@orpc/client 0.0.0-next.ba44cb8 → 0.0.0-next.ba7984f

package/dist/plugins/index.mjs

@@ -1,6 +1,7 @@
-import { isAsyncIteratorObject, value, splitInHalf, toArray } from '@orpc/shared';
-import { toBatchRequest, parseBatchResponse } from '@orpc/standard-server/batch';
-import { getEventMeta } from '@orpc/standard-server';
+import { isAsyncIteratorObject, defer, value, splitInHalf, toArray, stringifyJSON, overlayProxy, AsyncIteratorClass } from '@orpc/shared';
+import { toBatchRequest, parseBatchResponse, toBatchAbortSignal } from '@orpc/standard-server/batch';
+import { replicateStandardLazyResponse, getEventMeta, flattenHeader } from '@orpc/standard-server';
+import { C as COMMON_ORPC_ERROR_DEFS } from '../shared/client.Cf0lET_z.mjs';
 
 class BatchLinkPlugin {
   groups;
@@ -10,6 +11,7 @@ class BatchLinkPlugin {
   batchHeaders;
   mapRequestItem;
   exclude;
+  mode;
   pending;
   order = 5e6;
   constructor(options) {
@@ -17,6 +19,7 @@ class BatchLinkPlugin {
     this.pending = /* @__PURE__ */ new Map();
     this.maxSize = options.maxSize ?? 10;
     this.maxUrlLength = options.maxUrlLength ?? 2083;
+    this.mode = options.mode ?? "streaming";
     this.batchUrl = options.url ?? (([options2]) => `${options2.request.url.origin}${options2.request.url.pathname}/__batch__`);
     this.batchHeaders = options.headers ?? (([options2, ...rest]) => {
       const headers = {};
@@ -62,7 +65,7 @@ class BatchLinkPlugin {
       });
     });
     options.clientInterceptors.push((options2) => {
-      if (this.exclude(options2) || options2.request.body instanceof Blob || options2.request.body instanceof FormData || isAsyncIteratorObject(options2.request.body)) {
+      if (this.exclude(options2) || options2.request.body instanceof Blob || options2.request.body instanceof FormData || isAsyncIteratorObject(options2.request.body) || options2.request.signal?.aborted) {
         return options2.next();
       }
       const group = this.groups.find((group2) => group2.condition(options2));
@@ -71,7 +74,7 @@ class BatchLinkPlugin {
       }
       return new Promise((resolve, reject) => {
         this.#enqueueRequest(group, options2, resolve, reject);
-        setTimeout(() => this.#processPendingBatches());
+        defer(() => this.#processPendingBatches());
       });
     });
   }
@@ -127,16 +130,28 @@ class BatchLinkPlugin {
         this.#executeBatch(method, group, second);
         return;
       }
-      const lazyResponse = await options[0].next({
-        request: { ...batchRequest, headers: { ...batchRequest.headers, "x-orpc-batch": "1" } },
-        signal: batchRequest.signal,
-        context: group.context,
-        input: group.input,
-        path: toArray(group.path)
-      });
-      const parsed = parseBatchResponse({ ...lazyResponse, body: await lazyResponse.body() });
-      for await (const item of parsed) {
-        batchItems[item.index]?.[1]({ ...item, body: () => Promise.resolve(item.body) });
+      const mode = value(this.mode, options);
+      try {
+        const lazyResponse = await options[0].next({
+          request: { ...batchRequest, headers: { ...batchRequest.headers, "x-orpc-batch": mode } },
+          signal: batchRequest.signal,
+          context: group.context,
+          input: group.input,
+          path: toArray(group.path)
+        });
+        const parsed = parseBatchResponse({ ...lazyResponse, body: await lazyResponse.body() });
+        for await (const item of parsed) {
+          batchItems[item.index]?.[1]({ ...item, body: () => Promise.resolve(item.body) });
+        }
+      } catch (err) {
+        if (batchRequest.signal?.aborted && batchRequest.signal.reason === err) {
+          for (const [{ signal }, , reject] of batchItems) {
+            if (signal?.aborted) {
+              reject(signal.reason);
+            }
+          }
+        }
+        throw err;
       }
       throw new Error("Something went wrong make batch response not contains enough responses. This can be a bug please report it.");
     } catch (error) {
@@ -147,6 +162,101 @@ class BatchLinkPlugin {
   }
 }
 
