@orpc/openapi-client 0.0.0-next.e82d760 → 0.0.0-next.e91d2fd

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -17,6 +17,9 @@
17
17
  <a href="https://discord.gg/TXEbwRBvQn">
18
18
  <img alt="Discord" src="https://img.shields.io/discord/1308966753044398161?color=7389D8&label&logo=discord&logoColor=ffffff" />
19
19
  </a>
20
+ <a href="https://deepwiki.com/unnoq/orpc">
21
+ <img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki">
22
+ </a>
20
23
  </div>
21
24
 
22
25
  <h3 align="center">Typesafe APIs Made Simple 🪄</h3>
@@ -30,7 +33,8 @@
30
33
  - **🔗 End-to-End Type Safety**: Ensure type-safe inputs, outputs, and errors from client to server.
31
34
  - **📘 First-Class OpenAPI**: Built-in support that fully adheres to the OpenAPI standard.
32
35
  - **📝 Contract-First Development**: Optionally define your API contract before implementation.
33
- - **⚙️ Framework Integrations**: Seamlessly integrate with TanStack Query (React, Vue, Solid, Svelte, Angular), Pinia Colada, and more.
36
+ - **🔍 First-Class OpenTelemetry**: Seamlessly integrate with OpenTelemetry for observability.
37
+ - **⚙️ Framework Integrations**: Seamlessly integrate with TanStack Query (React, Vue, Solid, Svelte, Angular), SWR, Pinia Colada, and more.
34
38
  - **🚀 Server Actions**: Fully compatible with React Server Actions on Next.js, TanStack Start, and other platforms.
35
39
  - **🔠 Standard Schema Support**: Works out of the box with Zod, Valibot, ArkType, and other schema validators.
36
40
  - **🗃️ Native Types**: Supports native types like Date, File, Blob, BigInt, URL, and more.
@@ -38,7 +42,6 @@
38
42
  - **📡 SSE & Streaming**: Enjoy full type-safe support for SSE and streaming.
39
43
  - **🌍 Multi-Runtime Support**: Fast and lightweight on Cloudflare, Deno, Bun, Node.js, and beyond.
40
44
  - **🔌 Extendability**: Easily extend functionality with plugins, middleware, and interceptors.
41
- - **🛡️ Reliability**: Well-tested, TypeScript-based, production-ready, and MIT licensed.
42
45
 
43
46
  ## Documentation
44
47
 
@@ -50,9 +53,11 @@ You can find the full documentation [here](https://orpc.unnoq.com).
50
53
  - [@orpc/server](https://www.npmjs.com/package/@orpc/server): Build your API or implement API contract.
51
54
  - [@orpc/client](https://www.npmjs.com/package/@orpc/client): Consume your API on the client with type-safety.
52
55
  - [@orpc/openapi](https://www.npmjs.com/package/@orpc/openapi): Generate OpenAPI specs and handle OpenAPI requests.
56
+ - [@orpc/otel](https://www.npmjs.com/package/@orpc/otel): [OpenTelemetry](https://opentelemetry.io/) integration for observability.
53
57
  - [@orpc/nest](https://www.npmjs.com/package/@orpc/nest): Deeply integrate oRPC with [NestJS](https://nestjs.com/).
54
58
  - [@orpc/react](https://www.npmjs.com/package/@orpc/react): Utilities for integrating oRPC with React and React Server Actions.
55
59
  - [@orpc/tanstack-query](https://www.npmjs.com/package/@orpc/tanstack-query): [TanStack Query](https://tanstack.com/query/latest) integration.
60
+ - [@orpc/experimental-react-swr](https://www.npmjs.com/package/@orpc/experimental-react-swr): [SWR](https://swr.vercel.app/) integration.
56
61
  - [@orpc/vue-colada](https://www.npmjs.com/package/@orpc/vue-colada): Integration with [Pinia Colada](https://pinia-colada.esm.dev/).
57
62
  - [@orpc/hey-api](https://www.npmjs.com/package/@orpc/hey-api): [Hey API](https://heyapi.dev/) integration.
58
63
  - [@orpc/zod](https://www.npmjs.com/package/@orpc/zod): More schemas that [Zod](https://zod.dev/) doesn't support yet.
@@ -1,12 +1,12 @@
1
1
  import { ClientContext } from '@orpc/client';
2
2
  import { LinkFetchClientOptions } from '@orpc/client/fetch';
3
3
  import { AnyContractRouter } from '@orpc/contract';
4
- import { f as StandardOpenAPILinkOptions, g as StandardOpenAPILink } from '../../shared/openapi-client.Bc2pHPqD.mjs';
4
+ import { g as StandardOpenAPILinkOptions, h as StandardOpenAPILink } from '../../shared/openapi-client.Cv0hBP4Y.mjs';
5
5
  import '@orpc/client/standard';
6
6
  import '@orpc/shared';
7
7
  import '@orpc/standard-server';
8
8
 
9
- interface OpenAPILinkOptions<T extends ClientContext> extends StandardOpenAPILinkOptions<T>, LinkFetchClientOptions<T> {
9
+ interface OpenAPILinkOptions<T extends ClientContext> extends LinkFetchClientOptions<T>, Omit<StandardOpenAPILinkOptions<T>, 'plugins'> {
10
10
  }
11
11
  /**
12
12
  * The OpenAPI Link for fetch runtime communicates with the server that follow the OpenAPI specification.
@@ -1,12 +1,12 @@
1
1
  import { ClientContext } from '@orpc/client';
2
2
  import { LinkFetchClientOptions } from '@orpc/client/fetch';
3
3
  import { AnyContractRouter } from '@orpc/contract';
4
- import { f as StandardOpenAPILinkOptions, g as StandardOpenAPILink } from '../../shared/openapi-client.Bc2pHPqD.js';
4
+ import { g as StandardOpenAPILinkOptions, h as StandardOpenAPILink } from '../../shared/openapi-client.Cv0hBP4Y.js';
5
5
  import '@orpc/client/standard';
6
6
  import '@orpc/shared';
7
7
  import '@orpc/standard-server';
8
8
 
