@orpc/server 1.14.11 → 1.14.13

package/dist/plugins/index.mjs

@@ -1,206 +1,124 @@
-import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
-import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
-import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
-export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
-import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
+import { runWithSpan, value, setSpanError, isAsyncIteratorObject, AsyncIteratorClass, clone } from '@orpc/shared';
+import { flattenHeader } from '@orpc/standard-server';
+import { parseBatchRequest, toBatchResponse } from '@orpc/standard-server/batch';
+import { toFetchHeaders } from '@orpc/standard-server-fetch';
 import { ORPCError } from '@orpc/client';
+export { S as StrictGetMethodPlugin } from '../shared/server.TEVCLCFC.mjs';
+import '@orpc/contract';
 
 class BatchHandlerPlugin {
-  name = "~batch";
-  /**
-   * Run batch interceptors before OpenTelemetry interceptors
-   * so each subrequest gets its own span instead of sharing one batch-level span.
-   */
-  after = ["~opentelemetry"];
   maxSize;
-  mapSubrequest;
+  mapRequestItem;
   successStatus;
   headers;
-  keepAliveEnabled;
-  keepAliveInterval;
+  order = 5e6;
   constructor(options = {}) {
     this.maxSize = options.maxSize ?? 10;
-    this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
-      ...subRequest,
+    this.mapRequestItem = options.mapRequestItem ?? ((request, { request: batchRequest }) => ({
+      ...request,
       headers: {
         ...batchRequest.headers,
-        ...subRequest.headers,
-        "orpc-batch": void 0
-        // useful in case batch plugin is used multiple times
+        ...request.headers
       }
     }));
     this.successStatus = options.successStatus ?? 207;
     this.headers = options.headers ?? {};
-    this.keepAliveEnabled = options.keepAlive?.enabled ?? true;
-    this.keepAliveInterval = options.keepAlive?.interval ?? 15e3;
   }
   init(options) {
-    const routingInterceptor = async (interceptorOptions) => {
-      const batchHeader = flattenStandardHeader(interceptorOptions.request.headers["orpc-batch"]);
-      if (batchHeader === void 0) {
-        return interceptorOptions.next();
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.unshift(async (options2) => {
+      const xHeader = flattenHeader(options2.request.headers["x-orpc-batch"]);
+      if (xHeader === void 0) {
+        return options2.next();
       }
-      const mode = batchHeader === "buffered" ? "buffered" : "streaming";
-      let messages;
+      let isParsing = false;
       try {
-        if (interceptorOptions.request.method === "GET") {
-          const [, search] = parseStandardUrl(interceptorOptions.request.url);
-          const params = new URLSearchParams(search);
-          const data = params.getAll("data").at(-1);
-          if (!data) {
+        return await runWithSpan({ name: "handle_batch_request" }, async (span) => {
+          const mode = xHeader === "buffered" ? "buffered" : "streaming";
+          isParsing = true;
+          const parsed = parseBatchRequest({ ...options2.request, body: await options2.request.body() });
+          isParsing = false;
+          span?.setAttribute("batch.mode", mode);
+          span?.setAttribute("batch.size", parsed.length);
+          const maxSize = await value(this.maxSize, options2);
+          if (parsed.length > maxSize) {
+            const message = "Batch request size exceeds the maximum allowed size";
+            setSpanError(span, message);
             return {
               matched: true,
-              response: { status: 400, headers: {}, body: "Missing data parameter for batch request" }
-            };
-          }
-          const mightBeMessages = JSON.parse(data);
-          if (!Array.isArray(mightBeMessages) || mightBeMessages.some((m) => !isClientPeerSendMessage(m))) {
-            return {
-              matched: true,
-              response: { status: 400, headers: {}, body: "Invalid batch request data parameter" }
-            };
-          }
-          messages = mightBeMessages;
-        } else {
-          const mightBeMessages = await interceptorOptions.request.resolveBody();
-          if (!Array.isArray(mightBeMessages)) {
-            return {
-              matched: true,
-              response: { status: 400, headers: {}, body: "Invalid batch request body" }
+              response: {
+                status: 413,
+                headers: {},
+                body: message
+              }
             };
           }
-          messages = mightBeMessages;
-        }
-      } catch {
-        return {
-          matched: true,
-          response: { status: 400, headers: {}, body: "Invalid batch request" }
-        };
-      }
-      const maxSize = await value(this.maxSize, interceptorOptions);
-      if (messages.length > maxSize) {
-        return {
