request-iframe 0.0.5 → 0.1.0

package/esm/core/server.js

@@ -0,0 +1,767 @@
+import _slicedToArray from "@babel/runtime/helpers/esm/slicedToArray";
+import _defineProperty from "@babel/runtime/helpers/esm/defineProperty";
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+import "core-js/modules/es.array.includes.js";
+import "core-js/modules/es.symbol.description.js";
+import "core-js/modules/es.array.filter.js";
+import "core-js/modules/es.array.from.js";
+import "core-js/modules/es.array.iterator.js";
+import "core-js/modules/es.array.slice.js";
+import "core-js/modules/es.map.js";
+import "core-js/modules/es.object.entries.js";
+import "core-js/modules/es.promise.js";
+import "core-js/modules/es.object.get-own-property-descriptors.js";
+import "core-js/modules/es.regexp.exec.js";
+import "core-js/modules/es.string.includes.js";
+import "core-js/modules/es.string.match.js";
+import "core-js/modules/es.regexp.to-string.js";
+import "core-js/modules/es.string.replace.js";
+import "core-js/modules/es.string.starts-with.js";
+import "core-js/modules/web.dom-collections.for-each.js";
+import "core-js/modules/web.dom-collections.iterator.js";
+import { isCompatibleVersion } from '../utils';
+import { matchPath, matchPathWithParams } from '../utils/path-match';
+import { matchOrigin } from '../utils/origin';
+import { ServerRequestImpl } from './request';
+import { ServerResponseImpl } from './response';
+import { MessageDispatcher } from '../message';
+import { getOrCreateMessageChannel, releaseMessageChannel } from '../utils/cache';
+import { generateInstanceId, generateRequestId } from '../utils';
+import { MessageType, ErrorCode, HttpStatus, HttpStatusText, Messages, DefaultTimeout, ProtocolVersion, formatMessage, MessageRole, StreamType as StreamTypeConstant } from '../constants';
+import { isPromise } from '../utils';
+import { IframeReadableStream, IframeFileReadableStream } from '../stream';
+
+/**
+ * Middleware item (contains path matcher and middleware function)
+ */
+
+/**
+ * Pending acknowledgment
+ */
+
+/** Pending request waiting for client stream (streamId present) */
+
+/**
+ * Server configuration options
+ */
+
+/**
+ * RequestIframeServer implementation
+ * Uses shared MessageDispatcher (backed by MessageChannel) to listen for and send messages
+ */
+export class RequestIframeServerImpl {
+  constructor(options) {
+    var _options$ackTimeout, _options$versionValid, _options$maxConcurren;
+    /** Unique instance ID */
+    _defineProperty(this, "handlers", new Map());
+    _defineProperty(this, "middlewares", []);
+    _defineProperty(this, "inFlightByClientKey", new Map());
+    /** Responses waiting for client acknowledgment */
+    _defineProperty(this, "pendingAcks", new Map());
+    /** Pending pings waiting for client PONG (server -> client heartbeat) */
+    _defineProperty(this, "pendingPongs", new Map());
+    /** Pending requests waiting for client stream_start (streamId present) */
+    _defineProperty(this, "pendingStreamRequests", new Map());
+    /** Stream message handlers (streamId -> handler) for client→server streams */
+    _defineProperty(this, "streamHandlers", new Map());
+    /** List of functions to unregister handlers */
+    _defineProperty(this, "unregisterFns", []);
+    /** Whether it is open */
+    _defineProperty(this, "_isOpen", false);
+    // Use custom id if provided, otherwise generate one
+    this.id = (options === null || options === void 0 ? void 0 : options.id) || generateInstanceId();
+    this.ackTimeout = (_options$ackTimeout = options === null || options === void 0 ? void 0 : options.ackTimeout) !== null && _options$ackTimeout !== void 0 ? _options$ackTimeout : DefaultTimeout.ACK;
+    this.versionValidator = (_options$versionValid = options === null || options === void 0 ? void 0 : options.versionValidator) !== null && _options$versionValid !== void 0 ? _options$versionValid : isCompatibleVersion;
+    this.maxConcurrentRequestsPerClient = (_options$maxConcurren = options === null || options === void 0 ? void 0 : options.maxConcurrentRequestsPerClient) !== null && _options$maxConcurren !== void 0 ? _options$maxConcurren : Number.POSITIVE_INFINITY;
+
+    // Build origin validator (incoming messages)
+    if (options !== null && options !== void 0 && options.validateOrigin) {
+      this.originValidator = (origin, data, context) => options.validateOrigin(origin, data, context);
+    } else if (options !== null && options !== void 0 && options.allowedOrigins) {
+      var matcher = options.allowedOrigins;
+      this.originValidator = origin => matchOrigin(origin, matcher);
+    }
+
+    // Get or create shared channel and create dispatcher
+    var channel = getOrCreateMessageChannel(options === null || options === void 0 ? void 0 : options.secretKey);
+    this.dispatcher = new MessageDispatcher(channel, MessageRole.SERVER, this.id);
+
+    // Auto-open by default (unless explicitly set to false)
+    if ((options === null || options === void 0 ? void 0 : options.autoOpen) !== false) {
+      this.open();
+    }
+  }
+
+  /**
+   * Check whether an incoming message origin is allowed.