9
- interface OpenAPILinkOptions<T extends ClientContext> extends StandardOpenAPILinkOptions<T>, LinkFetchClientOptions<T> {
9
+ interface OpenAPILinkOptions<T extends ClientContext> extends LinkFetchClientOptions<T>, Omit<StandardOpenAPILinkOptions<T>, 'plugins'> {
10
10
  }
11
11
  /**
12
12
  * The OpenAPI Link for fetch runtime communicates with the server that follow the OpenAPI specification.
@@ -1,10 +1,11 @@
1
1
  import { LinkFetchClient } from '@orpc/client/fetch';
2
2
  import '@orpc/shared';
3
3
  import '@orpc/contract';
4
- import { b as StandardOpenAPILink } from '../../shared/openapi-client.Bix5hHnT.mjs';
4
+ import { a as StandardOpenAPILink } from '../../shared/openapi-client.InKGcjFv.mjs';
5
5
  import '@orpc/client';
6
6
  import '@orpc/client/standard';
7
7
  import '@orpc/standard-server';
8
+ import '../../shared/openapi-client.t9fCAe3x.mjs';
8
9
 
9
10
  class OpenAPILink extends StandardOpenAPILink {
10
11
  constructor(contract, options) {
@@ -1,63 +1,11 @@
1
- export { S as StandardBracketNotationSerialized, a as StandardBracketNotationSerializer, c as StandardOpenAPICustomJsonSerializer, b as StandardOpenAPIJsonSerialized, e as StandardOpenAPIJsonSerializer, d as StandardOpenAPIJsonSerializerOptions, g as StandardOpenAPILink, f as StandardOpenAPILinkOptions, j as StandardOpenAPISerializeOptions, k as StandardOpenAPISerializer, i as StandardOpenapiLinkCodec, h as StandardOpenapiLinkCodecOptions } from '../../shared/openapi-client.Bc2pHPqD.mjs';
1
+ export { S as StandardBracketNotationSerialized, b as StandardBracketNotationSerializer, a as StandardBracketNotationSerializerOptions, d as StandardOpenAPICustomJsonSerializer, c as StandardOpenAPIJsonSerialized, f as StandardOpenAPIJsonSerializer, e as StandardOpenAPIJsonSerializerOptions, h as StandardOpenAPILink, g as StandardOpenAPILinkOptions, k as StandardOpenAPISerializeOptions, l as StandardOpenAPISerializer, j as StandardOpenapiLinkCodec, i as StandardOpenapiLinkCodecOptions } from '../../shared/openapi-client.Cv0hBP4Y.mjs';
2
+ export { getIssueMessage, parseFormData } from '../../helpers/index.mjs';
2
3
  import { HTTPPath } from '@orpc/client';
3
4
  import '@orpc/client/standard';
4
5
  import '@orpc/contract';
5
6
  import '@orpc/shared';
6
7
  import '@orpc/standard-server';
7
8
 
8
- /**
9
- * parse a form data with bracket notation
10
- *
11
- * @example
12
- * ```ts
13
- * const form = new FormData()
14
- * form.append('a', '1')
15
- * form.append('user[name]', 'John')
16
- * form.append('user[age]', '20')
17
- * form.append('user[friends][]', 'Bob')
18
- * form.append('user[friends][]', 'Alice')
19
- * form.append('user[friends][]', 'Charlie')
20
- * form.append('thumb', new Blob(['hello']), 'thumb.png')
21
- *
22
- * parseFormData(form)
23
- * // {
24
- * // a: '1',
25
- * // user: {
26
- * // name: 'John',
27
- * // age: '20',
28
- * // friends: ['Bob', 'Alice', 'Charlie'],
29
- * // },
30
- * // thumb: form.get('thumb'),
31
- * // }
32
- * ```
33
- *
34
- * @see {@link https://orpc.unnoq.com/docs/openapi/bracket-notation Bracket Notation Docs}
35
- */
36
- declare function parseFormData(form: FormData): any;
37
- /**
38
- * Get the issue message from the error.
39
- *
40
- * @param error - The error (can be anything) can contain `data.issues` (standard schema issues)
41
- * @param path - The path of the field that has the issue follow [bracket notation](https://orpc.unnoq.com/docs/openapi/bracket-notation)
42
- *
43
- * @example
44
- * ```tsx
45
- * const { error, data, execute } = useServerAction(someAction)
46
- *
47
- * return <form action={(form) => execute(parseFormData(form))}>
48
- * <input name="user[name]" type="text" />
49
- * <p>{getIssueMessage(error, 'user[name]')}</p>
50
- *
51
- * <input name="user[age]" type="number" />
52
- * <p>{getIssueMessage(error, 'user[age]')}</p>
53
- *
54
- * <input name="images[]" type="file" />
55
- * <p>{getIssueMessage(error, 'images[]')}</p>
56
- * </form>
57
- *
58
- */
59
- declare function getIssueMessage(error: unknown, path: string): string | undefined;
60
-
61
9
  /**
62
10
  * @internal
63
11
  */
@@ -70,4 +18,4 @@ declare function getDynamicParams(path: HTTPPath | undefined): {
70
18
  name: string;
71
19
  }[] | undefined;
72
20
 
