request-iframe 0.2.1 → 0.2.2

package/cdn/request-iframe.umd.js

@@ -1574,11 +1574,11 @@
 		return objectGetOwnPropertySymbols;
 	}
 
-	var ownKeys$d;
+	var ownKeys$e;
 	var hasRequiredOwnKeys;
 
 	function requireOwnKeys () {
-		if (hasRequiredOwnKeys) return ownKeys$d;
+		if (hasRequiredOwnKeys) return ownKeys$e;
 		hasRequiredOwnKeys = 1;
 		var getBuiltIn = requireGetBuiltIn();
 		var uncurryThis = requireFunctionUncurryThis();
@@ -1589,12 +1589,12 @@
 		var concat = uncurryThis([].concat);
 
 		// all object keys, includes non-enumerable and symbols
-		ownKeys$d = getBuiltIn('Reflect', 'ownKeys') || function ownKeys(it) {
+		ownKeys$e = getBuiltIn('Reflect', 'ownKeys') || function ownKeys(it) {
 		  var keys = getOwnPropertyNamesModule.f(anObject(it));
 		  var getOwnPropertySymbols = getOwnPropertySymbolsModule.f;
 		  return getOwnPropertySymbols ? concat(keys, getOwnPropertySymbols(it)) : keys;
 		};
-		return ownKeys$d;
+		return ownKeys$e;
 	}
 
 	var copyConstructorProperties;
@@ -5885,8 +5885,8 @@
 
 	requireEs_string_replace();
 
-	function ownKeys$c(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$c(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$c(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$c(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$d(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$d(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$d(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$d(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 	/**
 	 * Message constants (for multi-language support)
 	 * 
@@ -5987,7 +5987,7 @@
 	/**
 	 * Current message configuration
 	 */
-	var currentMessages = _objectSpread$c({}, defaultMessages);
+	var currentMessages = _objectSpread$d({}, defaultMessages);
 
 	/**
 	 * Message constants object
@@ -6003,14 +6003,14 @@
 	 * @param messages Custom message content (partial or full)
 	 */
 	function setMessages(messages) {
-	  currentMessages = _objectSpread$c(_objectSpread$c({}, defaultMessages), messages);
+	  currentMessages = _objectSpread$d(_objectSpread$d({}, defaultMessages), messages);
 	}
 
 	/**
 	 * Reset to default messages
 	 */
 	function resetMessages() {
-	  currentMessages = _objectSpread$c({}, defaultMessages);
+	  currentMessages = _objectSpread$d({}, defaultMessages);
 	}
 
 	/**
@@ -6037,7 +6037,7 @@
 	 * Get current message configuration
 	 */
 	function getMessages() {
-	  return _objectSpread$c({}, currentMessages);
+	  return _objectSpread$d({}, currentMessages);
 	}
 
 	var es_array_map = {};
@@ -6074,7 +6074,13 @@
 
 	var WarnOnceKey = {
 	  INBOX_MISSING_PENDING_WHEN_CLOSED: 'inbox:missingPendingWhenClosed',
-	  SERVER_MISSING_PENDING_WHEN_CLOSED: 'server:missingPendingWhenClosed'
+	  SERVER_MISSING_PENDING_WHEN_CLOSED: 'server:missingPendingWhenClosed',
+	  /**
+	   * Security warning:
+	   * - targetOrigin is '*'
+	   * - and no allowedOrigins/validateOrigin is configured
+	   */
+	  TARGET_ORIGIN_ANY_WITHOUT_ORIGIN_VALIDATION: 'targetOrigin:anyWithoutOriginValidation'
 	};
 	function buildWarnOnceKey(prefix, ...parts) {
 	  if (!parts.length) return prefix;
@@ -9037,8 +9043,8 @@
 
 	requireEs_set();
 
-	function ownKeys$b(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$b(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$b(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$b(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$c(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$c(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$c(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$c(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Create PostMessage data
@@ -9048,7 +9054,7 @@
 	 * @returns PostMessageData
 	 */
 	function createPostMessage(type, requestId, data) {
-	  return _objectSpread$b({
+	  return _objectSpread$c({
 	    __requestIframe__: ProtocolVersion.CURRENT,
 	    timestamp: Date.now(),
 	    type,
@@ -9129,6 +9135,65 @@
 	  }
 	}
 
+	var esnext_globalThis = {};
+
+	var es_globalThis = {};
+
+	var hasRequiredEs_globalThis;
+
+	function requireEs_globalThis () {
+		if (hasRequiredEs_globalThis) return es_globalThis;
+		hasRequiredEs_globalThis = 1;
+		var $ = require_export();
+		var globalThis = requireGlobalThis();
+
+		// `globalThis` object
+		// https://tc39.es/ecma262/#sec-globalthis
+		$({ global: true, forced: globalThis.globalThis !== globalThis }, {
+		  globalThis: globalThis
+		});
+		return es_globalThis;
+	}
+
+	var hasRequiredEsnext_globalThis;
+
+	function requireEsnext_globalThis () {
+		if (hasRequiredEsnext_globalThis) return esnext_globalThis;
+		hasRequiredEsnext_globalThis = 1;
+		// TODO: Remove from `core-js@4`
+		requireEs_globalThis();
+		return esnext_globalThis;
+	}
+
+	requireEsnext_globalThis();
+
+	/**
+	 * A simple global warn-once helper.
+	 *
+	 * Why:
+	 * - Some warnings need to fire before a hub/client/server instance exists (e.g. api factory functions).
+	 * - We use Symbol.for() so multiple bundles/versions can share the same dedupe storage.
+	 */
+
+	var WARN_ONCE_SYMBOL = Symbol.for('__requestIframeWarnOnce__');
+	function getHost() {
+	  if (typeof window !== 'undefined') return window;
+	  return globalThis;
+	}
+	function getWarnOnceSet() {
+	  var host = getHost();
+	  if (!(WARN_ONCE_SYMBOL in host)) {
+	    host[WARN_ONCE_SYMBOL] = new Set();
+	  }
+	  return host[WARN_ONCE_SYMBOL];
+	}
+	function warnOnce(key, fn) {
+	  var set = getWarnOnceSet();
+	  if (set.has(key)) return;
+	  set.add(key);
+	  fn();
+	}
+
 	/**
 	 * Built-in leveled logger for request-iframe.
 	 *
@@ -9145,6 +9210,9 @@
 	  [LogLevel.SILENT]: 100
 	};
 	var currentLevel = LogLevel.WARN;
+	function getRequestIframeLogLevel() {
+	  return currentLevel;
+	}
 	function setRequestIframeLogLevel(level) {
 	  currentLevel = level;
 	}
@@ -9180,6 +9248,37 @@
 	  }
 	}
 
+	/**
+	 * Unified logger facade.
+	 *
+	 * Notes:
+	 * - This is a thin wrapper around existing functions (kept for backward compatibility).
+	 * - `once()` is useful for configuration/security hints to avoid noisy logs.
+	 */
+	var logger = {
+	  getLevel: getRequestIframeLogLevel,
+	  setLevel: setRequestIframeLogLevel,
+	  ensureLevel: ensureRequestIframeLogLevel,
+	  trace(message, data) {
+	    requestIframeLog(LogLevel.TRACE, message, data);
+	  },
+	  info(message, data) {
+	    requestIframeLog(LogLevel.INFO, message, data);
+	  },
+	  warn(message, data) {
+	    requestIframeLog(LogLevel.WARN, message, data);
+	  },
+	  error(message, data) {
+	    requestIframeLog(LogLevel.ERROR, message, data);
+	  },
+	  /**
+	   * Log once by key (deduped across bundles/versions).
+	   */
+	  once(level, key, message, data) {
+	    warnOnce(key, () => requestIframeLog(level, message, data));
+	  }
+	};
+
 	var es_array_indexOf = {};
 
 	var hasRequiredEs_array_indexOf;
@@ -9370,8 +9469,8 @@
 	  }
 	}
 
-	function ownKeys$a(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$a(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$a(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$a(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$b(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$b(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$b(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$b(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Message context (extracted from MessageEvent, transport-agnostic)
@@ -9588,10 +9687,22 @@
 	   * @param message message data (already formatted as PostMessageData)
 	   * @param targetOrigin target origin (defaults to '*')
 	   */
-	  send(target, message, targetOrigin = OriginConstant.ANY) {
+	  send(target, message, targetOrigin = OriginConstant.ANY, transfer) {
 	    if (!isWindowAvailable(target)) {
 	      return false;
 	    }
+	    /**
+	     * Prefer transferable objects when provided.
+	     * Use a try/catch fallback for environments that don't support the 3rd arg signature.
+	     */
+	    if (transfer && transfer.length) {
+	      try {
+	        target.postMessage(message, targetOrigin, transfer);
+	        return true;
+	      } catch (_unused) {
+	        /** fall through to 2-arg postMessage */
+	      }
+	    }
 	    target.postMessage(message, targetOrigin);
 	    return true;
 	  }
@@ -9604,11 +9715,11 @@
 	   * @param requestId request ID
 	   * @param data additional data
 	   */
-	  sendMessage(target, targetOrigin, type, requestId, data) {
-	    var message = createPostMessage(type, requestId, _objectSpread$a(_objectSpread$a({}, data), {}, {
+	  sendMessage(target, targetOrigin, type, requestId, data, transfer) {
+	    var message = createPostMessage(type, requestId, _objectSpread$b(_objectSpread$b({}, data), {}, {
 	      secretKey: this.secretKey
 	    }));
-	    return this.send(target, message, targetOrigin);
+	    return this.send(target, message, targetOrigin, transfer);
 	  }
 
 	  /**
@@ -10068,8 +10179,8 @@
 	  return expectedId === receivedId;
 	}
 
-	function ownKeys$9(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$9(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$9(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$9(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$a(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$a(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$a(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$a(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 	function _createForOfIteratorHelper$4(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$4(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
 	function _unsupportedIterableToArray$4(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$4(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$4(r, a) : void 0; } }
 	function _arrayLikeToArray$4(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
@@ -10472,7 +10583,7 @@
 	  sendMessage(target, targetOrigin, type, requestId, data) {
 	    // Automatically set role, creatorId, and secretKey based on dispatcher's properties
 	    // Create message with role, creatorId, and secretKey using createPostMessage directly
-	    var message = createPostMessage(type, requestId, _objectSpread$9(_objectSpread$9({}, data), {}, {
+	    var message = createPostMessage(type, requestId, _objectSpread$a(_objectSpread$a({}, data), {}, {
 	      role: this.role,
 	      creatorId: this.instanceId,
 	      secretKey: this.secretKey
@@ -10505,38 +10616,6 @@
 	  }
 	}
 
-	var esnext_globalThis = {};
-
-	var es_globalThis = {};
-
-	var hasRequiredEs_globalThis;
-
-	function requireEs_globalThis () {
-		if (hasRequiredEs_globalThis) return es_globalThis;
-		hasRequiredEs_globalThis = 1;
-		var $ = require_export();
-		var globalThis = requireGlobalThis();
-
-		// `globalThis` object
-		// https://tc39.es/ecma262/#sec-globalthis
-		$({ global: true, forced: globalThis.globalThis !== globalThis }, {
-		  globalThis: globalThis
-		});
-		return es_globalThis;
-	}
-
-	var hasRequiredEsnext_globalThis;
-
-	function requireEsnext_globalThis () {
-		if (hasRequiredEsnext_globalThis) return esnext_globalThis;
-		hasRequiredEsnext_globalThis = 1;
-		// TODO: Remove from `core-js@4`
-		requireEs_globalThis();
-		return esnext_globalThis;
-	}
-
-	requireEsnext_globalThis();
-
 	/**
 	 * Global cache Symbol (used to store MessageChannel instance cache on window/globalThis).
 	 *
@@ -10915,8 +10994,8 @@
 	  }
 	}
 
-	function ownKeys$8(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$8(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$8(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$8(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$9(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$9(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$9(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$9(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Generate a unique stream ID
@@ -10991,7 +11070,7 @@
 	        });
 	      }
 	    }
-	    this.pendingQueue.push(_objectSpread$8(_objectSpread$8({}, item), {}, {
+	    this.pendingQueue.push(_objectSpread$9(_objectSpread$9({}, item), {}, {
 	      bytes
 	    }));
 	    this.pendingBytes += bytes;
@@ -11190,14 +11269,31 @@
 	    var creatorId = (_this$context$serverI = this.context.serverId) !== null && _this$context$serverI !== void 0 ? _this$context$serverI : this.context.clientId;
 	    var message = createPostMessage(type, this.context.requestId, {
 	      secretKey: this.context.secretKey,
-	      body: _objectSpread$8({
+	      body: _objectSpread$9({
 	        streamId: this.streamId
 	      }, data),
 	      role,
 	      creatorId,
 	      targetId: this.context.targetId
 	    });
-	    var ok = this.context.channel.send(this.context.targetWindow, message, this.context.targetOrigin);
+
+	    /**
+	     * Transferable optimization:
+	     * - If payload contains ArrayBuffer/TypedArray, transfer its underlying buffer to avoid copy.
+	     * - This helps large chunks (e.g. file streams) significantly.
+	     */
+	    var payloadData = data === null || data === void 0 ? void 0 : data.data;
+	    var transfer;
+	    try {
+	      if (typeof ArrayBuffer !== 'undefined' && payloadData instanceof ArrayBuffer) {
+	        transfer = [payloadData];
+	      } else if (typeof ArrayBuffer !== 'undefined' && typeof ArrayBuffer.isView === 'function' && payloadData && ArrayBuffer.isView(payloadData) && payloadData.buffer instanceof ArrayBuffer) {
+	        transfer = [payloadData.buffer];
+	      }
+	    } catch (_unused6) {
+	      /** ignore */
+	    }
+	    var ok = this.context.channel.send(this.context.targetWindow, message, this.context.targetOrigin, transfer);
 	    if (!ok) {
 	      this._state = StreamState.CANCELLED;
 	      this.clearExpireTimer();
@@ -11242,7 +11338,7 @@
 	      if (isFunction(ch.removeReceiver)) {
 	        try {
 	          ch.removeReceiver(this.ackReceiver);
-	        } catch (_unused6) {
+	        } catch (_unused7) {
 	          /** ignore */
 	        }
 	      }
@@ -11277,7 +11373,7 @@
 	          timeout: expireTimeout
 	        });
 	        this.error(formatMessage(Messages.STREAM_EXPIRED, expireTimeout));
-	      } catch (_unused7) {
+	      } catch (_unused8) {
 	        /** ignore timer-triggered send failures */
 	      }
 	    }, expireTimeout);
@@ -11792,7 +11888,7 @@
 	        this.sendMessage(MessageType.STREAM_CANCEL, {
 	          reason
 	        });
-	      } catch (_unused8) {
+	      } catch (_unused9) {
 	        // ignore send failures on cancel
 	      }
 	    }
@@ -11887,6 +11983,71 @@
 
 	requireEs_array_reduce();
 
+	var es_string_match = {};
+
+	var hasRequiredEs_string_match;
+
+	function requireEs_string_match () {
+		if (hasRequiredEs_string_match) return es_string_match;
+		hasRequiredEs_string_match = 1;
+		var call = requireFunctionCall();
+		var uncurryThis = requireFunctionUncurryThis();
+		var fixRegExpWellKnownSymbolLogic = requireFixRegexpWellKnownSymbolLogic();
+		var anObject = requireAnObject();
+		var isObject = requireIsObject();
+		var toLength = requireToLength();
+		var toString = requireToString();
+		var requireObjectCoercible = requireRequireObjectCoercible();
+		var getMethod = requireGetMethod();
+		var advanceStringIndex = requireAdvanceStringIndex();
+		var getRegExpFlags = requireRegexpGetFlags();
+		var regExpExec = requireRegexpExecAbstract();
+
+		var stringIndexOf = uncurryThis(''.indexOf);
+
+		// @@match logic
+		fixRegExpWellKnownSymbolLogic('match', function (MATCH, nativeMatch, maybeCallNative) {
+		  return [
+		    // `String.prototype.match` method
+		    // https://tc39.es/ecma262/#sec-string.prototype.match
+		    function match(regexp) {
+		      var O = requireObjectCoercible(this);
+		      var matcher = isObject(regexp) ? getMethod(regexp, MATCH) : undefined;
+		      return matcher ? call(matcher, regexp, O) : new RegExp(regexp)[MATCH](toString(O));
+		    },
+		    // `RegExp.prototype[@@match]` method
+		    // https://tc39.es/ecma262/#sec-regexp.prototype-@@match
+		    function (string) {
+		      var rx = anObject(this);
+		      var S = toString(string);
+		      var res = maybeCallNative(nativeMatch, rx, S);
+
+		      if (res.done) return res.value;
+
+		      var flags = toString(getRegExpFlags(rx));
+
+		      if (stringIndexOf(flags, 'g') === -1) return regExpExec(rx, S);
+
+		      var fullUnicode = stringIndexOf(flags, 'u') !== -1;
+		      rx.lastIndex = 0;
+		      var A = [];
+		      var n = 0;
+		      var result;
+		      while ((result = regExpExec(rx, S)) !== null) {
+		        var matchStr = toString(result[0]);
+		        A[n] = matchStr;
+		        if (matchStr === '') rx.lastIndex = advanceStringIndex(S, toLength(rx.lastIndex), fullUnicode);
+		        n++;
+		      }
+		      return n === 0 ? null : A;
+		    }
+		  ];
+		});
+		return es_string_match;
+	}
+
+	requireEs_string_match();
+
 	var es_typedArray_uint8Array = {};
 
 	var typedArrayConstructor = {exports: {}};
@@ -13393,8 +13554,8 @@
 
 	requireEs_symbol_asyncIterator();
 
-	function ownKeys$7(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$7(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$7(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$7(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$8(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$8(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$8(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$8(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Stream message handler interface
@@ -13436,7 +13597,7 @@
 	  postControl(type, body) {
 	    var message = createPostMessage(type, this.requestId, {
 	      secretKey: this.secretKey,
-	      body: _objectSpread$7({
+	      body: _objectSpread$8({
 	        streamId: this.streamId
 	      }, body)
 	    });
@@ -13953,332 +14114,23 @@
 	  }
 	}
 
-	function _createForOfIteratorHelper$3(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$3(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
-	function _unsupportedIterableToArray$3(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$3(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$3(r, a) : void 0; } }
-	function _arrayLikeToArray$3(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
-	function ownKeys$6(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$6(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$6(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$6(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	var es_array_includes = {};
 
-	/**
-	 * Convert Uint8Array to Base64 string
-	 */
-	function uint8ArrayToBase64(uint8Array) {
-	  /**
-	   * Avoid O(n^2) string concatenation for large buffers.
-	   * Note: btoa still needs a single binary string, so this mainly improves conversion cost.
-	   */
-	  var chunkSize = 0x8000; // 32KB per chunk (safe for fromCharCode/apply limits)
-	  var parts = [];
-	  for (var i = 0; i < uint8Array.length; i += chunkSize) {
-	    var chunk = uint8Array.subarray(i, i + chunkSize);
-	    parts.push(String.fromCharCode.apply(null, chunk));
-	  }
-	  return btoa(parts.join(''));
-	}
+	var hasRequiredEs_array_includes;
 
-	/**
-	 * Convert Base64 string to Uint8Array
-	 */
-	function base64ToUint8Array(base64) {
-	  var binary = atob(base64);
-	  var uint8Array = new Uint8Array(binary.length);
-	  for (var i = 0; i < binary.length; i++) {
-	    uint8Array[i] = binary.charCodeAt(i);
-	  }
-	  return uint8Array;
-	}
+	function requireEs_array_includes () {
+		if (hasRequiredEs_array_includes) return es_array_includes;
+		hasRequiredEs_array_includes = 1;
+		var $ = require_export();
+		var $includes = requireArrayIncludes().includes;
+		var fails = requireFails();
+		var addToUnscopables = requireAddToUnscopables();
 
