@orpc/server 2.0.0-beta.3 → 2.0.0-beta.30

package/dist/shared/{server.T9F3bzZx.d.ts → server.C2n16pp0.d.ts}

@@ -1,11 +1,21 @@
 import { RPCSerializer, AnyORPCError } from '@orpc/client';
 import { Value, Promisable } from '@orpc/shared';
 import { StandardMethod, StandardLazyRequest, StandardResponse } from '@standardserver/core';
-import { A as AnyProcedure, C as Context } from './server.BL22TloH.js';
-import { A as AnyRouter } from './server.Pa0F03f_.js';
+import { A as AnyProcedure, C as Context } from './server.CwrYlF72.js';
+import { A as AnyRouter } from './server.DtfwuV6U.js';
 import { AnyProcedureContract } from '@orpc/contract';
-import { b as StandardHandlerHandleOptions, c as StandardHandlerCodec, d as StandardHandlerCodecResolvedProcedure } from './server.EOHJ3NJr.js';
+import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.DrN1Pj1-.js';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,20 +23,34 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
-    private pendingLazyRouters;
+    private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
-    private matchPathname;
     private resolvePendingLazyRouters;
+    private loadPendingLazyRouters;
+    private loadPendingLazyRouter;
+    private indexPendingLazyRouter;
     private resolveProcedure;
 }
 
@@ -38,14 +62,15 @@ interface RPCHandlerCodecOptions<T extends Context> extends RPCMatcherOptions {
     /**
      * Resolve HTTP status for encoded successful outputs.
      *
-     * Value should be in range `200-299`
+     * Value should be in the `2xx` range and must be less than `400`.
      * Return `undefined` or `null` to fallback to default
      *
-     * @default DEFAULT_ERROR_STATUS, DEFAULT_ERROR_STATUS
+     * @default DEFAULT_SUCCESS_STATUS (200)
      */
     outputStatus?: Value<number | undefined | null, [output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>]>;
     /**
      * Mapping ORPCError Code -> HTTP Status Code
+     * The status code should be in the `4xx` or `5xx` range (must be greater than or equal to `400`).
      *
      * @default COMMON_ERROR_STATUS_MAP
      */
@@ -62,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/server.Cd4Z1hpV.mjs

@@ -0,0 +1,69 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standardserver/core';
+import { toFetchHeaders, toStandardBody } from '@standardserver/fetch';
+
+class RequestLimitHandlerPlugin {
+  name = "~request-limit";
+  /**
+   * Should limit the original batch request body instead of sub-requests.
+   */
+  after = ["~batch"];
+  /**
+   * Should limit the final body size instead of the compressed one.
+   */
+  before = ["~request-compression"];
+  maxBodySize;
+  constructor(options) {
+    this.maxBodySize = options.maxBodySize;
+  }
+  init(options) {
+    const maxBodySize = this.maxBodySize;
+    const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+      return next({
+        ...interceptorOptions,
+        request: {
+          ...interceptorOptions.request,
+          async resolveBody(hint) {
+            const contentLength = Number(
+              flattenStandardHeader(interceptorOptions.request.headers["content-length"])
+            );
+            if (Number.isFinite(contentLength) && contentLength > maxBodySize) {
+              throw new ORPCError("PAYLOAD_TOO_LARGE");
+            }
+            const stream = await interceptorOptions.request.resolveBody("octet-stream");
+            if (!(stream instanceof ReadableStream)) {
+              return stream;
+            }
+            let currentBodySize = 0;
+            const limitedStream = stream.pipeThrough(
+              new TransformStream({
+                transform(chunk, controller) {
+                  currentBodySize += chunk.byteLength;
+                  if (currentBodySize > maxBodySize) {
+                    controller.error(new ORPCError("PAYLOAD_TOO_LARGE"));
+                    return;
+                  }
+                  controller.enqueue(chunk);
+                }
+              })
+            );
+            const response = new Response(limitedStream, {
+              headers: toFetchHeaders(interceptorOptions.request.headers)
+            });
+            return toStandardBody(response, { hint });
+          }
+        }
+      });
+    };
+    return {
+      ...options,
+      routingInterceptors: [
+        routingInterceptor,
+        ...toArray(options.routingInterceptors)
+      ]
+    };
+  }
+}
+
+export { RequestLimitHandlerPlugin as R };