+   */
+  isOriginAllowed(data, context) {
+    if (!this.originValidator) return true;
+    try {
+      return this.originValidator(context.origin, data, context);
+    } catch (_unused) {
+      return false;
+    }
+  }
+
+  /**
+   * Build a per-client key used for concurrency limiting.
+   * We intentionally include origin to prevent cross-origin collisions.
+   */
+  getClientKey(origin, creatorId) {
+    return `${origin}::${creatorId || 'unknown'}`;
+  }
+  incInFlight(clientKey) {
+    var current = this.inFlightByClientKey.get(clientKey) || 0;
+    this.inFlightByClientKey.set(clientKey, current + 1);
+  }
+  decInFlight(clientKey) {
+    var current = this.inFlightByClientKey.get(clientKey) || 0;
+    var next = current - 1;
+    if (next <= 0) {
+      this.inFlightByClientKey.delete(clientKey);
+      return;
+    }
+    this.inFlightByClientKey.set(clientKey, next);
+  }
+
+  /**
+   * Open message processing (register message handlers)
+   */
+  open() {
+    if (this._isOpen) return;
+    this._isOpen = true;
+    this.registerHandlers();
+  }
+
+  /**
+   * Close message processing (unregister message handlers, but don't release channel)
+   */
+  close() {
+    if (!this._isOpen) return;
+    this._isOpen = false;
+
+    // Unregister all handlers
+    this.unregisterFns.forEach(fn => fn());
+    this.unregisterFns.length = 0;
+  }
+
+  /**
+   * Whether it is open
+   */
+  get isOpen() {
+    return this._isOpen;
+  }
+
+  /**
+   * Register message handlers
+   */
+  registerHandlers() {
+    var handlerOptions = {
+      versionValidator: this.versionValidator,
+      onVersionError: this.handleVersionError.bind(this)
+    };
+
+    // Handle REQUEST messages
+    this.unregisterFns.push(this.dispatcher.registerHandler(MessageType.REQUEST, (data, context) => this.handleRequest(data, context), handlerOptions));
+
+    // Handle PING messages
+    this.unregisterFns.push(this.dispatcher.registerHandler(MessageType.PING, (data, context) => this.handlePing(data, context), handlerOptions));
+
+    // Handle PONG messages (server -> client heartbeat)
+    this.unregisterFns.push(this.dispatcher.registerHandler(MessageType.PONG, (data, context) => this.handlePong(data, context), handlerOptions));
+
+    // Handle RECEIVED messages (for confirming response delivery)
+    this.unregisterFns.push(this.dispatcher.registerHandler(MessageType.RECEIVED, (data, context) => this.handleReceived(data, context), handlerOptions));
+
+    // Handle stream_* messages (client→server stream)
+    this.unregisterFns.push(this.dispatcher.registerHandler(MessageType.STREAM_START, (data, ctx) => this.handleStreamStart(data, ctx), handlerOptions));
+    this.unregisterFns.push(this.dispatcher.registerHandler(type => type.startsWith('stream_') && type !== MessageType.STREAM_START, (data, context) => this.dispatchStreamMessage(data, context), handlerOptions));
+  }
+
+  /** Handle stream_start from client (stream request with streamId) */
+  handleStreamStart(data, context) {
+    var _body$chunked;
+    if (data.role !== MessageRole.CLIENT) return;
+    if (!this.isOriginAllowed(data, context)) return;
+    var body = data.body;
+    if (!(body !== null && body !== void 0 && body.streamId)) return;
+    var pending = this.pendingStreamRequests.get(data.requestId);
+    if (!pending || pending.streamId !== body.streamId) return;
+    clearTimeout(pending.timeoutId);
+    this.pendingStreamRequests.delete(data.requestId);
+    var targetWindow = pending.targetWindow,
+      targetOrigin = pending.targetOrigin,
+      res = pending.res,
+      reqData = pending.data,
+      reqContext = pending.context,
+      handlerFn = pending.handlerFn;
+    var streamHandler = {
+      registerStreamHandler: (streamId, handler) => {
+        this.streamHandlers.set(streamId, handler);
+      },
+      unregisterStreamHandler: streamId => {