-	/**
-	 * IframeFileWritableStream - Server-side file writable stream
-	 * Automatically handles Base64 encoding of file content
-	 */
-	class IframeFileWritableStream extends IframeWritableStream {
-	  constructor(options) {
-	    super(_objectSpread$6(_objectSpread$6({}, options), {}, {
-	      type: StreamType.FILE,
-	      metadata: _objectSpread$6(_objectSpread$6({}, options.metadata), {}, {
-	        filename: options.filename,
-	        mimeType: options.mimeType || 'application/octet-stream',
-	        size: options.size
-	      })
-	    }));
-	    this.filename = options.filename;
-	    this.mimeType = options.mimeType || 'application/octet-stream';
-	    this.size = options.size;
-	  }
-
-	  /**
-	   * Override encode method to convert Uint8Array to Base64
-	   */
-	  encodeData(data) {
-	    if (data instanceof Uint8Array) {
-	      return uint8ArrayToBase64(data);
-	    }
-	    if (data instanceof ArrayBuffer) {
-	      return uint8ArrayToBase64(new Uint8Array(data));
-	    }
-	    if (typeof data === 'string') {
-	      // Already a base64 string
-	      return data;
-	    }
-	    // Try to convert other types
-	    return String(data);
-	  }
-	}
-
-	/**
-	 * IframeFileReadableStream - Client-side file readable stream
-	 * Automatically handles Base64 decoding of file content
-	 */
-	class IframeFileReadableStream extends IframeReadableStream {
-	  constructor(streamId, requestId, messageHandler, options = {}) {
-	    var _options$metadata, _options$metadata2, _options$metadata3;
-	    super(streamId, requestId, messageHandler, _objectSpread$6(_objectSpread$6({}, options), {}, {
-	      type: StreamType.FILE
-	    }));
-	    this.filename = options.filename || ((_options$metadata = options.metadata) === null || _options$metadata === void 0 ? void 0 : _options$metadata.filename);
-	    this.mimeType = options.mimeType || ((_options$metadata2 = options.metadata) === null || _options$metadata2 === void 0 ? void 0 : _options$metadata2.mimeType);
-	    this.size = options.size || ((_options$metadata3 = options.metadata) === null || _options$metadata3 === void 0 ? void 0 : _options$metadata3.size);
-	  }
-
-	  /**
-	   * Override decode method to convert Base64 to Uint8Array
-	   */
-	  decodeData(data) {
-	    if (typeof data === 'string') {
-	      return base64ToUint8Array(data);
-	    }
-	    if (data instanceof Uint8Array) {
-	      return data;
-	    }
-	    if (data instanceof ArrayBuffer) {
-	      return new Uint8Array(data);
-	    }
-	    return new Uint8Array();
-	  }
-
-	  /**
-	   * Override merge method to merge all Uint8Array chunks
-	   */
-	  mergeChunks() {
-	    var chunks = this.chunks;
-	    if (chunks.length === 0) {
-	      return new Uint8Array();
-	    }
-	    if (chunks.length === 1) {
-	      return chunks[0];
-	    }
-
-	    // Calculate total length
-	    var totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
-	    var result = new Uint8Array(totalLength);
-
-	    // Merge all chunks
-	    var offset = 0;
-	    var _iterator = _createForOfIteratorHelper$3(chunks),
-	      _step;
-	    try {
-	      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-	        var chunk = _step.value;
-	        result.set(chunk, offset);
-	        offset += chunk.length;
-	      }
-	    } catch (err) {
-	      _iterator.e(err);
-	    } finally {
-	      _iterator.f();
-	    }
-	    return result;
-	  }
-
-	  /**
-	   * Read all data as a merged Uint8Array (file stream default behavior)
-	   */
-	  read() {
-	    var _superprop_getRead = () => super.read,
-	      _this = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
-	      return _regeneratorRuntime.wrap(function (_context) {
-	        while (1) switch (_context.prev = _context.next) {
-	          case 0:
-	            _context.next = 1;
-	            return _superprop_getRead().call(_this);
-	          case 1:
-	            return _context.abrupt("return", _context.sent);
-	          case 2:
-	          case "end":
-	            return _context.stop();
-	        }
-	      }, _callee);
-	    }))();
-	  }
-
-	  /**
-	   * Read as Blob
-	   */
-	  readAsBlob() {
-	    var _this2 = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
-	      var data, buffer;
-	      return _regeneratorRuntime.wrap(function (_context2) {
-	        while (1) switch (_context2.prev = _context2.next) {
-	          case 0:
-	            _context2.next = 1;
-	            return _this2.read();
-	          case 1:
-	            data = _context2.sent;
-	            // Use slice to create a pure ArrayBuffer copy to avoid type issues
-	            buffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
-	            return _context2.abrupt("return", new Blob([buffer], {
-	              type: _this2.mimeType || 'application/octet-stream'
-	            }));
-	          case 2:
-	          case "end":
-	            return _context2.stop();
-	        }
-	      }, _callee2);
-	    }))();
-	  }
-
-	  /**
-	   * Read as File
-	   * @param fileName Optional file name (if not provided, uses stream's filename)
-	   */
-	  readAsFile(fileName) {
-	    var _this3 = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3() {
-	      var data, buffer, name;
-	      return _regeneratorRuntime.wrap(function (_context3) {
-	        while (1) switch (_context3.prev = _context3.next) {
-	          case 0:
-	            _context3.next = 1;
-	            return _this3.read();
-	          case 1:
-	            data = _context3.sent;
-	            // Use slice to create a pure ArrayBuffer copy to avoid type issues
-	            buffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
-	            name = fileName || _this3.filename || 'file';
-	            return _context3.abrupt("return", new File([buffer], name, {
-	              type: _this3.mimeType || 'application/octet-stream'
-	            }));
-	          case 2:
-	          case "end":
-	            return _context3.stop();
-	        }
-	      }, _callee3);
-	    }))();
-	  }
-
-	  /**
-	   * Read as ArrayBuffer
-	   */
-	  readAsArrayBuffer() {
-	    var _this4 = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4() {
-	      var data, buffer;
-	      return _regeneratorRuntime.wrap(function (_context4) {
-	        while (1) switch (_context4.prev = _context4.next) {
-	          case 0:
-	            _context4.next = 1;
-	            return _this4.read();
-	          case 1:
-	            data = _context4.sent;
-	            // Create a new ArrayBuffer copy
-	            buffer = new ArrayBuffer(data.byteLength);
-	            new Uint8Array(buffer).set(data);
-	            return _context4.abrupt("return", buffer);
-	          case 2:
-	          case "end":
-	            return _context4.stop();
-	        }
-	      }, _callee4);
-	    }))();
-	  }
-
-	  /**
-	   * Read as Data URL
-	   */
-	  readAsDataURL() {
-	    var _this5 = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5() {
-	      var data, base64;
-	      return _regeneratorRuntime.wrap(function (_context5) {
-	        while (1) switch (_context5.prev = _context5.next) {
-	          case 0:
-	            _context5.next = 1;
-	            return _this5.read();
-	          case 1:
-	            data = _context5.sent;
-	            base64 = uint8ArrayToBase64(data);
-	            return _context5.abrupt("return", `data:${_this5.mimeType || 'application/octet-stream'};base64,${base64}`);
-	          case 2:
-	          case "end":
-	            return _context5.stop();
-	        }
-	      }, _callee5);
-	    }))();
-	  }
-	}
-
-	// Type exports
-	/**
-	 * Check if value is an IframeReadableStream
-	 */
-	function isIframeReadableStream(value) {
-	  return value instanceof IframeReadableStream;
-	}
-
-	/**
-	 * Check if value is an IframeFileReadableStream (file stream)
-	 */
-	function isIframeFileReadableStream(value) {
-	  return value instanceof IframeFileReadableStream;
-	}
-
-	/**
-	 * Check if value is an IframeWritableStream (includes IframeFileWritableStream)
-	 */
-	function isIframeWritableStream(value) {
-	  return value instanceof IframeWritableStream || value instanceof IframeFileWritableStream;
-	}
-
-	/**
-	 * Check if value is an IframeFileWritableStream (file writable stream)
-	 */
-	function isIframeFileWritableStream(value) {
-	  return value instanceof IframeFileWritableStream;
-	}
-
-	var index = /*#__PURE__*/Object.freeze({
-		__proto__: null,
-		IframeFileReadableStream: IframeFileReadableStream,
-		IframeFileWritableStream: IframeFileWritableStream,
-		IframeReadableStream: IframeReadableStream,
-		IframeWritableStream: IframeWritableStream,
-		RequestIframeStreamError: RequestIframeStreamError,
-		isIframeFileReadableStream: isIframeFileReadableStream,
-		isIframeFileWritableStream: isIframeFileWritableStream,
-		isIframeReadableStream: isIframeReadableStream,
-		isIframeWritableStream: isIframeWritableStream
-	});
-
-	var es_array_includes = {};
-
-	var hasRequiredEs_array_includes;
-
-	function requireEs_array_includes () {
-		if (hasRequiredEs_array_includes) return es_array_includes;
-		hasRequiredEs_array_includes = 1;
-		var $ = require_export();
-		var $includes = requireArrayIncludes().includes;
-		var fails = requireFails();
-		var addToUnscopables = requireAddToUnscopables();
-
-		// FF99+ bug
-		var BROKEN_ON_SPARSE = fails(function () {
-		  // eslint-disable-next-line es/no-array-prototype-includes -- detection
-		  return !Array(1).includes();
-		});
+		// FF99+ bug
+		var BROKEN_ON_SPARSE = fails(function () {
+		  // eslint-disable-next-line es/no-array-prototype-includes -- detection
+		  return !Array(1).includes();
+		});
 
 		// `Array.prototype.includes` method
 		// https://tc39.es/ecma262/#sec-array.prototype.includes
@@ -14384,378 +14236,412 @@
 	}
 
 	/**
-	 * Endpoint Stream integration layer (`src/endpoint/stream`)
-	 *
-	 * This directory integrates postMessage `stream_*` messages with the stream object system in `src/stream`:
-	 * - Endpoint-side File/Blob -> IframeFileWritableStream adaptation (for sendFile / res.sendFile)
-	 * - Does NOT implement the stream protocol itself (protocol lives in `src/stream`)
+	 * Convert Blob to ArrayBuffer.
 	 *
-	 * Create an IframeFileWritableStream from content.
-	 *
-	 * Shared by:
-	 * - client: sendFile(...) -> sendStream(...)
-	 * - server response: res.sendFile(...) -> sendStream(...)
+	 * Notes:
+	 * - Use FileReader for legacy browser support (e.g. Chrome 49).
 	 */
-	function createIframeFileWritableStreamFromContent(_x) {
-	  return _createIframeFileWritableStreamFromContent.apply(this, arguments);
-	}
-	function _createIframeFileWritableStreamFromContent() {
-	  _createIframeFileWritableStreamFromContent = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(params) {
-	    var _params$chunked, _params$autoResolve;
-	    var _yield$import, IframeFileWritableStream, mimeType, fileName, t, fileContent, streamFileName, stream, _t;
-	    return _regeneratorRuntime.wrap(function (_context2) {
-	      while (1) switch (_context2.prev = _context2.next) {
-	        case 0:
-	          _context2.next = 1;
-	          return Promise.resolve().then(function () { return index; });
-	        case 1:
-	          _yield$import = _context2.sent;
-	          IframeFileWritableStream = _yield$import.IframeFileWritableStream;
-	          mimeType = params.mimeType || params.defaultMimeType || 'application/octet-stream';
-	          fileName = params.fileName;
-	          try {
-	            if (typeof File !== 'undefined' && params.content instanceof File) {
-	              mimeType = params.content.type || mimeType;
-	              fileName = fileName || params.content.name;
-	            }
-	          } catch (_unused) {
-	            /** ignore */
-	          }
-	          try {
-	            if (!fileName && typeof Blob !== 'undefined' && params.content instanceof Blob) {
-	              t = params.content.type;
-	              if (t) mimeType = t;
-	            }
-	          } catch (_unused2) {
-	            /** ignore */
-	          }
-	          if (!(typeof params.content === 'string')) {
-	            _context2.next = 2;
-	            break;
-	          }
-	          _t = btoa(unescape(encodeURIComponent(params.content)));
-	          _context2.next = 4;
-	          break;
-	        case 2:
-	          _context2.next = 3;
-	          return blobToBase64(params.content);
-	        case 3:
-	          _t = _context2.sent;
-	        case 4:
-	          fileContent = _t;
-	          streamFileName = fileName || params.defaultFileName || 'file';
-	          stream = new IframeFileWritableStream({
-	            filename: streamFileName,
-	            mimeType,
-	            chunked: (_params$chunked = params.chunked) !== null && _params$chunked !== void 0 ? _params$chunked : false,
-	            autoResolve: (_params$autoResolve = params.autoResolve) !== null && _params$autoResolve !== void 0 ? _params$autoResolve : true,
-	            next: function () {
-	              var _next = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
-	                return _regeneratorRuntime.wrap(function (_context) {
-	                  while (1) switch (_context.prev = _context.next) {
-	                    case 0:
-	                      return _context.abrupt("return", {
-	                        data: fileContent,
-	                        done: true
-	                      });
-	                    case 1:
-	                    case "end":
-	                      return _context.stop();
-	                  }
-	                }, _callee);
-	              }));
-	              function next() {
-	                return _next.apply(this, arguments);
-	              }
-	              return next;
-	            }()
-	          });
-	          return _context2.abrupt("return", {
-	            stream,
-	            fileName,
-	            mimeType
-	          });
-	        case 5:
-	        case "end":
-	          return _context2.stop();
-	      }
-	    }, _callee2);
-	  }));
-	  return _createIframeFileWritableStreamFromContent.apply(this, arguments);
+	function blobToArrayBuffer(blob) {
+	  return new Promise((resolve, reject) => {
+	    var reader = new FileReader();
+	    reader.onloadend = () => {
+	      resolve(reader.result);
+	    };
+	    reader.onerror = reject;
+	    reader.readAsArrayBuffer(blob);
+	  });
 	}
 
-	function ownKeys$5(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$5(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$5(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$5(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
-
-	/**
-	 * Outbox hooks for send pipelines.
-	 */
-
-	/**
-	 * Stream send pipeline params.
-	 */
+	function _createForOfIteratorHelper$3(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$3(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+	function _unsupportedIterableToArray$3(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$3(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$3(r, a) : void 0; } }
+	function _arrayLikeToArray$3(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+	function ownKeys$7(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$7(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$7(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$7(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	var DEFAULT_FILE_CHUNK_SIZE = 256 * 1024; // 256KB
 
-	/**
-	 * File send pipeline params.
+	/**
+	 * Convert Uint8Array to Base64 string
 	 */
+	function uint8ArrayToBase64(uint8Array) {
+	  /**
+	   * Avoid O(n^2) string concatenation for large buffers.
+	   * Note: btoa still needs a single binary string, so this mainly improves conversion cost.
+	   */
+	  var chunkSize = 0x8000; // 32KB per chunk (safe for fromCharCode/apply limits)
+	  var parts = [];
+	  for (var i = 0; i < uint8Array.length; i += chunkSize) {
+	    var chunk = uint8Array.subarray(i, i + chunkSize);
+	    parts.push(String.fromCharCode.apply(null, chunk));
+	  }
+	  return btoa(parts.join(''));
+	}
 
-	/**
-	 * Universal send pipeline params.
+	/**
+	 * Convert string to UTF-8 bytes.
+	 *
+	 * Notes:
+	 * - We prefer TextEncoder when available.
+	 * - Fallback uses `unescape(encodeURIComponent(...))` for broad browser compatibility.
 	 */
-
-	function safeIsFile(data) {
+	function stringToUtf8Uint8Array(value) {
 	  try {
-	    return typeof File !== 'undefined' && data instanceof File;
+	    if (typeof TextEncoder !== 'undefined') {
+	      return new TextEncoder().encode(value);
+	    }
 	  } catch (_unused) {
-	    return false;
+	    /** ignore */
 	  }
+	  var latin1 = unescape(encodeURIComponent(value));
+	  var arr = new Uint8Array(latin1.length);
+	  for (var i = 0; i < latin1.length; i++) {
+	    arr[i] = latin1.charCodeAt(i);
+	  }
+	  return arr;
 	}
-	function safeIsBlob(data) {
+
+	/**
+	 * Convert UTF-8 bytes to string.
+	 *
+	 * Notes:
+	 * - We prefer TextDecoder when available.
+	 * - Fallback uses `escape/decodeURIComponent` for broad browser compatibility.
+	 */
+	function utf8Uint8ArrayToString(bytes) {
 	  try {
-	    return typeof Blob !== 'undefined' && data instanceof Blob;
+	    if (typeof TextDecoder !== 'undefined') {
+	      return new TextDecoder('utf-8').decode(bytes);
+	    }
 	  } catch (_unused2) {
-	    return false;
+	    /** ignore */
 	  }
+	  /**
+	   * Fallback:
+	   * - Build a latin1 string from bytes, then decode as UTF-8.
+	   * - We chunk to avoid call stack / argument limits.
+	   */
+	  var chunkSize = 0x8000;
+	  var parts = [];
+	  for (var i = 0; i < bytes.length; i += chunkSize) {
+	    var chunk = bytes.subarray(i, i + chunkSize);
+	    parts.push(String.fromCharCode.apply(null, chunk));
+	  }
+	  return decodeURIComponent(escape(parts.join('')));
 	}
 
-	/**
-	 * RequestIframeEndpointOutbox
-	 *
-	 * A lightweight "built-in sender" bound to a fixed peer (targetWindow/targetOrigin).
-	 * Used by request/response-side objects to send messages without repeatedly passing
-	 * targetWindow/targetOrigin.
+	/**
+	 * IframeFileWritableStream - Server-side file writable stream
+	 *
+	 * Notes:
+	 * - This stream supports binary chunks (ArrayBuffer / Uint8Array), which can be transferred
+	 *   via postMessage transfer list for better performance.
 	 */
-	class RequestIframeEndpointOutbox {
-	  constructor(dispatcher, targetWindow, targetOrigin, defaultTargetId) {
-	    _defineProperty(this, "hooks", {
-	      beforeSendRaw: new SyncHook(),
-	      afterSendRaw: new SyncHook(),
-	      sendRawError: new SyncHook(),
-	      beforeSendMessage: new SyncHook(),
-	      afterSendMessage: new SyncHook(),
-	      sendMessageError: new SyncHook()
-	    });
-	    this.dispatcher = dispatcher;
-	    this.targetWindow = targetWindow;
-	    this.targetOrigin = targetOrigin;
-	    this.defaultTargetId = defaultTargetId;
-	  }
-	  setDefaultTargetId(targetId) {
-	    this.defaultTargetId = targetId;
-	  }
-	  get secretKey() {
-	    return this.dispatcher.secretKey;
-	  }
-	  get channel() {
-	    return this.dispatcher.getChannel();
-	  }
-	  runWithHooks(hooks, fn) {
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
-	      var result, _t;
-	      return _regeneratorRuntime.wrap(function (_context) {
-	        while (1) switch (_context.prev = _context.next) {
+	class IframeFileWritableStream extends IframeWritableStream {
+	  /**
+	   * Create a file writable stream from string/Blob/File.
+	   *
+	   * This is a stream-layer utility:
+	   * - It does NOT depend on headers.
+	   * - It produces binary chunks (ArrayBuffer) for better performance.
+	   */
+	  static from(params) {
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
+	      var _params$chunked, _params$autoResolve;
+	      var mimeType, fileName, size, t, blob, streamFileName, chunked, chunkSize, offset, stream;
+	      return _regeneratorRuntime.wrap(function (_context2) {
+	        while (1) switch (_context2.prev = _context2.next) {
 	          case 0:
-	            _context.prev = 0;
-	            if (!hooks.before) {
-	              _context.next = 1;
-	              break;
-	            }
-	            _context.next = 1;
-	            return hooks.before();
-	          case 1:
-	            _context.next = 2;
-	            return fn();
-	          case 2:
-	            result = _context.sent;
-	            if (!hooks.end) {
-	              _context.next = 3;
-	              break;
-	            }
-	            _context.next = 3;
-	            return hooks.end(result);
-	          case 3:
-	            return _context.abrupt("return", result);
-	          case 4:
-	            _context.prev = 4;
-	            _t = _context["catch"](0);
-	            if (!hooks.error) {
-	              _context.next = 6;
-	              break;
+	            mimeType = params.mimeType || params.defaultMimeType || 'application/octet-stream';
+	            fileName = params.fileName;
+	            try {
+	              if (typeof File !== 'undefined' && params.content instanceof File) {
+	                mimeType = params.content.type || mimeType;
+	                fileName = fileName || params.content.name;
+	                size = params.content.size;
+	              }
+	            } catch (_unused3) {
+	              /** ignore */
 	            }
-	            _context.next = 5;
-	            return hooks.error(_t);
-	          case 5:
-	            return _context.abrupt("return", _context.sent);
-	          case 6:
-	            throw _t;
-	          case 7:
-	            _context.prev = 7;
-	            if (!hooks.finally) {
-	              _context.next = 8;
-	              break;
+	            try {
+	              if (!fileName && typeof Blob !== 'undefined' && params.content instanceof Blob) {
+	                t = params.content.type;
+	                if (t) mimeType = t;
+	                size = params.content.size;
+	              }
+	            } catch (_unused4) {
+	              /** ignore */
 	            }
-	            _context.next = 8;
-	            return hooks.finally();
-	          case 8:
-	            return _context.finish(7);
-	          case 9:
+	            blob = typeof params.content === 'string' ? new Blob([params.content], {
+	              type: mimeType
+	            }) : params.content;
+	            size = size !== null && size !== void 0 ? size : blob === null || blob === void 0 ? void 0 : blob.size;
+	            streamFileName = fileName || params.defaultFileName || 'file';
+	            chunked = (_params$chunked = params.chunked) !== null && _params$chunked !== void 0 ? _params$chunked : false;
+	            chunkSize = typeof params.chunkSize === 'number' && Number.isFinite(params.chunkSize) && params.chunkSize > 0 ? Math.floor(params.chunkSize) : DEFAULT_FILE_CHUNK_SIZE;
+	            offset = 0;
+	            stream = new IframeFileWritableStream({
+	              filename: streamFileName,
+	              mimeType,
+	              size,
+	              chunked,
+	              autoResolve: (_params$autoResolve = params.autoResolve) !== null && _params$autoResolve !== void 0 ? _params$autoResolve : true,
+	              next: function () {
+	                var _next = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
+	                  var _size;
+	                  var all, total, end, slice, buf;
+	                  return _regeneratorRuntime.wrap(function (_context) {
+	                    while (1) switch (_context.prev = _context.next) {
+	                      case 0:
+	                        if (chunked) {
+	                          _context.next = 2;
+	                          break;
+	                        }
+	                        _context.next = 1;
+	                        return blobToArrayBuffer(blob);
+	                      case 1:
+	                        all = _context.sent;
+	                        return _context.abrupt("return", {
+	                          data: all,
+	                          done: true
+	                        });
+	                      case 2:
+	                        total = (_size = blob.size) !== null && _size !== void 0 ? _size : 0;
+	                        if (!(offset >= total)) {
+	                          _context.next = 3;
+	                          break;
+	                        }
+	                        return _context.abrupt("return", {
+	                          data: new ArrayBuffer(0),
+	                          done: true
+	                        });
+	                      case 3:
+	                        end = Math.min(total, offset + chunkSize);
+	                        slice = blob.slice(offset, end);
+	                        _context.next = 4;
+	                        return blobToArrayBuffer(slice);
+	                      case 4:
+	                        buf = _context.sent;
+	                        offset = end;
+	                        return _context.abrupt("return", {
+	                          data: buf,
+	                          done: offset >= total
+	                        });
+	                      case 5:
+	                      case "end":
+	                        return _context.stop();
+	                    }
+	                  }, _callee);
+	                }));
+	                function next() {
+	                  return _next.apply(this, arguments);
+	                }
+	                return next;
+	              }()
+	            });
+	            return _context2.abrupt("return", stream);
+	          case 1:
 	          case "end":
-	            return _context.stop();
+	            return _context2.stop();
 	        }
-	      }, _callee, null, [[0, 4, 7, 9]]);
+	      }, _callee2);
 	    }))();
 	  }
 
-	  /**
-	   * Create a stream bind context using this peer's fixed target info.
-	   *
-	   * This helps unify the duplicated `_bind({ targetWindow, targetOrigin, secretKey, channel, ... })` logic
-	   * across client/server response implementations.
-	   */
-	  createStreamBindContext(params) {
-	    var _params$targetId;
-	    return {
-	      requestId: params.requestId,
-	      targetWindow: this.targetWindow,
-	      targetOrigin: this.targetOrigin,
-	      secretKey: this.secretKey,
-	      channel: this.channel,
-	      registerStreamHandler: params.registerStreamHandler,
-	      unregisterStreamHandler: params.unregisterStreamHandler,
-	      heartbeat: params.heartbeat,
-	      serverId: params.serverId,
-	      clientId: params.clientId,
-	      targetId: (_params$targetId = params.targetId) !== null && _params$targetId !== void 0 ? _params$targetId : this.defaultTargetId
-	    };
-	  }
-
-	  /**
-	   * Bind and start a writable stream to this peer.
-	   *
-	   * Note:
-	   * - Client-side request-body streams may need to delay `start()` until after REQUEST is sent.
-	   *   For that case, prefer `createStreamBindContext()` + manual `stream.start()`.
+	  /**
+	   * Create a UTF-8 text file stream.
+	   *
+	   * This is a convenience wrapper around from({ content: string, ... }):
+	   * - Makes "string -> UTF-8 bytes -> file stream" intent explicit.
+	   * - Sets a more appropriate default mimeType for text files.
 	   */
-	  sendWritableStream(stream, params) {
-	    var _this = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
-	      return _regeneratorRuntime.wrap(function (_context2) {
-	        while (1) switch (_context2.prev = _context2.next) {
+	  static fromText(params) {
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3() {
+	      var _params$mimeType, _params$defaultFileNa;
+	      return _regeneratorRuntime.wrap(function (_context3) {
+	        while (1) switch (_context3.prev = _context3.next) {
 	          case 0:
-	            stream._bind(_this.createStreamBindContext(params));
-	            _context2.next = 1;
-	            return stream.start();
+	            _context3.next = 1;
+	            return IframeFileWritableStream.from({
+	              content: params.text,
+	              fileName: params.fileName,
+	              mimeType: (_params$mimeType = params.mimeType) !== null && _params$mimeType !== void 0 ? _params$mimeType : 'text/plain; charset=utf-8',
+	              chunked: params.chunked,
+	              chunkSize: params.chunkSize,
+	              autoResolve: params.autoResolve,
+	              defaultFileName: (_params$defaultFileNa = params.defaultFileName) !== null && _params$defaultFileNa !== void 0 ? _params$defaultFileNa : 'file.txt',
+	              defaultMimeType: 'text/plain; charset=utf-8'
+	            });
 	          case 1:
+	            return _context3.abrupt("return", _context3.sent);
+	          case 2:
 	          case "end":
-	            return _context2.stop();
+	            return _context3.stop();
 	        }
-	      }, _callee2);
+	      }, _callee3);
 	    }))();
 	  }
+	  constructor(options) {
+	    super(_objectSpread$7(_objectSpread$7({}, options), {}, {
+	      type: StreamType.FILE,
+	      metadata: _objectSpread$7(_objectSpread$7({}, options.metadata), {}, {
+	        filename: options.filename,
+	        mimeType: options.mimeType || 'application/octet-stream',
+	        size: options.size
+	      })
+	    }));
+	    this.filename = options.filename;
+	    this.mimeType = options.mimeType || 'application/octet-stream';
+	    this.size = options.size;
+	  }
 