package/dist/shared/{server.CrlKQucM.mjs → server.CkButhNT.mjs}

@@ -1,32 +1,6 @@
-import { ORPCError, wrapEventIteratorPreservingMeta, cloneORPCError } from '@orpc/client';
-import { reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
-import { getOrBind, resolveMaybeOptionalOptions, getConstructor, isTypescriptObject, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
-
-function createORPCErrorConstructorMap(errorMap) {
-  const proxy = new Proxy(errorMap, {
-    get(target, code) {
-      if (typeof code !== "string") {
-        return getOrBind(target, code);
-      }
-      const item = (...rest) => {
-        const options = resolveMaybeOptionalOptions(rest);
-        const config = errorMap[code];
-        const error = new ORPCError(code, {
-          message: options.message ?? config?.message,
-          data: options.data,
-          cause: options.cause
-        });
-        if (config) {
-          error.defined = true;
-          error.inferable = true;
-        }
-        return error;
-      };
-      return item;
-    }
-  });
-  return proxy;
-}
+import { wrapAsyncIteratorPreservingEventMeta, ORPCError, cloneORPCError } from '@orpc/client';
+import { createORPCErrorConstructorMap, reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
+import { getConstructor, isTypescriptObject, resolveMaybeOptionalOptions, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream, isPlainObject, mergeTwoLevels } from '@orpc/shared';
 
 class Lazy {
   "~orpc";
@@ -34,7 +8,7 @@ class Lazy {
     this["~orpc"] = def;
   }
   /**
-   * Checks if the given instance satisfies the {@see Lazy} class/interface.
+   * Checks if the given instance satisfies the {@link Lazy} class/interface.
    */
   static [Symbol.hasInstance](instance) {
     if (this !== Lazy) {
@@ -84,8 +58,8 @@ function createProcedureClient(lazyableProcedure, ...rest) {
         );
       });
       if (isAsyncIteratorObject(output)) {
-        return override(output, wrapEventIteratorPreservingMeta(
-          traceAsyncIterator("consume_event_iterator_output", output),
+        return override(output, wrapAsyncIteratorPreservingEventMeta(
+          traceAsyncIterator("consume_async_iterator_object_output", output),
           { mapError: reconcileError }
         ));
       }
@@ -151,8 +125,15 @@ async function executeProcedureInternal(procedure, options) {
     let currentInput = input;
     const startInputIndex = midIndex === 0 ? 0 : orderedMiddlewares[midIndex - 1].inputSchemasLengthAtUse ?? 0;
     const endInputIndex = midIndex === orderedMiddlewares.length ? inputSchemas.length : orderedMiddlewares[midIndex].inputSchemasLengthAtUse ?? 0;
-    for (let i = startInputIndex; i < endInputIndex; i++) {
-      currentInput = await validateInput(i, inputSchemas[i], currentInput);
+    if (!procedure["~orpc"].disableInputValidation) {
+      for (let i = startInputIndex; i < endInputIndex; i++) {
+        const validated = await validateInput(
+          i,
+          inputSchemas[i],
+          inputSchemas.length > 1 && isPlainObject(currentInput) ? options.input : currentInput
+        );
+        currentInput = i !== 0 ? mergeTwoLevels(currentInput, validated) : validated;
+      }
     }
     let currentOutput;
     let currentContext = context;
@@ -201,8 +182,10 @@ async function executeProcedureInternal(procedure, options) {
     }
     const startOutputIndex = midIndex === 0 ? 0 : orderedMiddlewares[midIndex - 1].outputSchemasLengthAtUse ?? 0;
     const endOutputIndex = midIndex === orderedMiddlewares.length ? outputSchemas.length : orderedMiddlewares[midIndex].outputSchemasLengthAtUse ?? 0;
-    for (let i = endOutputIndex - 1; i >= startOutputIndex; i--) {
-      currentOutput = await validateOutput(i, outputSchemas[i], currentOutput);
+    if (!procedure["~orpc"].disableOutputValidation) {
+      for (let i = endOutputIndex - 1; i >= startOutputIndex; i--) {
+        currentOutput = await validateOutput(i, outputSchemas[i], currentOutput);
+      }
     }
     return { output: currentOutput, context: currentContext };
   };
@@ -216,7 +199,7 @@ class Procedure {
     this["~orpc"] = def;
   }
   /**
-   * Checks if the given instance satisfies the {@see Procedure} class/interface.
+   * Checks if the given instance satisfies the {@link Procedure} class/interface.
    */
   static [Symbol.hasInstance](instance) {
     if (this !== Procedure) {
@@ -230,4 +213,4 @@ class Procedure {
   }
 }
 