+        this.streamHandlers.delete(streamId);
+      },
+      postMessage: message => {
+        this.dispatcher.send(targetWindow, message, targetOrigin);
+      }
+    };
+    var streamType = body.type || StreamTypeConstant.DATA;
+    var streamMode = body.mode;
+    var streamChunked = (_body$chunked = body.chunked) !== null && _body$chunked !== void 0 ? _body$chunked : true;
+    var streamMetadata = body.metadata;
+    var req = new ServerRequestImpl(reqData, reqContext, res, pending.params);
+
+    // File stream: optionally auto-resolve to File/Blob before calling handler
+    if (streamType === StreamTypeConstant.FILE) {
+      var _body$autoResolve;
+      var fileStream = new IframeFileReadableStream(body.streamId, data.requestId, streamHandler, {
+        chunked: streamChunked,
+        metadata: streamMetadata,
+        secretKey: data.secretKey,
+        mode: streamMode,
+        filename: streamMetadata === null || streamMetadata === void 0 ? void 0 : streamMetadata.filename,
+        mimeType: streamMetadata === null || streamMetadata === void 0 ? void 0 : streamMetadata.mimeType,
+        size: streamMetadata === null || streamMetadata === void 0 ? void 0 : streamMetadata.size
+      });
+      var autoResolve = (_body$autoResolve = body.autoResolve) !== null && _body$autoResolve !== void 0 ? _body$autoResolve : false;
+      if (autoResolve) {
+        var name = fileStream.filename || (streamMetadata === null || streamMetadata === void 0 ? void 0 : streamMetadata.filename);
+        var promise = name ? fileStream.readAsFile(name) : fileStream.readAsBlob();
+        promise.then(fileData => {
+          req.body = fileData;
+          req.stream = undefined;
+          this.runMiddlewares(req, res, () => {
+            try {
+              var result = handlerFn(req, res);
+              if (isPromise(result)) {
+                // Window check is handled in MessageDispatcher
+                this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ASYNC, data.requestId, {
+                  path: reqData.path,
+                  targetId: data.creatorId
+                });
+                result.then(this.handleRequestResult.bind(this, res, targetWindow, targetOrigin, reqData)).catch(this.handleRequestError.bind(this, res, targetWindow, targetOrigin, reqData));
+              } else {
+                this.handleRequestResult(res, targetWindow, targetOrigin, reqData, result);
+              }
+            } catch (error) {
+              this.handleRequestError(res, targetWindow, targetOrigin, reqData, error);
+            }
+          });
+        }).catch(error => {
+          this.handleRequestError(res, targetWindow, targetOrigin, reqData, error);
+        });
+        return;
+      }
+
+      // Non-autoResolve: expose stream directly
+      req.body = fileStream;
+      req.stream = fileStream;
+    } else {
+      // Non-file stream
+      var readableStream = new IframeReadableStream(body.streamId, data.requestId, streamHandler, {
+        type: streamType,
+        mode: streamMode,
+        chunked: streamChunked,
+        metadata: streamMetadata,
+        secretKey: data.secretKey
+      });
+      req.body = undefined;
+      req.stream = readableStream;
+    }
+    this.runMiddlewares(req, res, () => {
+      try {
+        var result = handlerFn(req, res);
+        if (isPromise(result)) {
+          // Window check is handled in MessageDispatcher
+          this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ASYNC, data.requestId, {
+            path: reqData.path,
+            targetId: data.creatorId
+          });
+          result.then(this.handleRequestResult.bind(this, res, targetWindow, targetOrigin, reqData)).catch(this.handleRequestError.bind(this, res, targetWindow, targetOrigin, reqData));
+        } else {
+          this.handleRequestResult(res, targetWindow, targetOrigin, reqData, result);
