@orpc/server 2.0.0-beta.23 → 2.0.0-beta.25

package/dist/plugins/index.d.ts

@@ -1,10 +1,19 @@
 import { Value, Promisable, ThrowableError } from '@orpc/shared';
 import { StandardLazyRequest, StandardHeaders } from '@standardserver/core';
-import { C as Context } from '../shared/server.CcR4kgje.js';
-import { e as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.BhsVw7m7.js';
+import { C as Context } from '../shared/server.CwrYlF72.js';
+import { S as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.DrN1Pj1-.js';
+export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.BhHrioCw.js';
 import '@orpc/client';
 import '@orpc/contract';
 
+/**
+ * Content type for batch responses that use the length-prefixed binary framing
+ * (streaming mode, and buffered mode when any sub-response contains binary).
+ *
+ * Decoding is driven by the `standard-server` body hint, not this header,
+ * so it only serves to describe the payload to logs, proxies, and dev tools.
+ */
+declare const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * The max size of the batch allowed.
@@ -54,6 +63,15 @@ interface BatchHandlerPluginOptions<T extends Context> {
         interval?: number;
     };
 }
+/**
+ * Handles batch requests sent by the client Batch Link Plugin, splitting each
+ * batch into sub-requests and streaming their responses back together.
+ *
+ * @remarks
+ * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+ */
 declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
     /**
@@ -119,9 +137,10 @@ interface CORSHandlerPluginOptions<T extends Context> {
     exposeHeaders?: readonly string[];
 }
 /**
- * CORSHandlerPlugin is a plugin for oRPC that allows you to configure CORS for your API.
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
  *
- * @see {@link https://orpc.dev/docs/plugins/cors CORS Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
  */
 declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     private readonly options;
@@ -137,17 +156,11 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
 }
 
 /**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
+ * Decompresses incoming request bodies based on the Content-Encoding header,
+ * supporting gzip, deflate, and deflate-raw.
  *
- * @info This plugin is enabled by default for `RPCHandler` over HTTP.
+ * @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
  */
-declare class CSRFGuardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
 declare class RequestCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
     /**
@@ -157,6 +170,11 @@ declare class RequestCompressionHandlerPlugin<T extends Context> implements Stan
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * The context shape into which the Request Headers Plugin injects `reqHeaders`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
+ */
 interface RequestHeadersHandlerPluginContext {
     /**
      * Request headers as a Headers instance. This is injected by the Request Headers Plugin.
@@ -167,42 +185,13 @@ interface RequestHeadersHandlerPluginContext {
  * The Request Headers Plugin injects a `reqHeaders` instance into the context,
  * allowing access to request headers in oRPC.
  *
- * @see {@link https://orpc.dev/docs/plugins/request-headers Request Headers Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
  */
 declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
     name: string;
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-interface RequestLimitHandlerPluginOptions {
-    /**
-     * The maximum allowed request body size in bytes.
-     */
-    maxBodySize: number;
-}
-/**
- * Rejects requests whose body exceeds `maxBodySize`.
- *
- * When used with the request compression plugin, the limit applies to the
- * decompressed payload rather than the compressed wire size.
- *
- * @see {@link https://orpc.dev/docs/plugins/request-limit Request Limit Plugin Docs}
- */
-declare class RequestLimitHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    /**
-     * Should limit the original batch request body instead of sub-requests.
-     */
-    after: string[];
-    /**
-     * Should limit the final body size instead of the compressed one.
-     */
-    before: string[];
-    private readonly maxBodySize;
-    constructor(options: RequestLimitHandlerPluginOptions);
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
 interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
     /**
      * The compression schemes to use for response compression.
@@ -225,7 +214,7 @@ interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
  * Compresses response bodies based on the client's Accept-Encoding header.
  * Works at the standard handler level, so it supports all adapters.
  *
- * @see {@link https://orpc.dev/docs/plugins/response-compression Response Compression Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/response-compression | Response Compression Plugin}
  */
 declare class ResponseCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
@@ -240,6 +229,11 @@ declare class ResponseCompressionHandlerPlugin<T extends Context> implements Sta
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * The context shape into which the Response Headers Plugin injects `resHeaders`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/response-headers | Response Headers Plugin}
+ */
 interface ResponseHeadersHandlerPluginContext {
     /**
      * Response headers as a Headers instance. This is injected by the Response Headers Plugin.
@@ -251,7 +245,7 @@ interface ResponseHeadersHandlerPluginContext {
  * The Response Headers Plugin allows you to set response headers in oRPC.
  * It injects a resHeaders instance into the context, enabling you to modify response headers easily.
  *
- * @see {@link https://orpc.dev/docs/plugins/response-headers Response Headers Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/response-headers | Response Headers Plugin}
  */
 declare class ResponseHeadersHandlerPlugin<T extends ResponseHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
     name: string;
@@ -283,7 +277,7 @@ interface RethrowHandlerPluginOptions<T extends Context> {
  * and rethrow matching errors directly to your framework's error handling mechanism
  * (e.g., NestJS exception filters, Express error middleware).
  *
- * @see {@link https://orpc.dev/docs/plugins/rethrow Rethrow Plugin Documentation}
+ * @see {@link https://orpc.dev/docs/plugins/rethrow | Rethrow Handler Plugin}
  */
 declare class RethrowHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
@@ -293,5 +287,22 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BatchHandlerPlugin, CORSHandlerPlugin, CSRFGuardHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestLimitHandlerPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, RethrowHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestLimitHandlerPluginOptions, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, RethrowHandlerPluginOptions };
+/**
+ * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
+ * When a request includes cookies, it helps ensure the request originates from JavaScript
+ * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
+ *
+ * @remarks
+ * Unlike `SameSite` cookies, this protection also covers cross-site requests that
+ * still carry cookies, so it is the recommended safeguard when you enable the `GET`
+ * method on RPC handlers or rely on cookie-based authentication.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
+ */
+declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
+export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };

package/dist/plugins/index.mjs

@@ -1,10 +1,11 @@
 import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
-export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
+export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
 import { ORPCError } from '@orpc/client';
 
+const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
   name = "~batch";
   /**
@@ -121,7 +122,7 @@ class BatchHandlerPlugin {
             response: {
               status,
               headers,
-              body: new Blob(chunks, { type: "application/octet-stream" })
+              body: new Blob(chunks, { type: BATCH_CONTENT_TYPE })
             }
           };
         }
@@ -182,7 +183,11 @@ class BatchHandlerPlugin {
       });
       return {
         matched: true,
-        response: { status, headers, body: stream }
+        response: {
+          status,
+          headers: { ...headers, "content-type": BATCH_CONTENT_TYPE },
+          body: stream
+        }
       };
     };
     return {
@@ -365,69 +370,6 @@ class RequestHeadersHandlerPlugin {
   }
 }
 
-class RequestLimitHandlerPlugin {
-  name = "~request-limit";
-  /**
-   * Should limit the original batch request body instead of sub-requests.
-   */
-  after = ["~batch"];
-  /**
-   * Should limit the final body size instead of the compressed one.
-   */
-  before = ["~request-compression"];
-  maxBodySize;
-  constructor(options) {
-    this.maxBodySize = options.maxBodySize;
-  }
-  init(options) {
-    const maxBodySize = this.maxBodySize;
-    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
-      return next({
-        ...interceptorOptions,
-        request: {
-          ...interceptorOptions.request,
-          async resolveBody(hint) {
-            const contentLength = Number(
-              flattenStandardHeader(interceptorOptions.request.headers["content-length"])
-            );
-            if (Number.isFinite(contentLength) && contentLength > maxBodySize) {
-              throw new ORPCError("PAYLOAD_TOO_LARGE");
-            }
-            const stream = await interceptorOptions.request.resolveBody("octet-stream");
-            if (!(stream instanceof ReadableStream)) {
-              return stream;
-            }
-            let currentBodySize = 0;
-            const limitedStream = stream.pipeThrough(
-              new TransformStream({
-                transform(chunk, controller) {
-                  currentBodySize += chunk.byteLength;
-                  if (currentBodySize > maxBodySize) {
-                    controller.error(new ORPCError("PAYLOAD_TOO_LARGE"));
-                    return;
-                  }
-                  controller.enqueue(chunk);
-                }
-              })
-            );
-            const response = new Response(limitedStream, {
-              headers: toFetchHeaders(interceptorOptions.request.headers)
-            });
-            return toStandardBody(response, { hint });
-          }
-        }
-      });
-    };
-    return {
-      ...options,
-      routingInterceptors: [
-        routingInterceptor,
-        ...toArray(options.routingInterceptors)
-      ]
-    };
-  }
-}
-
 const AVG_BYTES_PER_CHAR = 1.2;
 class ResponseCompressionHandlerPlugin {
   name = "~response-compression";
@@ -690,4 +632,29 @@ class RethrowHandlerPlugin {
   }
 }
 