73
- export { getDynamicParams, getIssueMessage, parseFormData, standardizeHTTPPath };
21
+ export { getDynamicParams, standardizeHTTPPath };
@@ -1,63 +1,11 @@
1
- export { S as StandardBracketNotationSerialized, a as StandardBracketNotationSerializer, c as StandardOpenAPICustomJsonSerializer, b as StandardOpenAPIJsonSerialized, e as StandardOpenAPIJsonSerializer, d as StandardOpenAPIJsonSerializerOptions, g as StandardOpenAPILink, f as StandardOpenAPILinkOptions, j as StandardOpenAPISerializeOptions, k as StandardOpenAPISerializer, i as StandardOpenapiLinkCodec, h as StandardOpenapiLinkCodecOptions } from '../../shared/openapi-client.Bc2pHPqD.js';
1
+ export { S as StandardBracketNotationSerialized, b as StandardBracketNotationSerializer, a as StandardBracketNotationSerializerOptions, d as StandardOpenAPICustomJsonSerializer, c as StandardOpenAPIJsonSerialized, f as StandardOpenAPIJsonSerializer, e as StandardOpenAPIJsonSerializerOptions, h as StandardOpenAPILink, g as StandardOpenAPILinkOptions, k as StandardOpenAPISerializeOptions, l as StandardOpenAPISerializer, j as StandardOpenapiLinkCodec, i as StandardOpenapiLinkCodecOptions } from '../../shared/openapi-client.Cv0hBP4Y.js';
2
+ export { getIssueMessage, parseFormData } from '../../helpers/index.js';
2
3
  import { HTTPPath } from '@orpc/client';
3
4
  import '@orpc/client/standard';
4
5
  import '@orpc/contract';
5
6
  import '@orpc/shared';
6
7
  import '@orpc/standard-server';
7
8
 
8
- /**
9
- * parse a form data with bracket notation
10
- *
11
- * @example
12
- * ```ts
13
- * const form = new FormData()
14
- * form.append('a', '1')
15
- * form.append('user[name]', 'John')
16
- * form.append('user[age]', '20')
17
- * form.append('user[friends][]', 'Bob')
18
- * form.append('user[friends][]', 'Alice')
19
- * form.append('user[friends][]', 'Charlie')
20
- * form.append('thumb', new Blob(['hello']), 'thumb.png')
21
- *
22
- * parseFormData(form)
23
- * // {
24
- * // a: '1',
25
- * // user: {
26
- * // name: 'John',
27
- * // age: '20',
28
- * // friends: ['Bob', 'Alice', 'Charlie'],
29
- * // },
30
- * // thumb: form.get('thumb'),
31
- * // }
32
- * ```
33
- *
34
- * @see {@link https://orpc.unnoq.com/docs/openapi/bracket-notation Bracket Notation Docs}
35
- */
36
- declare function parseFormData(form: FormData): any;
37
- /**
38
- * Get the issue message from the error.
39
- *
40
- * @param error - The error (can be anything) can contain `data.issues` (standard schema issues)
41
- * @param path - The path of the field that has the issue follow [bracket notation](https://orpc.unnoq.com/docs/openapi/bracket-notation)
42
- *
43
- * @example
44
- * ```tsx
45
- * const { error, data, execute } = useServerAction(someAction)
46
- *
47
- * return <form action={(form) => execute(parseFormData(form))}>
48
- * <input name="user[name]" type="text" />
49
- * <p>{getIssueMessage(error, 'user[name]')}</p>
50
- *
51
- * <input name="user[age]" type="number" />
52
- * <p>{getIssueMessage(error, 'user[age]')}</p>
53
- *
54
- * <input name="images[]" type="file" />
55
- * <p>{getIssueMessage(error, 'images[]')}</p>
56
- * </form>
57
- *
58
- */
59
- declare function getIssueMessage(error: unknown, path: string): string | undefined;
60
-
61
9
  /**
62
10
  * @internal
63
11
  */
@@ -70,4 +18,4 @@ declare function getDynamicParams(path: HTTPPath | undefined): {
70
18
  name: string;
71
19
  }[] | undefined;
72
20
 
