@orpc/node 2.0.0-beta.40 → 2.0.0-beta.41

package/README.md

@@ -85,7 +85,7 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
 
 <table>
   <tr>
-   <td width="2000"><a href="https://screenshotone.com/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener" title="The screenshot API for developers"><img src="https://avatars.githubusercontent.com/u/97035603?v=4" width="64" align="left" hspace="12" alt="ScreenshotOne.com"/><b>ScreenshotOne.com</b></a><br /><sub>The screenshot API for developers</sub></td>
+   <td width="2000"><a href="https://screenshotone.com/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="The screenshot API for developers"><img src="https://avatars.githubusercontent.com/u/97035603?v=4" width="64" align="left" hspace="12" alt="ScreenshotOne.com"/><b>ScreenshotOne.com</b></a><br /><sub>The screenshot API for developers</sub></td>
   </tr>
   <tr>
    <td width="2000"><a href="https://yuzu.health/careers?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="We&#39;re hiring NYC based engineers"><img src="https://avatars.githubusercontent.com/u/102488956?v=4" width="64" align="left" hspace="12" alt="Yuzu"/><b>Yuzu</b></a><br /><sub>We&#39;re hiring NYC based engineers</sub></td>
@@ -127,19 +127,18 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
    <td align="center"><a href="https://soymilk.party/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="あわわわとーにゅ"><img src="https://avatars.githubusercontent.com/u/17376330?u=de3353804be889f009f7e0a1582daf04d0ab292d&amp;v=4" width="139" alt="あわわわとーにゅ"/><br />あわわわとーにゅ</a></td>
    <td align="center"><a href="https://github.com/nicognaW?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="nk"><img src="https://avatars.githubusercontent.com/u/66731869?u=4699bda3a9092d3ec34fbd959450767bcc8b8b6d&amp;v=4" width="139" alt="nk"/><br />nk</a></td>
    <td align="center"><a href="https://supastarter.dev/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="supastarter"><img src="https://avatars.githubusercontent.com/u/110960143?v=4" width="139" alt="supastarter"/><br />supastarter</a></td>
-   <td align="center"><a href="https://github.com/divmgl?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Dexter Miguel"><img src="https://avatars.githubusercontent.com/u/5452298?u=645993204be8696c085ecf0d228c3062efe2ed65&amp;v=4" width="139" alt="Dexter Miguel"/><br />Dexter Miguel</a></td>
    <td align="center"><a href="https://github.com/herrfugbaum?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="herrfugbaum"><img src="https://avatars.githubusercontent.com/u/12859776?u=644dc1666d0220bc0468eb0de3c56b919f635b16&amp;v=4" width="139" alt="herrfugbaum"/><br />herrfugbaum</a></td>
+   <td align="center"><a href="https://laststance.io/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ryota Murakami"><img src="https://avatars.githubusercontent.com/u/5501268?u=599389e03340734325726ca3f8f423c021d47d7f&amp;v=4" width="139" alt="Ryota Murakami"/><br />Ryota Murakami</a></td>
   </tr>
   <tr>
-   <td align="center"><a href="https://laststance.io/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ryota Murakami"><img src="https://avatars.githubusercontent.com/u/5501268?u=599389e03340734325726ca3f8f423c021d47d7f&amp;v=4" width="139" alt="Ryota Murakami"/><br />Ryota Murakami</a></td>
    <td align="center"><a href="https://cra.mr/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="David Cramer"><img src="https://avatars.githubusercontent.com/u/23610?v=4" width="139" alt="David Cramer"/><br />David Cramer</a></td>
    <td align="center"><a href="https://valerii15298.github.io/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Valerii Petryniak"><img src="https://avatars.githubusercontent.com/u/44531564?u=88ac74d9bacd20401518441907acad21063cd397&amp;v=4" width="139" alt="Valerii Petryniak"/><br />Valerii Petryniak</a></td>
    <td align="center"><a href="https://letstri.dev/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Valerii Strilets"><img src="https://avatars.githubusercontent.com/u/13253748?u=c7b10399ccc8f8081e24db94ec32cd9858e86ac3&amp;v=4" width="139" alt="Valerii Strilets"/><br />Valerii Strilets</a></td>
