@orpc/server 0.0.0-next.3e1c2e9 → 0.0.0-next.3ee2e95

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/README.md +9 -0
  2. package/dist/adapters/fetch/index.d.mts +41 -11
  3. package/dist/adapters/fetch/index.d.ts +41 -11
  4. package/dist/adapters/fetch/index.mjs +6 -6
  5. package/dist/adapters/hono/index.d.mts +5 -4
  6. package/dist/adapters/hono/index.d.ts +5 -4
  7. package/dist/adapters/hono/index.mjs +6 -6
  8. package/dist/adapters/next/index.d.mts +5 -4
  9. package/dist/adapters/next/index.d.ts +5 -4
  10. package/dist/adapters/next/index.mjs +6 -6
  11. package/dist/adapters/node/index.d.mts +43 -22
  12. package/dist/adapters/node/index.d.ts +43 -22
  13. package/dist/adapters/node/index.mjs +81 -21
  14. package/dist/adapters/standard/index.d.mts +6 -6
  15. package/dist/adapters/standard/index.d.ts +6 -6
  16. package/dist/adapters/standard/index.mjs +3 -3
  17. package/dist/index.d.mts +50 -36
  18. package/dist/index.d.ts +50 -36
  19. package/dist/index.mjs +27 -6
  20. package/dist/plugins/index.d.mts +108 -15
  21. package/dist/plugins/index.d.ts +108 -15
  22. package/dist/plugins/index.mjs +179 -6
  23. package/dist/shared/server.BVwwTHyO.mjs +9 -0
  24. package/dist/shared/{server.BtxZnWJ9.mjs → server.C37gDhSZ.mjs} +19 -29
  25. package/dist/shared/server.C56IpPNj.d.mts +10 -0
  26. package/dist/shared/{server.BY9sDlwl.mjs → server.C78d5yfh.mjs} +43 -28
  27. package/dist/shared/server.CSIDw0mq.mjs +106 -0
  28. package/dist/shared/{server.Dm3ZuTuI.d.ts → server.CyrwhzzU.d.ts} +2 -2
  29. package/dist/shared/{server.MZvbGc3n.d.mts → server.DLt5njUb.d.mts} +8 -8
  30. package/dist/shared/{server.MZvbGc3n.d.ts → server.DLt5njUb.d.ts} +8 -8
  31. package/dist/shared/{server.P4_D9lKb.d.mts → server.DfyOFejj.d.ts} +27 -29
  32. package/dist/shared/{server.BqBN5WhH.d.mts → server.DgrNIRDf.d.mts} +2 -2
  33. package/dist/shared/{server.CPqNKiJp.d.ts → server.Dm5DEJl5.d.mts} +27 -29
  34. package/dist/shared/server.DnuwaDJo.d.ts +10 -0
  35. package/package.json +8 -8
  36. package/dist/shared/server.Dba3Iiyp.mjs +0 -12
  37. package/dist/shared/server.Del5OmaY.mjs +0 -29
@@ -1,31 +1,124 @@
1
- import { b as StandardHandlerInterceptorOptions, H as HandlerPlugin, a as StandardHandlerOptions } from '../shared/server.P4_D9lKb.mjs';
2
- export { C as CompositeHandlerPlugin } from '../shared/server.P4_D9lKb.mjs';
3
1
  import { Value } from '@orpc/shared';
4
- import { C as Context } from '../shared/server.MZvbGc3n.mjs';
5
- import '@orpc/contract';
6
- import '@orpc/standard-server';
7
- import '@orpc/client';
2
+ import { StandardRequest, StandardHeaders } from '@orpc/standard-server';
3
+ import { BatchResponseBodyItem } from '@orpc/standard-server/batch';
4
+ import { g as StandardHandlerInterceptorOptions, i as StandardHandlerPlugin, a as StandardHandlerOptions } from '../shared/server.Dm5DEJl5.mjs';
5
+ import { C as Context, P as ProcedureClientInterceptorOptions } from '../shared/server.DLt5njUb.mjs';
6
+ import { ORPCError, Meta } from '@orpc/contract';
7
+ import { ORPCError as ORPCError$1 } from '@orpc/client';
8
8
 
