@orpc/server 2.0.0-beta.42 → 2.0.0-beta.44

package/README.md

@@ -17,7 +17,7 @@
     <img alt="Discord" src="https://img.shields.io/discord/1308966753044398161?color=7389D8&label&logo=discord&logoColor=ffffff" />
   </a>
   <a href="https://deepwiki.com/middleapi/orpc">
-    <img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki">
+    <img alt="Ask DeepWiki" src="https://img.shields.io/badge/Ask-DeepWiki-blue" />
   </a>
 </div>
 
@@ -95,14 +95,6 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
   </tr>
 </table>
 
-### Special Sponsors
-
-<table>
-  <tr>
-   <td align="center"><a href="http://twitter.com/rauchg?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Guillermo Rauch"><img src="https://avatars.githubusercontent.com/u/13041?u=1ee8d111657cdd02ff6d253df00978d17ee6d722&amp;v=4" width="279" alt="Guillermo Rauch"/><br />Guillermo Rauch</a></td>
-  </tr>
-</table>
-
 ### Premium Sponsors
 
 <table>
@@ -178,7 +170,7 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
   </tr>
 </table>
 
-With thanks to [38 past sponsors](https://orpc.dev/sponsors#past-sponsors) who helped get oRPC here.
+With thanks to [39 past sponsors](https://orpc.dev/sponsors#past-sponsors) who helped get oRPC here.
 
 ## References
 

package/dist/adapters/aws-lambda/index.mjs

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standard-server/aws-lambda';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '@orpc/client';
 import '@standard-server/core';
 import '../../shared/server.FEqy7Hrj.mjs';

package/dist/adapters/crossws/index.mjs

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standard-server/peer';
 import { createStandardPeerRequestHandler } from '../standard-peer/index.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@standard-server/core';

package/dist/adapters/fastify/index.mjs

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standard-server/fastify';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '@orpc/client';
 import '@standard-server/core';
 import '../../shared/server.FEqy7Hrj.mjs';

package/dist/adapters/fetch/index.mjs

@@ -2,7 +2,7 @@ export { R as BodyLimitPlugin } from '../../shared/server.1ExWFMze.mjs';
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, toFetchResponse } from '@standard-server/fetch';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '@orpc/client';
 import '@standard-server/core';
 import '../../shared/server.FEqy7Hrj.mjs';

package/dist/adapters/message-port/index.mjs

@@ -2,7 +2,7 @@ import { onMessagePortMessage, onMessagePortClose, postMessagePortMessage } from
 import { value, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage, isPeerMessage } from '@standard-server/peer';
 import { createStandardPeerRequestHandler } from '../standard-peer/index.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@standard-server/core';

package/dist/adapters/node/index.mjs

@@ -2,7 +2,7 @@ export { R as BodyLimitPlugin } from '../../shared/server.1ExWFMze.mjs';
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standard-server/node';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '@orpc/client';
 import '@standard-server/core';
 import '@standard-server/fetch';

package/dist/adapters/standard/index.d.mts

@@ -43,6 +43,8 @@ declare class RPCMatcher {
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
+    /** segment count of the deepest pending key, never lowered so it stays an upper bound */
+    private maxPendingLazyRouterDepth;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
     match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
@@ -50,7 +52,6 @@ declare class RPCMatcher {
         procedure: AnyProcedure;
     } | undefined>;
     private resolvePendingLazyRouters;
-    private loadPendingLazyRouters;
     private loadPendingLazyRouter;
     private indexPendingLazyRouter;
     private resolveProcedure;

package/dist/adapters/standard/index.d.ts

@@ -43,6 +43,8 @@ declare class RPCMatcher {
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
+    /** segment count of the deepest pending key, never lowered so it stays an upper bound */
+    private maxPendingLazyRouterDepth;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
     match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
@@ -50,7 +52,6 @@ declare class RPCMatcher {
         procedure: AnyProcedure;
     } | undefined>;
     private resolvePendingLazyRouters;
-    private loadPendingLazyRouters;
     private loadPendingLazyRouter;
     private indexPendingLazyRouter;
     private resolveProcedure;