    <td align="center"><a href="https://blacklight.sh/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Kyle Mistele"><img src="https://avatars.githubusercontent.com/u/18430555?u=3afebeb81de666e35aaac3ed46f14159d7603ffb&amp;v=4" width="139" alt="Kyle Mistele"/><br />Kyle Mistele</a></td>
    <td align="center"><a href="https://github.com/christ12938?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="christ12938"><img src="https://avatars.githubusercontent.com/u/25758598?v=4" width="139" alt="christ12938"/><br />christ12938</a></td>
+   <td align="center"><a href="https://github.com/Ryanjso?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ryan Soderberg"><img src="https://avatars.githubusercontent.com/u/39172778?u=5ed913c31d57e7221b75784abcad48c7ebddde27&amp;v=4" width="139" alt="Ryan Soderberg"/><br />Ryan Soderberg</a></td>
   </tr>
   <tr>
-   <td align="center"><a href="https://github.com/Ryanjso?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ryan Soderberg"><img src="https://avatars.githubusercontent.com/u/39172778?u=5ed913c31d57e7221b75784abcad48c7ebddde27&amp;v=4" width="139" alt="Ryan Soderberg"/><br />Ryan Soderberg</a></td>
    <td align="center"><a href="https://github.com/itigoore01?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="shota"><img src="https://avatars.githubusercontent.com/u/11831107?u=c976a6dc7e055eb026304c46c99100ed22b0c8e0&amp;v=4" width="139" alt="shota"/><br />shota</a></td>
    <td align="center"><a href="https://github.com/ellis-driscoll?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ellis Driscoll"><img src="https://avatars.githubusercontent.com/u/70685966?u=c5f95bc33b5991d9744abe00052542e4a2ed3cb9&amp;v=4" width="139" alt="Ellis Driscoll"/><br />Ellis Driscoll</a></td>
    <td align="center"><a href="https://github.com/hoangbn?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Hoang Nguyen"><img src="https://avatars.githubusercontent.com/u/38968280?u=c90084c6de65c56facabab7ba13a72a49ddbc3e4&amp;v=4" width="139" alt="Hoang Nguyen"/><br />Hoang Nguyen</a></td>
@@ -173,12 +172,13 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
    <td align="center"><a href="https://kellychan.im/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Kelly Peilin Chan"><img src="https://avatars.githubusercontent.com/u/520852?u=6b0f7105f694e7b5cacf410a3f04c7044b469dc8&amp;v=4" width="119" alt="Kelly Peilin Chan"/><br />Kelly Peilin Chan</a></td>
    <td align="center"><a href="https://guyariely.com/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Guy Ariely"><img src="https://avatars.githubusercontent.com/u/42813496?u=edb6b7f563bf28e160a290832e7da57c0506f8ca&amp;v=4" width="119" alt="Guy Ariely"/><br />Guy Ariely</a></td>
    <td align="center"><a href="https://paulsenon.com/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="PaulSenon"><img src="https://avatars.githubusercontent.com/u/19531087?u=6385741eb91d200b8c513ec6045482e301767ca6&amp;v=4" width="119" alt="PaulSenon"/><br />PaulSenon</a></td>
+   <td align="center"><a href="https://nakasyou.how/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Shotaro Nakamura"><img src="https://avatars.githubusercontent.com/u/79000684?u=f644df3f29f0e8677a90967115774564f1d9d6ab&amp;v=4" width="119" alt="Shotaro Nakamura"/><br />Shotaro Nakamura</a></td>
    <td align="center"><a href="https://piscis.dev/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Alex"><img src="https://avatars.githubusercontent.com/u/326163?u=b245f368bd940cf51d08c0b6bf55f8257f359437&amp;v=4" width="119" alt="Alex"/><br />Alex</a></td>
    <td align="center"><a href="https://opensource.gubanov.eu/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Andrey Gubanov"><img src="https://avatars.githubusercontent.com/u/1082083?u=c5f2daf7ebece498e85c83367bb37b4e10e2649d&amp;v=4" width="119" alt="Andrey Gubanov"/><br />Andrey Gubanov</a></td>
   </tr>
 </table>
 
-With thanks to [36 past sponsors](https://htmlpreview.github.io/?https://github.com/middleapi/static/blob/main/sponsors.svg) who helped get oRPC here.
+With thanks to [38 past sponsors](https://orpc.dev/sponsors#past-sponsors) who helped get oRPC here.
 