-export { BatchHandlerPlugin, CORSHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestLimitHandlerPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, RethrowHandlerPlugin };
+class SimpleCsrfProtectionHandlerPlugin {
+  name = "~simple-csrf-protection";
+  init(options) {
+    const interceptor = async (interceptorOptions) => {
+      const mode = flattenStandardHeader(
+        interceptorOptions.request.headers["sec-fetch-mode"]
+      )?.toLowerCase();
+      if (mode === void 0) {
+        return interceptorOptions.next();
+      }
+      if (mode === "cors" || mode === "same-origin") {
+        return interceptorOptions.next();
+      }
+      throw new ORPCError("FORBIDDEN", {
+        message: "Request blocked by CSRF protection."
+      });
+    };
+    return {
+      ...options,
+      // appended last so user's interceptors can catch ORPCError
+      interceptors: [...toArray(options.interceptors), interceptor]
+    };
+  }
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };

package/dist/shared/{server.DofEOwf-.mjs → server.7T18Khvf.mjs}

@@ -1,32 +1,6 @@
-import { ORPCError, wrapAsyncIteratorPreservingEventMeta, cloneORPCError } from '@orpc/client';
-import { reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
-import { getOrBind, resolveMaybeOptionalOptions, getConstructor, isTypescriptObject, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
-
-function createORPCErrorConstructorMap(errorMap) {
-  const proxy = new Proxy(errorMap, {
-    get(target, code) {
-      if (typeof code !== "string") {
-        return getOrBind(target, code);
-      }
-      const item = (...rest) => {
-        const options = resolveMaybeOptionalOptions(rest);
-        const config = errorMap[code];
-        const error = new ORPCError(code, {
-          message: options.message ?? config?.message,
-          data: options.data,
-          cause: options.cause
-        });
-        if (config) {
-          error.defined = true;
-          error.inferable = true;
-        }
-        return error;
-      };
-      return item;
-    }
-  });
-  return proxy;
-}
+import { wrapAsyncIteratorPreservingEventMeta, ORPCError, cloneORPCError } from '@orpc/client';
+import { createORPCErrorConstructorMap, reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
+import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
 
 class Lazy {
   "~orpc";
@@ -34,7 +8,7 @@ class Lazy {
     this["~orpc"] = def;
   }
   /**
-   * Checks if the given instance satisfies the {@see Lazy} class/interface.
+   * Checks if the given instance satisfies the {@link Lazy} class/interface.
    */
   static [Symbol.hasInstance](instance) {
     if (this !== Lazy) {
@@ -220,7 +194,7 @@ class Procedure {
     this["~orpc"] = def;
   }
   /**
-   * Checks if the given instance satisfies the {@see Procedure} class/interface.
+   * Checks if the given instance satisfies the {@link Procedure} class/interface.
    */
   static [Symbol.hasInstance](instance) {
     if (this !== Procedure) {
@@ -234,4 +208,4 @@ class Procedure {
   }
 }
 
-export { Lazy as L, Procedure as P, createORPCErrorConstructorMap as a, createProcedureClient as c, unlazy as u };
+export { Lazy as L, Procedure as P, createProcedureClient as c, unlazy as u };

package/dist/shared/{server.DBs0rrf9.mjs → server.B2pXdfpL.mjs}

@@ -1,5 +1,5 @@
 import { resolveMetaPlugins, mergeErrorMap, getHiddenMetaPlugins } from '@orpc/contract';
-import { P as Procedure } from './server.DofEOwf-.mjs';
+import { P as Procedure } from './server.7T18Khvf.mjs';
 
 class DecoratedProcedure extends Procedure {
   meta(...plugins) {

package/dist/shared/server.BhHrioCw.d.ts

@@ -0,0 +1,34 @@
+import { C as Context } from './server.CwrYlF72.js';
+import { S as StandardHandlerPlugin, a as StandardHandlerOptions } from './server.DrN1Pj1-.js';
+
+interface RequestLimitHandlerPluginOptions {
+    /**
+     * The maximum allowed request body size in bytes.
+     */
+    maxBodySize: number;
+}
+/**
+ * Rejects requests whose body exceeds `maxBodySize`.
+ *
+ * When used with the request compression plugin, the limit applies to the
+ * decompressed payload rather than the compressed wire size.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-limit | Request Limit Plugin}
+ */
+declare class RequestLimitHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should limit the original batch request body instead of sub-requests.
+     */
+    after: string[];
+    /**
+     * Should limit the final body size instead of the compressed one.
+     */
+    before: string[];
+    private readonly maxBodySize;
+    constructor(options: RequestLimitHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { RequestLimitHandlerPlugin as R };
+export type { RequestLimitHandlerPluginOptions as a };

package/dist/shared/{server.DG9aQpJK.d.ts → server.C2n16pp0.d.ts}

@@ -1,11 +1,21 @@
 import { RPCSerializer, AnyORPCError } from '@orpc/client';
 import { Value, Promisable } from '@orpc/shared';
 import { StandardMethod, StandardLazyRequest, StandardResponse } from '@standardserver/core';
-import { A as AnyProcedure, C as Context } from './server.CcR4kgje.js';
-import { A as AnyRouter } from './server.m3szVJGU.js';
+import { A as AnyProcedure, C as Context } from './server.CwrYlF72.js';
+import { A as AnyRouter } from './server.DtfwuV6U.js';
 import { AnyProcedureContract } from '@orpc/contract';
-import { b as StandardHandlerHandleOptions, c as StandardHandlerCodec, d as StandardHandlerCodecResolvedProcedure } from './server.BhsVw7m7.js';
+import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.DrN1Pj1-.js';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,15 +23,27 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
@@ -65,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/{server.A8J9H8OE.mjs → server.Cbv46U7N.mjs}