-export { Lazy as L, Procedure as P, createORPCErrorConstructorMap as a, createProcedureClient as c, unlazy as u };
+export { Lazy as L, Procedure as P, createProcedureClient as c, unlazy as u };

package/dist/shared/{server.B_U9y00a.d.mts → server.CkNnZ5F-.d.mts}

@@ -1,11 +1,21 @@
 import { RPCSerializer, AnyORPCError } from '@orpc/client';
 import { Value, Promisable } from '@orpc/shared';
 import { StandardMethod, StandardLazyRequest, StandardResponse } from '@standardserver/core';
-import { A as AnyProcedure, C as Context } from './server.BL22TloH.mjs';
-import { A as AnyRouter } from './server.BsNNjG5J.mjs';
+import { A as AnyProcedure, C as Context } from './server.CwrYlF72.mjs';
+import { A as AnyRouter } from './server.Dm0os-OP.mjs';
 import { AnyProcedureContract } from '@orpc/contract';
-import { b as StandardHandlerHandleOptions, c as StandardHandlerCodec, d as StandardHandlerCodecResolvedProcedure } from './server.BB_Ik9Ph.mjs';
+import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.JbCIPL4P.mjs';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,20 +23,34 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
-    private pendingLazyRouters;
+    private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
-    private matchPathname;
     private resolvePendingLazyRouters;
+    private loadPendingLazyRouters;
+    private loadPendingLazyRouter;
+    private indexPendingLazyRouter;
     private resolveProcedure;
 }
 
@@ -38,14 +62,15 @@ interface RPCHandlerCodecOptions<T extends Context> extends RPCMatcherOptions {
     /**
      * Resolve HTTP status for encoded successful outputs.
      *
-     * Value should be in range `200-299`
+     * Value should be in the `2xx` range and must be less than `400`.
      * Return `undefined` or `null` to fallback to default
      *
-     * @default DEFAULT_ERROR_STATUS, DEFAULT_ERROR_STATUS
+     * @default DEFAULT_SUCCESS_STATUS (200)
      */
     outputStatus?: Value<number | undefined | null, [output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>]>;
     /**
      * Mapping ORPCError Code -> HTTP Status Code
+     * The status code should be in the `4xx` or `5xx` range (must be greater than or equal to `400`).
      *
      * @default COMMON_ERROR_STATUS_MAP
      */
@@ -62,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/{server.BL22TloH.d.mts → server.CwrYlF72.d.mts}

@@ -1,5 +1,5 @@
-import { ORPCErrorCode, ORPCErrorOptions, ORPCError, AnyORPCError, ClientContext, Client } from '@orpc/client';
-import { ErrorMap, ErrorMapItem, InferSchemaInput, AnyMetaPlugin, AnySchema, ProcedureContractDefinition, Meta, InferSchemaOutput, ORPCErrorFromErrorMap } from '@orpc/contract';
+import { AnyORPCError, ClientContext, Client } from '@orpc/client';
+import { ErrorMap, AnyMetaPlugin, ORPCErrorConstructorMap, AnySchema, ProcedureContractDefinition, Meta, InferSchemaOutput, ORPCErrorFromErrorMap, InferSchemaInput } from '@orpc/contract';
 import { MaybeOptionalOptions, Promisable, Interceptor, PromiseWithError, ThrowableError, Value } from '@orpc/shared';
 
