@orpc/server 2.0.0-beta.25 → 2.0.0-beta.27

package/dist/plugins/index.d.ts

@@ -1,5 +1,5 @@
 import { Value, Promisable, ThrowableError } from '@orpc/shared';
-import { StandardLazyRequest, StandardHeaders } from '@standardserver/core';
+import { StandardLazyRequest, StandardHeaders, StandardMethod } from '@standardserver/core';
 import { C as Context } from '../shared/server.CwrYlF72.js';
 import { S as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.DrN1Pj1-.js';
 export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.BhHrioCw.js';
@@ -96,18 +96,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
      *
      * @default (origin) => origin
      */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
      *
      * @default undefined
      */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
      */
     allowMethods?: readonly string[];
     /**
@@ -155,6 +155,64 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /** Judge the real request, before batch splits it into client-authored sub-requests. */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}
+
+interface MethodOverrideHandlerPluginOptions {
+    /**
+     * The query parameter carrying the override method.
+     *
+     * @default 'method'
+     */
+    param?: string;
+    /**
+     * The methods a POST request may be overridden to.
+     *
+     * GET and HEAD are excluded by default because they switch input decoding
+     * from the request body to the query string and widen the CSRF surface.
+     *
+     * @default ['PUT', 'PATCH', 'DELETE']
+     */
+    methods?: readonly StandardMethod[];
+}
+/**
+ * Overrides the HTTP method of a POST request based on a query parameter,
+ * so HTML forms (which only support GET and POST) can invoke procedures
+ * routed as PUT, PATCH, or DELETE.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+ */
+declare class MethodOverrideHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should override batch sub-request methods, not the original batch request.
+     */
+    before: string[];
+    private readonly param;
+    private readonly methods;
+    constructor(options?: MethodOverrideHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -287,22 +345,5 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @remarks
- * Unlike `SameSite` cookies, this protection also covers cross-site requests that
- * still carry cookies, so it is the recommended safeguard when you enable the `GET`
- * method on RPC handlers or rely on cookie-based authentication.
- *
- * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
- */
-declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };
+export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };

package/dist/plugins/index.mjs

@@ -1,9 +1,9 @@
-import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
+import { toArray, value, parseAcceptEncodingQualities, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
-import { ORPCError } from '@orpc/client';
+import '@orpc/client';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
@@ -64,7 +64,7 @@ class BatchHandlerPlugin {
           messages = mightBeMessages;
         } else {
           const mightBeMessages = await interceptorOptions.request.resolveBody();
-          if (!Array.isArray(mightBeMessages)) {
+          if (!Array.isArray(mightBeMessages) || mightBeMessages.some((m) => !isClientPeerSendMessage(m))) {
             return {
               matched: true,
               response: { status: 400, headers: {}, body: "Invalid batch request body" }
@@ -78,6 +78,13 @@ class BatchHandlerPlugin {
           response: { status: 400, headers: {}, body: "Invalid batch request" }
         };
       }
+      const outerMethod = interceptorOptions.request.method;
+      if ((outerMethod === "GET" || outerMethod === "QUERY") && messages.some((message) => message.kind === "request" && message.json.method !== outerMethod)) {
+        return {
+          matched: true,
+          response: { status: 400, headers: {}, body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests` }
+        };
+      }
       const maxSize = await value(this.maxSize, interceptorOptions);
       if (messages.length > maxSize) {
         return {
@@ -209,7 +216,7 @@ class CORSHandlerPlugin {
   constructor(options = {}) {
     const defaults = {
       origin: (origin) => origin,
-      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"]
+      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"]
     };
     this.options = {
       ...defaults,
@@ -223,12 +230,12 @@ class CORSHandlerPlugin {
         return result;
       }
       const resHeaders = { ...result.response.headers };
-      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin) ?? "";
-      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
+      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+      const allowedOrigins = toArray(value(this.options.origin, origin, interceptorOptions));
       if (allowedOrigins.includes("*")) {
         resHeaders["access-control-allow-origin"] = "*";
       } else {
-        if (allowedOrigins.includes(origin)) {
+        if (origin !== void 0 && allowedOrigins.includes(origin)) {
           resHeaders["access-control-allow-origin"] = origin;
         }
         const existingVary = flattenStandardHeader(resHeaders.vary);
@@ -236,10 +243,10 @@ class CORSHandlerPlugin {
           resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
         }
       }
-      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
+      const allowedTimingOrigins = toArray(value(this.options.timingOrigin, origin, interceptorOptions));
       if (allowedTimingOrigins.includes("*")) {
         resHeaders["timing-allow-origin"] = "*";
-      } else if (allowedTimingOrigins.includes(origin)) {
+      } else if (origin !== void 0 && allowedTimingOrigins.includes(origin)) {
         resHeaders["timing-allow-origin"] = origin;
       }
       if (this.options.credentials) {
@@ -285,6 +292,84 @@ class CORSHandlerPlugin {
   }
 }
 
