@thednp/rpc 0.3.6 → 0.3.7

package/dist/helpers/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":[],"sources":["../../src/constants.ts","../../src/client-helpers.ts"],"sourcesContent":["export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Client-side helper utilities. Exports `handleResponse` for processing fetch responses and `innerModule` for creating AbortController-bound RPC fetch calls. This module is bundled into the generated client modules — keep it free of server-only code. */\nimport type {\n  ClientFunction,\n  Credentials,\n  InnerModReturn,\n  JsonArray,\n  JsonValue,\n  StubOptions,\n} from \"./types.d.ts\";\nimport { FETCH_ERROR_PREFIX, REQUEST_CANCELLED } from \"./constants.ts\";\n\n/**\n * Processes an HTTP fetch response from the RPC server.\n * On HTTP 499 or 408 (client cancellation), logs a warning and returns undefined.\n * On other error statuses, throws a Fetch error.\n * On success, parses JSON and returns `result.data` — or throws if `result.error` is set.\n * @param response - Fetch Response object from the RPC endpoint\n * @returns The response data, or void on cancellation\n */\nexport const handleResponse = async <R extends JsonValue>(\n  response: Response,\n): Promise<R | void> => {\n  if (!response.ok) {\n    if (response.status === 499 || response.status === 408) {\n      return console.warn(REQUEST_CANCELLED);\n    }\n    throw new Error(FETCH_ERROR_PREFIX + response.statusText);\n  }\n  const result = await response.json();\n  if (result.error) throw new Error(result.error);\n  return result.data as R;\n};\n\n/**\n * Unwraps the `{ data }` envelope from a parsed RPC response body.\n *\n * Error handling matches `handleResponse` so both helpers in this module agree\n * on the contract: a **top-level** `error` key (which the server only emits for\n * 404/405/415/400/500) throws, while a `{ data: { error } }` body resolves\n * normally — that shape is the documented \"validation-as-data\" contract where a\n * 200 carries the validation outcome as its result.\n *\n * Discriminating on `error` present **and** `data` absent is what keeps those\n * two cases apart. Checking `res.ok` first is still recommended, since this\n * helper is status-code agnostic by design.\n * @param json - Parsed JSON response body\n * @returns The unwrapped response data\n * @throws When the body carries a top-level `error` and no `data`\n * @example\n * ```ts\n * const response = await fetch(\"/__rpc/greet\", { method: \"POST\", ... });\n * const body = await response.json();\n * const greeting = unwrapEnvelope<string>(body); // \"Hello, world!\"\n * ```\n */\nexport const unwrapEnvelope = <T>(json: unknown): T => {\n  if (json !== null && typeof json === \"object\") {\n    const envelope = json as { data?: T; error?: unknown };\n    if (!(\"data\" in envelope) && \"error\" in envelope) {\n      throw new Error(String(envelope.error));\n    }\n    if (\"data\" in envelope) return envelope.data as T;\n  }\n  return json as T;\n};\n\n/**\n * Low-level stub factory used by both `getClientStub` and the auto-generated\n * modules (`src/getClientModules.ts:73`). Keeps body/header mapping in one\n * place so `innerModule` stays thin.\n */\nconst makeStub = <T extends JsonArray, R extends JsonValue>(\n  prefix: string,\n  name: string,\n  options: Partial<StubOptions> = {},\n): ClientFunction<T, R> => {\n  const method = (options.method ?? \"POST\") as \"GET\" | \"POST\";\n  const credentials = (options.credentials ?? \"same-origin\") as Credentials;\n  const contentType = (options.contentType ?? \"application/json\") as string;\n  if (method === \"GET\") {\n    const headers = {} as HeadersInit;\n    return (<TArgs extends T, Res extends R>(\n      ...args: TArgs\n    ): InnerModReturn<Res> => {\n      const json = JSON.stringify(args);\n      return innerModule<Res>(\n        json as BodyInit,\n        headers,\n        credentials,\n        prefix,\n        name,\n        method,\n      );\n    }) as ClientFunction<T, R>;\n  }\n  switch (contentType) {\n    case \"text/plain\": {\n      const headers = { \"Content-Type\": \"text/plain\" } as HeadersInit;\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          (args[0] as string) as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    case \"application/x-www-form-urlencoded\": {\n      const headers: HeadersInit = {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n      };\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          new URLSearchParams(args[0] as Record<string, string>)\n            .toString() as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    case \"multipart/form-data\": {\n      const headers: HeadersInit = {};\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          args[0] as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    default: {\n      const headers: HeadersInit = { \"Content-Type\": \"application/json\" };\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          JSON.stringify(args) as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n  }\n};\n\n/**\n * Creates a typed client stub for any prefix — the manual counterpart to the\n * auto-generated `public:rpc` stubs. Useful for privileged prefixes like\n * `admin:rpc` that are not emitted in the public bundle.\n * The stub has the same `{data,cancel}` shape and cancellation/error handling\n * as generated stubs, and is code-splittable: `const adminGetUser = getClientStub(\"admin:rpc\",\"get-user\")`\n * should be `await import`-ed only inside `/admin` routes so the `admin:rpc`\n * literal never appears in the public chunk.\n * @param prefix - RPC prefix (e.g. \"admin:rpc\")\n * @param name - Registered function name\n * @param options - Optional `method`, `credentials`, `contentType`\n * @returns Client stub `(...args) => {data,cancel}`\n * @example\n * import { getClientStub } from \"@thednp/rpc/helpers\";\n * const adminGetUser = getClientStub(\"admin:rpc\",\"get-user\");\n * const {data,cancel} = adminGetUser(\"123\");\n * @example\n * const adminStats = getClientStub(\"admin:rpc\",\"stats\", { method: \"GET\" });\n */\nexport function getClientStub<T extends JsonArray, R extends JsonValue>(\n  prefix: string,\n  name: string,\n  options?: Partial<StubOptions>,\n): ClientFunction<T, R> {\n  return makeStub<T, R>(prefix, name, options);\n}\n\n/**\n * Creates an AbortController-bound fetch call for a single RPC function.\n * Used by the auto-generated client modules to issue HTTP requests with cancellation support.\n * GET requests carry arguments as an `?args=` JSON query parameter, since a fetch\n * request body is not allowed on GET.\n * @param body - Serialized request body (JSON string or raw text)\n * @param headers - HTTP headers (Content-Type, etc.)\n * @param credentials - Fetch credentials policy (\"same-origin\", \"include\", or \"omit\")\n * @param prefix - RPC endpoint prefix (e.g. \"__rpc\")\n * @param name - Registered server function name\n * @param method - HTTP method to use, \"POST\" by default\n * @returns An object with `data` (promise resolving to the server response) and `cancel` (abort function)\n */\nexport const innerModule = <R extends JsonValue>(\n  body: BodyInit,\n  headers: HeadersInit,\n  credentials: Credentials,\n  prefix: string,\n  name: string,\n  method?: \"GET\" | \"POST\",\n): InnerModReturn<R> => {\n  const controller = new AbortController();\n  const cancel = (reason: string) => controller.abort(reason);\n\n  const fetcher = async () => {\n    try {\n      const isGet = method === \"GET\";\n      const url = isGet\n        ? `/${prefix}/${name}?args=${encodeURIComponent(String(body))}`\n        : `/${prefix}/${name}`;\n      const response = await fetch(url, {\n        method: isGet ? \"GET\" : \"POST\",\n        headers,\n        credentials,\n        body: isGet ? undefined : body,\n        signal: controller.signal,\n      });\n      return await handleResponse<R>(response);\n    } catch (err) {\n      throw err;\n    }\n  };\n\n  return {\n    data: fetcher(),\n    cancel,\n  };\n};\n"],"mappings":";AAEA,MAAa,oBAAoB;AAEjC,MAAa,qBAAqB;;;;;;;;;;;ACelC,MAAa,iBAAiB,OAC5B,aACsB;CACtB,IAAI,CAAC,SAAS,IAAI;EAChB,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,QAAQ,KAAK,iBAAiB;EAEvC,MAAM,IAAI,MAAM,qBAAqB,SAAS,UAAU;CAC1D;CACA,MAAM,SAAS,MAAM,SAAS,KAAK;CACnC,IAAI,OAAO,OAAO,MAAM,IAAI,MAAM,OAAO,KAAK;CAC9C,OAAO,OAAO;AAChB;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,kBAAqB,SAAqB;CACrD,IAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;EAC7C,MAAM,WAAW;EACjB,IAAI,EAAE,UAAU,aAAa,WAAW,UACtC,MAAM,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC;EAExC,IAAI,UAAU,UAAU,OAAO,SAAS;CAC1C;CACA,OAAO;AACT;;;;;;AAOA,MAAM,YACJ,QACA,MACA,UAAgC,CAAC,MACR;CACzB,MAAM,SAAU,QAAQ,UAAU;CAClC,MAAM,cAAe,QAAQ,eAAe;CAC5C,MAAM,cAAe,QAAQ,eAAe;CAC5C,IAAI,WAAW,OAAO;EACpB,MAAM,UAAU,CAAC;EACjB,SACE,GAAG,SACqB;GACxB,MAAM,OAAO,KAAK,UAAU,IAAI;GAChC,OAAO,YACL,MACA,SACA,aACA,QACA,MACA,MACF;EACF;CACF;CACA,QAAQ,aAAR;EACE,KAAK,cAAc;GACjB,MAAM,UAAU,EAAE,gBAAgB,aAAa;GAC/C,SACE,GAAG,SAEH,YACG,KAAK,IACN,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,KAAK,qCAAqC;GACxC,MAAM,UAAuB,EAC3B,gBAAgB,oCAClB;GACA,SACE,GAAG,SAEH,YACE,IAAI,gBAAgB,KAAK,EAA4B,CAAC,CACnD,SAAS,GACZ,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,KAAK,uBAAuB;GAC1B,MAAM,UAAuB,CAAC;GAC9B,SACE,GAAG,SAEH,YACE,KAAK,IACL,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,SAAS;GACP,MAAM,UAAuB,EAAE,gBAAgB,mBAAmB;GAClE,SACE,GAAG,SAEH,YACE,KAAK,UAAU,IAAI,GACnB,SACA,aACA,QACA,MACA,MACF;EACJ;CACF;AACF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cACd,QACA,MACA,SACsB;CACtB,OAAO,SAAe,QAAQ,MAAM,OAAO;AAC7C;;;;;;;;;;;;;;AAeA,MAAa,eACX,MACA,SACA,aACA,QACA,MACA,WACsB;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;CAE1D,MAAM,UAAU,YAAY;EAC1B,IAAI;GACF,MAAM,QAAQ,WAAW;GACzB,MAAM,MAAM,QACR,IAAI,OAAO,GAAG,KAAK,QAAQ,mBAAmB,OAAO,IAAI,CAAC,MAC1D,IAAI,OAAO,GAAG;GAClB,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,QAAQ,QAAQ,QAAQ;IACxB;IACA;IACA,MAAM,QAAQ,KAAA,IAAY;IAC1B,QAAQ,WAAW;GACrB,CAAC;GACD,OAAO,MAAM,eAAkB,QAAQ;EACzC,SAAS,KAAK;GACZ,MAAM;EACR;CACF;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;CACF;AACF"}
+{"version":3,"file":"helpers.mjs","names":[],"sources":["../../src/constants.ts","../../src/client-helpers.ts"],"sourcesContent":["/**\n * @module User-facing message strings.\n *\n * Two shapes live here: plain message constants (the exact text an RPC\n * response body carries) and message *factories* for the cases that need a\n * value interpolated. Both are part of the wire contract for the bodies below,\n * so the casing is deliberate — e.g. a client matching on\n * `METHOD_NOT_ALLOWED` must see `\"Method Not Allowed\"`, not `\"Method not\n * allowed\"`. These strings are also what keeps error responses generic: they\n * never include the requested function name, so a response cannot be used to\n * enumerate what exists.