@thednp/rpc 0.3.5 → 0.3.7

package/dist/server/server.mjs

@@ -3,18 +3,37 @@ import { join, resolve } from "node:path";
 import process from "node:process";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/options.ts
+/**
+* Defaults applied to a server function that declares no `method`,
+* `credentials`, or `contentType` of its own.
+*/
 const defaultServerFnOptions = {
 	contentType: "application/json",
 	credentials: "same-origin",
 	method: "POST"
 };
+/**
+* The built-in RPC endpoint prefix, used when neither an explicit prefix nor a
+* global one (`getGlobalPrefix`) is supplied. Kept for backward compatibility
+* with pre-multi-prefix setups, where every function lived under this one map.
+*/
 const defaultPrefix = "__rpc";
+/**
+* Baseline plugin options. `defineConfig` merges a user's partial config over
+* these, and `loadRPCConfig` merges a loaded config file over them, so every
+* option has a defined value even when a config file omits it.
+*/
 const defaultRPCOptions = {
 	rpcPrefix: defaultPrefix,
-	adapter: "express",
 	serverFiles: "exact",
 	scanRoot: void 0
 };
+/**
+* Baseline middleware options. Note `rpcPrefix` is `undefined` rather than
+* `defaultPrefix` on purpose: leaving it unset lets `resolveRPCPrefix` fall
+* through to the global prefix, which is what makes a published global prefix
+* reach the middleware.
+*/
 const defaultMiddlewareOptions = {
 	rpcPrefix: void 0,
 	path: void 0,
@@ -67,9 +86,31 @@ const serverFunctionsMap = {
 };
 //#endregion
 //#region src/constants.ts
+/**
+* @module User-facing message strings.
+*
+* Two shapes live here: plain message constants (the exact text an RPC
+* response body carries) and message *factories* for the cases that need a
+* value interpolated. Both are part of the wire contract for the bodies below,
+* so the casing is deliberate — e.g. a client matching on
+* `METHOD_NOT_ALLOWED` must see `"Method Not Allowed"`, not `"Method not
+* allowed"`. These strings are also what keeps error responses generic: they
+* never include the requested function name, so a response cannot be used to
+* enumerate what exists.
+*/
+/** Thrown-name for an operation stopped by its own `cancel()`. */
 const OPERATION_ABORTED = "Operation aborted";
+/** Warning logged when a scanned server module exports nothing. */
 const NO_SERVER_FUNCTION_FOUND = "No server function found.";
+/** Error logged when a server function file cannot be loaded by Vite's SSR loader. */
 const ERROR_LOADING_FILE = "Error loading file:";
+/** Body of a 415, returned when the request's `Content-Type` does not satisfy the function's declared `contentType`. */
+const UNSUPPORTED_MEDIA_TYPE = "Unsupported Media Type";
+/** Body of a 413, returned when the request body exceeds the host's configured size limit. */
+const PAYLOAD_TOO_LARGE = "Payload Too Large";
+/** Body of a 400, returned when a GET `?args=` value parses but is not an array. */
+const BAD_REQUEST = "Bad Request";
+/** Body of a 500. Always generic — never the underlying error, so internals cannot leak. */
 const INTERNAL_SERVER_ERROR = "Internal Server Error";
 /** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */
 const INVALID_IDENTIFIER = (label, name) => `Invalid ${label}: "${name}" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;
@@ -141,11 +182,60 @@ const formatError = (err, isProduction) => {
 	return { error: INTERNAL_SERVER_ERROR };
 };
 /**
-* Checks whether a content type maps to a form encoding
-* (`multipart/form-data` or `application/x-www-form-urlencoded`).
-* Form-declared functions accept either encoding so native browser
-* submissions (urlencoded) keep working without JavaScript.
+* Tags an error with an HTTP status for the dispatch to surface.
+*
+* Used where a malformed *request* is the fault — a body that does not parse
+* under a declared JSON `Content-Type`, a GET `?args=` value that is not valid
+* JSON. Every host framework rpc supports answers `400` for these (Express
+* `entity.parse.failed`, Fastify `FST_ERR_CTP_INVALID_JSON_BODY`, koa-bodyparser,
+* and h3's own `readBody`), and treating one as a server fault both misreports
+* the fault and turns a trivial client mistake into a log entry.
+* @param status - The HTTP status to answer with
+* @param message - Internal diagnostic message; never sent to the client
+* @returns An `Error` carrying `status`
+*/
+const httpError = (status, message) => {
+	const err = new Error(message);
+	err.status = status;
+	return err;
+};
+/**
+* Recognises an error that should produce a `4xx` response rather than a `500`.
+*
+* Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the
+* `http-errors` objects Express's `body-parser` throws, and anything else that
+* carries a numeric 4xx. Shared by all five adapters so a host-framework
+* signal and an rpc-raised one are handled by the same rule.
+* @param err - The caught error
+* @returns True when the error denotes a client (4xx) fault
 */
+const readClientStatus = (err) => {
+	const candidate = err;
+	const status = candidate?.status ?? candidate?.statusCode;
+	return typeof status === "number" && status >= 400 && status < 500 ? status : void 0;
+};
+/**
+* Recognises an error that should produce a `4xx` response rather than a `500`.
+* Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the
+* `http-errors` objects Express's `body-parser` throws, and anything else
+* carrying a numeric 4xx. Shared by all five adapters so a host-framework
+* signal and an rpc-raised one are handled by the same rule.
+* @param err - The caught error
+* @returns True when the error denotes a client (4xx) fault
+*/
+const isClientHttpError = (err) => readClientStatus(err) !== void 0;
+/**
+* Reads the status to answer for a client error. Defaults to `400` rather than
+* `500` so an unrecognised 4xx is never reported as a server fault.
+* @param err - The caught error
+* @returns The 4xx status to answer with
+*/
+const clientErrorStatus = (err) => readClientStatus(err) ?? 400;
+const clientErrorMessage = (status) => {
+	if (status === 413) return PAYLOAD_TOO_LARGE;
+	if (status === 415) return UNSUPPORTED_MEDIA_TYPE;
+	return BAD_REQUEST;
+};
 const isFormContentType = (contentType) => contentType === "multipart/form-data" || contentType === "application/x-www-form-urlencoded";
 /**
 * Detects whether an incoming request's `Content-Type` header conflicts
@@ -164,6 +254,47 @@ const hasContentTypeMismatch = (declared, rawHeader) => {
 	return incomingType !== declared;
 };
 /**
+* Decides whether a request may proceed, given the configured origin allowlist
+* and the two headers a browser can be made to reveal.
+*
+* Four tiers, evaluated in order — the first tier with a signal decides:
+*
+* 1. `origin` option unset → everything passes. No validation is performed.
+* 2. `Origin` present → the allowlist decides, exactly as {@link isOriginAllowed}.
+* 3. `Origin` absent but `Sec-Fetch-Site` present → allow only `same-origin`
+*    and `none`; anything else (including an unrecognised value) is rejected.
+* 4. Both absent → passes. This is the deliberate, documented curl/native hole.
+*
+* Tier 2 must short-circuit ahead of tier 3. `Sec-Fetch-Site` is a coarse
+* four-value enum that cannot name a host, so on its own it would reject a
+* legitimate request from an allowlisted sibling subdomain (`same-site`). The
+* allowlist exists precisely to admit that case, and it can only do so while
+* `Origin` survives. `Sec-Fetch-Site` earns a vote only once the precise signal
+* has been stripped away by something in the chain — at which point there is
+* nothing left to trust, so it fails closed.
+*
+* Browsers never strip `Origin` themselves, so tier 3 can only fire when a
+* proxy, sanitising middleware, or misconfigured CDN removed it. No legitimate
+* browser request can regress.
+*
+* An empty (or whitespace-only) header value counts as **absent**, not as an
+* unrecognised signal. No browser emits an empty `Sec-Fetch-Site`, and adapters
+* disagree on what their header accessor returns for a missing header (Node's
+* `req.headers` yields `undefined`, Hono's `c.req.header()` may yield `""`).
+* Normalising here keeps all five adapters behaving identically instead of
+* inheriting whichever convention their framework happens to use.
+* @param allowed - The configured `origin` option, if any
+* @param origin - The raw `Origin` request header, if present
+* @param site - The raw `Sec-Fetch-Site` request header, if present
+* @returns `true` when the request may proceed
+*/
+const isOriginRequestAllowed = (allowed, origin, site) => {
+	if (!allowed) return true;
+	if (origin?.trim()) return isOriginAllowed(allowed, origin);
+	if (!site?.trim()) return true;
+	return site === "same-origin" || site === "none";
+};
+/**
 * Escapes special regex metacharacters in a string.
 * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
 * preventing ReDoS and regex injection attacks.
@@ -218,13 +349,49 @@ const safeURL = (rawUrl, base = SAFE_URL_BASE) => {
 const globalPrefixSymbol = Symbol.for("thednp.rpc.globalPrefix");
 /** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */
 const getGlobalPrefix = () => globalThis[globalPrefixSymbol];
+/**
+* Publishes the global RPC prefix, consulted by `resolveRPCPrefix` whenever no
+* explicit prefix is supplied. `loadRPCConfig` calls this on every return path
+* so a loaded config is the fallback for later registrations and dispatches.
+*
+* Stored on a `Symbol.for` key on `globalThis` so it stays instance-stable
+* across the bundled entry copies (`server.mjs`, `express.mjs`, ...) and dev
+* server hot reloads — the same technique as the request-context storage.
