@orpc/server 2.0.0-beta.3 → 2.0.0-beta.30

package/dist/index.mjs

@@ -1,12 +1,12 @@
 import { mergeErrorMap, resolveMetaPlugins, getHiddenMetaPlugins, ProcedureContract } from '@orpc/contract';
-export { ValidationError, defineMeta, eventIterator, reconcileORPCError, type } from '@orpc/contract';
-import { toArray, bindMethods, getOrBind, isTypescriptObject, resolveMaybeOptionalOptions } from '@orpc/shared';
-export { AsyncIteratorClass, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onError, onFinish, onStart, onSuccess, streamToAsyncIteratorClass as streamToEventIterator } from '@orpc/shared';
-import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.CrlKQucM.mjs';
-export { a as createORPCErrorConstructorMap, u as unlazy } from './shared/server.CrlKQucM.mjs';
-import { D as DecoratedProcedure } from './shared/server.CjOb6ItT.mjs';
-import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.BwHnWUuN.mjs';
-export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.BwHnWUuN.mjs';
+export { ValidationError, asyncIteratorObject, defineMeta, error, eventIterator, reconcileORPCError, type } from '@orpc/contract';
+import { toArray, bindMethods, isTypescriptObject, resolveMaybeOptionalOptions } from '@orpc/shared';
+export { AsyncIteratorClass, asyncIteratorToStream, asyncIteratorToUnproxiedDataStream, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onAsyncIteratorObjectError, onError, onFinish, onReadableStreamError, onStart, onSuccess, streamToAsyncIteratorObject, streamToAsyncIteratorObject as streamToEventIterator } from '@orpc/shared';
+import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.CkButhNT.mjs';
+export { u as unlazy } from './shared/server.CkButhNT.mjs';
+import { D as DecoratedProcedure } from './shared/server.eCTV8Vpp.mjs';
+import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.Dh77P3ii.mjs';
+export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.Dh77P3ii.mjs';
 import { RECURSIVE_CLIENT_UNWRAP_KEYS } from '@orpc/client';
 export { COMMON_ERROR_STATUS_MAP, ORPCError, RPCJsonSerializer, RPCSerializer, cloneORPCError, isDefinedError, isInferableError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
@@ -86,9 +86,19 @@ function decorateMiddleware(middleware) {
 
 class Builder {
   "~orpc";
+  /**
+   * Private constructor to prevent direct instantiation.
+   * Use the static `create` method to initialize a new instance with a safe initial definition.
+   */
   constructor(definition) {
     this["~orpc"] = definition;
   }
+  /**
+   * Creates a fresh builder with an empty definition.
+   * Prefer the exported `os` instance over calling this directly.
+   *
+   * @see {@link https://orpc.dev/docs/procedure | Procedure}
+   */
   static create() {
     return new Builder({
       errorMap: {},
@@ -96,9 +106,32 @@ class Builder {
       orderedMiddlewares: []
     });
   }
+  /**
+   * Declares the initial context type that must be provided when executing
+   * procedures built from this builder.
+   *
+   * @see {@link https://orpc.dev/docs/context#initial-context | Context - Initial Context}
+   */
   $context() {
     return this;
   }
+  /**
+   * Overrides the procedure configuration, such as disabling runtime
+   * input/output validation.
+   *
+   * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+   */
+  $config(config) {
+    return new Builder({
+      ...this["~orpc"],
+      ...config
+    });
+  }
+  /**
+   * Applies metadata plugins to procedures built from this builder.
+   *
+   * @see {@link https://orpc.dev/docs/metadata | Metadata}
+   */
   meta(...plugins) {
     const [meta, metaPlugins] = resolveMetaPlugins(
       this["~orpc"].meta,
@@ -111,6 +144,12 @@ class Builder {
       metaPlugins
     });
   }
+  /**
+   * Defines typesafe errors that procedures built from this builder can throw
+   * via the `errors` utility in handlers and middleware.
+   *
+   * @see {@link https://orpc.dev/docs/error-handling#typesafe-errors | Error Handling - Typesafe Errors}
+   */
   errors(errors) {
     let builder = new Builder({
       ...this["~orpc"],
@@ -122,6 +161,12 @@ class Builder {
     }
     return builder;
   }
+  /**
+   * Applies a middleware that runs before the handler of every procedure
+   * built from this builder.
