@orpc/server 2.0.0-beta.30 → 2.0.0-beta.32

package/README.md

@@ -4,7 +4,7 @@
   <a href="https://codecov.io/gh/middleapi/orpc">
     <img alt="codecov" src="https://codecov.io/gh/middleapi/orpc/branch/main/graph/badge.svg">
   </a>
-  <a href="https://npmx.dev/package/@orpc/server">
+  <a href="https://www.npmjs.com/package/@orpc/server">
     <img alt="weekly downloads" src="https://img.shields.io/npm/dw/%40orpc%2Fserver?logo=npm" />
   </a>
   <a href="https://app.codspeed.io/middleapi/orpc?utm_source=badge">
@@ -29,44 +29,44 @@ You can read the documentation [here](https://orpc.dev).
 
 **Core**
 
-- [@orpc/contract](https://npmx.dev/package/@orpc/contract): Define API contract as the single source of truth.
-- [@orpc/server](https://npmx.dev/package/@orpc/server): Build APIs or implement contracts.
-- [@orpc/client](https://npmx.dev/package/@orpc/client): Consume APIs with end-to-end type safety.
-- [@orpc/openapi](https://npmx.dev/package/@orpc/openapi): Add OpenAPI compatibility to APIs.
+- [@orpc/contract](https://www.npmjs.com/package/@orpc/contract): Define API contract as the single source of truth.
+- [@orpc/server](https://www.npmjs.com/package/@orpc/server): Build APIs or implement contracts.
+- [@orpc/client](https://www.npmjs.com/package/@orpc/client): Consume APIs with end-to-end type safety.
+- [@orpc/openapi](https://www.npmjs.com/package/@orpc/openapi): Add OpenAPI compatibility to APIs.
 
 **Schema validation**
 
-- [@orpc/zod](https://npmx.dev/package/@orpc/zod): Integrate with [Zod](https://zod.dev/).
-- [@orpc/valibot](https://npmx.dev/package/@orpc/valibot): Integrate with [Valibot](https://valibot.dev/).
-- [@orpc/arktype](https://npmx.dev/package/@orpc/arktype): Integrate with [ArkType](https://arktype.io/).
+- [@orpc/zod](https://www.npmjs.com/package/@orpc/zod): Integrate with [Zod](https://zod.dev/).
+- [@orpc/valibot](https://www.npmjs.com/package/@orpc/valibot): Integrate with [Valibot](https://valibot.dev/).
+- [@orpc/arktype](https://www.npmjs.com/package/@orpc/arktype): Integrate with [ArkType](https://arktype.io/).
 
 **Built-in features**
 
-- [@orpc/publisher](https://npmx.dev/package/@orpc/publisher): Pub/Sub with memory, Redis, and Upstash adapters.
-- [@orpc/ratelimit](https://npmx.dev/package/@orpc/ratelimit): Rate limiting with memory, Redis, and Upstash adapters.
-- [@orpc/hibernation](https://npmx.dev/package/@orpc/hibernation): Leverage Hibernation APIs like [Cloudflare's Hibernation WebSocket](https://developers.cloudflare.com/durable-objects/best-practices/websockets/#durable-objects-hibernation-websocket-api).
-- [@orpc/json-schema](https://npmx.dev/package/@orpc/json-schema): Smart coercion for OpenAPI requests.
+- [@orpc/publisher](https://www.npmjs.com/package/@orpc/publisher): Pub/Sub with memory, Redis, and Upstash adapters.
+- [@orpc/ratelimit](https://www.npmjs.com/package/@orpc/ratelimit): Rate limiting with memory, Redis, and Upstash adapters.
+- [@orpc/hibernation](https://www.npmjs.com/package/@orpc/hibernation): Leverage Hibernation APIs like [Cloudflare's Hibernation WebSocket](https://developers.cloudflare.com/durable-objects/best-practices/websockets/#durable-objects-hibernation-websocket-api).
+- [@orpc/json-schema](https://www.npmjs.com/package/@orpc/json-schema): Smart coercion for OpenAPI requests.
 