+class DedupeRequestsPlugin {
+  #groups;
+  #filter;
+  order = 4e6;
+  // make sure execute before batch plugin
+  #queue = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.#groups = options.groups;
+    this.#filter = options.filter ?? (({ request }) => request.method === "GET");
+  }
+  init(options) {
+    options.clientInterceptors ??= [];
+    options.clientInterceptors.push((options2) => {
+      if (options2.request.body instanceof Blob || options2.request.body instanceof FormData || options2.request.body instanceof URLSearchParams || isAsyncIteratorObject(options2.request.body) || !this.#filter(options2)) {
+        return options2.next();
+      }
+      const group = this.#groups.find((group2) => group2.condition(options2));
+      if (!group) {
+        return options2.next();
+      }
+      return new Promise((resolve, reject) => {
+        this.#enqueue(group, options2, resolve, reject);
+        defer(() => this.#dequeue());
+      });
+    });
+  }
+  #enqueue(group, options, resolve, reject) {
+    let queue = this.#queue.get(group);
+    if (!queue) {
+      this.#queue.set(group, queue = []);
+    }
+    const matched = queue.find((item) => {
+      const requestString1 = stringifyJSON({
+        body: item.options.request.body,
+        headers: item.options.request.headers,
+        method: item.options.request.method,
+        url: item.options.request.url
+      });
+      const requestString2 = stringifyJSON({
+        body: options.request.body,
+        headers: options.request.headers,
+        method: options.request.method,
+        url: options.request.url
+      });
+      return requestString1 === requestString2;
+    });
+    if (matched) {
+      matched.signals.push(options.request.signal);
+      matched.resolves.push(resolve);
+      matched.rejects.push(reject);
+    } else {
+      queue.push({
+        options,
+        signals: [options.request.signal],
+        resolves: [resolve],
+        rejects: [reject]
+      });
+    }
+  }
+  async #dequeue() {
+    const promises = [];
+    for (const [group, items] of this.#queue) {
+      for (const { options, signals, resolves, rejects } of items) {
+        promises.push(
+          this.#execute(group, options, signals, resolves, rejects)
+        );
+      }
+    }
+    this.#queue.clear();
+    await Promise.all(promises);
+  }
+  async #execute(group, options, signals, resolves, rejects) {
+    try {
+      const dedupedRequest = {
+        ...options.request,
+        signal: toBatchAbortSignal(signals)
+      };
+      const response = await options.next({
+        ...options,
+        request: dedupedRequest,
+        signal: dedupedRequest.signal,
+        context: group.context
+      });
+      const replicatedResponses = replicateStandardLazyResponse(response, resolves.length);
+      for (const resolve of resolves) {
+        resolve(replicatedResponses.shift());
+      }
+    } catch (error) {
+      for (const reject of rejects) {
+        reject(error);
+      }
+    }
+  }
+}
+
 class ClientRetryPluginInvalidEventIteratorRetryResponse extends Error {
 }
 class ClientRetryPlugin {
@@ -154,6 +264,7 @@ class ClientRetryPlugin {
   defaultRetryDelay;
   defaultShouldRetry;
   defaultOnRetry;
+  order = 18e5;
   constructor(options = {}) {
     this.defaultRetry = options.default?.retry ?? 0;
     this.defaultRetryDelay = options.default?.retryDelay ?? ((o) => o.lastEventRetry ?? 2e3);
@@ -208,7 +319,7 @@ class ClientRetryPlugin {
             return await interceptorOptions.next(updatedInterceptorOptions);
           } catch (error) {
             currentError = { error };
-            if (updatedInterceptorOptions.signal?.aborted === true) {
+            if (updatedInterceptorOptions.signal?.aborted) {
               throw error;
             }
           } finally {
@@ -221,19 +332,17 @@ class ClientRetryPlugin {