+   *
+   * @see {@link https://orpc.dev/docs/middleware | Middleware}
+   */
   use(middleware) {
     let builder = new Builder({
       ...this["~orpc"],
@@ -137,6 +182,12 @@ class Builder {
     }
     return builder;
   }
+  /**
+   * Creates a standalone middleware that can be composed and applied to any
+   * compatible builder or procedure with `.use`.
+   *
+   * @see {@link https://orpc.dev/docs/middleware | Middleware}
+   */
   middleware(middleware) {
     const allMiddlewares = [
       ...this["~orpc"].orderedMiddlewares.map(({ middleware: middleware2 }) => middleware2),
@@ -156,6 +207,11 @@ class Builder {
     };
     return current;
   }
+  /**
+   * Defines the input schema used to validate and type the procedure input.
+   *
+   * @see {@link https://orpc.dev/docs/procedure#inputoutput-validation | Procedure - Input/Output Validation}
+   */
   input(schema) {
     let builder = new Builder({
       ...this["~orpc"],
@@ -167,6 +223,11 @@ class Builder {
     }
     return builder;
   }
+  /**
+   * Defines the output schema used to validate and type the procedure output.
+   *
+   * @see {@link https://orpc.dev/docs/procedure#inputoutput-validation | Procedure - Input/Output Validation}
+   */
   output(schema) {
     let builder = new Builder({
       ...this["~orpc"],
@@ -178,6 +239,12 @@ class Builder {
     }
     return builder;
   }
+  /**
+   * Defines the function that implements the procedure and completes the
+   * chain, returning a callable procedure.
+   *
+   * @see {@link https://orpc.dev/docs/procedure | Procedure}
+   */
   handler(handler) {
     let procedure = new DecoratedProcedure({
       ...this["~orpc"],
@@ -189,14 +256,24 @@ class Builder {
     }
     return procedure;
   }
+  /**
+   * Applies the builder's middleware, errors, and metadata to every procedure
+   * in the given router.
+   *
+   * @see {@link https://orpc.dev/docs/router#extending-router | Router - Extending Router}
+   */
   router(router) {
     return augmentRouter(router, {
-      middlewares: this["~orpc"].orderedMiddlewares.map(({ middleware }) => middleware),
-      meta: this["~orpc"].meta,
-      metaPlugins: this["~orpc"].metaPlugins,
-      errorMap: this["~orpc"].errorMap
+      ...this["~orpc"],
+      middlewares: this["~orpc"].orderedMiddlewares.map(({ middleware }) => middleware)
     });
   }
+  /**
+   * Like `.router`, but loads the router lazily on first access, which helps
+   * reduce startup time for large applications.
+   *
+   * @see {@link https://orpc.dev/docs/router#lazy-router | Router - Lazy Router}
+   */
   lazy(loader) {
     return new Lazy({
       loader: async () => {
@@ -256,15 +333,20 @@ class ImplementedProcedure extends Procedure {
 }
 
 class SharedRouterImplementer {
-  constructor(contract, middlewares) {
+  constructor(contract, config, middlewares) {
     this.contract = contract;
+    this.config = config;
     this.middlewares = middlewares;
   }
-  static create(contract, middlewares = []) {
-    return new SharedRouterImplementer(contract, middlewares);
+  static create(contract, config, middlewares = []) {
+    return new SharedRouterImplementer(
+      contract,
+      config,
+      middlewares
+    );
   }
   use(middleware) {
-    return createRouterImplementerInternal(this.contract, [...this.middlewares, middleware]);
+    return createRouterImplementerInternal(this.contract, this.config, [...this.middlewares, middleware]);
   }
   middleware(middleware) {
     const allMiddlewares = [
@@ -280,6 +362,7 @@ class SharedRouterImplementer {
   router(router) {
     if (this.middlewares.length) {
       router = augmentImplementedRouter(router, {
+        ...this.config,
         middlewares: this.middlewares
       });
     }
@@ -292,6 +375,7 @@ class SharedRouterImplementer {
         const { default: router } = await originalLoader();
         return {
           default: augmentImplementedRouter(router, {
+            ...this.config,
             middlewares: this.middlewares
           })
         };
@@ -300,12 +384,13 @@ class SharedRouterImplementer {
     return new Lazy({ loader, meta: {} });
   }
 }
-function createRouterImplementer(contract) {
-  return createRouterImplementerInternal(contract, []);
+function createRouterImplementer(contract, config) {
+  return createRouterImplementerInternal(contract, config, []);
 }
-function createRouterImplementerInternal(contract, middlewares) {