 **Framework & ecosystem integrations**
 
-- [@orpc/next](https://npmx.dev/package/@orpc/next): Integrate with [Next.js Server Functions](https://nextjs.org/docs/app/getting-started/mutating-data).
-- [@orpc/ai-sdk](https://npmx.dev/package/@orpc/ai-sdk): Turn contracts and procedures into [AI SDK](https://ai-sdk.dev/) tools.
-- [@orpc/tanstack-query](https://npmx.dev/package/@orpc/tanstack-query): Integrate with [TanStack Query](https://tanstack.com/query/latest).
-- [@orpc/pinia-colada](https://npmx.dev/package/@orpc/pinia-colada): Integrate with [Pinia Colada](https://pinia-colada.esm.dev/).
-- [@orpc/swr](https://npmx.dev/package/@orpc/swr): Integrate with [SWR](https://swr.vercel.app/).
-- [@orpc/experimental-msw](https://npmx.dev/package/@orpc/experimental-msw): Mock procedures with [Mock Service Worker](https://mswjs.io/).
-- [@orpc/experimental-effect](https://npmx.dev/package/@orpc/experimental-effect): Integrate with [Effect](https://effect.website/).
-- [@orpc/nest](https://npmx.dev/package/@orpc/nest): Implement your contract with [NestJS](https://nestjs.com/).
-- [@orpc/node](https://npmx.dev/package/@orpc/node): [Node.js](https://nodejs.org/) plugins for static file serving and large uploads.
-- [@orpc/bun](https://npmx.dev/package/@orpc/bun): Adapters for [Bun's Redis](https://bun.sh/).
-- [@orpc/cloudflare](https://npmx.dev/package/@orpc/cloudflare): Adapters for [Cloudflare's RateLimit and Durable Objects](https://developers.cloudflare.com/workers/).
-- [@orpc/trpc](https://npmx.dev/package/@orpc/trpc): Reuse existing [tRPC](https://trpc.io/) routers within oRPC.
+- [@orpc/next](https://www.npmjs.com/package/@orpc/next): Integrate with [Next.js Server Functions](https://nextjs.org/docs/app/getting-started/mutating-data).
+- [@orpc/ai-sdk](https://www.npmjs.com/package/@orpc/ai-sdk): Turn contracts and procedures into [AI SDK](https://ai-sdk.dev/) tools.
+- [@orpc/tanstack-query](https://www.npmjs.com/package/@orpc/tanstack-query): Integrate with [TanStack Query](https://tanstack.com/query/latest).
+- [@orpc/pinia-colada](https://www.npmjs.com/package/@orpc/pinia-colada): Integrate with [Pinia Colada](https://pinia-colada.esm.dev/).
+- [@orpc/swr](https://www.npmjs.com/package/@orpc/swr): Integrate with [SWR](https://swr.vercel.app/).
+- [@orpc/experimental-msw](https://www.npmjs.com/package/@orpc/experimental-msw): Mock procedures with [Mock Service Worker](https://mswjs.io/).
+- [@orpc/experimental-effect](https://www.npmjs.com/package/@orpc/experimental-effect): Integrate with [Effect](https://effect.website/).
+- [@orpc/nest](https://www.npmjs.com/package/@orpc/nest): Implement your contract with [NestJS](https://nestjs.com/).
+- [@orpc/node](https://www.npmjs.com/package/@orpc/node): [Node.js](https://nodejs.org/) plugins for static file serving and large uploads.
+- [@orpc/bun](https://www.npmjs.com/package/@orpc/bun): Adapters for [Bun's Redis](https://bun.sh/).
+- [@orpc/cloudflare](https://www.npmjs.com/package/@orpc/cloudflare): Adapters for [Cloudflare's RateLimit and Durable Objects](https://developers.cloudflare.com/workers/).
+- [@orpc/trpc](https://www.npmjs.com/package/@orpc/trpc): Reuse existing [tRPC](https://trpc.io/) routers within oRPC.
 
 **Observability**
 
-- [@orpc/opentelemetry](https://npmx.dev/package/@orpc/opentelemetry): Integrate with [OpenTelemetry](https://opentelemetry.io/) for distributed tracing.
-- [@orpc/pino](https://npmx.dev/package/@orpc/pino): Integrate with [Pino](https://getpino.io/) for logging.
-- [@orpc/evlog](https://npmx.dev/package/@orpc/evlog): Integrate with [Evlog](https://evlog.dev/) for logging.
+- [@orpc/opentelemetry](https://www.npmjs.com/package/@orpc/opentelemetry): Integrate with [OpenTelemetry](https://opentelemetry.io/) for distributed tracing.
+- [@orpc/pino](https://www.npmjs.com/package/@orpc/pino): Integrate with [Pino](https://getpino.io/) for logging.
+- [@orpc/evlog](https://www.npmjs.com/package/@orpc/evlog): Integrate with [Evlog](https://evlog.dev/) for logging.
 