9
- interface CORSOptions<TContext extends Context> {
10
- origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<TContext>]>;
11
- timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<TContext>]>;
9
+ interface BatchHandlerOptions<T extends Context> {
10
+ /**
11
+ * The max size of the batch allowed.
12
+ *
13
+ * @default 10
14
+ */
15
+ maxSize?: Value<number, [StandardHandlerInterceptorOptions<T>]>;
16
+ /**
17
+ * Map the request before processing it.
18
+ *
19
+ * @default merged back batch request headers into the request
20
+ */
21
+ mapRequestItem?(request: StandardRequest, batchOptions: StandardHandlerInterceptorOptions<T>): StandardRequest;
22
+ /**
23
+ * Success batch response status code.
24
+ *
25
+ * @default 207
26
+ */
27
+ successStatus?: Value<number, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
28
+ /**
29
+ * success batch response headers.
30
+ *
31
+ * @default {}
32
+ */
33
+ headers?: Value<StandardHeaders, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
34
+ }
35
+ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
36
+ private readonly maxSize;
37
+ private readonly mapRequestItem;
38
+ private readonly successStatus;
39
+ private readonly headers;
40
+ order: number;
41
+ constructor(options?: BatchHandlerOptions<T>);
42
+ init(options: StandardHandlerOptions<T>): void;
43
+ }
44
+
45
+ interface CORSOptions<T extends Context> {
46
+ origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
47
+ timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
12
48
  allowMethods?: readonly string[];
13
49
  allowHeaders?: readonly string[];
14
50
  maxAge?: number;
15
51
  credentials?: boolean;
16
52
  exposeHeaders?: readonly string[];
17
53
  }
18
- declare class CORSPlugin<TContext extends Context> implements HandlerPlugin<TContext> {
54
+ declare class CORSPlugin<T extends Context> implements StandardHandlerPlugin<T> {
19
55
  private readonly options;
20
- constructor(options?: CORSOptions<TContext>);
21
- init(options: StandardHandlerOptions<TContext>): void;
56
+ order: number;
57
+ constructor(options?: CORSOptions<T>);
58
+ init(options: StandardHandlerOptions<T>): void;
59
+ }
60
+
61
+ interface GetMethodGuardPluginOptions {
62
+ /**
63
+ * The error thrown when a GET request is made to a procedure that doesn't allow GET.
64
+ *
65
+ * @default new ORPCError('METHOD_NOT_SUPPORTED')
66
+ */
67
+ error?: InstanceType<typeof ORPCError>;
68
+ }
69
+ declare class GetMethodGuardPlugin<T extends Context> implements StandardHandlerPlugin<T> {
70
+ private readonly error;
71
+ order: number;
72
+ constructor(options?: GetMethodGuardPluginOptions);
73
+ init(options: StandardHandlerOptions<T>): void;
22
74
  }
23
75
 
24
76
  interface ResponseHeadersPluginContext {
25
77
  resHeaders?: Headers;
26
78
  }
27
- declare class ResponseHeadersPlugin<TContext extends ResponseHeadersPluginContext & Context> implements HandlerPlugin<TContext> {
28
- init(options: StandardHandlerOptions<TContext>): void;
79
+ declare class ResponseHeadersPlugin<T extends ResponseHeadersPluginContext> implements StandardHandlerPlugin<T> {
80
+ init(options: StandardHandlerOptions<T>): void;
81
+ }
82
+
83
+ interface SimpleCsrfProtectionHandlerPluginOptions<T extends Context> {
84
+ /**
85
+ * The name of the header to check.
86
+ *
87
+ * @default 'x-csrf-token'
88
+ */
89
+ headerName?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
90
+ /**
91
+ * The value of the header to check.
92
+ *
93
+ * @default 'orpc'
94
+ *
95
+ */
96
+ headerValue?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
97
+ /**
98
+ * Exclude a procedure from the plugin.
99
+ *
100
+ * @default false
101
+ *
102
+ */
103
+ exclude?: Value<boolean, [options: ProcedureClientInterceptorOptions<T, Record<never, never>, Meta>]>;
104
+ /**
105
+ * The error thrown when the CSRF token is invalid.
106
+ *
107
+ * @default new ORPCError('CSRF_TOKEN_MISMATCH', {
108
+ * status: 403,
109
+ * message: 'Invalid CSRF token',
110
+ * })
111
+ */
112
+ error?: InstanceType<typeof ORPCError$1>;
113
+ }
114
+ declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
115
+ private readonly headerName;
116
+ private readonly headerValue;
117
+ private readonly exclude;
118
+ private readonly error;
119
+ constructor(options?: SimpleCsrfProtectionHandlerPluginOptions<T>);
120
+ order: number;
121
+ init(options: StandardHandlerOptions<T>): void;
29
122
  }
30
123
 