\n */\n/** Thrown-name for an operation stopped by its own `cancel()`. */\nexport const OPERATION_ABORTED = \"Operation aborted\";\n\n/** Warning text used when a request is cancelled by an HTTP 408/499 response. */\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\n/** Prefix of the `Error` message the client helpers throw for a non-OK HTTP response. The status text is appended; the response body is deliberately not read, so server-side detail never reaches the client through this path. */\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\n/** Warning logged when a scanned server module exports nothing. */\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\n/** Error logged when a server function file cannot be loaded by Vite's SSR loader. */\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\n/** Body of a 404. Deliberately does not name the requested function. */\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\n/** Body of a 405, returned when the HTTP method does not match the function's declared method. */\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\n/** Body of a 403, returned when the optional origin allowlist rejects the request. */\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\n/** Body of a 415, returned when the request's `Content-Type` does not satisfy the function's declared `contentType`. */\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\n/** Body of a 413, returned when the request body exceeds the host's configured size limit. */\nexport const PAYLOAD_TOO_LARGE = \"Payload Too Large\";\n\n/** Body of a 400, returned when a GET `?args=` value parses but is not an array. */\nexport const BAD_REQUEST = \"Bad Request\";\n\n/** Body of a 500. Always generic — never the underlying error, so internals cannot leak. */\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\n/** Abort reason used when the client disconnects mid-dispatch. */\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\n/** Warning logged when no config file is discovered and the defaults are used. */\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\n/** Warning logged when a config file exists but could not be loaded; the defaults are used. */\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Client-side helper utilities. Exports `handleResponse` for processing fetch responses and `innerModule` for creating AbortController-bound RPC fetch calls. This module is bundled into the generated client modules — keep it free of server-only code. */\nimport type {\n  ClientFunction,\n  Credentials,\n  InnerModReturn,\n  JsonArray,\n  JsonValue,\n  StubOptions,\n} from \"./types.d.ts\";\nimport { FETCH_ERROR_PREFIX, REQUEST_CANCELLED } from \"./constants.ts\";\n\n/**\n * Processes an HTTP fetch response from the RPC server.\n * On HTTP 499 or 408 (client cancellation), logs a warning and returns undefined.\n * On other error statuses, throws a Fetch error.\n * On success, parses JSON and returns `result.data` — or throws if `result.error` is set.\n * @param response - Fetch Response object from the RPC endpoint\n * @returns The response data, or void on cancellation\n */\nexport const handleResponse = async <R extends JsonValue>(\n  response: Response,\n): Promise<R | void> => {\n  if (!response.ok) {\n    if (response.status === 499 || response.status === 408) {\n      return console.warn(REQUEST_CANCELLED);\n    }\n    throw new Error(FETCH_ERROR_PREFIX + response.statusText);\n  }\n  const result = await response.json();\n  if (result.error) throw new Error(result.error);\n  return result.data as R;\n};\n\n/**\n * Unwraps the `{ data }` envelope from a parsed RPC response body.\n *\n * Error handling matches `handleResponse` so both helpers in this module agree\n * on the contract: a **top-level** `error` key (which the server only emits for\n * 404/405/415/400/500) throws, while a `{ data: { error } }` body resolves\n * normally — that shape is the documented \"validation-as-data\" contract where a\n * 200 carries the validation outcome as its result.\n *\n * Discriminating on `error` present **and** `data` absent is what keeps those\n * two cases apart. Checking `res.ok` first is still recommended, since this\n * helper is status-code agnostic by design.\n * @param json - Parsed JSON response body\n * @returns The unwrapped response data\n * @throws When the body carries a top-level `error` and no `data`\n * @example\n * ```ts\n * const response = await fetch(\"/__rpc/greet\", { method: \"POST\", ... });\n * const body = await response.json();\n * const greeting = unwrapEnvelope<string>(body); // \"Hello, world!\"\n * ```\n */\nexport const unwrapEnvelope = <T>(json: unknown): T => {\n  if (json !== null && typeof json === \"object\") {\n    const envelope = json as { data?: T; error?: unknown };\n    if (!(\"data\" in envelope) && \"error\" in envelope) {\n      throw new Error(String(envelope.error));\n    }\n    if (\"data\" in envelope) return envelope.data as T;\n  }\n  return json as T;\n};\n\n/**\n * Low-level stub factory used by both `getClientStub` and the auto-generated\n * modules (`src/getClientModules.ts:73`). Keeps body/header mapping in one\n * place so `innerModule` stays thin.\n */\nconst makeStub = <T extends JsonArray, R extends JsonValue>(\n  prefix: string,\n  name: string,\n  options: Partial<StubOptions> = {},\n): ClientFunction<T, R> => {\n  const method = (options.method ?? \"POST\") as \"GET\" | \"POST\";\n  const credentials = (options.credentials ?? \"same-origin\") as Credentials;\n  const contentType = (options.contentType ?? \"application/json\") as string;\n  if (method === \"GET\") {\n    const headers = {} as HeadersInit;\n    return (<TArgs extends T, Res extends R>(\n      ...args: TArgs\n    ): InnerModReturn<Res> => {\n      const json = JSON.stringify(args);\n      return innerModule<Res>(\n        json as BodyInit,\n        headers,\n        credentials,\n        prefix,\n        name,\n        method,\n      );\n    }) as ClientFunction<T, R>;\n  }\n  switch (contentType) {\n    case \"text/plain\": {\n      const headers = { \"Content-Type\": \"text/plain\" } as HeadersInit;\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          (args[0] as string) as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    case \"application/x-www-form-urlencoded\": {\n      const headers: HeadersInit = {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n      };\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          new URLSearchParams(args[0] as Record<string, string>)\n            .toString() as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    case \"multipart/form-data\": {\n      const headers: HeadersInit = {};\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          args[0] as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n    default: {\n      const headers: HeadersInit = { \"Content-Type\": \"application/json\" };\n      return (<TArgs extends T, Res extends R>(\n        ...args: TArgs\n      ): InnerModReturn<Res> =>\n        innerModule(\n          JSON.stringify(args) as BodyInit,\n          headers,\n          credentials,\n          prefix,\n          name,\n          method,\n        )) as ClientFunction<T, R>;\n    }\n  }\n};\n\n/**\n * Creates a typed client stub for any prefix — the manual counterpart to the\n * auto-generated `public:rpc` stubs. Useful for privileged prefixes like\n * `admin:rpc` that are not emitted in the public bundle.\n * The stub has the same `{data,cancel}` shape and cancellation/error handling\n * as generated stubs, and is code-splittable: `const adminGetUser = getClientStub(\"admin:rpc\",\"get-user\")`\n * should be `await import`-ed only inside `/admin` routes so the `admin:rpc`\n * literal never appears in the public chunk.\n * @param prefix - RPC prefix (e.g. \"admin:rpc\")\n * @param name - Registered function name\n * @param options - Optional `method`, `credentials`, `contentType`\n * @returns Client stub `(...args) => {data,cancel}`\n * @example\n * import { getClientStub } from \"@thednp/rpc/helpers\";\n * const adminGetUser = getClientStub(\"admin:rpc\",\"get-user\");\n * const {data,cancel} = adminGetUser(\"123\");\n * @example\n * const adminStats = getClientStub(\"admin:rpc\",\"stats\", { method: \"GET\" });\n */\nexport function getClientStub<T extends JsonArray, R extends JsonValue>(\n  prefix: string,\n  name: string,\n  options?: Partial<StubOptions>,\n): ClientFunction<T, R> {\n  return makeStub<T, R>(prefix, name, options);\n}\n\n/**\n * Creates an AbortController-bound fetch call for a single RPC function.\n * Used by the auto-generated client modules to issue HTTP requests with cancellation support.\n * GET requests carry arguments as an `?args=` JSON query parameter, since a fetch\n * request body is not allowed on GET.\n * @param body - Serialized request body (JSON string or raw text)\n * @param headers - HTTP headers (Content-Type, etc.)\n * @param credentials - Fetch credentials policy (\"same-origin\", \"include\", or \"omit\")\n * @param prefix - RPC endpoint prefix (e.g. \"__rpc\")\n * @param name - Registered server function name\n * @param method - HTTP method to use, \"POST\" by default\n * @returns An object with `data` (promise resolving to the server response) and `cancel` (abort function)\n */\nexport const innerModule = <R extends JsonValue>(\n  body: BodyInit,\n  headers: HeadersInit,\n  credentials: Credentials,\n  prefix: string,\n  name: string,\n  method?: \"GET\" | \"POST\",\n): InnerModReturn<R> => {\n  const controller = new AbortController();\n  const cancel = (reason: string) => controller.abort(reason);\n\n  const fetcher = async () => {\n    try {\n      const isGet = method === \"GET\";\n      const url = isGet\n        ? `/${prefix}/${name}?args=${encodeURIComponent(String(body))}`\n        : `/${prefix}/${name}`;\n      const response = await fetch(url, {\n        method: isGet ? \"GET\" : \"POST\",\n        headers,\n        credentials,\n        body: isGet ? undefined : body,\n        signal: controller.signal,\n      });\n      return await handleResponse<R>(response);\n    } catch (err) {\n      throw err;\n    }\n  };\n\n  return {\n    data: fetcher(),\n    cancel,\n  };\n};\n"],"mappings":";;AAgBA,MAAa,oBAAoB;;AAGjC,MAAa,qBAAqB;;;;;;;;;;;ACAlC,MAAa,iBAAiB,OAC5B,aACsB;CACtB,IAAI,CAAC,SAAS,IAAI;EAChB,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,QAAQ,KAAK,iBAAiB;EAEvC,MAAM,IAAI,MAAM,qBAAqB,SAAS,UAAU;CAC1D;CACA,MAAM,SAAS,MAAM,SAAS,KAAK;CACnC,IAAI,OAAO,OAAO,MAAM,IAAI,MAAM,OAAO,KAAK;CAC9C,OAAO,OAAO;AAChB;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,kBAAqB,SAAqB;CACrD,IAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;EAC7C,MAAM,WAAW;EACjB,IAAI,EAAE,UAAU,aAAa,WAAW,UACtC,MAAM,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC;EAExC,IAAI,UAAU,UAAU,OAAO,SAAS;CAC1C;CACA,OAAO;AACT;;;;;;AAOA,MAAM,YACJ,QACA,MACA,UAAgC,CAAC,MACR;CACzB,MAAM,SAAU,QAAQ,UAAU;CAClC,MAAM,cAAe,QAAQ,eAAe;CAC5C,MAAM,cAAe,QAAQ,eAAe;CAC5C,IAAI,WAAW,OAAO;EACpB,MAAM,UAAU,CAAC;EACjB,SACE,GAAG,SACqB;GACxB,MAAM,OAAO,KAAK,UAAU,IAAI;GAChC,OAAO,YACL,MACA,SACA,aACA,QACA,MACA,MACF;EACF;CACF;CACA,QAAQ,aAAR;EACE,KAAK,cAAc;GACjB,MAAM,UAAU,EAAE,gBAAgB,aAAa;GAC/C,SACE,GAAG,SAEH,YACG,KAAK,IACN,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,KAAK,qCAAqC;GACxC,MAAM,UAAuB,EAC3B,gBAAgB,oCAClB;GACA,SACE,GAAG,SAEH,YACE,IAAI,gBAAgB,KAAK,EAA4B,CAAC,CACnD,SAAS,GACZ,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,KAAK,uBAAuB;GAC1B,MAAM,UAAuB,CAAC;GAC9B,SACE,GAAG,SAEH,YACE,KAAK,IACL,SACA,aACA,QACA,MACA,MACF;EACJ;EACA,SAAS;GACP,MAAM,UAAuB,EAAE,gBAAgB,mBAAmB;GAClE,SACE,GAAG,SAEH,YACE,KAAK,UAAU,IAAI,GACnB,SACA,aACA,QACA,MACA,MACF;EACJ;CACF;AACF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cACd,QACA,MACA,SACsB;CACtB,OAAO,SAAe,QAAQ,MAAM,OAAO;AAC7C;;;;;;;;;;;;;;AAeA,MAAa,eACX,MACA,SACA,aACA,QACA,MACA,WACsB;CACtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;CAE1D,MAAM,UAAU,YAAY;EAC1B,IAAI;GACF,MAAM,QAAQ,WAAW;GACzB,MAAM,MAAM,QACR,IAAI,OAAO,GAAG,KAAK,QAAQ,mBAAmB,OAAO,IAAI,CAAC,MAC1D,IAAI,OAAO,GAAG;GAClB,MAAM,WAAW,MAAM,MAAM,KAAK;IAChC,QAAQ,QAAQ,QAAQ;IACxB;IACA;IACA,MAAM,QAAQ,KAAA,IAAY;IAC1B,QAAQ,WAAW;GACrB,CAAC;GACD,OAAO,MAAM,eAAkB,QAAQ;EACzC,SAAS,KAAK;GACZ,MAAM;EACR;CACF;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;CACF;AACF"}

package/dist/hono/hono.d.mts

@@ -1,7 +1,7 @@
 import { createMiddleware as createMiddleware$1 } from "hono/factory";
 import { Context, Context as HonoContext, Hono, Hono as Hono$1, Hono as HonoApp, HonoRequest, MiddlewareHandler, MiddlewareHandler as HonoMiddlewareHandler, Next as HonoNext, Response as HonoResponse } from "hono";
 import { IncomingHttpHeaders, IncomingMessage } from "node:http";
-import { BodyResult, MiddlewareOptions, RpcPluginOptions } from "@thednp/rpc";
+import { AdapterName, BodyResult, MiddlewareOptions } from "@thednp/rpc";
 import { ViteDevServer } from "vite";
 import "express";
 import "fastify";
@@ -92,7 +92,7 @@ interface HonoMiddlewareHooks {
  * Hono middleware factory: takes optional initial options and returns
  * the Hono-compatible handler.