-          matched: true,
-          response: { status: 413, headers: {}, body: "Batch request size exceeds the maximum allowed size" }
-        };
-      }
-      const handleIndividualRequest = async (request) => {
-        try {
-          request = this.mapSubrequest(request, interceptorOptions);
-          const { matched, response } = await interceptorOptions.next({ ...interceptorOptions, request });
-          if (!matched) {
-            return { status: 404, headers: {}, body: "No procedure matched" };
-          }
-          return response;
-        } catch (err) {
-          Promise.reject(err);
-          return { status: 500, headers: {}, body: "Internal server error" };
-        }
-      };
-      const status = await value(this.successStatus, interceptorOptions);
-      const headers = await value(this.headers, interceptorOptions);
-      if (mode === "buffered") {
-        const responseMessages = [];
-        const peer2 = new ServerPeer(async (message) => {
-          responseMessages.push(message);
+          const responses = parsed.map(
+            (request, index) => {
+              const mapped = this.mapRequestItem(request, options2);
+              return options2.next({ ...options2, request: { ...mapped, body: () => Promise.resolve(mapped.body) } }).then(({ response: response2, matched }) => {
+                span?.addEvent(`response.${index}.${matched ? "success" : "not_matched"}`);
+                if (matched) {
+                  if (response2.body instanceof Blob || response2.body instanceof FormData || isAsyncIteratorObject(response2.body)) {
+                    return {
+                      index,
+                      status: 500,
+                      headers: {},
+                      body: "Batch responses do not support file/blob, or event-iterator. Please call this procedure separately outside of the batch request."
+                    };
+                  }
+                  return { ...response2, index };
+                }
+                return { index, status: 404, headers: {}, body: "No procedure matched" };
+              }).catch((err) => {
+                Promise.reject(err);
+                return { index, status: 500, headers: {}, body: "Internal server error" };
+              });
+            }
+          );
+          await Promise.race(responses);
+          const status = await value(this.successStatus, responses, options2);
+          const headers = await value(this.headers, responses, options2);
+          const promises = [...responses];
+          const response = await toBatchResponse({
+            status,
+            headers,
+            mode,
+            body: new AsyncIteratorClass(
+              async () => {
+                const handling = promises.filter((p) => p !== void 0);
+                if (handling.length <= 0) {
+                  return { done: true, value: void 0 };
+                }
+                const value2 = await Promise.race(handling);
+                promises[value2.index] = void 0;
+                return { done: false, value: value2 };
+              },
+              async () => {
+              }
+            )
+          });
+          return {
+            matched: true,
+            response
+          };
         });
-        await Promise.all(messages.map((msg) => peer2.message(msg, handleIndividualRequest)));
-        await peer2.close();
-        if (responseMessages.some((msg) => msg.binary !== void 0)) {
-          const chunks = [];
-          for (const message of responseMessages) {
-            const encoded = await encodePeerMessage(message);
-            const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
-            const lengthBuffer = new ArrayBuffer(4);
-            new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
-            chunks.push(new Uint8Array(lengthBuffer));
-            chunks.push(bytes);
-          }
+      } catch (cause) {
+        if (isParsing) {
           return {
             matched: true,
-            response: {
-              status,
-              headers,
-              body: new Blob(chunks, { type: "application/octet-stream" })
-            }
+            response: { status: 400, headers: {}, body: "Invalid batch request, this could be caused by a malformed request body or a missing header" }
           };
         }
-        return {
-          matched: true,
-          response: { status, headers, body: responseMessages }
-        };
+        throw cause;
       }
-      let streamController;
-      let keepAliveTimer;
-      const clearKeepAlive = () => {
-        if (keepAliveTimer !== void 0) {
-          clearInterval(keepAliveTimer);
-          keepAliveTimer = void 0;
-        }
-      };
-      const scheduleKeepAlive = () => {
-        if (!this.keepAliveEnabled) {
-          return;
-        }
-        clearKeepAlive();