31
- export { type CORSOptions, CORSPlugin, HandlerPlugin, ResponseHeadersPlugin, type ResponseHeadersPluginContext };
124
+ export { type BatchHandlerOptions, BatchHandlerPlugin, type CORSOptions, CORSPlugin, GetMethodGuardPlugin, type GetMethodGuardPluginOptions, ResponseHeadersPlugin, type ResponseHeadersPluginContext, SimpleCsrfProtectionHandlerPlugin, type SimpleCsrfProtectionHandlerPluginOptions };
@@ -1,31 +1,124 @@
1
- import { b as StandardHandlerInterceptorOptions, H as HandlerPlugin, a as StandardHandlerOptions } from '../shared/server.CPqNKiJp.js';
2
- export { C as CompositeHandlerPlugin } from '../shared/server.CPqNKiJp.js';
3
1
  import { Value } from '@orpc/shared';
4
- import { C as Context } from '../shared/server.MZvbGc3n.js';
5
- import '@orpc/contract';
6
- import '@orpc/standard-server';
7
- import '@orpc/client';
2
+ import { StandardRequest, StandardHeaders } from '@orpc/standard-server';
3
+ import { BatchResponseBodyItem } from '@orpc/standard-server/batch';
4
+ import { g as StandardHandlerInterceptorOptions, i as StandardHandlerPlugin, a as StandardHandlerOptions } from '../shared/server.DfyOFejj.js';
5
+ import { C as Context, P as ProcedureClientInterceptorOptions } from '../shared/server.DLt5njUb.js';
6
+ import { ORPCError, Meta } from '@orpc/contract';
7
+ import { ORPCError as ORPCError$1 } from '@orpc/client';
8
8
 
9
- interface CORSOptions<TContext extends Context> {
10
- origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<TContext>]>;
11
- timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<TContext>]>;
9
+ interface BatchHandlerOptions<T extends Context> {
10
+ /**
11
+ * The max size of the batch allowed.
12
+ *
13
+ * @default 10
14
+ */
15
+ maxSize?: Value<number, [StandardHandlerInterceptorOptions<T>]>;
16
+ /**
17
+ * Map the request before processing it.
18
+ *
19
+ * @default merged back batch request headers into the request
20
+ */
21
+ mapRequestItem?(request: StandardRequest, batchOptions: StandardHandlerInterceptorOptions<T>): StandardRequest;
22
+ /**
23
+ * Success batch response status code.
24
+ *
25
+ * @default 207
26
+ */
27
+ successStatus?: Value<number, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
28
+ /**
29
+ * success batch response headers.
30
+ *
31
+ * @default {}
32
+ */
33
+ headers?: Value<StandardHeaders, [responses: Promise<BatchResponseBodyItem>[], batchOptions: StandardHandlerInterceptorOptions<T>]>;
34
+ }
35
+ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
36
+ private readonly maxSize;
37
+ private readonly mapRequestItem;
38
+ private readonly successStatus;
39
+ private readonly headers;
40
+ order: number;
41
+ constructor(options?: BatchHandlerOptions<T>);
42
+ init(options: StandardHandlerOptions<T>): void;
43
+ }
44
+
45
+ interface CORSOptions<T extends Context> {
46
+ origin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
47
+ timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string, options: StandardHandlerInterceptorOptions<T>]>;
12
48
  allowMethods?: readonly string[];
13
49
  allowHeaders?: readonly string[];
14
50
  maxAge?: number;
15
51
  credentials?: boolean;
16
52
  exposeHeaders?: readonly string[];
17
53
  }
18
- declare class CORSPlugin<TContext extends Context> implements HandlerPlugin<TContext> {
54
+ declare class CORSPlugin<T extends Context> implements StandardHandlerPlugin<T> {
19
55
  private readonly options;
20
- constructor(options?: CORSOptions<TContext>);
21
- init(options: StandardHandlerOptions<TContext>): void;
56
+ order: number;
57
+ constructor(options?: CORSOptions<T>);
58
+ init(options: StandardHandlerOptions<T>): void;
59
+ }
60
+
61
+ interface GetMethodGuardPluginOptions {
62
+ /**
63
+ * The error thrown when a GET request is made to a procedure that doesn't allow GET.
64
+ *
65
+ * @default new ORPCError('METHOD_NOT_SUPPORTED')
66
+ */
67
+ error?: InstanceType<typeof ORPCError>;
68
+ }
69
+ declare class GetMethodGuardPlugin<T extends Context> implements StandardHandlerPlugin<T> {
70
+ private readonly error;
71
+ order: number;
72
+ constructor(options?: GetMethodGuardPluginOptions);
73
+ init(options: StandardHandlerOptions<T>): void;
22
74
  }
23
75
 