+* @param prefix - The prefix to publish, or `undefined` to clear it
+*/
 const setGlobalPrefix = (prefix) => {
 	if (prefix) globalThis[globalPrefixSymbol] = prefix;
 	else delete globalThis[globalPrefixSymbol];
 };
+/**
+* Resolves the effective RPC prefix: the explicit one when given, otherwise
+* the global prefix set by `setGlobalPrefix` / `loadRPCConfig`, otherwise the
+* built-in default.
+*
+* Every adapter resolves its prefix through this single function — in both the
+* outer `createMiddleware` gate and the `createRPCMiddleware` dispatch — so the
+* two halves of a request can never disagree, and so a prefix registered by
+* `createServerFunction` (which resolves the same way) is always the prefix the
+* middleware looks up. Resolving the two sides independently is what allowed
+* h3 to drift from the other four adapters, and what left the documented
+* global-prefix flow returning 404 on all of them.
+* @param rpcPrefix - Explicit prefix from config or middleware options
+* @returns The prefix to gate on, look up in, and strip from the request path
+*/
+const resolveRPCPrefix = (rpcPrefix) => rpcPrefix || getGlobalPrefix() || "__rpc";
 //#endregion
 //#region src/scanForServerFiles.ts
-let isScanned = false;
+/**
+* Scan targets already performed, so a lazy re-scan is not repeated.
+*
+* Keyed by everything that determines the outcome — the resolved scan root
+* (which files are read), the matching mode, and the prefix prefix-less
+* functions register under. A single process-wide boolean used to be enough
+* only while there was one prefix: the *first* scan suppressed every later
+* one, so a second RPC instance on a different prefix asked for a lazy scan,
+* got an early return, and answered 404 for every function it owned.
+*/
+const scannedTargets = /* @__PURE__ */ new Set();
 /** Absolute ids (normalized) of the scanned server function files. */
 const scannedServerFiles = /* @__PURE__ */ new Set();
 const EXACT_NAMES = [
@@ -245,7 +412,11 @@ const EXACT_NAMES = [
 * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one
 */
 const scanForServerFiles = async (initialCfg, devServer) => {
-	if (isScanned && !devServer) return;
+	const root = initialCfg?.root || process.cwd();
+	const resolvedScanRoot = resolve(root, initialCfg?.scanRoot ?? join(root, "src", "api"));
+	const serverFiles = initialCfg?.serverFiles ?? "exact";
+	const target = `${resolvedScanRoot}|${serverFiles}|${initialCfg?.rpcPrefix ?? "__rpc"}`;
+	if (scannedTargets.has(target) && !devServer) return;
 	let createServer;
 	let normalizePath;
 	try {
@@ -253,7 +424,7 @@ const scanForServerFiles = async (initialCfg, devServer) => {
 	} catch {
 		return;
 	}
-	const config = !initialCfg && !devServer || !initialCfg ? {
+	const config = !initialCfg ? {
 		root: process.cwd(),
 		base: process.env.BASE || "/",
 		server: { middlewareMode: true }
@@ -271,9 +442,6 @@ const scanForServerFiles = async (initialCfg, devServer) => {
 		optimizeDeps: { noDiscovery: true },
 		ssr: { optimizeDeps: { noDiscovery: true } }
 	});
-	const root = config.root || process.cwd();
-	const resolvedScanRoot = resolve(root, config.scanRoot ?? join(root, "src", "api"));
-	const serverFiles = config.serverFiles ?? "exact";
 	const seenNames = /* @__PURE__ */ new Set();
 	let files;
 	try {
@@ -295,7 +463,7 @@ const scanForServerFiles = async (initialCfg, devServer) => {
 			const moduleEntries = Object.entries(moduleExports);
 			if (!moduleEntries.length) {
 				console.warn(NO_SERVER_FUNCTION_FOUND);
-				return;
+				continue;
 			}
 			for (const [exportName, exportValue] of moduleEntries) {
 				const registeredName = exportValue.name;
@@ -320,7 +488,7 @@ const scanForServerFiles = async (initialCfg, devServer) => {
 		}
 	} finally {
 		if (!devServer && server) await server.close();
-		isScanned = true;
+		scannedTargets.add(target);
 	}
 };
 //#endregion
@@ -455,7 +623,10 @@ const getModule = (fnName, fnEntry, options) => {
 * Generates the complete client-side module bundle by iterating all registered server functions
 * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite
 * (or Oxc) during the dev server or production build.
-* @param initialOptions - Plugin options containing rpcPrefix and optional adapter
+*
+* The generated stubs are plain `fetch` calls, so they are adapter-agnostic —
+* only the prefix is needed.
+* @param initialOptions - Plugin options containing the rpcPrefix
 * @returns A string of JavaScript code with all client RPC modules and their import dependencies
 */
 const getClientModules = (initialOptions) => {
@@ -567,6 +738,6 @@ const getRequestMeta = (event) => {
 	};
 };
 //#endregion
-export { RPCError, createServerFunction, defaultMiddlewareOptions, defaultPrefix, defaultRPCOptions, defaultServerFnOptions, escapeRegExp, formatError, getClientModules, getFunctionsForPrefix, getGlobalPrefix, getRequestContext, getRequestMeta, hasContentTypeMismatch, isFormContentType, isOriginAllowed, provideRequestContext, redirect, safeURL, scanForServerFiles, scannedServerFiles, sendResponse, serverFunctionsByPrefix, serverFunctionsMap, setGlobalPrefix, walkGlobFiles };
+export { RPCError, clientErrorMessage, clientErrorStatus, createServerFunction, defaultMiddlewareOptions, defaultPrefix, defaultRPCOptions, defaultServerFnOptions, escapeRegExp, formatError, getClientModules, getFunctionsForPrefix, getGlobalPrefix, getRequestContext, getRequestMeta, hasContentTypeMismatch, httpError, isClientHttpError, isFormContentType, isOriginAllowed, isOriginRequestAllowed, provideRequestContext, redirect, resolveRPCPrefix, safeURL, scanForServerFiles, scannedServerFiles, sendResponse, serverFunctionsByPrefix, serverFunctionsMap, setGlobalPrefix, walkGlobFiles };
 
 //# sourceMappingURL=server.mjs.map

package/dist/server/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts","../../src/context.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Decides whether a request's `Origin` header is allowed by the configured\n * allowlist. Shared by all five adapters so the rule lives in exactly one place.\n *\n * - No `allowed` value (option unset) → everything passes: no validation.\n * - No `requestOrigin` header → passes, preserving curl/native-client access.\n * - Otherwise the header must match one of the entries exactly.\n *\n * A single string and a one-element array behave identically, so widening\n * `origin` to `string | string[]` is backward compatible.\n *\n * `Origin: null` (sandboxed iframes, `file://`, extension pages) is rejected\n * whenever an allowlist is set, because it never equals a real origin.\n * @param allowed - The configured `origin` option, if any\n * @param requestOrigin - The raw `Origin` request header, if present\n * @returns `true` when the request may proceed\n */\nexport const isOriginAllowed = (\n  allowed: string | string[] | undefined,\n  requestOrigin: string | undefined,\n): boolean => {\n  if (!allowed || !requestOrigin) return true;\n  return Array.isArray(allowed)\n    ? allowed.includes(requestOrigin)\n    : requestOrigin === allowed;\n};\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  let createServer: typeof import(\"vite\").createServer;\n  let normalizePath: typeof import(\"vite\").normalizePath;\n  try {\n    ({ createServer, normalizePath } = await import(\"vite\"));\n  } catch {\n    // Vite is not installed in this environment (e.g. a serverless bundle\n    // where Vite is externalized or absent). Server functions must have been\n    // imported directly into the prefix-scoped map; nothing to scan — exit\n    // gracefully instead of crashing the host's cold start with\n    // `Cannot find module 'vite'`.\n    return;\n  }\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","/** @module Server function creation and registration. */\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix, defaultServerFnOptions } from \"./options.ts\";\nimport { getGlobalPrefix } from \"./server-helpers.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Extended options for createServerFunction, including rpcPrefix for multi-instance support.\n */\nexport interface CreateServerFunctionOptions\n  extends Partial<ServerFunctionOptions> {\n  /**\n   * RPC prefix for this function. Enables multiple RPC instances with different prefixes.\n   * When using multi-prefix setup, functions with the same name but different prefixes\n   * can coexist without collision.\n   * @default \"__rpc\"\n   * @example\n   * // v1 API\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, email, password) => ({...}),\n   *   { rpcPrefix: \"v1:rpc\" },\n   * );\n   *\n   * // v2 API - same function name, different prefix\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, credentials) => ({...