  */
-type HonoMiddlewareFn = <A extends RpcPluginOptions["adapter"] = "hono">(initialOptions?: Partial<MiddlewareOptions<A>>) => HonoMiddlewareHooks["handler"];
+type HonoMiddlewareFn = <A extends AdapterName = "hono">(initialOptions?: Partial<MiddlewareOptions<A>>) => HonoMiddlewareHooks["handler"];
 //#endregion
 //#region src/hono/createMiddleware.d.ts
 /**

package/dist/hono/hono.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"hono.d.mts","names":["Hono","createMiddleware"],"sources":["../../src/types.d.ts","../../src/adapter-types.ts","../../src/hono/types.d.ts","../../src/hono/createMiddleware.ts","../../src/hono/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;KA0HY;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;KC1HxC;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ;;;;;;;KAQ3B;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;KCjCU,mBAAmB;EAAoB;;;;;KAKvC,wBAAwB;;;;UAKnB;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,sCACxC,iBAAiB,QAAQ,kBAAkB,QACxC;;;;;;;;;;qBCmBQ,kBAAkB;;;;;;;;qBAgFlB,qBAAqB;;;;;;;;wBC5GZ,UAAU,KAAKA,SAAI;;;;;;;qBAgB5B,aAAU,KAASA,QAAI,MAAQ;;;;;;;;;qBAY/B,iBAAc,MACnB,kBACL,kBAAkBC;EAAmB,UAAU;;;;;;;;qBAgDrC,WAAQ,GAChB,YACF,QAAQ;;;;;;;;;;;qBA4DE,WAAQ,GAChB,SAAO,kBACM,SACR,uBACP"}
+{"version":3,"file":"hono.d.mts","names":["Hono","createMiddleware"],"sources":["../../src/types.d.ts","../../src/adapter-types.ts","../../src/hono/types.d.ts","../../src/hono/createMiddleware.ts","../../src/hono/helpers.ts"],"mappings":";;;;;;;;;;;;;;;;;KAsIY;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;;;;;;;KCtIxC;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ;;;;;;;KAQ3B;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;KCjCU,mBAAmB;EAAoB;;;;;KAKvC,wBAAwB;;;;UAKnB;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,sBACxC,iBAAiB,QAAQ,kBAAkB,QACxC;;;;;;;;;;qBCkBQ,kBAAkB;;;;;;;;qBAqFlB,qBAAqB;;;;;;;;wBC/GZ,UAAU,KAAKA,SAAI;;;;;;;qBAgB5B,aAAU,KAASA,QAAI,MAAQ;;;;;;;;;qBAY/B,iBAAc,MACnB,kBACL,kBAAkBC;EAAmB,UAAU;;;;;;;;qBAuDrC,WAAQ,GAChB,YACF,QAAQ;;;;;;;;;;;qBA2EE,WAAQ,GAChB,SAAO,kBACM,SACR,uBACP"}

package/dist/hono/hono.mjs

@@ -1,11 +1,12 @@
 import { createMiddleware as createMiddleware$1 } from "hono/factory";
-import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, isOriginRequestAllowed, provideRequestContext, safeURL, scanForServerFiles } from "@thednp/rpc/server";
-const defaultRPCOptions = {
-	rpcPrefix: "__rpc",
-	adapter: "express",
-	serverFiles: "exact",
-	scanRoot: void 0
-};
+import { clientErrorMessage, clientErrorStatus, escapeRegExp, formatError, hasContentTypeMismatch, isClientHttpError, isOriginRequestAllowed, provideRequestContext, resolveRPCPrefix, safeURL, scanForServerFiles } from "@thednp/rpc/server";
+//#region src/options.ts
+/**
+* Baseline middleware options. Note `rpcPrefix` is `undefined` rather than
+* `defaultPrefix` on purpose: leaving it unset lets `resolveRPCPrefix` fall
+* through to the global prefix, which is what makes a published global prefix
+* reach the middleware.
+*/
 const defaultMiddlewareOptions = {
 	rpcPrefix: void 0,
 	path: void 0,
@@ -39,15 +40,66 @@ const getFunctionsForPrefix = (prefix) => {
 };
 //#endregion
 //#region src/constants.ts
+/** Body of a 404. Deliberately does not name the requested function. */
 const FUNCTION_NOT_FOUND = "Function not found";
+/** Body of a 405, returned when the HTTP method does not match the function's declared method. */
 const METHOD_NOT_ALLOWED = "Method Not Allowed";
+/** Body of a 403, returned when the optional origin allowlist rejects the request. */
 const REQUEST_FORBIDDEN = "Forbidden";
+/** Body of a 415, returned when the request's `Content-Type` does not satisfy the function's declared `contentType`. */
 const UNSUPPORTED_MEDIA_TYPE = "Unsupported Media Type";
+/** Body of a 400, returned when a GET `?args=` value parses but is not an array. */
 const BAD_REQUEST = "Bad Request";
+/** Abort reason used when the client disconnects mid-dispatch. */
 const CLIENT_DISCONNECTED = "client disconnected";
 /** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
 const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
 //#endregion
+//#region src/server-helpers.ts
+/**
+* Tags an error with an HTTP status for the dispatch to surface.
+*
+* Used where a malformed *request* is the fault — a body that does not parse
+* under a declared JSON `Content-Type`, a GET `?args=` value that is not valid
+* JSON. Every host framework rpc supports answers `400` for these (Express
+* `entity.parse.failed`, Fastify `FST_ERR_CTP_INVALID_JSON_BODY`, koa-bodyparser,
+* and h3's own `readBody`), and treating one as a server fault both misreports
+* the fault and turns a trivial client mistake into a log entry.
+* @param status - The HTTP status to answer with
+* @param message - Internal diagnostic message; never sent to the client
+* @returns An `Error` carrying `status`
+*/
+const httpError = (status, message) => {
+	const err = new Error(message);
+	err.status = status;
+	return err;
+};
+/**
+* Recognises an error that should produce a `4xx` response rather than a `500`.
+*
+* Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the
+* `http-errors` objects Express's `body-parser` throws, and anything else that
+* carries a numeric 4xx. Shared by all five adapters so a host-framework
+* signal and an rpc-raised one are handled by the same rule.
+* @param err - The caught error
+* @returns True when the error denotes a client (4xx) fault
+*/
+const readClientStatus = (err) => {
+	const candidate = err;
+	const status = candidate?.status ?? candidate?.statusCode;
+	return typeof status === "number" && status >= 400 && status < 500 ? status : void 0;
+};
+/**
+* Recognises an error that should produce a `4xx` response rather than a `500`.
+* Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the
+* `http-errors` objects Express's `body-parser` throws, and anything else
+* carrying a numeric 4xx. Shared by all five adapters so a host-framework
+* signal and an rpc-raised one are handled by the same rule.
+* @param err - The caught error
+* @returns True when the error denotes a client (4xx) fault
+*/
+const isClientHttpError$1 = (err) => readClientStatus(err) !== void 0;
+//#endregion
 //#region src/hono/helpers.ts
 /**
 * Convenience function to load RPC config and attach the RPC middleware to a Hono app.