       if (!isAsyncIteratorObject(output)) {
         return output;
       }
-      return async function* () {
-        let current = output;
-        try {
+      let current = output;
+      let isIteratorAborted = false;
+      return overlayProxy(() => current, new AsyncIteratorClass(
+        async () => {
           while (true) {
             try {
               const item = await current.next();
               const meta = getEventMeta(item.value);
               lastEventId = meta?.id ?? lastEventId;
               lastEventRetry = meta?.retry ?? lastEventRetry;
-              if (item.done) {
-                return item.value;
-              }
-              yield item.value;
+              return item;
             } catch (error) {
               const meta = getEventMeta(error);
               lastEventId = meta?.id ?? lastEventId;
@@ -245,12 +354,97 @@ class ClientRetryPlugin {
                 );
               }
               current = maybeEventIterator;
+              if (isIteratorAborted) {
+                await current.return?.();
+                throw error;
+              }
             }
           }
-        } finally {
-          await current.return?.();
+        },
+        async (reason) => {
+          isIteratorAborted = true;
+          if (reason !== "next") {
+            await current.return?.();
+          }
         }
-      }();
+      ));
+    });
+  }
+}
+
+class RetryAfterPlugin {
+  condition;
+  maxAttempts;
+  timeout;
+  order = 19e5;
+  constructor(options = {}) {
+    this.condition = options.condition ?? ((response) => response.status === COMMON_ORPC_ERROR_DEFS.TOO_MANY_REQUESTS.status || response.status === COMMON_ORPC_ERROR_DEFS.SERVICE_UNAVAILABLE.status);
+    this.maxAttempts = options.maxAttempts ?? 3;
+    this.timeout = options.timeout ?? 5 * 60 * 1e3;
+  }
+  init(options) {
+    options.clientInterceptors ??= [];
+    options.clientInterceptors.push(async (interceptorOptions) => {
+      const startTime = Date.now();
+      let attemptCount = 0;
+      while (true) {
+        attemptCount++;
+        const response = await interceptorOptions.next();
+        if (!value(this.condition, response, interceptorOptions)) {
+          return response;
+        }
+        const retryAfterHeader = flattenHeader(response.headers["retry-after"]);
+        const retryAfterMs = this.parseRetryAfterHeader(retryAfterHeader);
+        if (retryAfterMs === void 0) {
+          return response;
+        }
+        if (attemptCount >= value(this.maxAttempts, response, interceptorOptions)) {
+          return response;
+        }
+        const timeoutMs = value(this.timeout, response, interceptorOptions);
+        const elapsedTime = Date.now() - startTime;
+        if (elapsedTime + retryAfterMs > timeoutMs) {
+          return response;
+        }
+        await this.delayExecution(retryAfterMs, interceptorOptions.signal);
+        if (interceptorOptions.signal?.aborted) {
+          return response;
+        }
+      }
+    });
+  }
+  parseRetryAfterHeader(value2) {
+    value2 = value2?.trim();
+    if (!value2) {
+      return void 0;
+    }
+    const seconds = Number(value2);
+    if (Number.isFinite(seconds)) {
+      return Math.max(0, seconds * 1e3);
+    }
+    const retryDate = Date.parse(value2);
+    if (!Number.isNaN(retryDate)) {
+      return Math.max(0, retryDate - Date.now());
+    }
+    return void 0;
+  }
+  delayExecution(ms, signal) {
+    return new Promise((resolve) => {
+      if (signal?.aborted) {
+        resolve();
+        return;
+      }
+      let timeout;
+      const onAbort = () => {
+        clearTimeout(timeout);
+        timeout = void 0;
+        resolve();
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      timeout = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      }, ms);
     });
   }
 }
@@ -288,4 +482,4 @@ class SimpleCsrfProtectionLinkPlugin {
   }
 }
 
