silgi 0.43.29 → 0.50.0

package/dist/client/plugins/circuit-breaker.d.mts

@@ -0,0 +1,24 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+
+//#region src/client/plugins/circuit-breaker.d.ts
+type CircuitState = 'closed' | 'open' | 'half-open';
+declare class CircuitBreakerOpenError extends Error {
+  readonly state: CircuitState;
+  constructor();
+}
+interface CircuitBreakerOptions {
+  /** Number of consecutive failures before opening (default: 5) */
+  failureThreshold?: number;
+  /** Time in ms to wait before moving to half-open (default: 30000) */
+  resetTimeout?: number;
+  /** Called when circuit state changes */
+  onStateChange?: (state: CircuitState, info: {
+    failures: number;
+  }) => void;
+}
+declare function withCircuitBreaker<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options?: CircuitBreakerOptions): ClientLink<TClientContext> & {
+  getState: () => CircuitState;
+  reset: () => void;
+};
+//#endregion
+export { CircuitBreakerOpenError, CircuitBreakerOptions, CircuitState, withCircuitBreaker };

package/dist/client/plugins/circuit-breaker.mjs

@@ -0,0 +1,60 @@
+//#region src/client/plugins/circuit-breaker.ts
+var CircuitBreakerOpenError = class extends Error {
+	state = "open";
+	constructor() {
+		super("Circuit breaker is open — requests are blocked. Try again later.");
+		this.name = "CircuitBreakerOpenError";
+	}
+};
+function withCircuitBreaker(link, options = {}) {
+	const threshold = options.failureThreshold ?? 5;
+	const resetTimeout = options.resetTimeout ?? 3e4;
+	let state = "closed";
+	let failures = 0;
+	let openedAt = 0;
+	let probeSent = false;
+	function setState(newState) {
+		if (state !== newState) {
+			state = newState;
+			if (newState !== "half-open") probeSent = false;
+			options.onStateChange?.(state, { failures });
+		}
+	}
+	function recordSuccess() {
+		failures = 0;
+		setState("closed");
+	}
+	function recordFailure() {
+		failures++;
+		if (failures >= threshold) {
+			openedAt = Date.now();
+			setState("open");
+		}
+	}
+	return {
+		async call(path, input, callOptions) {
+			if (state === "open") if (Date.now() - openedAt >= resetTimeout) setState("half-open");
+			else throw new CircuitBreakerOpenError();
+			if (state === "half-open") {
+				if (probeSent) throw new CircuitBreakerOpenError();
+				probeSent = true;
+			}
+			try {
+				const result = await link.call(path, input, callOptions);
+				recordSuccess();
+				return result;
+			} catch (error) {
+				recordFailure();
+				throw error;
+			}
+		},
+		getState: () => state,
+		reset: () => {
+			failures = 0;
+			probeSent = false;
+			setState("closed");
+		}
+	};
+}
+//#endregion
+export { CircuitBreakerOpenError, withCircuitBreaker };

package/dist/client/plugins/csrf.d.mts

@@ -0,0 +1,13 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+
+//#region src/client/plugins/csrf.d.ts
+interface CSRFLinkOptions {
+  headerName?: string;
+  headerValue?: string;
+}
+/**
+ * Wrap a link to automatically inject the CSRF header on every request.
+ */
+declare function withCSRF<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options?: CSRFLinkOptions): ClientLink<TClientContext>;
+//#endregion
+export { CSRFLinkOptions, withCSRF };

package/dist/client/plugins/csrf.mjs

@@ -0,0 +1,20 @@
+//#region src/client/plugins/csrf.ts
+/**
+* Wrap a link to automatically inject the CSRF header on every request.
+*/
+function withCSRF(link, options = {}) {
+	const headerName = options.headerName ?? "x-csrf-token";
+	const headerValue = options.headerValue ?? "silgi";
+	return { call(path, input, callOptions) {
+		const enhancedOptions = {
+			...callOptions,
+			headers: {
+				...callOptions.headers,
+				[headerName]: headerValue
+			}
+		};
+		return link.call(path, input, enhancedOptions);
+	} };
+}
+//#endregion
+export { withCSRF };

package/dist/client/plugins/dedupe.d.mts

@@ -0,0 +1,10 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+
+//#region src/client/plugins/dedupe.d.ts
+interface DedupeOptions {
+  /** Custom key function. Default: JSON.stringify(path + input) */
+  keyFn?: (path: readonly string[], input: unknown) => string;
+}
+declare function withDedupe<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options?: DedupeOptions): ClientLink<TClientContext>;
+//#endregion
+export { DedupeOptions, withDedupe };