+        }
+      } catch (error) {
+        this.handleRequestError(res, targetWindow, targetOrigin, reqData, error);
+      }
+    });
+  }
+  dispatchStreamMessage(data, context) {
+    if (!this.isOriginAllowed(data, context)) return;
+    var body = data.body;
+    if (!(body !== null && body !== void 0 && body.streamId)) return;
+    var handler = this.streamHandlers.get(body.streamId);
+    if (handler) {
+      var messageType = data.type.replace('stream_', '');
+      handler(_objectSpread(_objectSpread({}, body), {}, {
+        type: messageType
+      }));
+    }
+  }
+
+  /**
+   * Handle protocol version error
+   */
+  handleVersionError(data, context, version) {
+    if (!context.source) return;
+
+    // Send protocol version incompatibility error
+    // Window check is handled in MessageDispatcher
+    this.dispatcher.sendMessage(context.source, context.origin, MessageType.ERROR, data.requestId, {
+      path: data.path,
+      status: HttpStatus.BAD_REQUEST,
+      statusText: Messages.PROTOCOL_VERSION_UNSUPPORTED,
+      error: {
+        message: formatMessage(Messages.PROTOCOL_VERSION_TOO_LOW, version, ProtocolVersion.MIN_SUPPORTED),
+        code: ErrorCode.PROTOCOL_UNSUPPORTED
+      }
+    });
+  }
+
+  /**
+   * Handle ping message
+   */
+  handlePing(data, context) {
+    if (!context.source) return;
+    if (!this.isOriginAllowed(data, context)) return;
+
+    /**
+     * Only allow one server instance to respond.
+     * This is important when multiple server instances share the same channel.
+     */
+    if (!context.handledBy) {
+      // Mark as accepted so MessageDispatcher can auto-send ACK when requireAck === true
+      context.accepted = true;
+      context.handledBy = this.id;
+    }
+
+    // Window check is handled in MessageDispatcher
+    this.dispatcher.sendMessage(context.source, context.origin, MessageType.PONG, data.requestId);
+  }
+  handlePong(data, context) {
+    if (!this.isOriginAllowed(data, context)) return;
+    var pending = this.pendingPongs.get(data.requestId);
+    if (pending) {
+      if (!context.handledBy) {
+        context.accepted = true;
+        context.handledBy = this.id;
+      }
+      clearTimeout(pending.timeoutId);
+      this.pendingPongs.delete(data.requestId);
+      pending.resolve(true);
+    }
+  }
+  pingClient(targetWindow, targetOrigin, targetClientId) {
+    var requestId = generateRequestId();
+    return new Promise(resolve => {
+      var timeoutId = setTimeout(() => {
+        this.pendingPongs.delete(requestId);
+        resolve(false);
+      }, this.ackTimeout);
+      this.pendingPongs.set(requestId, {
+        resolve,
+        timeoutId
+      });
+      // Window check is handled in MessageDispatcher
+      this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.PING, requestId, {
+        requireAck: true,
+        targetId: targetClientId
+      });
+    });
+  }
+
+  /**
+   * Handle received acknowledgment
+   */
+  handleReceived(data, context) {
+    if (!this.isOriginAllowed(data, context)) return;
+    var pending = this.pendingAcks.get(data.requestId);
+    if (pending) {
+      // Best-effort: prevent other server instances from also resolving
+      if (!context.handledBy) {
+        context.handledBy = this.id;
+      }
+      clearTimeout(pending.timeoutId);
+      this.pendingAcks.delete(data.requestId);
+      pending.resolve(true, data.ackMeta);
+    }
+  }
+
+  /** Get secretKey */
+  get secretKey() {
+    return this.dispatcher.secretKey;
+  }
+
+  /** Get the underlying MessageDispatcher */
+  get messageDispatcher() {
+    return this.dispatcher;
+  }
+  handleRequestError(res, targetWindow, targetOrigin, data, err) {
+    if (!res._sent) {
+      res._markSent();
+      /** 
+       * Use INTERNAL_SERVER_ERROR (500) for handler errors unless a different error status code was explicitly set.