 ## References
 

package/dist/index.d.mts

@@ -83,6 +83,8 @@ interface StaticFileHandlerPluginOptions {
     cacheControl?: string | false;
     /**
      * Whether files and directories whose name starts with a dot can be served.
+     * When disabled, names shaped like 8.3 short names, such as `ENV~1`, are refused too,
+     * since NTFS and FAT resolve them to dotfiles.
      *
      * @default false
      */
@@ -175,10 +177,11 @@ declare class StaticFileHandlerPlugin<T extends Context> implements StandardHand
 
 interface TmpFileUploadHandlerPluginMaxBodySize {
     /**
-     * The maximum total size in bytes of request body content that is parsed
-     * into memory: JSON, URL-encoded forms, and the plain fields of a multipart
-     * body. A larger body rejects the request with `PAYLOAD_TOO_LARGE`. Usually
-     * the lowest of the three limits, because this content cannot stream anywhere.
+     * The maximum size in bytes of request body content buffered into memory:
+     * JSON, URL-encoded forms, and the fields and part headers of a multipart
+     * body in total, and each event of an event stream on its own. Exceeding it
+     * rejects with `PAYLOAD_TOO_LARGE`. Usually the lowest of the three limits,
+     * because this content cannot stream anywhere.
      */
     memory: number;
     /**
@@ -191,7 +194,8 @@ interface TmpFileUploadHandlerPluginMaxBodySize {
      * The maximum total size in bytes of a request body that is consumed as a
      * stream: event streams and raw binary streams. Enforced while the stream is
      * consumed, so an oversized stream fails at the reader. Usually the highest
-     * of the three limits, because this content is consumed on the fly.
+     * of the three limits, but keep it finite so no client can stream
+     * indefinitely.
      */
     stream: number;
 }
@@ -257,8 +261,8 @@ declare class TmpFile extends File {
  * far larger than available memory parse in constant memory. Every other body is left
  * to the standard parser.
  *
- * Request body sizes are limited per content category: memory-parsed, spooled to
- * disk, and streamed, each limit fixed or resolved per request. This subsumes the
+ * Request body sizes are limited per content category: buffered in memory, spooled
+ * to disk, and streamed, each limit fixed or resolved per request. This subsumes the
  * request limit plugin while sizing each kind of body to what it actually costs.
  *
  * @remarks
@@ -287,7 +291,7 @@ declare class TmpFileUploadHandlerPlugin<T extends Context> implements StandardH
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
     private resolveBody;
     /**
-     * Enforces a size limit on a body the standard parser handles, counting the
+     * Enforces size limits on a body the standard parser handles, counting the
      * raw bytes before handing them back for regular parsing.
      */
     private parseLimitedBody;

package/dist/index.d.ts

@@ -83,6 +83,8 @@ interface StaticFileHandlerPluginOptions {
     cacheControl?: string | false;
     /**
      * Whether files and directories whose name starts with a dot can be served.
+     * When disabled, names shaped like 8.3 short names, such as `ENV~1`, are refused too,
+     * since NTFS and FAT resolve them to dotfiles.
      *
      * @default false
      */
@@ -175,10 +177,11 @@ declare class StaticFileHandlerPlugin<T extends Context> implements StandardHand
 