24
76
  interface ResponseHeadersPluginContext {
25
77
  resHeaders?: Headers;
26
78
  }
27
- declare class ResponseHeadersPlugin<TContext extends ResponseHeadersPluginContext & Context> implements HandlerPlugin<TContext> {
28
- init(options: StandardHandlerOptions<TContext>): void;
79
+ declare class ResponseHeadersPlugin<T extends ResponseHeadersPluginContext> implements StandardHandlerPlugin<T> {
80
+ init(options: StandardHandlerOptions<T>): void;
81
+ }
82
+
83
+ interface SimpleCsrfProtectionHandlerPluginOptions<T extends Context> {
84
+ /**
85
+ * The name of the header to check.
86
+ *
87
+ * @default 'x-csrf-token'
88
+ */
89
+ headerName?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
90
+ /**
91
+ * The value of the header to check.
92
+ *
93
+ * @default 'orpc'
94
+ *
95
+ */
96
+ headerValue?: Value<string, [options: StandardHandlerInterceptorOptions<T>]>;
97
+ /**
98
+ * Exclude a procedure from the plugin.
99
+ *
100
+ * @default false
101
+ *
102
+ */
103
+ exclude?: Value<boolean, [options: ProcedureClientInterceptorOptions<T, Record<never, never>, Meta>]>;
104
+ /**
105
+ * The error thrown when the CSRF token is invalid.
106
+ *
107
+ * @default new ORPCError('CSRF_TOKEN_MISMATCH', {
108
+ * status: 403,
109
+ * message: 'Invalid CSRF token',
110
+ * })
111
+ */
112
+ error?: InstanceType<typeof ORPCError$1>;
113
+ }
114
+ declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
115
+ private readonly headerName;
116
+ private readonly headerValue;
117
+ private readonly exclude;
118
+ private readonly error;
119
+ constructor(options?: SimpleCsrfProtectionHandlerPluginOptions<T>);
120
+ order: number;
121
+ init(options: StandardHandlerOptions<T>): void;
29
122
  }
30
123
 