package/dist/client/plugins/dedupe.mjs

@@ -0,0 +1,28 @@
+import { stringifyJSON } from "../../core/utils.mjs";
+//#region src/client/plugins/dedupe.ts
+/**
+* Dedupe Plugin — collapses identical concurrent requests into one.
+*
+* If two calls have the same path and serialized input within
+* the same microtask, only one actual request is sent.
+* All callers receive the same response.
+*/
+function withDedupe(link, options = {}) {
+	const inflight = /* @__PURE__ */ new Map();
+	const keyFn = options.keyFn ?? ((path, input) => stringifyJSON({
+		path,
+		input
+	}));
+	return { call(path, input, callOptions) {
+		const key = keyFn(path, input);
+		const existing = inflight.get(key);
+		if (existing) return existing;
+		const promise = link.call(path, input, callOptions).finally(() => {
+			inflight.delete(key);
+		});
+		inflight.set(key, promise);
+		return promise;
+	} };
+}
+//#endregion
+export { withDedupe };

package/dist/client/plugins/index.d.mts

@@ -0,0 +1,8 @@
+import { RetryOptions, withRetry } from "./retry.mjs";
+import { CircuitBreakerOpenError, CircuitBreakerOptions, CircuitState, withCircuitBreaker } from "./circuit-breaker.mjs";
+import { TimeoutOptions, withTimeout } from "./timeout.mjs";
+import { BatchLink, BatchLinkOptions } from "./batch.mjs";
+import { DedupeOptions, withDedupe } from "./dedupe.mjs";
+import { CSRFLinkOptions, withCSRF } from "./csrf.mjs";
+import { ClientOtelOptions, withOtel } from "./otel.mjs";
+export { BatchLink, type BatchLinkOptions, type CSRFLinkOptions, CircuitBreakerOpenError, type CircuitBreakerOptions, type CircuitState, type ClientOtelOptions, type DedupeOptions, type RetryOptions, type TimeoutOptions, withCSRF, withCircuitBreaker, withDedupe, withOtel, withRetry, withTimeout };

package/dist/client/plugins/index.mjs

@@ -0,0 +1,8 @@
+import { withRetry } from "./retry.mjs";
+import { CircuitBreakerOpenError, withCircuitBreaker } from "./circuit-breaker.mjs";
+import { withTimeout } from "./timeout.mjs";
+import { BatchLink } from "./batch.mjs";
+import { withDedupe } from "./dedupe.mjs";
+import { withCSRF } from "./csrf.mjs";
+import { withOtel } from "./otel.mjs";
+export { BatchLink, CircuitBreakerOpenError, withCSRF, withCircuitBreaker, withDedupe, withOtel, withRetry, withTimeout };

package/dist/client/plugins/otel.d.mts

@@ -0,0 +1,12 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+import { Tracer } from "../../plugins/otel.mjs";
+
+//#region src/client/plugins/otel.d.ts
+interface ClientOtelOptions {
+  tracer: Tracer;
+  /** Span name prefix (default: 'rpc.client') */
+  spanName?: string;
+}
+declare function withOtel<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options: ClientOtelOptions): ClientLink<TClientContext>;
+//#endregion
+export { ClientOtelOptions, withOtel };

package/dist/client/plugins/otel.mjs

@@ -0,0 +1,27 @@
+//#region src/client/plugins/otel.ts
+function withOtel(link, options) {
+	const { tracer, spanName = "rpc.client" } = options;
+	return { async call(path, input, callOptions) {
+		const rpcMethod = path.join(".");
+		const span = tracer.startSpan(`${spanName}/${rpcMethod}`, { attributes: {
+			"rpc.system": "silgi",
+			"rpc.method": rpcMethod
+		} });
+		try {
+			const result = await link.call(path, input, callOptions);
+			span.setStatus({ code: 0 });
+			return result;
+		} catch (error) {
+			span.setStatus({
+				code: 2,
+				message: String(error)
+			});
+			span.addEvent("exception", { "exception.message": error instanceof Error ? error.message : String(error) });
+			throw error;
+		} finally {
+			span.end();
+		}
+	} };
+}
+//#endregion
+export { withOtel };