+       * If statusCode is still the default OK (200), override it to INTERNAL_SERVER_ERROR.
+       */
+      var errorStatus = res.statusCode === HttpStatus.OK ? HttpStatus.INTERNAL_SERVER_ERROR : res.statusCode;
+
+      // Window check is handled in MessageDispatcher
+      this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ERROR, data.requestId, {
+        path: data.path,
+        error: {
+          message: err && err.message || Messages.REQUEST_FAILED,
+          code: err && err.code || ErrorCode.REQUEST_ERROR
+        },
+        status: errorStatus,
+        statusText: HttpStatusText[errorStatus] || HttpStatusText[HttpStatus.INTERNAL_SERVER_ERROR],
+        headers: res.headers,
+        targetId: data.creatorId
+      });
+    }
+  }
+  handleRequestResult(res, targetWindow, targetOrigin, data, result) {
+    if (!res._sent && result !== undefined) {
+      res.send(result);
+    } else if (!res._sent) {
+      res._markSent();
+      this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ERROR, data.requestId, {
+        path: data.path,
+        error: {
+          message: Messages.NO_RESPONSE_SENT,
+          code: ErrorCode.NO_RESPONSE
+        },
+        status: HttpStatus.INTERNAL_SERVER_ERROR,
+        statusText: HttpStatusText[HttpStatus.INTERNAL_SERVER_ERROR],
+        headers: res.headers
+      });
+    }
+  }
+
+  /**
+   * Find matching handler and extract path parameters
+   * @param requestPath The actual request path
+   * @returns Handler function and extracted parameters, or null if not found
+   */
+  findHandler(requestPath) {
+    var prefixedRequestPath = this.dispatcher.prefixPath(requestPath);
+
+    // First try exact match (for backward compatibility and performance)
+    var exactHandler = this.handlers.get(prefixedRequestPath);
+    if (exactHandler) {
+      return {
+        handler: exactHandler,
+        params: {}
+      };
+    }
+
+    // Then try parameter matching (e.g., '/api/users/:id' matches '/api/users/123')
+    var _iterator = _createForOfIteratorHelper(this.handlers.entries()),
+      _step;
+    try {
+      for (_iterator.s(); !(_step = _iterator.n()).done;) {
+        var _step$value = _slicedToArray(_step.value, 2),
+          registeredPath = _step$value[0],
+          handler = _step$value[1];
+        // Check if registered path contains parameters
+        if (registeredPath.includes(':')) {
+          var matchResult = matchPathWithParams(prefixedRequestPath, registeredPath);
+          if (matchResult.match) {
+            return {
+              handler,
+              params: matchResult.params
+            };
+          }
+        }
+      }
+    } catch (err) {
+      _iterator.e(err);
+    } finally {
+      _iterator.f();
+    }
+    return null;
+  }
+
+  /**
+   * Handle request
+   */
+  handleRequest(data, context) {
+    // If targetId is specified, only process if it matches this server's id
+    if (!data.path || data.targetId && data.targetId !== this.id) return;
+    if (!context.source) return;
+    if (!this.isOriginAllowed(data, context)) return;
+
+    // If message has already been handled by another server instance, skip processing
+    if (context.handledBy) {
+      return;
+    }
+    var targetWindow = context.source;
+    var targetOrigin = context.origin;
+
+    // Find matching handler and extract path parameters
+    var handlerMatch = this.findHandler(data.path);
+    if (!handlerMatch) {
+      // No handler found in this instance
+      // Mark as handled by this instance (using special marker) to prevent other instances from processing
+      // This ensures only one instance sends the error response
+      context.handledBy = this.id;
+
+      // Send METHOD_NOT_FOUND error
+      // Use request's creatorId as targetId to route back to the correct client
+      // Window check is handled in MessageDispatcher
+      this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ERROR, data.requestId, {
+        path: data.path,
+        error: {
+          message: Messages.METHOD_NOT_FOUND,
+          code: ErrorCode.METHOD_NOT_FOUND
+        },
+        status: HttpStatus.NOT_FOUND,
+        statusText: HttpStatusText[HttpStatus.NOT_FOUND],