}),\n   *   { rpcPrefix: \"v2:rpc\" },\n   * );\n   */\n  rpcPrefix?: string;\n}\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map (scoped by rpcPrefix) and returns\n * a client-compatible wrapper that exposes `data` (Promise) and `cancel` (function)\n * for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType, credentials, and rpcPrefix settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: CreateServerFunctionOptions = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n  const rpcPrefix = fnOptions.rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  // Register to prefix-scoped map\n  const prefixMap = getFunctionsForPrefix(rpcPrefix);\n  prefixMap.set(name, {\n    name,\n    handler: wrappedFunction as never,\n    options,\n  });\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, `redirect` and `sendResponse` for framework-level short-circuits, and `getRequestMeta` for normalized request access. Never import this module in client code — it is server-only. */\n\n// @thednp/rpc/src/context.ts\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { JsonValue } from \"./types.d.ts\";\nimport { safeURL } from \"./server-helpers.ts\";\n\n/**\n * Global symbol under which the shared `AsyncLocalStorage` instance is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across module copies and dev-server hot reloads, mirroring\n * `solid-js/web`'s own request-context storage.\n */\nconst requestContextSymbol = Symbol.for(\"thednp.rpc.requestContext\");\n\n/**\n * A per-request context established by the framework adapters around\n * server-function dispatch, mirroring Solid Start's `FetchEvent`. Any code\n * running in the async tree of a dispatch can read the current context through\n * {@link getRequestContext} instead of threading `req`/`res` (or the framework\n * `Context` object) through every nested call. This module is server-only and\n * must never be imported by client code.\n *\n * Each adapter extends this with framework-specific request/response accessors:\n * - Express: `req`/`res` plus `nativeEvent = { req, res }`\n * - Fastify: `request`/`reply` plus `nativeEvent = request`\n * - Koa: `ctx` plus `nativeEvent = ctx`\n * - Hono: `c` (the Hono `Context`) plus `nativeEvent = c`\n * - h3: `event` (the h3 `H3Event`) plus `nativeEvent = event`\n */\nexport interface RequestEvent {\n  /** Adapter-specific native event kept for deep framework access */\n  nativeEvent?: unknown;\n  /** Adapter request object */\n  request: unknown;\n  /** Adapter response object */\n  response: unknown;\n  /**\n   * Bound adapter-native redirect. Performing a redirect sets `redirected`\n   * so the middleware can skip the JSON `{ data }` send.\n   * @param location - The URL to redirect to\n   * @param status - HTTP status code, defaults to `303 See Other`\n   */\n  redirect: (location: string, status?: number) => void;\n  /**\n   * Set by `redirect` once a redirect has been issued. The middleware checks\n   * this after `await`ing the server function to avoid double-responding.\n   */\n  redirected?: { location: string; status: number };\n  /**\n   * Bound adapter-native response short-circuit. Writes the given status and\n   * JSON body (plus optional headers) directly, bypassing the standard\n   * `{ data }` response. Setting `sent` makes the middleware skip the JSON\n   * `{ data }` send, mirroring `redirect`/`redirected`.\n   * @param status - HTTP status code (e.g. 401, 413, 429)\n   * @param body - JSON-serializable response body\n   * @param headers - Optional response headers (e.g. `{ \"Retry-After\": \"60\" }`)\n   */\n  send: (\n    status: number,\n    body: JsonValue,\n    headers?: Record<string, string>,\n  ) => void;\n  /**\n   * Set by `send` once a response has been issued. The middleware checks this\n   * after `await`ing the server function to avoid double-responding.\n   */\n  sent?: { status: number; body: JsonValue; headers?: Record<string, string> };\n  /**\n   * The matched RPC function name for the current request, when available.\n   * Useful for per-function rate limiting or auditing inside middleware.\n   */\n  functionName?: string;\n  /** Per-request app data shared across the async tree of the dispatch */\n  locals: Record<string, unknown>;\n  [prop: string]: unknown;\n}\n\n// Instance-stable across module copies and dev-server hot reloads, exactly like\n// `solid-js/web`'s `provideRequestEvent` (which stores on a globalThis symbol).\nconst requestContextStorage: AsyncLocalStorage<RequestEvent> =\n  ((globalThis as Record<symbol, AsyncLocalStorage<RequestEvent>>)[\n    requestContextSymbol\n  ] ??= new AsyncLocalStorage<RequestEvent>());\n\n/**\n * Runs `cb` with `init` as the current request context. Use inside the\n * adapters around server-function dispatch (the async tree under `cb` can then\n * read the context via {@link getRequestContext}).\n * @param init - The request context for the duration of `cb`\n * @param cb - The work that needs access to the request context\n */\nexport const provideRequestContext = <T>(\n  init: RequestEvent,\n  cb: () => T,\n): T => requestContextStorage.run(init, cb);\n\n/**\n * Returns the current request context, or throws when called outside of a\n * request (e.g. module scope or a background task).\n * @throws When no request context is established\n */\nexport const getRequestContext = (): RequestEvent => {\n  const ctx = requestContextStorage.getStore();\n  if (!ctx) {\n    throw new Error(\"RequestEvent is not available outside of a request\");\n  }\n  return ctx;\n};\n\n/**\n * Redirects the current request to `location`. Reads the adapter-bound\n * `redirect` from the current request context — callable from anywhere inside\n * a server-function tree (no `res` threading needed).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to `303 See Other`\n * @throws When called outside of a request\n */\nexport const redirect = (location: string, status = 303): void => {\n  getRequestContext().redirect(location, status);\n};\n\n/**\n * Sends a raw JSON response for the current request, bypassing the standard\n * `{ data }` shape. Reads the adapter-bound `send` from the current request\n * context — callable from anywhere inside a server-function tree. Any code in\n * the async tree of a dispatch can call this (e.g. custom middleware) to\n * short-circuit with a specific status code (401, 413, 429, ...).\n * @param status - HTTP status code\n * @param body - JSON-serializable response body\n * @param headers - Optional response headers\n * @throws When called outside of a request\n */\nexport const sendResponse = (\n  status: number,\n  body: JsonValue,\n  headers?: Record<string, string>,\n): void => {\n  getRequestContext().send(status, body, headers);\n};\n\n/**\n * Normalized, adapter-agnostic view of the current request. Reads the request\n * object off the current request context and normalizes it across the five\n * adapter request shapes (Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req`, h3 `event.req`) so middleware can be written once.\n */\nexport interface RequestMeta {\n  /** HTTP method, upper-cased (e.g. \"GET\", \"POST\") */\n  method: string;\n  /** URL pathname (e.g. \"/__rpc/greet\") */\n  pathname: string;\n  /** Raw search string including the leading \"?\", or \"\" when absent */\n  search: string;\n  /** Parsed search params */\n  searchParams: URLSearchParams;\n  /** Request headers, lower-cased */\n  headers: Record<string, string | string[] | undefined>;\n  /** Host header value (e.g. \"localhost:5173\"), when present */\n  host?: string;\n  /** Client IP when the framework exposes it (e.g. Fastify `req.ip`) */\n  ip?: string;\n  /** Request protocol (\"http\" or \"https\"), when determinable */\n  protocol?: string;\n}\n\nconst pickHeader = (\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined => {\n  const value = headers[name];\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[0];\n  return undefined;\n};\n\n/** Normalizes any headers shape into a plain lower-cased record. */\nconst toHeaderRecord = (\n  headers: unknown,\n): Record<string, string | string[] | undefined> => {\n  if (!headers) return {};\n  // Headers-like object (h3 Request, Hono c.req.raw.headers, fetch Headers)\n  if (typeof (headers as Headers).forEach === \"function\") {\n    const record: Record<string, string> = {};\n    (headers as Headers).forEach((value, key) => {\n      record[key] = value;\n    });\n    return record;\n  }\n  // Plain map (Express req.headers, Fastify req.headers, Koa ctx.req.headers)\n  return headers as Record<string, string | string[] | undefined>;\n};\n\n/**\n * Reads normalized, adapter-agnostic request metadata from the current request\n * context. Works with Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req` and h3 `event.req` by feature-detecting the request shape\n * (`originalUrl`/`url`/`path`, raw `headers` map vs `Headers`-like API).