package/dist/client/plugins/retry.d.mts

@@ -0,0 +1,34 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+
+//#region src/client/plugins/retry.d.ts
+interface RetryOptions {
+  /** Maximum number of retry attempts (default: 3) */
+  maxRetries?: number;
+  /**
+   * Base delay in ms for exponential backoff (default: 1000).
+   * Actual delay: `baseDelay * 2^attempt + jitter`
+   * Or pass a function: `(attempt: number) => delayMs`
+   */
+  baseDelay?: number | ((attempt: number) => number);
+  /** Add random jitter 0-25% to prevent thundering herd (default: true) */
+  jitter?: boolean;
+  /**
+   * HTTP status codes to retry on (default: [408, 429, 500, 502, 503, 504]).
+   * Network errors (no status) are always retried unless shouldRetry returns false.
+   */
+  retryOn?: number[];
+  /** Custom retry predicate — return false to stop retrying */
+  shouldRetry?: (error: unknown, attempt: number) => boolean;
+  /** Called before each retry attempt */
+  onRetry?: (info: {
+    attempt: number;
+    delay: number;
+    error: unknown;
+    path: readonly string[];
+  }) => void;
+  /** Respect Retry-After header from 429/503 responses (default: true) */
+  respectRetryAfter?: boolean;
+}
+declare function withRetry<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options?: RetryOptions): ClientLink<TClientContext>;
+//#endregion
+export { RetryOptions, withRetry };

package/dist/client/plugins/retry.mjs

@@ -0,0 +1,79 @@
+//#region src/client/plugins/retry.ts
+const DEFAULT_RETRY_CODES = [
+	408,
+	429,
+	500,
+	502,
+	503,
+	504
+];
+function getStatusFromError(error) {
+	if (error && typeof error === "object") {
+		const e = error;
+		if (typeof e.status === "number") return e.status;
+		if (typeof e.statusCode === "number") return e.statusCode;
+		if (e.response && typeof e.response === "object") {
+			const r = e.response;
+			if (typeof r.status === "number") return r.status;
+		}
+	}
+}
+/** Parse Retry-After header value — returns delay in ms, or undefined */
+function parseRetryAfter(error) {
+	if (!error || typeof error !== "object") return void 0;
+	const e = error;
+	const headers = e.response?.headers ?? e.headers;
+	if (!headers) return void 0;
+	const value = typeof headers.get === "function" ? headers.get("retry-after") : headers["retry-after"];
+	if (!value) return void 0;
+	const seconds = Number(value);
+	if (!Number.isNaN(seconds)) return seconds * 1e3;
+	const date = Date.parse(value);
+	if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
+}
+function withRetry(link, options = {}) {
+	const maxRetries = options.maxRetries ?? 3;
+	const baseDelay = options.baseDelay ?? 1e3;
+	const useJitter = options.jitter ?? true;
+	const retryCodes = new Set(options.retryOn ?? DEFAULT_RETRY_CODES);
+	const shouldRetry = options.shouldRetry;
+	const onRetry = options.onRetry;
+	const respectRetryAfter = options.respectRetryAfter ?? true;
+	function getDelay(attempt) {
+		const base = typeof baseDelay === "function" ? baseDelay(attempt) : baseDelay * 2 ** attempt;
+		const jitter = useJitter ? base * Math.random() * .25 : 0;
+		return Math.round(base + jitter);
+	}
+	function isRetryable(error, attempt) {
+		if (shouldRetry && !shouldRetry(error, attempt)) return false;
+		const status = getStatusFromError(error);
+		if (status === void 0) return true;
+		return retryCodes.has(status);
+	}
+	return { async call(path, input, callOptions) {
+		for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+			return await link.call(path, input, callOptions);
+		} catch (error) {
+			if (attempt === maxRetries) throw error;
+			if (callOptions.signal?.aborted) throw error;
+			if (!isRetryable(error, attempt)) throw error;
+			const delay = (respectRetryAfter ? parseRetryAfter(error) : void 0) ?? getDelay(attempt);
+			onRetry?.({
+				attempt: attempt + 1,
+				delay,
+				error,
+				path
+			});
+			await new Promise((resolve, reject) => {
+				const timer = setTimeout(resolve, delay);
+				callOptions.signal?.addEventListener("abort", () => {
+					clearTimeout(timer);
+					reject(callOptions.signal.reason);
+				}, { once: true });
+			});
+		}
+		throw new Error("Retry exhausted");
+	} };
+}
+//#endregion
+export { withRetry };