-        keepAliveTimer = setInterval(() => {
-          try {
-            const lengthBuffer = new ArrayBuffer(4);
-            new DataView(lengthBuffer).setUint32(0, 0, false);
-            streamController.enqueue(new Uint8Array(lengthBuffer));
-          } catch {
-            clearKeepAlive();
-          }
-        }, this.keepAliveInterval);
-      };
-      const stream = new ReadableStream({
-        start(controller) {
-          streamController = controller;
-          scheduleKeepAlive();
-        },
-        cancel() {
-          clearKeepAlive();
-        }
-      });
-      const peer = new ServerPeer(async (message) => {
-        const encoded = await encodePeerMessage(message);
-        const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
-        const lengthBuffer = new ArrayBuffer(4);
-        new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
-        streamController.enqueue(new Uint8Array(lengthBuffer));
-        streamController.enqueue(bytes);
-        scheduleKeepAlive();
-      });
-      Promise.all(messages.map((msg) => peer.message(msg, handleIndividualRequest))).then(async () => {
-        clearKeepAlive();
-        streamController.close();
-        await peer.close();
-      }).catch(async (error) => {
-        clearKeepAlive();
-        streamController.error(error);
-        await peer.close(error);
-      });
-      return {
-        matched: true,
-        response: { status, headers, body: stream }
-      };
-    };
-    return {
-      ...options,
-      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
-    };
+    });
   }
 }
 
-class CORSHandlerPlugin {
+class CORSPlugin {
   options;
-  name = "~cors";
-  /**
-   * - Do not create spans for CORS preflight requests.
-   * - Run CORS interceptors before batch interceptors so headers are applied to
-   *  the actual response rather than sub-responses.
-   */
-  after = ["~opentelemetry", "~batch"];
+  order = 9e6;
   constructor(options = {}) {
     const defaults = {
       origin: (origin) => origin,
@@ -212,51 +130,19 @@ class CORSHandlerPlugin {
     };
   }
   init(options) {
-    const corsHeadersInterceptor = async (interceptorOptions) => {
-      const result = await interceptorOptions.next();
-      if (!result.matched) {
-        return result;
-      }
-      const resHeaders = { ...result.response.headers };
-      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin) ?? "";
-      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
-      if (allowedOrigins.includes("*")) {
-        resHeaders["access-control-allow-origin"] = "*";
-      } else {
-        if (allowedOrigins.includes(origin)) {
-          resHeaders["access-control-allow-origin"] = origin;
-        }
-        const existingVary = flattenStandardHeader(resHeaders.vary);
-        if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) {
-          resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
-        }
-      }
-      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
-      if (allowedTimingOrigins.includes("*")) {
-        resHeaders["timing-allow-origin"] = "*";
-      } else if (allowedTimingOrigins.includes(origin)) {
-        resHeaders["timing-allow-origin"] = origin;
-      }
-      if (this.options.credentials) {
-        resHeaders["access-control-allow-credentials"] = "true";
-      }
-      if (this.options.exposeHeaders?.length) {
-        resHeaders["access-control-expose-headers"] = flattenStandardHeader(this.options.exposeHeaders);
-      }
-      return { ...result, response: { ...result.response, headers: resHeaders } };
-    };
-    const preflightInterceptor = async (interceptorOptions) => {
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.unshift(async (interceptorOptions) => {
       if (interceptorOptions.request.method === "OPTIONS") {
         const resHeaders = {};
         if (this.options.maxAge !== void 0) {
           resHeaders["access-control-max-age"] = this.options.maxAge.toString();
         }
         if (this.options.allowMethods?.length) {
-          resHeaders["access-control-allow-methods"] = flattenStandardHeader(this.options.allowMethods);
+          resHeaders["access-control-allow-methods"] = flattenHeader(this.options.allowMethods);
         }
         const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
         if (typeof allowHeaders === "string" || allowHeaders?.length) {
-          resHeaders["access-control-allow-headers"] = flattenStandardHeader(allowHeaders);
+          resHeaders["access-control-allow-headers"] = flattenHeader(allowHeaders);
         }
         return {
           matched: true,
@@ -268,385 +154,106 @@ class CORSHandlerPlugin {
         };
       }
       return interceptorOptions.next();
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        corsHeadersInterceptor,
-        preflightInterceptor,
-        ...toArray(options.routingInterceptors)