-	  /**
-	   * Universal send - dispatch by data type, then call hooks to implement differences.
+	  /**
+	   * Encode outbound chunk.
+	   *
+	   * - ArrayBuffer / TypedArray: keep as-is (binary chunks)
+	   * - string: encoded as UTF-8 bytes
 	   */
-	  send(params) {
-	    var _this2 = this;
-	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4() {
-	      return _regeneratorRuntime.wrap(function (_context4) {
-	        while (1) switch (_context4.prev = _context4.next) {
-	          case 0:
-	            return _context4.abrupt("return", _this2.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3() {
-	              var data;
-	              return _regeneratorRuntime.wrap(function (_context3) {
-	                while (1) switch (_context3.prev = _context3.next) {
-	                  case 0:
-	                    data = params.data;
-	                    if (!isIframeWritableStream(data)) {
-	                      _context3.next = 4;
-	                      break;
-	                    }
-	                    if (!params.onStream) {
-	                      _context3.next = 2;
-	                      break;
-	                    }
-	                    _context3.next = 1;
-	                    return params.onStream(data);
-	                  case 1:
-	                    return _context3.abrupt("return", _context3.sent);
-	                  case 2:
-	                    _context3.next = 3;
-	                    return params.onOther(data);
-	                  case 3:
-	                    return _context3.abrupt("return", _context3.sent);
-	                  case 4:
-	                    if (!(safeIsFile(data) || safeIsBlob(data))) {
-	                      _context3.next = 8;
-	                      break;
-	                    }
-	                    if (!params.onFileOrBlob) {
-	                      _context3.next = 6;
-	                      break;
-	                    }
-	                    _context3.next = 5;
-	                    return params.onFileOrBlob(data);
-	                  case 5:
-	                    return _context3.abrupt("return", _context3.sent);
-	                  case 6:
-	                    _context3.next = 7;
-	                    return params.onOther(data);
-	                  case 7:
-	                    return _context3.abrupt("return", _context3.sent);
-	                  case 8:
-	                    _context3.next = 9;
-	                    return params.onOther(data);
-	                  case 9:
-	                    return _context3.abrupt("return", _context3.sent);
-	                  case 10:
-	                  case "end":
-	                    return _context3.stop();
-	                }
-	              }, _callee3);
-	            }))));
+	  encodeData(data) {
+	    try {
+	      if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer) {
+	        return data;
+	      }
+	      if (typeof ArrayBuffer !== 'undefined' && ArrayBuffer.isView && ArrayBuffer.isView(data)) {
+	        return data;
+	      }
+	    } catch (_unused5) {
+	      /** ignore */
+	    }
+	    if (typeof data === 'string') {
+	      return stringToUtf8Uint8Array(data);
+	    }
+	    return stringToUtf8Uint8Array(String(data));
+	  }
+	}
+
+	/**
+	 * IframeFileReadableStream - Client-side file readable stream
+	 * Automatically normalizes inbound chunks to Uint8Array.
+	 */
+	class IframeFileReadableStream extends IframeReadableStream {
+	  constructor(streamId, requestId, messageHandler, options = {}) {
+	    var _options$metadata, _options$metadata2, _options$metadata3;
+	    super(streamId, requestId, messageHandler, _objectSpread$7(_objectSpread$7({}, options), {}, {
+	      type: StreamType.FILE
+	    }));
+	    this.filename = options.filename || ((_options$metadata = options.metadata) === null || _options$metadata === void 0 ? void 0 : _options$metadata.filename);
+	    this.mimeType = options.mimeType || ((_options$metadata2 = options.metadata) === null || _options$metadata2 === void 0 ? void 0 : _options$metadata2.mimeType);
+	    this.size = options.size || ((_options$metadata3 = options.metadata) === null || _options$metadata3 === void 0 ? void 0 : _options$metadata3.size);
+	  }
+
+	  /**
+	   * Override decode method to normalize chunk to Uint8Array.
+	   */
+	  decodeData(data) {
+	    if (typeof data === 'string') {
+	      return stringToUtf8Uint8Array(data);
+	    }
+	    if (data instanceof Uint8Array) {
+	      return data;
+	    }
+	    if (data instanceof ArrayBuffer) {
+	      return new Uint8Array(data);
+	    }
+	    return new Uint8Array();
+	  }
+
+	  /**
+	   * Parse filename from Content-Disposition header value.
+	   */
+	  static parseFilenameFromContentDisposition(value) {
+	    if (!value) return undefined;
+	    var disposition = typeof value === 'string' ? value : value[0];
+	    if (!disposition) return undefined;
+	    var match = disposition.match(/filename="?([^"]+)"?/i);
+	    return match ? match[1] : undefined;
+	  }
+
+	  /**
+	   * Resolve this file stream to File or Blob, depending on whether fileName is provided.
+	   */
+	  readAsFileOrBlob(fileName) {
+	    return fileName ? this.readAsFile(fileName) : this.readAsBlob();
+	  }
+
+	  /**
+	   * Override merge method to merge all Uint8Array chunks
+	   */
+	  mergeChunks() {
+	    var chunks = this.chunks;
+	    if (chunks.length === 0) {
+	      return new Uint8Array();
+	    }
+	    if (chunks.length === 1) {
+	      return chunks[0];
+	    }
+
+	    // Calculate total length
+	    var totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+	    var result = new Uint8Array(totalLength);
+
+	    // Merge all chunks
+	    var offset = 0;
+	    var _iterator = _createForOfIteratorHelper$3(chunks),
+	      _step;
+	    try {
+	      for (_iterator.s(); !(_step = _iterator.n()).done;) {
+	        var chunk = _step.value;
+	        result.set(chunk, offset);
+	        offset += chunk.length;
+	      }
+	    } catch (err) {
+	      _iterator.e(err);
+	    } finally {
+	      _iterator.f();
+	    }
+	    return result;
+	  }
+
+	  /**
+	   * Read all data as a merged Uint8Array (file stream default behavior)
+	   */
+	  read() {
+	    var _superprop_getRead = () => super.read,
+	      _this = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4() {
+	      return _regeneratorRuntime.wrap(function (_context4) {
+	        while (1) switch (_context4.prev = _context4.next) {
+	          case 0:
+	            _context4.next = 1;
+	            return _superprop_getRead().call(_this);
 	          case 1:
+	            return _context4.abrupt("return", _context4.sent);
+	          case 2:
 	          case "end":
 	            return _context4.stop();
 	        }
 	      }, _callee4);
 	    }))();
 	  }
-	  runStreamSend(params) {
-	    var _this3 = this;
+
+	  /**
+	   * Read as Blob
+	   */
+	  readAsBlob() {
+	    var _this2 = this;
 	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5() {
-	      var resultPromise, result;
+	      var data, buffer;
 	      return _regeneratorRuntime.wrap(function (_context5) {
 	        while (1) switch (_context5.prev = _context5.next) {
 	          case 0:
-	            params.stream._bind(_this3.createStreamBindContext(params.bind));
-	            resultPromise = params.beforeStart ? params.beforeStart({
-	              stream: params.stream
-	            }) : undefined;
-	            if (!(params.awaitStart === false)) {
-	              _context5.next = 2;
-	              break;
-	            }
-	            /**
-	             * Fire-and-forget:
-	             * - request-body stream must start after REQUEST is sent (beforeStart is expected to send REQUEST synchronously)
-	             * - we must NOT await the response promise before starting stream, otherwise server will time out waiting stream_start
-	             */
-	            void params.stream.start();
 	            _context5.next = 1;
-	            return resultPromise;
+	            return _this2.read();
 	          case 1:
-	            return _context5.abrupt("return", _context5.sent);
+	            data = _context5.sent;
+	            // Use slice to create a pure ArrayBuffer copy to avoid type issues
+	            buffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
+	            return _context5.abrupt("return", new Blob([buffer], {
+	              type: _this2.mimeType || 'application/octet-stream'
+	            }));
 	          case 2:
-	            _context5.next = 3;
-	            return resultPromise;
-	          case 3:
-	            result = _context5.sent;
-	            _context5.next = 4;
-	            return params.stream.start();
-	          case 4:
-	            return _context5.abrupt("return", result);
-	          case 5:
 	          case "end":
 	            return _context5.stop();
 	        }
@@ -14763,30 +14649,55 @@
 	    }))();
 	  }
 
-	  /**
-	   * Send writable stream via peer.
+	  /**
+	   * Read as UTF-8 text.
+	   *
+	   * Notes:
+	   * - This is intended for "text file" use cases where file stream chunks represent UTF-8 bytes.
+	   * - For non-UTF-8 binary files, use readAsBlob()/readAsArrayBuffer().
 	   */
-	  sendStream(params) {
+	  readAsText() {
+	    var _this3 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee6() {
+	      var data;
+	      return _regeneratorRuntime.wrap(function (_context6) {
+	        while (1) switch (_context6.prev = _context6.next) {
+	          case 0:
+	            _context6.next = 1;
+	            return _this3.read();
+	          case 1:
+	            data = _context6.sent;
+	            return _context6.abrupt("return", utf8Uint8ArrayToString(data));
+	          case 2:
+	          case "end":
+	            return _context6.stop();
+	        }
+	      }, _callee6);
+	    }))();
+	  }
+
+	  /**
+	   * Read as File
+	   * @param fileName Optional file name (if not provided, uses stream's filename)
+	   */
+	  readAsFile(fileName) {
 	    var _this4 = this;
 	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee7() {
+	      var data, buffer, name;
 	      return _regeneratorRuntime.wrap(function (_context7) {
 	        while (1) switch (_context7.prev = _context7.next) {
 	          case 0:
-	            return _context7.abrupt("return", _this4.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee6() {
-	              return _regeneratorRuntime.wrap(function (_context6) {
-	                while (1) switch (_context6.prev = _context6.next) {
-	                  case 0:
-	                    _context6.next = 1;
-	                    return _this4.runStreamSend(params);
-	                  case 1:
-	                    return _context6.abrupt("return", _context6.sent);
-	                  case 2:
-	                  case "end":
-	                    return _context6.stop();
-	                }
-	              }, _callee6);
-	            }))));
+	            _context7.next = 1;
+	            return _this4.read();
 	          case 1:
+	            data = _context7.sent;
+	            // Use slice to create a pure ArrayBuffer copy to avoid type issues
+	            buffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
+	            name = fileName || _this4.filename || 'file';
+	            return _context7.abrupt("return", new File([buffer], name, {
+	              type: _this4.mimeType || 'application/octet-stream'
+	            }));
+	          case 2:
 	          case "end":
 	            return _context7.stop();
 	        }
@@ -14794,426 +14705,862 @@
 	    }))();
 	  }
 
-	  /**
-	   * Send File/Blob/string as a file stream via peer.
+	  /**
+	   * Read as ArrayBuffer
 	   */
-	  sendFile(params) {
+	  readAsArrayBuffer() {
 	    var _this5 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee8() {
+	      var data, buffer;
+	      return _regeneratorRuntime.wrap(function (_context8) {
+	        while (1) switch (_context8.prev = _context8.next) {
+	          case 0:
+	            _context8.next = 1;
+	            return _this5.read();
+	          case 1:
+	            data = _context8.sent;
+	            // Create a new ArrayBuffer copy
+	            buffer = new ArrayBuffer(data.byteLength);
+	            new Uint8Array(buffer).set(data);
+	            return _context8.abrupt("return", buffer);
+	          case 2:
+	          case "end":
+	            return _context8.stop();
+	        }
+	      }, _callee8);
+	    }))();
+	  }
+
+	  /**
+	   * Read as Data URL
+	   */
+	  readAsDataURL() {
+	    var _this6 = this;
 	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee9() {
+	      var data, base64;
 	      return _regeneratorRuntime.wrap(function (_context9) {
 	        while (1) switch (_context9.prev = _context9.next) {
 	          case 0:
-	            return _context9.abrupt("return", _this5.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee8() {
-	              var _params$onFileInfo;
-	              var created;
-	              return _regeneratorRuntime.wrap(function (_context8) {
-	                while (1) switch (_context8.prev = _context8.next) {
-	                  case 0:
-	                    _context8.next = 1;
-	                    return createIframeFileWritableStreamFromContent({
-	                      content: params.content,
-	                      fileName: params.fileName,
-	                      mimeType: params.mimeType,
-	                      chunked: params.chunked,
-	                      autoResolve: params.autoResolve,
-	                      defaultFileName: params.defaultFileName,
-	                      defaultMimeType: params.defaultMimeType
-	                    });
-	                  case 1:
-	                    created = _context8.sent;
-	                    _context8.next = 2;
-	                    return (_params$onFileInfo = params.onFileInfo) === null || _params$onFileInfo === void 0 ? void 0 : _params$onFileInfo.call(params, {
-	                      fileName: created.fileName,
-	                      mimeType: created.mimeType
-	                    });
-	                  case 2:
-	                    _context8.next = 3;
-	                    return _this5.runStreamSend(_objectSpread$5(_objectSpread$5({}, params.stream), {}, {
-	                      stream: created.stream
-	                    }));
-	                  case 3:
-	                    return _context8.abrupt("return", _context8.sent);
-	                  case 4:
-	                  case "end":
-	                    return _context8.stop();
-	                }
-	              }, _callee8);
-	            }))));
+	            _context9.next = 1;
+	            return _this6.read();
 	          case 1:
+	            data = _context9.sent;
+	            base64 = uint8ArrayToBase64(data);
+	            return _context9.abrupt("return", `data:${_this6.mimeType || 'application/octet-stream'};base64,${base64}`);
+	          case 2:
 	          case "end":
 	            return _context9.stop();
 	        }
 	      }, _callee9);
 	    }))();
 	  }
-
-	  /**
-	   * Send typed message with peer pre-bound.
-	   */
-	  sendMessage(type, requestId, data) {
-	    var payload = _objectSpread$5({}, data || {});
-	    if (payload.targetId === undefined && this.defaultTargetId !== undefined) {
-	      payload.targetId = this.defaultTargetId;
-	    }
-	    this.hooks.beforeSendMessage.call(type, requestId, payload);
-	    try {
-	      var _ok = this.dispatcher.sendMessage(this.targetWindow, this.targetOrigin, type, requestId, payload);
-	      this.hooks.afterSendMessage.call(type, requestId, payload, _ok);
-	      return _ok;
-	    } catch (e) {
-	      this.hooks.sendMessageError.call(type, requestId, payload, e);
-	      throw e;
-	    }
-	  }
-
-	  /**
-	   * Send raw message with peer pre-bound.
-	   */
-	  sendRaw(message) {
-	    this.hooks.beforeSendRaw.call(message);
-	    try {
-	      var _ok2 = this.dispatcher.send(this.targetWindow, message, this.targetOrigin);
-	      this.hooks.afterSendRaw.call(message, _ok2);
-	      return _ok2;
-	    } catch (e) {
-	      this.hooks.sendRawError.call(message, e);
-	      throw e;
-	    }
-	  }
 	}
 
-	/**
-	 * Pending manager for maps and timers.
-	 *
-	 * - Track all pending maps created by hub
-	 * - Track all timeouts created by hub
-	 * - Provide a unified cleanup when destroying
+	// Type exports
+	/**
+	 * Check if value is an IframeReadableStream
 	 */
-	class RequestIframePendingManager {
-	  constructor() {
-	    _defineProperty(this, "maps", new Map());
-	    _defineProperty(this, "timeouts", new Set());
-	  }
-	  /**
-	   * Get or create a named pending map that will be auto-cleared on destroy.
-	   */
-	  map(name) {
-	    var existing = this.maps.get(name);
-	    if (existing) return existing;
-	    var m = new Map();
-	    this.maps.set(name, m);
-	    return m;
-	  }
-	  get(name, key) {
-	    return this.map(name).get(key);
-	  }
-	  set(name, key, value) {
-	    this.map(name).set(key, value);
-	  }
-	  has(name, key) {
-	    return this.map(name).has(key);
-	  }
-	  delete(name, key) {
-	    return this.map(name).delete(key);
-	  }
+	function isIframeReadableStream(value) {
+	  return value instanceof IframeReadableStream;
+	}
 
-	  /**
-	   * Create a timeout that will be auto-cleared on destroy.
-	   */
-	  setTimeout(fn, ms) {
-	    var id = setTimeout(() => {
-	      this.timeouts.delete(id);
-	      fn();
-	    }, ms);
-	    this.timeouts.add(id);
-	    return id;
-	  }
+	/**
+	 * Check if value is an IframeFileReadableStream (file stream)
+	 */
+	function isIframeFileReadableStream(value) {
+	  return value instanceof IframeFileReadableStream;
+	}
 
-	  /**
-	   * Clear a tracked timeout.
-	   */
-	  clearTimeout(id) {
-	    clearTimeout(id);
-	    this.timeouts.delete(id);
-	  }
+	/**
+	 * Check if value is an IframeWritableStream (includes IframeFileWritableStream)
+	 */
+	function isIframeWritableStream(value) {
+	  return value instanceof IframeWritableStream || value instanceof IframeFileWritableStream;
+	}
 
-	  /**
-	   * Clear all tracked pending maps and timeouts.
-	   */
-	  clearAll() {
-	    this.timeouts.forEach(id => clearTimeout(id));
-	    this.timeouts.clear();
-	    this.maps.forEach(m => m.clear());
-	  }
+	/**
+	 * Check if value is an IframeFileWritableStream (file writable stream)
+	 */
+	function isIframeFileWritableStream(value) {
+	  return value instanceof IframeFileWritableStream;
 	}
 
+	function ownKeys$6(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$6(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$6(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$6(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+
 	/**
-	 * Generic counter/limiter utilities (built on hub.pending maps).
-	 *
-	 * This is intended as a shared infrastructure for both client/server:
-	 * - server can limit max concurrent in-flight requests per client
-	 * - client can limit max concurrent streams / in-flight sends in future
+	 * Outbox hooks for send pipelines.
 	 */
-	class RequestIframeLimiter {
-	  constructor(pending) {
-	    this.pending = pending;
-	  }
-	  get(bucket, key) {
-	    var _this$pending$get;
-	    return (_this$pending$get = this.pending.get(bucket, key)) !== null && _this$pending$get !== void 0 ? _this$pending$get : 0;
-	  }
-
-	  /**
-	   * Try acquire one permit for the given key.
-	   * Returns true if acquired, false if limit reached.
-	   */
-	  tryAcquire(bucket, key, limit) {
-	    if (!Number.isFinite(limit)) {
-	      /** Treat Infinity as always allowed but still count for symmetry */
-	      var next = this.get(bucket, key) + 1;
-	      this.pending.set(bucket, key, next);
-	      return true;
-	    }
-	    var current = this.get(bucket, key);
-	    if (current >= limit) return false;
-	    this.pending.set(bucket, key, current + 1);
-	    return true;
-	  }
 
-	  /**
-	   * Release one permit for the given key.
-	   */
-	  release(bucket, key) {
-	    var current = this.get(bucket, key);
-	    var next = current - 1;
-	    if (next <= 0) {
-	      this.pending.delete(bucket, key);
-	      return;
-	    }
-	    this.pending.set(bucket, key, next);
-	  }
-	}
+	/**
+	 * Stream send pipeline params.
+	 */
 
 	/**
-	 * Shared options for endpoint hub.
+	 * File send pipeline params.
 	 */
 
 	/**
-	 * RequestIframeEndpointHub
-	 *
-	 * Endpoint "hub" responsible for:
-	 * - MessageDispatcher lifecycle
-	 * - handler registration/unregistration
-	 * - pending + timeout management
-	 * - limiter counters
+	 * Universal send pipeline params.
 	 */
-	class RequestIframeEndpointHub {
-	  constructor(role, instanceId, options) {
-	    var _options$versionValid;
-	    _defineProperty(this, "hooks", {
-	      beforeOpen: new SyncHook(),
-	      afterOpen: new SyncHook(),
-	      beforeClose: new SyncHook(),
-	      afterClose: new SyncHook(),
-	      beforeDestroy: new SyncHook(),
-	      afterDestroy: new SyncHook(),
-	      registerHandler: new SyncHook(),
-	      unregisterHandler: new SyncHook()
-	    });
-	    _defineProperty(this, "pending", new RequestIframePendingManager());
-	    _defineProperty(this, "limiter", new RequestIframeLimiter(this.pending));
-	    _defineProperty(this, "unregisterFns", []);
-	    _defineProperty(this, "warnOnceKeys", new Set());
-	    /** Whether it is open */
-	    _defineProperty(this, "_isOpen", false);
-	    this.instanceId = instanceId;
-	    this.versionValidator = (_options$versionValid = options === null || options === void 0 ? void 0 : options.versionValidator) !== null && _options$versionValid !== void 0 ? _options$versionValid : isCompatibleVersion;
 
-	    /** Get or create shared channel and create dispatcher */
-	    var channel = getOrCreateMessageChannel(options === null || options === void 0 ? void 0 : options.secretKey);
-	    this.messageDispatcher = new MessageDispatcher(channel, role, instanceId);
-	    this.messageDispatcher.setAutoAckLimits({
-	      maxMetaLength: options === null || options === void 0 ? void 0 : options.autoAckMaxMetaLength,
-	      maxIdLength: options === null || options === void 0 ? void 0 : options.autoAckMaxIdLength
-	    });
+	function safeIsFile(data) {
+	  try {
+	    return typeof File !== 'undefined' && data instanceof File;
+	  } catch (_unused) {
+	    return false;
 	  }
-
-	  /**
-	   * Set registerHandlers callback.
-	   *
-	   * This is used by composition-based implementations to define handler bindings.
-	   */
-	  setRegisterHandlers(fn) {
-	    this.registerHandlersFn = fn;
+	}
+	function safeIsBlob(data) {
+	  try {
+	    return typeof Blob !== 'undefined' && data instanceof Blob;
+	  } catch (_unused2) {
+	    return false;
 	  }
+	}
 