@@ -56,7 +108,7 @@ const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already
 */
 async function attachRPC(app) {
 	const { loadRPCConfig } = await import("@thednp/rpc");
-	const { adapter: _adapter, ...options } = await loadRPCConfig();
+	const options = await loadRPCConfig();
 	app.use(createRPCMiddleware(options));
 }
 /**
@@ -80,6 +132,10 @@ const viteMiddleware = (vite) => {
 	return createMiddleware$1((c, next) => {
 		return new Promise((resolve) => {
 			if (typeof Bun === "undefined") {
+				if (!c.env) {
+					resolve(next());
+					return;
+				}
 				vite.middlewares(c.env.incoming, c.env.outgoing, () => resolve(next()));
 				return;
 			}
@@ -115,7 +171,7 @@ const readBody = async (c) => {
 	const isJSON = contentType.includes("json");
 	const isMultipart = contentType.includes("multipart/form-data");
 	const isUrlEncoded = contentType.includes("urlencoded");
-	const incoming = c.env.incoming;
+	const incoming = c.env?.incoming;
 	if (incoming?.body !== void 0) {
 		const reqBody = incoming.body;
 		return {
@@ -123,10 +179,14 @@ const readBody = async (c) => {
 			data: isMultipart ? reqBody : isJSON ? reqBody : isUrlEncoded ? reqBody : String(reqBody)
 		};
 	}
-	if (isJSON) return {
-		contentType: "application/json",
-		data: await c.req.json()
-	};
+	if (isJSON) try {
+		return {
+			contentType: "application/json",
+			data: await c.req.json()
+		};
+	} catch (err) {
+		throw isClientHttpError$1(err) ? err : httpError(400, "Invalid JSON body");
+	}
 	const text = await c.req.text();
 	return {
 		contentType: isMultipart ? "multipart/form-data" : isUrlEncoded ? "application/x-www-form-urlencoded" : "text/plain",
@@ -160,7 +220,7 @@ const middlewareStack = /* @__PURE__ */ new Set();
 const createMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const middlewareName = options.name;
-	let rpcPrefix = options.rpcPrefix;
+	const rpcPrefix = options.rpcPrefix;
 	const path = options.path;
 	const handler = options.handler;
 	let name = middlewareName;
@@ -170,15 +230,15 @@ const createMiddleware = (initialOptions = {}) => {
 	}
 	if (middlewareStack.has(name)) throw new Error(MIDDLEWARE_NAME_USED(name));
 	middlewareStack.add(name);
-	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
+	const resolvedPrefix = resolveRPCPrefix(rpcPrefix);
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(resolvedPrefix)}/`) : null;
 	const pathMatcher = path ? typeof path === "string" ? new RegExp(path) : path : null;
 	const middlewareHandler = createMiddleware$1(async (c, next) => {
 		const url = safeURL(c.req.path).pathname;
 		if (!handler) return next();
 		if (pathMatcher && !pathMatcher.test(url)) return next();
 		if (prefixRegex && !prefixRegex.test(url)) return next();
-		rpcPrefix = rpcPrefix ?? "__rpc";
-		if (getFunctionsForPrefix(rpcPrefix).size === 0) await scanForServerFiles({
+		if (getFunctionsForPrefix(resolvedPrefix).size === 0) await scanForServerFiles({
 			rpcPrefix,
 			serverFiles: options.serverFiles,
 			scanRoot: options.scanRoot
@@ -196,13 +256,14 @@ const createMiddleware = (initialOptions = {}) => {
 * @returns A Hono middleware function
 */
 const createRPCMiddleware = (initialOptions = {}) => {
-	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPrefix: defaultRPCOptions.rpcPrefix }, initialOptions);
+	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const rpcPrefix = options.rpcPrefix;
-	const prefix = rpcPrefix || getGlobalPrefix() || "__rpc";
-	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
+	const prefix = resolveRPCPrefix(rpcPrefix);
+	const prefixRegex = new RegExp(`^/${escapeRegExp(prefix)}/`);
 	const prefixReplace = `/${prefix}/`;
 	return createMiddleware({
 		...options,
+		rpcPrefix: prefix,
 		handler: async (c, _next) => {
 			const { path: reqPath } = c.req;
 			if (prefixRegex && !prefixRegex.test(reqPath)) return;
@@ -217,7 +278,12 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				if (method === "GET") {
 					const raw = c.req.query("args");
 					if (raw) {
-						const parsed = JSON.parse(raw);
+						let parsed;
+						try {
+							parsed = JSON.parse(raw);
+						} catch {
+							return c.json({ error: BAD_REQUEST }, 400);
+						}
 						if (!Array.isArray(parsed)) return c.json({ error: BAD_REQUEST }, 400);
 						args = parsed;
 					}
@@ -248,9 +314,9 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				};
 				const fnResult = provideRequestContext(requestEvent, () => serverFunction.handler(...args));
 				const onAbort = () => fnResult.cancel(CLIENT_DISCONNECTED);
-				c.env.incoming?.on("close", onAbort);
+				c.env?.incoming?.on("close", onAbort);
 				const result = await fnResult.data;
-				c.env.incoming?.off("close", onAbort);
+				c.env?.incoming?.off("close", onAbort);
 				if (requestEvent.redirected) return c.redirect(requestEvent.redirected.location, requestEvent.redirected.status);
 				if (requestEvent.sent) {
 					const { status, body, headers } = requestEvent.sent;
@@ -261,6 +327,10 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				}
 				return c.json({ data: result }, 200);
 			} catch (err) {
+				if (isClientHttpError(err)) {
+					const status = clientErrorStatus(err);
+					return c.json({ error: clientErrorMessage(status) }, status);
+				}
 				console.error(String(err));
 				const isProduction = process.env.NODE_ENV === "production";
 				return c.json(formatError(err, isProduction), 500);

package/dist/hono/hono.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hono.mjs","names":["createMiddleware","createHonoMiddleware"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/hono/helpers.ts","../../src/hono/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\nexport const defaultPrefix = \"__rpc\";\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const BAD_REQUEST = \"Bad Request\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/hono/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { HttpBindings } from \"@hono/node-server\";\nimport type { Context, Hono } from \"hono\";\nimport type { ViteDevServer } from \"vite\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { IncomingWithBody } from \"./types.d.ts\";\nimport { createMiddleware } from \"hono/factory\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to a Hono app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - Hono application instance\n */\nexport async function attachRPC(app: Hono) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Hono app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into Hono.\n * @param app - Hono application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: Hono, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates a Hono-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to Hono's context-based request/response model.\n * Supports both Node.js and Bun runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns A Hono middleware function\n * @see https://github.com/honojs/hono/issues/3162#issuecomment-2331118049\n */\nexport const viteMiddleware = (\n  vite: ViteDevServer,\n): ReturnType<typeof createMiddleware<{ Bindings: HttpBindings }>> => {\n  return createMiddleware<{ Bindings: HttpBindings }>((c, next) => {\n    return new Promise((resolve) => {\n      // Node.js\n      // @ts-expect-error - NodeJS is different\n      // istanbul ignore if\n      if (typeof Bun === \"undefined\") {\n        vite.middlewares(c.env.incoming, c.env.outgoing, () => resolve(next()));\n        return;\n      }\n\n      /* istanbul ignore next */ {\n        // Bun\n        let sent = false;\n        const headers = new Headers();\n        // Polyfill the node:http IncommingMessage and ServerResponse\n        vite.middlewares(\n          {\n            url: new URL(c.req.path, \"http://localhost\").pathname,\n            method: c.req.raw.method,\n            headers: Object.fromEntries(c.req.raw.headers),\n          } as IncomingMessage,\n          {\n            setHeader(name, value: string) {\n              headers.set(name, value);\n              return this;\n            },\n            end(body) {\n              sent = true;\n              resolve(\n                // @ts-expect-error - weird\n                c.body(body, c.res.status as ContentfulStatusCode, headers),\n              );\n            },\n          } as ServerResponse,\n          () => sent || resolve(next()),\n        );\n      }\n    });\n  });\n};\n\n/**\n * Reads and parses the HTTP request body from a Hono context.\n * Supports JSON and text content types, with pre-parsed body detection for server-side environments.\n * @param c - Hono request context\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (\n  c: Context,\n): Promise<BodyResult> => {\n  const contentType = c.req.header(\"content-type\")?.toLowerCase() || \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  const incoming = (c.env as HttpBindings).incoming as\n    | IncomingWithBody\n    | undefined;\n  if (incoming?.body !== undefined) {\n    const reqBody = incoming.body;\n    return {\n      contentType: isMultipart\n        ? \"multipart/form-data\"\n        : isJSON\n        ? \"application/json\"\n        : isUrlEncoded\n        ? \"application/x-www-form-urlencoded\"\n        : \"text/plain\",\n      data: isMultipart\n        ? (reqBody as Record<string, unknown>)\n        : isJSON\n        ? reqBody\n        : isUrlEncoded\n        ? (reqBody as Record<string, unknown>)\n        : String(reqBody),\n    } as BodyResult;\n  }\n  if (isJSON) {\n    const data = await c.req.json();\n    return {\n      contentType: \"application/json\",\n      data,\n    };\n  }\n\n  const text = await c.req.text();\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect on a Hono context. Hono's `c.redirect(location,\n * status)` returns a `Response` object that the handler must return (it never\n * writes directly). Defaults to `303 See Other` for convention\n * (Post/Redirect/Get).\n * @param c - Hono context\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns A Hono `Response` to return from the handler\n */\nexport const redirect = (\n  c: Context,\n  location: string,\n  status: RedirectStatusCode = 303,\n): Response => {\n  return c.redirect(location, status);\n};\n","// src/hono/createMiddleware.ts\nimport type { Context, Next } from \"hono\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { HonoMiddlewareFn, HonoMiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport { createMiddleware as createHonoMiddleware } from \"hono/factory\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  getGlobalPrefix,\n  hasContentTypeMismatch,\n  isOriginRequestAllowed,\n  provideRequestContext,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport {\n  defaultMiddlewareOptions,\n  defaultPrefix,\n  defaultRPCOptions,\n} from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Hono middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * Uses Hono's factory `createMiddleware` to wrap the handler.