+        targetId: data.creatorId
+      });
+      return;
+    }
+    var handlerFn = handlerMatch.handler,
+      params = handlerMatch.params;
+    var clientKey = this.getClientKey(targetOrigin, data.creatorId);
+    if (Number.isFinite(this.maxConcurrentRequestsPerClient)) {
+      var inFlight = this.inFlightByClientKey.get(clientKey) || 0;
+      if (inFlight >= this.maxConcurrentRequestsPerClient) {
+        // Prevent other server instances from also responding
+        context.handledBy = this.id;
+        this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ERROR, data.requestId, {
+          path: data.path,
+          error: {
+            message: formatMessage(Messages.TOO_MANY_REQUESTS, this.maxConcurrentRequestsPerClient),
+            code: ErrorCode.TOO_MANY_REQUESTS
+          },
+          status: HttpStatus.TOO_MANY_REQUESTS,
+          statusText: HttpStatusText[HttpStatus.TOO_MANY_REQUESTS],
+          requireAck: data.requireAck,
+          ackMeta: data.ackMeta,
+          targetId: data.creatorId
+        });
+        return;
+      }
+    }
+    this.incInFlight(clientKey);
+
+    // Mark as accepted so MessageDispatcher can auto-send ACK (delivery confirmation)
+    context.accepted = true;
+
+    // Mark message as handled by this server instance to prevent other server instances from processing it
+    context.handledBy = this.id;
+
+    // Create response object with channel reference
+    // Pass request's creatorId as targetId so responses are routed back to the correct client
+    var res = new ServerResponseImpl(data.requestId, data.path || '', data.secretKey, targetWindow, targetOrigin, this.dispatcher.getChannel(), this.id, data.creatorId, {
+      registerStreamHandler: (streamId, handler) => {
+        this.streamHandlers.set(streamId, handler);
+      },
+      unregisterStreamHandler: streamId => {
+        this.streamHandlers.delete(streamId);
+      },
+      heartbeat: () => this.pingClient(targetWindow, targetOrigin, data.creatorId),
+      onSent: () => this.decInFlight(clientKey)
+    });
+
+    // Register callback waiting for client acknowledgment
+    this.registerPendingAck(data.requestId, (received, ackMeta) => {
+      res._triggerAck(received, ackMeta);
+    }, () => {
+      res._triggerAck(false);
+    });
+
+    // Client sends body as stream: wait for stream_start, then create readable stream and call handler
+    // If streamId is present, this is a stream request
+    var streamId = data.streamId;
+    if (streamId) {
+      var streamStartTimeout = this.ackTimeout;
+      var timeoutId = setTimeout(() => {
+        var pending = this.pendingStreamRequests.get(data.requestId);
+        if (!pending) return;
+        this.pendingStreamRequests.delete(data.requestId);
+        if (!pending.res._sent) {
+          pending.res._markSent();
+          this.dispatcher.sendMessage(pending.targetWindow, pending.targetOrigin, MessageType.ERROR, pending.requestId, {
+            path: pending.path,
+            error: {
+              message: formatMessage(Messages.STREAM_START_TIMEOUT, streamStartTimeout),
+              code: ErrorCode.STREAM_START_TIMEOUT
+            },
+            status: HttpStatus.REQUEST_TIMEOUT,
+            statusText: HttpStatusText[HttpStatus.REQUEST_TIMEOUT],
+            requireAck: pending.data.requireAck,
+            ackMeta: pending.data.ackMeta,
+            targetId: pending.data.creatorId
+          });
+        }
+      }, streamStartTimeout);
+      this.pendingStreamRequests.set(data.requestId, {
+        path: data.path || '',
+        requestId: data.requestId,
+        streamId,
+        timeoutId,
+        handlerFn,
+        targetWindow,
+        targetOrigin,
+        res,
+        data,
+        context,
+        params
+      });
+      return;
+    }
+
+    // Create request object with path parameters
+    var req = new ServerRequestImpl(data, context, res, params);
+
+    // Execute middleware chain
+    this.runMiddlewares(req, res, () => {
+      try {
+        var result = handlerFn(req, res);
+        if (isPromise(result)) {
+          // Async task
+          // Window check is handled in MessageDispatcher
