h3 2.0.1-rc.21 → 2.0.1-rc.23

package/dist/{h3-DiSMXP1G.d.mts → index.d.mts}

@@ -1,4 +1,4 @@
-import { C as DynamicEventHandler, D as EventHandlerRequest, E as EventHandlerObject, F as Middleware, L as MaybePromise$1, M as HTTPHandler, N as InferEventInput, O as EventHandlerResponse, R as TypedRequest, S as HTTPError, Y as CookieSerializeOptions, a as H3EventContext, b as ErrorDetails, d as H3RouteMeta, f as HTTPMethod, i as HTTPEvent, j as FetchableObject, k as EventHandlerWithFetch, l as H3Plugin, o as H3$1, r as H3Event, s as H3Config, t as H3, w as EventHandler } from "./h3-D76FUMrE.mjs";
+import { CookieSerializeOptions, DynamicEventHandler, ErrorDetails, EventHandler, EventHandlerObject, EventHandlerRequest, EventHandlerResponse, EventHandlerWithFetch, FetchableObject, H3, H3$1, H3Config, H3Event, H3EventContext, H3Plugin, H3RouteMeta, HTTPError, HTTPEvent, HTTPHandler, HTTPMethod, InferEventInput, MaybePromise as MaybePromise$1, Middleware, TypedRequest } from "./h3.mjs";
 import { NodeServerRequest, NodeServerResponse, ServerRequest, ServerRequestContext } from "srvx";
 import { Hooks, Hooks as WebSocketHooks, Message as WebSocketMessage, Peer, Peer as WebSocketPeer } from "crossws";
 
@@ -249,7 +249,7 @@ declare function getValidatedRouterParams<Event extends HTTPEvent, OutputT, Inpu
 /**
 * Get a matched route param by name.
 *
-* If `decode` option is `true`, it will decode the matched route param using `decodeURI`.
+* If `decode` option is `true`, it will decode the matched route param using `decodeURIComponent`.
 *
 * @example
 * app.get("/", (event) => {
@@ -308,7 +308,7 @@ declare function getRequestHost(event: HTTPEvent, opts?: {
 /**
 * Get the request protocol.
 *
-* If `x-forwarded-proto` header is set to "https", it will return "https". You can disable this behavior by setting `xForwardedProto` to `false`.
+* If `x-forwarded-proto` header is set to "https", it will return "https". If the header contains a comma-separated list of protocols, the first entry is used. You can disable this behavior by setting `xForwardedProto` to `false`.
 *
 * If protocol cannot be determined, it will default to "http".
 *
@@ -493,6 +493,19 @@ interface ProxyOptions {
   cookieDomainRewrite?: string | Record<string, string>;
   cookiePathRewrite?: string | Record<string, string>;
   onResponse?: (event: H3Event, response: Response) => void | Promise<void>;
+  /**
+  * Control how a client disconnect is handled.
+  *
+  * The incoming request's abort signal (`event.req.signal`) is always forwarded
+  * to the proxied request, so a client disconnect aborts the upstream request
+  * and releases its connection. By default the resulting abort is handled
+  * quietly with a `499 Client Closed Request` response (never delivered, since
+  * the client is already gone) rather than logged as a `502` gateway error.
+  *
+  * Set this to `true` to instead let the `AbortError` propagate to your handler
+  * (e.g. to run cleanup). This also applies to a custom `fetchOptions.signal`.
+  */
+  propagateAbortError?: boolean;
 }
 /**
 * Proxy the incoming request to a target URL.
@@ -500,11 +513,24 @@ interface ProxyOptions {
 * If the `target` starts with `/`, the request is handled internally by the app router
 * via `event.app.fetch()` instead of making an external HTTP request.
 *
+* The request body is streamed to the target without buffering. Per the Fetch
+* standard, a request body can only be consumed once, so reading it beforehand
+* (e.g. via `readBody()`, `readFormData()`, or body-reading middleware) locks
+* the stream and proxying fails. If you need to inspect the body and still
+* proxy it, read from a clone and leave the original event untouched.
+*
 * **Security:** Never pass unsanitized user input as the `target`. Callers are
 * responsible for validating and restricting the target URL (e.g. allowlisting
 * hosts, blocking internal paths, enforcing protocol). Consider using
 * `bodyLimit()` middleware to prevent large request bodies from consuming
 * excessive resources when proxying untrusted input.