 interface TmpFileUploadHandlerPluginMaxBodySize {
     /**
-     * The maximum total size in bytes of request body content that is parsed
-     * into memory: JSON, URL-encoded forms, and the plain fields of a multipart
-     * body. A larger body rejects the request with `PAYLOAD_TOO_LARGE`. Usually
-     * the lowest of the three limits, because this content cannot stream anywhere.
+     * The maximum size in bytes of request body content buffered into memory:
+     * JSON, URL-encoded forms, and the fields and part headers of a multipart
+     * body in total, and each event of an event stream on its own. Exceeding it
+     * rejects with `PAYLOAD_TOO_LARGE`. Usually the lowest of the three limits,
+     * because this content cannot stream anywhere.
      */
     memory: number;
     /**
@@ -191,7 +194,8 @@ interface TmpFileUploadHandlerPluginMaxBodySize {
      * The maximum total size in bytes of a request body that is consumed as a
      * stream: event streams and raw binary streams. Enforced while the stream is
      * consumed, so an oversized stream fails at the reader. Usually the highest
-     * of the three limits, because this content is consumed on the fly.
+     * of the three limits, but keep it finite so no client can stream
+     * indefinitely.
      */
     stream: number;
 }
@@ -257,8 +261,8 @@ declare class TmpFile extends File {
  * far larger than available memory parse in constant memory. Every other body is left
  * to the standard parser.
  *
- * Request body sizes are limited per content category: memory-parsed, spooled to
- * disk, and streamed, each limit fixed or resolved per request. This subsumes the
+ * Request body sizes are limited per content category: buffered in memory, spooled
+ * to disk, and streamed, each limit fixed or resolved per request. This subsumes the
  * request limit plugin while sizing each kind of body to what it actually costs.
  *
  * @remarks
@@ -287,7 +291,7 @@ declare class TmpFileUploadHandlerPlugin<T extends Context> implements StandardH
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
     private resolveBody;
     /**
-     * Enforces a size limit on a body the standard parser handles, counting the
+     * Enforces size limits on a body the standard parser handles, counting the
      * raw bytes before handing them back for regular parsing.
      */
     private parseLimitedBody;

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import { Duplex } from 'node:stream';
 import { constants, createGzip, createDeflate, createDeflateRaw } from 'node:zlib';
-import { toArray, isNoTransformCacheControl, parseAcceptEncodingQualities, stringifyJSON, varyByAcceptEncoding, mergeHttpPath, safeDecodeURIComponent, matchesHttpPathPrefix, safeEncodeURIComponent, isCompressibleContentType, getTracer, value, isAsyncIteratorObject, override, wrapAsyncIterator, wrapReadableStream } from '@orpc/shared';
+import { negotiateResponseCompressionEncoding, toCompressedHeaders } from '@orpc/server/plugins';
+import { toArray, stringifyJSON, mergeHttpPath, safeDecodeURIComponent, matchesHttpPathPrefix, safeEncodeURIComponent, isCompressibleContentType, parseAcceptEncodingQualities, isAcceptableEncoding, getTracer, value, isAsyncIteratorObject, override, wrapAsyncIterator, wrapReadableStream } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, resolveStandardBodyHint, getFilenameFromContentDisposition } from '@standard-server/core';
 import { createReadStream, openAsBlob } from 'node:fs';
 import { realpath, stat, mkdtemp, appendFile, rm } from 'node:fs/promises';
@@ -40,19 +41,7 @@ class BatchResponseCompressionHandlerPlugin {
       if (response.status >= 400) {
         return result;
       }
-      if (flattenStandardHeader(headers["content-encoding"]) !== void 0) {
-        return result;
-      }
-      if (response.status === 206 || flattenStandardHeader(headers["content-range"]) !== void 0) {
-        return result;
-      }
-      if (isNoTransformCacheControl(flattenStandardHeader(headers["cache-control"]))) {
-        return result;
-      }
-      const acceptEncodings = parseAcceptEncodingQualities(
-        flattenStandardHeader(interceptorOptions.request.headers["accept-encoding"])
-      );
-      const encoding = this.encodings.find((enc) => (acceptEncodings.get(enc) ?? 0) > 0);
+      const encoding = negotiateResponseCompressionEncoding(response, interceptorOptions.request.headers, this.encodings);
       if (encoding === void 0) {
         return result;
       }
@@ -95,11 +84,8 @@ class BatchResponseCompressionHandlerPlugin {
           ...response,
           body: stream.pipeThrough(createFlushingCompressionStream(encoding)),
           headers: {
-            ...headers,
-            ...bodyHeaders,
-            "content-length": [],
-            "content-encoding": encoding,
-            "vary": varyByAcceptEncoding(flattenStandardHeader(headers.vary))
+            ...toCompressedHeaders(headers, encoding),
+            ...bodyHeaders
           }
         }
       };
@@ -120,6 +106,7 @@ function createFlushingCompressionStream(encoding) {
 }
 