+          // Use request's creatorId as targetId to route back to the correct client
+          this.dispatcher.sendMessage(targetWindow, targetOrigin, MessageType.ASYNC, data.requestId, {
+            path: data.path,
+            targetId: data.creatorId
+          });
+          result.then(this.handleRequestResult.bind(this, res, targetWindow, targetOrigin, data)).catch(this.handleRequestError.bind(this, res, targetWindow, targetOrigin, data));
+        } else {
+          // Synchronous processing
+          this.handleRequestResult(res, targetWindow, targetOrigin, data, result);
+        }
+      } catch (error) {
+        this.handleRequestError(res, targetWindow, targetOrigin, data, error);
+      }
+    });
+  }
+
+  /**
+   * Register pending acknowledgment response
+   */
+  registerPendingAck(requestId, resolve, reject) {
+    var timeoutId = setTimeout(() => {
+      this.pendingAcks.delete(requestId);
+      resolve(false);
+    }, this.ackTimeout);
+    this.pendingAcks.set(requestId, {
+      resolve,
+      reject,
+      timeoutId
+    });
+  }
+  use(pathOrMiddleware, middleware) {
+    if (typeof pathOrMiddleware === 'function') {
+      this.middlewares.push({
+        matcher: null,
+        middleware: pathOrMiddleware
+      });
+    } else if (middleware) {
+      this.middlewares.push({
+        matcher: pathOrMiddleware,
+        middleware
+      });
+    }
+  }
+  on(path, handler) {
+    var prefixedPath = this.dispatcher.prefixPath(path);
+    this.handlers.set(prefixedPath, handler);
+
+    // Return unregister function
+    return () => {
+      this.handlers.delete(prefixedPath);
+    };
+  }
+  runMiddlewares(req, res, finalHandler) {
+    var path = req.path;
+    var index = 0;
+    var next = () => {
+      if (res._sent) {
+        return;
+      }
+      while (index < this.middlewares.length) {
+        var item = this.middlewares[index++];
+        if (item.matcher === null || matchPath(path, item.matcher)) {
+          try {
+            var result = item.middleware(req, res, next);
+            if (result instanceof Promise) {
+              result.catch(err => {
+                if (!res._sent) {
+                  res.status(HttpStatus.INTERNAL_SERVER_ERROR).send({
+                    error: err.message || Messages.MIDDLEWARE_ERROR
+                  });
+                }
+              });
+            }
+            return;
+          } catch (err) {
+            if (!res._sent) {
+              res.status(HttpStatus.INTERNAL_SERVER_ERROR).send({
+                error: (err === null || err === void 0 ? void 0 : err.message) || Messages.MIDDLEWARE_ERROR
+              });
+            }
+            return;
+          }
+        }
+      }
+      if (index >= this.middlewares.length) {
+        finalHandler();
+      }
+    };
+    next();
+  }
+  off(path) {
+    if (Array.isArray(path)) {
+      // Batch unregister
+      path.forEach(p => {
+        this.handlers.delete(this.dispatcher.prefixPath(p));
+      });
+    } else {
+      // Single unregister
+      this.handlers.delete(this.dispatcher.prefixPath(path));
+    }
+  }
+  map(handlers) {
+    var unregisterFns = [];
+    Object.entries(handlers).forEach(([path, h]) => {
+      unregisterFns.push(this.on(path, h));
+    });
+    return () => {
+      unregisterFns.forEach(fn => fn());
+    };
+  }
+
+  /**
+   * Destroy (close and release channel reference)
+   */
+  destroy() {
+    // Close first
+    this.close();
+
+    // Clean up pending
+    this.pendingAcks.forEach(pending => clearTimeout(pending.timeoutId));
+    this.pendingAcks.clear();
+    this.pendingPongs.forEach(pending => clearTimeout(pending.timeoutId));
+    this.pendingPongs.clear();
+    this.pendingStreamRequests.forEach(pending => clearTimeout(pending.timeoutId));
+    this.pendingStreamRequests.clear();
+    this.inFlightByClientKey.clear();
+
+    // Clean up handlers
+    this.handlers.clear();
+    this.middlewares.length = 0;
+    this.streamHandlers.clear();
+
+    // Destroy dispatcher and release channel reference
+    this.dispatcher.destroy();
+    releaseMessageChannel(this.dispatcher.getChannel());
+  }
+}