-	  /**
-	   * Register a dispatcher handler and track its unregister function.
-	   */
-	  registerHandler(matcher, handler, options) {
-	    this.hooks.registerHandler.call(matcher);
-	    var unreg = this.messageDispatcher.registerHandler(matcher, handler, options);
-	    this.unregisterFns.push(unreg);
-	    return unreg;
+	/**
+	 * RequestIframeEndpointOutbox
+	 *
+	 * A lightweight "built-in sender" bound to a fixed peer (targetWindow/targetOrigin).
+	 * Used by request/response-side objects to send messages without repeatedly passing
+	 * targetWindow/targetOrigin.
+	 */
+	class RequestIframeEndpointOutbox {
+	  constructor(dispatcher, targetWindow, targetOrigin, defaultTargetId) {
+	    _defineProperty(this, "hooks", {
+	      beforeSendRaw: new SyncHook(),
+	      afterSendRaw: new SyncHook(),
+	      sendRawError: new SyncHook(),
+	      beforeSendMessage: new SyncHook(),
+	      afterSendMessage: new SyncHook(),
+	      sendMessageError: new SyncHook()
+	    });
+	    this.dispatcher = dispatcher;
+	    this.targetWindow = targetWindow;
+	    this.targetOrigin = targetOrigin;
+	    this.defaultTargetId = defaultTargetId;
+	  }
+	  setDefaultTargetId(targetId) {
+	    this.defaultTargetId = targetId;
+	  }
+	  get secretKey() {
+	    return this.dispatcher.secretKey;
+	  }
+	  get channel() {
+	    return this.dispatcher.getChannel();
+	  }
+	  runWithHooks(hooks, fn) {
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
+	      var result, _t;
+	      return _regeneratorRuntime.wrap(function (_context) {
+	        while (1) switch (_context.prev = _context.next) {
+	          case 0:
+	            _context.prev = 0;
+	            if (!hooks.before) {
+	              _context.next = 1;
+	              break;
+	            }
+	            _context.next = 1;
+	            return hooks.before();
+	          case 1:
+	            _context.next = 2;
+	            return fn();
+	          case 2:
+	            result = _context.sent;
+	            if (!hooks.end) {
+	              _context.next = 3;
+	              break;
+	            }
+	            _context.next = 3;
+	            return hooks.end(result);
+	          case 3:
+	            return _context.abrupt("return", result);
+	          case 4:
+	            _context.prev = 4;
+	            _t = _context["catch"](0);
+	            if (!hooks.error) {
+	              _context.next = 6;
+	              break;
+	            }
+	            _context.next = 5;
+	            return hooks.error(_t);
+	          case 5:
+	            return _context.abrupt("return", _context.sent);
+	          case 6:
+	            throw _t;
+	          case 7:
+	            _context.prev = 7;
+	            if (!hooks.finally) {
+	              _context.next = 8;
+	              break;
+	            }
+	            _context.next = 8;
+	            return hooks.finally();
+	          case 8:
+	            return _context.finish(7);
+	          case 9:
+	          case "end":
+	            return _context.stop();
+	        }
+	      }, _callee, null, [[0, 4, 7, 9]]);
+	    }))();
 	  }
 
 	  /**
-	   * Create common handler options object.
+	   * Create a stream bind context using this peer's fixed target info.
+	   *
+	   * This helps unify the duplicated `_bind({ targetWindow, targetOrigin, secretKey, channel, ... })` logic
+	   * across client/server response implementations.
 	   */
-	  createHandlerOptions(onVersionError) {
+	  createStreamBindContext(params) {
+	    var _params$targetId;
 	    return {
-	      versionValidator: this.versionValidator,
-	      onVersionError
+	      requestId: params.requestId,
+	      targetWindow: this.targetWindow,
+	      targetOrigin: this.targetOrigin,
+	      secretKey: this.secretKey,
+	      channel: this.channel,
+	      registerStreamHandler: params.registerStreamHandler,
+	      unregisterStreamHandler: params.unregisterStreamHandler,
+	      heartbeat: params.heartbeat,
+	      serverId: params.serverId,
+	      clientId: params.clientId,
+	      targetId: (_params$targetId = params.targetId) !== null && _params$targetId !== void 0 ? _params$targetId : this.defaultTargetId
 	    };
 	  }
 
 	  /**
-	   * Warn once per key.
+	   * Bind and start a writable stream to this peer.
+	   *
+	   * Note:
+	   * - Client-side request-body streams may need to delay `start()` until after REQUEST is sent.
+	   *   For that case, prefer `createStreamBindContext()` + manual `stream.start()`.
 	   */
-	  warnOnce(key, fn) {
-	    if (this.warnOnceKeys.has(key)) return;
-	    this.warnOnceKeys.add(key);
-	    fn();
+	  sendWritableStream(stream, params) {
+	    var _this = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
+	      return _regeneratorRuntime.wrap(function (_context2) {
+	        while (1) switch (_context2.prev = _context2.next) {
+	          case 0:
+	            stream._bind(_this.createStreamBindContext(params));
+	            _context2.next = 1;
+	            return stream.start();
+	          case 1:
+	          case "end":
+	            return _context2.stop();
+	        }
+	      }, _callee2);
+	    }))();
 	  }
 
 	  /**
-	   * Set stream callback (used by client-side stream routing).
+	   * Universal send - dispatch by data type, then call hooks to implement differences.
 	   */
-	  setStreamCallback(callback) {
-	    this.streamCallback = callback;
+	  send(params) {
+	    var _this2 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4() {
+	      return _regeneratorRuntime.wrap(function (_context4) {
+	        while (1) switch (_context4.prev = _context4.next) {
+	          case 0:
+	            return _context4.abrupt("return", _this2.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3() {
+	              var data;
+	              return _regeneratorRuntime.wrap(function (_context3) {
+	                while (1) switch (_context3.prev = _context3.next) {
+	                  case 0:
+	                    data = params.data;
+	                    if (!isIframeWritableStream(data)) {
+	                      _context3.next = 4;
+	                      break;
+	                    }
+	                    if (!params.onStream) {
+	                      _context3.next = 2;
+	                      break;
+	                    }
+	                    _context3.next = 1;
+	                    return params.onStream(data);
+	                  case 1:
+	                    return _context3.abrupt("return", _context3.sent);
+	                  case 2:
+	                    _context3.next = 3;
+	                    return params.onOther(data);
+	                  case 3:
+	                    return _context3.abrupt("return", _context3.sent);
+	                  case 4:
+	                    if (!(safeIsFile(data) || safeIsBlob(data))) {
+	                      _context3.next = 8;
+	                      break;
+	                    }
+	                    if (!params.onFileOrBlob) {
+	                      _context3.next = 6;
+	                      break;
+	                    }
+	                    _context3.next = 5;
+	                    return params.onFileOrBlob(data);
+	                  case 5:
+	                    return _context3.abrupt("return", _context3.sent);
+	                  case 6:
+	                    _context3.next = 7;
+	                    return params.onOther(data);
+	                  case 7:
+	                    return _context3.abrupt("return", _context3.sent);
+	                  case 8:
+	                    _context3.next = 9;
+	                    return params.onOther(data);
+	                  case 9:
+	                    return _context3.abrupt("return", _context3.sent);
+	                  case 10:
+	                  case "end":
+	                    return _context3.stop();
+	                }
+	              }, _callee3);
+	            }))));
+	          case 1:
+	          case "end":
+	            return _context4.stop();
+	        }
+	      }, _callee4);
+	    }))();
 	  }
-
-	  /**
-	   * Get stream callback (used by handler registration side).
-	   */
-	  getStreamCallback() {
-	    return this.streamCallback;
+	  runStreamSend(params) {
+	    var _this3 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5() {
+	      var resultPromise, result;
+	      return _regeneratorRuntime.wrap(function (_context5) {
+	        while (1) switch (_context5.prev = _context5.next) {
+	          case 0:
+	            params.stream._bind(_this3.createStreamBindContext(params.bind));
+	            resultPromise = params.beforeStart ? params.beforeStart({
+	              stream: params.stream
+	            }) : undefined;
+	            if (!(params.awaitStart === false)) {
+	              _context5.next = 2;
+	              break;
+	            }
+	            /**
+	             * Fire-and-forget:
+	             * - request-body stream must start after REQUEST is sent (beforeStart is expected to send REQUEST synchronously)
+	             * - we must NOT await the response promise before starting stream, otherwise server will time out waiting stream_start
+	             */
+	            void params.stream.start();
+	            _context5.next = 1;
+	            return resultPromise;
+	          case 1:
+	            return _context5.abrupt("return", _context5.sent);
+	          case 2:
+	            _context5.next = 3;
+	            return resultPromise;
+	          case 3:
+	            result = _context5.sent;
+	            _context5.next = 4;
+	            return params.stream.start();
+	          case 4:
+	            return _context5.abrupt("return", result);
+	          case 5:
+	          case "end":
+	            return _context5.stop();
+	        }
+	      }, _callee5);
+	    }))();
 	  }
 
 	  /**
-	   * Validate origin safely (originValidator wins over origin string).
+	   * Send writable stream via peer.
 	   */
-	  isOriginAllowedBy(contextOrigin, data, context, origin, originValidator) {
-	    if (originValidator) {
-	      try {
-	        return originValidator(contextOrigin, data, context);
-	      } catch (_unused) {
-	        return false;
-	      }
-	    }
-	    if (!origin || origin === OriginConstant.ANY) return true;
-	    return contextOrigin === origin;
+	  sendStream(params) {
+	    var _this4 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee7() {
+	      return _regeneratorRuntime.wrap(function (_context7) {
+	        while (1) switch (_context7.prev = _context7.next) {
+	          case 0:
+	            return _context7.abrupt("return", _this4.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee6() {
+	              return _regeneratorRuntime.wrap(function (_context6) {
+	                while (1) switch (_context6.prev = _context6.next) {
+	                  case 0:
+	                    _context6.next = 1;
+	                    return _this4.runStreamSend(params);
+	                  case 1:
+	                    return _context6.abrupt("return", _context6.sent);
+	                  case 2:
+	                  case "end":
+	                    return _context6.stop();
+	                }
+	              }, _callee6);
+	            }))));
+	          case 1:
+	          case "end":
+	            return _context7.stop();
+	        }
+	      }, _callee7);
+	    }))();
 	  }
 
 	  /**
-	   * Set a fixed peer (fallback target) for cases where MessageEvent.source is missing.
-	   *
-	   * This is useful for "response endpoint" style usage where the peer is already known
-	   * (e.g. a client bound to an iframe window).
+	   * Send File/Blob/string as a file stream via peer.
 	   */
-	  setFallbackTarget(targetWindow, targetOrigin) {
-	    this.messageDispatcher.setFallbackTarget(targetWindow, targetOrigin);
+	  sendFile(params) {
+	    var _this5 = this;
+	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee9() {
+	      return _regeneratorRuntime.wrap(function (_context9) {
+	        while (1) switch (_context9.prev = _context9.next) {
+	          case 0:
+	            return _context9.abrupt("return", _this5.runWithHooks(params, /*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee8() {
+	              var _params$onFileInfo;
+	              var stream;
+	              return _regeneratorRuntime.wrap(function (_context8) {
+	                while (1) switch (_context8.prev = _context8.next) {
+	                  case 0:
+	                    _context8.next = 1;
+	                    return IframeFileWritableStream.from({
+	                      content: params.content,
+	                      fileName: params.fileName,
+	                      mimeType: params.mimeType,
+	                      chunked: params.chunked,
+	                      chunkSize: params.chunkSize,
+	                      autoResolve: params.autoResolve,
+	                      defaultFileName: params.defaultFileName,
+	                      defaultMimeType: params.defaultMimeType
+	                    });
+	                  case 1:
+	                    stream = _context8.sent;
+	                    _context8.next = 2;
+	                    return (_params$onFileInfo = params.onFileInfo) === null || _params$onFileInfo === void 0 ? void 0 : _params$onFileInfo.call(params, {
+	                      fileName: stream.filename,
+	                      mimeType: stream.mimeType
+	                    });
+	                  case 2:
+	                    _context8.next = 3;
+	                    return _this5.runStreamSend(_objectSpread$6(_objectSpread$6({}, params.stream), {}, {
+	                      stream: stream
+	                    }));
+	                  case 3:
+	                    return _context8.abrupt("return", _context8.sent);
+	                  case 4:
+	                  case "end":
+	                    return _context8.stop();
+	                }
+	              }, _callee8);
+	            }))));
+	          case 1:
+	          case "end":
+	            return _context9.stop();
+	        }
+	      }, _callee9);
+	    }))();
 	  }
 
 	  /**
-	   * Create a peer-bound outbox using this hub's dispatcher.
+	   * Send typed message with peer pre-bound.
 	   */
-	  createOutbox(targetWindow, targetOrigin, defaultTargetId) {
-	    return new RequestIframeEndpointOutbox(this.messageDispatcher, targetWindow, targetOrigin, defaultTargetId);
+	  sendMessage(type, requestId, data) {
+	    var payload = _objectSpread$6({}, data || {});
+	    if (payload.targetId === undefined && this.defaultTargetId !== undefined) {
+	      payload.targetId = this.defaultTargetId;
+	    }
+	    this.hooks.beforeSendMessage.call(type, requestId, payload);
+	    try {
+	      var _ok = this.dispatcher.sendMessage(this.targetWindow, this.targetOrigin, type, requestId, payload);
+	      this.hooks.afterSendMessage.call(type, requestId, payload, _ok);
+	      return _ok;
+	    } catch (e) {
+	      this.hooks.sendMessageError.call(type, requestId, payload, e);
+	      throw e;
+	    }
 	  }
 
 	  /**
-	   * Open message processing (register message handlers)
+	   * Send raw message with peer pre-bound.
 	   */
-	  open() {
-	    if (this._isOpen) return;
-	    this.hooks.beforeOpen.call();
-	    this._isOpen = true;
-	    if (!this.registerHandlersFn) {
-	      throw new Error(Messages.HUB_REGISTER_HANDLERS_NOT_SET);
+	  sendRaw(message) {
+	    this.hooks.beforeSendRaw.call(message);
+	    try {
+	      var _ok2 = this.dispatcher.send(this.targetWindow, message, this.targetOrigin);
+	      this.hooks.afterSendRaw.call(message, _ok2);
+	      return _ok2;
+	    } catch (e) {
+	      this.hooks.sendRawError.call(message, e);
+	      throw e;
 	    }
-	    this.registerHandlersFn();
-	    this.hooks.afterOpen.call();
 	  }
+	}
 
+	/**
+	 * Pending manager for maps and timers.
+	 *
+	 * - Track all pending maps created by hub
+	 * - Track all timeouts created by hub
+	 * - Provide a unified cleanup when destroying
+	 */
+	class RequestIframePendingManager {
+	  constructor() {
+	    _defineProperty(this, "maps", new Map());
+	    _defineProperty(this, "timeouts", new Set());
+	  }
 	  /**
-	   * Close message processing (unregister message handlers, but don't release channel)
+	   * Get or create a named pending map that will be auto-cleared on destroy.
 	   */
-	  close() {
-	    if (!this._isOpen) return;
-	    this.hooks.beforeClose.call();
-	    this._isOpen = false;
-
-	    /** Unregister all handlers */
-	    this.unregisterFns.forEach(fn => fn());
-	    this.unregisterFns.length = 0;
-	    this.hooks.unregisterHandler.call();
-	    this.hooks.afterClose.call();
+	  map(name) {
+	    var existing = this.maps.get(name);
+	    if (existing) return existing;
+	    var m = new Map();
+	    this.maps.set(name, m);
+	    return m;
+	  }
+	  get(name, key) {
+	    return this.map(name).get(key);
+	  }
+	  set(name, key, value) {
+	    this.map(name).set(key, value);
+	  }
+	  has(name, key) {
+	    return this.map(name).has(key);
+	  }
+	  delete(name, key) {
+	    return this.map(name).delete(key);
 	  }
 
 	  /**
-	   * Whether it is open
+	   * Create a timeout that will be auto-cleared on destroy.
 	   */
-	  get isOpen() {
-	    return this._isOpen;
+	  setTimeout(fn, ms) {
+	    var id = setTimeout(() => {
+	      this.timeouts.delete(id);
+	      fn();
+	    }, ms);
+	    this.timeouts.add(id);
+	    return id;
 	  }
 
 	  /**
-	   * Get secretKey
+	   * Clear a tracked timeout.
 	   */
-	  get secretKey() {
-	    return this.messageDispatcher.secretKey;
+	  clearTimeout(id) {
+	    clearTimeout(id);
+	    this.timeouts.delete(id);
 	  }
 
 	  /**
-	   * Destroy (close and release channel reference)
+	   * Clear all tracked pending maps and timeouts.
 	   */
-	  destroy() {
-	    this.hooks.beforeDestroy.call();
-	    /** Close first */
-	    this.close();
-
-	    /** Clear all pending maps and timeouts */
-	    this.pending.clearAll();
-	    this.warnOnceKeys.clear();
-	    this.streamCallback = undefined;
-
-	    /** Destroy dispatcher and release channel reference */
-	    this.messageDispatcher.destroy();
-	    releaseMessageChannel(this.messageDispatcher.getChannel());
-	    this.hooks.afterDestroy.call();
+	  clearAll() {
+	    this.timeouts.forEach(id => clearTimeout(id));
+	    this.timeouts.clear();
+	    this.maps.forEach(m => m.clear());
 	  }
 	}
 
 	/**
-	 * Create a PING responder handler (reply PONG).
+	 * Generic counter/limiter utilities (built on hub.pending maps).
 	 *
-	 * This is a shared building block for both client/server endpoints.
+	 * This is intended as a shared infrastructure for both client/server:
+	 * - server can limit max concurrent in-flight requests per client
+	 * - client can limit max concurrent streams / in-flight sends in future
 	 */
-	function createPingResponder(params) {
-	  var hub = params.hub,
-	    handledBy = params.handledBy,
-	    includeTargetId = params.includeTargetId;
-	  return (data, context) => {
-	    if (!context.source) return;
-	    /** Mark accepted so MessageDispatcher can auto-send ACK when requireAck === true */
-	    context.markAcceptedBy(handledBy);
-	    /** Reply PONG */
-	    hub.messageDispatcher.sendMessage(context.source, context.origin, MessageType.PONG, data.requestId, includeTargetId ? {
-	      targetId: data.creatorId
-	    } : undefined);
-	  };
+	class RequestIframeLimiter {
+	  constructor(pending) {
+	    this.pending = pending;
+	  }
+	  get(bucket, key) {
+	    var _this$pending$get;
+	    return (_this$pending$get = this.pending.get(bucket, key)) !== null && _this$pending$get !== void 0 ? _this$pending$get : 0;
+	  }
+
+	  /**
+	   * Try acquire one permit for the given key.
+	   * Returns true if acquired, false if limit reached.
+	   */
+	  tryAcquire(bucket, key, limit) {
+	    if (!Number.isFinite(limit)) {
+	      /** Treat Infinity as always allowed but still count for symmetry */
+	      var next = this.get(bucket, key) + 1;
+	      this.pending.set(bucket, key, next);
+	      return true;
+	    }
+	    var current = this.get(bucket, key);
+	    if (current >= limit) return false;
+	    this.pending.set(bucket, key, current + 1);
+	    return true;
+	  }
+
+	  /**
+	   * Release one permit for the given key.
+	   */
+	  release(bucket, key) {
+	    var current = this.get(bucket, key);
+	    var next = current - 1;
+	    if (next <= 0) {
+	      this.pending.delete(bucket, key);
+	      return;
+	    }
+	    this.pending.set(bucket, key, next);
+	  }
 	}
 
 	/**
-	 * Pending request awaiting response
+	 * Shared options for endpoint hub.
 	 */
 
