@orpc/server 2.0.0-beta.30 → 2.0.0-beta.31

package/dist/adapters/aws-lambda/index.mjs

@@ -1,7 +1,7 @@
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/aws-lambda';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/adapters/crossws/index.mjs

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/adapters/fastify/index.mjs

@@ -1,7 +1,7 @@
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/fastify';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/adapters/fetch/index.mjs

@@ -2,7 +2,7 @@ export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, toFetchResponse } from '@standardserver/fetch';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/adapters/message-port/index.mjs

@@ -2,7 +2,7 @@ import { onMessagePortMessage, onMessagePortClose, postMessagePortMessage } from
 import { value, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage, isPeerMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/adapters/node/index.mjs

@@ -2,7 +2,7 @@ export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/node';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '@standardserver/fetch';

package/dist/adapters/standard/index.mjs

@@ -1,4 +1,4 @@
-export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 export { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@orpc/shared';

package/dist/adapters/websocket/index.mjs

@@ -1,7 +1,7 @@
 import { toStringOrBytes, resolveMaybeOptionalOptions, sequential, loadBytes } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DpUGXBi2.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.CkButhNT.mjs';

package/dist/index.d.mts

@@ -314,7 +314,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
      * Overrides the procedure configuration, such as disabling runtime
      * input/output validation.
      *
-     * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+     * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
      */
     $config(config: ProcedureConfig): Builder<TInitialContext, TErrorMap>;
     /**

package/dist/index.d.ts

@@ -314,7 +314,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
      * Overrides the procedure configuration, such as disabling runtime
      * input/output validation.
      *
-     * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+     * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
      */
     $config(config: ProcedureConfig): Builder<TInitialContext, TErrorMap>;
     /**

package/dist/index.mjs

@@ -119,7 +119,7 @@ class Builder {
    * Overrides the procedure configuration, such as disabling runtime
    * input/output validation.
    *
-   * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+   * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
    */
   $config(config) {
     return new Builder({

package/dist/plugins/index.d.mts

@@ -24,7 +24,8 @@ interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * Map each subrequest in the batch before it is processed.
      *
-     * @default merges the batch request headers into the subrequest and remove `orpc-batch` header to prevent nested batching
+     * @default merges the batch request headers into the subrequest, giving them priority over
+     * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
      */
     mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
     /**
@@ -92,18 +93,16 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
 interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
-     * @default (origin) => origin
+     * @default '*'
      */
-    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default undefined
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      */
-    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
@@ -113,26 +112,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     *
-     * @default undefined
      */
     allowHeaders?: readonly string[];
     /**
      * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     *
-     * @default undefined
      */
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * @default undefined
      */
     credentials?: boolean;
     /**
      * Configures the `Access-Control-Expose-Headers` header.
-     *
-     * @default undefined
      */
     exposeHeaders?: readonly string[];
 }

package/dist/plugins/index.d.ts

@@ -24,7 +24,8 @@ interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * Map each subrequest in the batch before it is processed.
      *
-     * @default merges the batch request headers into the subrequest and remove `orpc-batch` header to prevent nested batching
+     * @default merges the batch request headers into the subrequest, giving them priority over
+     * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
      */
     mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
     /**
@@ -92,18 +93,16 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
 interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
-     * @default (origin) => origin
+     * @default '*'
      */
-    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default undefined
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      */
-    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
@@ -113,26 +112,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     *
-     * @default undefined
      */
     allowHeaders?: readonly string[];
     /**
      * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     *
-     * @default undefined
      */
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * @default undefined
      */
     credentials?: boolean;
     /**
      * Configures the `Access-Control-Expose-Headers` header.
-     *
-     * @default undefined
      */
     exposeHeaders?: readonly string[];
 }

package/dist/plugins/index.mjs

@@ -24,8 +24,13 @@ class BatchHandlerPlugin {
     this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
       ...subRequest,
       headers: {
-        ...batchRequest.headers,
         ...subRequest.headers,
+        /**
+         * The batch request headers win over the subrequest ones. They are the only ones the
+         * transport actually saw, so headers the browser injects on its own, such as `cookie`
+         * or `origin`, cannot be overridden by a subrequest, which is just request payload.
+         */
+        ...batchRequest.headers,
         "orpc-batch": void 0
         // useful in case batch plugin is used multiple times
       }
@@ -215,7 +220,7 @@ class CORSHandlerPlugin {
   after = ["~opentelemetry", "~batch"];
   constructor(options = {}) {
     const defaults = {
-      origin: (origin) => origin,
+      origin: "*",
       allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"]
     };
     this.options = {
@@ -231,7 +236,7 @@ class CORSHandlerPlugin {
       }
       const resHeaders = { ...result.response.headers };
       const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
-      const allowedOrigins = toArray(value(this.options.origin, origin, interceptorOptions));
+      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
       if (allowedOrigins.includes("*")) {
         resHeaders["access-control-allow-origin"] = "*";
       } else {
@@ -243,7 +248,7 @@ class CORSHandlerPlugin {
           resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
         }
       }
-      const allowedTimingOrigins = toArray(value(this.options.timingOrigin, origin, interceptorOptions));
+      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
       if (allowedTimingOrigins.includes("*")) {
         resHeaders["timing-allow-origin"] = "*";
       } else if (origin !== void 0 && allowedTimingOrigins.includes(origin)) {

package/dist/shared/{server.D9VprDph.mjs → server.DpUGXBi2.mjs}

@@ -1,5 +1,5 @@
 import { ORPCError, toORPCError, RPCSerializer, COMMON_ERROR_STATUS_MAP } from '@orpc/client';
-import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON } from '@orpc/shared';
+import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON, getOwn } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl } from '@standardserver/core';
 import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.CkButhNT.mjs';
 import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.Dh77P3ii.mjs';
@@ -292,7 +292,7 @@ class RPCHandlerCodec {
     };
   }
   encodeError(error, _procedure, _path, _options) {
-    const status = this.errorStatusMap[error.code] ?? DEFAULT_ERROR_STATUS;
+    const status = getOwn(this.errorStatusMap, error.code) ?? DEFAULT_ERROR_STATUS;
     return {
       headers: {},
       status,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.30",
+  "version": "2.0.0-beta.31",
   "description": "Build typesafe APIs with oRPC: RPC and OpenAPI support, middleware, and adapters for Node.js, Bun, Deno, Fetch, Fastify, WebSocket, AWS Lambda, and more",
   "license": "MIT",
   "funding": [
@@ -124,9 +124,9 @@
     "@standardserver/node": "^0.8.0",
     "@standardserver/peer": "^0.8.0",
     "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.30",
-    "@orpc/shared": "2.0.0-beta.30",
-    "@orpc/contract": "2.0.0-beta.30"
+    "@orpc/contract": "2.0.0-beta.31",
+    "@orpc/client": "2.0.0-beta.31",
+    "@orpc/shared": "2.0.0-beta.31"
   },
   "devDependencies": {
     "crossws": "^0.4.6",