-      ]
-    };
+    });
+    options.rootInterceptors.unshift(async (interceptorOptions) => {
+      const result = await interceptorOptions.next();
+      if (!result.matched) {
+        return result;
+      }
+      const origin = flattenHeader(interceptorOptions.request.headers.origin) ?? "";
+      const allowedOrigin = await value(this.options.origin, origin, interceptorOptions);
+      const allowedOriginArr = Array.isArray(allowedOrigin) ? allowedOrigin : [allowedOrigin];
+      if (allowedOriginArr.includes("*")) {
+        result.response.headers["access-control-allow-origin"] = "*";
+      } else {
+        if (allowedOriginArr.includes(origin)) {
+          result.response.headers["access-control-allow-origin"] = origin;
+        }
+        const existingVary = flattenHeader(result.response.headers.vary);
+        if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) {
+          result.response.headers.vary = existingVary ? `${existingVary}, Origin` : "Origin";
+        }
+      }
+      const allowedTimingOrigin = await value(this.options.timingOrigin, origin, interceptorOptions);
+      const allowedTimingOriginArr = Array.isArray(allowedTimingOrigin) ? allowedTimingOrigin : [allowedTimingOrigin];
+      if (allowedTimingOriginArr.includes("*")) {
+        result.response.headers["timing-allow-origin"] = "*";
+      } else if (allowedTimingOriginArr.includes(origin)) {
+        result.response.headers["timing-allow-origin"] = origin;
+      }
+      if (this.options.credentials) {
+        result.response.headers["access-control-allow-credentials"] = "true";
+      }
+      if (this.options.exposeHeaders?.length) {
+        result.response.headers["access-control-expose-headers"] = flattenHeader(this.options.exposeHeaders);
+      }
+      return result;
+    });
   }
 }
 
-class RequestCompressionHandlerPlugin {
-  name = "~request-compression";
-  /**
-   * Should decompress the original batch request body instead of sub-requests.
-   */
-  after = ["~batch"];
+class RequestHeadersPlugin {
   init(options) {
-    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
-      const encodings = parseContentEncodings(
-        flattenStandardHeader(interceptorOptions.request.headers["content-encoding"])
-      );
-      if (encodings.length === 0 || !encodings.every(isSupportedEncoding)) {
-        return next();
-      }
-      const decompressedHeaders = {
-        ...interceptorOptions.request.headers,
-        "content-length": void 0,
-        "content-encoding": void 0
-      };
-      return next({
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.push((interceptorOptions) => {
+      const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
+      return interceptorOptions.next({
         ...interceptorOptions,
-        request: {
-          ...interceptorOptions.request,
-          headers: decompressedHeaders,
-          async resolveBody(hint) {
-            const stream = await interceptorOptions.request.resolveBody("octet-stream");
-            if (!(stream instanceof ReadableStream)) {
-              return stream;
-            }
-            let decompressedStream = stream;
-            for (let i = encodings.length - 1; i >= 0; i--) {
-              decompressedStream = decompressedStream.pipeThrough(
-                new DecompressionStream(encodings[i])
-              );
-            }
-            const response = new Response(decompressedStream, {
-              headers: toFetchHeaders(decompressedHeaders)
-            });
-            return toStandardBody(response, { hint });
-          }
+        context: {
+          ...interceptorOptions.context,
+          reqHeaders
         }
       });
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        routingInterceptor,
-        ...toArray(options.routingInterceptors)
-      ]
-    };
+    });
   }
 }
-const SUPPORTED_ENCODINGS = ["gzip", "deflate", "deflate-raw"];
-function isSupportedEncoding(encoding) {
-  return SUPPORTED_ENCODINGS.includes(encoding);
-}
-function parseContentEncodings(header) {
-  if (header === void 0) {
-    return [];
-  }
-  return header.split(",").map((part) => part.trim().toLowerCase());
-}
 
-class RequestHeadersHandlerPlugin {
-  name = "~request-headers";
+class ResponseHeadersPlugin {
   init(options) {
-    return {
-      ...options,
-      interceptors: [
-        (interceptorOptions) => {
-          const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
-          return interceptorOptions.next({
-            ...interceptorOptions,
-            context: {
-              ...interceptorOptions.context,
-              reqHeaders
-            }
-          });
-        },
-        ...toArray(options.interceptors)
-      ]
-    };
-  }
-}
-
-class RequestLimitHandlerPlugin {
-  name = "~request-limit";
-  /**
-   * Should limit the original batch request body instead of sub-requests.