+class GetMethodCsrfProtectionHandlerPlugin {
+  name = "~get-method-csrf-protection";
+  /** Judge the real request, before batch splits it into client-authored sub-requests. */
+  after = ["~batch"];
+  init(options) {
+    const routingInterceptor = (interceptorOptions) => {
+      if (this.isAllowed(interceptorOptions)) {
+        return interceptorOptions.next();
+      }
+      return Promise.resolve({
+        matched: true,
+        response: { status: 403, headers: {}, body: "Request blocked by CSRF protection." }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+  isAllowed({ request }) {
+    if (request.method !== "GET") {
+      return true;
+    }
+    const site = flattenStandardHeader(request.headers["sec-fetch-site"])?.toLowerCase();
+    if (site === void 0 || site === "same-origin" || site === "same-site") {
+      return true;
+    }
+    const mode = flattenStandardHeader(request.headers["sec-fetch-mode"])?.toLowerCase();
+    const dest = flattenStandardHeader(request.headers["sec-fetch-dest"])?.toLowerCase();
+    if (mode === void 0 || dest === void 0) {
+      return false;
+    }
+    return mode !== "navigate" || dest !== "document";
+  }
+}
+
+class MethodOverrideHandlerPlugin {
+  name = "~method-override";
+  /**
+   * Should override batch sub-request methods, not the original batch request.
+   */
+  before = ["~batch"];
+  param;
+  methods;
+  constructor(options = {}) {
+    this.param = options.param ?? "method";
+    this.methods = new Set((options.methods ?? ["PUT", "PATCH", "DELETE"]).map((method) => method.toUpperCase()));
+  }
+  init(options) {
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      const { request } = interceptorOptions;
+      if (request.method !== "POST") {
+        return next();
+      }
+      const [pathname, search, hash] = parseStandardUrl(request.url);
+      const params = new URLSearchParams(search);
+      const raw = params.getAll(this.param).at(-1);
+      if (raw === void 0) {
+        return next();
+      }
+      const method = raw.toUpperCase();
+      if (!this.methods.has(method)) {
+        return next();
+      }
+      params.delete(this.param);
+      const url = `${pathname}${params.size ? `?${params}` : ""}${hash ?? ""}`;
+      return next({
+        ...interceptorOptions,
+        request: { ...request, method, url }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+}
+
 class RequestCompressionHandlerPlugin {
   name = "~request-compression";
   /**
@@ -395,13 +480,16 @@ class ResponseCompressionHandlerPlugin {
       if (contentEncoding !== void 0) {
         return result;
       }
+      if (response.status === 206 || response.headers["content-range"] !== void 0) {
+        return result;
+      }
       if (isNoTransformCacheControl(flattenStandardHeader(response.headers["cache-control"]))) {
         return result;
       }
-      const acceptEncodings = parseAcceptEncodings(
+      const acceptEncodings = parseAcceptEncodingQualities(
         flattenStandardHeader(interceptorOptions.request.headers["accept-encoding"])
       );
-      const encoding = this.encodings.find((enc) => acceptEncodings.includes(enc));
+      const encoding = this.encodings.find((enc) => (acceptEncodings.get(enc) ?? 0) > 0);
       if (encoding === void 0) {
         return result;
       }
@@ -419,7 +507,8 @@ class ResponseCompressionHandlerPlugin {
                 ...headers,
                 "standard-server": "octet-stream",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -440,7 +529,8 @@ class ResponseCompressionHandlerPlugin {
                 "content-type": body.type,
                 "content-length": [],
                 "content-disposition": contentDisposition,
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -477,7 +567,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": res.headers.get("content-type"),
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -495,7 +586,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": "application/x-www-form-urlencoded",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -513,7 +605,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": "application/json",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -530,11 +623,13 @@ class ResponseCompressionHandlerPlugin {
     };
   }
 }
-function parseAcceptEncodings(header) {
-  if (header === void 0) {
-    return [];
+function varyByAcceptEncoding(vary) {
+  const current = flattenStandardHeader(vary);
+  if (current === void 0) {
+    return "accept-encoding";
   }
-  return header.split(",").map((part) => part.trim().split(";")[0].trim().toLowerCase()).filter(Boolean);
+  const fields = current.split(",").map((field) => field.trim().toLowerCase());
+  return fields.includes("accept-encoding") || fields.includes("*") ? current : `${current}, accept-encoding`;
 }
 const CACHE_CONTROL_NO_TRANSFORM_REGEX = /(?:^|,)\s*no-transform\s*(?:,|$)/i;
 function isNoTransformCacheControl(cacheControl) {
@@ -632,29 +727,4 @@ class RethrowHandlerPlugin {
   }
 }
 