+*
+* @example
+* app.all("/proxy", async (event) => {
+*   const body = await event.req.clone().json(); // read from the clone
+*   // ...inspect body...
+*   return proxyRequest(event, "/target"); // original stream still intact
+* });
 */
 declare function proxyRequest(event: H3Event, target: string, opts?: ProxyOptions): Promise<HTTPResponse>;
 /**
@@ -537,20 +563,41 @@ declare function getProxyRequestHeaders(event: H3Event, opts?: {
 * responsible for validating and restricting the URL.
 */
 declare function fetchWithEvent(event: H3Event, url: string, init?: RequestInit): Promise<Response>;
+interface ReadBodyOptions {
+  /**
+  * Force a parser instead of inferring it from the request `Content-Type`.
+  *
+  * - `"json"` (default): parse as JSON.
+  * - `"text"`: return the raw string body.
+  * - `"urlencoded"`: parse as `application/x-www-form-urlencoded`.
+  * - `"formData"`: parse as `multipart/form-data` (or url-encoded) form data.
+  */
+  type?: "json" | "text" | "urlencoded" | "formData";
+}
 /**
 * Reads request body and tries to parse using JSON.parse or URLSearchParams.
 *
+* By default the body is parsed as JSON (falling back to URL-encoded parsing
+* when the `Content-Type` is `application/x-www-form-urlencoded`). Other body
+* types, such as `multipart/form-data`, must be opted into explicitly via
+* `options.type` and are never auto-detected from the request headers.
+*
 * @example
-* app.get("/", async (event) => {
+* app.post("/", async (event) => {
 *   const body = await readBody(event);
 * });
+* @example
+* app.post("/upload", async (event) => {
+*   const body = await readBody(event, { type: "formData" });
+* });
 *
 * @param event H3 event passed by h3 handler
-* @param encoding The character encoding to use, defaults to 'utf-8'.
+* @param options Parsing options. Set `type` to force a parser instead of
+*   inferring it from the request `Content-Type`.
 *
-* @return {*} The `Object`, `Array`, `String`, `Number`, `Boolean`, or `null` value corresponding to the request JSON body
+* @return {*} The `Object`, `Array`, `String`, `Number`, `Boolean`, or `null` value corresponding to the request body
 */
-declare function readBody<T, _Event extends HTTPEvent = HTTPEvent, _T = InferEventInput<"body", _Event, T>>(event: _Event): Promise<undefined | _T>;
+declare function readBody<T, _Event extends HTTPEvent = HTTPEvent, _T = InferEventInput<"body", _Event, T>>(event: _Event, options?: ReadBodyOptions): Promise<undefined | _T>;
 declare function readValidatedBody<Event extends HTTPEvent, S extends StandardSchemaV1>(event: Event, validate: S, options?: {
   onError?: (result: FailureResult) => ErrorDetails;
 }): Promise<InferOutput<S>>;
@@ -675,6 +722,7 @@ declare class EventStream {
   private _unsentData;
   private _disposed;
   private _handled;
+  private get _isClosed();
   constructor(event: H3Event, opts?: EventStreamOptions);
   /**
   * Publish new event(s) for the client
@@ -803,6 +851,62 @@ interface CacheConditions {
 * @returns `true` when cache headers are matching. When `true` is returned, no response should be sent anymore
 */
 declare function handleCacheHeaders(event: H3Event, opts: CacheConditions): boolean;
+interface ResolveDotSegmentsOptions {
+  /**
+  * Also decode percent-encoded path separators (`%2f`, `%5c`) into real `/`
+  * segment boundaries before resolving `.`/`..`.
+  *
+  * `event.url.pathname` never decodes `%2f` on its own, because doing so
+  * would change how many segments a path has and therefore which route
+  * matches — a correctness concern for dispatch, not just a security one
+  * (e.g. `/files/:id` may rely on `%2F` to keep an id with a literal slash
+  * as one opaque segment). So never use the result for routing/dispatch.
+  *
+  * Enable this for any out-of-band scope/security check whose result is
+  * later handed to something that collapses `%2f` back to `/` on its own —
+  * which is the common case, not an exotic one: an ordinary reverse proxy
+  * (e.g. nginx with a trailing-slash `proxy_pass`) decodes `%2f`→`/` on every
+  * request, so an encoded separator that dodges a narrower rule at match time
+  * then escapes it downstream. If a scope check feeds a proxy or redirect
+  * target, you almost certainly want this on.