 	/**
-	 * RequestIframeEndpointInbox
+	 * RequestIframeEndpointHub
 	 *
-	 * The endpoint "inbox" is responsible for handling inbound framework messages and
-	 * driving pending request resolution by requestId.
+	 * Endpoint "hub" responsible for:
+	 * - MessageDispatcher lifecycle
+	 * - handler registration/unregistration
+	 * - pending + timeout management
+	 * - limiter counters
+	 */
+	class RequestIframeEndpointHub {
+	  constructor(role, instanceId, options) {
+	    var _options$versionValid;
+	    _defineProperty(this, "hooks", {
+	      beforeOpen: new SyncHook(),
+	      afterOpen: new SyncHook(),
+	      beforeClose: new SyncHook(),
+	      afterClose: new SyncHook(),
+	      beforeDestroy: new SyncHook(),
+	      afterDestroy: new SyncHook(),
+	      registerHandler: new SyncHook(),
+	      unregisterHandler: new SyncHook()
+	    });
+	    _defineProperty(this, "pending", new RequestIframePendingManager());
+	    _defineProperty(this, "limiter", new RequestIframeLimiter(this.pending));
+	    _defineProperty(this, "unregisterFns", []);
+	    _defineProperty(this, "warnOnceKeys", new Set());
+	    /** Whether it is open */
+	    _defineProperty(this, "_isOpen", false);
+	    this.instanceId = instanceId;
+	    this.versionValidator = (_options$versionValid = options === null || options === void 0 ? void 0 : options.versionValidator) !== null && _options$versionValid !== void 0 ? _options$versionValid : isCompatibleVersion;
+
+	    /** Get or create shared channel and create dispatcher */
+	    var channel = getOrCreateMessageChannel(options === null || options === void 0 ? void 0 : options.secretKey);
+	    this.messageDispatcher = new MessageDispatcher(channel, role, instanceId);
+	    this.messageDispatcher.setAutoAckLimits({
+	      maxMetaLength: options === null || options === void 0 ? void 0 : options.autoAckMaxMetaLength,
+	      maxIdLength: options === null || options === void 0 ? void 0 : options.autoAckMaxIdLength
+	    });
+	  }
+
+	  /**
+	   * Set registerHandlers callback.
+	   *
+	   * This is used by composition-based implementations to define handler bindings.
+	   */
+	  setRegisterHandlers(fn) {
+	    this.registerHandlersFn = fn;
+	  }
+
+	  /**
+	   * Register a dispatcher handler and track its unregister function.
+	   */
+	  registerHandler(matcher, handler, options) {
+	    this.hooks.registerHandler.call(matcher);
+	    var unreg = this.messageDispatcher.registerHandler(matcher, handler, options);
+	    this.unregisterFns.push(unreg);
+	    return unreg;
+	  }
+
+	  /**
+	   * Create common handler options object.
+	   */
+	  createHandlerOptions(onVersionError) {
+	    return {
+	      versionValidator: this.versionValidator,
+	      onVersionError
+	    };
+	  }
+
+	  /**
+	   * Warn once per key.
+	   */
+	  warnOnce(key, fn) {
+	    if (this.warnOnceKeys.has(key)) return;
+	    this.warnOnceKeys.add(key);
+	    fn();
+	  }
+
+	  /**
+	   * Set stream callback (used by client-side stream routing).
+	   */
+	  setStreamCallback(callback) {
+	    this.streamCallback = callback;
+	  }
+
+	  /**
+	   * Get stream callback (used by handler registration side).
+	   */
+	  getStreamCallback() {
+	    return this.streamCallback;
+	  }
+
+	  /**
+	   * Validate origin safely (originValidator wins over origin string).
+	   */
+	  isOriginAllowedBy(contextOrigin, data, context, origin, originValidator) {
+	    if (originValidator) {
+	      try {
+	        return originValidator(contextOrigin, data, context);
+	      } catch (_unused) {
+	        return false;
+	      }
+	    }
+	    if (!origin || origin === OriginConstant.ANY) return true;
+	    return contextOrigin === origin;
+	  }
+
+	  /**
+	   * Set a fixed peer (fallback target) for cases where MessageEvent.source is missing.
+	   *
+	   * This is useful for "response endpoint" style usage where the peer is already known
+	   * (e.g. a client bound to an iframe window).
+	   */
+	  setFallbackTarget(targetWindow, targetOrigin) {
+	    this.messageDispatcher.setFallbackTarget(targetWindow, targetOrigin);
+	  }
+
+	  /**
+	   * Create a peer-bound outbox using this hub's dispatcher.
+	   */
+	  createOutbox(targetWindow, targetOrigin, defaultTargetId) {
+	    return new RequestIframeEndpointOutbox(this.messageDispatcher, targetWindow, targetOrigin, defaultTargetId);
+	  }
+
+	  /**
+	   * Open message processing (register message handlers)
+	   */
+	  open() {
+	    if (this._isOpen) return;
+	    this.hooks.beforeOpen.call();
+	    this._isOpen = true;
+	    if (!this.registerHandlersFn) {
+	      throw new Error(Messages.HUB_REGISTER_HANDLERS_NOT_SET);
+	    }
+	    this.registerHandlersFn();
+	    this.hooks.afterOpen.call();
+	  }
+
+	  /**
+	   * Close message processing (unregister message handlers, but don't release channel)
+	   */
+	  close() {
+	    if (!this._isOpen) return;
+	    this.hooks.beforeClose.call();
+	    this._isOpen = false;
+
+	    /** Unregister all handlers */
+	    this.unregisterFns.forEach(fn => fn());
+	    this.unregisterFns.length = 0;
+	    this.hooks.unregisterHandler.call();
+	    this.hooks.afterClose.call();
+	  }
+
+	  /**
+	   * Whether it is open
+	   */
+	  get isOpen() {
+	    return this._isOpen;
+	  }
+
+	  /**
+	   * Get secretKey
+	   */
+	  get secretKey() {
+	    return this.messageDispatcher.secretKey;
+	  }
+
+	  /**
+	   * Destroy (close and release channel reference)
+	   */
+	  destroy() {
+	    this.hooks.beforeDestroy.call();
+	    /** Close first */
+	    this.close();
+
+	    /** Clear all pending maps and timeouts */
+	    this.pending.clearAll();
+	    this.warnOnceKeys.clear();
+	    this.streamCallback = undefined;
+
+	    /** Destroy dispatcher and release channel reference */
+	    this.messageDispatcher.destroy();
+	    releaseMessageChannel(this.messageDispatcher.getChannel());
+	    this.hooks.afterDestroy.call();
+	  }
+	}
+
+	/**
+	 * Create a PING responder handler (reply PONG).
+	 *
+	 * This is a shared building block for both client/server endpoints.
+	 */
+	function createPingResponder(params) {
+	  var hub = params.hub,
+	    handledBy = params.handledBy,
+	    includeTargetId = params.includeTargetId;
+	  return (data, context) => {
+	    if (!context.source) return;
+	    /** Mark accepted so MessageDispatcher can auto-send ACK when requireAck === true */
+	    context.markAcceptedBy(handledBy);
+	    /** Reply PONG */
+	    hub.messageDispatcher.sendMessage(context.source, context.origin, MessageType.PONG, data.requestId, includeTargetId ? {
+	      targetId: data.creatorId
+	    } : undefined);
+	  };
+	}
+
+	/**
+	 * Minimal "warnOnce host" interface.
+	 *
+	 * Why:
+	 * - We want to reuse the hub-level warnOnce mechanism without importing endpoint internals here.
+	 */
+
+	/**
+	 * Warn when using `targetOrigin="*"` for Window targets without any incoming origin validation.
+	 *
+	 * Why:
+	 * - For `Window` targets, default `targetOrigin` is '*'.
+	 * - If user does not configure `allowedOrigins` / `validateOrigin`, origin validation is effectively disabled.
+	 * - This is a best-practice/security warning and is logged once (INFO level) to avoid noise.
+	 */
+	function warnUnsafeTargetOriginForWindow(params) {
+	  if (params.isIframeTarget) return;
+	  if (params.targetOrigin !== OriginConstant.ANY) return;
+	  if (params.allowedOrigins || params.validateOrigin) return;
+	  logger.once(LogLevel.INFO, buildWarnOnceKey(WarnOnceKey.TARGET_ORIGIN_ANY_WITHOUT_ORIGIN_VALIDATION), '[Security] targetOrigin is "*" for Window targets and no allowedOrigins/validateOrigin is configured. ' + 'Consider setting a strict targetOrigin and allowedOrigins/validateOrigin.');
+	}
+
+	/**
+	 * Warn once when a client-side endpoint is already closed/destroyed and an inbound message arrives
+	 * without a matching pending request.
+	 *
+	 * This is a debugging hint (warn level) because it often indicates lifecycle issues:
+	 * - the client/server instance was recreated/unmounted before the response arrived
+	 */
+	function warnClientServerIgnoredMessageWhenClosedOnce(host, params) {
+	  host.warnOnce(buildWarnOnceKey(WarnOnceKey.INBOX_MISSING_PENDING_WHEN_CLOSED, params.requestId), () => {
+	    logger.warn(formatMessage(Messages.CLIENT_SERVER_IGNORED_MESSAGE_WHEN_CLOSED, params.type, params.requestId));
+	  });
+	}
+
+	/**
+	 * Warn once when a server-side endpoint is already closed/destroyed and it receives a message
+	 * that cannot be matched to a pending waiter (e.g. ack/pong/stream control frames).
+	 */
+	function warnServerIgnoredMessageWhenClosedOnce(host, params) {
+	  host.warnOnce(buildWarnOnceKey(WarnOnceKey.SERVER_MISSING_PENDING_WHEN_CLOSED, params.type, params.requestId), () => {
+	    logger.warn(formatMessage(Messages.SERVER_IGNORED_MESSAGE_WHEN_CLOSED, params.type, params.requestId));
+	  });
+	}
+
+	/**
+	 * Pending request awaiting response
+	 */
+
+	/**
+	 * RequestIframeEndpointInbox
+	 *
+	 * The endpoint "inbox" is responsible for handling inbound framework messages and
+	 * driving pending request resolution by requestId.
 	 *
 	 * - Registers dispatcher handlers for ACK/ASYNC/RESPONSE/ERROR/STREAM_START + PING/PONG
 	 * - Manages pending requests via hub.pending
@@ -15359,8 +15706,9 @@
 	       */
 	      if (!this.hub.isOpen) {
 	        this.hooks.missingPending.call(data, context);
-	        this.hub.warnOnce(buildWarnOnceKey(WarnOnceKey.INBOX_MISSING_PENDING_WHEN_CLOSED, data.requestId), () => {
-	          requestIframeLog('warn', formatMessage(Messages.CLIENT_SERVER_IGNORED_MESSAGE_WHEN_CLOSED, data.type, data.requestId));
+	        warnClientServerIgnoredMessageWhenClosedOnce(this.hub, {
+	          type: data.type,
+	          requestId: data.requestId
 	        });
 	      }
 	      return;
@@ -15453,8 +15801,8 @@
 	  return isAckMatch(expectedAck, receivedAck);
 	}
 
-	function ownKeys$4(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$4(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$4(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$4(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$5(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$5(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$5(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$5(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 	/**
 	 * Endpoint Stream integration layer (`src/endpoint/stream`)
 	 *
@@ -15497,7 +15845,7 @@
 	      context.markAcceptedBy(this.handledBy);
 	    }
 	    var messageType = data.type.replace('stream_', '');
-	    handler(_objectSpread$4(_objectSpread$4({}, body), {}, {
+	    handler(_objectSpread$5(_objectSpread$5({}, body), {}, {
 	      type: messageType
 	    }));
 	  }
@@ -16134,87 +16482,18 @@
 	  };
 	}
 
-	var es_string_match = {};
-
-	var hasRequiredEs_string_match;
-
-	function requireEs_string_match () {
-		if (hasRequiredEs_string_match) return es_string_match;
-		hasRequiredEs_string_match = 1;
-		var call = requireFunctionCall();
-		var uncurryThis = requireFunctionUncurryThis();
-		var fixRegExpWellKnownSymbolLogic = requireFixRegexpWellKnownSymbolLogic();
-		var anObject = requireAnObject();
-		var isObject = requireIsObject();
-		var toLength = requireToLength();
-		var toString = requireToString();
-		var requireObjectCoercible = requireRequireObjectCoercible();
-		var getMethod = requireGetMethod();
-		var advanceStringIndex = requireAdvanceStringIndex();
-		var getRegExpFlags = requireRegexpGetFlags();
-		var regExpExec = requireRegexpExecAbstract();
-
-		var stringIndexOf = uncurryThis(''.indexOf);
-
-		// @@match logic
-		fixRegExpWellKnownSymbolLogic('match', function (MATCH, nativeMatch, maybeCallNative) {
-		  return [
-		    // `String.prototype.match` method
-		    // https://tc39.es/ecma262/#sec-string.prototype.match
-		    function match(regexp) {
-		      var O = requireObjectCoercible(this);
-		      var matcher = isObject(regexp) ? getMethod(regexp, MATCH) : undefined;
-		      return matcher ? call(matcher, regexp, O) : new RegExp(regexp)[MATCH](toString(O));
-		    },
-		    // `RegExp.prototype[@@match]` method
-		    // https://tc39.es/ecma262/#sec-regexp.prototype-@@match
-		    function (string) {
-		      var rx = anObject(this);
-		      var S = toString(string);
-		      var res = maybeCallNative(nativeMatch, rx, S);
-
-		      if (res.done) return res.value;
-
-		      var flags = toString(getRegExpFlags(rx));
-
-		      if (stringIndexOf(flags, 'g') === -1) return regExpExec(rx, S);
-
-		      var fullUnicode = stringIndexOf(flags, 'u') !== -1;
-		      rx.lastIndex = 0;
-		      var A = [];
-		      var n = 0;
-		      var result;
-		      while ((result = regExpExec(rx, S)) !== null) {
-		        var matchStr = toString(result[0]);
-		        A[n] = matchStr;
-		        if (matchStr === '') rx.lastIndex = advanceStringIndex(S, toLength(rx.lastIndex), fullUnicode);
-		        n++;
-		      }
-		      return n === 0 ? null : A;
-		    }
-		  ];
-		});
-		return es_string_match;
-	}
-
-	requireEs_string_match();
-
-	/**
-	 * Endpoint Stream integration layer (`src/endpoint/stream`)
-	 *
-	 * This directory integrates postMessage `stream_*` messages with the stream object system in `src/stream`:
-	 * - Endpoint-side file stream utilities (e.g. choose filename from header/metadata and auto-resolve)
-	 * - Does NOT implement the stream protocol itself (protocol lives in `src/stream`)
-	 *
-	 * Parse filename from Content-Disposition header.
-	 */
-	function parseFilenameFromContentDisposition(value) {
-	  if (!value) return undefined;
-	  var disposition = typeof value === 'string' ? value : value[0];
-	  if (!disposition) return undefined;
-	  var match = disposition.match(/filename="?([^"]+)"?/i);
-	  return match ? match[1] : undefined;
-	}
+	/**
+	 * Endpoint Stream integration layer (`src/endpoint/stream`)
+	 *
+	 * This directory integrates postMessage `stream_*` messages with the stream object system in `src/stream`:
+	 * - Endpoint-side file stream utilities (e.g. choose filename from header/metadata and auto-resolve)
+	 * - Does NOT implement the stream protocol itself (protocol lives in `src/stream`)
+	 *
+	 * Parse filename from Content-Disposition header.
+	 */
+	function parseFilenameFromContentDisposition(value) {
+	  return IframeFileReadableStream.parseFilenameFromContentDisposition(value);
+	}
 
 	/**
 	 * Auto resolve a file readable stream to File/Blob.
@@ -16228,7 +16507,12 @@
 	  var _params$headers, _params$info;
 	  var headerFilename = parseFilenameFromContentDisposition((_params$headers = params.headers) === null || _params$headers === void 0 ? void 0 : _params$headers[HttpHeader.CONTENT_DISPOSITION]);
 	  var fileName = headerFilename || ((_params$info = params.info) === null || _params$info === void 0 || (_params$info = _params$info.metadata) === null || _params$info === void 0 ? void 0 : _params$info.filename) || params.fileStream.filename;
-	  return fileName ? params.fileStream.readAsFile(fileName) : params.fileStream.readAsBlob();
+	  var anyStream = params.fileStream;
+	  if (typeof anyStream.readAsFileOrBlob === 'function') {
+	    return anyStream.readAsFileOrBlob(fileName);
+	  }
+	  // Backward-compatible fallback for mocks/older stream objects
+	  return fileName ? anyStream.readAsFile(fileName) : anyStream.readAsBlob();
 	}
 
 	/**
@@ -16453,8 +16737,8 @@
 
 	requireEs_string_trim();
 
-	function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$4(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$4(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$4(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$4(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 	function _createForOfIteratorHelper$2(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$2(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
 	function _unsupportedIterableToArray$2(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$2(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$2(r, a) : void 0; } }
 	function _arrayLikeToArray$2(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
@@ -16724,7 +17008,7 @@
 	    var result = [];
 	    this.cookies.forEach(cookie => {
 	      if (!cookie.expires || cookie.expires > now) {
-	        result.push(_objectSpread$3({}, cookie));
+	        result.push(_objectSpread$4({}, cookie));
 	      }
 	    });
 	    return result;
@@ -16887,8 +17171,8 @@
 	function _createForOfIteratorHelper$1(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$1(r)) || e) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: true } : { done: false, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = true, u = false; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = true, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
 	function _unsupportedIterableToArray$1(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$1(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$1(r, a) : void 0; } }
 	function _arrayLikeToArray$1(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
-	function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Client configuration options
@@ -17112,7 +17396,7 @@
 	      return _regeneratorRuntime.wrap(function (_context) {
 	        while (1) switch (_context.prev = _context.next) {
 	          case 0:
-	            config = _objectSpread$2({
+	            config = _objectSpread$3({
 	              path,
 	              body
 	            }, options);
@@ -17155,12 +17439,12 @@
 	  sendFile(path, content, options) {
 	    var _this2 = this;
 	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2() {
-	      var _processedConfig$requ2, _processedConfig$targ, _options$autoResolve;
+	      var _processedConfig$requ2, _processedConfig$targ, _options$chunked, _options$autoResolve;
 	      var config, processedConfig, requestId, targetId, processedPath, mergedHeaders, pathMatchedCookies, mergedCookies, streamConfig;
 	      return _regeneratorRuntime.wrap(function (_context2) {
 	        while (1) switch (_context2.prev = _context2.next) {
 	          case 0:
-	            config = _objectSpread$2({
+	            config = _objectSpread$3({
 	              path,
 	              body: undefined
 	            }, options);
@@ -17173,15 +17457,16 @@
 	            processedPath = processedConfig.path;
 	            mergedHeaders = _this2.mergeHeaders(processedConfig, undefined);
 	            pathMatchedCookies = _this2._cookieStore.getForPath(processedPath);
-	            mergedCookies = _objectSpread$2(_objectSpread$2({}, pathMatchedCookies), processedConfig.cookies);
-	            streamConfig = _objectSpread$2(_objectSpread$2({}, processedConfig), {}, {
+	            mergedCookies = _objectSpread$3(_objectSpread$3({}, pathMatchedCookies), processedConfig.cookies);
+	            streamConfig = _objectSpread$3(_objectSpread$3({}, processedConfig), {}, {
 	              requestId
 	            });
 	            return _context2.abrupt("return", _this2.outbox.sendFile({
 	              content,
 	              fileName: options === null || options === void 0 ? void 0 : options.fileName,
 	              mimeType: options === null || options === void 0 ? void 0 : options.mimeType,
-	              chunked: false,
+	              chunked: (_options$chunked = options === null || options === void 0 ? void 0 : options.chunked) !== null && _options$chunked !== void 0 ? _options$chunked : false,
+	              chunkSize: options === null || options === void 0 ? void 0 : options.chunkSize,
 	              autoResolve: (_options$autoResolve = options === null || options === void 0 ? void 0 : options.autoResolve) !== null && _options$autoResolve !== void 0 ? _options$autoResolve : true,
 	              defaultFileName: typeof File !== 'undefined' && content instanceof File ? content.name : 'file',
 	              defaultMimeType: 'application/octet-stream',
@@ -17224,7 +17509,7 @@
 	      return _regeneratorRuntime.wrap(function (_context3) {
 	        while (1) switch (_context3.prev = _context3.next) {
 	          case 0:
-	            config = _objectSpread$2({
+	            config = _objectSpread$3({
 	              path,
 	              body: undefined
 	            }, options);
@@ -17237,8 +17522,8 @@
 	            processedPath = processedConfig.path;
 	            mergedHeaders = _this3.mergeHeaders(processedConfig, undefined);
 	            pathMatchedCookies = _this3._cookieStore.getForPath(processedPath);
-	            mergedCookies = _objectSpread$2(_objectSpread$2({}, pathMatchedCookies), processedConfig.cookies);
-	            streamConfig = _objectSpread$2(_objectSpread$2({}, processedConfig), {}, {
+	            mergedCookies = _objectSpread$3(_objectSpread$3({}, pathMatchedCookies), processedConfig.cookies);
+	            streamConfig = _objectSpread$3(_objectSpread$3({}, processedConfig), {}, {
 	              requestId
 	            });
 	            return _context3.abrupt("return", _this3.outbox.sendStream({
@@ -17512,7 +17797,7 @@
 
 	      // Get cookies matching request path and merge with user-provided cookies (user-provided takes precedence)
 	      var pathMatchedCookies = this._cookieStore.getForPath(requestPath);
-	      var mergedCookies = _objectSpread$2(_objectSpread$2({}, pathMatchedCookies), processedCookies);
+	      var mergedCookies = _objectSpread$3(_objectSpread$3({}, pathMatchedCookies), processedCookies);
 
 	      // Send request via MessageDispatcher
 	      var payload = {
@@ -17654,555 +17939,512 @@
 	  }
 	}
 
-	function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
-	function logEvent(level, event, message, data) {
-	  if (data !== undefined && data !== null && typeof data === 'object') {
-	    requestIframeLog(level, message, _objectSpread$1({
-	      event
-	    }, data));
-	    return;
-	  }
-	  requestIframeLog(level, message, data === undefined ? {
-	    event
-	  } : {
-	    event,
-	    data
-	  });
-	}
+	var es_weakMap = {};
 
-	/**
-	 * Format message data for logging (remove sensitive data if needed)
-	 */
-	function formatMessageData(data) {
-	  if (!data) return data;
-	  var formatted = _objectSpread$1({}, data);
+	var es_weakMap_constructor = {};
 
-	  // Limit body size in logs
-	  if (formatted.body && typeof formatted.body === 'object') {
-	    var bodyStr = JSON.stringify(formatted.body);
-	    if (bodyStr.length > 500) {
-	      formatted.body = bodyStr.substring(0, 500) + '... (truncated)';
-	    }
-	  }
+	var collectionWeak;
+	var hasRequiredCollectionWeak;
 
-	  // Limit data size in logs
-	  if (formatted.data && typeof formatted.data === 'object') {
-	    var dataStr = JSON.stringify(formatted.data);
-	    if (dataStr.length > 500) {
-	      formatted.data = dataStr.substring(0, 500) + '... (truncated)';
-	    }
-	  }
-	  return formatted;
-	}
+	function requireCollectionWeak () {
+		if (hasRequiredCollectionWeak) return collectionWeak;
+		hasRequiredCollectionWeak = 1;
+		var uncurryThis = requireFunctionUncurryThis();
+		var defineBuiltIns = requireDefineBuiltIns();
+		var getWeakData = requireInternalMetadata().getWeakData;
+		var anInstance = requireAnInstance();
+		var anObject = requireAnObject();
+		var isNullOrUndefined = requireIsNullOrUndefined();
+		var isObject = requireIsObject();
+		var iterate = requireIterate();
+		var ArrayIterationModule = requireArrayIteration();
+		var hasOwn = requireHasOwnProperty();
+		var InternalStateModule = requireInternalState();
 
-	/**
-	 * Register debug interceptors for client
-	 */
-	function setupClientDebugInterceptors(client) {
-	  ensureRequestIframeLogLevel(LogLevel.INFO);
+		var setInternalState = InternalStateModule.set;
+		var internalStateGetterFor = InternalStateModule.getterFor;
+		var find = ArrayIterationModule.find;
+		var findIndex = ArrayIterationModule.findIndex;
+		var splice = uncurryThis([].splice);
+		var id = 0;
 
-	  // Request interceptor: log request start
-	  client.interceptors.request.use(config => {
-	    logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_START, Messages.DEBUG_CLIENT_REQUEST_START, formatMessageData({
-	      path: config.path,
-	      body: config.body,
-	      headers: config.headers,
-	      cookies: config.cookies,
-	      ackTimeout: config.ackTimeout,
-	      timeout: config.timeout,
-	      asyncTimeout: config.asyncTimeout,
-	      requestId: config.requestId
-	    }));
-	    return config;
-	  });
+		// fallback for uncaught frozen keys
+		var uncaughtFrozenStore = function (state) {
+		  return state.frozen || (state.frozen = new UncaughtFrozenStore());
+		};
 
-	  // Response interceptor: log response success
-	  client.interceptors.response.use(response => {
-	    var logData = {
-	      requestId: response.requestId,
-	      status: response.status,
-	      statusText: response.statusText,
-	      headers: response.headers
-	    };
+		var UncaughtFrozenStore = function () {
+		  this.entries = [];
+		};
 
-	    // Check if response.data is a File or Blob
-	    if (response.data instanceof File || response.data instanceof Blob) {
-	      var file = response.data;
-	      var fileName = file instanceof File ? file.name : undefined;
-	      var mimeType = file.type || undefined;
-	      var contentLength = file.size;
-	      logData.fileData = {
-	        fileName,
-	        mimeType,
-	        contentLength
-	      };
-	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS_FILE, Messages.DEBUG_CLIENT_REQUEST_SUCCESS_FILE, formatMessageData(logData));
-	    } else if (response.stream) {
-	      logData.stream = {
-	        streamId: response.stream.streamId,
-	        type: response.stream.type
-	      };
-	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS_STREAM, Messages.DEBUG_CLIENT_REQUEST_SUCCESS_STREAM, formatMessageData(logData));
-	    } else {
-	      logData.data = response.data;
-	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS, Messages.DEBUG_CLIENT_REQUEST_SUCCESS, formatMessageData(logData));
-	    }
-	    return response;
-	  }, error => {
-	    logEvent(LogLevel.ERROR, DebugEvent.CLIENT_REQUEST_FAILED, Messages.DEBUG_CLIENT_REQUEST_FAILED, formatMessageData({
-	      requestId: error.requestId,
-	      code: error.code,
-	      message: error.message,
-	      config: error.config,
-	      response: error.response
-	    }));
-	    return Promise.reject(error);
-	  });
+		var findUncaughtFrozen = function (store, key) {
+		  return find(store.entries, function (it) {
+		    return it[0] === key;
+		  });
+		};
 