-export { BatchLinkPlugin, ClientRetryPlugin, ClientRetryPluginInvalidEventIteratorRetryResponse, SimpleCsrfProtectionLinkPlugin };
+export { BatchLinkPlugin, ClientRetryPlugin, ClientRetryPluginInvalidEventIteratorRetryResponse, DedupeRequestsPlugin, RetryAfterPlugin, SimpleCsrfProtectionLinkPlugin };

package/dist/shared/{client.7ZYxJok_.d.ts → client.2jUAqzYU.d.ts}

@@ -1,6 +1,6 @@
-import { Interceptor, ThrowableError } from '@orpc/shared';
+import { Interceptor } from '@orpc/shared';
 import { StandardRequest, StandardLazyResponse } from '@orpc/standard-server';
-import { a as ClientContext, b as ClientOptions, C as ClientLink } from './client.4TS_0JaO.js';
+import { b as ClientContext, c as ClientOptions, C as ClientLink } from './client.i2uoJbEp.js';
 
 interface StandardLinkPlugin<T extends ClientContext> {
     order?: number;
@@ -28,12 +28,11 @@ interface StandardLinkClientInterceptorOptions<T extends ClientContext> extends
     request: StandardRequest;
 }
 interface StandardLinkOptions<T extends ClientContext> {
-    interceptors?: Interceptor<StandardLinkInterceptorOptions<T>, unknown, ThrowableError>[];
-    clientInterceptors?: Interceptor<StandardLinkClientInterceptorOptions<T>, StandardLazyResponse, ThrowableError>[];
+    interceptors?: Interceptor<StandardLinkInterceptorOptions<T>, Promise<unknown>>[];
+    clientInterceptors?: Interceptor<StandardLinkClientInterceptorOptions<T>, Promise<StandardLazyResponse>>[];
     plugins?: StandardLinkPlugin<T>[];
 }
 declare class StandardLink<T extends ClientContext> implements ClientLink<T> {
-    #private;
     readonly codec: StandardLinkCodec<T>;
     readonly sender: StandardLinkClient<T>;
     private readonly interceptors;

package/dist/shared/{client.B2432-Lu.d.ts → client.B3pNRBih.d.ts}

@@ -1,6 +1,6 @@
-import { a as ClientContext, b as ClientOptions, d as HTTPMethod } from './client.4TS_0JaO.js';
-import { e as StandardLinkCodec, b as StandardLinkOptions, d as StandardLink, f as StandardLinkClient } from './client.7ZYxJok_.js';
-import { Segment, Value } from '@orpc/shared';
+import { b as ClientContext, c as ClientOptions, f as HTTPMethod } from './client.i2uoJbEp.js';
+import { e as StandardLinkCodec, b as StandardLinkOptions, d as StandardLink, f as StandardLinkClient } from './client.2jUAqzYU.js';
+import { Segment, Value, Promisable } from '@orpc/shared';
 import { StandardHeaders, StandardRequest, StandardLazyResponse } from '@orpc/standard-server';
 
 declare const STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES: {
@@ -44,19 +44,19 @@ interface StandardRPCLinkCodecOptions<T extends ClientContext> {
     /**
      * Base url for all requests.
      */
-    url: Value<string | URL, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    url: Value<Promisable<string | URL>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The maximum length of the URL.
      *
      * @default 2083
      */
-    maxUrlLength?: Value<number, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    maxUrlLength?: Value<Promisable<number>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The method used to make the request.
      *
      * @default 'POST'
      */
-    method?: Value<Exclude<HTTPMethod, 'HEAD'>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    method?: Value<Promisable<Exclude<HTTPMethod, 'HEAD'>>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The method to use when the payload cannot safely pass to the server with method return from method function.
      * GET is not allowed, it's very dangerous.
@@ -67,7 +67,7 @@ interface StandardRPCLinkCodecOptions<T extends ClientContext> {
     /**
      * Inject headers to the request.
      */
-    headers?: Value<StandardHeaders, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    headers?: Value<Promisable<StandardHeaders | Headers>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
 }
 declare class StandardRPCLinkCodec<T extends ClientContext> implements StandardLinkCodec<T> {
     private readonly serializer;

package/dist/shared/{client.ClwIM_ku.d.mts → client.BFAVy68H.d.mts}

@@ -1,6 +1,6 @@
-import { a as ClientContext, b as ClientOptions, d as HTTPMethod } from './client.4TS_0JaO.mjs';
-import { e as StandardLinkCodec, b as StandardLinkOptions, d as StandardLink, f as StandardLinkClient } from './client.ds1abV85.mjs';
-import { Segment, Value } from '@orpc/shared';
+import { b as ClientContext, c as ClientOptions, f as HTTPMethod } from './client.i2uoJbEp.mjs';
+import { e as StandardLinkCodec, b as StandardLinkOptions, d as StandardLink, f as StandardLinkClient } from './client.CpCa3si8.mjs';
+import { Segment, Value, Promisable } from '@orpc/shared';
 import { StandardHeaders, StandardRequest, StandardLazyResponse } from '@orpc/standard-server';
 
 declare const STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES: {
@@ -44,19 +44,19 @@ interface StandardRPCLinkCodecOptions<T extends ClientContext> {
     /**
      * Base url for all requests.
      */
-    url: Value<string | URL, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    url: Value<Promisable<string | URL>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The maximum length of the URL.
      *
      * @default 2083
      */
-    maxUrlLength?: Value<number, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    maxUrlLength?: Value<Promisable<number>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The method used to make the request.
      *
      * @default 'POST'
      */
-    method?: Value<Exclude<HTTPMethod, 'HEAD'>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    method?: Value<Promisable<Exclude<HTTPMethod, 'HEAD'>>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
     /**
      * The method to use when the payload cannot safely pass to the server with method return from method function.
      * GET is not allowed, it's very dangerous.
@@ -67,7 +67,7 @@ interface StandardRPCLinkCodecOptions<T extends ClientContext> {
     /**
      * Inject headers to the request.
      */
-    headers?: Value<StandardHeaders, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
+    headers?: Value<Promisable<StandardHeaders | Headers>, [options: ClientOptions<T>, path: readonly string[], input: unknown]>;
 }
 declare class StandardRPCLinkCodec<T extends ClientContext> implements StandardLinkCodec<T> {
     private readonly serializer;