\n * @param event - The request context to read, typically the result of\n *   {@link getRequestContext}\n */\nexport const getRequestMeta = (event: RequestEvent): RequestMeta => {\n  const req = event.request as {\n    method?: string;\n    originalUrl?: string;\n    url?: string;\n    path?: string;\n    headers?: unknown;\n    header?: (name: string) => string | string[] | undefined;\n    ip?: string;\n    protocol?: string;\n    socket?: { remoteAddress?: string };\n    raw?: { headers?: unknown };\n  } | undefined;\n\n  const method = (req?.method ?? \"GET\").toUpperCase();\n  const rawUrl = req?.originalUrl ?? req?.url ?? req?.path ?? \"\";\n  const url = safeURL(rawUrl);\n  const headers = toHeaderRecord(req?.headers ?? req?.raw?.headers);\n  const hostHeader = pickHeader(headers, \"host\");\n\n  return {\n    method,\n    pathname: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers,\n    host: hostHeader,\n    ip: req?.ip ?? req?.socket?.remoteAddress,\n    protocol: req?.protocol ?? url.protocol.replace(\":\", \"\"),\n  };\n};\n"],"mappings":";;;;;AAMA,MAAa,yBAAgD;CAC3D,aAAa;CACb,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,gBAAgB;AAE7B,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;ACjEA,MAAa,oBAAoB;AAMjC,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;AAYlC,MAAa,wBAAwB;;AASrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAehC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;AC3CrC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;;;;;AAQA,MAAa,qBAAqB,gBAChC,gBAAgB,yBAChB,gBAAgB;;;;;;;;;;;AAYlB,MAAa,0BACX,UACA,cACY;CAEZ,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;CACvE,IAAI,kBAAkB,QAAQ,GAE5B,OAAO,CAAC,kBAAkB,YAAY;CAExC,OAAO,iBAAiB;AAC1B;;;;;;;;AASA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;;;;;;;;;;;;;;;;AAmBA,MAAa,mBACX,SACA,kBACY;CACZ,IAAI,CAAC,WAAW,CAAC,eAAe,OAAO;CACvC,OAAO,MAAM,QAAQ,OAAO,IACxB,QAAQ,SAAS,aAAa,IAC9B,kBAAkB;AACxB;AAEA,MAAM,gBAAgB;;;;;;;;;;;;;;AAetB,MAAa,WAAW,QAAgB,OAAO,kBAAuB;CACpE,IAAI;EACF,OAAO,IAAI,IAAI,QAAQ,IAAI;CAC7B,QAAQ;EACN,OAAO,IAAI,IAAI,KAAK,IAAI;CAC1B;AACF;AAEA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;AAG/D,MAAa,wBACV,WACC;AAGJ,MAAa,mBAAmB,WAAqC;CACnE,IAAI,QACF,WACE,sBACE;MAEJ,OAAQ,WACN;AAGN;;;ACnLA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,cAAc,iBAAkB,MAAM,OAAO;CAClD,QAAQ;EAMN;CACF;CACA,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAKF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;;;;;;;;;;;ACjIA,SAAgB,qBAId,MACA,SACA,YAAyC,CAAC,GACV;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CACnE,MAAM,YAAY,UAAU,aAAa,gBAAgB,KAAA;CAEzD,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAID,sBADwC,SAChC,CAAC,CAAC,IAAI,MAAM;EAClB;EACA,SAAS;EACT;CACF,CAAC;CAED,OAAO;AACT;;;AC3FA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;;;;;;;;AC1EA,MAAM,uBAAuB,OAAO,IAAI,2BAA2B;AAmEnE,MAAM,wBACH,WACC,0BACI,IAAI,kBAAgC;;;;;;;;AAS5C,MAAa,yBACX,MACA,OACM,sBAAsB,IAAI,MAAM,EAAE;;;;;;AAO1C,MAAa,0BAAwC;CACnD,MAAM,MAAM,sBAAsB,SAAS;CAC3C,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;AACT;;;;;;;;;AAUA,MAAa,YAAY,UAAkB,SAAS,QAAc;CAChE,kBAAkB,CAAC,CAAC,SAAS,UAAU,MAAM;AAC/C;;;;;;;;;;;;AAaA,MAAa,gBACX,QACA,MACA,YACS;CACT,kBAAkB,CAAC,CAAC,KAAK,QAAQ,MAAM,OAAO;AAChD;AA2BA,MAAM,cACJ,SACA,SACuB;CACvB,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;AAEzC;;AAGA,MAAM,kBACJ,YACkD;CAClD,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,IAAI,OAAQ,QAAoB,YAAY,YAAY;EACtD,MAAM,SAAiC,CAAC;EACxC,QAAqB,SAAS,OAAO,QAAQ;GAC3C,OAAO,OAAO;EAChB,CAAC;EACD,OAAO;CACT;CAEA,OAAO;AACT;;;;;;;;;AAUA,MAAa,kBAAkB,UAAqC;CAClE,MAAM,MAAM,MAAM;CAalB,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;CAClD,MAAM,SAAS,KAAK,eAAe,KAAK,OAAO,KAAK,QAAQ;CAC5D,MAAM,MAAM,QAAQ,MAAM;CAC1B,MAAM,UAAU,eAAe,KAAK,WAAW,KAAK,KAAK,OAAO;CAChE,MAAM,aAAa,WAAW,SAAS,MAAM;CAE7C,OAAO;EACL;EACA,UAAU,IAAI;EACd,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB;EACA,MAAM;EACN,IAAI,KAAK,MAAM,KAAK,QAAQ;EAC5B,UAAU,KAAK,YAAY,IAAI,SAAS,QAAQ,KAAK,EAAE;CACzD;AACF"}
+{"version":3,"file":"server.mjs","names":[],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts","../../src/context.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\n/**\n * Defaults applied to a server function that declares no `method`,\n * `credentials`, or `contentType` of its own.\n */\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\n/**\n * The built-in RPC endpoint prefix, used when neither an explicit prefix nor a\n * global one (`getGlobalPrefix`) is supplied. Kept for backward compatibility\n * with pre-multi-prefix setups, where every function lived under this one map.\n */\nexport const defaultPrefix = \"__rpc\";\n\n/**\n * Baseline plugin options. `defineConfig` merges a user's partial config over\n * these, and `loadRPCConfig` merges a loaded config file over them, so every\n * option has a defined value even when a config file omits it.\n */\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\n/**\n * Baseline middleware options. Note `rpcPrefix` is `undefined` rather than\n * `defaultPrefix` on purpose: leaving it unset lets `resolveRPCPrefix` fall\n * through to the global prefix, which is what makes a published global prefix\n * reach the middleware.\n */\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","/**\n * @module User-facing message strings.\n *\n * Two shapes live here: plain message constants (the exact text an RPC\n * response body carries) and message *factories* for the cases that need a\n * value interpolated. Both are part of the wire contract for the bodies below,\n * so the casing is deliberate — e.g. a client matching on\n * `METHOD_NOT_ALLOWED` must see `\"Method Not Allowed\"`, not `\"Method not\n * allowed\"`. These strings are also what keeps error responses generic: they\n * never include the requested function name, so a response cannot be used to\n * enumerate what exists.\n */\n/** Thrown-name for an operation stopped by its own `cancel()`. */\nexport const OPERATION_ABORTED = \"Operation aborted\";\n\n/** Warning text used when a request is cancelled by an HTTP 408/499 response. */\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\n/** Prefix of the `Error` message the client helpers throw for a non-OK HTTP response. The status text is appended; the response body is deliberately not read, so server-side detail never reaches the client through this path. */\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\n/** Warning logged when a scanned server module exports nothing. */\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\n/** Error logged when a server function file cannot be loaded by Vite's SSR loader. */\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\n/** Body of a 404. Deliberately does not name the requested function. */\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\n/** Body of a 405, returned when the HTTP method does not match the function's declared method. */\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\n/** Body of a 403, returned when the optional origin allowlist rejects the request. */\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\n/** Body of a 415, returned when the request's `Content-Type` does not satisfy the function's declared `contentType`. */\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\n/** Body of a 413, returned when the request body exceeds the host's configured size limit. */\nexport const PAYLOAD_TOO_LARGE = \"Payload Too Large\";\n\n/** Body of a 400, returned when a GET `?args=` value parses but is not an array. */\nexport const BAD_REQUEST = \"Bad Request\";\n\n/** Body of a 500. Always generic — never the underlying error, so internals cannot leak. */\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\n/** Abort reason used when the client disconnects mid-dispatch. */\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\n/** Warning logged when no config file is discovered and the defaults are used. */\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\n/** Warning logged when a config file exists but could not be loaded; the defaults are used. */\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport {\n  BAD_REQUEST,\n  INTERNAL_SERVER_ERROR,\n  PAYLOAD_TOO_LARGE,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"./constants.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\n/**\n * An error carrying an HTTP status, so the dispatch can answer that status\n * instead of flattening every failure to a `500`.\n */\nexport interface ClientHttpError extends Error {\n  status?: number;\n  statusCode?: number;\n}\n\n/**\n * Tags an error with an HTTP status for the dispatch to surface.\n *\n * Used where a malformed *request* is the fault — a body that does not parse\n * under a declared JSON `Content-Type`, a GET `?args=` value that is not valid\n * JSON. Every host framework rpc supports answers `400` for these (Express\n * `entity.parse.failed`, Fastify `FST_ERR_CTP_INVALID_JSON_BODY`, koa-bodyparser,\n * and h3's own `readBody`), and treating one as a server fault both misreports\n * the fault and turns a trivial client mistake into a log entry.\n * @param status - The HTTP status to answer with\n * @param message - Internal diagnostic message; never sent to the client\n * @returns An `Error` carrying `status`\n */\nexport const httpError = (status: number, message: string): ClientHttpError => {\n  const err = new Error(message) as ClientHttpError;\n  err.status = status;\n  return err;\n};\n\n/**\n * Recognises an error that should produce a `4xx` response rather than a `500`.\n *\n * Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the\n * `http-errors` objects Express's `body-parser` throws, and anything else that\n * carries a numeric 4xx. Shared by all five adapters so a host-framework\n * signal and an rpc-raised one are handled by the same rule.