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Hono middleware function\n */\nexport const createMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  const middlewareName = options.name;\n  let rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = createHonoMiddleware(\n    async (c: Context, next: Next) => {\n      const reqUrl = safeURL(c.req.path);\n      const url = reqUrl.pathname;\n\n      // No need to continue when no handler provided\n      if (!handler) {\n        return next();\n      }\n\n      if (pathMatcher && !pathMatcher.test(url)) {\n        return next();\n      }\n\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return next();\n      }\n\n      rpcPrefix = (rpcPrefix ?? defaultPrefix) as string;\n\n      // When serving from production server, scan for server files\n      if (getFunctionsForPrefix(rpcPrefix).size === 0) {\n        await scanForServerFiles({\n          rpcPrefix,\n          serverFiles:\n            (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n              .serverFiles,\n          scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n        } as never);\n      }\n\n      return (await handler(c, next)) as Response;\n    },\n  );\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Hono RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Hono middleware function\n */\nexport const createRPCMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = rpcPrefix || getGlobalPrefix() || defaultPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (c: Context, _next: Next) => {\n      const { path: reqPath } = c.req;\n      // const { rpcPrefix: prefix } = options;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(reqPath)) {\n        /* istanbul ignore next */\n        return;\n      }\n\n      // Optional origin check. When Origin survives, the allowlist decides;\n      // when it has been stripped, Sec-Fetch-Site is consulted instead and\n      // fails closed. See `isOriginRequestAllowed` for the four tiers.\n      if (\n        !isOriginRequestAllowed(\n          options.origin,\n          c.req.header(\"origin\"),\n          c.req.header(\"sec-fetch-site\"),\n        )\n      ) {\n        return c.json({ error: REQUEST_FORBIDDEN }, 403);\n      }\n\n      const functionName = reqPath.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        return c.json({ error: FUNCTION_NOT_FOUND }, 404);\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (c.req.method.toUpperCase() !== method) {\n          return c.json({ error: METHOD_NOT_ALLOWED }, 405);\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = c.req.query(\"args\");\n          if (raw) {\n            const parsed: unknown = JSON.parse(raw);\n            if (!Array.isArray(parsed)) {\n              return c.json({ error: BAD_REQUEST }, 400);\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              c.req.header(\"content-type\"),\n            )\n          ) {\n            return c.json({ error: UNSUPPORTED_MEDIA_TYPE }, 415);\n          }\n          const body = await readBody(c);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: c.req,\n          response: c.res,\n          nativeEvent: c,\n          locals: {},\n          functionName,\n          // Hono's `c.redirect`/`c.json` return a `Response` (never write\n          // directly), so the bound redirect/send only record the intent; the\n          // middleware uses them after the dispatch to return the Response.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onAbort = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The runtime adapter may be absent in some Hono environments\n        // (e.g. standalone serverless adapters), so guard the close hook.\n        c.env.incoming?.on(\"close\", onAbort);\n        const result = await fnResult.data;\n        c.env.incoming?.off(\"close\", onAbort);\n\n        if (requestEvent.redirected) {\n          return c.redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status as RedirectStatusCode,\n          ) as Response;\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          return c.body(JSON.stringify(body), status as ContentfulStatusCode, {\n            \"content-type\": \"application/json\",\n            ...headers,\n          });\n        }\n\n        return c.json({ data: result }, 200);\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        return c.json(formatError(err, isProduction), 500);\n      }\n    },\n  });\n};\n"],"mappings":";;AAcA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACdA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;AC3BA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAEtC,MAAa,cAAc;AAI3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACP/B,eAAsB,UAAU,KAAW;CAIzC,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAE9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAW,SAA8B;CAClE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;;AAUA,MAAa,kBACX,SACoE;CACpE,OAAOA,oBAA8C,GAAG,SAAS;EAC/D,OAAO,IAAI,SAAS,YAAY;GAI9B,IAAI,OAAO,QAAQ,aAAa;IAC9B,KAAK,YAAY,EAAE,IAAI,UAAU,EAAE,IAAI,gBAAgB,QAAQ,KAAK,CAAC,CAAC;IACtE;GACF;GAEC;IAEC,IAAI,OAAO;IACX,MAAM,UAAU,IAAI,QAAQ;IAE5B,KAAK,YACH;KACE,KAAK,IAAI,IAAI,EAAE,IAAI,MAAM,kBAAkB,CAAC,CAAC;KAC7C,QAAQ,EAAE,IAAI,IAAI;KAClB,SAAS,OAAO,YAAY,EAAE,IAAI,IAAI,OAAO;IAC/C,GACA;KACE,UAAU,MAAM,OAAe;MAC7B,QAAQ,IAAI,MAAM,KAAK;MACvB,OAAO;KACT;KACA,IAAI,MAAM;MACR,OAAO;MACP,QAEE,EAAE,KAAK,MAAM,EAAE,IAAI,QAAgC,OAAO,CAC5D;KACF;IACF,SACM,QAAQ,QAAQ,KAAK,CAAC,CAC9B;GACF;EACF,CAAC;CACH,CAAC;AACH;;;;;;;AAQA,MAAa,WAAW,OACtB,MACwB;CACxB,MAAM,cAAc,EAAE,IAAI,OAAO,cAAc,CAAC,EAAE,YAAY,KAAK;CACnE,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CACtD,MAAM,WAAY,EAAE,IAAqB;CAGzC,IAAI,UAAU,SAAS,KAAA,GAAW;EAChC,MAAM,UAAU,SAAS;EACzB,OAAO;GACL,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;GACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;EACpB;CACF;CACA,IAAI,QAEF,OAAO;EACL,aAAa;EACb,MAAA,MAHiB,EAAE,IAAI,KAAK;CAI9B;CAGF,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK;CAC9B,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;;;AAYA,MAAa,YACX,GACA,UACA,SAA6B,QAChB;CACb,OAAO,EAAE,SAAS,UAAU,MAAM;AACpC;;;AChIA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAsC,iBAAiB,CAAC,MAAM;CACzE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,YAAY,QAAQ;CACxB,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoBC,mBACxB,OAAO,GAAY,SAAe;EAEhC,MAAM,MADS,QAAQ,EAAE,IAAI,IACZ,CAAC,CAAC;EAGnB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,YAAa,aAAA;EAGb,IAAI,sBAAsB,SAAS,CAAC,CAAC,SAAS,GAC5C,MAAM,mBAAmB;GACvB;GACA,aACG,QACE;GACL,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAQ,MAAM,QAAQ,GAAG,IAAI;CAC/B,CACF;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,aAAa,gBAAgB,KAAA;CAC5C,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OAAO,GAAY,UAAgB;GAC1C,MAAM,EAAE,MAAM,YAAY,EAAE;GAM5B,IAAI,eAAe,CAAC,YAAY,KAAK,OAAO,GAE1C;GAMF,IACE,CAAC,uBACC,QAAQ,QACR,EAAE,IAAI,OAAO,QAAQ,GACrB,EAAE,IAAI,OAAO,gBAAgB,CAC/B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAGjD,MAAM,eAAe,QAAQ,QAAQ,eAAe,EAAE;GACtD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBACH,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;GAGlD,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;IAGlD,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;KAC9B,IAAI,KAAK;MACP,MAAM,SAAkB,KAAK,MAAM,GAAG;MACtC,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;MAE3C,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,EAAE,IAAI,OAAO,cAAc,CAC7B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;KAEtD,MAAM,OAAO,MAAM,SAAS,CAAC;KAC7B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,EAAE;KACX,UAAU,EAAE;KACZ,aAAa;KACb,QAAQ,CAAC;KACT;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAGzD,EAAE,IAAI,UAAU,GAAG,SAAS,OAAO;IACnC,MAAM,SAAS,MAAM,SAAS;IAC9B,EAAE,IAAI,UAAU,IAAI,SAAS,OAAO;IAEpC,IAAI,aAAa,YACf,OAAO,EAAE,SACP,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,GAAG,QAAgC;MAClE,gBAAgB;MAChB,GAAG;KACL,CAAC;IACH;IAEA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,GAAG;GACrC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,OAAO,EAAE,KAAK,YAAY,KAAK,YAAY,GAAG,GAAG;GACnD;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"hono.mjs","names":["isClientHttpError","createMiddleware","isClientHttpError","createHonoMiddleware"],"sources":["../../src/options.ts","../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/hono/helpers.ts","../../src/hono/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\n/**\n * Defaults applied to a server function that declares no `method`,\n * `credentials`, or `contentType` of its own.\n */\nexport const defaultServerFnOptions: ServerFunctionOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n};\n\n/**\n * The built-in RPC endpoint prefix, used when neither an explicit prefix nor a\n * global one (`getGlobalPrefix`) is supplied. Kept for backward compatibility\n * with pre-multi-prefix setups, where every function lived under this one map.\n */\nexport const defaultPrefix = \"__rpc\";\n\n/**\n * Baseline plugin options. `defineConfig` merges a user's partial config over\n * these, and `loadRPCConfig` merges a loaded config file over them, so every\n * option has a defined value even when a config file omits it.\n */\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: defaultPrefix,\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\n/**\n * Baseline middleware options. Note `rpcPrefix` is `undefined` rather than\n * `defaultPrefix` on purpose: leaving it unset lets `resolveRPCPrefix` fall\n * through to the global prefix, which is what makes a published global prefix\n * reach the middleware.\n */\nexport const defaultMiddlewareOptions: MiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n};\n","import type { ServerFnEntry } from \"./types.d.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\n/**\n * Global symbol under which the shared `serverFunctionsByPrefix` map is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,\n * ...) and dev-server hot reloads, exactly like the request-context storage in\n * `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)\n * would populate a map copy the adapter middleware could not read.\n */\nconst functionsMapSymbol = Symbol.for(\"thednp.rpc.functionsMap\");\n\n/**\n * Map of rpcPrefix -> Map of function names -> ServerFnEntry\n * Enables multiple RPC instances with different prefixes to coexist\n * without name collisions.\n */\nexport const serverFunctionsByPrefix: Map<\n  string,\n  Map<string, ServerFnEntry>\n> = ((globalThis as Record<symbol, Map<string, Map<string, ServerFnEntry>>>)[\n  functionsMapSymbol\n] ??= new Map());\n\n/**\n * Gets or creates the function map for a specific prefix.\n * @param prefix - The RPC prefix (e.g., \"__rpc\", \"v1:rpc\", \"admin:rpc\")\n * @returns Map of function names to ServerFnEntry for that prefix\n */\nexport const getFunctionsForPrefix = (\n  prefix: string,\n): Map<string, ServerFnEntry> => {\n  if (!serverFunctionsByPrefix.has(prefix)) {\n    serverFunctionsByPrefix.set(prefix, new Map());\n  }\n  return serverFunctionsByPrefix.get(prefix)!;\n};\n\n/**\n * Backward compatibility: default map for the default prefix.\n * Legacy code can still use serverFunctionsMap.set(name, entry).\n */\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = {\n  get: (key: string) => getFunctionsForPrefix(defaultPrefix).get(key),\n  set: (key: string, value: ServerFnEntry) =>\n    getFunctionsForPrefix(defaultPrefix).set(key, value),\n  has: (key: string) => getFunctionsForPrefix(defaultPrefix).has(key),\n  delete: (key: string) => getFunctionsForPrefix(defaultPrefix).delete(key),\n  clear: () => getFunctionsForPrefix(defaultPrefix).clear(),\n  get size() {\n    return getFunctionsForPrefix(defaultPrefix).size;\n  },\n  entries: () => getFunctionsForPrefix(defaultPrefix).entries(),\n  keys: () => getFunctionsForPrefix(defaultPrefix).keys(),\n  values: () => getFunctionsForPrefix(defaultPrefix).values(),\n  forEach: (\n    callback: (\n      value: ServerFnEntry,\n      key: string,\n      map: Map<string, ServerFnEntry>,\n    ) => void,\n  ) => getFunctionsForPrefix(defaultPrefix).forEach(callback),\n  [Symbol.iterator]: () =>\n    getFunctionsForPrefix(defaultPrefix)[Symbol.iterator](),\n} as unknown as Map<string, ServerFnEntry>;\n","/**\n * @module User-facing message strings.