package/dist/shared/client.BLtwTQUg.mjs

@@ -0,0 +1,40 @@
+import { AsyncIteratorClass, isTypescriptObject } from '@orpc/shared';
+import { getEventMeta, withEventMeta } from '@orpc/standard-server';
+
+function mapEventIterator(iterator, maps) {
+  const mapError = async (error) => {
+    let mappedError = await maps.error(error);
+    if (mappedError !== error) {
+      const meta = getEventMeta(error);
+      if (meta && isTypescriptObject(mappedError)) {
+        mappedError = withEventMeta(mappedError, meta);
+      }
+    }
+    return mappedError;
+  };
+  return new AsyncIteratorClass(async () => {
+    const { done, value } = await (async () => {
+      try {
+        return await iterator.next();
+      } catch (error) {
+        throw await mapError(error);
+      }
+    })();
+    let mappedValue = await maps.value(value, done);
+    if (mappedValue !== value) {
+      const meta = getEventMeta(value);
+      if (meta && isTypescriptObject(mappedValue)) {
+        mappedValue = withEventMeta(mappedValue, meta);
+      }
+    }
+    return { done, value: mappedValue };
+  }, async () => {
+    try {
+      await iterator.return?.();
+    } catch (error) {
+      throw await mapError(error);
+    }
+  });
+}
+
+export { mapEventIterator as m };

package/dist/shared/{client.DpICn1BD.mjs → client.C9dDzeMy.mjs}

@@ -1,6 +1,8 @@
-import { toArray, intercept, isObject, value, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
+import { toArray, runWithSpan, ORPC_NAME, isAsyncIteratorObject, asyncIteratorWithSpan, intercept, getGlobalOtelConfig, isObject, value, stringifyJSON } from '@orpc/shared';
 import { mergeStandardHeaders, ErrorEvent } from '@orpc/standard-server';
-import { C as COMMON_ORPC_ERROR_DEFS, b as isORPCErrorStatus, c as isORPCErrorJson, d as createORPCErrorFromJson, O as ORPCError, m as mapEventIterator, t as toORPCError } from './client.CRWEpqLB.mjs';
+import { C as COMMON_ORPC_ERROR_DEFS, d as isORPCErrorStatus, e as isORPCErrorJson, g as createORPCErrorFromJson, c as ORPCError, t as toORPCError } from './client.Cf0lET_z.mjs';
+import { toStandardHeaders as toStandardHeaders$1 } from '@orpc/standard-server-fetch';
+import { m as mapEventIterator } from './client.BLtwTQUg.mjs';
 
 class CompositeStandardLinkPlugin {
   plugins;
@@ -26,20 +28,52 @@ class StandardLink {
   interceptors;
   clientInterceptors;
   call(path, input, options) {
-    return intercept(this.interceptors, { ...options, path, input }, async ({ path: path2, input: input2, ...options2 }) => {
-      const output = await this.#call(path2, input2, options2);
-      return output;
-    });
-  }
-  async #call(path, input, options) {
-    const request = await this.codec.encode(path, input, options);
-    const response = await intercept(
-      this.clientInterceptors,
-      { ...options, input, path, request },
-      ({ input: input2, path: path2, request: request2, ...options2 }) => this.sender.call(request2, options2, path2, input2)
+    return runWithSpan(
+      { name: `${ORPC_NAME}.${path.join("/")}`, signal: options.signal },
+      (span) => {
+        span?.setAttribute("rpc.system", ORPC_NAME);
+        span?.setAttribute("rpc.method", path.join("."));
+        if (isAsyncIteratorObject(input)) {
+          input = asyncIteratorWithSpan(
+            { name: "consume_event_iterator_input", signal: options.signal },
+            input
+          );
+        }
+        return intercept(this.interceptors, { ...options, path, input }, async ({ path: path2, input: input2, ...options2 }) => {
+          const otelConfig = getGlobalOtelConfig();
+          let otelContext;
+          const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
+          if (currentSpan && otelConfig) {
+            otelContext = otelConfig?.trace.setSpan(otelConfig.context.active(), currentSpan);
+          }
+          const request = await runWithSpan(
+            { name: "encode_request", context: otelContext },
+            () => this.codec.encode(path2, input2, options2)
+          );
+          const response = await intercept(
+            this.clientInterceptors,
+            { ...options2, input: input2, path: path2, request },
+            ({ input: input3, path: path3, request: request2, ...options3 }) => {
+              return runWithSpan(
+                { name: "send_request", signal: options3.signal, context: otelContext },
+                () => this.sender.call(request2, options3, path3, input3)
+              );
+            }
+          );
+          const output = await runWithSpan(
+            { name: "decode_response", context: otelContext },
+            () => this.codec.decode(response, options2, path2, input2)
+          );
+          if (isAsyncIteratorObject(output)) {
+            return asyncIteratorWithSpan(
+              { name: "consume_event_iterator_output", signal: options2.signal },
+              output
+            );
+          }
+          return output;
+        });
+      }
     );
-    const output = await this.codec.decode(response, options, path, input);
-    return output;
   }
 }
 