\n * @param err - The caught error\n * @returns True when the error denotes a client (4xx) fault\n */\nconst readClientStatus = (err: unknown): number | undefined => {\n  const candidate = err as ClientHttpError | null | undefined;\n  // Reads both conventions: h3's `HTTPError` and rpc's `httpError` use\n  // `status`, while the `http-errors` objects Express's `body-parser` throws\n  // and Koa's `ctx.throw` use `statusCode`.\n  const status = candidate?.status ?? candidate?.statusCode;\n  return typeof status === \"number\" && status >= 400 && status < 500\n    ? status\n    : undefined;\n};\n\n/**\n * Recognises an error that should produce a `4xx` response rather than a `500`.\n * Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the\n * `http-errors` objects Express's `body-parser` throws, and anything else\n * carrying a numeric 4xx. Shared by all five adapters so a host-framework\n * signal and an rpc-raised one are handled by the same rule.\n * @param err - The caught error\n * @returns True when the error denotes a client (4xx) fault\n */\nexport const isClientHttpError = (err: unknown): boolean =>\n  readClientStatus(err) !== undefined;\n\n/**\n * Reads the status to answer for a client error. Defaults to `400` rather than\n * `500` so an unrecognised 4xx is never reported as a server fault.\n * @param err - The caught error\n * @returns The 4xx status to answer with\n */\nexport const clientErrorStatus = (err: unknown): number =>\n  readClientStatus(err) ?? 400;\n\nexport const clientErrorMessage = (status: number): string => {\n  if (status === 413) return PAYLOAD_TOO_LARGE;\n  if (status === 415) return UNSUPPORTED_MEDIA_TYPE;\n  return BAD_REQUEST;\n};\n\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Decides whether a request may proceed, given the configured origin allowlist\n * and the two headers a browser can be made to reveal.\n *\n * Four tiers, evaluated in order — the first tier with a signal decides:\n *\n * 1. `origin` option unset → everything passes. No validation is performed.\n * 2. `Origin` present → the allowlist decides, exactly as {@link isOriginAllowed}.\n * 3. `Origin` absent but `Sec-Fetch-Site` present → allow only `same-origin`\n *    and `none`; anything else (including an unrecognised value) is rejected.\n * 4. Both absent → passes. This is the deliberate, documented curl/native hole.\n *\n * Tier 2 must short-circuit ahead of tier 3. `Sec-Fetch-Site` is a coarse\n * four-value enum that cannot name a host, so on its own it would reject a\n * legitimate request from an allowlisted sibling subdomain (`same-site`). The\n * allowlist exists precisely to admit that case, and it can only do so while\n * `Origin` survives. `Sec-Fetch-Site` earns a vote only once the precise signal\n * has been stripped away by something in the chain — at which point there is\n * nothing left to trust, so it fails closed.\n *\n * Browsers never strip `Origin` themselves, so tier 3 can only fire when a\n * proxy, sanitising middleware, or misconfigured CDN removed it. No legitimate\n * browser request can regress.\n *\n * An empty (or whitespace-only) header value counts as **absent**, not as an\n * unrecognised signal. No browser emits an empty `Sec-Fetch-Site`, and adapters\n * disagree on what their header accessor returns for a missing header (Node's\n * `req.headers` yields `undefined`, Hono's `c.req.header()` may yield `\"\"`).\n * Normalising here keeps all five adapters behaving identically instead of\n * inheriting whichever convention their framework happens to use.\n * @param allowed - The configured `origin` option, if any\n * @param origin - The raw `Origin` request header, if present\n * @param site - The raw `Sec-Fetch-Site` request header, if present\n * @returns `true` when the request may proceed\n */\nexport const isOriginRequestAllowed = (\n  allowed: string | string[] | undefined,\n  origin: string | undefined,\n  site: string | undefined,\n): boolean => {\n  if (!allowed) return true; // tier 1 — the check is opt-in\n  if (origin?.trim()) return isOriginAllowed(allowed, origin); // tier 2 — precise\n  if (!site?.trim()) return true; // tier 4 — curl / native client\n  // tier 3 — precision lost, so fail closed\n  return site === \"same-origin\" || site === \"none\";\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Decides whether a request's `Origin` header is allowed by the configured\n * allowlist. Shared by all five adapters so the rule lives in exactly one place.\n *\n * - No `allowed` value (option unset) → everything passes: no validation.\n * - No `requestOrigin` header → passes, preserving curl/native-client access.\n * - Otherwise the header must match one of the entries exactly.\n *\n * A single string and a one-element array behave identically, so widening\n * `origin` to `string | string[]` is backward compatible.\n *\n * `Origin: null` (sandboxed iframes, `file://`, extension pages) is rejected\n * whenever an allowlist is set, because it never equals a real origin.\n * @param allowed - The configured `origin` option, if any\n * @param requestOrigin - The raw `Origin` request header, if present\n * @returns `true` when the request may proceed\n */\nexport const isOriginAllowed = (\n  allowed: string | string[] | undefined,\n  requestOrigin: string | undefined,\n): boolean => {\n  if (!allowed || !requestOrigin) return true;\n  return Array.isArray(allowed)\n    ? allowed.includes(requestOrigin)\n    : requestOrigin === allowed;\n};\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\n/**\n * Publishes the global RPC prefix, consulted by `resolveRPCPrefix` whenever no\n * explicit prefix is supplied. `loadRPCConfig` calls this on every return path\n * so a loaded config is the fallback for later registrations and dispatches.\n *\n * Stored on a `Symbol.for` key on `globalThis` so it stays instance-stable\n * across the bundled entry copies (`server.mjs`, `express.mjs`, ...) and dev\n * server hot reloads — the same technique as the request-context storage.\n * @param prefix - The prefix to publish, or `undefined` to clear it\n */\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n\n/**\n * Resolves the effective RPC prefix: the explicit one when given, otherwise\n * the global prefix set by `setGlobalPrefix` / `loadRPCConfig`, otherwise the\n * built-in default.\n *\n * Every adapter resolves its prefix through this single function — in both the\n * outer `createMiddleware` gate and the `createRPCMiddleware` dispatch — so the\n * two halves of a request can never disagree, and so a prefix registered by\n * `createServerFunction` (which resolves the same way) is always the prefix the\n * middleware looks up. Resolving the two sides independently is what allowed\n * h3 to drift from the other four adapters, and what left the documented\n * global-prefix flow returning 404 on all of them.\n * @param rpcPrefix - Explicit prefix from config or middleware options\n * @returns The prefix to gate on, look up in, and strip from the request path\n */\nexport const resolveRPCPrefix = (rpcPrefix?: string): string =>\n  rpcPrefix || getGlobalPrefix() || defaultPrefix;\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix } from \"./options.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\n/**\n * Scan targets already performed, so a lazy re-scan is not repeated.\n *\n * Keyed by everything that determines the outcome — the resolved scan root\n * (which files are read), the matching mode, and the prefix prefix-less\n * functions register under. A single process-wide boolean used to be enough\n * only while there was one prefix: the *first* scan suppressed every later\n * one, so a second RPC instance on a different prefix asked for a lazy scan,\n * got an early return, and answered 404 for every function it owned.\n */\nconst scannedTargets = new Set<string>();\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the server functions map (scoped by rpcPrefix) with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  // Resolve the scan target up front, before anything expensive. Importing\n  // Vite and standing up an internal server are the costly parts, and neither\n  // is needed once a scan is known to be a repeat.\n  const root = initialCfg?.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    initialCfg?.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles = initialCfg?.serverFiles ?? \"exact\";\n  const target = `${resolvedScanRoot}|${serverFiles}|${\n    initialCfg?.rpcPrefix ?? defaultPrefix\n  }`;\n\n  if (scannedTargets.has(target) && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  let createServer: typeof import(\"vite\").createServer;\n  let normalizePath: typeof import(\"vite\").normalizePath;\n  try {\n    ({ createServer, normalizePath } = await import(\"vite\"));\n  } catch {\n    // Vite is not installed in this environment (e.g. a serverless bundle\n    // where Vite is externalized or absent). Server functions must have been\n    // imported directly into the prefix-scoped map; nothing to scan — exit\n    // gracefully instead of crashing the host's cold start with\n    // `Cannot find module 'vite'`.\n    return;\n  }\n  const config = !