 interface Context {
@@ -8,40 +8,6 @@ interface Context {
 type MergedInitialContext<TInitial extends Context, TOutContext extends Context, TInContext extends Context> = Exclude<keyof TInContext, keyof TInitial | keyof TOutContext> extends never ? TInitial : TInitial & Omit<TInContext, keyof TInitial | keyof TOutContext>;
 type MergedContext<TCurrent extends Context, TOutContext extends Context> = keyof TOutContext extends never ? TCurrent : Omit<TCurrent, keyof TOutContext> & TOutContext;
 
-type ORPCErrorConstructorMapItemOptions<TData> = Omit<ORPCErrorOptions<TData>, 'status'>;
-interface ORPCErrorConstructorMapItem<TCode extends ORPCErrorCode, TInData> {
-    (...rest: MaybeOptionalOptions<ORPCErrorConstructorMapItemOptions<TInData>>): ORPCError<TCode, TInData>;
-}
-type ORPCErrorConstructorMap<T extends ErrorMap> = {
-    [K in keyof T]: K extends ORPCErrorCode ? T[K] extends ErrorMapItem<infer UInputSchema> ? ORPCErrorConstructorMapItem<K, InferSchemaInput<UInputSchema>> : never : never;
-};
-/**
- * Creates a map of ORPC error constructors.
- *
- * The returned object is a `Proxy` that allows access to arbitrary error codes:
- * - If the code exists in the provided `errorMap`, the corresponding constructor
- *   will create a **defined** `ORPCError`.
- * - If the code does not exist, a fallback `ORPCError` constructor is returned.
- *
- * The `in` operator can be used to check whether an error code is explicitly
- * defined in the map.
- *
- * @example
- * ```ts
- * const errorMap = createORPCErrorConstructorMap({
- *   NOT_FOUND: {
- *     status: 404,
- *     message: 'Not Found',
- *   },
- * })
- *
- * if ('NOT_FOUND' in errorMap) {
- *   const error = errorMap.NOT_FOUND()
- * }
- * ```
- */
-declare function createORPCErrorConstructorMap<T extends ErrorMap>(errorMap: T): ORPCErrorConstructorMap<T>;
-
 type MiddlewareResult<TOutContext extends Context, TOutput> = Promisable<{
     output: TOutput;
     context: TOutContext;
@@ -119,7 +85,31 @@ interface OrderedMiddleware {
     outputSchemasLengthAtUse?: number | undefined;
     middleware: AnyMiddleware;
 }
-interface ProcedureDefinition<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> extends ProcedureContractDefinition<TInputSchema, TOutputSchema, TErrorMap> {
+interface ProcedureConfig {
+    /**
+     * When enabled, input schemas are not validated at runtime.
+     * Schemas are still used for type inference and OpenAPI generation.
+     *
+     * @remarks
+     * **Warning**: Do not disable validation for schemas that transform values.
+     *
+     * @default false
+     */
+    disableInputValidation?: boolean | undefined;
+    /**
+     * When enabled, output schemas are not validated at runtime.
+     * Schemas are still used for type inference and OpenAPI generation.
+     *
+     * Useful when output schemas exist only for specification generation.
+     *
+     * @remarks
+     * **Warning**: Do not disable validation for schemas that transform values.
+     *
+     * @default false
+     */
+    disableOutputValidation?: boolean | undefined;
+}
+interface ProcedureDefinition<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> extends ProcedureContractDefinition<TInputSchema, TOutputSchema, TErrorMap>, ProcedureConfig {
     __TInitialContext?: (type: TInitialContext) => unknown;
     __TInjectedContext?: (type: TInjectedContext) => unknown;
     __TReturnedError?: () => TReturnedError;
@@ -140,7 +130,7 @@ declare class Procedure<TInitialContext extends Context, TInjectedContext extend
     '~orpc': ProcedureDefinition<TInitialContext, TInjectedContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>;
     constructor(def: ProcedureDefinition<TInitialContext, TInjectedContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>);
     /**
-     * Checks if the given instance satisfies the {@see Procedure} class/interface.
+     * Checks if the given instance satisfies the {@link Procedure} class/interface.
      */
     static [Symbol.hasInstance](instance: unknown): boolean;
 }
@@ -157,7 +147,7 @@ declare class Lazy<T> {
     '~orpc': LazyDefinition<T>;
     constructor(def: LazyDefinition<T>);
     /**
-     * Checks if the given instance satisfies the {@see Lazy} class/interface.
+     * Checks if the given instance satisfies the {@link Lazy} class/interface.
      */
     static [Symbol.hasInstance](instance: unknown): boolean;
 }
@@ -180,5 +170,5 @@ type ProcedureClientOptions<TInitialContext extends Context, TOutputSchema exten
 });
 declare function createProcedureClient<TInitialContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError, TClientContext extends ClientContext = object>(lazyableProcedure: Lazyable<Procedure<TInitialContext, any, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>>, ...rest: MaybeOptionalOptions<ProcedureClientOptions<TInitialContext, TOutputSchema, TErrorMap, TReturnedError, TClientContext>>): ProcedureClient<TClientContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>;
 