package/dist/client/plugins/timeout.d.mts

@@ -0,0 +1,10 @@
+import { ClientContext, ClientLink } from "../types.mjs";
+
+//#region src/client/plugins/timeout.d.ts
+interface TimeoutOptions {
+  /** Timeout in ms (default: 30000) */
+  timeout?: number;
+}
+declare function withTimeout<TClientContext extends ClientContext>(link: ClientLink<TClientContext>, options?: TimeoutOptions): ClientLink<TClientContext>;
+//#endregion
+export { TimeoutOptions, withTimeout };

package/dist/client/plugins/timeout.mjs

@@ -0,0 +1,14 @@
+//#region src/client/plugins/timeout.ts
+function withTimeout(link, options = {}) {
+	const timeout = options.timeout ?? 3e4;
+	return { async call(path, input, callOptions) {
+		const timeoutSignal = AbortSignal.timeout(timeout);
+		const signal = callOptions.signal ? AbortSignal.any([callOptions.signal, timeoutSignal]) : timeoutSignal;
+		return link.call(path, input, {
+			...callOptions,
+			signal
+		});
+	} };
+}
+//#endregion
+export { withTimeout };

package/dist/client/server.d.mts

@@ -0,0 +1,16 @@
+import { InferClient, RouterDef } from "../types.mjs";
+
+//#region src/client/server.d.ts
+interface ServerClientOptions<TCtx extends Record<string, unknown>> {
+  /** Context factory — called for every procedure call */
+  context: () => TCtx | Promise<TCtx>;
+}
+/**
+ * Create a type-safe client that calls procedures directly in-process.
+ *
+ * No HTTP, no serialization, no network — just compiled pipeline execution.
+ * Uses the same compiled handlers as serve() and handler().
+ */
+declare function createServerClient<TRouter extends RouterDef, TCtx extends Record<string, unknown>>(router: TRouter, options: ServerClientOptions<TCtx>): InferClient<TRouter>;
+//#endregion
+export { ServerClientOptions, createServerClient };

package/dist/client/server.mjs

@@ -0,0 +1,59 @@
+import { compileRouter } from "../compile.mjs";
+//#region src/client/server.ts
+/**
+* Server-side client — call procedures directly without HTTP.
+*
+* Useful for SSR, server components, and testing where you want the
+* same typed client interface but without network overhead.
+*
+* @example
+* ```ts
+* import { createServerClient } from "silgi/client/server"
+*
+* const client = createServerClient(appRouter, {
+*   context: () => ({ db: getDB() }),
+* })
+*
+* // Same typed API as the HTTP client — but runs in-process
+* const users = await client.users.list({ limit: 10 })
+* ```
+*/
+/**
+* Create a type-safe client that calls procedures directly in-process.
+*
+* No HTTP, no serialization, no network — just compiled pipeline execution.
+* Uses the same compiled handlers as serve() and handler().
+*/
+function createServerClient(router, options) {
+	return createServerProxy(compileRouter(router), options.context, []);
+}
+function createServerProxy(flatRouter, contextFactory, path) {
+	const cache = /* @__PURE__ */ new Map();
+	const callProcedure = async (input) => {
+		const route = flatRouter("POST", "/" + path.join("/"))?.data;
+		if (!route) throw new Error(`Procedure not found: ${path.join("/")}`);
+		const ctx = Object.create(null);
+		const baseCtx = await contextFactory();
+		const keys = Object.keys(baseCtx);
+		for (let i = 0; i < keys.length; i++) ctx[keys[i]] = baseCtx[keys[i]];
+		const signal = new AbortController().signal;
+		return route.handler(ctx, input, signal);
+	};
+	return new Proxy(callProcedure, {
+		get(_target, prop) {
+			if (prop === "then") return void 0;
+			if (typeof prop !== "string") return void 0;
+			let cached = cache.get(prop);
+			if (!cached) {
+				cached = createServerProxy(flatRouter, contextFactory, [...path, prop]);
+				cache.set(prop, cached);
+			}
+			return cached;
+		},
+		apply(_target, _thisArg, args) {
+			return callProcedure(args[0]);
+		}
+	});
+}
+//#endregion
+export { createServerClient };