-   */
-  after = ["~batch"];
-  /**
-   * Should limit the final body size instead of the compressed one.
-   */
-  before = ["~request-compression"];
-  maxBodySize;
-  constructor(options) {
-    this.maxBodySize = options.maxBodySize;
-  }
-  init(options) {
-    const maxBodySize = this.maxBodySize;
-    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
-      return next({
+    options.rootInterceptors ??= [];
+    options.rootInterceptors.push(async (interceptorOptions) => {
+      const resHeaders = interceptorOptions.context.resHeaders ?? new Headers();
+      const result = await interceptorOptions.next({
         ...interceptorOptions,
-        request: {
-          ...interceptorOptions.request,
-          async resolveBody(hint) {
-            const contentLength = Number(
-              flattenStandardHeader(interceptorOptions.request.headers["content-length"])
-            );
-            if (Number.isFinite(contentLength) && contentLength > maxBodySize) {
-              throw new ORPCError("PAYLOAD_TOO_LARGE");
-            }
-            const stream = await interceptorOptions.request.resolveBody("octet-stream");
-            if (!(stream instanceof ReadableStream)) {
-              return stream;
-            }
-            let currentBodySize = 0;
-            const limitedStream = stream.pipeThrough(
-              new TransformStream({
-                transform(chunk, controller) {
-                  currentBodySize += chunk.byteLength;
-                  if (currentBodySize > maxBodySize) {
-                    controller.error(new ORPCError("PAYLOAD_TOO_LARGE"));
-                    return;
-                  }
-                  controller.enqueue(chunk);
-                }
-              })
-            );
-            const response = new Response(limitedStream, {
-              headers: toFetchHeaders(interceptorOptions.request.headers)
-            });
-            return toStandardBody(response, { hint });
-          }
+        context: {
+          ...interceptorOptions.context,
+          resHeaders
         }
       });
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        routingInterceptor,
-        ...toArray(options.routingInterceptors)
-      ]
-    };
-  }
-}
-
-const AVG_BYTES_PER_CHAR = 1.2;
-class ResponseCompressionHandlerPlugin {
-  name = "~response-compression";
-  /**
-   * Compression should be done after batching, to compress the final response.
-   * Compression should also be done after response headers are set, to access final headers like Content-Type and Cache-Control.
-   */
-  after = ["~batch", "~response-headers"];
-  encodings;
-  threshold;
-  constructor(options = {}) {
-    this.encodings = options.encodings ?? ["gzip", "deflate"];
-    this.threshold = options.threshold ?? 1024;
-  }
-  init(options) {
-    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
-      const result = await next();
       if (!result.matched) {
         return result;
       }
-      const response = result.response;
-      const contentEncoding = flattenStandardHeader(response.headers["content-encoding"])?.trim()?.toLowerCase();
-      if (contentEncoding !== void 0) {
-        return result;
-      }
-      if (isNoTransformCacheControl(flattenStandardHeader(response.headers["cache-control"]))) {
-        return result;
-      }
-      const acceptEncodings = parseAcceptEncodings(
-        flattenStandardHeader(interceptorOptions.request.headers["accept-encoding"])
-      );
-      const encoding = this.encodings.find((enc) => acceptEncodings.includes(enc));
-      if (encoding === void 0) {
-        return result;
-      }
-      const body = response.body;
-      const headers = response.headers;
-      if (body instanceof ReadableStream) {
-        const contentLength = Number(flattenStandardHeader(headers["content-length"]));
-        if ((!Number.isFinite(contentLength) || contentLength >= this.threshold) && isCompressibleContentType(flattenStandardHeader(headers["content-type"]))) {
-          return {
-            ...result,
-            response: {
-              ...response,
-              body: body.pipeThrough(new CompressionStream(encoding)),
-              headers: {
-                ...headers,
-                "standard-server": "octet-stream",
-                "content-length": [],
-                "content-encoding": encoding
-              }
-            }
-          };
-        }
-      } else if (body instanceof Blob) {
-        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && isCompressibleContentType(body.type)) {