-export { Procedure as a, Lazy as g, createORPCErrorConstructorMap as w, createProcedureClient as x, unlazy as y };
-export type { AnyProcedure as A, Context as C, Lazyable as L, MergedContext as M, ORPCErrorConstructorMap as O, ProcedureClientOptions as P, ProcedureClient as b, ProcedureClientInterceptor as c, Middleware as d, MergedInitialContext as e, AnyMiddleware as f, ProcedureHandler as h, OrderedMiddleware as i, LazyDefinition as j, MiddlewareDefinition as k, MiddlewareDone as l, MiddlewareDoneOptions as m, MiddlewareNext as n, MiddlewareNextOptions as o, MiddlewareOptions as p, MiddlewareResult as q, ORPCErrorConstructorMapItem as r, ORPCErrorConstructorMapItemOptions as s, ProcedureClientInterceptorOptions as t, ProcedureDefinition as u, ProcedureHandlerOptions as v };
+export { Procedure as a, Lazy as h, createProcedureClient as u, unlazy as v };
+export type { AnyProcedure as A, Context as C, Lazyable as L, MergedContext as M, OrderedMiddleware as O, ProcedureClientOptions as P, ProcedureClient as b, ProcedureClientInterceptor as c, Middleware as d, MergedInitialContext as e, ProcedureConfig as f, AnyMiddleware as g, ProcedureHandler as i, LazyDefinition as j, MiddlewareDefinition as k, MiddlewareDone as l, MiddlewareDoneOptions as m, MiddlewareNext as n, MiddlewareNextOptions as o, MiddlewareOptions as p, MiddlewareResult as q, ProcedureClientInterceptorOptions as r, ProcedureDefinition as s, ProcedureHandlerOptions as t };

package/dist/shared/{server.BL22TloH.d.ts → server.CwrYlF72.d.ts}

@@ -1,5 +1,5 @@
-import { ORPCErrorCode, ORPCErrorOptions, ORPCError, AnyORPCError, ClientContext, Client } from '@orpc/client';
-import { ErrorMap, ErrorMapItem, InferSchemaInput, AnyMetaPlugin, AnySchema, ProcedureContractDefinition, Meta, InferSchemaOutput, ORPCErrorFromErrorMap } from '@orpc/contract';
+import { AnyORPCError, ClientContext, Client } from '@orpc/client';
+import { ErrorMap, AnyMetaPlugin, ORPCErrorConstructorMap, AnySchema, ProcedureContractDefinition, Meta, InferSchemaOutput, ORPCErrorFromErrorMap, InferSchemaInput } from '@orpc/contract';
 import { MaybeOptionalOptions, Promisable, Interceptor, PromiseWithError, ThrowableError, Value } from '@orpc/shared';
 
 interface Context {
@@ -8,40 +8,6 @@ interface Context {
 type MergedInitialContext<TInitial extends Context, TOutContext extends Context, TInContext extends Context> = Exclude<keyof TInContext, keyof TInitial | keyof TOutContext> extends never ? TInitial : TInitial & Omit<TInContext, keyof TInitial | keyof TOutContext>;
 type MergedContext<TCurrent extends Context, TOutContext extends Context> = keyof TOutContext extends never ? TCurrent : Omit<TCurrent, keyof TOutContext> & TOutContext;
 