package/dist/client/types.d.mts

@@ -0,0 +1,29 @@
+import { SilgiError } from "../core/error.mjs";
+
+//#region src/client/types.d.ts
+type ClientContext = Record<PropertyKey, unknown>;
+interface ClientOptions<TContext extends ClientContext = ClientContext> {
+  signal?: AbortSignal;
+  lastEventId?: string;
+  context?: TContext;
+}
+/** A single procedure client — callable function */
+type Client<TClientContext extends ClientContext, TInput, TOutput, _TError = SilgiError> = (...args: ClientRest<TClientContext, TInput>) => Promise<TOutput>;
+/** A subscription client — returns async iterator */
+type SubscriptionClient<TClientContext extends ClientContext, TInput, TOutput> = (...args: ClientRest<TClientContext, TInput>) => AsyncIterableIterator<TOutput>;
+/** Determine argument shape based on input and context optionality */
+type ClientRest<TClientContext extends ClientContext, TInput> = undefined extends TInput ? Record<never, never> extends TClientContext ? [input?: TInput, options?: ClientOptions<TClientContext>] : [input: TInput | undefined, options: ClientOptions<TClientContext>] : Record<never, never> extends TClientContext ? [input: TInput, options?: ClientOptions<TClientContext>] : [input: TInput, options: ClientOptions<TClientContext>];
+/** Recursive nested client — mirrors the router structure */
+type NestedClient<TClientContext extends ClientContext = ClientContext> = Client<TClientContext, any, any, any> | SubscriptionClient<TClientContext, any, any> | {
+  [key: string]: NestedClient<TClientContext>;
+};
+/** Transport interface — how requests are sent */
+interface ClientLink<TClientContext extends ClientContext = ClientContext> {
+  call(path: readonly string[], input: unknown, options: ClientOptions<TClientContext>): Promise<unknown>;
+}
+/** Infer input types from a nested client */
+type InferClientInputs<T extends NestedClient> = T extends Client<any, infer TInput, any, any> ? TInput : T extends Record<string, NestedClient> ? { [K in keyof T]: InferClientInputs<T[K]> } : never;
+/** Infer output types from a nested client */
+type InferClientOutputs<T extends NestedClient> = T extends Client<any, any, infer TOutput, any> ? TOutput : T extends Record<string, NestedClient> ? { [K in keyof T]: InferClientOutputs<T[K]> } : never;
+//#endregion
+export { Client, ClientContext, ClientLink, ClientOptions, ClientRest, InferClientInputs, InferClientOutputs, NestedClient };

package/dist/codec/devalue.d.mts

@@ -0,0 +1,21 @@
+//#region src/codec/devalue.d.ts
+/**
+ * devalue codec — rich type serialization.
+ *
+ * Supports Date, Map, Set, BigInt, undefined, circular refs.
+ * 2.7x faster than superjson, 37% smaller output.
+ *
+ * Use when your RPC procedures return rich JS types
+ * that JSON.stringify can't handle.
+ */
+declare const DEVALUE_CONTENT_TYPE = "application/x-devalue+json";
+/** Serialize a value with devalue (handles Date, Map, Set, BigInt, etc.) */
+declare function encode(value: unknown): string;
+/** Deserialize a devalue string back to the original value, sanitized for safety */
+declare function decode(text: string): unknown;
+/** Check if request body uses devalue encoding */
+declare function isDevalue(contentType: string | null | undefined): boolean;
+/** Check if client accepts devalue responses */
+declare function acceptsDevalue(acceptHeader: string | null | undefined): boolean;
+//#endregion
+export { DEVALUE_CONTENT_TYPE, acceptsDevalue, decode, encode, isDevalue };

package/dist/codec/devalue.mjs

@@ -0,0 +1,33 @@
+import { sanitizeDecoded } from "./sanitize.mjs";
+import { parse, stringify } from "devalue";
+//#region src/codec/devalue.ts
+/**
+* devalue codec — rich type serialization.
+*
+* Supports Date, Map, Set, BigInt, undefined, circular refs.
+* 2.7x faster than superjson, 37% smaller output.
+*
+* Use when your RPC procedures return rich JS types
+* that JSON.stringify can't handle.
+*/
+const DEVALUE_CONTENT_TYPE = "application/x-devalue+json";
+/** Serialize a value with devalue (handles Date, Map, Set, BigInt, etc.) */
+function encode(value) {
+	return stringify(value);
+}
+/** Deserialize a devalue string back to the original value, sanitized for safety */
+function decode(text) {
+	return sanitizeDecoded(parse(text));
+}
+/** Check if request body uses devalue encoding */
+function isDevalue(contentType) {
+	if (!contentType) return false;
+	return contentType.includes(DEVALUE_CONTENT_TYPE);
+}
+/** Check if client accepts devalue responses */
+function acceptsDevalue(acceptHeader) {
+	if (!acceptHeader) return false;
+	return acceptHeader.includes(DEVALUE_CONTENT_TYPE);
+}
+//#endregion
+export { DEVALUE_CONTENT_TYPE, acceptsDevalue, decode, encode, isDevalue };