-	  /** Attach hook-based message debugging (no monkey patch). */
-	  var clientImpl = client;
-	  setupClientMessageDebuggingViaHooks(clientImpl);
-	}
+		UncaughtFrozenStore.prototype = {
+		  get: function (key) {
+		    var entry = findUncaughtFrozen(this, key);
+		    if (entry) return entry[1];
+		  },
+		  has: function (key) {
+		    return !!findUncaughtFrozen(this, key);
+		  },
+		  set: function (key, value) {
+		    var entry = findUncaughtFrozen(this, key);
+		    if (entry) entry[1] = value;
+		    else this.entries.push([key, value]);
+		  },
+		  'delete': function (key) {
+		    var index = findIndex(this.entries, function (it) {
+		      return it[0] === key;
+		    });
+		    if (~index) splice(this.entries, index, 1);
+		    return !!~index;
+		  }
+		};
 
-	/**
-	 * Setup message-level debugging for client (hook-based, no monkey patch).
-	 */
-	function setupClientMessageDebuggingViaHooks(clientImpl) {
-	  var _clientImpl$hub, _clientImpl$getHub, _outbox$hooks, _dispatcher$hooks, _inbox$hooks, _dispatcher$hooks2;
-	  var inbox = clientImpl.inbox;
-	  var outbox = clientImpl.outbox;
-	  var dispatcher = ((_clientImpl$hub = clientImpl.hub) === null || _clientImpl$hub === void 0 ? void 0 : _clientImpl$hub.messageDispatcher) || ((_clientImpl$getHub = clientImpl.getHub) === null || _clientImpl$getHub === void 0 || (_clientImpl$getHub = _clientImpl$getHub.call(clientImpl)) === null || _clientImpl$getHub === void 0 ? void 0 : _clientImpl$getHub.messageDispatcher);
+		collectionWeak = {
+		  getConstructor: function (wrapper, CONSTRUCTOR_NAME, IS_MAP, ADDER) {
+		    var Constructor = wrapper(function (that, iterable) {
+		      anInstance(that, Prototype);
+		      setInternalState(that, {
+		        type: CONSTRUCTOR_NAME,
+		        id: id++,
+		        frozen: null
+		      });
+		      if (!isNullOrUndefined(iterable)) iterate(iterable, that[ADDER], { that: that, AS_ENTRIES: IS_MAP });
+		    });
 
-	  /** Outbound */
-	  if (outbox !== null && outbox !== void 0 && (_outbox$hooks = outbox.hooks) !== null && _outbox$hooks !== void 0 && (_outbox$hooks = _outbox$hooks.afterSendMessage) !== null && _outbox$hooks !== void 0 && _outbox$hooks.tap) {
-	    outbox.hooks.afterSendMessage.tap('debug', (type, requestId, data) => {
-	      if (type === MessageType.REQUEST) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_REQUEST, formatMessageData({
-	          requestId,
-	          path: data === null || data === void 0 ? void 0 : data.path,
-	          body: data === null || data === void 0 ? void 0 : data.body,
-	          headers: data === null || data === void 0 ? void 0 : data.headers
-	        }));
-	      } else if (type === MessageType.PING) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_PING, {
-	          requestId
-	        });
-	      } else if (type === MessageType.ACK) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_RECEIVED_ACK, {
-	          requestId
-	        });
-	      }
-	    });
-	  } else if (dispatcher !== null && dispatcher !== void 0 && (_dispatcher$hooks = dispatcher.hooks) !== null && _dispatcher$hooks !== void 0 && (_dispatcher$hooks = _dispatcher$hooks.afterSend) !== null && _dispatcher$hooks !== void 0 && _dispatcher$hooks.tap) {
-	    dispatcher.hooks.afterSend.tap('debug', (_target, _origin, message) => {
-	      if (message.type === MessageType.REQUEST) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_REQUEST, formatMessageData({
-	          requestId: message.requestId,
-	          path: message.path,
-	          body: message.body,
-	          headers: message.headers
-	        }));
-	      }
-	    });
-	  }
+		    var Prototype = Constructor.prototype;
 
-	  /** Inbound */
-	  if (inbox !== null && inbox !== void 0 && (_inbox$hooks = inbox.hooks) !== null && _inbox$hooks !== void 0 && (_inbox$hooks = _inbox$hooks.inbound) !== null && _inbox$hooks !== void 0 && _inbox$hooks.tap) {
-	    inbox.hooks.inbound.tap('debug', data => {
-	      if (data.type === MessageType.ACK) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ACK, formatMessageData({
-	          requestId: data.requestId,
-	          path: data.path
-	        }));
-	      } else if (data.type === MessageType.ASYNC) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ASYNC, formatMessageData({
-	          requestId: data.requestId,
-	          path: data.path
-	        }));
-	      } else if (data.type === MessageType.STREAM_START) {
-	        var streamBody = data.body;
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_START, formatMessageData({
-	          requestId: data.requestId,
-	          streamId: streamBody === null || streamBody === void 0 ? void 0 : streamBody.streamId,
-	          streamType: streamBody === null || streamBody === void 0 ? void 0 : streamBody.type,
-	          chunked: streamBody === null || streamBody === void 0 ? void 0 : streamBody.chunked,
-	          autoResolve: streamBody === null || streamBody === void 0 ? void 0 : streamBody.autoResolve,
-	          metadata: streamBody === null || streamBody === void 0 ? void 0 : streamBody.metadata
-	        }));
-	      } else if (data.type === MessageType.STREAM_DATA) {
-	        var _streamBody$data;
-	        var _streamBody = data.body;
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_DATA, formatMessageData({
-	          requestId: data.requestId,
-	          streamId: _streamBody === null || _streamBody === void 0 ? void 0 : _streamBody.streamId,
-	          done: _streamBody === null || _streamBody === void 0 ? void 0 : _streamBody.done,
-	          dataLength: (_streamBody === null || _streamBody === void 0 || (_streamBody$data = _streamBody.data) === null || _streamBody$data === void 0 ? void 0 : _streamBody$data.length) || 0
-	        }));
-	      } else if (data.type === MessageType.STREAM_END) {
-	        var _streamBody2 = data.body;
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_END, formatMessageData({
-	          requestId: data.requestId,
-	          streamId: _streamBody2 === null || _streamBody2 === void 0 ? void 0 : _streamBody2.streamId
-	        }));
-	      } else if (data.type === MessageType.RESPONSE) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_RESPONSE, formatMessageData({
-	          requestId: data.requestId,
-	          status: data.status,
-	          statusText: data.statusText,
-	          requireAck: data.requireAck
-	        }));
-	      } else if (data.type === MessageType.ERROR) {
-	        logEvent(LogLevel.ERROR, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ERROR, formatMessageData({
-	          requestId: data.requestId,
-	          status: data.status,
-	          statusText: data.statusText,
-	          error: data.error
-	        }));
-	      }
+		    var getInternalState = internalStateGetterFor(CONSTRUCTOR_NAME);
+
+		    var define = function (that, key, value) {
+		      var state = getInternalState(that);
+		      var data = getWeakData(anObject(key), true);
+		      if (data === true) uncaughtFrozenStore(state).set(key, value);
+		      else data[state.id] = value;
+		      return that;
+		    };
+
+		    defineBuiltIns(Prototype, {
+		      // `{ WeakMap, WeakSet }.prototype.delete(key)` methods
+		      // https://tc39.es/ecma262/#sec-weakmap.prototype.delete
+		      // https://tc39.es/ecma262/#sec-weakset.prototype.delete
+		      'delete': function (key) {
+		        var state = getInternalState(this);
+		        if (!isObject(key)) return false;
+		        var data = getWeakData(key);
+		        if (data === true) return uncaughtFrozenStore(state)['delete'](key);
+		        return data && hasOwn(data, state.id) && delete data[state.id];
+		      },
+		      // `{ WeakMap, WeakSet }.prototype.has(key)` methods
+		      // https://tc39.es/ecma262/#sec-weakmap.prototype.has
+		      // https://tc39.es/ecma262/#sec-weakset.prototype.has
+		      has: function has(key) {
+		        var state = getInternalState(this);
+		        if (!isObject(key)) return false;
+		        var data = getWeakData(key);
+		        if (data === true) return uncaughtFrozenStore(state).has(key);
+		        return data && hasOwn(data, state.id);
+		      }
+		    });
+
+		    defineBuiltIns(Prototype, IS_MAP ? {
+		      // `WeakMap.prototype.get(key)` method
+		      // https://tc39.es/ecma262/#sec-weakmap.prototype.get
+		      get: function get(key) {
+		        var state = getInternalState(this);
+		        if (isObject(key)) {
+		          var data = getWeakData(key);
+		          if (data === true) return uncaughtFrozenStore(state).get(key);
+		          if (data) return data[state.id];
+		        }
+		      },
+		      // `WeakMap.prototype.set(key, value)` method
+		      // https://tc39.es/ecma262/#sec-weakmap.prototype.set
+		      set: function set(key, value) {
+		        return define(this, key, value);
+		      }
+		    } : {
+		      // `WeakSet.prototype.add(value)` method
+		      // https://tc39.es/ecma262/#sec-weakset.prototype.add
+		      add: function add(value) {
+		        return define(this, value, true);
+		      }
+		    });
+
+		    return Constructor;
+		  }
+		};
+		return collectionWeak;
+	}
+
+	var hasRequiredEs_weakMap_constructor;
+
+	function requireEs_weakMap_constructor () {
+		if (hasRequiredEs_weakMap_constructor) return es_weakMap_constructor;
+		hasRequiredEs_weakMap_constructor = 1;
+		var FREEZING = requireFreezing();
+		var globalThis = requireGlobalThis();
+		var uncurryThis = requireFunctionUncurryThis();
+		var defineBuiltIns = requireDefineBuiltIns();
+		var InternalMetadataModule = requireInternalMetadata();
+		var collection = requireCollection();
+		var collectionWeak = requireCollectionWeak();
+		var isObject = requireIsObject();
+		var enforceInternalState = requireInternalState().enforce;
+		var fails = requireFails();
+		var NATIVE_WEAK_MAP = requireWeakMapBasicDetection();
+
+		var $Object = Object;
+		// eslint-disable-next-line es/no-array-isarray -- safe
+		var isArray = Array.isArray;
+		// eslint-disable-next-line es/no-object-isextensible -- safe
+		var isExtensible = $Object.isExtensible;
+		// eslint-disable-next-line es/no-object-isfrozen -- safe
+		var isFrozen = $Object.isFrozen;
+		// eslint-disable-next-line es/no-object-issealed -- safe
+		var isSealed = $Object.isSealed;
+		// eslint-disable-next-line es/no-object-freeze -- safe
+		var freeze = $Object.freeze;
+		// eslint-disable-next-line es/no-object-seal -- safe
+		var seal = $Object.seal;
+
+		var IS_IE11 = !globalThis.ActiveXObject && 'ActiveXObject' in globalThis;
+		var InternalWeakMap;
+
+		var wrapper = function (init) {
+		  return function WeakMap() {
+		    return init(this, arguments.length ? arguments[0] : undefined);
+		  };
+		};
+
+		// `WeakMap` constructor
+		// https://tc39.es/ecma262/#sec-weakmap-constructor
+		var $WeakMap = collection('WeakMap', wrapper, collectionWeak);
+		var WeakMapPrototype = $WeakMap.prototype;
+		var nativeSet = uncurryThis(WeakMapPrototype.set);
+
+		// Chakra Edge bug: adding frozen arrays to WeakMap unfreeze them
+		var hasMSEdgeFreezingBug = function () {
+		  return FREEZING && fails(function () {
+		    var frozenArray = freeze([]);
+		    nativeSet(new $WeakMap(), frozenArray, 1);
+		    return !isFrozen(frozenArray);
+		  });
+		};
+
+		// IE11 WeakMap frozen keys fix
+		// We can't use feature detection because it crash some old IE builds
+		// https://github.com/zloirock/core-js/issues/485
+		if (NATIVE_WEAK_MAP) if (IS_IE11) {
+		  InternalWeakMap = collectionWeak.getConstructor(wrapper, 'WeakMap', true);
+		  InternalMetadataModule.enable();
+		  var nativeDelete = uncurryThis(WeakMapPrototype['delete']);
+		  var nativeHas = uncurryThis(WeakMapPrototype.has);
+		  var nativeGet = uncurryThis(WeakMapPrototype.get);
+		  defineBuiltIns(WeakMapPrototype, {
+		    'delete': function (key) {
+		      if (isObject(key) && !isExtensible(key)) {
+		        var state = enforceInternalState(this);
+		        if (!state.frozen) state.frozen = new InternalWeakMap();
+		        return nativeDelete(this, key) || state.frozen['delete'](key);
+		      } return nativeDelete(this, key);
+		    },
+		    has: function has(key) {
+		      if (isObject(key) && !isExtensible(key)) {
+		        var state = enforceInternalState(this);
+		        if (!state.frozen) state.frozen = new InternalWeakMap();
+		        return nativeHas(this, key) || state.frozen.has(key);
+		      } return nativeHas(this, key);
+		    },
+		    get: function get(key) {
+		      if (isObject(key) && !isExtensible(key)) {
+		        var state = enforceInternalState(this);
+		        if (!state.frozen) state.frozen = new InternalWeakMap();
+		        return nativeHas(this, key) ? nativeGet(this, key) : state.frozen.get(key);
+		      } return nativeGet(this, key);
+		    },
+		    set: function set(key, value) {
+		      if (isObject(key) && !isExtensible(key)) {
+		        var state = enforceInternalState(this);
+		        if (!state.frozen) state.frozen = new InternalWeakMap();
+		        nativeHas(this, key) ? nativeSet(this, key, value) : state.frozen.set(key, value);
+		      } else nativeSet(this, key, value);
+		      return this;
+		    }
+		  });
+		// Chakra Edge frozen keys fix
+		} else if (hasMSEdgeFreezingBug()) {
+		  defineBuiltIns(WeakMapPrototype, {
+		    set: function set(key, value) {
+		      var arrayIntegrityLevel;
+		      if (isArray(key)) {
+		        if (isFrozen(key)) arrayIntegrityLevel = freeze;
+		        else if (isSealed(key)) arrayIntegrityLevel = seal;
+		      }
+		      nativeSet(this, key, value);
+		      if (arrayIntegrityLevel) arrayIntegrityLevel(key);
+		      return this;
+		    }
+		  });
+		}
+		return es_weakMap_constructor;
+	}
+
+	var hasRequiredEs_weakMap;
+
+	function requireEs_weakMap () {
+		if (hasRequiredEs_weakMap) return es_weakMap;
+		hasRequiredEs_weakMap = 1;
+		// TODO: Remove this module from `core-js@4` since it's replaced to module below
+		requireEs_weakMap_constructor();
+		return es_weakMap;
+	}
+
+	requireEs_weakMap();
+
+	/**
+	 * Lazy-load debug helpers (dynamic import) with shared caching.
+	 *
+	 * Why:
+	 * - Avoid eagerly bundling debug wiring into the main bundle.
+	 * - Keep one shared Promise so multiple entry points don't trigger multiple imports.
+	 */
+
+	var debugModulePromise = null;
+	function loadDebugModule() {
+	  if (!debugModulePromise) {
+	    debugModulePromise = Promise.resolve().then(function () { return debug; });
+	  }
+	  return debugModulePromise;
+	}
+	var CLIENT_DEBUG_STATE = new WeakMap();
+	var CLIENT_DEBUG_WRAPPED = Symbol.for('__requestIframeClientDebugWrapped__');
+
+	/**
+	 * Ensure debug interceptors/listeners are attached to a client instance.
+	 *
+	 * Notes:
+	 * - This returns a Promise that never rejects (best-effort).
+	 * - It is safe to call multiple times; only attaches once per client instance.
+	 */
+	function ensureClientDebugInterceptors(client) {
+	  var key = client;
+	  var state = CLIENT_DEBUG_STATE.get(key);
+	  if (!state) {
+	    state = {
+	      promise: null,
+	      attached: false
+	    };
+	    CLIENT_DEBUG_STATE.set(key, state);
+	  }
+	  if (state.attached) return Promise.resolve();
+	  if (!state.promise) {
+	    state.promise = loadDebugModule().then(m => {
+	      if (state.attached) return;
+	      m.setupClientDebugInterceptors(client);
+	      state.attached = true;
+	    }).catch(() => {
+	      /** ignore */
 	    });
-	  } else if (dispatcher !== null && dispatcher !== void 0 && (_dispatcher$hooks2 = dispatcher.hooks) !== null && _dispatcher$hooks2 !== void 0 && (_dispatcher$hooks2 = _dispatcher$hooks2.inbound) !== null && _dispatcher$hooks2 !== void 0 && _dispatcher$hooks2.tap) {
-	    dispatcher.hooks.inbound.tap('debug', data => {
-	      if (data.type === MessageType.ACK) {
-	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ACK, formatMessageData({
-	          requestId: data.requestId,
-	          path: data.path
-	        }));
+	  }
+	  return state.promise;
+	}
+
+	/**
+	 * Wrap client send methods so the first request in trace mode won't miss debug hooks.
+	 *
+	 * Why:
+	 * - debug module is lazy-loaded via dynamic import, so it may not be ready immediately.
+	 * - In trace mode, it's acceptable to delay the first send by a microtask or module-load time.
+	 */
+	function wrapClientMethodsForDebug(client) {
+	  var c = client;
+	  if (c[CLIENT_DEBUG_WRAPPED]) return;
+	  c[CLIENT_DEBUG_WRAPPED] = true;
+	  var wrapAsyncMethod = name => {
+	    var original = c[name];
+	    if (typeof original !== 'function') return;
+	    var bound = original.bind(c);
+	    c[name] = (...args) => {
+	      return ensureClientDebugInterceptors(client).then(() => bound(...args));
+	    };
+	  };
+	  wrapAsyncMethod('send');
+	  wrapAsyncMethod('sendFile');
+	  wrapAsyncMethod('sendStream');
+	  wrapAsyncMethod('isConnect');
+	}
+
+	function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	/**
+	 * Security defaults helper for "strict mode".
+	 *
+	 * Goal:
+	 * - Reduce boilerplate in common same-origin usage.
+	 * - Provide safer defaults when user does NOT configure origin constraints explicitly.
+	 *
+	 * Behavior (when strict === true):
+	 * - Client-like options:
+	 *   - If targetOrigin is not provided, default to window.location.origin (same-origin only).
+	 *   - If neither allowedOrigins nor validateOrigin is provided, default allowedOrigins to [window.location.origin].
+	 * - Server-like options:
+	 *   - If neither allowedOrigins nor validateOrigin is provided, default allowedOrigins to [window.location.origin].
+	 *
+	 * Notes:
+	 * - This intentionally makes cross-origin setups fail fast unless user explicitly configures
+	 *   targetOrigin and allowedOrigins/validateOrigin.
+	 */
+
+	function getCurrentWindowOrigin() {
+	  try {
+	    var _window$location;
+	    if (typeof window === 'undefined') return undefined;
+	    var origin = (_window$location = window.location) === null || _window$location === void 0 ? void 0 : _window$location.origin;
+	    if (typeof origin === 'string' && origin) return origin;
+	  } catch (_unused) {
+	    /** ignore */
+	  }
+	  return undefined;
+	}
+	function applyStrictClientSecurityDefaults(defaultTargetOrigin, options) {
+	  var _options$targetOrigin;
+	  var strict = (options === null || options === void 0 ? void 0 : options.strict) === true;
+	  var targetOrigin = (_options$targetOrigin = options === null || options === void 0 ? void 0 : options.targetOrigin) !== null && _options$targetOrigin !== void 0 ? _options$targetOrigin : defaultTargetOrigin;
+	  var allowedOrigins = options === null || options === void 0 ? void 0 : options.allowedOrigins;
+	  if (strict) {
+	    var currentOrigin = getCurrentWindowOrigin();
+	    if (currentOrigin) {
+	      if (!(options !== null && options !== void 0 && options.targetOrigin)) {
+	        targetOrigin = currentOrigin;
 	      }
-	    });
+	      if (!(options !== null && options !== void 0 && options.allowedOrigins) && !(options !== null && options !== void 0 && options.validateOrigin)) {
+	        allowedOrigins = [currentOrigin];
+	      }
+	    }
+	  }
+	  if (!options) {
+	    return {
+	      targetOrigin,
+	      options: options
+	    };
+	  }
+	  if (targetOrigin === options.targetOrigin && allowedOrigins === options.allowedOrigins) {
+	    return {
+	      targetOrigin,
+	      options
+	    };
+	  }
+	  return {
+	    targetOrigin,
+	    options: _objectSpread$2(_objectSpread$2(_objectSpread$2({}, options), targetOrigin !== options.targetOrigin ? {
+	      targetOrigin
+	    } : null), allowedOrigins !== options.allowedOrigins ? {
+	      allowedOrigins
+	    } : null)
+	  };
+	}
+	function applyStrictServerSecurityDefaults(options) {
+	  var strict = (options === null || options === void 0 ? void 0 : options.strict) === true;
+	  if (!strict) return options;
+	  if (options !== null && options !== void 0 && options.allowedOrigins || options !== null && options !== void 0 && options.validateOrigin) {
+	    return options;
 	  }
+	  var currentOrigin = getCurrentWindowOrigin();
+	  if (!currentOrigin) return options;
+	  return _objectSpread$2(_objectSpread$2({}, options), {}, {
+	    allowedOrigins: [currentOrigin]
+	  });
 	}
 
-	/**
-	 * Register debug listeners for server
-	 * Use middleware to log requests and responses
+	/**
+	 * Create a client (for sending requests)
+	 * 
+	 * Note:
+	 * - MessageChannel is cached at the window level by secretKey (ensures unique message listener)
+	 * - Client instances are not cached, a new instance is created on each call
+	 * - This allows different versions of the library to coexist
 	 */
-	function setupServerDebugListeners(server) {
-	  ensureRequestIframeLogLevel(LogLevel.INFO);
-	  var serverImpl = server;
-	  var startTimes = new Map();
+	function requestIframeClient(target, options) {
+	  var _resolved$options;
+	  var targetWindow = null;
+	  var defaultTargetOrigin = OriginConstant.ANY;
+	  if (target.tagName === 'IFRAME') {
+	    var iframe = target;
+	    targetWindow = iframe.contentWindow;
+	    defaultTargetOrigin = getIframeTargetOrigin(iframe);
+	    if (!targetWindow) {
+	      throw {
+	        message: Messages.IFRAME_NOT_READY,
+	        code: ErrorCode.IFRAME_NOT_READY
+	      };
+	    }
+	  } else {
+	    targetWindow = target;
+	    defaultTargetOrigin = OriginConstant.ANY;
+	  }
+	  var resolved = applyStrictClientSecurityDefaults(defaultTargetOrigin, options);
+	  var targetOrigin = resolved.targetOrigin;
+	  var resolvedOptions = (_resolved$options = resolved.options) !== null && _resolved$options !== void 0 ? _resolved$options : options;
 