-type ORPCErrorConstructorMapItemOptions<TData> = Omit<ORPCErrorOptions<TData>, 'status'>;
-interface ORPCErrorConstructorMapItem<TCode extends ORPCErrorCode, TInData> {
-    (...rest: MaybeOptionalOptions<ORPCErrorConstructorMapItemOptions<TInData>>): ORPCError<TCode, TInData>;
-}
-type ORPCErrorConstructorMap<T extends ErrorMap> = {
-    [K in keyof T]: K extends ORPCErrorCode ? T[K] extends ErrorMapItem<infer UInputSchema> ? ORPCErrorConstructorMapItem<K, InferSchemaInput<UInputSchema>> : never : never;
-};
-/**
- * Creates a map of ORPC error constructors.
- *
- * The returned object is a `Proxy` that allows access to arbitrary error codes:
- * - If the code exists in the provided `errorMap`, the corresponding constructor
- *   will create a **defined** `ORPCError`.
- * - If the code does not exist, a fallback `ORPCError` constructor is returned.
- *
- * The `in` operator can be used to check whether an error code is explicitly
- * defined in the map.
- *
- * @example
- * ```ts
- * const errorMap = createORPCErrorConstructorMap({
- *   NOT_FOUND: {
- *     status: 404,
- *     message: 'Not Found',
- *   },
- * })
- *
- * if ('NOT_FOUND' in errorMap) {
- *   const error = errorMap.NOT_FOUND()
- * }
- * ```
- */
-declare function createORPCErrorConstructorMap<T extends ErrorMap>(errorMap: T): ORPCErrorConstructorMap<T>;
-
 type MiddlewareResult<TOutContext extends Context, TOutput> = Promisable<{
     output: TOutput;
     context: TOutContext;
@@ -119,7 +85,31 @@ interface OrderedMiddleware {
     outputSchemasLengthAtUse?: number | undefined;
     middleware: AnyMiddleware;
 }
-interface ProcedureDefinition<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> extends ProcedureContractDefinition<TInputSchema, TOutputSchema, TErrorMap> {
+interface ProcedureConfig {
+    /**
+     * When enabled, input schemas are not validated at runtime.
+     * Schemas are still used for type inference and OpenAPI generation.
+     *
+     * @remarks
+     * **Warning**: Do not disable validation for schemas that transform values.
+     *
+     * @default false
+     */
+    disableInputValidation?: boolean | undefined;
+    /**
+     * When enabled, output schemas are not validated at runtime.
+     * Schemas are still used for type inference and OpenAPI generation.
+     *
+     * Useful when output schemas exist only for specification generation.
+     *
+     * @remarks
+     * **Warning**: Do not disable validation for schemas that transform values.
+     *
+     * @default false
+     */
+    disableOutputValidation?: boolean | undefined;
+}
+interface ProcedureDefinition<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> extends ProcedureContractDefinition<TInputSchema, TOutputSchema, TErrorMap>, ProcedureConfig {
     __TInitialContext?: (type: TInitialContext) => unknown;
     __TInjectedContext?: (type: TInjectedContext) => unknown;
     __TReturnedError?: () => TReturnedError;
@@ -140,7 +130,7 @@ declare class Procedure<TInitialContext extends Context, TInjectedContext extend
     '~orpc': ProcedureDefinition<TInitialContext, TInjectedContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>;
     constructor(def: ProcedureDefinition<TInitialContext, TInjectedContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>);
     /**
-     * Checks if the given instance satisfies the {@see Procedure} class/interface.
+     * Checks if the given instance satisfies the {@link Procedure} class/interface.
      */
     static [Symbol.hasInstance](instance: unknown): boolean;
 }
@@ -157,7 +147,7 @@ declare class Lazy<T> {
     '~orpc': LazyDefinition<T>;
     constructor(def: LazyDefinition<T>);
     /**
-     * Checks if the given instance satisfies the {@see Lazy} class/interface.
+     * Checks if the given instance satisfies the {@link Lazy} class/interface.
      */
     static [Symbol.hasInstance](instance: unknown): boolean;
 }
@@ -180,5 +170,5 @@ type ProcedureClientOptions<TInitialContext extends Context, TOutputSchema exten
 });
 declare function createProcedureClient<TInitialContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError, TClientContext extends ClientContext = object>(lazyableProcedure: Lazyable<Procedure<TInitialContext, any, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>>, ...rest: MaybeOptionalOptions<ProcedureClientOptions<TInitialContext, TOutputSchema, TErrorMap, TReturnedError, TClientContext>>): ProcedureClient<TClientContext, TInputSchema, TOutputSchema, TErrorMap, TReturnedError>;
 