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  // Names registered during this scan run, used for duplicate detection.\n  // Keyed by `${prefix}:${registeredName}` so the same name can coexist\n  // under different rpcPrefixes (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        // Warn and move on: returning here would abandon every remaining\n        // file in the scan, silently dropping their functions.\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        continue;\n      }\n\n      // Register each export into its prefix-scoped map, recording the\n      // original export name so `getClientModules` can emit the matching\n      // client stub. `createServerFunction` already auto-registers its name\n      // into the appropriate prefix-scoped map at module load, so a function\n      // may already exist here — in that case only the export name is added.\n      // Track names seen in THIS scan run only, keyed by prefix: a name\n      // repeated within one scan under the same prefix (e.g. two files\n      // exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        const prefix = exportValue.options?.rpcPrefix ||\n          config.rpcPrefix ||\n          defaultPrefix;\n        const seenKey = `${prefix}:${registeredName}`;\n        if (seenNames.has(seenKey)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(seenKey);\n        const prefixMap = getFunctionsForPrefix(prefix);\n        const existing = prefixMap.get(registeredName);\n        if (existing) {\n          existing.exportName = exportName;\n        } else {\n          prefixMap.set(registeredName, {\n            name: registeredName,\n            handler: exportValue,\n            options: exportValue.options,\n            exportName,\n          });\n        }\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    scannedTargets.add(target);\n  }\n};\n","/** @module Server function creation and registration. */\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport { defaultPrefix, defaultServerFnOptions } from \"./options.ts\";\nimport { getGlobalPrefix } from \"./server-helpers.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Extended options for createServerFunction, including rpcPrefix for multi-instance support.\n */\nexport interface CreateServerFunctionOptions\n  extends Partial<ServerFunctionOptions> {\n  /**\n   * RPC prefix for this function. Enables multiple RPC instances with different prefixes.\n   * When using multi-prefix setup, functions with the same name but different prefixes\n   * can coexist without collision.\n   * @default \"__rpc\"\n   * @example\n   * // v1 API\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, email, password) => ({...}),\n   *   { rpcPrefix: \"v1:rpc\" },\n   * );\n   *\n   * // v2 API - same function name, different prefix\n   * export const login = createServerFunction(\n   *   \"login\",\n   *   async (signal, credentials) => ({...}),\n   *   { rpcPrefix: \"v2:rpc\" },\n   * );\n   */\n  rpcPrefix?: string;\n}\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map (scoped by rpcPrefix) and returns\n * a client-compatible wrapper that exposes `data` (Promise) and `cancel` (function)\n * for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType, credentials, and rpcPrefix settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: CreateServerFunctionOptions = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n  const rpcPrefix = fnOptions.rpcPrefix || getGlobalPrefix() || defaultPrefix;\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  // Register to prefix-scoped map\n  const prefixMap = getFunctionsForPrefix(rpcPrefix);\n  prefixMap.set(name, {\n    name,\n    handler: wrappedFunction as never,\n    options,\n  });\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs,\n * colons, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { getFunctionsForPrefix } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  const contentType =\n    (options.contentType ?? \"application/json\") as ServerFunctionOptions[\n      \"contentType\"\n    ];\n\n  const opts: string[] = [];\n  if (method !== \"POST\") opts.push(`method: \"${method}\"`);\n  if (credentials !== \"same-origin\") opts.push(`credentials: \"${credentials}\"`);\n  if (contentType !== \"application/json\") {\n    opts.push(`contentType: \"${contentType}\"`);\n  }\n  const optsStr = opts.length ? `, { ${opts.join(\", \")} }` : \"\";\n\n  const output = `\n export const ${safeFnEntry} = getClientStub(\"${safePrefix}\", \"${safeFnName}\"${optsStr});`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * for a specific prefix and producing fetch-based stubs for each. The result is transformed by Vite\n * (or Oxc) during the dev server or production build.\n *\n * The generated stubs are plain `fetch` calls, so they are adapter-agnostic —\n * only the prefix is needed.\n * @param initialOptions - Plugin options containing the rpcPrefix\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n\n  // Get functions registered for this specific prefix\n  const prefixMap = getFunctionsForPrefix(initialOptions.rpcPrefix);\n  const entries = Array.from(prefixMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n\n  const output = `\n// Client-side RPC modules for prefix: ${initialOptions.rpcPrefix}\nimport { getClientStub } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, `redirect` and `sendResponse` for framework-level short-circuits, and `getRequestMeta` for normalized request access. Never import this module in client code — it is server-only. */\n\n// @thednp/rpc/src/context.ts\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { JsonValue } from \"./types.d.ts\";\nimport { safeURL } from \"./server-helpers.ts\";\n\n/**\n * Global symbol under which the shared `AsyncLocalStorage` instance is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across module copies and dev-server hot reloads, mirroring\n * `solid-js/web`'s own request-context storage.\n */\nconst requestContextSymbol = Symbol.for(\"thednp.rpc.requestContext\");\n\n/**\n * A per-request context established by the framework adapters around\n * server-function dispatch, mirroring Solid Start's `FetchEvent`. Any code\n * running in the async tree of a dispatch can read the current context through\n * {@link getRequestContext} instead of threading `req`/`res` (or the framework\n * `Context` object) through every nested call. This module is server-only and\n * must never be imported by client code.\n *\n * Each adapter extends this with framework-specific request/response accessors:\n * - Express: `req`/`res` plus `nativeEvent = { req, res }`\n * - Fastify: `request`/`reply` plus `nativeEvent = request`\n * - Koa: `ctx` plus `nativeEvent = ctx`\n * - Hono: `c` (the Hono `Context`) plus `nativeEvent = c`\n * - h3: `event` (the h3 `H3Event`) plus `nativeEvent = event`\n */\nexport interface RequestEvent {\n  /** Adapter-specific native event kept for deep framework access */\n  nativeEvent?: unknown;\n  /** Adapter request object */\n  request: unknown;\n  /** Adapter response object */\n  response: unknown;\n  /**\n   * Bound adapter-native redirect. Performing a redirect sets `redirected`\n   * so the middleware can skip the JSON `{ data }` send.\n   * @param location - The URL to redirect to\n   * @param status - HTTP status code, defaults to `303 See Other`\n   */\n  redirect: (location: string, status?: number) => void;\n  /**\n   * Set by `redirect` once a redirect has been issued. The middleware checks\n   * this after `await`ing the server function to avoid double-responding.\n   */\n  redirected?: { location: string; status: number };\n  /**\n   * Bound adapter-native response short-circuit. Writes the given status and\n   * JSON body (plus optional headers) directly, bypassing the standard\n   * `{ data }` response. Setting `sent` makes the middleware skip the JSON\n   * `{ data }` send, mirroring `redirect`/`redirected`.\n   * @param status - HTTP status code (e.g. 401, 413, 429)\n   * @param body - JSON-serializable response body\n   * @param headers - Optional response headers (e.g. `{ \"Retry-After\": \"60\" }`)\n   */\n  send: (\n    status: number,\n    body: JsonValue,\n    headers?: Record<string, string>,\n  ) => void;\n  /**\n   * Set by `send` once a response has been issued. The middleware checks this\n   * after `await`ing the server function to avoid double-responding.\n   */\n  sent?: { status: number; body: JsonValue; headers?: Record<string, string> };\n  /**\n   * The matched RPC function name for the current request, when available.\n   * Useful for per-function rate limiting or auditing inside middleware.\n   */\n  functionName?: string;\n  /** Per-request app data shared across the async tree of the dispatch */\n  locals: Record<string, unknown>;\n  [prop: string]: unknown;\n}\n\n// Instance-stable across module copies and dev-server hot reloads, exactly like\n// `solid-js/web`'s `provideRequestEvent` (which stores on a globalThis symbol).\nconst requestContextStorage: AsyncLocalStorage<RequestEvent> =\n  ((globalThis as Record<symbol, AsyncLocalStorage<RequestEvent>>)[\n    requestContextSymbol\n  ] ??