\n *\n * Two shapes live here: plain message constants (the exact text an RPC\n * response body carries) and message *factories* for the cases that need a\n * value interpolated. Both are part of the wire contract for the bodies below,\n * so the casing is deliberate — e.g. a client matching on\n * `METHOD_NOT_ALLOWED` must see `\"Method Not Allowed\"`, not `\"Method not\n * allowed\"`. These strings are also what keeps error responses generic: they\n * never include the requested function name, so a response cannot be used to\n * enumerate what exists.\n */\n/** Thrown-name for an operation stopped by its own `cancel()`. */\nexport const OPERATION_ABORTED = \"Operation aborted\";\n\n/** Warning text used when a request is cancelled by an HTTP 408/499 response. */\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\n/** Prefix of the `Error` message the client helpers throw for a non-OK HTTP response. The status text is appended; the response body is deliberately not read, so server-side detail never reaches the client through this path. */\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\n/** Warning logged when a scanned server module exports nothing. */\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\n/** Error logged when a server function file cannot be loaded by Vite's SSR loader. */\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\n/** Body of a 404. Deliberately does not name the requested function. */\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\n/** Body of a 405, returned when the HTTP method does not match the function's declared method. */\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\n/** Body of a 403, returned when the optional origin allowlist rejects the request. */\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\n/** Body of a 415, returned when the request's `Content-Type` does not satisfy the function's declared `contentType`. */\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\n/** Body of a 413, returned when the request body exceeds the host's configured size limit. */\nexport const PAYLOAD_TOO_LARGE = \"Payload Too Large\";\n\n/** Body of a 400, returned when a GET `?args=` value parses but is not an array. */\nexport const BAD_REQUEST = \"Bad Request\";\n\n/** Body of a 500. Always generic — never the underlying error, so internals cannot leak. */\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\n/** Abort reason used when the client disconnects mid-dispatch. */\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$@:][A-Za-z0-9_$@:/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\n/** Warning logged when no config file is discovered and the defaults are used. */\nexport const NO_CONFIG_FOUND =\n  `  ⚡︎ No RPC config found, loading the defaults..`;\n\n/** Warning logged when a config file exists but could not be loaded; the defaults are used. */\nexport const FAILED_LOAD_CONFIG = `  ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport {\n  BAD_REQUEST,\n  INTERNAL_SERVER_ERROR,\n  PAYLOAD_TOO_LARGE,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"./constants.ts\";\nimport { defaultPrefix } from \"./options.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\n/**\n * An error carrying an HTTP status, so the dispatch can answer that status\n * instead of flattening every failure to a `500`.\n */\nexport interface ClientHttpError extends Error {\n  status?: number;\n  statusCode?: number;\n}\n\n/**\n * Tags an error with an HTTP status for the dispatch to surface.\n *\n * Used where a malformed *request* is the fault — a body that does not parse\n * under a declared JSON `Content-Type`, a GET `?args=` value that is not valid\n * JSON. Every host framework rpc supports answers `400` for these (Express\n * `entity.parse.failed`, Fastify `FST_ERR_CTP_INVALID_JSON_BODY`, koa-bodyparser,\n * and h3's own `readBody`), and treating one as a server fault both misreports\n * the fault and turns a trivial client mistake into a log entry.\n * @param status - The HTTP status to answer with\n * @param message - Internal diagnostic message; never sent to the client\n * @returns An `Error` carrying `status`\n */\nexport const httpError = (status: number, message: string): ClientHttpError => {\n  const err = new Error(message) as ClientHttpError;\n  err.status = status;\n  return err;\n};\n\n/**\n * Recognises an error that should produce a `4xx` response rather than a `500`.\n *\n * Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the\n * `http-errors` objects Express's `body-parser` throws, and anything else that\n * carries a numeric 4xx. Shared by all five adapters so a host-framework\n * signal and an rpc-raised one are handled by the same rule.\n * @param err - The caught error\n * @returns True when the error denotes a client (4xx) fault\n */\nconst readClientStatus = (err: unknown): number | undefined => {\n  const candidate = err as ClientHttpError | null | undefined;\n  // Reads both conventions: h3's `HTTPError` and rpc's `httpError` use\n  // `status`, while the `http-errors` objects Express's `body-parser` throws\n  // and Koa's `ctx.throw` use `statusCode`.\n  const status = candidate?.status ?? candidate?.statusCode;\n  return typeof status === \"number\" && status >= 400 && status < 500\n    ? status\n    : undefined;\n};\n\n/**\n * Recognises an error that should produce a `4xx` response rather than a `500`.\n * Matches the `status` / `statusCode` convention used by h3's `HTTPError`, the\n * `http-errors` objects Express's `body-parser` throws, and anything else\n * carrying a numeric 4xx. Shared by all five adapters so a host-framework\n * signal and an rpc-raised one are handled by the same rule.\n * @param err - The caught error\n * @returns True when the error denotes a client (4xx) fault\n */\nexport const isClientHttpError = (err: unknown): boolean =>\n  readClientStatus(err) !== undefined;\n\n/**\n * Reads the status to answer for a client error. Defaults to `400` rather than\n * `500` so an unrecognised 4xx is never reported as a server fault.\n * @param err - The caught error\n * @returns The 4xx status to answer with\n */\nexport const clientErrorStatus = (err: unknown): number =>\n  readClientStatus(err) ?? 400;\n\nexport const clientErrorMessage = (status: number): string => {\n  if (status === 413) return PAYLOAD_TOO_LARGE;\n  if (status === 415) return UNSUPPORTED_MEDIA_TYPE;\n  return BAD_REQUEST;\n};\n\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Decides whether a request may proceed, given the configured origin allowlist\n * and the two headers a browser can be made to reveal.\n *\n * Four tiers, evaluated in order — the first tier with a signal decides:\n *\n * 1. `origin` option unset → everything passes. No validation is performed.\n * 2. `Origin` present → the allowlist decides, exactly as {@link isOriginAllowed}.\n * 3. `Origin` absent but `Sec-Fetch-Site` present → allow only `same-origin`\n *    and `none`; anything else (including an unrecognised value) is rejected.\n * 4. Both absent → passes. This is the deliberate, documented curl/native hole.\n *\n * Tier 2 must short-circuit ahead of tier 3. `Sec-Fetch-Site` is a coarse\n * four-value enum that cannot name a host, so on its own it would reject a\n * legitimate request from an allowlisted sibling subdomain (`same-site`). The\n * allowlist exists precisely to admit that case, and it can only do so while\n * `Origin` survives. `Sec-Fetch-Site` earns a vote only once the precise signal\n * has been stripped away by something in the chain — at which point there is\n * nothing left to trust, so it fails closed.\n *\n * Browsers never strip `Origin` themselves, so tier 3 can only fire when a\n * proxy, sanitising middleware, or misconfigured CDN removed it. No legitimate\n * browser request can regress.\n *\n * An empty (or whitespace-only) header value counts as **absent**, not as an\n * unrecognised signal. No browser emits an empty `Sec-Fetch-Site`, and adapters\n * disagree on what their header accessor returns for a missing header (Node's\n * `req.headers` yields `undefined`, Hono's `c.req.header()` may yield `\"\"`).\n * Normalising here keeps all five adapters behaving identically instead of\n * inheriting whichever convention their framework happens to use.\n * @param allowed - The configured `origin` option, if any\n * @param origin - The raw `Origin` request header, if present\n * @param site - The raw `Sec-Fetch-Site` request header, if present\n * @returns `true` when the request may proceed\n */\nexport const isOriginRequestAllowed = (\n  allowed: string | string[] | undefined,\n  origin: string | undefined,\n  site: string | undefined,\n): boolean => {\n  if (!allowed) return true; // tier 1 — the check is opt-in\n  if (origin?.trim()) return isOriginAllowed(allowed, origin); // tier 2 — precise\n  if (!site?.trim()) return true; // tier 4 — curl / native client\n  // tier 3 — precision lost, so fail closed\n  return site === \"same-origin\" || site === \"none\";\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Decides whether a request's `Origin` header is allowed by the configured\n * allowlist. Shared by all five adapters so the rule lives in exactly one place.\n *\n * - No `allowed` value (option unset) → everything passes: no validation.\n * - No `requestOrigin` header → passes, preserving curl/native-client access.\n * - Otherwise the header must match one of the entries exactly.\n *\n * A single string and a one-element array behave identically, so widening\n * `origin` to `string | string[]` is backward compatible.\n *\n * `Origin: null` (sandboxed iframes, `file://`, extension pages) is rejected\n * whenever an allowlist is set, because it never equals a real origin.\n * @param allowed - The configured `origin` option, if any\n * @param requestOrigin - The raw `Origin` request header, if present\n * @returns `true` when the request may proceed\n */\nexport const isOriginAllowed = (\n  allowed: string | string[] | undefined,\n  requestOrigin: string | undefined,\n): boolean => {\n  if (!allowed || !requestOrigin) return true;\n  return Array.isArray(allowed)\n    ? allowed.includes(requestOrigin)\n    : requestOrigin === allowed;\n};\n\nconst SAFE_URL_BASE = \"http://localhost\";\n\n/**\n * Parses a raw request URL against a fixed base without ever throwing.\n * Malformed request-targets (e.g. `/\\`, `//`, `/\\/`) make the WHATWG URL\n * parser throw `TypeError: Invalid URL`; the adapters call this while\n * building the per-request URL **before** their dispatch `try` block, so an\n * unhandled rejection there crashes raw `node:http` hosts (and Express 4).\n * On failure we fall back to the base root: the resulting pathname never\n * matches the RPC prefix, so the request is treated as non-RPC and falls\n * through to `next()` / 404 instead of crashing the process.