-          const contentDisposition = headers["content-disposition"] ?? generateContentDisposition(
-            body instanceof File ? body.name : "blob"
-          );
-          return {
-            ...result,
-            response: {
-              ...response,
-              body: body.stream().pipeThrough(new CompressionStream(encoding)),
-              headers: {
-                ...headers,
-                "standard-server": "file",
-                "content-type": body.type,
-                "content-length": [],
-                "content-disposition": contentDisposition,
-                "content-encoding": encoding
-              }
-            }
-          };
-        }
-      } else if (body instanceof FormData) {
-        const PART_OVERHEAD = 64;
-        let contentLength = 0;
-        for (const [key, value] of body) {
-          contentLength += PART_OVERHEAD + key.length;
-          if (value instanceof Blob) {
-            if (!Number.isFinite(value.size)) {
-              if (!isCompressibleContentType(value.type)) {
-                contentLength = -Infinity;
-                break;
-              }
-              contentLength = Infinity;
-            } else {
-              contentLength += isCompressibleContentType(value.type) ? value.size : -value.size;
-            }
-          } else {
-            contentLength += value.length * AVG_BYTES_PER_CHAR;
-          }
-        }
-        if (contentLength >= this.threshold) {
-          const res = new Response(body);
-          const compressedStream = res.body.pipeThrough(new CompressionStream(encoding));
-          return {
-            ...result,
-            response: {
-              ...response,
-              body: compressedStream,
-              headers: {
-                ...headers,
-                "standard-server": [],
-                "content-type": res.headers.get("content-type"),
-                "content-length": [],
-                "content-encoding": encoding
-              }
-            }
-          };
-        }
-      } else if (body instanceof URLSearchParams) {
-        const string = body.toString();
-        if (string.length * AVG_BYTES_PER_CHAR >= this.threshold) {
-          return {
-            ...result,
-            response: {
-              ...response,
-              body: new Blob([string]).stream().pipeThrough(new CompressionStream(encoding)),
-              headers: {
-                ...headers,
-                "standard-server": [],
-                "content-type": "application/x-www-form-urlencoded",
-                "content-length": [],
-                "content-encoding": encoding
-              }
-            }
-          };
-        }
-      } else if (body !== void 0 && !isAsyncIteratorObject(body)) {
-        const string = stringifyJSON(body);
-        if (string.length * AVG_BYTES_PER_CHAR >= this.threshold) {
-          return {
-            ...result,
-            response: {
-              ...response,
-              body: new Blob([string]).stream().pipeThrough(new CompressionStream(encoding)),
-              headers: {
-                ...headers,
-                "standard-server": [],
-                "content-type": "application/json",
-                "content-length": [],
-                "content-encoding": encoding
-              }
-            }
-          };
+      const responseHeaders = clone(result.response.headers);
+      for (const [key, value] of resHeaders) {
+        if (Array.isArray(responseHeaders[key])) {
+          responseHeaders[key].push(value);
+        } else if (responseHeaders[key] !== void 0) {
+          responseHeaders[key] = [responseHeaders[key], value];
+        } else {
+          responseHeaders[key] = value;
         }
       }
-      return result;
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        routingInterceptor,
-        ...toArray(options.routingInterceptors)
-      ]
-    };
-  }
-}
-function parseAcceptEncodings(header) {
-  if (header === void 0) {
-    return [];
-  }
-  return header.split(",").map((part) => part.trim().split(";")[0].trim().toLowerCase()).filter(Boolean);
-}
-const CACHE_CONTROL_NO_TRANSFORM_REGEX = /(?:^|,)\s*no-transform\s*(?:,|$)/i;
-function isNoTransformCacheControl(cacheControl) {
-  if (cacheControl === void 0) {
-    return false;
-  }
-  return CACHE_CONTROL_NO_TRANSFORM_REGEX.test(cacheControl);
-}
-
-class ResponseHeadersHandlerPlugin {
-  name = "~response-headers";
-  /**
-   * Interceptors should run after batch interceptors so headers are applied to each sub-response.