 const TEXT_CONTENT_TYPE_REGEX = /^text\//;
+const SHORT_NAME_ALIAS_REGEX = /^[^.]{0,6}~\d/;
 const PRECOMPRESSED_ENCODINGS = [
   ["br", ".br"],
   ["zstd", ".zst"],
@@ -258,7 +245,7 @@ class StaticFileHandlerPlugin {
       if (segment.includes("\0") || segment.includes("/") || segment.includes("\\")) {
         return void 0;
       }
-      if (!this.dotfiles && segment.startsWith(".")) {
+      if (!this.dotfiles && (segment.startsWith(".") || SHORT_NAME_ALIAS_REGEX.test(segment))) {
         return void 0;
       }
       segments.push(segment);
@@ -309,7 +296,7 @@ class StaticFileHandlerPlugin {
     let contentEncoding;
     if (negotiatesEncoding) {
       const qualities = parseAcceptEncodingQualities(flattenStandardHeader(request.headers["accept-encoding"]));
-      const variants = await Promise.all(PRECOMPRESSED_ENCODINGS.filter(([encoding]) => (qualities.get(encoding) ?? qualities.get("*") ?? 0) > 0).map(async ([encoding, extension]) => {
+      const variants = await Promise.all(PRECOMPRESSED_ENCODINGS.filter(([encoding]) => isAcceptableEncoding(qualities, encoding)).map(async ([encoding, extension]) => {
         const candidatePath = filePath + extension;
         const [candidateStats, containedRealPath] = await Promise.all([
           stat(candidatePath).catch(() => void 0),
@@ -482,32 +469,39 @@ async function parseMultipart(source, boundary, onPart) {
           buffer = Buffer.alloc(0);
           return;
         }
+        state = "transport-padding";
+        continue;
+      }
+      if (state === "transport-padding") {
         let index = 0;
         while (index < buffer.length && (buffer[index] === 32 || buffer[index] === 9)) {
           index++;
         }
-        if (index + 1 >= buffer.length) {
+        buffer = buffer.subarray(index);
+        if (buffer.length < 2) {
           return;
         }
-        if (buffer[index] !== 13 || buffer[index + 1] !== 10) {
+        if (buffer[0] !== 13 || buffer[1] !== 10) {
           throw new TypeError("Invalid multipart body: expected CRLF after a boundary delimiter");
         }
-        buffer = buffer.subarray(index + 2);
+        buffer = buffer.subarray(2);
         state = "headers";
         continue;
       }
       if (buffer[0] === 13 && buffer[1] === 10) {
         throw new TypeError("Invalid multipart body: part is missing the content-disposition header");
       }
-      const headerEnd = buffer.indexOf(HEADER_BLOCK_END);
+      const headerWindow = MAX_PART_HEADER_SIZE + HEADER_BLOCK_END.length;
+      const headerEnd = buffer.subarray(0, headerWindow).indexOf(HEADER_BLOCK_END);
       if (headerEnd === -1) {
-        if (buffer.length > MAX_PART_HEADER_SIZE) {
+        if (buffer.length >= headerWindow) {
           throw new TypeError("Invalid multipart body: part headers exceed the maximum allowed size");
         }
         return;
       }
-      const part = parsePartHeaders(buffer.subarray(0, headerEnd).toString());
-      buffer = buffer.subarray(headerEnd + HEADER_BLOCK_END.length);
+      const headerSize = headerEnd + HEADER_BLOCK_END.length;
+      const part = parsePartHeaders(buffer.subarray(0, headerEnd).toString(), headerSize);
+      buffer = buffer.subarray(headerSize);
       writer = await onPart(part);
       state = "body";
     }
@@ -523,7 +517,7 @@ async function parseMultipart(source, boundary, onPart) {
     throw new TypeError("Invalid multipart body: unexpected end of body");
   }
 }
-function parsePartHeaders(block) {
+function parsePartHeaders(block, headerSize) {
   let contentDisposition;
   let contentType;