73
- export { getDynamicParams, getIssueMessage, parseFormData, standardizeHTTPPath };
21
+ export { getDynamicParams, standardizeHTTPPath };
@@ -1,43 +1,8 @@
1
- import { S as StandardBracketNotationSerializer } from '../../shared/openapi-client.Bix5hHnT.mjs';
2
- export { a as StandardOpenAPIJsonSerializer, b as StandardOpenAPILink, d as StandardOpenAPISerializer, c as StandardOpenapiLinkCodec, g as getDynamicParams, s as standardizeHTTPPath } from '../../shared/openapi-client.Bix5hHnT.mjs';
3
- import { isSchemaIssue } from '@orpc/contract';
4
- import { isTypescriptObject } from '@orpc/shared';
1
+ export { S as StandardBracketNotationSerializer } from '../../shared/openapi-client.t9fCAe3x.mjs';
2
+ export { g as getIssueMessage, p as parseFormData } from '../../shared/openapi-client.Dgl8z2tb.mjs';
3
+ export { S as StandardOpenAPIJsonSerializer, a as StandardOpenAPILink, c as StandardOpenAPISerializer, b as StandardOpenapiLinkCodec, g as getDynamicParams, s as standardizeHTTPPath } from '../../shared/openapi-client.InKGcjFv.mjs';
4
+ import '@orpc/shared';
5
+ import '@orpc/contract';
5
6
  import '@orpc/client/standard';
6
7
  import '@orpc/client';
7
8
  import '@orpc/standard-server';
8
-
9
- function parseFormData(form) {
10
- const serializer = new StandardBracketNotationSerializer();
11
- return serializer.deserialize(Array.from(form.entries()));
12
- }
13
- function getIssueMessage(error, path) {
14
- if (!isTypescriptObject(error) || !isTypescriptObject(error.data) || !Array.isArray(error.data.issues)) {
15
- return void 0;
16
- }
17
- const serializer = new StandardBracketNotationSerializer();
18
- for (const issue of error.data.issues) {
19
- if (!isSchemaIssue(issue)) {
20
- continue;
21
- }
22
- if (issue.path === void 0) {
23
- if (path === "") {
24
- return issue.message;
25
- }
26
- continue;
27
- }
28
- const issuePath = serializer.stringifyPath(
29
- issue.path.map((segment) => typeof segment === "object" ? segment.key.toString() : segment.toString())
30
- );
31
- if (issuePath === path) {
32
- return issue.message;
33
- }
34
- if (path.endsWith("[]") && issuePath.replace(/\[(?:0|[1-9]\d*)\]$/, "[]") === path) {
35
- return issue.message;
36
- }
37
- if (path === "" && issuePath.match(/(?:0|[1-9]\d*)$/)) {
38
- return issue.message;
39
- }
40
- }
41
- }
42
-
43
- export { StandardBracketNotationSerializer, getIssueMessage, parseFormData };
@@ -0,0 +1,54 @@
1
+ /**
2
+ * parse a form data with bracket notation
3
+ *
4
+ * @example
5
+ * ```ts
6
+ * const form = new FormData()
7
+ * form.append('a', '1')
8
+ * form.append('user[name]', 'John')
9
+ * form.append('user[age]', '20')
10
+ * form.append('user[friends][]', 'Bob')
11
+ * form.append('user[friends][]', 'Alice')
12
+ * form.append('user[friends][]', 'Charlie')
13
+ * form.append('thumb', new Blob(['hello']), 'thumb.png')
14
+ *
15
+ * parseFormData(form)
16
+ * // {
17
+ * // a: '1',
18
+ * // user: {
19
+ * // name: 'John',
20
+ * // age: '20',
21
+ * // friends: ['Bob', 'Alice', 'Charlie'],
22
+ * // },
23
+ * // thumb: form.get('thumb'),
24
+ * // }
25
+ * ```
26
+ *
27
+ * @see {@link https://orpc.unnoq.com/docs/openapi/bracket-notation Bracket Notation Docs}
28
+ */
29
+ declare function parseFormData(form: FormData): any;
30
+ /**
31
+ * Get the issue message from the error.
32
+ *
33
+ * @param error - The error (can be anything) can contain `data.issues` (standard schema issues)
34
+ * @param path - The path of the field that has the issue follow [bracket notation](https://orpc.unnoq.com/docs/openapi/bracket-notation)
35
+ *
36
+ * @example
37
+ * ```tsx
38
+ * const { error, data, execute } = useServerAction(someAction)
39
+ *
40
+ * return <form action={(form) => execute(parseFormData(form))}>
41
+ * <input name="user[name]" type="text" />
42
+ * <p>{getIssueMessage(error, 'user[name]')}</p>
43
+ *
44
+ * <input name="user[age]" type="number" />
45
+ * <p>{getIssueMessage(error, 'user[age]')}</p>
46
+ *
47
+ * <input name="images[]" type="file" />
48
+ * <p>{getIssueMessage(error, 'images[]')}</p>
49
+ * </form>
50
+ *
51
+ */
52
+ declare function getIssueMessage(error: unknown, path: string): string | undefined;
53
+
54
+ export { getIssueMessage, parseFormData };
@@ -0,0 +1,54 @@
1
+ /**
2
+ * parse a form data with bracket notation
3
+ *
4
+ * @example
5
+ * ```ts
6
+ * const form = new FormData()
7
+ * form.append('a', '1')
8
+ * form.append('user[name]', 'John')
9
+ * form.append('user[age]', '20')
10
+ * form.append('user[friends][]', 'Bob')
11
+ * form.append('user[friends][]', 'Alice')
12
+ * form.append('user[friends][]', 'Charlie')
13
+ * form.append('thumb', new Blob(['hello']), 'thumb.png')
14
+ *
15
+ * parseFormData(form)
16
+ * // {
17
+ * // a: '1',
18
+ * // user: {
19
+ * // name: 'John',
20
+ * // age: '20',
21
+ * // friends: ['Bob', 'Alice', 'Charlie'],
22
+ * // },
23
+ * // thumb: form.get('thumb'),
24
+ * // }
25
+ * ```
26
+ *
27
+ * @see {@link https://orpc.unnoq.com/docs/openapi/bracket-notation Bracket Notation Docs}
28
+ */
29
+ declare function parseFormData(form: FormData): any;
30
+ /**
31
+ * Get the issue message from the error.
32
+ *
33
+ * @param error - The error (can be anything) can contain `data.issues` (standard schema issues)
34
+ * @param path - The path of the field that has the issue follow [bracket notation](https://orpc.unnoq.com/docs/openapi/bracket-notation)
35
+ *
36
+ * @example
37
+ * ```tsx
38
+ * const { error, data, execute } = useServerAction(someAction)
39
+ *
40
+ * return <form action={(form) => execute(parseFormData(form))}>
41
+ * <input name="user[name]" type="text" />
42
+ * <p>{getIssueMessage(error, 'user[name]')}</p>
43
+ *
44
+ * <input name="user[age]" type="number" />
45
+ * <p>{getIssueMessage(error, 'user[age]')}</p>
46
+ *
47
+ * <input name="images[]" type="file" />
48
+ * <p>{getIssueMessage(error, 'images[]')}</p>
49
+ * </form>
50
+ *
51
+ */
52
+ declare function getIssueMessage(error: unknown, path: string): string | undefined;
53
+
54
+ export { getIssueMessage, parseFormData };
@@ -0,0 +1,7 @@
1
+ import '@orpc/shared';
2
+ export { g as getIssueMessage, p as parseFormData } from '../shared/openapi-client.Dgl8z2tb.mjs';
3
+ import '@orpc/client/standard';
4
+ import '@orpc/client';
5
+ import '@orpc/contract';
6
+ import '@orpc/standard-server';
7
+ import '../shared/openapi-client.t9fCAe3x.mjs';
@@ -5,7 +5,25 @@ import { Segment, Value, Promisable } from '@orpc/shared';
5
5
  import { StandardHeaders, StandardRequest, StandardLazyResponse } from '@orpc/standard-server';
6
6
 