-   */
-  before = ["~batch"];
-  init(options) {
-    return {
-      ...options,
-      routingInterceptors: [
-        async (interceptorOptions) => {
-          const resHeaders = new Headers(interceptorOptions.context.resHeaders);
-          const result = await interceptorOptions.next({
-            ...interceptorOptions,
-            context: {
-              ...interceptorOptions.context,
-              resHeaders
-            }
-          });
-          if (!result.response) {
-            return result;
-          }
-          return {
-            ...result,
-            response: {
-              ...result.response,
-              headers: mergeStandardHeaders(result.response.headers, toStandardHeaders(resHeaders))
-            }
-          };
-        },
-        ...toArray(options.routingInterceptors)
-      ]
-    };
+      return {
+        ...result,
+        response: {
+          ...result.response,
+          headers: responseHeaders
+        }
+      };
+    });
   }
 }
 
-class RethrowHandlerPlugin {
-  name = "~rethrow";
+class experimental_RethrowHandlerPlugin {
   filter;
   CONTEXT_SYMBOL = Symbol("ORPC_RETHROW_HANDLER_PLUGIN_CONTEXT");
   constructor(options) {
     this.filter = options.filter;
   }
   init(options) {
-    const routingInterceptor = async (options2) => {
+    options.rootInterceptors ??= [];
+    options.interceptors ??= [];
+    options.rootInterceptors.push(async (options2) => {
       const pluginContext = {};
       const result = await options2.next({
         ...options2,
@@ -659,8 +266,8 @@ class RethrowHandlerPlugin {
         throw pluginContext.error.value;
       }
       return result;
-    };
-    const interceptor = async (options2) => {
+    });
+    options.interceptors.unshift(async (options2) => {
       const pluginContext = options2.context[this.CONTEXT_SYMBOL];
       if (!pluginContext) {
         throw new TypeError("[RethrowHandlerPlugin] Rethrow handler context has been corrupted or modified by another plugin or interceptor");
@@ -668,26 +275,57 @@ class RethrowHandlerPlugin {
       try {
         return await options2.next();
       } catch (error) {
-        if (this.filter(error, options2)) {
+        if (value(this.filter, error, options2)) {
           pluginContext.error = { value: error };
+          return { matched: false, response: void 0 };
         }
         throw error;
       }
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        ...toArray(options.routingInterceptors),
-        routingInterceptor
-        // rethrow as early as possible and keep it close to `interceptor` to avoid a corrupted or modified context
-      ],
-      interceptors: [
-        interceptor,
-        // catch as many errors as possible
-        ...toArray(options.interceptors)
-      ]
-    };
+    });
+  }
+}
+
+const SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL = Symbol("SIMPLE_CSRF_PROTECTION_CONTEXT");
+class SimpleCsrfProtectionHandlerPlugin {
+  headerName;
+  headerValue;
+  exclude;
+  error;
+  constructor(options = {}) {
+    this.headerName = options.headerName ?? "x-csrf-token";
+    this.headerValue = options.headerValue ?? "orpc";
+    this.exclude = options.exclude ?? false;
+    this.error = options.error ?? new ORPCError("CSRF_TOKEN_MISMATCH", {
+      status: 403,
+      message: "Invalid CSRF token"
+    });
+  }
+  order = 8e6;
+  init(options) {
+    options.rootInterceptors ??= [];
+    options.clientInterceptors ??= [];
+    options.rootInterceptors.unshift(async (options2) => {
+      const headerName = await value(this.headerName, options2);
+      const headerValue = await value(this.headerValue, options2);
+      return options2.next({
+        ...options2,
+        context: {
+          ...options2.context,
+          [SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]: options2.request.headers[headerName] === headerValue
+        }
+      });
+    });
+    options.clientInterceptors.unshift(async (options2) => {
+      if (typeof options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL] !== "boolean") {
+        throw new TypeError("[SimpleCsrfProtectionHandlerPlugin] CSRF protection context has been corrupted or modified by another plugin or interceptor");
+      }
+      const excluded = await value(this.exclude, options2);
+      if (!excluded && !options2.context[SIMPLE_CSRF_PROTECTION_CONTEXT_SYMBOL]) {
+        throw this.error;
+      }
+      return options2.next();
+    });
   }
 }
 
-export { BatchHandlerPlugin, CORSHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestLimitHandlerPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, RethrowHandlerPlugin };
+export { BatchHandlerPlugin, CORSPlugin, RequestHeadersPlugin, ResponseHeadersPlugin, SimpleCsrfProtectionHandlerPlugin, experimental_RethrowHandlerPlugin };