+  *
+  * Decoding is pessimistic but bounded: it collapses a separator nested as
+  * repeated whole `%25` prefixes (`%252f`, `%25252f`, ...) at any depth, so a
+  * downstream that keeps `%25`-re-encoding and decoding cannot smuggle one
+  * past. It does NOT catch a separator whose own hex digits are themselves
+  * percent-encoded (`%25%32%66` → `%2f` → `/` after two decodes) — and that
+  * form can appear even in an already-once-decoded pathname (from wire
+  * `%2525%2532%2566`), so once-decoded input is not by itself sufficient.
+  * Treat this as covering the common `%25`-nesting case, not as an absolute
+  * guarantee against every multi-decode chain. Other escapes (e.g. `%20`) are
+  * never decoded.
+  *
+  * @default false
+  */
+  decodeSlashes?: boolean;
+}
+/**
+* Resolve `.` and `..` segments in a path, without ever escaping above the
+* root `/`. The result is always an absolute path with a single leading `/`,
+* so it can never be protocol-relative (`//host`).
+*
+* Also decodes percent-encoded dot segments at any `%25`-nesting depth
+* (`%2e`, `%252e`, ...) and normalizes `\` to `/`, so encoded or
+* backslash-based traversal (e.g. `%2e%2e/`, `..\..\`) is caught the same
+* way as a literal `../`.
+*
+* `%2f`/`%5c` (encoded path separators) are left untouched by default — see
+* {@link ResolveDotSegmentsOptions.decodeSlashes}.
+*
+* Only `.`/`..` resolution and the decodes above alter the string; every other
+* percent-encoding (`%20`, non-ASCII, `%3A`, and any `%2e` not forming a whole
+* segment) is left intact, so the result stays in the same representation as an
+* un-decoded `event.url.pathname` and matches routes/rules consistently.
+* Interior empty segments are preserved (`/a//b` stays `/a//b`, per WHATWG URL
+* normalization) — only the leading slash is guaranteed single, so a consumer
+* doing exact prefix matching should normalize its allowlist the same way.
+*/
+declare function resolveDotSegments(path: string, opts?: ResolveDotSegmentsOptions): string;
 interface StaticAssetMeta {
   type?: string;
   etag?: string;
@@ -1030,17 +1134,36 @@ interface RequestFingerprintOptions {
 */
 declare function getRequestFingerprint(event: HTTPEvent, opts?: RequestFingerprintOptions): Promise<string | null>;
 /**
-* Define WebSocket hooks.
+* The `426 Upgrade Required` response returned by `defineWebSocketHandler()`
+* for WebSocket upgrade requests, augmented with the `crossws` hooks that
+* were attached to it. Adapters (like the crossws `serve()` plugin) read
+* `crossws` off this response to wire up the platform-specific WebSocket
+* upgrade.
 *
-* @see https://h3.dev/guide/websocket
+* `crossws` is always the resolved hooks object: when the handler is defined
+* with an async hooks factory, `defineWebSocketHandler()` awaits it before
+* attaching it to the response.
 */
-declare function defineWebSocket(hooks: Partial<Hooks>): Partial<Hooks>;
+type WebSocketResponse = Response & {
+  crossws?: Partial<Hooks>;
+};
 /**
-* Define WebSocket event handler.
+* Define WebSocket hooks.
+*
+* @example
+* const hooks = defineWebSocket({
+*   open: (peer) => peer.send("Welcome!"),
+*   message: (peer, message) => peer.send(message.text()),
+*   close: (peer) => console.log("closed", peer),
+* });
 *
 * @see https://h3.dev/guide/websocket
 */
-declare function defineWebSocketHandler(hooks: Partial<Hooks> | ((event: H3Event) => Partial<Hooks> | Promise<Partial<Hooks>>)): EventHandler;
+declare function defineWebSocket(hooks: Partial<Hooks>): Partial<Hooks>;
+declare function defineWebSocketHandler(hooks: Partial<Hooks>): EventHandler<EventHandlerRequest, WebSocketResponse>;
+declare function defineWebSocketHandler(hooks: (event: H3Event) => Partial<Hooks> | Promise<Partial<Hooks>>): EventHandler<EventHandlerRequest, EventHandlerResponse<WebSocketResponse>>;
+declare function defineWebSocketHandler<Http extends EventHandler>(hooks: Partial<Hooks>, http: Http): EventHandler<EventHandlerRequest, WebSocketResponse | ReturnType<Http>>;
+declare function defineWebSocketHandler<Http extends EventHandler>(hooks: (event: H3Event) => Partial<Hooks> | Promise<Partial<Hooks>>, http: Http): EventHandler<EventHandlerRequest, EventHandlerResponse<WebSocketResponse> | ReturnType<Http>>;
 /**
 * JSON-RPC 2.0 Interfaces based on the specification.