+function createRouterImplementerInternal(contract, config, middlewares) {
   if (contract instanceof ProcedureContract) {
     return new ProcedureImplementer({
+      ...config,
       ...contract["~orpc"],
       orderedMiddlewares: middlewares.map((middleware) => ({ middleware }))
     });
@@ -313,16 +398,16 @@ function createRouterImplementerInternal(contract, middlewares) {
   const implementer = {};
   for (const key in contract) {
     const child = contract[key];
-    implementer[key] = createRouterImplementerInternal(child, middlewares);
+    implementer[key] = createRouterImplementerInternal(child, config, middlewares);
   }
-  const shared = bindMethods(SharedRouterImplementer.create(contract, middlewares));
+  const shared = bindMethods(SharedRouterImplementer.create(contract, config, middlewares));
   for (const key in shared) {
     const method = shared[key];
     if (key in implementer) {
       const child = implementer[key];
       implementer[key] = new Proxy(method, {
         get(_, p) {
-          return getOrBind(child, p);
+          return Reflect.get(child, p);
         }
       });
     } else {
@@ -332,22 +417,24 @@ function createRouterImplementerInternal(contract, middlewares) {
   return implementer;
 }
 
-function implement(contract) {
-  const routerImplementer = createRouterImplementer(contract);
+function implement(contract, config = {}) {
+  const routerImplementer = createRouterImplementer(contract, config);
   const implementer = new Proxy(routerImplementer, {
     get(_, p) {
       let method;
       if (p === "$context") {
         method = () => implementer;
+      } else if (p === "$config") {
+        method = (incoming) => implement(contract, { ...config, ...incoming });
       }
-      const value = getOrBind(routerImplementer, p);
+      const value = Reflect.get(routerImplementer, p);
       if (method) {
         if (!isTypescriptObject(value)) {
           return method;
         }
         return new Proxy(method, {
           get(_2, p2) {
-            return getOrBind(value, p2);
+            return Reflect.get(value, p2);
           }
         });
       }
@@ -363,19 +450,24 @@ function createRouterClient(router, ...rest) {
     return createProcedureClient(router, options);
   }
   const procedureCaller = router instanceof Lazy ? createProcedureClient(createGuardedProcedureLazy(router), options) : {};
+  const cache = /* @__PURE__ */ new Map();
   const recursive = new Proxy(procedureCaller, {
     get(target, key) {
       if (typeof key !== "string" || router instanceof Lazy && RECURSIVE_CLIENT_UNWRAP_KEYS.has(key)) {
-        return getOrBind(target, key);
+        return Reflect.get(target, key);
       }
-      const next = getRouter(router, [key]);
-      if (!next) {
-        return getOrBind(target, key);
+      let nextClient = cache.get(key);
+      if (nextClient === void 0) {
+        const next = getRouter(router, [key]);
+        if (!next) {
+          return Reflect.get(target, key);
+        }
+        nextClient = createRouterClient(next, {
+          ...options,
+          path: [...toArray(options.path), key]
+        });
+        cache.set(key, nextClient);
       }
-      const nextClient = createRouterClient(next, {
-        ...options,
-        path: [...toArray(options.path), key]
-      });
       return nextClient;
     }
   });

package/dist/plugins/index.d.mts

@@ -1,10 +1,19 @@
-import { Value, Promisable } from '@orpc/shared';
-import { StandardLazyRequest, StandardHeaders } from '@standardserver/core';
-import { C as Context } from '../shared/server.BL22TloH.mjs';
-import { e as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions } from '../shared/server.BB_Ik9Ph.mjs';
+import { Value, Promisable, ThrowableError } from '@orpc/shared';
+import { StandardLazyRequest, StandardHeaders, StandardMethod } from '@standardserver/core';
+import { Context } from '../index.mjs';
+import { StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions, StandardHandlerOptions, StandardHandlerInterceptorOptions } from '../adapters/standard/index.mjs';
+export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.D0Ipbmdv.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 
+/**
+ * Content type for batch responses that use the length-prefixed binary framing
+ * (streaming mode, and buffered mode when any sub-response contains binary).