-class SimpleCsrfProtectionHandlerPlugin {
-  name = "~simple-csrf-protection";
-  init(options) {
-    const interceptor = async (interceptorOptions) => {
-      const mode = flattenStandardHeader(
-        interceptorOptions.request.headers["sec-fetch-mode"]
-      )?.toLowerCase();
-      if (mode === void 0) {
-        return interceptorOptions.next();
-      }
-      if (mode === "cors" || mode === "same-origin") {
-        return interceptorOptions.next();
-      }
-      throw new ORPCError("FORBIDDEN", {
-        message: "Request blocked by CSRF protection."
-      });
-    };
-    return {
-      ...options,
-      // appended last so user's interceptors can catch ORPCError
-      interceptors: [...toArray(options.interceptors), interceptor]
-    };
-  }
-}
-
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };

package/dist/shared/{server.7T18Khvf.mjs → server.CkButhNT.mjs}

@@ -1,6 +1,6 @@
 import { wrapAsyncIteratorPreservingEventMeta, ORPCError, cloneORPCError } from '@orpc/client';
 import { createORPCErrorConstructorMap, reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
-import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
+import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream, isPlainObject, mergeTwoLevels } from '@orpc/shared';
 
 class Lazy {
   "~orpc";
@@ -127,7 +127,12 @@ async function executeProcedureInternal(procedure, options) {
     const endInputIndex = midIndex === orderedMiddlewares.length ? inputSchemas.length : orderedMiddlewares[midIndex].inputSchemasLengthAtUse ?? 0;
     if (!procedure["~orpc"].disableInputValidation) {
       for (let i = startInputIndex; i < endInputIndex; i++) {
-        currentInput = await validateInput(i, inputSchemas[i], currentInput);
+        const validated = await validateInput(
+          i,
+          inputSchemas[i],
+          inputSchemas.length > 1 && isPlainObject(currentInput) ? options.input : currentInput
+        );
+        currentInput = i !== 0 ? mergeTwoLevels(currentInput, validated) : validated;
       }
     }
     let currentOutput;

package/dist/shared/{server.Cbv46U7N.mjs → server.D9VprDph.mjs}

@@ -1,8 +1,8 @@
 import { ORPCError, toORPCError, RPCSerializer, COMMON_ERROR_STATUS_MAP } from '@orpc/client';
 import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl } from '@standardserver/core';
-import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.7T18Khvf.mjs';
-import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.DgunZU0v.mjs';
+import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.CkButhNT.mjs';
+import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.Dh77P3ii.mjs';
 
 class CompositeStandardHandlerPlugin {
   name = "~composite";

package/dist/shared/{server.DgunZU0v.mjs → server.Dh77P3ii.mjs}

@@ -1,4 +1,4 @@
-import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.7T18Khvf.mjs';
+import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.CkButhNT.mjs';
 import { resolveMetaPlugins, mergeErrorMap, ProcedureContract } from '@orpc/contract';
 import { omit, isTypescriptObject } from '@orpc/shared';
 

package/dist/shared/{server.B2pXdfpL.mjs → server.eCTV8Vpp.mjs}

@@ -1,5 +1,5 @@
 import { resolveMetaPlugins, mergeErrorMap, getHiddenMetaPlugins } from '@orpc/contract';
-import { P as Procedure } from './server.7T18Khvf.mjs';
+import { P as Procedure } from './server.CkButhNT.mjs';
 
 class DecoratedProcedure extends Procedure {
   meta(...plugins) {

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.25",
+  "version": "2.0.0-beta.27",
   "license": "MIT",
+  "funding": "https://github.com/sponsors/dinwwwh",
   "homepage": "https://orpc.dev",
   "repository": {
     "type": "git",
@@ -106,13 +107,13 @@
     "@standardserver/node": "^0.7.1",
     "@standardserver/peer": "^0.7.1",
     "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.25",
-    "@orpc/contract": "2.0.0-beta.25",
-    "@orpc/shared": "2.0.0-beta.25"
+    "@orpc/client": "2.0.0-beta.27",
+    "@orpc/contract": "2.0.0-beta.27",
+    "@orpc/shared": "2.0.0-beta.27"
   },
   "devDependencies": {
     "crossws": "^0.4.6",
-    "fastify": "^5.11.0",
+    "fastify": "^5.11.3",
     "supertest": "^7.2.2",
     "zod": "^4.4.3"
   },