@orpc/server 2.0.0-beta.26 → 2.0.0-beta.28

package/dist/plugins/index.mjs

@@ -1,9 +1,9 @@
-import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
+import { toArray, value, parseAcceptEncodingQualities, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON, anyAbortSignal, override, wrapAsyncIterator, wrapReadableStream, AbortError } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
-import { ORPCError } from '@orpc/client';
+import '@orpc/client';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
@@ -61,16 +61,10 @@ class BatchHandlerPlugin {
               response: { status: 400, headers: {}, body: "Invalid batch request data parameter" }
             };
           }
-          if (mightBeMessages.some((m) => m.kind === "request" && m.json.method !== "GET")) {
-            return {
-              matched: true,
-              response: { status: 400, headers: {}, body: "GET batch requests only accept GET sub-requests" }
-            };
-          }
           messages = mightBeMessages;
         } else {
           const mightBeMessages = await interceptorOptions.request.resolveBody();
-          if (!Array.isArray(mightBeMessages)) {
+          if (!Array.isArray(mightBeMessages) || mightBeMessages.some((m) => !isClientPeerSendMessage(m))) {
             return {
               matched: true,
               response: { status: 400, headers: {}, body: "Invalid batch request body" }
@@ -84,6 +78,13 @@ class BatchHandlerPlugin {
           response: { status: 400, headers: {}, body: "Invalid batch request" }
         };
       }
+      const outerMethod = interceptorOptions.request.method;
+      if ((outerMethod === "GET" || outerMethod === "QUERY") && messages.some((message) => message.kind === "request" && message.json.method !== outerMethod)) {
+        return {
+          matched: true,
+          response: { status: 400, headers: {}, body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests` }
+        };
+      }
       const maxSize = await value(this.maxSize, interceptorOptions);
       if (messages.length > maxSize) {
         return {
@@ -215,7 +216,7 @@ class CORSHandlerPlugin {
   constructor(options = {}) {
     const defaults = {
       origin: (origin) => origin,
-      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"]
+      allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"]
     };
     this.options = {
       ...defaults,
@@ -229,12 +230,12 @@ class CORSHandlerPlugin {
         return result;
       }
       const resHeaders = { ...result.response.headers };
-      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin) ?? "";
-      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
+      const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+      const allowedOrigins = toArray(value(this.options.origin, origin, interceptorOptions));
       if (allowedOrigins.includes("*")) {
         resHeaders["access-control-allow-origin"] = "*";
       } else {
-        if (allowedOrigins.includes(origin)) {
+        if (origin !== void 0 && allowedOrigins.includes(origin)) {
           resHeaders["access-control-allow-origin"] = origin;
         }
         const existingVary = flattenStandardHeader(resHeaders.vary);
@@ -242,10 +243,10 @@ class CORSHandlerPlugin {
           resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
         }
       }
-      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
+      const allowedTimingOrigins = toArray(value(this.options.timingOrigin, origin, interceptorOptions));
       if (allowedTimingOrigins.includes("*")) {
         resHeaders["timing-allow-origin"] = "*";
-      } else if (allowedTimingOrigins.includes(origin)) {
+      } else if (origin !== void 0 && allowedTimingOrigins.includes(origin)) {
         resHeaders["timing-allow-origin"] = origin;
       }
       if (this.options.credentials) {
@@ -291,6 +292,42 @@ class CORSHandlerPlugin {
   }
 }
 