   for (const line of block.split("\r\n")) {
@@ -555,7 +549,8 @@ function parsePartHeaders(block) {
   return {
     name: decodeContentDispositionParameter(name),
     filename: filename === void 0 ? void 0 : decodeContentDispositionParameter(filename),
-    type: contentType
+    type: contentType,
+    headerSize
   };
 }
 function decodeContentDispositionParameter(value) {
@@ -569,13 +564,15 @@ function parseHeaderParameters(header) {
     while (index < header.length && (header[index] === " " || header[index] === "	")) {
       index++;
     }
-    const equals = header.indexOf("=", index);
-    const nextSemicolon = header.indexOf(";", index);
-    if (equals === -1 || nextSemicolon !== -1 && nextSemicolon < equals) {
-      if (nextSemicolon === -1) {
-        break;
-      }
-      index = nextSemicolon;
+    let equals = index;
+    while (equals < header.length && header[equals] !== "=" && header[equals] !== ";") {
+      equals++;
+    }
+    if (equals === header.length) {
+      break;
+    }
+    if (header[equals] === ";") {
+      index = equals;
       continue;
     }
     const key = header.slice(index, equals).trim().toLowerCase();
@@ -695,14 +692,15 @@ class TmpFileUploadHandlerPlugin {
     if (resolvedHint === "json" || resolvedHint === "url-search-params") {
       return this.parseLimitedBody(request, hint, resolvedHint, maxBodySize.memory);
     }
-    return this.parseLimitedBody(request, hint, resolvedHint, maxBodySize.stream);
+    const eventLimit = resolvedHint === "event-stream" ? maxBodySize.memory : Number.POSITIVE_INFINITY;
+    return this.parseLimitedBody(request, hint, resolvedHint, maxBodySize.stream, eventLimit);
   }
   /**
-   * Enforces a size limit on a body the standard parser handles, counting the
+   * Enforces size limits on a body the standard parser handles, counting the
    * raw bytes before handing them back for regular parsing.
    */
-  async parseLimitedBody(request, hint, resolvedHint, limit) {
-    if (limit === Number.POSITIVE_INFINITY) {
+  async parseLimitedBody(request, hint, resolvedHint, limit, eventLimit = Number.POSITIVE_INFINITY) {
+    if (limit === Number.POSITIVE_INFINITY && eventLimit === Number.POSITIVE_INFINITY) {
       return request.resolveBody(hint);
     }
     assertContentLengthWithin(request.headers, limit);
@@ -710,7 +708,8 @@ class TmpFileUploadHandlerPlugin {
     if (!(stream instanceof ReadableStream)) {
       return stream;
     }
-    const response = new Response(limitStream(stream, limit), {
+    const fits = eventLimit < limit ? createEventSizeCheck(eventLimit) : void 0;
+    const response = new Response(limitStream(stream, limit, fits), {
       headers: toFetchHeaders(request.headers)
     });
     return toStandardBody(response, { hint: resolvedHint });
@@ -745,18 +744,21 @@ class TmpFileUploadHandlerPlugin {
     }
     const limited = totalLimit === Number.POSITIVE_INFINITY ? stream : limitStream(stream, totalLimit);
     const form = new FormData();
-    let memoryUsed = 0;
-    let fileUsed = 0;
+    const used = { memory: 0, file: 0 };
+    const charge = (category, size) => {
+      used[category] += size;
+      if (used[category] > maxBodySize[category]) {
+        throw new ORPCError("PAYLOAD_TOO_LARGE");
+      }
+    };
     await parseMultipart(limited, boundary, (part) => {
       const name = part.name;
+      charge("memory", part.headerSize);
       if (part.filename === void 0) {
         const chunks = [];
         return {
           write: (chunk) => {
-            memoryUsed += chunk.length;