 ## Sponsors
 
@@ -113,6 +113,7 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
    <td align="center"><a href="https://github.com/itigoore01?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="shota"><img src="https://avatars.githubusercontent.com/u/11831107?u=c976a6dc7e055eb026304c46c99100ed22b0c8e0&amp;v=4" width="139" alt="shota"/><br />shota</a></td>
    <td align="center"><a href="https://github.com/ellis-driscoll?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Ellis Driscoll"><img src="https://avatars.githubusercontent.com/u/70685966?u=c5f95bc33b5991d9744abe00052542e4a2ed3cb9&amp;v=4" width="139" alt="Ellis Driscoll"/><br />Ellis Driscoll</a></td>
    <td align="center"><a href="https://github.com/hoangbn?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Hoang Nguyen"><img src="https://avatars.githubusercontent.com/u/38968280?u=c90084c6de65c56facabab7ba13a72a49ddbc3e4&amp;v=4" width="139" alt="Hoang Nguyen"/><br />Hoang Nguyen</a></td>
+   <td align="center"><a href="https://opencollective.com/guest-ac41de3b?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Orestis Ioannou"><img src="https://images.opencollective.com/guest-ac41de3b/avatar/460.png" width="139" alt="Orestis Ioannou"/><br />Orestis Ioannou</a></td>
   </tr>
 </table>
 
@@ -135,7 +136,7 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
    <td align="center"><a href="https://rigtch.fm/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Igor Makowski"><img src="https://avatars.githubusercontent.com/u/56691628?u=ee8c879478f7c151b9156aef6c74243fa3e247a8&amp;v=4" width="119" alt="Igor Makowski"/><br />Igor Makowski</a></td>
    <td align="center"><a href="https://blog.cwang.io/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="hanayashiki"><img src="https://avatars.githubusercontent.com/u/26056783?u=06c3b9205a16fd41a871e82da1cc2a09306d53f5&amp;v=4" width="119" alt="hanayashiki"/><br />hanayashiki</a></td>
    <td align="center"><a href="https://dubinets.io/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Lev Dubinets"><img src="https://avatars.githubusercontent.com/u/3114081?u=f547f5d5012cab54851f1b1ad72d10e537f78fc2&amp;v=4" width="119" alt="Lev Dubinets"/><br />Lev Dubinets</a></td>
-   <td align="center"><a href="https://bika.ai/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Kelly Peilin Chan"><img src="https://avatars.githubusercontent.com/u/520852?u=6b0f7105f694e7b5cacf410a3f04c7044b469dc8&amp;v=4" width="119" alt="Kelly Peilin Chan"/><br />Kelly Peilin Chan</a></td>
+   <td align="center"><a href="https://kellychan.im/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Kelly Peilin Chan"><img src="https://avatars.githubusercontent.com/u/520852?u=6b0f7105f694e7b5cacf410a3f04c7044b469dc8&amp;v=4" width="119" alt="Kelly Peilin Chan"/><br />Kelly Peilin Chan</a></td>
   </tr>
   <tr>
    <td align="center"><a href="https://guyariely.com/?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Guy Ariely"><img src="https://avatars.githubusercontent.com/u/42813496?u=edb6b7f563bf28e160a290832e7da57c0506f8ca&amp;v=4" width="119" alt="Guy Ariely"/><br />Guy Ariely</a></td>

package/dist/adapters/aws-lambda/index.mjs

@@ -1,12 +1,12 @@
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/aws-lambda';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class CompositeAwsLambdaHandlerPlugin {
   name = "~composite/aws-lambda";

package/dist/adapters/crossws/index.mjs

@@ -1,12 +1,12 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class experimental_CrosswsHandler {
   constructor(handler, options = {}) {

package/dist/adapters/fastify/index.mjs

@@ -1,12 +1,12 @@
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/fastify';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class CompositeFastifyHandlerPlugin {
   name = "~composite/fastify";

package/dist/adapters/fetch/index.mjs

@@ -2,12 +2,12 @@ export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, toFetchResponse } from '@standardserver/fetch';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class CompositeFetchHandlerPlugin {
   name = "~composite/fetch";

package/dist/adapters/message-port/index.mjs

@@ -2,12 +2,12 @@ import { onMessagePortMessage, onMessagePortClose, postMessagePortMessage } from
 import { value, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage, isPeerMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class MessagePortHandler {
   constructor(handler, options = {}) {

package/dist/adapters/node/index.mjs

@@ -2,13 +2,13 @@ export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
 import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/node';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '@standardserver/fetch';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class CompositeNodeHttpHandlerPlugin {
   name = "~composite/node-http";

package/dist/adapters/standard/index.mjs

@@ -1,8 +1,8 @@
-export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 export { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@orpc/shared';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';

package/dist/adapters/websocket/index.mjs

@@ -1,12 +1,12 @@
 import { toStringOrBytes, resolveMaybeOptionalOptions, sequential, loadBytes } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.7G43pSxo.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.CkButhNT.mjs';
+import '../../shared/server.3Ex_8ISY.mjs';
 import '@orpc/contract';
-import '../../shared/server.Dh77P3ii.mjs';
+import '../../shared/server.S8BnCR3a.mjs';
 