 * https://www.jsonrpc.org/specification
@@ -1267,4 +1390,4 @@ declare const createApp: (config?: H3Config) => H3;
 declare const createRouter: (config?: H3Config) => H3;
 /** @deprecated Please use `withBase()` */
 declare const useBase: (base: string, input: EventHandler | H3) => EventHandler;
-export { JsonRpcWebSocketMethod as $, noContent as $t, readFormDataBody as A, defineMiddleware as An, createEventStream as At, setHeader as B, mockEvent as Bn, readBody as Bt, getResponseHeader as C, defineNodeMiddleware as Cn, handleCacheHeaders as Ct, isError as D, HTTPResponse as Dn, withServerTiming as Dt, getResponseStatusText as E, toWebHandler as En, setServerTiming as Et, sendNoContent as F, dynamicEventHandler as Fn, getValidatedCookies as Ft, toNodeHandler as G, proxy as Gt, setResponseHeader as H, ProxyOptions as Ht, sendProxy as I, toEventHandler as In, parseCookies as It, JsonRpcError as J, onError as Jt, toNodeListener as K, proxyRequest as Kt, sendRedirect as L, getEventContext as Ln, setChunkedCookie as Lt, readRawBody as M, defineHandler as Mn, deleteCookie as Mt, removeResponseHeader as N, defineLazyEventHandler as Nn, getChunkedCookie as Nt, lazyEventHandler as O, toResponse as On, EventStreamMessage as Ot, sendIterable as P, defineValidatedHandler as Pn, getCookie as Pt, JsonRpcResponse as Q, iterable as Qt, sendStream as R, isEvent as Rn, setCookie as Rt, getRequestWebStream as S, defineNodeHandler as Sn, CacheConditions as St, getResponseStatus as T, fromWebHandler as Tn, sanitizeStatusMessage as Tt, setResponseHeaders as U, fetchWithEvent as Ut, setHeaders as V, readValidatedBody as Vt, setResponseStatus as W, getProxyRequestHeaders as Wt, JsonRpcParams as X, onResponse as Xt, JsonRpcMethod as Y, onRequest as Yt, JsonRpcRequest as Z, html as Zt, getHeaders as _, RouteDefinition as _n, isCorsOriginAllowed as _t, appendResponseHeaders as a, getRequestHost as an, defineWebSocket as at, getRequestHeaders as b, NodeHandler as bn, StaticAssetMeta as bt, createError as c, getRequestURL as cn, getRequestFingerprint as ct, defineEventHandler as d, getValidatedQuery as dn, requireBasicAuth as dt, redirect as en, defineJsonRpcHandler as et, defineNodeListener as f, getValidatedRouterParams as fn, CorsOptions as ft, getHeader as g, toRequest as gn, isPreflightRequest as gt, getBodyStream as h, requestWithURL as hn, handleCors as ht, appendResponseHeader as i, getQuery as in, WebSocketPeer as it, readMultipartFormData as j, toMiddleware as jn, deleteChunkedCookie as jt, readFormData as k, callMiddleware as kn, EventStreamOptions as kt, createRouter as l, getRouterParam as ln, BasicAuthOptions as lt, fromNodeMiddleware as m, requestWithBaseURL as mn, appendCorsPreflightHeaders as mt, appendHeader as n, writeEarlyHints as nn, WebSocketHooks as nt, clearResponseHeaders as o, getRequestIP as on, defineWebSocketHandler as ot, eventHandler as p, isMethod as pn, appendCorsHeaders as pt, useBase as q, bodyLimit as qt, appendHeaders as r, assertMethod as rn, WebSocketMessage as rt, createApp as s, getRequestProtocol as sn, RequestFingerprintOptions as st, H3Error as t, redirectBack as tn, defineJsonRpcWebSocketHandler as tt, defaultContentType as u, getRouterParams as un, basicAuth as ut, getMethod as v, defineRoute as vn, withBase as vt, getResponseHeaders as w, fromNodeHandler as wn, sanitizeStatusCode as wt, getRequestPath as x, NodeMiddleware as xn, serveStatic as xt, getRequestHeader as y, removeRoute as yn, ServeStaticOptions as yt, sendWebResponse as z, isHTTPEvent as zn, assertBodySize as zt };