@@ -138,6 +172,9 @@ class StandardRPCJsonSerializer {
         segments.forEach((segment) => {
           currentRef = currentRef[preSegment];
           preSegment = segment;
+          if (!Object.hasOwn(currentRef, preSegment)) {
+            throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`);
+          }
         });
         currentRef[preSegment] = getBlob(i);
       });
@@ -149,6 +186,9 @@ class StandardRPCJsonSerializer {
       for (let i = 1; i < item.length; i++) {
         currentRef = currentRef[preSegment];
         preSegment = item[i];
+        if (!Object.hasOwn(currentRef, preSegment)) {
+          throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`);
+        }
       }
       for (const custom of this.customSerializers) {
         if (custom.type === type) {
@@ -192,6 +232,12 @@ class StandardRPCJsonSerializer {
 function toHttpPath(path) {
   return `/${path.map(encodeURIComponent).join("/")}`;
 }
+function toStandardHeaders(headers) {
+  if (typeof headers.forEach === "function") {
+    return toStandardHeaders$1(headers);
+  }
+  return headers;
+}
 function getMalformedResponseErrorCode(status) {
   return Object.entries(COMMON_ORPC_ERROR_DEFS).find(([, def]) => def.status === status)?.[0] ?? "MALFORMED_ORPC_ERROR_RESPONSE";
 }
@@ -211,14 +257,14 @@ class StandardRPCLinkCodec {
   expectedMethod;
   headers;
   async encode(path, input, options) {
+    let headers = toStandardHeaders(await value(this.headers, options, path, input));
+    if (options.lastEventId !== void 0) {
+      headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
+    }
     const expectedMethod = await value(this.expectedMethod, options, path, input);
-    let headers = await value(this.headers, options, path, input);
     const baseUrl = await value(this.baseUrl, options, path, input);
     const url = new URL(baseUrl);
     url.pathname = `${url.pathname.replace(/\/$/, "")}${toHttpPath(path)}`;
-    if (options.lastEventId !== void 0) {
-      headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
-    }
     const serialized = this.serializer.serialize(input);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
       const maxUrlLength = await value(this.maxUrlLength, options, path, input);
@@ -330,6 +376,9 @@ class StandardRPCSerializer {
     return this.#deserialize(data);
   }
   #deserialize(data) {
+    if (data === void 0) {
+      return void 0;
+    }
     if (!(data instanceof FormData)) {
       return this.jsonSerializer.deserialize(data.json, data.meta ?? []);
     }
@@ -352,4 +401,4 @@ class StandardRPCLink extends StandardLink {
   }
 }
 
-export { CompositeStandardLinkPlugin as C, StandardLink as S, STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES as a, StandardRPCJsonSerializer as b, StandardRPCLink as c, StandardRPCLinkCodec as d, StandardRPCSerializer as e, getMalformedResponseErrorCode as g, toHttpPath as t };
+export { CompositeStandardLinkPlugin as C, StandardLink as S, STANDARD_RPC_JSON_SERIALIZER_BUILT_IN_TYPES as a, StandardRPCJsonSerializer as b, StandardRPCLink as c, StandardRPCLinkCodec as d, StandardRPCSerializer as e, toStandardHeaders as f, getMalformedResponseErrorCode as g, toHttpPath as t };