 class WebSocketHandler {
   constructor(handler, options = {}) {

package/dist/extensions/callable.mjs

@@ -1,5 +1,5 @@
-import { c as createProcedureClient } from '../shared/server.CkButhNT.mjs';
-import { D as DecoratedProcedure } from '../shared/server.eCTV8Vpp.mjs';
+import { c as createProcedureClient } from '../shared/server.3Ex_8ISY.mjs';
+import { D as DecoratedProcedure } from '../shared/server.Cqk3swxs.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@orpc/shared';

package/dist/index.d.mts

@@ -314,7 +314,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
      * Overrides the procedure configuration, such as disabling runtime
      * input/output validation.
      *
-     * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+     * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
      */
     $config(config: ProcedureConfig): Builder<TInitialContext, TErrorMap>;
     /**

package/dist/index.d.ts

@@ -314,7 +314,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
      * Overrides the procedure configuration, such as disabling runtime
      * input/output validation.
      *
-     * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+     * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
      */
     $config(config: ProcedureConfig): Builder<TInitialContext, TErrorMap>;
     /**

package/dist/index.mjs

@@ -2,11 +2,11 @@ import { mergeErrorMap, resolveMetaPlugins, getHiddenMetaPlugins, ProcedureContr
 export { ValidationError, asyncIteratorObject, defineMeta, error, eventIterator, reconcileORPCError, type } from '@orpc/contract';
 import { toArray, bindMethods, isTypescriptObject, resolveMaybeOptionalOptions } from '@orpc/shared';
 export { AsyncIteratorClass, asyncIteratorToStream, asyncIteratorToUnproxiedDataStream, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onAsyncIteratorObjectError, onError, onFinish, onReadableStreamError, onStart, onSuccess, streamToAsyncIteratorObject, streamToAsyncIteratorObject as streamToEventIterator } from '@orpc/shared';
-import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.CkButhNT.mjs';
-export { u as unlazy } from './shared/server.CkButhNT.mjs';
-import { D as DecoratedProcedure } from './shared/server.eCTV8Vpp.mjs';
-import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.Dh77P3ii.mjs';
-export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.Dh77P3ii.mjs';
+import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.3Ex_8ISY.mjs';
+export { u as unlazy } from './shared/server.3Ex_8ISY.mjs';
+import { D as DecoratedProcedure } from './shared/server.Cqk3swxs.mjs';
+import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.S8BnCR3a.mjs';
+export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.S8BnCR3a.mjs';
 import { RECURSIVE_CLIENT_UNWRAP_KEYS } from '@orpc/client';
 export { COMMON_ERROR_STATUS_MAP, ORPCError, RPCJsonSerializer, RPCSerializer, cloneORPCError, isDefinedError, isInferableError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
@@ -119,7 +119,7 @@ class Builder {
    * Overrides the procedure configuration, such as disabling runtime
    * input/output validation.
    *
-   * @see {@link https://orpc.dev/docs/advanced/validation-customization | Validation Customization}
+   * @see {@link https://orpc.dev/docs/recipes/validation-customization | Validation Customization}
    */
   $config(config) {
     return new Builder({

package/dist/plugins/index.d.mts

@@ -24,7 +24,8 @@ interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * Map each subrequest in the batch before it is processed.
      *
-     * @default merges the batch request headers into the subrequest and remove `orpc-batch` header to prevent nested batching
+     * @default merges the batch request headers into the subrequest, giving them priority over
+     * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
      */
     mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
     /**
@@ -92,18 +93,16 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
 interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
-     * @default (origin) => origin
+     * @default '*'
      */
-    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default undefined
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      */
-    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
@@ -113,26 +112,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     *
-     * @default undefined
      */
     allowHeaders?: readonly string[];
     /**
      * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     *
-     * @default undefined
      */
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * @default undefined
      */
     credentials?: boolean;
     /**
      * Configures the `Access-Control-Expose-Headers` header.
-     *
-     * @default undefined
      */
     exposeHeaders?: readonly string[];
 }
@@ -160,6 +151,8 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
  * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
  * navigations initiated cross-site or from outside the browser, the only context where
  * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
  *
  * @remarks
  * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
@@ -171,8 +164,6 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
  */
 declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
-    /** Judge the real request, before batch splits it into client-authored sub-requests. */
-    after: string[];
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
     private isAllowed;
 }
@@ -213,6 +204,30 @@ declare class MethodOverrideHandlerPlugin<T extends Context> implements Standard
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Rejects requests whose decoded input contains prototype-polluting keys: an own
+ * `__proto__` key, or an own `constructor` key holding a `prototype` key. oRPC's own
+ * decoding never assigns through the prototype chain, so this plugin exists to stop such
+ * keys from reaching application code that merges, clones, or path-sets input with a
+ * library vulnerable to prototype pollution. An `AsyncIteratorObject` input is checked
+ * value by value as it arrives, and a polluting value fails that iteration instead.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/prototype-pollution-protection | Prototype Pollution Protection Plugin}
+ */
+declare class PrototypePollutionProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private rejectPollutingInput;
+    /**
+     * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
+     * objects, including null-prototype ones. Other objects, such as files and dates, carry
+     * no attacker-authored keys and are left alone. The walk is iterative, so input nested
+     * deeper than the call stack allows still gets the intended verdict instead of a
+     * `RangeError`.
+     */
+    private containsPollutingKey;
+}
+
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -250,7 +265,7 @@ declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginC
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
+interface ResponseCompressionHandlerPluginOptions<T extends Context> {
     /**
      * The compression schemes to use for response compression.
      * Schemes are prioritized by their order in this array and
@@ -267,6 +282,14 @@ interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
      * @default 1024 (1KB)
      */
     threshold?: number;
+    /**
+     * Determines whether a response with the given Content-Type should be compressed.
+     * Only consulted for binary transfers (streams, files, and file form-data parts).
+     * Also receives the routing interceptor options for per-request decisions.
+     *
+     * @default isCompressibleContentType (covers common text-based formats)
+     */
+    isCompressibleContentType?: (contentType: string | null | undefined, options: StandardHandlerRoutingInterceptorOptions<T>) => boolean;
 }
 /**
  * Compresses response bodies based on the client's Accept-Encoding header.
@@ -283,6 +306,7 @@ declare class ResponseCompressionHandlerPlugin<T extends Context> implements Sta
     after: string[];
     private readonly encodings;
     private readonly threshold;
+    private readonly isCompressibleContentType;
     constructor(options?: ResponseCompressionHandlerPluginOptions<T>);
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
@@ -380,5 +404,5 @@ declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };

package/dist/plugins/index.d.ts

@@ -24,7 +24,8 @@ interface BatchHandlerPluginOptions<T extends Context> {
     /**
      * Map each subrequest in the batch before it is processed.
      *
-     * @default merges the batch request headers into the subrequest and remove `orpc-batch` header to prevent nested batching
+     * @default merges the batch request headers into the subrequest, giving them priority over
+     * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
      */
     mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
     /**
@@ -92,18 +93,16 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
 interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
-     * @default (origin) => origin
+     * @default '*'
      */
-    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default undefined
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      */
-    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
@@ -113,26 +112,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     *
-     * @default undefined
      */
     allowHeaders?: readonly string[];
     /**
      * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     *
-     * @default undefined
      */
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * @default undefined
      */
     credentials?: boolean;
     /**
      * Configures the `Access-Control-Expose-Headers` header.
-     *
-     * @default undefined
      */
     exposeHeaders?: readonly string[];
 }
@@ -160,6 +151,8 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
  * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
  * navigations initiated cross-site or from outside the browser, the only context where
  * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
  *
  * @remarks
  * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
@@ -171,8 +164,6 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
  */
 declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
     name: string;
-    /** Judge the real request, before batch splits it into client-authored sub-requests. */
-    after: string[];
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
     private isAllowed;
 }
@@ -213,6 +204,30 @@ declare class MethodOverrideHandlerPlugin<T extends Context> implements Standard
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Rejects requests whose decoded input contains prototype-polluting keys: an own
+ * `__proto__` key, or an own `constructor` key holding a `prototype` key. oRPC's own
+ * decoding never assigns through the prototype chain, so this plugin exists to stop such
+ * keys from reaching application code that merges, clones, or path-sets input with a
+ * library vulnerable to prototype pollution. An `AsyncIteratorObject` input is checked
+ * value by value as it arrives, and a polluting value fails that iteration instead.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/prototype-pollution-protection | Prototype Pollution Protection Plugin}
+ */
+declare class PrototypePollutionProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private rejectPollutingInput;
+    /**
+     * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
+     * objects, including null-prototype ones. Other objects, such as files and dates, carry
+     * no attacker-authored keys and are left alone. The walk is iterative, so input nested
+     * deeper than the call stack allows still gets the intended verdict instead of a
+     * `RangeError`.
+     */
+    private containsPollutingKey;
+}
+
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -250,7 +265,7 @@ declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginC
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
+interface ResponseCompressionHandlerPluginOptions<T extends Context> {
     /**
      * The compression schemes to use for response compression.
      * Schemes are prioritized by their order in this array and
@@ -267,6 +282,14 @@ interface ResponseCompressionHandlerPluginOptions<_T extends Context> {
      * @default 1024 (1KB)
      */
     threshold?: number;
+    /**
+     * Determines whether a response with the given Content-Type should be compressed.
+     * Only consulted for binary transfers (streams, files, and file form-data parts).
+     * Also receives the routing interceptor options for per-request decisions.
+     *
+     * @default isCompressibleContentType (covers common text-based formats)
+     */
+    isCompressibleContentType?: (contentType: string | null | undefined, options: StandardHandlerRoutingInterceptorOptions<T>) => boolean;
 }
 /**
  * Compresses response bodies based on the client's Accept-Encoding header.
@@ -283,6 +306,7 @@ declare class ResponseCompressionHandlerPlugin<T extends Context> implements Sta
     after: string[];
     private readonly encodings;
     private readonly threshold;
+    private readonly isCompressibleContentType;
     constructor(options?: ResponseCompressionHandlerPluginOptions<T>);
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
@@ -380,5 +404,5 @@ declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };

package/dist/plugins/index.mjs

@@ -1,9 +1,9 @@
-import { toArray, value, isNoTransformCacheControl, parseAcceptEncodingQualities, isCompressibleContentType, varyByAcceptEncoding, isAsyncIteratorObject, stringifyJSON, anyAbortSignal, override, wrapAsyncIterator, wrapReadableStream, AbortError } from '@orpc/shared';
+import { toArray, value, isPlainObject, isTypescriptObject, isAsyncIteratorObject, override, wrapAsyncIterator, isCompressibleContentType, isNoTransformCacheControl, parseAcceptEncodingQualities, varyByAcceptEncoding, stringifyJSON, anyAbortSignal, wrapReadableStream, AbortError } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
+import { ORPCError } from '@orpc/client';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
-import '@orpc/client';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
@@ -24,8 +24,13 @@ class BatchHandlerPlugin {
     this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
       ...subRequest,
       headers: {
-        ...batchRequest.headers,
         ...subRequest.headers,
+        /**
+         * The batch request headers win over the subrequest ones. They are the only ones the
+         * transport actually saw, so headers the browser injects on its own, such as `cookie`
+         * or `origin`, cannot be overridden by a subrequest, which is just request payload.
+         */
+        ...batchRequest.headers,
         "orpc-batch": void 0
         // useful in case batch plugin is used multiple times
       }
@@ -215,7 +220,7 @@ class CORSHandlerPlugin {
   after = ["~opentelemetry", "~batch"];
   constructor(options = {}) {
     const defaults = {
-      origin: (origin) => origin,
+      origin: "*",
       allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"]
     };
     this.options = {
@@ -231,7 +236,7 @@ class CORSHandlerPlugin {
       }
       const resHeaders = { ...result.response.headers };
       const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
-      const allowedOrigins = toArray(value(this.options.origin, origin, interceptorOptions));
+      const allowedOrigins = toArray(await value(this.options.origin, origin, interceptorOptions));
       if (allowedOrigins.includes("*")) {
         resHeaders["access-control-allow-origin"] = "*";
       } else {
@@ -243,7 +248,7 @@ class CORSHandlerPlugin {
           resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
         }
       }
-      const allowedTimingOrigins = toArray(value(this.options.timingOrigin, origin, interceptorOptions));
+      const allowedTimingOrigins = toArray(await value(this.options.timingOrigin, origin, interceptorOptions));
       if (allowedTimingOrigins.includes("*")) {
         resHeaders["timing-allow-origin"] = "*";
       } else if (origin !== void 0 && allowedTimingOrigins.includes(origin)) {
@@ -294,21 +299,16 @@ class CORSHandlerPlugin {
 
 class GetMethodCsrfProtectionHandlerPlugin {
   name = "~get-method-csrf-protection";
-  /** Judge the real request, before batch splits it into client-authored sub-requests. */
-  after = ["~batch"];
   init(options) {
-    const routingInterceptor = (interceptorOptions) => {
+    const interceptor = (interceptorOptions) => {
       if (this.isAllowed(interceptorOptions)) {
         return interceptorOptions.next();
       }
-      return Promise.resolve({
-        matched: true,
-        response: { status: 403, headers: {}, body: "Request blocked by CSRF protection." }
-      });
+      throw new ORPCError("FORBIDDEN", { message: "Request blocked by CSRF protection." });
     };
     return {
       ...options,
-      routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+      interceptors: [interceptor, ...toArray(options.interceptors)]
     };
   }
   isAllowed({ request }) {
@@ -370,6 +370,78 @@ class MethodOverrideHandlerPlugin {
   }
 }
 