7
7
  type StandardBracketNotationSerialized = [string, unknown][];
8
+ interface StandardBracketNotationSerializerOptions {
9
+ /**
10
+ * Maximum allowed array index for bracket notation deserialization.
11
+ *
12
+ * This helps protect against memory exhaustion attacks where malicious input
13
+ * uses extremely large array indices (e.g., `?arr[4294967296]=value`).
14
+ *
15
+ * While bracket notation creates sparse arrays that handle large indices efficiently,
16
+ * downstream code might inadvertently convert these sparse arrays to dense arrays,
17
+ * potentially creating millions of undefined elements and causing memory issues.
18
+ *
19
+ * @note Only applies to deserialization.
20
+ * @default 9_999 (array with 10,000 elements)
21
+ */
22
+ maxBracketNotationArrayIndex?: number;
23
+ }
8
24
  declare class StandardBracketNotationSerializer {
25
+ private readonly maxArrayIndex;
26
+ constructor(options?: StandardBracketNotationSerializerOptions);
9
27
  serialize(data: unknown, segments?: Segment[], result?: StandardBracketNotationSerialized): StandardBracketNotationSerialized;
10
28
  deserialize(serialized: StandardBracketNotationSerialized): Record<string, unknown> | unknown[];
11
29
  stringifyPath(segments: readonly Segment[]): string;
@@ -52,7 +70,7 @@ interface StandardOpenapiLinkCodecOptions<T extends ClientContext> {
52
70
  /**
53
71
  * Inject headers to the request.
54
72
  */
55
- headers?: Value<Promisable<StandardHeaders>, [
73
+ headers?: Value<Promisable<StandardHeaders | Headers>, [
56
74
  options: ClientOptions<T>,
57
75
  path: readonly string[],
58
76
  input: unknown
@@ -75,5 +93,5 @@ declare class StandardOpenAPILink<T extends ClientContext> extends StandardLink<
75
93
  constructor(contract: AnyContractRouter, linkClient: StandardLinkClient<T>, options: StandardOpenAPILinkOptions<T>);
76
94
  }
77
95
 
78
- export { StandardBracketNotationSerializer as a, StandardOpenAPIJsonSerializer as e, StandardOpenAPILink as g, StandardOpenapiLinkCodec as i, StandardOpenAPISerializer as k };
79
- export type { StandardBracketNotationSerialized as S, StandardOpenAPIJsonSerialized as b, StandardOpenAPICustomJsonSerializer as c, StandardOpenAPIJsonSerializerOptions as d, StandardOpenAPILinkOptions as f, StandardOpenapiLinkCodecOptions as h, StandardOpenAPISerializeOptions as j };
96
+ export { StandardBracketNotationSerializer as b, StandardOpenAPIJsonSerializer as f, StandardOpenAPILink as h, StandardOpenapiLinkCodec as j, StandardOpenAPISerializer as l };
97
+ export type { StandardBracketNotationSerialized as S, StandardBracketNotationSerializerOptions as a, StandardOpenAPIJsonSerialized as c, StandardOpenAPICustomJsonSerializer as d, StandardOpenAPIJsonSerializerOptions as e, StandardOpenAPILinkOptions as g, StandardOpenapiLinkCodecOptions as i, StandardOpenAPISerializeOptions as k };
@@ -5,7 +5,25 @@ import { Segment, Value, Promisable } from '@orpc/shared';
5
5
  import { StandardHeaders, StandardRequest, StandardLazyResponse } from '@orpc/standard-server';
6
6
 
7
7
  type StandardBracketNotationSerialized = [string, unknown][];
8
+ interface StandardBracketNotationSerializerOptions {
9
+ /**
10
+ * Maximum allowed array index for bracket notation deserialization.
11
+ *
12
+ * This helps protect against memory exhaustion attacks where malicious input
13
+ * uses extremely large array indices (e.g., `?arr[4294967296]=value`).
14
+ *
15
+ * While bracket notation creates sparse arrays that handle large indices efficiently,
16
+ * downstream code might inadvertently convert these sparse arrays to dense arrays,
17
+ * potentially creating millions of undefined elements and causing memory issues.
18
+ *
19
+ * @note Only applies to deserialization.
20
+ * @default 9_999 (array with 10,000 elements)
21
+ */
22
+ maxBracketNotationArrayIndex?: number;
23
+ }
8
24
  declare class StandardBracketNotationSerializer {
25
+ private readonly maxArrayIndex;
26
+ constructor(options?: StandardBracketNotationSerializerOptions);
9
27
  serialize(data: unknown, segments?: Segment[], result?: StandardBracketNotationSerialized): StandardBracketNotationSerialized;
10
28
  deserialize(serialized: StandardBracketNotationSerialized): Record<string, unknown> | unknown[];
11
29
  stringifyPath(segments: readonly Segment[]): string;
@@ -52,7 +70,7 @@ interface StandardOpenapiLinkCodecOptions<T extends ClientContext> {
52
70
  /**
53
71
  * Inject headers to the request.
54
72
  */
55
- headers?: Value<Promisable<StandardHeaders>, [
73
+ headers?: Value<Promisable<StandardHeaders | Headers>, [
56
74
  options: ClientOptions<T>,
57
75
  path: readonly string[],
58
76
  input: unknown
@@ -75,5 +93,5 @@ declare class StandardOpenAPILink<T extends ClientContext> extends StandardLink<
75
93
  constructor(contract: AnyContractRouter, linkClient: StandardLinkClient<T>, options: StandardOpenAPILinkOptions<T>);
76
94
  }
77
95
 