-            if (memoryUsed > maxBodySize.memory) {
-              throw new ORPCError("PAYLOAD_TOO_LARGE");
-            }
+            charge("memory", chunk.length);
             chunks.push(Buffer.from(chunk));
           },
           end: () => {
@@ -769,10 +771,7 @@ class TmpFileUploadHandlerPlugin {
       let tmpPath;
       return {
         write: async (chunk) => {
-          fileUsed += chunk.length;
-          if (fileUsed > maxBodySize.file) {
-            throw new ORPCError("PAYLOAD_TOO_LARGE");
-          }
+          charge("file", chunk.length);
           tmpPath ??= await tmpFiles.allocate();
           await tmpFiles.append(tmpPath, chunk);
         },
@@ -791,12 +790,12 @@ function assertContentLengthWithin(headers, limit) {
     throw new ORPCError("PAYLOAD_TOO_LARGE");
   }
 }
-function limitStream(stream, limit) {
+function limitStream(stream, limit, fits = () => true) {
   let total = 0;
   return stream.pipeThrough(new TransformStream({
     transform(chunk, controller) {
       total += chunk.byteLength;
-      if (total > limit) {
+      if (total > limit || !fits(chunk)) {
         controller.error(new ORPCError("PAYLOAD_TOO_LARGE"));
         return;
       }
@@ -804,6 +803,51 @@ function limitStream(stream, limit) {
     }
   }));
 }
+const CR = 13;
+const LF = 10;
+function createEventSizeCheck(eventLimit) {
+  let eventSize = 0;
+  let trailing = "none";
+  return (chunk) => {
+    const bytes = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+    let nextCR = indexOrEnd(bytes, CR, 0);
+    let nextLF = indexOrEnd(bytes, LF, 0);
+    let offset = 0;
+    while (true) {
+      const lineEnding = Math.min(nextCR, nextLF);
+      if (lineEnding > offset) {
+        eventSize += lineEnding - offset;
+        trailing = "none";
+      }
+      if (lineEnding === bytes.length) {
+        return eventSize <= eventLimit;
+      }
+      const byte = bytes[lineEnding];
+      offset = lineEnding + 1;
+      if (byte === CR) {
+        nextCR = indexOrEnd(bytes, CR, offset);
+      } else {
+        nextLF = indexOrEnd(bytes, LF, offset);
+      }
+      if (eventSize === 0) {
+        continue;
+      }
+      if (++eventSize > eventLimit) {
+        return false;
+      }
+      if (trailing === "line" || trailing === "cr" && byte === CR) {
+        eventSize = 0;
+        trailing = "none";
+      } else {
+        trailing = byte === CR ? "cr" : "line";
+      }
+    }
+  };
+}
+function indexOrEnd(bytes, byte, from) {
+  const index = bytes.indexOf(byte, from);
+  return index === -1 ? bytes.length : index;
+}
 const EMPTY_CHUNK = new Uint8Array(0);
 class RequestTmpFiles {
   constructor(tmpDir) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/node",
   "type": "module",
-  "version": "2.0.0-beta.40",
+  "version": "2.0.0-beta.41",
   "description": "Node.js plugins for oRPC: static file serving, temporary file uploads, and batch response compression",
   "license": "MIT",
   "funding": [
@@ -36,15 +36,15 @@
     "dist"
   ],
   "dependencies": {
-    "@orpc/server": "2.0.0-beta.40",
-    "@orpc/shared": "2.0.0-beta.40",
-    "@standard-server/core": "~0.9.2",
-    "@standard-server/fetch": "~0.9.2",
-    "@standard-server/node": "~0.9.2",
+    "@orpc/server": "2.0.0-beta.41",
+    "@orpc/shared": "2.0.0-beta.41",
+    "@standard-server/core": "~0.10.0",
+    "@standard-server/fetch": "~0.10.0",
+    "@standard-server/node": "~0.10.0",
     "mime": "^4.1.0"
   },
   "devDependencies": {
-    "@orpc/client": "2.0.0-beta.40",
+    "@orpc/client": "2.0.0-beta.41",
     "supertest": "^7.2.2"
   },
   "scripts": {