31
- export { type CORSOptions, CORSPlugin, HandlerPlugin, ResponseHeadersPlugin, type ResponseHeadersPluginContext };
124
+ export { type BatchHandlerOptions, BatchHandlerPlugin, type CORSOptions, CORSPlugin, GetMethodGuardPlugin, type GetMethodGuardPluginOptions, ResponseHeadersPlugin, type ResponseHeadersPluginContext, SimpleCsrfProtectionHandlerPlugin, type SimpleCsrfProtectionHandlerPluginOptions };
@@ -1,8 +1,100 @@
1
- export { C as CompositeHandlerPlugin } from '../shared/server.Dba3Iiyp.mjs';
2
1
  import { value } from '@orpc/shared';
2
+ import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
3
+ import { ORPCError, fallbackContractConfig } from '@orpc/contract';
4
+ import { ORPCError as ORPCError$1 } from '@orpc/client';
5
+
6
+ class BatchHandlerPlugin {
7
+ maxSize;
8
+ mapRequestItem;
9
+ successStatus;
10
+ headers;
11
+ order = 5e6;
12
+ constructor(options = {}) {
13
+ this.maxSize = options.maxSize ?? 10;
14
+ this.mapRequestItem = options.mapRequestItem ?? ((request, { request: batchRequest }) => ({
15
+ ...request,
16
+ headers: {
17
+ ...batchRequest.headers,
18
+ ...request.headers
19
+ }
20
+ }));
21
+ this.successStatus = options.successStatus ?? 207;
22
+ this.headers = options.headers ?? {};
23
+ }
24
+ init(options) {
25
+ options.rootInterceptors ??= [];
26
+ options.rootInterceptors.unshift(async (options2) => {
27
+ if (options2.request.headers["x-orpc-batch"] !== "1") {
28
+ return options2.next();
29
+ }
30
+ let isParsing = false;
31
+ try {
32
+ isParsing = true;
33
+ const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
34
+ isParsing = false;
35
+ const maxSize = await value(this.maxSize, options2);
36
+ if (parsed.length > maxSize) {
37
+ return {
38
+ matched: true,
39
+ response: {
40
+ status: 413,
41
+ headers: {},
42
+ body: "Batch request size exceeds the maximum allowed size"
43
+ }
44
+ };
45
+ }
46
+ const responses = parsed.map(
47
+ (request, index) => {
48
+ const mapped = this.mapRequestItem(request, options2);
49
+ return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
50
+ if (matched) {
51
+ return { ...response2, index };
52
+ }
53
+ return { index, status: 404, headers: {}, body: "No procedure matched" };
54
+ }).catch(() => {
55
+ return { index, status: 500, headers: {}, body: "Internal server error" };
56
+ });
57
+ }
58
+ );
59
+ await Promise.race(responses);
60
+ const status = await value(this.successStatus, responses, options2);
61
+ const headers = await value(this.headers, responses, options2);
62
+ const response = toBatchResponse({
63
+ status,
64
+ headers,
65
+ body: async function* () {
66
+ const promises = [...responses];
67
+ while (true) {
68
+ const handling = promises.filter((p) => p !== void 0);
69
+ if (handling.length === 0) {
70
+ return;
71
+ }
72
+ const result = await Promise.race(handling);
73
+ promises[result.index] = void 0;
74
+ yield result;
75
+ }
76
+ }()
77
+ });
78
+ return {
79
+ matched: true,
80
+ response
81
+ };
82
+ } catch (cause) {
83
+ if (isParsing) {
84
+ return {
85
+ matched: true,
86
+ response: { status: 400, headers: {}, body: "Invalid batch request, this could be caused by a malformed request body or a missing header" }
87
+ };
88
+ }
89
+ throw cause;
90
+ }
91
+ });
92
+ }
93
+ }
3
94
 
4
95
  class CORSPlugin {
5
96
  options;
97
+ order = 9e6;
6
98
  constructor(options = {}) {
7
99
  const defaults = {
8
100
  origin: (origin) => origin,
@@ -75,18 +167,56 @@ class CORSPlugin {
75
167
  }
76
168
  }
77
169
 
170
+ const GET_METHOD_GUARD_PLUGIN_IS_GET_METHOD_CONTEXT_SYMBOL = Symbol("GET_METHOD_GUARD_PLUGIN_IS_GET_METHOD_CONTEXT");
171
+ class GetMethodGuardPlugin {
172
+ error;
173
+ order = 7e6;
174
+ constructor(options = {}) {
175
+ this.error = options.error ?? new ORPCError("METHOD_NOT_SUPPORTED");
176
+ }
177
+ init(options) {
178
+ options.rootInterceptors ??= [];
179
+ options.clientInterceptors ??= [];
180
+ options.rootInterceptors.unshift((options2) => {
181
+ const isGetMethod = options2.request.method === "GET";
182
+ return options2.next({
183
+ ...options2,
184
+ context: {
185
+ ...options2.context,
186
+ [GET_METHOD_GUARD_PLUGIN_IS_GET_METHOD_CONTEXT_SYMBOL]: isGetMethod
187
+ }
188
+ });
189
+ });
190
+ options.clientInterceptors.unshift((options2) => {
191
+ if (typeof options2.context[GET_METHOD_GUARD_PLUGIN_IS_GET_METHOD_CONTEXT_SYMBOL] !== "boolean") {
192
+ throw new TypeError("[GetMethodGuardPlugin] GET method guard context has been corrupted or modified by another plugin or interceptor");
193
+ }
194
+ const procedureMethod = fallbackContractConfig("defaultMethod", options2.procedure["~orpc"].route.method);
195
+ if (options2.context[GET_METHOD_GUARD_PLUGIN_IS_GET_METHOD_CONTEXT_SYMBOL] && procedureMethod !== "GET") {
196
+ throw this.error;
197
+ }
198
+ return options2.next();
199
+ });
200
+ }
201
+ }
202
+
78
203
  class ResponseHeadersPlugin {
79
204
  init(options) {
80
205
  options.rootInterceptors ??= [];
81
206
  options.rootInterceptors.push(async (interceptorOptions) => {
82
- const headers = new Headers();
83
- interceptorOptions.context.resHeaders = headers;
84
- const result = await interceptorOptions.next();
207
+ const resHeaders = interceptorOptions.context.resHeaders ?? new Headers();
208
+ const result = await interceptorOptions.next({
209
+ ...interceptorOptions,
210
+ context: {
211
+ ...interceptorOptions.context,
212
+ resHeaders
213
+ }
214
+ });
85
215
  if (!result.matched) {
86
216
  return result;
87
217
  }
88
218
  const responseHeaders = result.response.headers;
89
- for (const [key, value] of headers) {
219
+ for (const [key, value] of resHeaders) {
90
220
  if (Array.isArray(responseHeaders[key])) {
91
221
  responseHeaders[key].push(value);
92
222
  } else if (responseHeaders[key] !== void 0) {
@@ -100,4 +230,47 @@ class ResponseHeadersPlugin {
100
230
  }
101
231
  }
102
232
 