-export { Procedure as a, Lazy as g, createORPCErrorConstructorMap as w, createProcedureClient as x, unlazy as y };
-export type { AnyProcedure as A, Context as C, Lazyable as L, MergedContext as M, ORPCErrorConstructorMap as O, ProcedureClientOptions as P, ProcedureClient as b, ProcedureClientInterceptor as c, Middleware as d, MergedInitialContext as e, AnyMiddleware as f, ProcedureHandler as h, OrderedMiddleware as i, LazyDefinition as j, MiddlewareDefinition as k, MiddlewareDone as l, MiddlewareDoneOptions as m, MiddlewareNext as n, MiddlewareNextOptions as o, MiddlewareOptions as p, MiddlewareResult as q, ORPCErrorConstructorMapItem as r, ORPCErrorConstructorMapItemOptions as s, ProcedureClientInterceptorOptions as t, ProcedureDefinition as u, ProcedureHandlerOptions as v };
+export { Procedure as a, Lazy as h, createProcedureClient as u, unlazy as v };
+export type { AnyProcedure as A, Context as C, Lazyable as L, MergedContext as M, OrderedMiddleware as O, ProcedureClientOptions as P, ProcedureClient as b, ProcedureClientInterceptor as c, Middleware as d, MergedInitialContext as e, ProcedureConfig as f, AnyMiddleware as g, ProcedureHandler as i, LazyDefinition as j, MiddlewareDefinition as k, MiddlewareDone as l, MiddlewareDoneOptions as m, MiddlewareNext as n, MiddlewareNextOptions as o, MiddlewareOptions as p, MiddlewareResult as q, ProcedureClientInterceptorOptions as r, ProcedureDefinition as s, ProcedureHandlerOptions as t };

package/dist/shared/server.D0Ipbmdv.d.mts

@@ -0,0 +1,34 @@
+import { C as Context } from './server.CwrYlF72.mjs';
+import { S as StandardHandlerPlugin, a as StandardHandlerOptions } from './server.JbCIPL4P.mjs';
+
+interface RequestLimitHandlerPluginOptions {
+    /**
+     * The maximum allowed request body size in bytes.
+     */
+    maxBodySize: number;
+}
+/**
+ * Rejects requests whose body exceeds `maxBodySize`.
+ *
+ * When used with the request compression plugin, the limit applies to the
+ * decompressed payload rather than the compressed wire size.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-limit | Request Limit Plugin}
+ */
+declare class RequestLimitHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should limit the original batch request body instead of sub-requests.
+     */
+    after: string[];
+    /**
+     * Should limit the final body size instead of the compressed one.
+     */
+    before: string[];
+    private readonly maxBodySize;
+    constructor(options: RequestLimitHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { RequestLimitHandlerPlugin as R };
+export type { RequestLimitHandlerPluginOptions as a };