78
- export { StandardBracketNotationSerializer as a, StandardOpenAPIJsonSerializer as e, StandardOpenAPILink as g, StandardOpenapiLinkCodec as i, StandardOpenAPISerializer as k };
79
- export type { StandardBracketNotationSerialized as S, StandardOpenAPIJsonSerialized as b, StandardOpenAPICustomJsonSerializer as c, StandardOpenAPIJsonSerializerOptions as d, StandardOpenAPILinkOptions as f, StandardOpenapiLinkCodecOptions as h, StandardOpenAPISerializeOptions as j };
96
+ export { StandardBracketNotationSerializer as b, StandardOpenAPIJsonSerializer as f, StandardOpenAPILink as h, StandardOpenapiLinkCodec as j, StandardOpenAPISerializer as l };
97
+ export type { StandardBracketNotationSerialized as S, StandardBracketNotationSerializerOptions as a, StandardOpenAPIJsonSerialized as c, StandardOpenAPICustomJsonSerializer as d, StandardOpenAPIJsonSerializerOptions as e, StandardOpenAPILinkOptions as g, StandardOpenapiLinkCodecOptions as i, StandardOpenAPISerializeOptions as k };
@@ -0,0 +1,39 @@
1
+ import { isSchemaIssue } from '@orpc/contract';
2
+ import { isTypescriptObject } from '@orpc/shared';
3
+ import { S as StandardBracketNotationSerializer } from './openapi-client.t9fCAe3x.mjs';
4
+
5
+ function parseFormData(form) {
6
+ const serializer = new StandardBracketNotationSerializer();
7
+ return serializer.deserialize(Array.from(form.entries()));
8
+ }
9
+ function getIssueMessage(error, path) {
10
+ if (!isTypescriptObject(error) || !isTypescriptObject(error.data) || !Array.isArray(error.data.issues)) {
11
+ return void 0;
12
+ }
13
+ const serializer = new StandardBracketNotationSerializer();
14
+ for (const issue of error.data.issues) {
15
+ if (!isSchemaIssue(issue)) {
16
+ continue;
17
+ }
18
+ if (issue.path === void 0) {
19
+ if (path === "") {
20
+ return issue.message;
21
+ }
22
+ continue;
23
+ }
24
+ const issuePath = serializer.stringifyPath(
25
+ issue.path.map((segment) => typeof segment === "object" ? segment.key.toString() : segment.toString())
26
+ );
27
+ if (issuePath === path) {
28
+ return issue.message;
29
+ }
30
+ if (path.endsWith("[]") && issuePath.replace(/\[(?:0|[1-9]\d*)\]$/, "[]") === path) {
31
+ return issue.message;
32
+ }
33
+ if (path === "" && issuePath.match(/(?:0|[1-9]\d*)$/)) {
34
+ return issue.message;
35
+ }
36
+ }
37
+ }
38
+
39
+ export { getIssueMessage as g, parseFormData as p };
@@ -1,148 +1,10 @@
1
- import { toHttpPath, getMalformedResponseErrorCode, StandardLink } from '@orpc/client/standard';
2
- import { isObject, NullProtoObj, value, get, isAsyncIteratorObject } from '@orpc/shared';
1
+ import { toStandardHeaders, toHttpPath, getMalformedResponseErrorCode, StandardLink } from '@orpc/client/standard';
2
+ import { S as StandardBracketNotationSerializer } from './openapi-client.t9fCAe3x.mjs';
3
+ import { isObject, value, get, isAsyncIteratorObject } from '@orpc/shared';
3
4
  import { isORPCErrorStatus, isORPCErrorJson, createORPCErrorFromJson, mapEventIterator, toORPCError } from '@orpc/client';
4
5
  import { isContractProcedure, fallbackContractConfig, ORPCError } from '@orpc/contract';
5
6
  import { mergeStandardHeaders, ErrorEvent } from '@orpc/standard-server';
6
7
 