+class PrototypePollutionProtectionHandlerPlugin {
+  name = "~prototype-pollution-protection";
+  init(options) {
+    const interceptor = (interceptorOptions) => {
+      const input = interceptorOptions.input;
+      if (isAsyncIteratorObject(input)) {
+        const guardedInput = override(input, wrapAsyncIterator(input, {
+          mapResult: (result) => {
+            this.rejectPollutingInput(result.value);
+            return result;
+          }
+        }));
+        return interceptorOptions.next({ ...interceptorOptions, input: guardedInput });
+      }
+      this.rejectPollutingInput(input);
+      return interceptorOptions.next();
+    };
+    return {
+      ...options,
+      clientInterceptors: [interceptor, ...toArray(options.clientInterceptors)]
+    };
+  }
+  rejectPollutingInput(input) {
+    if (this.containsPollutingKey(input)) {
+      throw new ORPCError("BAD_REQUEST", { message: "Request blocked by prototype pollution protection." });
+    }
+  }
+  /**
+   * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
+   * objects, including null-prototype ones. Other objects, such as files and dates, carry
+   * no attacker-authored keys and are left alone. The walk is iterative, so input nested
+   * deeper than the call stack allows still gets the intended verdict instead of a
+   * `RangeError`.
+   */
+  containsPollutingKey(root) {
+    const visited = /* @__PURE__ */ new WeakSet();
+    const stack = [root];
+    while (stack.length !== 0) {
+      const value = stack.pop();
+      if (typeof value !== "object" || value === null || visited.has(value)) {
+        continue;
+      }
+      visited.add(value);
+      if (Array.isArray(value)) {
+        for (const item of value) {
+          stack.push(item);
+        }
+        continue;
+      }
+      if (value instanceof Map || value instanceof Set) {
+        for (const entry of value) {
+          stack.push(entry);
+        }
+        continue;
+      }
+      if (!isPlainObject(value)) {
+        continue;
+      }
+      if (Object.hasOwn(value, "__proto__")) {
+        return true;
+      }
+      if (Object.hasOwn(value, "constructor") && isTypescriptObject(value.constructor) && Object.hasOwn(value.constructor, "prototype")) {
+        return true;
+      }
+      for (const key of Object.keys(value)) {
+        stack.push(value[key]);
+      }
+    }
+    return false;
+  }
+}
+
 class RequestCompressionHandlerPlugin {
   name = "~request-compression";
   /**
@@ -465,9 +537,11 @@ class ResponseCompressionHandlerPlugin {
   after = ["~batch", "~response-headers"];
   encodings;
   threshold;
+  isCompressibleContentType;
   constructor(options = {}) {
     this.encodings = options.encodings ?? ["gzip", "deflate"];
     this.threshold = options.threshold ?? 1024;
+    this.isCompressibleContentType = options.isCompressibleContentType ?? isCompressibleContentType;
   }
   init(options) {
     const routingInterceptor = async ({ next, ...interceptorOptions }) => {
@@ -497,7 +571,7 @@ class ResponseCompressionHandlerPlugin {
       const headers = response.headers;
       if (body instanceof ReadableStream) {
         const contentLength = Number(flattenStandardHeader(headers["content-length"]));
-        if ((!Number.isFinite(contentLength) || contentLength >= this.threshold) && isCompressibleContentType(flattenStandardHeader(headers["content-type"]))) {
+        if ((!Number.isFinite(contentLength) || contentLength >= this.threshold) && this.isCompressibleContentType(flattenStandardHeader(headers["content-type"]), interceptorOptions)) {
           return {
             ...result,
             response: {
@@ -514,7 +588,7 @@ class ResponseCompressionHandlerPlugin {
           };
         }
       } else if (body instanceof Blob) {
-        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && isCompressibleContentType(body.type)) {
+        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && this.isCompressibleContentType(body.type, interceptorOptions)) {
           const contentDisposition = headers["content-disposition"] ?? generateContentDisposition(
             body instanceof File ? body.name : "blob"
           );
@@ -542,13 +616,13 @@ class ResponseCompressionHandlerPlugin {
           contentLength += PART_OVERHEAD + key.length;
           if (value instanceof Blob) {
             if (!Number.isFinite(value.size)) {
-              if (!isCompressibleContentType(value.type)) {
+              if (!this.isCompressibleContentType(value.type, interceptorOptions)) {
                 contentLength = -Infinity;
                 break;
               }
               contentLength = Infinity;
             } else {
-              contentLength += isCompressibleContentType(value.type) ? value.size : -value.size;
+              contentLength += this.isCompressibleContentType(value.type, interceptorOptions) ? value.size : -value.size;
             }
           } else {
             contentLength += value.length * AVG_BYTES_PER_CHAR;
@@ -761,4 +835,4 @@ class TimeoutHandlerPlugin {
   }
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };

package/dist/shared/{server.CkButhNT.mjs → server.3Ex_8ISY.mjs}

@@ -123,6 +123,7 @@ async function executeProcedureInternal(procedure, options) {
   const orderedMiddlewares = procedure["~orpc"].orderedMiddlewares;
   const next = async (midIndex, context, input) => {
     let currentInput = input;
+    let middlewareInput = input;
     const startInputIndex = midIndex === 0 ? 0 : orderedMiddlewares[midIndex - 1].inputSchemasLengthAtUse ?? 0;
     const endInputIndex = midIndex === orderedMiddlewares.length ? inputSchemas.length : orderedMiddlewares[midIndex].inputSchemasLengthAtUse ?? 0;
     if (!procedure["~orpc"].disableInputValidation) {
@@ -134,6 +135,7 @@ async function executeProcedureInternal(procedure, options) {
         );
         currentInput = i !== 0 ? mergeTwoLevels(currentInput, validated) : validated;
       }
+      middlewareInput = endInputIndex > 0 && endInputIndex < inputSchemas.length ? mergeTwoLevels(options.input, currentInput) : currentInput;
     }
     let currentOutput;
     let currentContext = context;
@@ -156,7 +158,7 @@ async function executeProcedureInternal(procedure, options) {
             },
             lastEventId: options.lastEventId
           },
-          currentInput,
+          middlewareInput,
           middlewareDone
         );
       });

package/dist/shared/{server.D9VprDph.mjs → server.7G43pSxo.mjs}

@@ -1,8 +1,8 @@
 import { ORPCError, toORPCError, RPCSerializer, COMMON_ERROR_STATUS_MAP } from '@orpc/client';
-import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON } from '@orpc/shared';
+import { sortPlugins, getOpenTelemetryConfig, runWithSpan, toArray, matchesHttpPathPrefix, intercept, ORPC_NAME, isAsyncIteratorObject, override, traceAsyncIterator, recordSpanError, pathToHttpPath, normalizeHttpPath, value, parseEmptyableJSON, getOwn } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl } from '@standardserver/core';
-import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.CkButhNT.mjs';
-import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.Dh77P3ii.mjs';
+import { c as createProcedureClient, u as unlazy, P as Procedure } from './server.3Ex_8ISY.mjs';
+import { w as walkProcedureContractsSync, g as getRouter, c as createContractProcedure, D as DEFAULT_SUCCESS_STATUS, a as DEFAULT_ERROR_STATUS } from './server.S8BnCR3a.mjs';
 
 class CompositeStandardHandlerPlugin {
   name = "~composite";
@@ -292,7 +292,7 @@ class RPCHandlerCodec {
     };
   }
   encodeError(error, _procedure, _path, _options) {
-    const status = this.errorStatusMap[error.code] ?? DEFAULT_ERROR_STATUS;
+    const status = getOwn(this.errorStatusMap, error.code) ?? DEFAULT_ERROR_STATUS;
     return {
       headers: {},
       status,

package/dist/shared/{server.eCTV8Vpp.mjs → server.Cqk3swxs.mjs}

@@ -1,5 +1,5 @@
 import { resolveMetaPlugins, mergeErrorMap, getHiddenMetaPlugins } from '@orpc/contract';
-import { P as Procedure } from './server.CkButhNT.mjs';
+import { P as Procedure } from './server.3Ex_8ISY.mjs';
 
 class DecoratedProcedure extends Procedure {
   meta(...plugins) {

package/dist/shared/{server.Dh77P3ii.mjs → server.S8BnCR3a.mjs}

@@ -1,4 +1,4 @@
-import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.CkButhNT.mjs';
+import { c as createProcedureClient, P as Procedure, L as Lazy, u as unlazy } from './server.3Ex_8ISY.mjs';
 import { resolveMetaPlugins, mergeErrorMap, ProcedureContract } from '@orpc/contract';
 import { omit, isTypescriptObject } from '@orpc/shared';
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.30",
+  "version": "2.0.0-beta.32",
   "description": "Build typesafe APIs with oRPC: RPC and OpenAPI support, middleware, and adapters for Node.js, Bun, Deno, Fetch, Fastify, WebSocket, AWS Lambda, and more",
   "license": "MIT",
   "funding": [
@@ -117,16 +117,16 @@
     }
   },
   "dependencies": {
-    "@standardserver/aws-lambda": "^0.8.0",
-    "@standardserver/core": "^0.8.0",
-    "@standardserver/fastify": "^0.8.0",
-    "@standardserver/fetch": "^0.8.0",
-    "@standardserver/node": "^0.8.0",
-    "@standardserver/peer": "^0.8.0",
-    "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.30",
-    "@orpc/shared": "2.0.0-beta.30",
-    "@orpc/contract": "2.0.0-beta.30"
+    "@orpc/client": "2.0.0-beta.32",
+    "@orpc/contract": "2.0.0-beta.32",
+    "@orpc/shared": "2.0.0-beta.32",
+    "@standardserver/aws-lambda": "^0.8.2",
+    "@standardserver/core": "^0.8.2",
+    "@standardserver/fastify": "^0.8.2",
+    "@standardserver/fetch": "^0.8.2",
+    "@standardserver/node": "^0.8.2",
+    "@standardserver/peer": "^0.8.2",
+    "cookie": "^2.0.1"
   },
   "devDependencies": {
     "crossws": "^0.4.6",