@@ -1,8 +1,8 @@
 import { ORPCError, toORPCError, RPCSerializer, COMMON_ERROR_STATUS_MAP } from '@orpc/client';
 import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl } from '@standardserver/core';
-import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.DofEOwf-.mjs';
-import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.D4cnq66J.mjs';
+import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.7T18Khvf.mjs';
+import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.DgunZU0v.mjs';
 
 class CompositeStandardHandlerPlugin {
   name = "~composite";
@@ -121,13 +121,22 @@ class OtelHandlerPlugin {
   }
 }
 
+const RPC_DEFAULT_ALLOW_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
 class RPCMatcher {
   filter;
+  allowMethodsSet;
+  allowMethodsFn;
   rootRouter;
   tree = /* @__PURE__ */ new Map();
   pendingLazyRouters = /* @__PURE__ */ new Map();
   constructor(router, options = {}) {
     this.filter = options.filter ?? true;
+    const allowMethods = options.allowMethods ?? RPC_DEFAULT_ALLOW_METHODS;
+    if (typeof allowMethods !== "function") {
+      this.allowMethodsSet = new Set(allowMethods);
+    } else {
+      this.allowMethodsFn = allowMethods;
+    }
     this.rootRouter = router;
     this.index(router);
   }
@@ -147,7 +156,10 @@ class RPCMatcher {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
   }
-  async match(_method, pathname, prefix) {
+  async match(method, pathname, prefix) {
+    if (this.allowMethodsSet && !this.allowMethodsSet.has(method)) {
+      return void 0;
+    }
     if (pathname.length > 1 && pathname.endsWith("/")) {
       pathname = pathname.slice(0, -1);
     }
@@ -182,9 +194,13 @@ class RPCMatcher {
     if (entry === void 0) {
       return void 0;
     }
+    const procedure = entry.procedure ?? await this.resolveProcedure(entry);
+    if (this.allowMethodsFn && !this.allowMethodsFn(method, procedure, entry.path)) {
+      return void 0;
+    }
     return {
       path: entry.path,
-      procedure: entry.procedure ?? await this.resolveProcedure(entry)
+      procedure
     };
   }
   resolvePendingLazyRouters(pathname) {
@@ -285,4 +301,4 @@ class RPCHandlerCodec {
   }
 }
 
-export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a };
+export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a, RPC_DEFAULT_ALLOW_METHODS as b };

package/dist/shared/server.Cd4Z1hpV.mjs

@@ -0,0 +1,69 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standardserver/core';
+import { toFetchHeaders, toStandardBody } from '@standardserver/fetch';
+
+class RequestLimitHandlerPlugin {
+  name = "~request-limit";
+  /**
+   * Should limit the original batch request body instead of sub-requests.
+   */
+  after = ["~batch"];
+  /**
+   * Should limit the final body size instead of the compressed one.
+   */
+  before = ["~request-compression"];
+  maxBodySize;
+  constructor(options) {
+    this.maxBodySize = options.maxBodySize;
+  }
+  init(options) {
+    const maxBodySize = this.maxBodySize;
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      return next({
+        ...interceptorOptions,
+        request: {
+          ...interceptorOptions.request,
+          async resolveBody(hint) {
+            const contentLength = Number(
+              flattenStandardHeader(interceptorOptions.request.headers["content-length"])
+            );
+            if (Number.isFinite(contentLength) && contentLength > maxBodySize) {
+              throw new ORPCError("PAYLOAD_TOO_LARGE");
+            }
+            const stream = await interceptorOptions.request.resolveBody("octet-stream");
+            if (!(stream instanceof ReadableStream)) {
+              return stream;
+            }
+            let currentBodySize = 0;
+            const limitedStream = stream.pipeThrough(
+              new TransformStream({
+                transform(chunk, controller) {
+                  currentBodySize += chunk.byteLength;
+                  if (currentBodySize > maxBodySize) {
+                    controller.error(new ORPCError("PAYLOAD_TOO_LARGE"));
+                    return;
+                  }
+                  controller.enqueue(chunk);
+                }
+              })
+            );
+            const response = new Response(limitedStream, {
+              headers: toFetchHeaders(interceptorOptions.request.headers)
+            });
+            return toStandardBody(response, { hint });
+          }
+        }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        routingInterceptor,
+        ...toArray(options.routingInterceptors)
+      ]
+    };
+  }
+}
+
+export { RequestLimitHandlerPlugin as R };