7
- class StandardBracketNotationSerializer {
8
- serialize(data, segments = [], result = []) {
9
- if (Array.isArray(data)) {
10
- data.forEach((item, i) => {
11
- this.serialize(item, [...segments, i], result);
12
- });
13
- } else if (isObject(data)) {
14
- for (const key in data) {
15
- this.serialize(data[key], [...segments, key], result);
16
- }
17
- } else {
18
- result.push([this.stringifyPath(segments), data]);
19
- }
20
- return result;
21
- }
22
- deserialize(serialized) {
23
- if (serialized.length === 0) {
24
- return {};
25
- }
26
- const arrayPushStyles = /* @__PURE__ */ new WeakSet();
27
- const ref = { value: [] };
28
- for (const [path, value] of serialized) {
29
- const segments = this.parsePath(path);
30
- let currentRef = ref;
31
- let nextSegment = "value";
32
- segments.forEach((segment, i) => {
33
- if (!Array.isArray(currentRef[nextSegment]) && !isObject(currentRef[nextSegment])) {
34
- currentRef[nextSegment] = [];
35
- }
36
- if (i !== segments.length - 1) {
37
- if (Array.isArray(currentRef[nextSegment]) && !isValidArrayIndex(segment)) {
38
- if (arrayPushStyles.has(currentRef[nextSegment])) {
39
- arrayPushStyles.delete(currentRef[nextSegment]);
40
- currentRef[nextSegment] = pushStyleArrayToObject(currentRef[nextSegment]);
41
- } else {
42
- currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
43
- }
44
- }
45
- } else {
46
- if (Array.isArray(currentRef[nextSegment])) {
47
- if (segment === "") {
48
- if (currentRef[nextSegment].length && !arrayPushStyles.has(currentRef[nextSegment])) {
49
- currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
50
- }
51
- } else {
52
- if (arrayPushStyles.has(currentRef[nextSegment])) {
53
- arrayPushStyles.delete(currentRef[nextSegment]);
54
- currentRef[nextSegment] = pushStyleArrayToObject(currentRef[nextSegment]);
55
- } else if (!isValidArrayIndex(segment)) {
56
- currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
57
- }
58
- }
59
- }
60
- }
61
- currentRef = currentRef[nextSegment];
62
- nextSegment = segment;
63
- });
64
- if (Array.isArray(currentRef) && nextSegment === "") {
65
- arrayPushStyles.add(currentRef);
66
- currentRef.push(value);
67
- } else if (nextSegment in currentRef) {
68
- if (Array.isArray(currentRef[nextSegment])) {
69
- currentRef[nextSegment].push(value);
70
- } else {
71
- currentRef[nextSegment] = [currentRef[nextSegment], value];
72
- }
73
- } else {
74
- currentRef[nextSegment] = value;
75
- }
76
- }
77
- return ref.value;
78
- }
79
- stringifyPath(segments) {
80
- return segments.map((segment) => {
81
- return segment.toString().replace(/[\\[\]]/g, (match) => {
82
- switch (match) {
83
- case "\\":
84
- return "\\\\";
85
- case "[":
86
- return "\\[";
87
- case "]":
88
- return "\\]";
89
- /* v8 ignore next 2 */
90
- default:
91
- return match;
92
- }
93
- });
94
- }).reduce((result, segment, i) => {
95
- if (i === 0) {
96
- return segment;
97
- }
98
- return `${result}[${segment}]`;
99
- }, "");
100
- }
101
- parsePath(path) {
102
- const segments = [];
103
- let inBrackets = false;
104
- let currentSegment = "";
105
- let backslashCount = 0;
106
- for (let i = 0; i < path.length; i++) {
107
- const char = path[i];
108
- const nextChar = path[i + 1];
109
- if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[") && backslashCount % 2 === 0) {
110
- if (nextChar === void 0) {
111
- inBrackets = false;
112
- }
113
- segments.push(currentSegment);
114
- currentSegment = "";
115
- i++;
116
- } else if (segments.length === 0 && char === "[" && backslashCount % 2 === 0) {
117
- inBrackets = true;
118
- segments.push(currentSegment);
119
- currentSegment = "";
120
- } else if (char === "\\") {
121
- backslashCount++;
122
- } else {
123
- currentSegment += "\\".repeat(backslashCount / 2) + char;
124
- backslashCount = 0;
125
- }
126
- }
127
- return inBrackets || segments.length === 0 ? [path] : segments;
128
- }
129
- }
130
- function isValidArrayIndex(value) {
131
- return /^0$|^[1-9]\d*$/.test(value);
132
- }
133
- function arrayToObject(array) {
134
- const obj = new NullProtoObj();
135
- array.forEach((item, i) => {
136
- obj[i] = item;
137
- });
138
- return obj;
139
- }
140
- function pushStyleArrayToObject(array) {
141
- const obj = new NullProtoObj();
142
- obj[""] = array.length === 1 ? array[0] : array;
143
- return obj;
144
- }
145
-
146
8
  class StandardOpenAPIJsonSerializer {
147
9
  customSerializers;
148
10
  constructor(options = {}) {
@@ -212,11 +74,11 @@ class StandardOpenapiLinkCodec {
212
74
  baseUrl;
213
75
  headers;
214
76
  async encode(path, input, options) {
215
- const baseUrl = await value(this.baseUrl, options, path, input);
216
- let headers = await value(this.headers, options, path, input);
77
+ let headers = toStandardHeaders(await value(this.headers, options, path, input));
217
78
  if (options.lastEventId !== void 0) {
218
79
  headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
219
80
  }
81
+ const baseUrl = await value(this.baseUrl, options, path, input);
220
82
  const procedure = get(this.contract, path);
221
83
  if (!isContractProcedure(procedure)) {
222
84
  throw new Error(`[StandardOpenapiLinkCodec] expect a contract procedure at ${path.join(".")}`);
@@ -424,11 +286,11 @@ class StandardOpenAPISerializer {
424
286
  class StandardOpenAPILink extends StandardLink {
425
287
  constructor(contract, linkClient, options) {
426
288
  const jsonSerializer = new StandardOpenAPIJsonSerializer(options);
427
- const bracketNotationSerializer = new StandardBracketNotationSerializer();
289
+ const bracketNotationSerializer = new StandardBracketNotationSerializer({ maxBracketNotationArrayIndex: 4294967294 });
428
290
  const serializer = new StandardOpenAPISerializer(jsonSerializer, bracketNotationSerializer);
429
291
  const linkCodec = new StandardOpenapiLinkCodec(contract, serializer, options);
430
292
  super(linkCodec, linkClient, options);
431
293
  }
432
294
  }
433
295
 