-	  // Use global middleware to log requests
-	  server.use((req, res, next) => {
-	    var _res$sendStream;
-	    var startTime = Date.now();
-	    startTimes.set(req.requestId, startTime);
-	    logEvent(LogLevel.INFO, DebugEvent.SERVER_REQUEST_RECEIVED, Messages.DEBUG_SERVER_RECEIVED_REQUEST, formatMessageData({
-	      requestId: req.requestId,
-	      path: req.path,
-	      body: req.body,
-	      origin: req.origin,
-	      headers: req.headers,
-	      cookies: req.cookies,
-	      method: 'POST' // iframe requests are always POST-like
-	    }));
+	  /**
+	   * P1: warn on unsafe default targetOrigin for Window targets.
+	   * - If targetOrigin is '*' and user did not configure allowedOrigins/validateOrigin,
+	   *   incoming message origin validation is effectively disabled.
+	   */
+	  warnUnsafeTargetOriginForWindow({
+	    isIframeTarget: target.tagName === 'IFRAME',
+	    targetOrigin,
+	    allowedOrigins: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.allowedOrigins,
+	    validateOrigin: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.validateOrigin
+	  });
 
-	    // Store original send methods
-	    var originalSend = res.send.bind(res);
-	    var originalJson = res.json.bind(res);
-	    var originalSendFile = res.sendFile.bind(res);
-	    var originalSendStream = (_res$sendStream = res.sendStream) === null || _res$sendStream === void 0 ? void 0 : _res$sendStream.bind(res);
-	    var originalStatus = res.status.bind(res);
-	    var originalSetHeader = res.setHeader.bind(res);
+	  // Determine secretKey
+	  var secretKey = resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.secretKey;
 
-	    // Track status code changes
-	    res.status = function (code) {
-	      logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SETTING_STATUS_CODE, {
-	        requestId: req.requestId,
-	        path: req.path,
-	        statusCode: code
-	      });
-	      return originalStatus(code);
-	    };
+	  // Generate instance ID first (will be used by both client and server)
+	  var instanceId = generateInstanceId();
 
-	    // Track header changes
-	    res.setHeader = function (name, value) {
-	      logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SETTING_HEADER, {
-	        requestId: req.requestId,
-	        path: req.path,
-	        header: name,
-	        value: Array.isArray(value) ? value.join(', ') : String(value)
-	      });
-	      return originalSetHeader(name, value);
-	    };
-
-	    // Override send method
-	    res.send = /*#__PURE__*/function () {
-	      var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(data, options) {
-	        var duration;
-	        return _regeneratorRuntime.wrap(function (_context) {
-	          while (1) switch (_context.prev = _context.next) {
-	            case 0:
-	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
-	              startTimes.delete(req.requestId);
-	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_RESPONSE, formatMessageData({
-	                requestId: req.requestId,
-	                path: req.path,
-	                status: res.statusCode,
-	                statusText: getStatusText(res.statusCode),
-	                requireAck: options === null || options === void 0 ? void 0 : options.requireAck,
-	                headers: res.headers,
-	                data,
-	                duration: `${duration}ms`
-	              }));
-	              return _context.abrupt("return", originalSend(data, options));
-	            case 1:
-	            case "end":
-	              return _context.stop();
-	          }
-	        }, _callee);
-	      }));
-	      return function (_x, _x2) {
-	        return _ref.apply(this, arguments);
-	      };
-	    }();
-
-	    // Override json method
-	    res.json = /*#__PURE__*/function () {
-	      var _ref2 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(data, options) {
-	        var duration;
-	        return _regeneratorRuntime.wrap(function (_context2) {
-	          while (1) switch (_context2.prev = _context2.next) {
-	            case 0:
-	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
-	              startTimes.delete(req.requestId);
-	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_JSON_RESPONSE, formatMessageData({
-	                requestId: req.requestId,
-	                path: req.path,
-	                status: res.statusCode,
-	                statusText: getStatusText(res.statusCode),
-	                requireAck: options === null || options === void 0 ? void 0 : options.requireAck,
-	                headers: res.headers,
-	                data,
-	                duration: `${duration}ms`
-	              }));
-	              return _context2.abrupt("return", originalJson(data, options));
-	            case 1:
-	            case "end":
-	              return _context2.stop();
-	          }
-	        }, _callee2);
-	      }));
-	      return function (_x3, _x4) {
-	        return _ref2.apply(this, arguments);
-	      };
-	    }();
-
-	    // Override sendFile method
-	    res.sendFile = /*#__PURE__*/function () {
-	      var _ref3 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(content, options) {
-	        var duration;
-	        return _regeneratorRuntime.wrap(function (_context3) {
-	          while (1) switch (_context3.prev = _context3.next) {
-	            case 0:
-	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
-	              startTimes.delete(req.requestId);
-	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_FILE, formatMessageData({
-	                requestId: req.requestId,
-	                path: req.path,
-	                status: res.statusCode,
-	                statusText: getStatusText(res.statusCode),
-	                fileName: options === null || options === void 0 ? void 0 : options.fileName,
-	                mimeType: options === null || options === void 0 ? void 0 : options.mimeType,
-	                contentLength: typeof content === 'string' ? content.length : (content === null || content === void 0 ? void 0 : content.size) || 0,
-	                duration: `${duration}ms`
-	              }));
-	              return _context3.abrupt("return", originalSendFile(content, options));
-	            case 1:
-	            case "end":
-	              return _context3.stop();
-	          }
-	        }, _callee3);
-	      }));
-	      return function (_x5, _x6) {
-	        return _ref3.apply(this, arguments);
-	      };
-	    }();
-
-	    // Override sendStream method if exists
-	    if (originalSendStream) {
-	      res.sendStream = /*#__PURE__*/function () {
-	        var _ref4 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(stream) {
-	          var duration;
-	          return _regeneratorRuntime.wrap(function (_context4) {
-	            while (1) switch (_context4.prev = _context4.next) {
-	              case 0:
-	                duration = Date.now() - (startTimes.get(req.requestId) || startTime);
-	                startTimes.delete(req.requestId);
-	                logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_STREAM, formatMessageData({
-	                  requestId: req.requestId,
-	                  path: req.path,
-	                  status: res.statusCode,
-	                  statusText: getStatusText(res.statusCode),
-	                  streamId: stream === null || stream === void 0 ? void 0 : stream.streamId,
-	                  duration: `${duration}ms`
-	                }));
-	                return _context4.abrupt("return", originalSendStream(stream));
-	              case 1:
-	              case "end":
-	                return _context4.stop();
-	            }
-	          }, _callee4);
-	        }));
-	        return function (_x7) {
-	          return _ref4.apply(this, arguments);
-	        };
-	      }();
-	    }
-	    next();
-	  });
-
-	  /** Hook into MessageDispatcher hooks (no monkey patch). */
-	  setupServerMessageDebuggingViaHooks(serverImpl);
-	}
-
-	/**
-	 * Setup message-level debugging for server (hook-based, no monkey patch).
-	 */
-	function setupServerMessageDebuggingViaHooks(serverImpl) {
-	  var _dispatcher$hooks$aft, _dispatcher$hooks$inb;
-	  var dispatcher = serverImpl.messageDispatcher || serverImpl.dispatcher;
-	  if (!(dispatcher !== null && dispatcher !== void 0 && dispatcher.hooks)) return;
-
-	  /** Outbound messages */
-	  if ((_dispatcher$hooks$aft = dispatcher.hooks.afterSend) !== null && _dispatcher$hooks$aft !== void 0 && _dispatcher$hooks$aft.tap) {
-	    dispatcher.hooks.afterSend.tap('debug', (_target, _targetOrigin, message) => {
-	      var type = message.type;
-	      var requestId = message.requestId;
-	      var data = message;
-	      if (type === MessageType.ACK) {
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ACK, formatMessageData({
-	          requestId,
-	          path: data.path
-	        }));
-	      } else if (type === MessageType.ASYNC) {
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ASYNC, formatMessageData({
-	          requestId,
-	          path: data.path
-	        }));
-	      } else if (type === MessageType.STREAM_START) {
-	        var streamBody = (data === null || data === void 0 ? void 0 : data.body) || {};
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_START, formatMessageData({
-	          requestId,
-	          streamId: streamBody.streamId,
-	          streamType: streamBody.type,
-	          chunked: streamBody.chunked,
-	          autoResolve: streamBody.autoResolve,
-	          metadata: streamBody.metadata
-	        }));
-	      } else if (type === MessageType.STREAM_DATA) {
-	        var _streamBody3$data;
-	        var _streamBody3 = (data === null || data === void 0 ? void 0 : data.body) || {};
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_DATA, formatMessageData({
-	          requestId,
-	          streamId: _streamBody3.streamId,
-	          done: _streamBody3.done,
-	          dataLength: ((_streamBody3$data = _streamBody3.data) === null || _streamBody3$data === void 0 ? void 0 : _streamBody3$data.length) || 0
-	        }));
-	      } else if (type === MessageType.STREAM_END) {
-	        var _streamBody4 = (data === null || data === void 0 ? void 0 : data.body) || {};
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_END, formatMessageData({
-	          requestId,
-	          streamId: _streamBody4.streamId
-	        }));
-	      } else if (type === MessageType.ERROR) {
-	        logEvent(LogLevel.ERROR, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ERROR, formatMessageData({
-	          requestId,
-	          status: data === null || data === void 0 ? void 0 : data.status,
-	          statusText: data === null || data === void 0 ? void 0 : data.statusText,
-	          error: data === null || data === void 0 ? void 0 : data.error,
-	          path: data === null || data === void 0 ? void 0 : data.path
-	        }));
-	      } else if (type === MessageType.RESPONSE) {
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_RESPONSE_VIA_DISPATCHER, formatMessageData({
-	          requestId,
-	          status: data === null || data === void 0 ? void 0 : data.status,
-	          statusText: data === null || data === void 0 ? void 0 : data.statusText,
-	          requireAck: data === null || data === void 0 ? void 0 : data.requireAck,
-	          path: data === null || data === void 0 ? void 0 : data.path
-	        }));
-	      }
-	    });
-	  }
-
-	  /** Inbound messages */
-	  if ((_dispatcher$hooks$inb = dispatcher.hooks.inbound) !== null && _dispatcher$hooks$inb !== void 0 && _dispatcher$hooks$inb.tap) {
-	    dispatcher.hooks.inbound.tap('debug', (data, context) => {
-	      if (data.type === MessageType.REQUEST) {
-	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_INBOUND, Messages.DEBUG_SERVER_HANDLING_REQUEST, formatMessageData({
-	          requestId: data.requestId,
-	          path: data.path,
-	          origin: context === null || context === void 0 ? void 0 : context.origin,
-	          role: data.role,
-	          creatorId: data.creatorId
-	        }));
-	      }
-	    });
-	  }
-	}
-
-	/**
-	 * Create a client (for sending requests)
-	 * 
-	 * Note:
-	 * - MessageChannel is cached at the window level by secretKey (ensures unique message listener)
-	 * - Client instances are not cached, a new instance is created on each call
-	 * - This allows different versions of the library to coexist
-	 */
-	function requestIframeClient(target, options) {
-	  var targetWindow = null;
-	  var targetOrigin = OriginConstant.ANY;
-	  if (target.tagName === 'IFRAME') {
-	    var iframe = target;
-	    targetWindow = iframe.contentWindow;
-	    targetOrigin = getIframeTargetOrigin(iframe);
-	    if (!targetWindow) {
-	      throw {
-	        message: Messages.IFRAME_NOT_READY,
-	        code: ErrorCode.IFRAME_NOT_READY
-	      };
-	    }
-	  } else {
-	    targetWindow = target;
-	    targetOrigin = OriginConstant.ANY;
-	  }
-
-	  // Allow user to override targetOrigin explicitly
-	  if (options !== null && options !== void 0 && options.targetOrigin) {
-	    targetOrigin = options.targetOrigin;
-	  }
-
-	  // Determine secretKey
-	  var secretKey = options === null || options === void 0 ? void 0 : options.secretKey;
-
-	  // Generate instance ID first (will be used by both client and server)
-	  var instanceId = generateInstanceId();
-
-	  // Create client instance (internally creates its core message server)
-	  var client = new RequestIframeClientImpl(targetWindow, targetOrigin, {
-	    secretKey,
-	    ackTimeout: options === null || options === void 0 ? void 0 : options.ackTimeout,
-	    timeout: options === null || options === void 0 ? void 0 : options.timeout,
-	    asyncTimeout: options === null || options === void 0 ? void 0 : options.asyncTimeout,
-	    returnData: options === null || options === void 0 ? void 0 : options.returnData,
-	    headers: options === null || options === void 0 ? void 0 : options.headers,
-	    allowedOrigins: options === null || options === void 0 ? void 0 : options.allowedOrigins,
-	    validateOrigin: options === null || options === void 0 ? void 0 : options.validateOrigin,
-	    autoOpen: options === null || options === void 0 ? void 0 : options.autoOpen,
-	    autoAckMaxMetaLength: options === null || options === void 0 ? void 0 : options.autoAckMaxMetaLength,
-	    autoAckMaxIdLength: options === null || options === void 0 ? void 0 : options.autoAckMaxIdLength
-	  }, instanceId);
+	  // Create client instance (internally creates its core message server)
+	  var client = new RequestIframeClientImpl(targetWindow, targetOrigin, {
+	    secretKey,
+	    ackTimeout: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.ackTimeout,
+	    timeout: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.timeout,
+	    asyncTimeout: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.asyncTimeout,
+	    returnData: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.returnData,
+	    headers: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.headers,
+	    allowedOrigins: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.allowedOrigins,
+	    validateOrigin: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.validateOrigin,
+	    autoOpen: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoOpen,
+	    autoAckMaxMetaLength: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoAckMaxMetaLength,
+	    autoAckMaxIdLength: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoAckMaxIdLength
+	  }, instanceId);
 
 	  /**
 	   * Trace/log level:
 	   * - default: only warn/error will be printed (logger default)
 	   * - if trace enabled: raise log level and (optionally) enable detailed debug interceptors
 	   */
-	  if (options !== null && options !== void 0 && options.trace) {
-	    var level = options.trace === true ? LogLevel.TRACE : options.trace;
+	  if (resolvedOptions !== null && resolvedOptions !== void 0 && resolvedOptions.trace) {
+	    var level = resolvedOptions.trace === true ? LogLevel.TRACE : resolvedOptions.trace;
 	    setRequestIframeLogLevel(level);
 	    if (level === LogLevel.TRACE || level === LogLevel.INFO) {
-	      setupClientDebugInterceptors(client);
+	      /**
+	       * Lazy-load debug hooks to keep main bundle smaller, but still ensure
+	       * the first request in trace mode won't miss debug interceptors.
+	       */
+	      wrapClientMethodsForDebug(client);
+	      // Preheat import early (best-effort)
+	      void loadDebugModule().catch(() => {
+	        /** ignore */
+	      });
+	      // Attach ASAP (best-effort)
+	      void ensureClientDebugInterceptors(client);
 	    }
 	  }
 	  return client;
@@ -18388,8 +18630,8 @@
 	  }
 	}
 
-	function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-	function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 	/**
 	 * Callback waiting for client acknowledgment
@@ -18599,7 +18841,7 @@
 	              }(),
 	              onFileOrBlob: () => {
 	                // Extract options for sendFile
-	                var fileOptions = _objectSpread({
+	                var fileOptions = _objectSpread$1({
 	                  requireAck: options === null || options === void 0 ? void 0 : options.requireAck
 	                }, typeof File !== 'undefined' && data instanceof File ? {
 	                  mimeType: data.type,
@@ -18626,6 +18868,7 @@
 	  sendFile(content, options) {
 	    var _this2 = this;
 	    return _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3() {
+	      var _options$chunked, _options$autoResolve;
 	      return _regeneratorRuntime.wrap(function (_context3) {
 	        while (1) switch (_context3.prev = _context3.next) {
 	          case 0:
@@ -18640,8 +18883,9 @@
 	              content,
 	              fileName: options === null || options === void 0 ? void 0 : options.fileName,
 	              mimeType: options === null || options === void 0 ? void 0 : options.mimeType,
-	              chunked: false,
-	              autoResolve: true,
+	              chunked: (_options$chunked = options === null || options === void 0 ? void 0 : options.chunked) !== null && _options$chunked !== void 0 ? _options$chunked : false,
+	              chunkSize: options === null || options === void 0 ? void 0 : options.chunkSize,
+	              autoResolve: (_options$autoResolve = options === null || options === void 0 ? void 0 : options.autoResolve) !== null && _options$autoResolve !== void 0 ? _options$autoResolve : true,
 	              defaultFileName: 'file',
 	              defaultMimeType: 'application/octet-stream',
 	              onFileInfo: ({
@@ -18834,8 +19078,9 @@
 	        handledBy: this.id,
 	        isOriginAllowed: (d, ctx) => this.isOriginAllowed(d, ctx),
 	        warnMissingPendingWhenClosed: d => {
-	          this.hub.warnOnce(buildWarnOnceKey(WarnOnceKey.SERVER_MISSING_PENDING_WHEN_CLOSED, d.type, d.requestId), () => {
-	            requestIframeLog('warn', formatMessage(Messages.SERVER_IGNORED_MESSAGE_WHEN_CLOSED, d.type, d.requestId));
+	          warnServerIgnoredMessageWhenClosedOnce(this.hub, {
+	            type: d.type,
+	            requestId: d.requestId
 	          });
 	        }
 	      },
@@ -18850,8 +19095,9 @@
 	    this.ackTimeout = (_options$ackTimeout = options === null || options === void 0 ? void 0 : options.ackTimeout) !== null && _options$ackTimeout !== void 0 ? _options$ackTimeout : DefaultTimeout.ACK;
 	    this.maxConcurrentRequestsPerClient = (_options$maxConcurren = options === null || options === void 0 ? void 0 : options.maxConcurrentRequestsPerClient) !== null && _options$maxConcurren !== void 0 ? _options$maxConcurren : Number.POSITIVE_INFINITY;
 	    var warnMissingPendingWhenClosed = d => {
-	      this.hub.warnOnce(buildWarnOnceKey(WarnOnceKey.SERVER_MISSING_PENDING_WHEN_CLOSED, d.type, d.requestId), () => {
-	        requestIframeLog('warn', formatMessage(Messages.SERVER_IGNORED_MESSAGE_WHEN_CLOSED, d.type, d.requestId));
+	      warnServerIgnoredMessageWhenClosedOnce(this.hub, {
+	        type: d.type,
+	        requestId: d.requestId
 	      });
 	    };
 	    var handlerOptions = this.hub.createHandlerOptions(this.handleVersionError.bind(this));
@@ -19429,9 +19675,11 @@
 	 * - This allows different versions of the library to coexist
 	 */
 	function requestIframeServer(options) {
+	  var _applyStrictServerSec;
+	  var resolvedOptions = (_applyStrictServerSec = applyStrictServerSecurityDefaults(options)) !== null && _applyStrictServerSec !== void 0 ? _applyStrictServerSec : options;
 	  // Determine secretKey and id
-	  var secretKey = options === null || options === void 0 ? void 0 : options.secretKey;
-	  var id = options === null || options === void 0 ? void 0 : options.id;
+	  var secretKey = resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.secretKey;
+	  var id = resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.id;
 
 	  // If id is specified, check cache first
 	  if (id) {
@@ -19445,13 +19693,13 @@
 	  var server = new RequestIframeServerImpl({
 	    secretKey,
 	    id,
-	    ackTimeout: options === null || options === void 0 ? void 0 : options.ackTimeout,
-	    autoOpen: options === null || options === void 0 ? void 0 : options.autoOpen,
-	    allowedOrigins: options === null || options === void 0 ? void 0 : options.allowedOrigins,
-	    validateOrigin: options === null || options === void 0 ? void 0 : options.validateOrigin,
-	    maxConcurrentRequestsPerClient: options === null || options === void 0 ? void 0 : options.maxConcurrentRequestsPerClient,
-	    autoAckMaxMetaLength: options === null || options === void 0 ? void 0 : options.autoAckMaxMetaLength,
-	    autoAckMaxIdLength: options === null || options === void 0 ? void 0 : options.autoAckMaxIdLength
+	    ackTimeout: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.ackTimeout,
+	    autoOpen: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoOpen,
+	    allowedOrigins: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.allowedOrigins,
+	    validateOrigin: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.validateOrigin,
+	    maxConcurrentRequestsPerClient: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.maxConcurrentRequestsPerClient,
+	    autoAckMaxMetaLength: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoAckMaxMetaLength,
+	    autoAckMaxIdLength: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.autoAckMaxIdLength
 	  });
 
 	  /**
@@ -19459,11 +19707,17 @@
 	   * - default: only warn/error will be printed (logger default)
 	   * - if trace enabled: raise log level and (optionally) enable detailed debug listeners
 	   */
-	  if (options !== null && options !== void 0 && options.trace) {
-	    var level = options.trace === true ? LogLevel.TRACE : options.trace;
+	  if (resolvedOptions !== null && resolvedOptions !== void 0 && resolvedOptions.trace) {
+	    var level = resolvedOptions.trace === true ? LogLevel.TRACE : resolvedOptions.trace;
 	    setRequestIframeLogLevel(level);
 	    if (level === LogLevel.TRACE || level === LogLevel.INFO) {
-	      setupServerDebugListeners(server);
+	      /**
+	       * Lazy-load debug hooks to keep main bundle smaller.
+	       * Best-effort: ignore dynamic import errors.
+	       */
+	      void loadDebugModule().then(m => m.setupServerDebugListeners(server)).catch(() => {
+	        /** ignore */
+	      });
 	    }
 	  }
 
@@ -19545,7 +19799,11 @@
 	        var level = options.trace === true ? LogLevel.TRACE : options.trace;
 	        setRequestIframeLogLevel(level);
 	        if (level === LogLevel.TRACE || level === LogLevel.INFO) {
-	          setupClientDebugInterceptors(client);
+	          wrapClientMethodsForDebug(client);
+	          void loadDebugModule().catch(() => {
+	            /** ignore */
+	          });
+	          void ensureClientDebugInterceptors(client);
 	        }
 	      }
 	      this.client_ = client;
@@ -19580,7 +19838,9 @@
 	        var level = options.trace === true ? LogLevel.TRACE : options.trace;
 	        setRequestIframeLogLevel(level);
 	        if (level === LogLevel.TRACE || level === LogLevel.INFO) {
-	          setupServerDebugListeners(server);
+	          void loadDebugModule().then(m => m.setupServerDebugListeners(server)).catch(() => {
+	            /** ignore */
+	          });
 	        }
 	      }
 	      this.server_ = server;
@@ -19666,13 +19926,13 @@
 	 * - handle requests from the peer (server)
 	 */
 	function requestIframeEndpoint(target, options) {
-	  var _options$id;
+	  var _applyStrictServerSec, _resolvedClient$optio, _resolvedClient$optio2, _resolvedOptions$id;
 	  var targetWindow = null;
-	  var targetOrigin = OriginConstant.ANY;
+	  var defaultTargetOrigin = OriginConstant.ANY;
 	  if (target.tagName === 'IFRAME') {
 	    var iframe = target;
 	    targetWindow = iframe.contentWindow;
-	    targetOrigin = getIframeTargetOrigin(iframe);
+	    defaultTargetOrigin = getIframeTargetOrigin(iframe);
 	    if (!targetWindow) {
 	      throw {
 	        message: Messages.IFRAME_NOT_READY,
@@ -19681,27 +19941,529 @@
 	    }
 	  } else {
 	    targetWindow = target;
-	    targetOrigin = OriginConstant.ANY;
+	    defaultTargetOrigin = OriginConstant.ANY;
 	  }
+	  var resolvedClient = applyStrictClientSecurityDefaults(defaultTargetOrigin, options);
+	  var targetOrigin = resolvedClient.targetOrigin;
+	  var resolvedOptions = (_applyStrictServerSec = applyStrictServerSecurityDefaults((_resolvedClient$optio = resolvedClient.options) !== null && _resolvedClient$optio !== void 0 ? _resolvedClient$optio : options)) !== null && _applyStrictServerSec !== void 0 ? _applyStrictServerSec : (_resolvedClient$optio2 = resolvedClient.options) !== null && _resolvedClient$optio2 !== void 0 ? _resolvedClient$optio2 : options;
 