+class GetMethodCsrfProtectionHandlerPlugin {
+  name = "~get-method-csrf-protection";
+  /** Judge the real request, before batch splits it into client-authored sub-requests. */
+  after = ["~batch"];
+  init(options) {
+    const routingInterceptor = (interceptorOptions) => {
+      if (this.isAllowed(interceptorOptions)) {
+        return interceptorOptions.next();
+      }
+      return Promise.resolve({
+        matched: true,
+        response: { status: 403, headers: {}, body: "Request blocked by CSRF protection." }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+    };
+  }
+  isAllowed({ request }) {
+    if (request.method !== "GET") {
+      return true;
+    }
+    const site = flattenStandardHeader(request.headers["sec-fetch-site"])?.toLowerCase();
+    if (site === void 0 || site === "same-origin" || site === "same-site") {
+      return true;
+    }
+    const mode = flattenStandardHeader(request.headers["sec-fetch-mode"])?.toLowerCase();
+    const dest = flattenStandardHeader(request.headers["sec-fetch-dest"])?.toLowerCase();
+    if (mode === void 0 || dest === void 0) {
+      return false;
+    }
+    return mode !== "navigate" || dest !== "document";
+  }
+}
+
 class MethodOverrideHandlerPlugin {
   name = "~method-override";
   /**
@@ -443,13 +480,16 @@ class ResponseCompressionHandlerPlugin {
       if (contentEncoding !== void 0) {
         return result;
       }
+      if (response.status === 206 || response.headers["content-range"] !== void 0) {
+        return result;
+      }
       if (isNoTransformCacheControl(flattenStandardHeader(response.headers["cache-control"]))) {
         return result;
       }
-      const acceptEncodings = parseAcceptEncodings(
+      const acceptEncodings = parseAcceptEncodingQualities(
         flattenStandardHeader(interceptorOptions.request.headers["accept-encoding"])
       );
-      const encoding = this.encodings.find((enc) => acceptEncodings.includes(enc));
+      const encoding = this.encodings.find((enc) => (acceptEncodings.get(enc) ?? 0) > 0);
       if (encoding === void 0) {
         return result;
       }
@@ -467,7 +507,8 @@ class ResponseCompressionHandlerPlugin {
                 ...headers,
                 "standard-server": "octet-stream",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -488,7 +529,8 @@ class ResponseCompressionHandlerPlugin {
                 "content-type": body.type,
                 "content-length": [],
                 "content-disposition": contentDisposition,
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -525,7 +567,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": res.headers.get("content-type"),
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -543,7 +586,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": "application/x-www-form-urlencoded",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -561,7 +605,8 @@ class ResponseCompressionHandlerPlugin {
                 "standard-server": [],
                 "content-type": "application/json",
                 "content-length": [],
-                "content-encoding": encoding
+                "content-encoding": encoding,
+                "vary": varyByAcceptEncoding(headers.vary)
               }
             }
           };
@@ -578,11 +623,13 @@ class ResponseCompressionHandlerPlugin {
     };
   }
 }
-function parseAcceptEncodings(header) {
-  if (header === void 0) {
-    return [];
+function varyByAcceptEncoding(vary) {
+  const current = flattenStandardHeader(vary);
+  if (current === void 0) {
+    return "accept-encoding";
   }
-  return header.split(",").map((part) => part.trim().split(";")[0].trim().toLowerCase()).filter(Boolean);
+  const fields = current.split(",").map((field) => field.trim().toLowerCase());
+  return fields.includes("accept-encoding") || fields.includes("*") ? current : `${current}, accept-encoding`;
 }
 const CACHE_CONTROL_NO_TRANSFORM_REGEX = /(?:^|,)\s*no-transform\s*(?:,|$)/i;
 function isNoTransformCacheControl(cacheControl) {
@@ -680,29 +727,53 @@ class RethrowHandlerPlugin {
   }
 }
 
-class SimpleCsrfProtectionHandlerPlugin {
-  name = "~simple-csrf-protection";
+class TimeoutHandlerPlugin {
+  timeout;
+  streamingTimeout;
+  name = "~timeout";
+  constructor(options) {
+    this.timeout = options.timeout;
+    this.streamingTimeout = options.streamingTimeout;
+  }
   init(options) {
     const interceptor = async (interceptorOptions) => {
-      const mode = flattenStandardHeader(
-        interceptorOptions.request.headers["sec-fetch-mode"]
-      )?.toLowerCase();
-      if (mode === void 0) {
+      const timeoutMs = value(this.timeout, interceptorOptions);
+      const streamingTimeoutMs = value(this.streamingTimeout, interceptorOptions);
+      const hasTimeout = timeoutMs !== null && timeoutMs !== void 0;
+      const hasStreamingTimeout = streamingTimeoutMs !== null && streamingTimeoutMs !== void 0;
+      if (!hasTimeout && !hasStreamingTimeout) {
         return interceptorOptions.next();
       }
-      if (mode === "cors" || mode === "same-origin") {
-        return interceptorOptions.next();
+      const controller = new AbortController();
+      const abortWithTimeout = (ms) => {
+        controller.abort(new AbortError(`Request timed out after ${ms}ms`));
+      };
+      const timeoutId = hasTimeout ? setTimeout(abortWithTimeout, timeoutMs, timeoutMs) : void 0;
+      const signal = anyAbortSignal([interceptorOptions.request.signal, controller.signal]);
+      try {
+        const response = await interceptorOptions.next({
+          ...interceptorOptions,
+          request: { ...interceptorOptions.request, signal }
+        });
+        if (hasStreamingTimeout) {
+          const body = response.body;
+          const isIterator = isAsyncIteratorObject(body);
+          if (isIterator || body instanceof ReadableStream) {
+            const streamingTimeoutId = setTimeout(abortWithTimeout, streamingTimeoutMs, streamingTimeoutMs);
+            const onFinish = () => clearTimeout(streamingTimeoutId);
+            return {
+              ...response,
+              body: isIterator ? override(body, wrapAsyncIterator(body, { onFinish })) : override(body, wrapReadableStream(body, { onFinish }))
+            };
+          }
+        }
+        return response;
+      } finally {
+        clearTimeout(timeoutId);
       }
-      throw new ORPCError("FORBIDDEN", {
-        message: "Request blocked by CSRF protection."
-      });
-    };
-    return {
-      ...options,
-      // appended last so user's interceptors can catch ORPCError
-      interceptors: [...toArray(options.interceptors), interceptor]
     };
+    return { ...options, interceptors: [interceptor, ...toArray(options.interceptors)] };
   }
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };

package/dist/shared/{server.7T18Khvf.mjs → server.CkButhNT.mjs}

@@ -1,6 +1,6 @@
 import { wrapAsyncIteratorPreservingEventMeta, ORPCError, cloneORPCError } from '@orpc/client';
 import { createORPCErrorConstructorMap, reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
-import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
+import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream, isPlainObject, mergeTwoLevels } from '@orpc/shared';
 
 class Lazy {
   "~orpc";
@@ -127,7 +127,12 @@ async function executeProcedureInternal(procedure, options) {
     const endInputIndex = midIndex === orderedMiddlewares.length ? inputSchemas.length : orderedMiddlewares[midIndex].inputSchemasLengthAtUse ?? 0;
     if (!procedure["~orpc"].disableInputValidation) {
       for (let i = startInputIndex; i < endInputIndex; i++) {
-        currentInput = await validateInput(i, inputSchemas[i], currentInput);
+        const validated = await validateInput(
+          i,
+          inputSchemas[i],
+          inputSchemas.length > 1 && isPlainObject(currentInput) ? options.input : currentInput
+        );
+        currentInput = i !== 0 ? mergeTwoLevels(currentInput, validated) : validated;
       }
     }
     let currentOutput;

package/dist/shared/{server.Cbv46U7N.mjs → server.D9VprDph.mjs}

@@ -1,8 +1,8 @@
 import { ORPCError, toORPCError, RPCSerializer, COMMON_ERROR_STATUS_MAP } from '@orpc/client';
 import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl } from '@standardserver/core';
-import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.7T18Khvf.mjs';
-import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.DgunZU0v.mjs';
+import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.CkButhNT.mjs';
+import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.Dh77P3ii.mjs';
 
 class CompositeStandardHandlerPlugin {
   name = "~composite";

package/dist/shared/{server.DgunZU0v.mjs → server.Dh77P3ii.mjs}

@@ -1,4 +1,4 @@
-import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.7T18Khvf.mjs';
+import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.CkButhNT.mjs';
 import { resolveMetaPlugins, mergeErrorMap, ProcedureContract } from '@orpc/contract';
 import { omit, isTypescriptObject } from '@orpc/shared';
 

package/dist/shared/{server.B2pXdfpL.mjs → server.eCTV8Vpp.mjs}

@@ -1,5 +1,5 @@
 import { resolveMetaPlugins, mergeErrorMap, getHiddenMetaPlugins } from '@orpc/contract';
-import { P as Procedure } from './server.7T18Khvf.mjs';
+import { P as Procedure } from './server.CkButhNT.mjs';
 
 class DecoratedProcedure extends Procedure {
   meta(...plugins) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.26",
+  "version": "2.0.0-beta.28",
   "license": "MIT",
   "funding": "https://github.com/sponsors/dinwwwh",
   "homepage": "https://orpc.dev",
@@ -100,20 +100,20 @@
     }
   },
   "dependencies": {
-    "@standardserver/aws-lambda": "^0.7.1",
-    "@standardserver/core": "^0.7.1",
-    "@standardserver/fastify": "^0.7.1",
-    "@standardserver/fetch": "^0.7.1",
-    "@standardserver/node": "^0.7.1",
-    "@standardserver/peer": "^0.7.1",
+    "@standardserver/aws-lambda": "^0.8.0",
+    "@standardserver/core": "^0.8.0",
+    "@standardserver/fastify": "^0.8.0",
+    "@standardserver/fetch": "^0.8.0",
+    "@standardserver/node": "^0.8.0",
+    "@standardserver/peer": "^0.8.0",
     "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.26",
-    "@orpc/contract": "2.0.0-beta.26",
-    "@orpc/shared": "2.0.0-beta.26"
+    "@orpc/client": "2.0.0-beta.28",
+    "@orpc/shared": "2.0.0-beta.28",
+    "@orpc/contract": "2.0.0-beta.28"
   },
   "devDependencies": {
     "crossws": "^0.4.6",
-    "fastify": "^5.11.0",
+    "fastify": "^5.11.3",
     "supertest": "^7.2.2",
     "zod": "^4.4.3"
   },