434
- export { StandardBracketNotationSerializer as S, StandardOpenAPIJsonSerializer as a, StandardOpenAPILink as b, StandardOpenapiLinkCodec as c, StandardOpenAPISerializer as d, getDynamicParams as g, standardizeHTTPPath as s };
296
+ export { StandardOpenAPIJsonSerializer as S, StandardOpenAPILink as a, StandardOpenapiLinkCodec as b, StandardOpenAPISerializer as c, getDynamicParams as g, standardizeHTTPPath as s };
@@ -0,0 +1,146 @@
1
+ import { isObject, NullProtoObj } from '@orpc/shared';
2
+
3
+ class StandardBracketNotationSerializer {
4
+ maxArrayIndex;
5
+ constructor(options = {}) {
6
+ this.maxArrayIndex = options.maxBracketNotationArrayIndex ?? 9999;
7
+ }
8
+ serialize(data, segments = [], result = []) {
9
+ if (Array.isArray(data)) {
10
+ data.forEach((item, i) => {
11
+ this.serialize(item, [...segments, i], result);
12
+ });
13
+ } else if (isObject(data)) {
14
+ for (const key in data) {
15
+ this.serialize(data[key], [...segments, key], result);
16
+ }
17
+ } else {
18
+ result.push([this.stringifyPath(segments), data]);
19
+ }
20
+ return result;
21
+ }
22
+ deserialize(serialized) {
23
+ if (serialized.length === 0) {
24
+ return {};
25
+ }
26
+ const arrayPushStyles = /* @__PURE__ */ new WeakSet();
27
+ const ref = { value: [] };
28
+ for (const [path, value] of serialized) {
29
+ const segments = this.parsePath(path);
30
+ let currentRef = ref;
31
+ let nextSegment = "value";
32
+ segments.forEach((segment, i) => {
33
+ if (!Array.isArray(currentRef[nextSegment]) && !isObject(currentRef[nextSegment])) {
34
+ currentRef[nextSegment] = [];
35
+ }
36
+ if (i !== segments.length - 1) {
37
+ if (Array.isArray(currentRef[nextSegment]) && !isValidArrayIndex(segment, this.maxArrayIndex)) {
38
+ if (arrayPushStyles.has(currentRef[nextSegment])) {
39
+ arrayPushStyles.delete(currentRef[nextSegment]);
40
+ currentRef[nextSegment] = pushStyleArrayToObject(currentRef[nextSegment]);
41
+ } else {
42
+ currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
43
+ }
44
+ }
45
+ } else {
46
+ if (Array.isArray(currentRef[nextSegment])) {
47
+ if (segment === "") {
48
+ if (currentRef[nextSegment].length && !arrayPushStyles.has(currentRef[nextSegment])) {
49
+ currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
50
+ }
51
+ } else {
52
+ if (arrayPushStyles.has(currentRef[nextSegment])) {
53
+ arrayPushStyles.delete(currentRef[nextSegment]);
54
+ currentRef[nextSegment] = pushStyleArrayToObject(currentRef[nextSegment]);
55
+ } else if (!isValidArrayIndex(segment, this.maxArrayIndex)) {
56
+ currentRef[nextSegment] = arrayToObject(currentRef[nextSegment]);
57
+ }
58
+ }
59
+ }
60
+ }
61
+ currentRef = currentRef[nextSegment];
62
+ nextSegment = segment;
63
+ });
64
+ if (Array.isArray(currentRef) && nextSegment === "") {
65
+ arrayPushStyles.add(currentRef);
66
+ currentRef.push(value);
67
+ } else if (nextSegment in currentRef) {
68
+ if (Array.isArray(currentRef[nextSegment])) {
69
+ currentRef[nextSegment].push(value);
70
+ } else {
71
+ currentRef[nextSegment] = [currentRef[nextSegment], value];
72
+ }
73
+ } else {
74
+ currentRef[nextSegment] = value;
75
+ }
76
+ }
77
+ return ref.value;
78
+ }
79
+ stringifyPath(segments) {
80
+ return segments.map((segment) => {
81
+ return segment.toString().replace(/[\\[\]]/g, (match) => {
82
+ switch (match) {
83
+ case "\\":
84
+ return "\\\\";
85
+ case "[":
86
+ return "\\[";
87
+ case "]":
88
+ return "\\]";
89
+ /* v8 ignore next 2 */
90
+ default:
91
+ return match;
92
+ }
93
+ });
94
+ }).reduce((result, segment, i) => {
95
+ if (i === 0) {
96
+ return segment;
97
+ }
98
+ return `${result}[${segment}]`;
99
+ }, "");
100
+ }
101
+ parsePath(path) {
102
+ const segments = [];
103
+ let inBrackets = false;
104
+ let currentSegment = "";
105
+ let backslashCount = 0;
106
+ for (let i = 0; i < path.length; i++) {
107
+ const char = path[i];
108
+ const nextChar = path[i + 1];
109
+ if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[") && backslashCount % 2 === 0) {
110
+ if (nextChar === void 0) {
111
+ inBrackets = false;
112
+ }
113
+ segments.push(currentSegment);
114
+ currentSegment = "";
115
+ i++;
116
+ } else if (segments.length === 0 && char === "[" && backslashCount % 2 === 0) {
117
+ inBrackets = true;
118
+ segments.push(currentSegment);
119
+ currentSegment = "";
120
+ } else if (char === "\\") {
121
+ backslashCount++;
122
+ } else {
123
+ currentSegment += "\\".repeat(backslashCount / 2) + char;
124
+ backslashCount = 0;
125
+ }
126
+ }
127
+ return inBrackets || segments.length === 0 ? [path] : segments;
128
+ }
129
+ }
130
+ function isValidArrayIndex(value, maxIndex) {
131
+ return /^0$|^[1-9]\d*$/.test(value) && Number(value) <= maxIndex;
132
+ }
133
+ function arrayToObject(array) {
134
+ const obj = new NullProtoObj();
135
+ array.forEach((item, i) => {
136
+ obj[i] = item;
137
+ });
138
+ return obj;
139
+ }
140
+ function pushStyleArrayToObject(array) {
141
+ const obj = new NullProtoObj();
142
+ obj[""] = array.length === 1 ? array[0] : array;
143
+ return obj;
144
+ }
145
+
146
+ export { StandardBracketNotationSerializer as S };
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@orpc/openapi-client",
3
3
  "type": "module",
4
- "version": "0.0.0-next.e82d760",
4
+ "version": "0.0.0-next.e91d2fd",
5
5
  "license": "MIT",
6
6
  "homepage": "https://orpc.unnoq.com",
7
7
  "repository": {
@@ -19,6 +19,11 @@
19
19
  "import": "./dist/index.mjs",
20
20
  "default": "./dist/index.mjs"
21
21
  },
22
+ "./helpers": {
23
+ "types": "./dist/helpers/index.d.mts",
24
+ "import": "./dist/helpers/index.mjs",
25
+ "default": "./dist/helpers/index.mjs"
26
+ },
22
27
  "./standard": {
23
28
  "types": "./dist/adapters/standard/index.d.mts",
24
29
  "import": "./dist/adapters/standard/index.mjs",
@@ -34,13 +39,13 @@
34
39
  "dist"
35
40
  ],
36
41
  "dependencies": {
37
- "@orpc/client": "0.0.0-next.e82d760",
38
- "@orpc/contract": "0.0.0-next.e82d760",
39
- "@orpc/shared": "0.0.0-next.e82d760",
40
- "@orpc/standard-server": "0.0.0-next.e82d760"
42
+ "@orpc/client": "0.0.0-next.e91d2fd",
43
+ "@orpc/standard-server": "0.0.0-next.e91d2fd",
44
+ "@orpc/shared": "0.0.0-next.e91d2fd",
45
+ "@orpc/contract": "0.0.0-next.e91d2fd"
41
46
  },
42
47
  "devDependencies": {
43
- "@orpc/server": "0.0.0-next.e82d760"
48
+ "@orpc/server": "0.0.0-next.e91d2fd"
44
49
  },
45
50
  "scripts": {
46
51
  "build": "unbuild",