-	  /** Allow user to override targetOrigin explicitly */
-	  if (options !== null && options !== void 0 && options.targetOrigin) {
-	    targetOrigin = options.targetOrigin;
-	  }
+	  /**
+	   * P1: warn on unsafe default targetOrigin for Window targets.
+	   * Endpoint facade is lazy (client/server created later), so warn here.
+	   */
+	  warnUnsafeTargetOriginForWindow({
+	    isIframeTarget: target.tagName === 'IFRAME',
+	    targetOrigin,
+	    allowedOrigins: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.allowedOrigins,
+	    validateOrigin: resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.validateOrigin
+	  });
 
 	  /**
 	   * Endpoint uses ONE shared id by default, so it behaves like a single endpoint.
 	   * If options.id is provided, it becomes the shared id for both client+server.
 	   */
-	  var endpointId = (_options$id = options === null || options === void 0 ? void 0 : options.id) !== null && _options$id !== void 0 ? _options$id : generateInstanceId();
+	  var endpointId = (_resolvedOptions$id = resolvedOptions === null || resolvedOptions === void 0 ? void 0 : resolvedOptions.id) !== null && _resolvedOptions$id !== void 0 ? _resolvedOptions$id : generateInstanceId();
 	  return new RequestIframeEndpointApiFacade({
 	    targetWindow,
 	    targetOrigin,
-	    options,
+	    options: resolvedOptions,
 	    endpointId
 	  });
 	}
 
+	function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+	function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), true).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+	function logEvent(level, event, message, data) {
+	  if (data !== undefined && data !== null && typeof data === 'object') {
+	    requestIframeLog(level, message, _objectSpread({
+	      event
+	    }, data));
+	    return;
+	  }
+	  requestIframeLog(level, message, data === undefined ? {
+	    event
+	  } : {
+	    event,
+	    data
+	  });
+	}
+
+	/**
+	 * Format message data for logging (remove sensitive data if needed)
+	 */
+	function formatMessageData(data) {
+	  if (!data) return data;
+	  var formatted = _objectSpread({}, data);
+
+	  // Limit body size in logs
+	  if (formatted.body && typeof formatted.body === 'object') {
+	    var bodyStr = JSON.stringify(formatted.body);
+	    if (bodyStr.length > 500) {
+	      formatted.body = bodyStr.substring(0, 500) + '... (truncated)';
+	    }
+	  }
+
+	  // Limit data size in logs
+	  if (formatted.data && typeof formatted.data === 'object') {
+	    var dataStr = JSON.stringify(formatted.data);
+	    if (dataStr.length > 500) {
+	      formatted.data = dataStr.substring(0, 500) + '... (truncated)';
+	    }
+	  }
+	  return formatted;
+	}
+
+	/**
+	 * Register debug interceptors for client
+	 */
+	function setupClientDebugInterceptors(client) {
+	  ensureRequestIframeLogLevel(LogLevel.INFO);
+
+	  // Request interceptor: log request start
+	  client.interceptors.request.use(config => {
+	    logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_START, Messages.DEBUG_CLIENT_REQUEST_START, formatMessageData({
+	      path: config.path,
+	      body: config.body,
+	      headers: config.headers,
+	      cookies: config.cookies,
+	      ackTimeout: config.ackTimeout,
+	      timeout: config.timeout,
+	      asyncTimeout: config.asyncTimeout,
+	      requestId: config.requestId
+	    }));
+	    return config;
+	  });
+
+	  // Response interceptor: log response success
+	  client.interceptors.response.use(response => {
+	    var logData = {
+	      requestId: response.requestId,
+	      status: response.status,
+	      statusText: response.statusText,
+	      headers: response.headers
+	    };
+
+	    // Check if response.data is a File or Blob
+	    if (response.data instanceof File || response.data instanceof Blob) {
+	      var file = response.data;
+	      var fileName = file instanceof File ? file.name : undefined;
+	      var mimeType = file.type || undefined;
+	      var contentLength = file.size;
+	      logData.fileData = {
+	        fileName,
+	        mimeType,
+	        contentLength
+	      };
+	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS_FILE, Messages.DEBUG_CLIENT_REQUEST_SUCCESS_FILE, formatMessageData(logData));
+	    } else if (response.stream) {
+	      logData.stream = {
+	        streamId: response.stream.streamId,
+	        type: response.stream.type
+	      };
+	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS_STREAM, Messages.DEBUG_CLIENT_REQUEST_SUCCESS_STREAM, formatMessageData(logData));
+	    } else {
+	      logData.data = response.data;
+	      logEvent(LogLevel.INFO, DebugEvent.CLIENT_REQUEST_SUCCESS, Messages.DEBUG_CLIENT_REQUEST_SUCCESS, formatMessageData(logData));
+	    }
+	    return response;
+	  }, error => {
+	    logEvent(LogLevel.ERROR, DebugEvent.CLIENT_REQUEST_FAILED, Messages.DEBUG_CLIENT_REQUEST_FAILED, formatMessageData({
+	      requestId: error.requestId,
+	      code: error.code,
+	      message: error.message,
+	      config: error.config,
+	      response: error.response
+	    }));
+	    return Promise.reject(error);
+	  });
+
+	  /** Attach hook-based message debugging (no monkey patch). */
+	  var clientImpl = client;
+	  setupClientMessageDebuggingViaHooks(clientImpl);
+	}
+
+	/**
+	 * Setup message-level debugging for client (hook-based, no monkey patch).
+	 */
+	function setupClientMessageDebuggingViaHooks(clientImpl) {
+	  var _clientImpl$hub, _clientImpl$getHub, _outbox$hooks, _dispatcher$hooks, _inbox$hooks, _dispatcher$hooks2;
+	  var inbox = clientImpl.inbox;
+	  var outbox = clientImpl.outbox;
+	  var dispatcher = ((_clientImpl$hub = clientImpl.hub) === null || _clientImpl$hub === void 0 ? void 0 : _clientImpl$hub.messageDispatcher) || ((_clientImpl$getHub = clientImpl.getHub) === null || _clientImpl$getHub === void 0 || (_clientImpl$getHub = _clientImpl$getHub.call(clientImpl)) === null || _clientImpl$getHub === void 0 ? void 0 : _clientImpl$getHub.messageDispatcher);
+
+	  /** Outbound */
+	  if (outbox !== null && outbox !== void 0 && (_outbox$hooks = outbox.hooks) !== null && _outbox$hooks !== void 0 && (_outbox$hooks = _outbox$hooks.afterSendMessage) !== null && _outbox$hooks !== void 0 && _outbox$hooks.tap) {
+	    outbox.hooks.afterSendMessage.tap('debug', (type, requestId, data) => {
+	      if (type === MessageType.REQUEST) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_REQUEST, formatMessageData({
+	          requestId,
+	          path: data === null || data === void 0 ? void 0 : data.path,
+	          body: data === null || data === void 0 ? void 0 : data.body,
+	          headers: data === null || data === void 0 ? void 0 : data.headers
+	        }));
+	      } else if (type === MessageType.PING) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_PING, {
+	          requestId
+	        });
+	      } else if (type === MessageType.ACK) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_RECEIVED_ACK, {
+	          requestId
+	        });
+	      }
+	    });
+	  } else if (dispatcher !== null && dispatcher !== void 0 && (_dispatcher$hooks = dispatcher.hooks) !== null && _dispatcher$hooks !== void 0 && (_dispatcher$hooks = _dispatcher$hooks.afterSend) !== null && _dispatcher$hooks !== void 0 && _dispatcher$hooks.tap) {
+	    dispatcher.hooks.afterSend.tap('debug', (_target, _origin, message) => {
+	      if (message.type === MessageType.REQUEST) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_OUTBOUND, Messages.DEBUG_CLIENT_SENDING_REQUEST, formatMessageData({
+	          requestId: message.requestId,
+	          path: message.path,
+	          body: message.body,
+	          headers: message.headers
+	        }));
+	      }
+	    });
+	  }
+
+	  /** Inbound */
+	  if (inbox !== null && inbox !== void 0 && (_inbox$hooks = inbox.hooks) !== null && _inbox$hooks !== void 0 && (_inbox$hooks = _inbox$hooks.inbound) !== null && _inbox$hooks !== void 0 && _inbox$hooks.tap) {
+	    inbox.hooks.inbound.tap('debug', data => {
+	      if (data.type === MessageType.ACK) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ACK, formatMessageData({
+	          requestId: data.requestId,
+	          path: data.path
+	        }));
+	      } else if (data.type === MessageType.ASYNC) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ASYNC, formatMessageData({
+	          requestId: data.requestId,
+	          path: data.path
+	        }));
+	      } else if (data.type === MessageType.STREAM_START) {
+	        var streamBody = data.body;
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_START, formatMessageData({
+	          requestId: data.requestId,
+	          streamId: streamBody === null || streamBody === void 0 ? void 0 : streamBody.streamId,
+	          streamType: streamBody === null || streamBody === void 0 ? void 0 : streamBody.type,
+	          chunked: streamBody === null || streamBody === void 0 ? void 0 : streamBody.chunked,
+	          autoResolve: streamBody === null || streamBody === void 0 ? void 0 : streamBody.autoResolve,
+	          metadata: streamBody === null || streamBody === void 0 ? void 0 : streamBody.metadata
+	        }));
+	      } else if (data.type === MessageType.STREAM_DATA) {
+	        var _streamBody$data;
+	        var _streamBody = data.body;
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_DATA, formatMessageData({
+	          requestId: data.requestId,
+	          streamId: _streamBody === null || _streamBody === void 0 ? void 0 : _streamBody.streamId,
+	          done: _streamBody === null || _streamBody === void 0 ? void 0 : _streamBody.done,
+	          dataLength: (_streamBody === null || _streamBody === void 0 || (_streamBody$data = _streamBody.data) === null || _streamBody$data === void 0 ? void 0 : _streamBody$data.length) || 0
+	        }));
+	      } else if (data.type === MessageType.STREAM_END) {
+	        var _streamBody2 = data.body;
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_STREAM_END, formatMessageData({
+	          requestId: data.requestId,
+	          streamId: _streamBody2 === null || _streamBody2 === void 0 ? void 0 : _streamBody2.streamId
+	        }));
+	      } else if (data.type === MessageType.RESPONSE) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_RESPONSE, formatMessageData({
+	          requestId: data.requestId,
+	          status: data.status,
+	          statusText: data.statusText,
+	          requireAck: data.requireAck
+	        }));
+	      } else if (data.type === MessageType.ERROR) {
+	        logEvent(LogLevel.ERROR, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ERROR, formatMessageData({
+	          requestId: data.requestId,
+	          status: data.status,
+	          statusText: data.statusText,
+	          error: data.error
+	        }));
+	      }
+	    });
+	  } else if (dispatcher !== null && dispatcher !== void 0 && (_dispatcher$hooks2 = dispatcher.hooks) !== null && _dispatcher$hooks2 !== void 0 && (_dispatcher$hooks2 = _dispatcher$hooks2.inbound) !== null && _dispatcher$hooks2 !== void 0 && _dispatcher$hooks2.tap) {
+	    dispatcher.hooks.inbound.tap('debug', data => {
+	      if (data.type === MessageType.ACK) {
+	        logEvent(LogLevel.INFO, DebugEvent.CLIENT_MESSAGE_INBOUND, Messages.DEBUG_CLIENT_RECEIVED_ACK, formatMessageData({
+	          requestId: data.requestId,
+	          path: data.path
+	        }));
+	      }
+	    });
+	  }
+	}
+
+	/**
+	 * Register debug listeners for server
+	 * Use middleware to log requests and responses
+	 */
+	function setupServerDebugListeners(server) {
+	  ensureRequestIframeLogLevel(LogLevel.INFO);
+	  var serverImpl = server;
+	  var startTimes = new Map();
+
+	  // Use global middleware to log requests
+	  server.use((req, res, next) => {
+	    var _res$sendStream;
+	    var startTime = Date.now();
+	    startTimes.set(req.requestId, startTime);
+	    logEvent(LogLevel.INFO, DebugEvent.SERVER_REQUEST_RECEIVED, Messages.DEBUG_SERVER_RECEIVED_REQUEST, formatMessageData({
+	      requestId: req.requestId,
+	      path: req.path,
+	      body: req.body,
+	      origin: req.origin,
+	      headers: req.headers,
+	      cookies: req.cookies,
+	      method: 'POST' // iframe requests are always POST-like
+	    }));
+
+	    // Store original send methods
+	    var originalSend = res.send.bind(res);
+	    var originalJson = res.json.bind(res);
+	    var originalSendFile = res.sendFile.bind(res);
+	    var originalSendStream = (_res$sendStream = res.sendStream) === null || _res$sendStream === void 0 ? void 0 : _res$sendStream.bind(res);
+	    var originalStatus = res.status.bind(res);
+	    var originalSetHeader = res.setHeader.bind(res);
+
+	    // Track status code changes
+	    res.status = function (code) {
+	      logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SETTING_STATUS_CODE, {
+	        requestId: req.requestId,
+	        path: req.path,
+	        statusCode: code
+	      });
+	      return originalStatus(code);
+	    };
+
+	    // Track header changes
+	    res.setHeader = function (name, value) {
+	      logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SETTING_HEADER, {
+	        requestId: req.requestId,
+	        path: req.path,
+	        header: name,
+	        value: Array.isArray(value) ? value.join(', ') : String(value)
+	      });
+	      return originalSetHeader(name, value);
+	    };
+
+	    // Override send method
+	    res.send = /*#__PURE__*/function () {
+	      var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(data, options) {
+	        var duration;
+	        return _regeneratorRuntime.wrap(function (_context) {
+	          while (1) switch (_context.prev = _context.next) {
+	            case 0:
+	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
+	              startTimes.delete(req.requestId);
+	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_RESPONSE, formatMessageData({
+	                requestId: req.requestId,
+	                path: req.path,
+	                status: res.statusCode,
+	                statusText: getStatusText(res.statusCode),
+	                requireAck: options === null || options === void 0 ? void 0 : options.requireAck,
+	                headers: res.headers,
+	                data,
+	                duration: `${duration}ms`
+	              }));
+	              return _context.abrupt("return", originalSend(data, options));
+	            case 1:
+	            case "end":
+	              return _context.stop();
+	          }
+	        }, _callee);
+	      }));
+	      return function (_x, _x2) {
+	        return _ref.apply(this, arguments);
+	      };
+	    }();
+
+	    // Override json method
+	    res.json = /*#__PURE__*/function () {
+	      var _ref2 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(data, options) {
+	        var duration;
+	        return _regeneratorRuntime.wrap(function (_context2) {
+	          while (1) switch (_context2.prev = _context2.next) {
+	            case 0:
+	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
+	              startTimes.delete(req.requestId);
+	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_JSON_RESPONSE, formatMessageData({
+	                requestId: req.requestId,
+	                path: req.path,
+	                status: res.statusCode,
+	                statusText: getStatusText(res.statusCode),
+	                requireAck: options === null || options === void 0 ? void 0 : options.requireAck,
+	                headers: res.headers,
+	                data,
+	                duration: `${duration}ms`
+	              }));
+	              return _context2.abrupt("return", originalJson(data, options));
+	            case 1:
+	            case "end":
+	              return _context2.stop();
+	          }
+	        }, _callee2);
+	      }));
+	      return function (_x3, _x4) {
+	        return _ref2.apply(this, arguments);
+	      };
+	    }();
+
+	    // Override sendFile method
+	    res.sendFile = /*#__PURE__*/function () {
+	      var _ref3 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(content, options) {
+	        var duration;
+	        return _regeneratorRuntime.wrap(function (_context3) {
+	          while (1) switch (_context3.prev = _context3.next) {
+	            case 0:
+	              duration = Date.now() - (startTimes.get(req.requestId) || startTime);
+	              startTimes.delete(req.requestId);
+	              logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_FILE, formatMessageData({
+	                requestId: req.requestId,
+	                path: req.path,
+	                status: res.statusCode,
+	                statusText: getStatusText(res.statusCode),
+	                fileName: options === null || options === void 0 ? void 0 : options.fileName,
+	                mimeType: options === null || options === void 0 ? void 0 : options.mimeType,
+	                contentLength: typeof content === 'string' ? content.length : (content === null || content === void 0 ? void 0 : content.size) || 0,
+	                duration: `${duration}ms`
+	              }));
+	              return _context3.abrupt("return", originalSendFile(content, options));
+	            case 1:
+	            case "end":
+	              return _context3.stop();
+	          }
+	        }, _callee3);
+	      }));
+	      return function (_x5, _x6) {
+	        return _ref3.apply(this, arguments);
+	      };
+	    }();
+
+	    // Override sendStream method if exists
+	    if (originalSendStream) {
+	      res.sendStream = /*#__PURE__*/function () {
+	        var _ref4 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(stream) {
+	          var duration;
+	          return _regeneratorRuntime.wrap(function (_context4) {
+	            while (1) switch (_context4.prev = _context4.next) {
+	              case 0:
+	                duration = Date.now() - (startTimes.get(req.requestId) || startTime);
+	                startTimes.delete(req.requestId);
+	                logEvent(LogLevel.INFO, DebugEvent.SERVER_RESPONSE_SEND, Messages.DEBUG_SERVER_SENDING_STREAM, formatMessageData({
+	                  requestId: req.requestId,
+	                  path: req.path,
+	                  status: res.statusCode,
+	                  statusText: getStatusText(res.statusCode),
+	                  streamId: stream === null || stream === void 0 ? void 0 : stream.streamId,
+	                  duration: `${duration}ms`
+	                }));
+	                return _context4.abrupt("return", originalSendStream(stream));
+	              case 1:
+	              case "end":
+	                return _context4.stop();
+	            }
+	          }, _callee4);
+	        }));
+	        return function (_x7) {
+	          return _ref4.apply(this, arguments);
+	        };
+	      }();
+	    }
+	    next();
+	  });
+
+	  /** Hook into MessageDispatcher hooks (no monkey patch). */
+	  setupServerMessageDebuggingViaHooks(serverImpl);
+	}
+
+	/**
+	 * Setup message-level debugging for server (hook-based, no monkey patch).
+	 */
+	function setupServerMessageDebuggingViaHooks(serverImpl) {
+	  var _dispatcher$hooks$aft, _dispatcher$hooks$inb;
+	  var dispatcher = serverImpl.messageDispatcher || serverImpl.dispatcher;
+	  if (!(dispatcher !== null && dispatcher !== void 0 && dispatcher.hooks)) return;
+
+	  /** Outbound messages */
+	  if ((_dispatcher$hooks$aft = dispatcher.hooks.afterSend) !== null && _dispatcher$hooks$aft !== void 0 && _dispatcher$hooks$aft.tap) {
+	    dispatcher.hooks.afterSend.tap('debug', (_target, _targetOrigin, message) => {
+	      var type = message.type;
+	      var requestId = message.requestId;
+	      var data = message;
+	      if (type === MessageType.ACK) {
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ACK, formatMessageData({
+	          requestId,
+	          path: data.path
+	        }));
+	      } else if (type === MessageType.ASYNC) {
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ASYNC, formatMessageData({
+	          requestId,
+	          path: data.path
+	        }));
+	      } else if (type === MessageType.STREAM_START) {
+	        var streamBody = (data === null || data === void 0 ? void 0 : data.body) || {};
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_START, formatMessageData({
+	          requestId,
+	          streamId: streamBody.streamId,
+	          streamType: streamBody.type,
+	          chunked: streamBody.chunked,
+	          autoResolve: streamBody.autoResolve,
+	          metadata: streamBody.metadata
+	        }));
+	      } else if (type === MessageType.STREAM_DATA) {
+	        var _streamBody3$data;
+	        var _streamBody3 = (data === null || data === void 0 ? void 0 : data.body) || {};
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_DATA, formatMessageData({
+	          requestId,
+	          streamId: _streamBody3.streamId,
+	          done: _streamBody3.done,
+	          dataLength: ((_streamBody3$data = _streamBody3.data) === null || _streamBody3$data === void 0 ? void 0 : _streamBody3$data.length) || 0
+	        }));
+	      } else if (type === MessageType.STREAM_END) {
+	        var _streamBody4 = (data === null || data === void 0 ? void 0 : data.body) || {};
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_STREAM_END, formatMessageData({
+	          requestId,
+	          streamId: _streamBody4.streamId
+	        }));
+	      } else if (type === MessageType.ERROR) {
+	        logEvent(LogLevel.ERROR, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_ERROR, formatMessageData({
+	          requestId,
+	          status: data === null || data === void 0 ? void 0 : data.status,
+	          statusText: data === null || data === void 0 ? void 0 : data.statusText,
+	          error: data === null || data === void 0 ? void 0 : data.error,
+	          path: data === null || data === void 0 ? void 0 : data.path
+	        }));
+	      } else if (type === MessageType.RESPONSE) {
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_OUTBOUND, Messages.DEBUG_SERVER_SENDING_RESPONSE_VIA_DISPATCHER, formatMessageData({
+	          requestId,
+	          status: data === null || data === void 0 ? void 0 : data.status,
+	          statusText: data === null || data === void 0 ? void 0 : data.statusText,
+	          requireAck: data === null || data === void 0 ? void 0 : data.requireAck,
+	          path: data === null || data === void 0 ? void 0 : data.path
+	        }));
+	      }
+	    });
+	  }
+
+	  /** Inbound messages */
+	  if ((_dispatcher$hooks$inb = dispatcher.hooks.inbound) !== null && _dispatcher$hooks$inb !== void 0 && _dispatcher$hooks$inb.tap) {
+	    dispatcher.hooks.inbound.tap('debug', (data, context) => {
+	      if (data.type === MessageType.REQUEST) {
+	        logEvent(LogLevel.INFO, DebugEvent.SERVER_MESSAGE_INBOUND, Messages.DEBUG_SERVER_HANDLING_REQUEST, formatMessageData({
+	          requestId: data.requestId,
+	          path: data.path,
+	          origin: context === null || context === void 0 ? void 0 : context.origin,
+	          role: data.role,
+	          creatorId: data.creatorId
+	        }));
+	      }
+	    });
+	  }
+	}
+
+	var debug = /*#__PURE__*/Object.freeze({
+		__proto__: null,
+		setupClientDebugInterceptors: setupClientDebugInterceptors,
+		setupServerDebugListeners: setupServerDebugListeners
+	});
+
 	exports.AutoAckConstant = AutoAckConstant;
 	exports.ChannelType = ChannelType;
 	exports.DebugEvent = DebugEvent;