\n * @param rawUrl - Raw request URL (path + optional query string)\n * @param base - Optional base URL, defaults to a fixed localhost origin\n * @returns A URL object; never throws\n */\nexport const safeURL = (rawUrl: string, base = SAFE_URL_BASE): URL => {\n  try {\n    return new URL(rawUrl, base);\n  } catch {\n    return new URL(\"/\", base);\n  }\n};\n\nconst globalPrefixSymbol = Symbol.for(\"thednp.rpc.globalPrefix\");\n\n/** Global rpcPrefix from the last loaded config / middleware — fallback for functions without explicit prefix. */\nexport const getGlobalPrefix = (): string | undefined =>\n  (globalThis as unknown as Record<symbol, string | undefined>)[\n    globalPrefixSymbol\n  ];\n\n/**\n * Publishes the global RPC prefix, consulted by `resolveRPCPrefix` whenever no\n * explicit prefix is supplied. `loadRPCConfig` calls this on every return path\n * so a loaded config is the fallback for later registrations and dispatches.\n *\n * Stored on a `Symbol.for` key on `globalThis` so it stays instance-stable\n * across the bundled entry copies (`server.mjs`, `express.mjs`, ...) and dev\n * server hot reloads — the same technique as the request-context storage.\n * @param prefix - The prefix to publish, or `undefined` to clear it\n */\nexport const setGlobalPrefix = (prefix: string | undefined): void => {\n  if (prefix) {\n    (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ] = prefix;\n  } else {\n    delete (globalThis as unknown as Record<symbol, string | undefined>)[\n      globalPrefixSymbol\n    ];\n  }\n};\n\n/**\n * Resolves the effective RPC prefix: the explicit one when given, otherwise\n * the global prefix set by `setGlobalPrefix` / `loadRPCConfig`, otherwise the\n * built-in default.\n *\n * Every adapter resolves its prefix through this single function — in both the\n * outer `createMiddleware` gate and the `createRPCMiddleware` dispatch — so the\n * two halves of a request can never disagree, and so a prefix registered by\n * `createServerFunction` (which resolves the same way) is always the prefix the\n * middleware looks up. Resolving the two sides independently is what allowed\n * h3 to drift from the other four adapters, and what left the documented\n * global-prefix flow returning 404 on all of them.\n * @param rpcPrefix - Explicit prefix from config or middleware options\n * @returns The prefix to gate on, look up in, and strip from the request path\n */\nexport const resolveRPCPrefix = (rpcPrefix?: string): string =>\n  rpcPrefix || getGlobalPrefix() || defaultPrefix;\n","// src/hono/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { HttpBindings } from \"@hono/node-server\";\nimport type { Context, Hono } from \"hono\";\nimport type { ViteDevServer } from \"vite\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { BodyResult } from \"@thednp/rpc\";\nimport type { IncomingWithBody } from \"./types.d.ts\";\nimport { createMiddleware } from \"hono/factory\";\nimport { httpError, isClientHttpError } from \"../server-helpers.ts\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to a Hono app.\n * Dynamically imports loadRPCConfig and registers the middleware.\n * @param app - Hono application instance\n */\nexport async function attachRPC(app: Hono) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const options = await loadRPCConfig();\n\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to a Hono app for development mode.\n * Uses the viteMiddleware wrapper to bridge Vite's Connect-compatible stack into Hono.\n * @param app - Hono application instance\n * @param vite - Running Vite dev server\n */\nexport const attachVite = (app: Hono, vite: ViteDevServer): void => {\n  app.use(viteMiddleware(vite));\n};\n\n/**\n * Creates a Hono-compatible middleware from a Vite dev server middleware stack.\n * Bridges the Connect/Express middleware interface to Hono's context-based request/response model.\n * Supports both Node.js and Bun runtimes with separate polyfill paths.\n * @param vite - Running Vite dev server\n * @returns A Hono middleware function\n * @see https://github.com/honojs/hono/issues/3162#issuecomment-2331118049\n */\nexport const viteMiddleware = (\n  vite: ViteDevServer,\n): ReturnType<typeof createMiddleware<{ Bindings: HttpBindings }>> => {\n  return createMiddleware<{ Bindings: HttpBindings }>((c, next) => {\n    return new Promise((resolve) => {\n      // Node.js\n      // @ts-expect-error - NodeJS is different\n      // istanbul ignore if\n      if (typeof Bun === \"undefined\") {\n        // Only a node-style runtime can hand Vite's Connect stack a raw\n        // IncomingMessage/ServerResponse. Everywhere else `c.env` is absent,\n        // so there is nothing to bridge and we fall through to the Bun path.\n        if (!c.env) {\n          resolve(next());\n          return;\n        }\n        vite.middlewares(c.env.incoming, c.env.outgoing, () => resolve(next()));\n        return;\n      }\n\n      /* istanbul ignore next */ {\n        // Bun\n        let sent = false;\n        const headers = new Headers();\n        // Polyfill the node:http IncommingMessage and ServerResponse\n        vite.middlewares(\n          {\n            url: new URL(c.req.path, \"http://localhost\").pathname,\n            method: c.req.raw.method,\n            headers: Object.fromEntries(c.req.raw.headers),\n          } as IncomingMessage,\n          {\n            setHeader(name, value: string) {\n              headers.set(name, value);\n              return this;\n            },\n            end(body) {\n              sent = true;\n              resolve(\n                // @ts-expect-error - weird\n                c.body(body, c.res.status as ContentfulStatusCode, headers),\n              );\n            },\n          } as ServerResponse,\n          () => sent || resolve(next()),\n        );\n      }\n    });\n  });\n};\n\n/**\n * Reads and parses the HTTP request body from a Hono context.\n * Supports JSON and text content types, with pre-parsed body detection for server-side environments.\n * @param c - Hono request context\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = async (\n  c: Context,\n): Promise<BodyResult> => {\n  const contentType = c.req.header(\"content-type\")?.toLowerCase() || \"\";\n  const isJSON = contentType.includes(\"json\");\n  const isMultipart = contentType.includes(\"multipart/form-data\");\n  const isUrlEncoded = contentType.includes(\"urlencoded\");\n  // `c.env` is only populated by @hono/node-server. On every other runtime\n  // Hono supports — Cloudflare Workers, Bun, Deno, and Hono's own\n  // `app.fetch()` — it is undefined, and reading `.incoming` off it threw a\n  // TypeError that the dispatch reported as a 500 for *every* request,\n  // including well-formed ones. Optional chaining makes the pre-parsed path\n  // simply not apply there, which is correct: those runtimes have no\n  // node IncomingMessage to read a pre-parsed body from.\n  const incoming = (c.env as HttpBindings | undefined)?.incoming as\n    | IncomingWithBody\n    | undefined;\n  if (incoming?.body !== undefined) {\n    const reqBody = incoming.body;\n    return {\n      contentType: isMultipart\n        ? \"multipart/form-data\"\n        : isJSON\n        ? \"application/json\"\n        : isUrlEncoded\n        ? \"application/x-www-form-urlencoded\"\n        : \"text/plain\",\n      data: isMultipart\n        ? (reqBody as Record<string, unknown>)\n        : isJSON\n        ? reqBody\n        : isUrlEncoded\n        ? (reqBody as Record<string, unknown>)\n        : String(reqBody),\n    } as BodyResult;\n  }\n  if (isJSON) {\n    try {\n      const data = await c.req.json();\n      return {\n        contentType: \"application/json\",\n        data,\n      };\n    } catch (err) {\n      // Hono has no opinion here (its maintainers declined to own this in\n      // honojs/hono#578), so a malformed body arrived as a bare SyntaxError\n      // and was reported as a 500. Tag it so the dispatch answers 400, which\n      // is what every other supported host does.\n      throw isClientHttpError(err) ? err : httpError(400, \"Invalid JSON body\");\n    }\n  }\n\n  const text = await c.req.text();\n  return {\n    contentType: isMultipart\n      ? \"multipart/form-data\"\n      : isUrlEncoded\n      ? \"application/x-www-form-urlencoded\"\n      : \"text/plain\",\n    data: isMultipart\n      ? ({ raw: text } as Record<string, unknown>)\n      : isUrlEncoded\n      ? Object.fromEntries(new URLSearchParams(text))\n      : String(text),\n  } as BodyResult;\n};\n\n/**\n * Issues an HTTP redirect on a Hono context. Hono's `c.redirect(location,\n * status)` returns a `Response` object that the handler must return (it never\n * writes directly). Defaults to `303 See Other` for convention\n * (Post/Redirect/Get).\n * @param c - Hono context\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n * @returns A Hono `Response` to return from the handler\n */\nexport const redirect = (\n  c: Context,\n  location: string,\n  status: RedirectStatusCode = 303,\n): Response => {\n  return c.redirect(location, status);\n};\n","// src/hono/createMiddleware.ts\nimport type { Context, Next } from \"hono\";\nimport type {\n  ContentfulStatusCode,\n  RedirectStatusCode,\n} from \"hono/utils/http-status\";\nimport type { HonoMiddlewareFn, HonoMiddlewareOptions } from \"./types.d.ts\";\nimport type { JsonValue } from \"@thednp/rpc\";\nimport { createMiddleware as createHonoMiddleware } from \"hono/factory\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  clientErrorMessage,\n  clientErrorStatus,\n  escapeRegExp,\n  formatError,\n  hasContentTypeMismatch,\n  isClientHttpError,\n  isOriginRequestAllowed,\n  provideRequestContext,\n  resolveRPCPrefix,\n  safeURL,\n  scanForServerFiles,\n} from \"@thednp/rpc/server\";\nimport { getFunctionsForPrefix } from \"../functionsMap.ts\";\nimport { defaultMiddlewareOptions } from \"../options.ts\";\nimport {\n  BAD_REQUEST,\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\nimport { readBody } from \"./helpers.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates a Hono middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.\n * Uses Hono's factory `createMiddleware` to wrap the handler.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns A Hono middleware function\n */\nexport const createMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  const middlewareName = options.name;\n  const rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  // Resolved once at creation time so the hoisted regex and the\n  // function-map lookup can never disagree. `createRPCMiddleware` hands\n  // over its already-resolved prefix, making this a no-op in that path.\n  const resolvedPrefix = resolveRPCPrefix(rpcPrefix);\n  // Gated only when an explicit prefix was supplied: a bare\n  // `createMiddleware({ path, handler })` has never prefix-gated.\n  // `createRPCMiddleware` always supplies one, so RPC dispatch does.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(resolvedPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = createHonoMiddleware(\n    async (c: Context, next: Next) => {\n      const reqUrl = safeURL(c.req.path);\n      const url = reqUrl.pathname;\n\n      // No need to continue when no handler provided\n      if (!handler) {\n        return next();\n      }\n\n      if (pathMatcher && !pathMatcher.test(url)) {\n        return next();\n      }\n\n      if (prefixRegex && !prefixRegex.test(url)) {\n        return next();\n      }\n\n      // When serving from production server, scan for server files\n      if (getFunctionsForPrefix(resolvedPrefix).size === 0) {\n        await scanForServerFiles({\n          rpcPrefix,\n          serverFiles:\n            (options as unknown as { serverFiles?: \"exact\" | \"glob\" })\n              .serverFiles,\n          scanRoot: (options as unknown as { scanRoot?: string }).scanRoot,\n        } as never);\n      }\n\n      return (await handler(c, next)) as Response;\n    },\n  );\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Hono RPC middleware that routes incoming requests to registered server functions.