+ *
+ * Decoding is driven by the `standard-server` body hint, not this header,
+ * so it only serves to describe the payload to logs, proxies, and dev tools.
+ */
+declare const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * The max size of the batch allowed.
@@ -30,7 +39,39 @@ interface BatchHandlerPluginOptions<T extends Context> {
      * @default {}
      */
     headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]>;
+    /**
+     * Keep-alive settings for streaming batch responses.
+     *
+     * When enabled, a zero-length length-prefixed frame is sent periodically while the
+     * stream is idle (no message sent for `interval` ms). Clients ignore these frames.
+     * Only applies to streaming mode.
+     *
+     * @default { enabled: true, interval: 15000 }
+     */
+    keepAlive?: undefined | {
+        /**
+         * If true, a keep-alive frame is sent periodically while the stream is idle.
+         *
+         * @default true
+         */
+        enabled: boolean;
+        /**
+         * Interval (in milliseconds) between keep-alive frames after the last message.
+         *
+         * @default 15000
+         */
+        interval?: number;
+    };
 }
+/**
+ * Handles batch requests sent by the client Batch Link Plugin, splitting each
+ * batch into sub-requests and streaming their responses back together.
+ *
+ * @remarks
+ * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+ */
 declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
     /**
@@ -42,6 +83,8 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
     private readonly mapSubrequest;
     private readonly successStatus;
     private readonly headers;
+    private readonly keepAliveEnabled;
+    private readonly keepAliveInterval;
     constructor(options?: BatchHandlerPluginOptions<T>);
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
@@ -53,18 +96,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
      *
      * @default (origin) => origin
      */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
      *
      * @default undefined
      */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
      */
     allowMethods?: readonly string[];
     /**
@@ -94,9 +137,10 @@ interface CORSHandlerPluginOptions<T extends Context> {
     exposeHeaders?: readonly string[];
 }
 /**
- * CORSHandlerPlugin is a plugin for oRPC that allows you to configure CORS for your API.
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
  *
- * @see {@link https://orpc.dev/docs/plugins/cors CORS Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
  */
 declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     private readonly options;
@@ -112,17 +156,83 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
 }
 
 /**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /** Judge the real request, before batch splits it into client-authored sub-requests. */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}
+
+interface MethodOverrideHandlerPluginOptions {
+    /**
+     * The query parameter carrying the override method.
+     *
+     * @default 'method'
+     */
+    param?: string;
+    /**
+     * The methods a POST request may be overridden to.
+     *
+     * GET and HEAD are excluded by default because they switch input decoding
+     * from the request body to the query string and widen the CSRF surface.
+     *
+     * @default ['PUT', 'PATCH', 'DELETE']
+     */
+    methods?: readonly StandardMethod[];
+}
+/**
+ * Overrides the HTTP method of a POST request based on a query parameter,
+ * so HTML forms (which only support GET and POST) can invoke procedures
+ * routed as PUT, PATCH, or DELETE.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+ */
+declare class MethodOverrideHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should override batch sub-request methods, not the original batch request.
+     */
+    before: string[];
+    private readonly param;
+    private readonly methods;
+    constructor(options?: MethodOverrideHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+/**
+ * Decompresses incoming request bodies based on the Content-Encoding header,
+ * supporting gzip, deflate, and deflate-raw.
  *
- * @info This plugin is enabled by default for `RPCHandler` over HTTP.
+ * @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
  */
-declare class CSRFGuardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+declare class RequestCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
+    /**
+     * Should decompress the original batch request body instead of sub-requests.
+     */
+    after: string[];
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * The context shape into which the Request Headers Plugin injects `reqHeaders`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
+ */
 interface RequestHeadersHandlerPluginContext {
     /**
      * Request headers as a Headers instance. This is injected by the Request Headers Plugin.
@@ -133,13 +243,55 @@ interface RequestHeadersHandlerPluginContext {
  * The Request Headers Plugin injects a `reqHeaders` instance into the context,
  * allowing access to request headers in oRPC.
  *
- * @see {@link https://orpc.dev/docs/plugins/request-headers Request Headers Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
  */
 declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
     name: string;
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
+    /**
+     * The compression schemes to use for response compression.
+     * Schemes are prioritized by their order in this array and
+     * only applied if the client supports them (via Accept-Encoding).