+export { BasicAuthOptions, CacheConditions, CorsOptions, EventStreamMessage, EventStreamOptions, H3Error, HTTPResponse, JsonRpcError, JsonRpcMethod, JsonRpcParams, JsonRpcRequest, JsonRpcResponse, JsonRpcWebSocketMethod, NodeHandler, NodeMiddleware, ProxyOptions, ReadBodyOptions, RequestFingerprintOptions, ResolveDotSegmentsOptions, RouteDefinition, ServeStaticOptions, StaticAssetMeta, type WebSocketHooks, type WebSocketMessage, type WebSocketPeer, WebSocketResponse, appendCorsHeaders, appendCorsPreflightHeaders, appendHeader, appendHeaders, appendResponseHeader, appendResponseHeaders, assertBodySize, assertMethod, basicAuth, bodyLimit, callMiddleware, clearResponseHeaders, createApp, createError, createEventStream, createRouter, defaultContentType, defineEventHandler, defineHandler, defineJsonRpcHandler, defineJsonRpcWebSocketHandler, defineLazyEventHandler, defineMiddleware, defineNodeHandler, defineNodeListener, defineNodeMiddleware, defineRoute, defineValidatedHandler, defineWebSocket, defineWebSocketHandler, deleteChunkedCookie, deleteCookie, dynamicEventHandler, eventHandler, fetchWithEvent, fromNodeHandler, fromNodeMiddleware, fromWebHandler, getBodyStream, getChunkedCookie, getCookie, getEventContext, getHeader, getHeaders, getMethod, getProxyRequestHeaders, getQuery, getRequestFingerprint, getRequestHeader, getRequestHeaders, getRequestHost, getRequestIP, getRequestPath, getRequestProtocol, getRequestURL, getRequestWebStream, getResponseHeader, getResponseHeaders, getResponseStatus, getResponseStatusText, getRouterParam, getRouterParams, getValidatedCookies, getValidatedQuery, getValidatedRouterParams, handleCacheHeaders, handleCors, html, isCorsOriginAllowed, isError, isEvent, isHTTPEvent, isMethod, isPreflightRequest, iterable, lazyEventHandler, mockEvent, noContent, onError, onRequest, onResponse, parseCookies, proxy, proxyRequest, readBody, readFormData, readFormDataBody, readMultipartFormData, readRawBody, readValidatedBody, redirect, redirectBack, removeResponseHeader, removeRoute, requestWithBaseURL, requestWithURL, requireBasicAuth, resolveDotSegments, sanitizeStatusCode, sanitizeStatusMessage, sendIterable, sendNoContent, sendProxy, sendRedirect, sendStream, sendWebResponse, serveStatic, setChunkedCookie, setCookie, setHeader, setHeaders, setResponseHeader, setResponseHeaders, setResponseStatus, setServerTiming, toEventHandler, toMiddleware, toNodeHandler, toNodeListener, toRequest, toResponse, toWebHandler, useBase, withBase, withServerTiming, writeEarlyHints };

package/dist/tracing.d.mts

@@ -1,4 +1,4 @@
-import { l as H3Plugin, r as H3Event } from "./h3-D76FUMrE.mjs";
+import { EventHandler, H3Event, H3Plugin } from "./h3.mjs";
 
 interface TracingRequestEvent {
   type: "middleware" | "route";
@@ -21,4 +21,14 @@ interface TracingPluginOptions {
 * Enables tracing for H3 apps.
 */
 declare function tracingPlugin(traceOpts?: TracingPluginOptions): H3Plugin;
-export { TracingPluginOptions, TracingRequestEvent, tracingPlugin };
+/**
+* Wraps an event handler so its execution is traced via the `h3.request`
+* diagnostics channel with `type: "route"`. Intended to be called once per
+* handler at initialization time (e.g. during codegen or module load), not
+* per request.
+*
+* Returns the handler unchanged when `diagnostics_channel` is unavailable
+* or the handler is already traced.