package/dist/codec/msgpack.d.mts

@@ -0,0 +1,18 @@
+//#region src/codec/msgpack.d.ts
+/**
+ * MessagePack codec — binary transport for Silgi.
+ *
+ * ~50% smaller payloads vs JSON. Uses msgpackr with record extension
+ * for fast encoding of repeated object shapes.
+ */
+declare const MSGPACK_CONTENT_TYPE = "application/x-msgpack";
+/** Encode a value to MessagePack binary (usable as Response body) */
+declare function encode(value: unknown): BodyInit;
+/** Decode a MessagePack Buffer to a value (safe for untrusted input) */
+declare function decode(buf: Buffer | Uint8Array): unknown;
+/** Check if a request accepts msgpack */
+declare function acceptsMsgpack(acceptHeader: string | null | undefined): boolean;
+/** Check if request body is msgpack */
+declare function isMsgpack(contentType: string | null | undefined): boolean;
+//#endregion
+export { MSGPACK_CONTENT_TYPE, acceptsMsgpack, decode, encode, isMsgpack };

package/dist/codec/msgpack.mjs

@@ -0,0 +1,45 @@
+import { sanitizeDecoded } from "./sanitize.mjs";
+import { Packr } from "msgpackr";
+//#region src/codec/msgpack.ts
+/**
+* MessagePack codec — binary transport for Silgi.
+*
+* ~50% smaller payloads vs JSON. Uses msgpackr with record extension
+* for fast encoding of repeated object shapes.
+*/
+const MSGPACK_CONTENT_TYPE = "application/x-msgpack";
+/**
+* Stateless msgpack codec — for request/response (no connection persistence).
+* Records disabled for cross-request compatibility.
+*/
+const encoder = new Packr({
+	useRecords: false,
+	moreTypes: true,
+	int64AsType: "number"
+});
+const decoder = new Packr({
+	useRecords: false,
+	moreTypes: false,
+	int64AsType: "number"
+});
+/** Encode a value to MessagePack binary (usable as Response body) */
+function encode(value) {
+	const buf = encoder.pack(value);
+	return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
+/** Decode a MessagePack Buffer to a value (safe for untrusted input) */
+function decode(buf) {
+	return sanitizeDecoded(decoder.unpack(buf));
+}
+/** Check if a request accepts msgpack */
+function acceptsMsgpack(acceptHeader) {
+	if (!acceptHeader) return false;
+	return acceptHeader.includes("application/x-msgpack") || acceptHeader.includes("application/msgpack");
+}
+/** Check if request body is msgpack */
+function isMsgpack(contentType) {
+	if (!contentType) return false;
+	return contentType.includes("application/x-msgpack") || contentType.includes("application/msgpack");
+}
+//#endregion
+export { MSGPACK_CONTENT_TYPE, acceptsMsgpack, decode, encode, isMsgpack };

package/dist/codec/sanitize.mjs

@@ -0,0 +1,38 @@
+//#region src/codec/sanitize.ts
+/**
+* Shared sanitizer for decoded codec values.
+*
+* Strips dangerous types (RegExp → ReDoS, Error → info disclosure)
+* and removes __proto__ keys (prototype pollution) from decoded payloads.
+* Used by both devalue and msgpack codecs.
+*/
+function sanitizeDecoded(value) {
+	if (value === null || value === void 0) return value;
+	if (typeof value !== "object") return value;
+	if (value instanceof RegExp) return String(value);
+	if (value instanceof Error) return { message: value.message };
+	if (value instanceof Date) return value;
+	if (Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) value[i] = sanitizeDecoded(value[i]);
+		return value;
+	}
+	if (value instanceof Map) {
+		const clean = /* @__PURE__ */ new Map();
+		for (const [k, v] of value) clean.set(sanitizeDecoded(k), sanitizeDecoded(v));
+		return clean;
+	}
+	if (value instanceof Set) {
+		const clean = /* @__PURE__ */ new Set();
+		for (const v of value) clean.add(sanitizeDecoded(v));
+		return clean;
+	}
+	const proto = Object.getPrototypeOf(value);
+	if (proto === Object.prototype || proto === null) {
+		const obj = value;
+		for (const key of Object.keys(obj)) if (key === "__proto__") delete obj[key];
+		else obj[key] = sanitizeDecoded(obj[key]);
+	}
+	return value;
+}
+//#endregion
+export { sanitizeDecoded };