103
- export { CORSPlugin, ResponseHeadersPlugin };
233
+ const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
234
+ class SimpleCsrfProtectionHandlerPlugin {
235
+ headerName;
236
+ headerValue;
237
+ exclude;
238
+ error;
239
+ constructor(options = {}) {
240
+ this.headerName = options.headerName ?? "x-csrf-token";
241
+ this.headerValue = options.headerValue ?? "orpc";
242
+ this.exclude = options.exclude ?? false;
243
+ this.error = options.error ?? new ORPCError$1("CSRF_TOKEN_MISMATCH", {
244
+ status: 403,
245
+ message: "Invalid CSRF token"
246
+ });
247
+ }
248
+ order = 8e6;
249
+ init(options) {
250
+ options.rootInterceptors ??= [];
251
+ options.clientInterceptors ??= [];
252
+ options.rootInterceptors.unshift(async (options2) => {
253
+ const headerName = await value(this.headerName, options2);
254
+ const headerValue = await value(this.headerValue, options2);
255
+ return options2.next({
256
+ ...options2,
257
+ context: {
258
+ ...options2.context,
259
+ [SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
260
+ }
261
+ });
262
+ });
263
+ options.clientInterceptors.unshift(async (options2) => {
264
+ if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
265
+ throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
266
+ }
267
+ const excluded = await value(this.exclude, options2);
268
+ if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
269
+ throw this.error;
270
+ }
271
+ return options2.next();
272
+ });
273
+ }
274
+ }
275
+
276
+ export { BatchHandlerPlugin, CORSPlugin, GetMethodGuardPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin };
@@ -0,0 +1,9 @@
1
+ function resolveFriendlyStandardHandleOptions(options) {
2
+ return {
3
+ ...options,
4
+ context: options?.context ?? {}
5
+ // Context only optional if all fields are optional
6
+ };
7
+ }
8
+
9
+ export { resolveFriendlyStandardHandleOptions as r };
@@ -1,6 +1,6 @@
1
1
  import { isContractProcedure, ValidationError, mergePrefix, mergeErrorMap, enhanceRoute } from '@orpc/contract';
2
2
  import { fallbackORPCErrorStatus, ORPCError } from '@orpc/client';
3
- import { value, intercept, toError } from '@orpc/shared';
3
+ import { value, intercept } from '@orpc/shared';
4
4
 