+*/
+declare function wrapHandlerWithTracing(handler: EventHandler): EventHandler;
+export { TracingPluginOptions, TracingRequestEvent, tracingPlugin, wrapHandlerWithTracing };

package/dist/tracing.mjs

@@ -1,4 +1,3 @@
-import "./h3-DagAgogP.mjs";
 function tracingPlugin(traceOpts) {
 	return (h3) => {
 		const { tracingChannel } = globalThis.process?.getBuiltinModule?.("diagnostics_channel") ?? {};
@@ -73,4 +72,18 @@ function tracingPlugin(traceOpts) {
 		return h3;
 	};
 }
-export { tracingPlugin };
+function wrapHandlerWithTracing(handler) {
+	const { tracingChannel } = globalThis.process?.getBuiltinModule?.("diagnostics_channel") ?? {};
+	if (!tracingChannel) return handler;
+	if (handler.__traced__) return handler;
+	const channel = tracingChannel("h3.request");
+	const wrapped = (...args) => {
+		return channel.tracePromise(async () => handler(...args), {
+			event: args[0],
+			type: "route"
+		});
+	};
+	wrapped.__traced__ = true;
+	return wrapped;
+}
+export { tracingPlugin, wrapHandlerWithTracing };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "h3",
-  "version": "2.0.1-rc.21",
+  "version": "2.0.1-rc.23",
   "description": "Minimal H(TTP) framework built for high performance and portability.",
   "homepage": "https://h3.dev",
   "license": "MIT",
@@ -49,51 +49,51 @@
     "test": "pnpm lint && vitest --run --coverage"
   },
   "dependencies": {
-    "rou3": "^0.8.1",
-    "srvx": "^0.11.15"
+    "rou3": "^0.9.0",
+    "srvx": "^0.11.21"
   },
   "devDependencies": {
-    "@happy-dom/global-registrator": "^20.9.0",
+    "@happy-dom/global-registrator": "^20.10.6",
     "@mitata/counters": "^0.0.8",
     "@types/connect": "^3.4.38",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.6.0",
-    "@types/react": "^19.2.14",
+    "@types/node": "^26.1.0",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@typescript/native-preview": "^7.0.0-dev.20260429.1",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@typescript/native-preview": "latest",
+    "@vitest/coverage-v8": "^4.1.9",
     "automd": "^0.4.3",
     "changelogen": "^0.6.2",
     "connect": "^3.7.0",
     "cookie-es": "^3.1.1",
-    "crossws": "^0.4.5",
-    "elysia": "^1.4.28",
-    "esbuild": "^0.28.0",
+    "crossws": "^0.4.9",
+    "elysia": "^1.4.29",
+    "esbuild": "^0.28.1",
     "express": "^5.2.1",
     "fetchdts": "^0.1.7",
     "get-port-please": "^3.2.0",
-    "h3": "^2.0.1-rc.20",
-    "h3-nightly": "^2.0.0-20260429-110804-351b2aa",
-    "happy-dom": "^20.9.0",
-    "hono": "^4.12.15",
+    "h3": "workspace:*",
+    "h3-nightly": "latest",
+    "happy-dom": "^20.10.6",
+    "hono": "^4.12.27",
     "magic-string": "^0.30.21",
     "mdzilla": "^0.2.1",
-    "memoirist": "^0.4.0",
+    "memoirist": "^1.1.0",
     "mitata": "^1.0.34",
-    "obuild": "^0.4.33",
-    "oxc-parser": "^0.128.0",
-    "oxfmt": "^0.47.0",
-    "oxlint": "^1.62.0",
-    "oxlint-tsgolint": "^0.22.1",
-    "react": "^19.2.5",
-    "react-dom": "^19.2.5",
+    "obuild": "^0.4.37",
+    "oxc-parser": "^0.138.0",
+    "oxfmt": "^0.57.0",
+    "oxlint": "^1.72.0",
+    "oxlint-tsgolint": "^0.24.0",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^6.0.3",
-    "vite": "^8.0.10",
-    "vitest": "^4.1.5",
-    "zod": "^4.3.6"
+    "vite": "^8.1.3",
+    "vitest": "^4.1.9",
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "crossws": "^0.4.1"
+    "crossws": "^0.4.9"
   },
   "peerDependenciesMeta": {
     "crossws": {
@@ -107,5 +107,5 @@
   "engines": {
     "node": ">=20.11.1"
   },
-  "packageManager": "pnpm@10.33.2"
+  "packageManager": "pnpm@11.9.0"
 }

package/dist/h3-DagAgogP.mjs

@@ -1,4 +0,0 @@
-function definePlugin(def) {
-	return ((opts) => (h3) => def(h3, opts));
-}
-export { definePlugin as t };