= new AsyncLocalStorage<RequestEvent>());\n\n/**\n * Runs `cb` with `init` as the current request context. Use inside the\n * adapters around server-function dispatch (the async tree under `cb` can then\n * read the context via {@link getRequestContext}).\n * @param init - The request context for the duration of `cb`\n * @param cb - The work that needs access to the request context\n */\nexport const provideRequestContext = <T>(\n  init: RequestEvent,\n  cb: () => T,\n): T => requestContextStorage.run(init, cb);\n\n/**\n * Returns the current request context, or throws when called outside of a\n * request (e.g. module scope or a background task).\n * @throws When no request context is established\n */\nexport const getRequestContext = (): RequestEvent => {\n  const ctx = requestContextStorage.getStore();\n  if (!ctx) {\n    throw new Error(\"RequestEvent is not available outside of a request\");\n  }\n  return ctx;\n};\n\n/**\n * Redirects the current request to `location`. Reads the adapter-bound\n * `redirect` from the current request context — callable from anywhere inside\n * a server-function tree (no `res` threading needed).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to `303 See Other`\n * @throws When called outside of a request\n */\nexport const redirect = (location: string, status = 303): void => {\n  getRequestContext().redirect(location, status);\n};\n\n/**\n * Sends a raw JSON response for the current request, bypassing the standard\n * `{ data }` shape. Reads the adapter-bound `send` from the current request\n * context — callable from anywhere inside a server-function tree. Any code in\n * the async tree of a dispatch can call this (e.g. custom middleware) to\n * short-circuit with a specific status code (401, 413, 429, ...).\n * @param status - HTTP status code\n * @param body - JSON-serializable response body\n * @param headers - Optional response headers\n * @throws When called outside of a request\n */\nexport const sendResponse = (\n  status: number,\n  body: JsonValue,\n  headers?: Record<string, string>,\n): void => {\n  getRequestContext().send(status, body, headers);\n};\n\n/**\n * Normalized, adapter-agnostic view of the current request. Reads the request\n * object off the current request context and normalizes it across the five\n * adapter request shapes (Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req`, h3 `event.req`) so middleware can be written once.\n */\nexport interface RequestMeta {\n  /** HTTP method, upper-cased (e.g. \"GET\", \"POST\") */\n  method: string;\n  /** URL pathname (e.g. \"/__rpc/greet\") */\n  pathname: string;\n  /** Raw search string including the leading \"?\", or \"\" when absent */\n  search: string;\n  /** Parsed search params */\n  searchParams: URLSearchParams;\n  /** Request headers, lower-cased */\n  headers: Record<string, string | string[] | undefined>;\n  /** Host header value (e.g. \"localhost:5173\"), when present */\n  host?: string;\n  /** Client IP when the framework exposes it (e.g. Fastify `req.ip`) */\n  ip?: string;\n  /** Request protocol (\"http\" or \"https\"), when determinable */\n  protocol?: string;\n}\n\nconst pickHeader = (\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined => {\n  const value = headers[name];\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[0];\n  return undefined;\n};\n\n/** Normalizes any headers shape into a plain lower-cased record. */\nconst toHeaderRecord = (\n  headers: unknown,\n): Record<string, string | string[] | undefined> => {\n  if (!headers) return {};\n  // Headers-like object (h3 Request, Hono c.req.raw.headers, fetch Headers)\n  if (typeof (headers as Headers).forEach === \"function\") {\n    const record: Record<string, string> = {};\n    (headers as Headers).forEach((value, key) => {\n      record[key] = value;\n    });\n    return record;\n  }\n  // Plain map (Express req.headers, Fastify req.headers, Koa ctx.req.headers)\n  return headers as Record<string, string | string[] | undefined>;\n};\n\n/**\n * Reads normalized, adapter-agnostic request metadata from the current request\n * context. Works with Express `req`, Fastify `req`, Koa `ctx.req`,\n * Hono `c.req` and h3 `event.req` by feature-detecting the request shape\n * (`originalUrl`/`url`/`path`, raw `headers` map vs `Headers`-like API).\n * @param event - The request context to read, typically the result of\n *   {@link getRequestContext}\n */\nexport const getRequestMeta = (event: RequestEvent): RequestMeta => {\n  const req = event.request as {\n    method?: string;\n    originalUrl?: string;\n    url?: string;\n    path?: string;\n    headers?: unknown;\n    header?: (name: string) => string | string[] | undefined;\n    ip?: string;\n    protocol?: string;\n    socket?: { remoteAddress?: string };\n    raw?: { headers?: unknown };\n  } | undefined;\n\n  const method = (req?.method ?? \"GET\").toUpperCase();\n  const rawUrl = req?.originalUrl ?? req?.url ?? req?.path ?? \"\";\n  const url = safeURL(rawUrl);\n  const headers = toHeaderRecord(req?.headers ?? req?.raw?.headers);\n  const hostHeader = pickHeader(headers, \"host\");\n\n  return {\n    method,\n    pathname: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers,\n    host: hostHeader,\n    ip: req?.ip ?? req?.socket?.remoteAddress,\n    protocol: req?.protocol ?? url.protocol.replace(\":\", \"\"),\n  };\n};\n"],"mappings":";;;;;;;;;AAUA,MAAa,yBAAgD;CAC3D,aAAa;CACb,aAAa;CACb,QAAQ;AACV;;;;;;AAOA,MAAa,gBAAgB;;;;;;AAO7B,MAAa,oBAAsC;CACjD,WAAW;CACX,aAAa;CACb,UAAU,KAAA;AACZ;;;;;;;AAQA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACjCA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;;AAMA,MAAa,qBAAiD;CAC5D,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,MAAM,KAAa,UACjB,sBAAsB,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK;CACrD,MAAM,QAAgB,sBAAsB,aAAa,CAAC,CAAC,IAAI,GAAG;CAClE,SAAS,QAAgB,sBAAsB,aAAa,CAAC,CAAC,OAAO,GAAG;CACxE,aAAa,sBAAsB,aAAa,CAAC,CAAC,MAAM;CACxD,IAAI,OAAO;EACT,OAAO,sBAAsB,aAAa,CAAC,CAAC;CAC9C;CACA,eAAe,sBAAsB,aAAa,CAAC,CAAC,QAAQ;CAC5D,YAAY,sBAAsB,aAAa,CAAC,CAAC,KAAK;CACtD,cAAc,sBAAsB,aAAa,CAAC,CAAC,OAAO;CAC1D,UACE,aAKG,sBAAsB,aAAa,CAAC,CAAC,QAAQ,QAAQ;EACzD,OAAO,iBACN,sBAAsB,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC;AAC1D;;;;;;;;;;;;;;;;ACpDA,MAAa,oBAAoB;;AASjC,MAAa,2BAA2B;;AAGxC,MAAa,qBAAqB;;AAYlC,MAAa,yBAAyB;;AAGtC,MAAa,oBAAoB;;AAGjC,MAAa,cAAc;;AAG3B,MAAa,wBAAwB;;AAUrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAiBhC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;AClErC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;;;;;;;;;;;;AA8BA,MAAa,aAAa,QAAgB,YAAqC;CAC7E,MAAM,MAAM,IAAI,MAAM,OAAO;CAC7B,IAAI,SAAS;CACb,OAAO;AACT;;;;;;;;;;;AAYA,MAAM,oBAAoB,QAAqC;CAC7D,MAAM,YAAY;CAIlB,MAAM,SAAS,WAAW,UAAU,WAAW;CAC/C,OAAO,OAAO,WAAW,YAAY,UAAU,OAAO,SAAS,MAC3D,SACA,KAAA;AACN;;;;;;;;;;AAWA,MAAa,qBAAqB,QAChC,iBAAiB,GAAG,MAAM,KAAA;;;;;;;AAQ5B,MAAa,qBAAqB,QAChC,iBAAiB,GAAG,KAAK;AAE3B,MAAa,sBAAsB,WAA2B;CAC5D,IAAI,WAAW,KAAK,OAAO;CAC3B,IAAI,WAAW,KAAK,OAAO;CAC3B,OAAO;AACT;AAEA,MAAa,qBAAqB,gBAChC,gBAAgB,yBAChB,gBAAgB;;;;;;;;;;;AAYlB,MAAa,0BACX,UACA,cACY;CAEZ,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;CACvE,IAAI,kBAAkB,QAAQ,GAE5B,OAAO,CAAC,kBAAkB,YAAY;CAExC,OAAO,iBAAiB;AAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,0BACX,SACA,QACA,SACY;CACZ,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,QAAQ,KAAK,GAAG,OAAO,gBAAgB,SAAS,MAAM;CAC1D,IAAI,CAAC,MAAM,KAAK,GAAG,OAAO;CAE1B,OAAO,SAAS,iBAAiB,SAAS;AAC5C;;;;;;;;AASA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;;;;;;;;;;;;;;;;AAmBA,MAAa,mBACX,SACA,kBACY;CACZ,IAAI,CAAC,WAAW,CAAC,eAAe,OAAO;CACvC,OAAO,MAAM,QAAQ,OAAO,IACxB,QAAQ,SAAS,aAAa,IAC9B,kBAAkB;AACxB;AAEA,MAAM,gBAAgB;;;;;;;;;;;;;;AAetB,MAAa,WAAW,QAAgB,OAAO,kBAAuB;CACpE,IAAI;EACF,OAAO,IAAI,IAAI,QAAQ,IAAI;CAC7B,QAAQ;EACN,OAAO,IAAI,IAAI,KAAK,IAAI;CAC1B;AACF;AAEA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;AAG/D,MAAa,wBACV,WACC;;;;;;;;;;;AAaJ,MAAa,mBAAmB,WAAqC;CACnE,IAAI,QACF,WACE,sBACE;MAEJ,OAAQ,WACN;AAGN;;;;;;;;;;;;;;;;AAiBA,MAAa,oBAAoB,cAC/B,aAAa,gBAAgB,KAAA;;;;;;;;;;;;;ACtU/B,MAAM,iCAAiB,IAAI,IAAY;;AAGvC,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAIlB,MAAM,OAAO,YAAY,QAAQ,QAAQ,IAAI;CAC7C,MAAM,mBAAmB,QACvB,MACA,YAAY,YAAY,KAAK,MAAM,OAAO,KAAK,CACjD;CACA,MAAM,cAAc,YAAY,eAAe;CAC/C,MAAM,SAAS,GAAG,iBAAiB,GAAG,YAAY,GAChD,YAAY,aAAA;CAGd,IAAI,eAAe,IAAI,MAAM,KAAK,CAAC,WACjC;CASF,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,cAAc,iBAAkB,MAAM,OAAO;CAClD,QAAQ;EAMN;CACF;CACA,MAAM,SAAS,CAAC,aACZ;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAMH,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IAGzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAUA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,MAAM,SAAS,YAAY,SAAS,aAClC,OAAO,aAAA;IAET,MAAM,UAAU,GAAG,OAAO,GAAG;IAC7B,IAAI,UAAU,IAAI,OAAO,GAAG;KAC1B,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,OAAO;IACrB,MAAM,YAAY,sBAAsB,MAAM;IAC9C,MAAM,WAAW,UAAU,IAAI,cAAc;IAC7C,IAAI,UACF,SAAS,aAAa;SAEtB,UAAU,IAAI,gBAAgB;KAC5B,MAAM;KACN,SAAS;KACT,SAAS,YAAY;KACrB;IACF,CAAC;GAEL;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,eAAe,IAAI,MAAM;CAC3B;AACF;;;;;;;;;;;;;AClJA,SAAgB,qBAId,MACA,SACA,YAAyC,CAAC,GACV;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CACnE,MAAM,YAAY,UAAU,aAAa,gBAAgB,KAAA;CAEzD,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAID,sBADwC,SAChC,CAAC,CAAC,IAAI,MAAM;EAClB;EACA,SAAS;EACT;CACF,CAAC;CAED,OAAO;AACT;;;AC3FA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;ACnDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,MAAM,cACH,QAAQ,eAAe;CAI1B,MAAM,OAAiB,CAAC;CACxB,IAAI,WAAW,QAAQ,KAAK,KAAK,YAAY,OAAO,EAAE;CACtD,IAAI,gBAAgB,eAAe,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAC5E,IAAI,gBAAgB,oBAClB,KAAK,KAAK,iBAAiB,YAAY,EAAE;CAO3C,OAAO;gBAFO,YAAY,oBAAoB,WAAW,MAAM,WAAW,GAH1D,KAAK,SAAS,OAAO,KAAK,KAAK,IAAI,EAAE,MAAM,GAG0B,IAEvE,KAAK;AACrB;;;;;;;;;;;AAYA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAGzD,MAAM,YAAY,sBAAsB,eAAe,SAAS;CAgBhE,OAAO;;;EAfS,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC,CAC5C,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAKF,IAEQ,KAAK;AACrB;;;;;;;;;;AC7EA,MAAM,uBAAuB,OAAO,IAAI,2BAA2B;AAmEnE,MAAM,wBACH,WACC,0BACI,IAAI,kBAAgC;;;;;;;;AAS5C,MAAa,yBACX,MACA,OACM,sBAAsB,IAAI,MAAM,EAAE;;;;;;AAO1C,MAAa,0BAAwC;CACnD,MAAM,MAAM,sBAAsB,SAAS;CAC3C,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;AACT;;;;;;;;;AAUA,MAAa,YAAY,UAAkB,SAAS,QAAc;CAChE,kBAAkB,CAAC,CAAC,SAAS,UAAU,MAAM;AAC/C;;;;;;;;;;;;AAaA,MAAa,gBACX,QACA,MACA,YACS;CACT,kBAAkB,CAAC,CAAC,KAAK,QAAQ,MAAM,OAAO;AAChD;AA2BA,MAAM,cACJ,SACA,SACuB;CACvB,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM;AAEzC;;AAGA,MAAM,kBACJ,YACkD;CAClD,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,IAAI,OAAQ,QAAoB,YAAY,YAAY;EACtD,MAAM,SAAiC,CAAC;EACxC,QAAqB,SAAS,OAAO,QAAQ;GAC3C,OAAO,OAAO;EAChB,CAAC;EACD,OAAO;CACT;CAEA,OAAO;AACT;;;;;;;;;AAUA,MAAa,kBAAkB,UAAqC;CAClE,MAAM,MAAM,MAAM;CAalB,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;CAClD,MAAM,SAAS,KAAK,eAAe,KAAK,OAAO,KAAK,QAAQ;CAC5D,MAAM,MAAM,QAAQ,MAAM;CAC1B,MAAM,UAAU,eAAe,KAAK,WAAW,KAAK,KAAK,OAAO;CAChE,MAAM,aAAa,WAAW,SAAS,MAAM;CAE7C,OAAO;EACL;EACA,UAAU,IAAI;EACd,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB;EACA,MAAM;EACN,IAAI,KAAK,MAAM,KAAK,QAAQ;EAC5B,UAAU,KAAK,YAAY,IAAI,SAAS,QAAQ,KAAK,EAAE;CACzD;AACF"}

package/llms.txt

@@ -11,6 +11,7 @@ Vite plugin for automatic RPC generation from server functions. One module (`src
 - `RPCError(message, code?, data?)` — throwable typed error, exported from `@thednp/rpc/server` (as is `formatError`); throw for server-side failures (not validation — return `{ error }` for expected user-facing problems). Dev 500 body: `{ error, code, data }`; prod: generic `{ error: "Internal Server Error" }` only. Client rejection `message` = the error string
 - `provideRequestContext(init, cb)` / `getRequestContext()` — per-request `AsyncLocalStorage` context available to all server function code; `RequestEvent` includes `nativeEvent`, `locals`, adapter-bound `redirect`; works across Express/Fastify/Hono/Koa/h3
 - `unwrapEnvelope<T>(json)` — client helper from `@thednp/rpc/helpers` to unwrap the `{ data }` wire protocol envelope; for native HTTP clients (Deno, Bun, curl-equivalents) that don't use the auto-generated fetch stubs. Same error contract as `handleResponse`: a **top-level** `error` (emitted only for 400/404/405/415/500) throws; `{ data: { error } }` resolves normally (validation-as-data). Status-code agnostic — keep the `res.ok` check. `RPCError` is server-side only (`@thednp/rpc/server`), not a client export, and its `code`/`data` are stripped in production regardless
+- `resolveRPCPrefix(rpcPrefix?)` from `@thednp/rpc/server` — the single prefix-resolution point used by all five adapters: explicit argument → the prefix published by `setGlobalPrefix`/`loadRPCConfig` → the `"__rpc"` default. `createServerFunction` resolves the same way, so a function always registers under the prefix the middleware dispatches on. Call it if you build a custom adapter or wrapper and need to agree with the built-in ones
 - Registered function names become URL paths: `POST /{prefix}/{name}` with body `JSON.stringify(args)`
 
 ## Wire Protocol (client module → server)
@@ -24,12 +25,12 @@ Vite plugin for automatic RPC generation from server functions. One module (`src
 - See `wiki/wire-protocol.md` for full curl examples
 
 ## Config
-- `rpc.config.ts` imports `defineConfig` from `@thednp/rpc/config` (vite-free subpath — safe for serverless bundles): `defineConfig({ rpcPrefix: "__rpc", adapter: "express" | "fastify" | "hono" | "koa" | "h3" })`
+- `rpc.config.ts` imports `defineConfig` from `@thednp/rpc/config` (vite-free subpath — safe for serverless bundles): `defineConfig({ rpcPrefix: "__rpc", serverFiles: "exact" | "glob", scanRoot, silent })` — note there is no `adapter` option: the adapter is the subpath you import (`@thednp/rpc/express`, `/hono`, `/koa`, `/h3`, `/fastify`)
 - `serverFiles: "exact" | "glob"` — `"exact"` (default) matches `server.ts|js|mjs|mts`; `"glob"` recursively matches `*.server.{ts,js,mjs,mts}` under the scan root
 - `scanRoot: string` — scan directory (default `<root>/src/api`); point it at a shared package in monorepos
 - `silent: boolean` — suppress the `NO_CONFIG_FOUND` warning when no config file is found. Useful for wrapper plugins that define server functions directly without a config file
-- `loadRPCConfig(opts?)` — loads config programmatically; pass `{ silent: true }` to suppress warnings
-- `createRPCMiddleware({ origin })` — optional origin check: `origin` accepts a single string or an **allowlist array** (`["https://app.example.com","https://admin.example.com"]`). A request is rejected with 403 only when it carries an `Origin` header matching none of the entries; requests without an `Origin` header pass through; unset means no validation. Matching is exact, so a lookalike host (`https://app.example.com.evil.com`) is rejected. The rule is the shared `isOriginAllowed` helper in `src/server-helpers.ts`, used by all five adapters
+- `loadRPCConfig(configFile?, opts?)` — loads config programmatically. `configFile` is an optional path; when omitted the config-file search runs. Pass `{ silent: true }` as the **second** argument to suppress the `NO_CONFIG_FOUND` warning, or as the sole argument — both `loadRPCConfig(undefined, { silent: true })` and `loadRPCConfig({ silent: true })` are accepted. It also publishes the resolved prefix via `setGlobalPrefix`, and every adapter resolves its prefix the same way (explicit argument → global prefix → `"__rpc"`), so registration and dispatch cannot disagree. A config file that fails to load falls back to the defaults with a warning. Still recommended: `createRPCMiddleware({ rpcPrefix: config.rpcPrefix })`
+- `createRPCMiddleware({ origin })` — optional origin check. `origin` accepts a single string or an **allowlist array** (`["https://app.example.com","https://admin.example.com"]`). Four tiers, first signal wins: (1) `origin` unset → everything passes; (2) `Origin` present → the allowlist decides, exact match only, so `https://app.example.com.evil.com` and `https://app.example.com:443` are rejected and `Origin: null` (sandboxed iframes, `file://`, extensions) never matches; (3) `Origin` absent but `Sec-Fetch-Site` present → allow only `same-origin`/`none`, else 403 (a proxy that strips `Origin` can no longer turn the check into a no-op); (4) both absent → passes, the deliberate curl/native hole. `Origin` deliberately short-circuits ahead of `Sec-Fetch-Site` so an allowlisted sibling's `same-site` request still passes. No new option — setting `origin` is the opt-in. The rule lives once in `isOriginRequestAllowed` (`src/server-helpers.ts`), used by all five adapters; `isOriginAllowed` remains exported as a building block
 - Plugin options in `vite.config.ts` (`rpc()`) override `rpc.config.ts` in dev only
 - Config discovery: `rpc.config.ts` > `.js` > `.mjs` > `.mts` > `.rpcrc.ts` > `.rpcrc.js`
 
@@ -80,4 +81,5 @@ Vite plugin for automatic RPC generation from server functions. One module (`src
 - `wiki/wire-protocol.md` — HTTP contract: request/response bodies, status codes, curl debugging
 - `wiki/adapters.md` — Express, Fastify, Hono, Koa, h3 (`attachRPC`, `attachVite`, body limits, `viteMiddleware` for Fastify/Hono/h3, Hono header fallback in `getRequestMeta`)
 - `wiki/security.md` — Prefix guards, method enforcement, origin, CSRF hardening
+- `wiki/comparison.md` — Cross-origin/CSRF boundary vs Next.js Server Actions, TanStack Start, SvelteKit, tRPC, and Vike/Telefunc. Framed as *fail-open by default, strictest-once-configured, multi-origin without a proxy*: with `origin` set, rpc rejects an untrusted `Origin` even when `Sec-Fetch-Site: same-origin` claims otherwise, which TanStack's tier order waves through (measured 3 stricter / 2 more lenient, both lenient cases deliberate). `Where the trade costs you` keeps the real sharp edges — case-sensitive origin matching, literal origins only, no automatic input validation, deliberate `Referer` omission Re-verified against vendor source and docs on 2026-09-27 (Next.js 16.3.6, TanStack Start 1.168.59, SvelteKit 2.70.3, tRPC 11.18.0, Telefunc 0.2.24) — an earlier draft wrongly claimed Next.js aborts requests with no `Origin`; it lets them through, the same fail-open posture rpc takes.
 - `wiki/best-practices.md` — Auth middleware, rate limiting, per-function authorization, body limits