5
5
  const LAZY_SYMBOL = Symbol("ORPC_LAZY_SYMBOL");
6
6
  function lazy(loader, meta = {}) {
@@ -127,7 +127,7 @@ function createProcedureClient(lazyableProcedure, ...[options]) {
127
127
  );
128
128
  } catch (e) {
129
129
  if (!(e instanceof ORPCError)) {
130
- throw toError(e);
130
+ throw e;
131
131
  }
132
132
  const validated = await validateORPCError(procedure["~orpc"].errorMap, e);
133
133
  throw validated;
@@ -169,35 +169,29 @@ async function executeProcedureInternal(procedure, options) {
169
169
  const middlewares = procedure["~orpc"].middlewares;
170
170
  const inputValidationIndex = Math.min(Math.max(0, procedure["~orpc"].inputValidationIndex), middlewares.length);
171
171
  const outputValidationIndex = Math.min(Math.max(0, procedure["~orpc"].outputValidationIndex), middlewares.length);
172
- let currentIndex = 0;
173
- let currentContext = options.context;
174
- let currentInput = options.input;
175
- const next = async (...[nextOptions]) => {
176
- const index = currentIndex;
177
- const midContext = nextOptions?.context ?? {};
178
- currentIndex += 1;
179
- currentContext = mergeCurrentContext(currentContext, midContext);
172
+ const next = async (index, context, input) => {
173
+ let currentInput = input;
180
174
  if (index === inputValidationIndex) {
181
175
  currentInput = await validateInput(procedure, currentInput);
182
176
  }
183
177
  const mid = middlewares[index];
184
- const result = mid ? {
185
- context: midContext,
186
- output: (await mid({ ...options, context: currentContext, next }, currentInput, middlewareOutputFn)).output
187
- } : {
188
- context: midContext,
189
- output: await procedure["~orpc"].handler({ ...options, context: currentContext, input: currentInput })
190
- };
178
+ const output = mid ? (await mid({
179
+ ...options,
180
+ context,
181
+ next: async (...[nextOptions]) => {
182
+ const nextContext = nextOptions?.context ?? {};
183
+ return {
184
+ output: await next(index + 1, mergeCurrentContext(context, nextContext), currentInput),
185
+ context: nextContext
186
+ };
187
+ }
188
+ }, currentInput, middlewareOutputFn)).output : await procedure["~orpc"].handler({ ...options, context, input: currentInput });
191
189
  if (index === outputValidationIndex) {
192
- const validatedOutput = await validateOutput(procedure, result.output);
193
- return {
194
- context: result.context,
195
- output: validatedOutput
196
- };
190
+ return await validateOutput(procedure, output);
197
191
  }
198
- return result;
192
+ return output;
199
193
  };
200
- return (await next()).output;
194
+ return next(0, options.context, options.input);
201
195
  }
202
196
 
203
197
  const HIDDEN_ROUTER_CONTRACT_SYMBOL = Symbol("ORPC_HIDDEN_ROUTER_CONTRACT");
@@ -367,8 +361,4 @@ function call(procedure, input, ...rest) {
367
361
  return createProcedureClient(procedure, ...rest)(input);
368
362
  }
369
363
 
370
- function toHttpPath(path) {
371
- return `/${path.map(encodeURIComponent).join("/")}`;
372
- }
373
-
374
- export { LAZY_SYMBOL as L, Procedure as P, toHttpPath as a, createContractedProcedure as b, createProcedureClient as c, addMiddleware as d, enhanceRouter as e, isLazy as f, getRouter as g, createAssertedLazyProcedure as h, isProcedure as i, createORPCErrorConstructorMap as j, getLazyMeta as k, lazy as l, mergeCurrentContext as m, middlewareOutputFn as n, isStartWithMiddlewares as o, mergeMiddlewares as p, call as q, getHiddenRouterContract as r, setHiddenRouterContract as s, traverseContractProcedures as t, unlazy as u, validateORPCError as v, createAccessibleLazyRouter as w, resolveContractProcedures as x, unlazyRouter as y };
364
+ export { LAZY_SYMBOL as L, Procedure as P, createContractedProcedure as a, addMiddleware as b, createProcedureClient as c, isLazy as d, enhanceRouter as e, createAssertedLazyProcedure as f, getRouter as g, createORPCErrorConstructorMap as h, isProcedure as i, getLazyMeta as j, middlewareOutputFn as k, lazy as l, mergeCurrentContext as m, isStartWithMiddlewares as n, mergeMiddlewares as o, call as p, getHiddenRouterContract as q, createAccessibleLazyRouter as r, setHiddenRouterContract as s, traverseContractProcedures as t, unlazy as u, validateORPCError as v, resolveContractProcedures as w, unlazyRouter as x };
@@ -0,0 +1,10 @@
1
+ import { C as Context } from './server.DLt5njUb.mjs';
2
+ import { S as StandardHandleOptions } from './server.Dm5DEJl5.mjs';
3
+
4
+ type FriendlyStandardHandleOptions<T extends Context> = Omit<StandardHandleOptions<T>, 'context'> & (Record<never, never> extends T ? {
5
+ context?: T;
6
+ } : {
7
+ context: T;
8
+ });
9
+
10
+ export type { FriendlyStandardHandleOptions as F };