+     *
+     * @default ['gzip', 'deflate']
+     */
+    encodings?: readonly ('gzip' | 'deflate' | 'deflate-raw')[];
+    /**
+     * The minimum response size in bytes required to trigger compression.
+     * Responses smaller than this threshold will not be compressed to avoid overhead.
+     * If the response size cannot be determined, compression will still be applied.
+     *
+     * @default 1024 (1KB)
+     */
+    threshold?: number;
+}
+/**
+ * Compresses response bodies based on the client's Accept-Encoding header.
+ * Works at the standard handler level, so it supports all adapters.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/response-compression | Response Compression Plugin}
+ */
+declare class ResponseCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Compression should be done after batching, to compress the final response.
+     * Compression should also be done after response headers are set, to access final headers like Content-Type and Cache-Control.
+     */
+    after: string[];
+    private readonly encodings;
+    private readonly threshold;
+    constructor(options?: ResponseCompressionHandlerPluginOptions<T>);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+/**
+ * The context shape into which the Response Headers Plugin injects `resHeaders`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/response-headers | Response Headers Plugin}
+ */
 interface ResponseHeadersHandlerPluginContext {
     /**
      * Response headers as a Headers instance. This is injected by the Response Headers Plugin.
@@ -151,7 +303,7 @@ interface ResponseHeadersHandlerPluginContext {
  * The Response Headers Plugin allows you to set response headers in oRPC.
  * It injects a resHeaders instance into the context, enabling you to modify response headers easily.
  *
- * @see {@link https://orpc.dev/docs/plugins/response-headers Response Headers Plugin Docs}
+ * @see {@link https://orpc.dev/docs/plugins/response-headers | Response Headers Plugin}
  */
 declare class ResponseHeadersHandlerPlugin<T extends ResponseHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
     name: string;
@@ -162,5 +314,71 @@ declare class ResponseHeadersHandlerPlugin<T extends ResponseHeadersHandlerPlugi
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BatchHandlerPlugin, CORSHandlerPlugin, CSRFGuardHandlerPlugin, RequestHeadersHandlerPlugin, ResponseHeadersHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext };
+interface RethrowHandlerPluginOptions<T extends Context> {
+    /**
+     * Decide which errors should be rethrown.
+     *
+     * @example
+     * ```ts
+     * const rethrowPlugin = new RethrowHandlerPlugin({
+     *   filter: (error) => {
+     *     // Rethrow all non-ORPCError errors
+     *     return !(error instanceof ORPCError)
+     *   }
+     * })
+     * ```
+     */
+    filter: (error: ThrowableError, options: StandardHandlerInterceptorOptions<T>) => boolean;
+}
+/**
+ * The plugin can bypass oRPC's built-in error handling
+ * and rethrow matching errors directly to your framework's error handling mechanism
+ * (e.g., NestJS exception filters, Express error middleware).
+ *
+ * @see {@link https://orpc.dev/docs/plugins/rethrow | Rethrow Handler Plugin}
+ */
+declare class RethrowHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    private readonly filter;
+    private readonly CONTEXT_SYMBOL;
+    constructor(options: RethrowHandlerPluginOptions<T>);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+interface TimeoutHandlerPluginOptions<T extends Context> {
+    /**
+     * Timeout in milliseconds before the request signal is aborted.
+     * This only covers producing the response, use `streamingTimeout`
+     * to limit streaming response bodies.
+     * Use `null` or `undefined` to disable the timeout.
+     */
+    timeout: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+    /**
+     * Timeout in milliseconds for the full duration of a streaming response body
+     * (async iterator object or readable stream), measured from when the response is produced.
+     * When exceeded, the request signal is aborted and the body ends
+     * once its producer honors the signal.
+     * Usually higher than `timeout`.
+     * Use `null` or `undefined` to disable the timeout.
+     *
+     * @default undefined (streaming responses run without limit)
+     */
+    streamingTimeout?: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+}
+/**
+ * The Timeout Handler Plugin aborts the request signal with an `AbortError`
+ * when handling exceeds a configured timeout. It only aborts the signal,
+ * the procedure must honor it to stop early and produce the response.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/timeout | Timeout Plugin}
+ */
+declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    private readonly timeout;
+    private readonly streamingTimeout;
+    name: string;
+    constructor(options: NoInfer<TimeoutHandlerPluginOptions<T>>);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };