE,IAAI,OAAO,cAAc,CAC7B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;KAEtD,MAAM,OAAO,MAAM,SAAS,CAAC;KAC7B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,EAAE;KACX,UAAU,EAAE;KACZ,aAAa;KACb,QAAQ,CAAC;KACT;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAGzD,EAAE,IAAI,UAAU,GAAG,SAAS,OAAO;IACnC,MAAM,SAAS,MAAM,SAAS;IAC9B,EAAE,IAAI,UAAU,IAAI,SAAS,OAAO;IAEpC,IAAI,aAAa,YACf,OAAO,EAAE,SACP,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,GAAG,QAAgC;MAClE,gBAAgB;MAChB,GAAG;KACL,CAAC;IACH;IAEA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,GAAG;GACrC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,OAAO,EAAE,KAAK,YAAY,KAAK,YAAY,GAAG,GAAG;GACnD;EACF;CACF,CAAC;AACH"}

package/dist/index.d.mts

@@ -381,13 +381,19 @@ interface MiddlewareOptions<A extends RpcPluginOptions["adapter"] = "express"> {
    */
   rpcPrefix?: string | false;
   /**
-   * Allowed request origin (e.g. "https://example.com").
-   * When set, any request carrying an `Origin` header that does not match
-   * is rejected with a 403 Forbidden response. Requests without an `Origin`
-   * header (curl, native clients) pass through unchecked.
+   * Allowed request origin(s) — a single origin string or an allowlist of them
+   * (e.g. `"https://example.com"` or
+   * `["https://example.com", "https://admin.example.com"]`).
+   *
+   * When set, any request carrying an `Origin` header that matches none of the
+   * entries is rejected with a 403 Forbidden response. Requests without an
+   * `Origin` header (curl, native clients) pass through unchecked.
    * When unset (default), no origin validation is performed.
+   *
+   * `Origin: null` (sandboxed iframes, `file://`, extension pages) never
+   * equals a real origin, so it is rejected whenever an allowlist is set.
    */
-  origin?: string;
+  origin?: string | string[];
   /**
    * Server file matching mode. Use `"exact"` for `server.ts|js|mjs|mts`
    * names, or `"glob"` to match `**\/*.server.{ts,js,mjs,mts}` inside the

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":["MiddlewareOptions","RpcPluginOptions","Response","RpcPluginOptions","MiddlewareOptions","MiddlewareOptions","RpcPluginOptions","MiddlewareOptions","RpcPluginOptions","MiddlewareOptions","RpcPluginOptions"],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/h3/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;KAgBY,2BAA2BA;;;;;KAM3B,uBACV,UAAUC,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiBC,YACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;;UCzBU;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAUC,wCACxC,iBAAiB,QAAQC,oBAAkB,QACxC;;;;;;KCWO,2BAA2BC;;;;;KAM3B,uBACV,UAAUC,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;;;KCtDK,uBAAuBC;;;;UAalB;;;;;;EAMf,UAAU,KAAK,SAAS,MAAM,SAAS;;;;;;KAO7B,mBAAmB,UAAUC,uCACvC,iBAAiB,QAAQ,0BACtB;;;;;;KChCO,sBAAsBC;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAUC,sCACtC,iBAAiB,QAAQ,yBACtB;;;;;;;UCJY;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;UAMW;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;;KAOM;;;;KAUA;;;;KASA;;;;KAKA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;EAE7B;EACA,MAAM;;EAEJ;EAAoC,MAAM;;;;;;UAM/B;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;EAKA;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;KAuBxC,mBAAmB;;;;;KAMnB,eACV,cAAc,YAAY,WAC1B,UAAU,cACP,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;KAMzC,mBACV,cAAc,WAAW,YAAY,WACrC,UAAU,cACP,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,UAAU,iBACJ,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;UAMe,mBAAmB,KAAK;EACvC;EACA,SAAS,QAAQ;EACjB;EACA;;EAEA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;EASA;;;;;;;;EASA;;;;;EAMA;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;UAOV;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;;;cC5VL,gBACJ,qBACA;EAAS;MACN,QAAQ;;;;;;;;iBA6FJ,UACP,aAAY,QAAQ,oBACnB"}
+{"version":3,"file":"index.d.mts","names":["MiddlewareOptions","RpcPluginOptions","Response","RpcPluginOptions","MiddlewareOptions","MiddlewareOptions","RpcPluginOptions","MiddlewareOptions","RpcPluginOptions","MiddlewareOptions","RpcPluginOptions"],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/h3/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;KAgBY,2BAA2BA;;;;;KAM3B,uBACV,UAAUC,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiBC,YACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;;UCzBU;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAUC,wCACxC,iBAAiB,QAAQC,oBAAkB,QACxC;;;;;;KCWO,2BAA2BC;;;;;KAM3B,uBACV,UAAUC,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;;;KCtDK,uBAAuBC;;;;UAalB;;;;;;EAMf,UAAU,KAAK,SAAS,MAAM,SAAS;;;;;;KAO7B,mBAAmB,UAAUC,uCACvC,iBAAiB,QAAQ,0BACtB;;;;;;KChCO,sBAAsBC;;;;UAKjB;;;;;;EAMf,SAAS;;;;;;KAOC,kBAAkB,UAAUC,sCACtC,iBAAiB,QAAQ,yBACtB;;;;;;;UCJY;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;UAMW;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;EAEL,IAAI;;;;;;KAOM;;;;KAUA;;;;KASA;;;;KAKA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;EAE7B;EACA,MAAM;;EAEJ;EAAoC,MAAM;;;;;;UAM/B;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;EAKA;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;KAuBxC,mBAAmB;;;;;KAMnB,eACV,cAAc,YAAY,WAC1B,UAAU,cACP,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;KAMzC,mBACV,cAAc,WAAW,YAAY,WACrC,UAAU,cACP,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,UAAU,iBACJ,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;UAMe,mBAAmB,KAAK;EACvC;EACA,SAAS,QAAQ;EACjB;EACA;;EAEA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;;;;;;;EAeA;;;;;;;;EASA;;;;;EAMA;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;UAOV;;;;;EAKf;;;;;EAKA,aAAa;;;;;;;EAOb,aAAa;;;;;;KAOH,eAAe,UAAU;;EAEnC,MAAM,QAAQ;;EAEd,SAAS;;;;;;;;;;;;cClWL,gBACJ,qBACA;EAAS;MACN,QAAQ;;;;;;;;iBA6FJ,UACP,aAAY,QAAQ,oBACnB"}