\n * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches\n * to the matching function, and returns the JSON-serialized result.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns A Hono middleware function\n */\nexport const createRPCMiddleware: HonoMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as HonoMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefix = resolveRPCPrefix(rpcPrefix);\n  const prefixRegex = new RegExp(`^/${escapeRegExp(prefix)}/`);\n  const prefixReplace = `/${prefix}/`;\n\n  return createMiddleware({\n    ...options,\n    // Hand the resolved prefix down so the gate and the dispatch agree.\n    rpcPrefix: prefix,\n    handler: async (c: Context, _next: Next) => {\n      const { path: reqPath } = c.req;\n      // const { rpcPrefix: prefix } = options;\n\n      // Defense-in-depth: validate prefix match via escaped regex even though\n      // the outer createMiddleware gates on the same prefix already.\n      // istanbul ignore if\n      if (prefixRegex && !prefixRegex.test(reqPath)) {\n        /* istanbul ignore next */\n        return;\n      }\n\n      // Optional origin check. When Origin survives, the allowlist decides;\n      // when it has been stripped, Sec-Fetch-Site is consulted instead and\n      // fails closed. See `isOriginRequestAllowed` for the four tiers.\n      if (\n        !isOriginRequestAllowed(\n          options.origin,\n          c.req.header(\"origin\"),\n          c.req.header(\"sec-fetch-site\"),\n        )\n      ) {\n        return c.json({ error: REQUEST_FORBIDDEN }, 403);\n      }\n\n      const functionName = reqPath.replace(prefixReplace, \"\");\n      const serverFunction = getFunctionsForPrefix(prefix).get(functionName);\n\n      if (!serverFunction) {\n        return c.json({ error: FUNCTION_NOT_FOUND }, 404);\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (c.req.method.toUpperCase() !== method) {\n          return c.json({ error: METHOD_NOT_ALLOWED }, 405);\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = c.req.query(\"args\");\n          if (raw) {\n            let parsed: unknown;\n            try {\n              parsed = JSON.parse(raw);\n            } catch {\n              // A malformed `?args=` is a malformed request, not a server\n              // fault, so it answers 400 like the non-array case above.\n              return c.json({ error: BAD_REQUEST }, 400);\n            }\n            if (!Array.isArray(parsed)) {\n              return c.json({ error: BAD_REQUEST }, 400);\n            }\n            args = parsed as JsonValue[];\n          }\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              c.req.header(\"content-type\"),\n            )\n          ) {\n            return c.json({ error: UNSUPPORTED_MEDIA_TYPE }, 415);\n          }\n          const body = await readBody(c);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const requestEvent: RequestEvent = {\n          request: c.req,\n          response: c.res,\n          nativeEvent: c,\n          locals: {},\n          functionName,\n          // Hono's `c.redirect`/`c.json` return a `Response` (never write\n          // directly), so the bound redirect/send only record the intent; the\n          // middleware uses them after the dispatch to return the Response.\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n          },\n          send: (status, body, headers) => {\n            requestEvent.sent = { status, body, headers };\n          },\n        };\n        const fnResult = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onAbort = () => fnResult.cancel(CLIENT_DISCONNECTED);\n        // The runtime adapter may be absent in some Hono environments\n        // (e.g. Workers, Bun, Deno, standalone serverless adapters), so guard\n        // the close hook. `c.env?.incoming?.` — the `?.` after `incoming` alone\n        // guards a null `incoming`, not an undefined `c.env`, which is what\n        // actually threw here and turned every request into a 500.\n        c.env?.incoming?.on(\"close\", onAbort);\n        const result = await fnResult.data;\n        c.env?.incoming?.off(\"close\", onAbort);\n\n        if (requestEvent.redirected) {\n          return c.redirect(\n            requestEvent.redirected.location,\n            requestEvent.redirected.status as RedirectStatusCode,\n          ) as Response;\n        }\n\n        if (requestEvent.sent) {\n          const { status, body, headers } = requestEvent.sent;\n          return c.body(JSON.stringify(body), status as ContentfulStatusCode, {\n            \"content-type\": \"application/json\",\n            ...headers,\n          });\n        }\n\n        return c.json({ data: result }, 200);\n      } catch (err) {\n        // A malformed request is a client error, not a server fault. rpc raises\n        // these with a status (see `httpError`), and host frameworks signal the\n        // same class the same way — h3's body limit throws 413 from inside the\n        // read, Express's body-parser throws 400, and Fastify's parser does the\n        // same before rpc is reached. Answering 500 for any of them both\n        // misreports the fault and turns a trivial client mistake into a log\n        // entry. The body comes from a fixed table, so nothing from the\n        // underlying error is echoed back.\n        if (isClientHttpError(err)) {\n          const status = clientErrorStatus(err);\n          return c.json(\n            { error: clientErrorMessage(status) },\n            status as ContentfulStatusCode,\n          );\n        }\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        return c.json(formatError(err, isProduction), 500);\n      }\n    },\n  });\n};\n"],"mappings":";;;;;;;;;AAwCA,MAAa,2BAA8C;CACzD,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;ACjCA,MAAM,qBAAqB,OAAO,IAAI,yBAAyB;;;;;;AAO/D,MAAa,0BAGR,WACH,wCACI,IAAI,IAAI;;;;;;AAOd,MAAa,yBACX,WAC+B;CAC/B,IAAI,CAAC,wBAAwB,IAAI,MAAM,GACrC,wBAAwB,IAAI,wBAAQ,IAAI,IAAI,CAAC;CAE/C,OAAO,wBAAwB,IAAI,MAAM;AAC3C;;;;ACTA,MAAa,qBAAqB;;AAGlC,MAAa,qBAAqB;;AAGlC,MAAa,oBAAoB;;AAGjC,MAAa,yBAAyB;;AAMtC,MAAa,cAAc;;AAM3B,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;;;;;;;;;AC6D/B,MAAa,aAAa,QAAgB,YAAqC;CAC7E,MAAM,MAAM,IAAI,MAAM,OAAO;CAC7B,IAAI,SAAS;CACb,OAAO;AACT;;;;;;;;;;;AAYA,MAAM,oBAAoB,QAAqC;CAC7D,MAAM,YAAY;CAIlB,MAAM,SAAS,WAAW,UAAU,WAAW;CAC/C,OAAO,OAAO,WAAW,YAAY,UAAU,OAAO,SAAS,MAC3D,SACA,KAAA;AACN;;;;;;;;;;AAWA,MAAaA,uBAAqB,QAChC,iBAAiB,GAAG,MAAM,KAAA;;;;;;;;ACnI5B,eAAsB,UAAU,KAAW;CAIzC,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,UAAU,MAAM,cAAc;CAEpC,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;;AAQA,MAAa,cAAc,KAAW,SAA8B;CAClE,IAAI,IAAI,eAAe,IAAI,CAAC;AAC9B;;;;;;;;;AAUA,MAAa,kBACX,SACoE;CACpE,OAAOC,oBAA8C,GAAG,SAAS;EAC/D,OAAO,IAAI,SAAS,YAAY;GAI9B,IAAI,OAAO,QAAQ,aAAa;IAI9B,IAAI,CAAC,EAAE,KAAK;KACV,QAAQ,KAAK,CAAC;KACd;IACF;IACA,KAAK,YAAY,EAAE,IAAI,UAAU,EAAE,IAAI,gBAAgB,QAAQ,KAAK,CAAC,CAAC;IACtE;GACF;GAEC;IAEC,IAAI,OAAO;IACX,MAAM,UAAU,IAAI,QAAQ;IAE5B,KAAK,YACH;KACE,KAAK,IAAI,IAAI,EAAE,IAAI,MAAM,kBAAkB,CAAC,CAAC;KAC7C,QAAQ,EAAE,IAAI,IAAI;KAClB,SAAS,OAAO,YAAY,EAAE,IAAI,IAAI,OAAO;IAC/C,GACA;KACE,UAAU,MAAM,OAAe;MAC7B,QAAQ,IAAI,MAAM,KAAK;MACvB,OAAO;KACT;KACA,IAAI,MAAM;MACR,OAAO;MACP,QAEE,EAAE,KAAK,MAAM,EAAE,IAAI,QAAgC,OAAO,CAC5D;KACF;IACF,SACM,QAAQ,QAAQ,KAAK,CAAC,CAC9B;GACF;EACF,CAAC;CACH,CAAC;AACH;;;;;;;AAQA,MAAa,WAAW,OACtB,MACwB;CACxB,MAAM,cAAc,EAAE,IAAI,OAAO,cAAc,CAAC,EAAE,YAAY,KAAK;CACnE,MAAM,SAAS,YAAY,SAAS,MAAM;CAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;CAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;CAQtD,MAAM,WAAY,EAAE,KAAkC;CAGtD,IAAI,UAAU,SAAS,KAAA,GAAW;EAChC,MAAM,UAAU,SAAS;EACzB,OAAO;GACL,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;GACJ,MAAM,cACD,UACD,SACA,UACA,eACC,UACD,OAAO,OAAO;EACpB;CACF;CACA,IAAI,QACF,IAAI;EAEF,OAAO;GACL,aAAa;GACb,MAAA,MAHiB,EAAE,IAAI,KAAK;EAI9B;CACF,SAAS,KAAK;EAKZ,MAAMC,oBAAkB,GAAG,IAAI,MAAM,UAAU,KAAK,mBAAmB;CACzE;CAGF,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK;CAC9B,OAAO;EACL,aAAa,cACT,wBACA,eACA,sCACA;EACJ,MAAM,cACD,EAAE,KAAK,KAAK,IACb,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,OAAO,IAAI;CACjB;AACF;;;;;;;;;;;AAYA,MAAa,YACX,GACA,UACA,SAA6B,QAChB;CACb,OAAO,EAAE,SAAS,UAAU,MAAM;AACpC;;;ACxJA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAsC,iBAAiB,CAAC,MAAM;CACzE,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAEA,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,YAAY,QAAQ;CAC1B,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAOxB,MAAM,iBAAiB,iBAAiB,SAAS;CAIjD,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,cAAc,EAAE,EAAE,IAC/C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoBC,mBACxB,OAAO,GAAY,SAAe;EAEhC,MAAM,MADS,QAAQ,EAAE,IAAI,IACZ,CAAC,CAAC;EAGnB,IAAI,CAAC,SACH,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAGd,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,KAAK;EAId,IAAI,sBAAsB,cAAc,CAAC,CAAC,SAAS,GACjD,MAAM,mBAAmB;GACvB;GACA,aACG,QACE;GACL,UAAW,QAA6C;EAC1D,CAAU;EAGZ,OAAQ,MAAM,QAAQ,GAAG,IAAI;CAC/B,CACF;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,SAAS,iBAAiB,SAAS;CACzC,MAAM,cAAc,IAAI,OAAO,KAAK,aAAa,MAAM,EAAE,EAAE;CAC3D,MAAM,gBAAgB,IAAI,OAAO;CAEjC,OAAO,iBAAiB;EACtB,GAAG;EAEH,WAAW;EACX,SAAS,OAAO,GAAY,UAAgB;GAC1C,MAAM,EAAE,MAAM,YAAY,EAAE;GAM5B,IAAI,eAAe,CAAC,YAAY,KAAK,OAAO,GAE1C;GAMF,IACE,CAAC,uBACC,QAAQ,QACR,EAAE,IAAI,OAAO,QAAQ,GACrB,EAAE,IAAI,OAAO,gBAAgB,CAC/B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAGjD,MAAM,eAAe,QAAQ,QAAQ,eAAe,EAAE;GACtD,MAAM,iBAAiB,sBAAsB,MAAM,CAAC,CAAC,IAAI,YAAY;GAErE,IAAI,CAAC,gBACH,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;GAGlD,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;IAGlD,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;KAC9B,IAAI,KAAK;MACP,IAAI;MACJ,IAAI;OACF,SAAS,KAAK,MAAM,GAAG;MACzB,QAAQ;OAGN,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;MAC3C;MACA,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;MAE3C,OAAO;KACT;IACF,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,EAAE,IAAI,OAAO,cAAc,CAC7B,GAEA,OAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;KAEtD,MAAM,OAAO,MAAM,SAAS,CAAC;KAC7B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,eAA6B;KACjC,SAAS,EAAE;KACX,UAAU,EAAE;KACZ,aAAa;KACb,QAAQ,CAAC;KACT;KAIA,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;KAC/C;KACA,OAAO,QAAQ,MAAM,YAAY;MAC/B,aAAa,OAAO;OAAE;OAAQ;OAAM;MAAQ;KAC9C;IACF;IACA,MAAM,WAAW,sBACf,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,SAAS,OAAO,mBAAmB;IAMzD,EAAE,KAAK,UAAU,GAAG,SAAS,OAAO;IACpC,MAAM,SAAS,MAAM,SAAS;IAC9B,EAAE,KAAK,UAAU,IAAI,SAAS,OAAO;IAErC,IAAI,aAAa,YACf,OAAO,EAAE,SACP,aAAa,WAAW,UACxB,aAAa,WAAW,MAC1B;IAGF,IAAI,aAAa,MAAM;KACrB,MAAM,EAAE,QAAQ,MAAM,YAAY,aAAa;KAC/C,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,GAAG,QAAgC;MAClE,gBAAgB;MAChB,GAAG;KACL,CAAC;IACH;IAEA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,GAAG;GACrC,SAAS,KAAK;IASZ,IAAI,kBAAkB,GAAG,GAAG;KAC1B,MAAM,SAAS,kBAAkB,GAAG;KACpC,OAAO,EAAE,KACP,EAAE,OAAO,mBAAmB,MAAM,EAAE,GACpC,MACF;IACF;IACA,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,OAAO,EAAE,KAAK,YAAY,KAAK,YAAY,GAAG,GAAG;GACnD;EACF;CACF,CAAC;AACH"}