package/dist/adapters/standard/index.mjs

@@ -1,4 +1,4 @@
-export { C as CompositeStandardHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler, T as TracingHandlerPlugin } from '../../shared/server.BFEVk-EI.mjs';
+export { C as CompositeStandardHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler, T as TracingHandlerPlugin } from '../../shared/server.B34dZrzY.mjs';
 export { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@orpc/shared';

package/dist/adapters/websocket/index.mjs

@@ -1,7 +1,7 @@
 import { toStringOrBytes, resolveMaybeOptionalOptions, sequential, loadBytes } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standard-server/peer';
 import { createStandardPeerRequestHandler } from '../standard-peer/index.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.BFEVk-EI.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.B34dZrzY.mjs';
 import '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@standard-server/core';

package/dist/helpers/index.d.mts

@@ -17,7 +17,8 @@ import { ParseOptions, SetCookie, StringifyOptions } from 'cookie';
 declare function encodeBase64url(data: Uint8Array): string;
 /**
  * Decodes a base64url string to Uint8Array
- * Returns undefined if the input is invalid
+ * Only accepts canonical, unpadded base64url (the form produced by `encodeBase64url`),
+ * returns undefined for anything else, including padded or standard base64 input
  *
  * @example
  * ```ts

package/dist/helpers/index.d.ts

@@ -17,7 +17,8 @@ import { ParseOptions, SetCookie, StringifyOptions } from 'cookie';
 declare function encodeBase64url(data: Uint8Array): string;
 /**
  * Decodes a base64url string to Uint8Array
- * Returns undefined if the input is invalid
+ * Only accepts canonical, unpadded base64url (the form produced by `encodeBase64url`),
+ * returns undefined for anything else, including padded or standard base64 input
  *
  * @example
  * ```ts

package/dist/helpers/index.mjs

@@ -24,7 +24,7 @@ function decodeBase64url(base64url) {
     for (let i = 0; i < binaryString.length; i++) {
       bytes[i] = binaryString.charCodeAt(i);
     }
-    return bytes;
+    return encodeBase64url(bytes) === base64url ? bytes : void 0;
   } catch {
     return void 0;
   }

package/dist/plugins/index.d.mts

@@ -8,7 +8,7 @@ import '@orpc/contract';
 
 /**
  * Content type for batch responses that use the length-prefixed binary framing
- * (streaming mode, and buffered mode when any sub-response contains binary).
+ * (streaming mode, and buffered mode when any sub-response contains binary or is a stream).
  *
  * Decoding is driven by the `standard-server` body hint, not this header,
  * so it only serves to describe the payload to logs, proxies, and dev tools.
@@ -45,7 +45,7 @@ interface BatchHandlerPluginOptions<T extends Context> {
      *
      * When enabled, a zero-length length-prefixed frame is sent periodically while the
      * stream is idle (no message sent for `interval` ms). Clients ignore these frames.
-     * Only applies to streaming mode.
+     * Only applies to streaming responses: streaming mode, or a buffered batch with a stream sub-response.
      *
      * @default { enabled: true, interval: 15000 }
      */
@@ -69,6 +69,9 @@ interface BatchHandlerPluginOptions<T extends Context> {
  * batch into sub-requests and streaming their responses back together.
  *
  * @remarks
+ * In buffered mode, the batch still streams once a sub-response is a stream
+ * (an event iterator or a `ReadableStream`), since it may never end.
+ *
  * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
  *
  * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
@@ -95,6 +98,9 @@ interface CORSHandlerPluginOptions<T extends Context> {
      * Configures the `Access-Control-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
+     * A function must only return origins it has validated: returning the incoming origin
+     * unchecked allows every origin.
+     *
      * @default '*'
      */
     origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
@@ -112,6 +118,8 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
+     * When set, it replaces that fallback, so include every non-safelisted header
+     * clients send, such as `Content-Type`.
      */
     allowHeaders?: readonly string[];
     /**
@@ -120,6 +128,9 @@ interface CORSHandlerPluginOptions<T extends Context> {
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
+     *
+     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+     * authenticated requests as your users and read the responses.
      */
     credentials?: boolean;
     /**
@@ -205,31 +216,6 @@ declare class MethodOverrideHandlerPlugin<T extends Context> implements Standard
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Rejects requests whose decoded input contains prototype-polluting keys: an own
- * `__proto__` key, or an own `constructor` key holding a `prototype` key. oRPC's own
- * decoding never assigns through the prototype chain, so this plugin exists to stop such
- * keys from reaching application code that merges, clones, or path-sets input with a
- * library vulnerable to prototype pollution. An `AsyncIteratorObject` input is checked
- * value by value as it arrives, and a polluting value fails that iteration instead.
- *
- * @see {@link https://orpc.dev/docs/plugins/prototype-pollution-protection | Prototype Pollution Protection Plugin}
- */
-declare class PrototypePollutionProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-    private rejectPollutingInput;
-    /**
-     * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
-     * objects, including null-prototype ones. Arrays get the same key checks as plain objects,
-     * since structured clone, as used over MessagePort, keeps named keys like `__proto__` on
-     * them. Other objects, such as files and dates, carry no attacker-authored keys and are
-     * left alone. The walk is iterative, so input nested deeper than the call stack allows
-     * still gets the intended verdict instead of a `RangeError`.
-     */
-    private containsPollutingKey;
-}
-
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -417,5 +403,5 @@ declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };

package/dist/plugins/index.d.ts

@@ -8,7 +8,7 @@ import '@orpc/contract';
 
 /**
  * Content type for batch responses that use the length-prefixed binary framing
- * (streaming mode, and buffered mode when any sub-response contains binary).
+ * (streaming mode, and buffered mode when any sub-response contains binary or is a stream).
  *
  * Decoding is driven by the `standard-server` body hint, not this header,
  * so it only serves to describe the payload to logs, proxies, and dev tools.
@@ -45,7 +45,7 @@ interface BatchHandlerPluginOptions<T extends Context> {
      *
      * When enabled, a zero-length length-prefixed frame is sent periodically while the
      * stream is idle (no message sent for `interval` ms). Clients ignore these frames.
-     * Only applies to streaming mode.
+     * Only applies to streaming responses: streaming mode, or a buffered batch with a stream sub-response.
      *
      * @default { enabled: true, interval: 15000 }
      */
@@ -69,6 +69,9 @@ interface BatchHandlerPluginOptions<T extends Context> {
  * batch into sub-requests and streaming their responses back together.
  *
  * @remarks
+ * In buffered mode, the batch still streams once a sub-response is a stream
+ * (an event iterator or a `ReadableStream`), since it may never end.
+ *
  * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
  *
  * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
@@ -95,6 +98,9 @@ interface CORSHandlerPluginOptions<T extends Context> {
      * Configures the `Access-Control-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
+     * A function must only return origins it has validated: returning the incoming origin
+     * unchecked allows every origin.
+     *
      * @default '*'
      */
     origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
@@ -112,6 +118,8 @@ interface CORSHandlerPluginOptions<T extends Context> {
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
+     * When set, it replaces that fallback, so include every non-safelisted header
+     * clients send, such as `Content-Type`.
      */
     allowHeaders?: readonly string[];
     /**
@@ -120,6 +128,9 @@ interface CORSHandlerPluginOptions<T extends Context> {
     maxAge?: number;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
+     *
+     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+     * authenticated requests as your users and read the responses.
      */
     credentials?: boolean;
     /**
@@ -205,31 +216,6 @@ declare class MethodOverrideHandlerPlugin<T extends Context> implements Standard
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Rejects requests whose decoded input contains prototype-polluting keys: an own
- * `__proto__` key, or an own `constructor` key holding a `prototype` key. oRPC's own
- * decoding never assigns through the prototype chain, so this plugin exists to stop such
- * keys from reaching application code that merges, clones, or path-sets input with a
- * library vulnerable to prototype pollution. An `AsyncIteratorObject` input is checked
- * value by value as it arrives, and a polluting value fails that iteration instead.
- *
- * @see {@link https://orpc.dev/docs/plugins/prototype-pollution-protection | Prototype Pollution Protection Plugin}
- */
-declare class PrototypePollutionProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-    private rejectPollutingInput;
-    /**
-     * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
-     * objects, including null-prototype ones. Arrays get the same key checks as plain objects,
-     * since structured clone, as used over MessagePort, keeps named keys like `__proto__` on
-     * them. Other objects, such as files and dates, carry no attacker-authored keys and are
-     * left alone. The walk is iterative, so input nested deeper than the call stack allows
-     * still gets the intended verdict instead of a `RangeError`.
-     */
-    private containsPollutingKey;
-}
-
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -417,5 +403,5 @@ declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };

package/dist/plugins/index.mjs

@@ -1,11 +1,22 @@
 import { ORPCError } from '@orpc/client';
-import { toArray, value, isPlainObject, isTypescriptObject, isAsyncIteratorObject, override, wrapAsyncIterator, isCompressibleContentType, isNoTransformCacheControl, parseAcceptEncodingQualities, isAcceptableEncoding, varyByAcceptEncoding, stringifyJSON, anyAbortSignal, wrapReadableStream, AbortError } from '@orpc/shared';
+import { toArray, value, promiseWithResolvers, isAsyncIteratorObject, isCompressibleContentType, isNoTransformCacheControl, parseAcceptEncodingQualities, isAcceptableEncoding, varyByAcceptEncoding, stringifyJSON, anyAbortSignal, override, wrapAsyncIterator, wrapReadableStream, AbortError } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standard-server/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standard-server/peer';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standard-server/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.1ExWFMze.mjs';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
+const textEncoder = new TextEncoder();
+function encodeLengthPrefix(length) {
+  const prefix = new Uint8Array(4);
+  new DataView(prefix.buffer).setUint32(0, length, false);
+  return prefix;
+}
+async function encodeFrame(message) {
+  const encoded = await encodePeerMessage(message);
+  const bytes = typeof encoded === "string" ? textEncoder.encode(encoded) : encoded;
+  return [encodeLengthPrefix(bytes.byteLength), bytes];
+}
 class BatchHandlerPlugin {
   name = "~batch";
   /**
@@ -101,6 +112,63 @@ class BatchHandlerPlugin {
           response: { status: 413, headers: {}, body: "Batch request size exceeds the maximum allowed size" }
         };
       }
+      const status = await value(this.successStatus, interceptorOptions);
+      const headers = await value(this.headers, interceptorOptions);
+      const bufferedMessages = [];
+      let streamController;
+      let keepAliveTimer;
+      const clearKeepAlive = () => {
+        if (keepAliveTimer !== void 0) {
+          clearInterval(keepAliveTimer);
+          keepAliveTimer = void 0;
+        }
+      };
+      const scheduleKeepAlive = () => {
+        if (!this.keepAliveEnabled) {
+          return;
+        }
+        clearKeepAlive();
+        keepAliveTimer = setInterval(() => {
+          try {
+            streamController.enqueue(encodeLengthPrefix(0));
+          } catch {
+            clearKeepAlive();
+          }
+        }, this.keepAliveInterval);
+      };
+      const enqueueMessage = async (message) => {
+        for (const chunk of await encodeFrame(message)) {
+          streamController.enqueue(chunk);
+        }
+        scheduleKeepAlive();
+      };
+      const peer = new ServerPeer(async (message) => {
+        if (mode === "streaming") {
+          startStreaming();
+        }
+        if (streamController === void 0) {
+          bufferedMessages.push(message);
+        } else {
+          await enqueueMessage(message);
+        }
+      });
+      const streaming = promiseWithResolvers();
+      function startStreaming() {
+        if (streamController !== void 0) {
+          return;
+        }
+        const body = new ReadableStream({
+          start(controller) {
+            streamController = controller;
+            scheduleKeepAlive();
+          },
+          async cancel(reason) {
+            clearKeepAlive();
+            await peer.close(reason);
+          }
+        });
+        streaming.resolve({ body, flushed: Promise.all(bufferedMessages.splice(0).map(enqueueMessage)) });
+      }
       const handleIndividualRequest = async (request) => {
         try {
           request = this.mapSubrequest(request, interceptorOptions);
@@ -108,16 +176,19 @@ class BatchHandlerPlugin {
           if (!matched) {
             return { status: 404, headers: {}, body: "No procedure matched" };
           }
+          if (response.body instanceof ReadableStream || isAsyncIteratorObject(response.body)) {
+            startStreaming();
+          }
           return response;
         } catch (err) {
           Promise.reject(err);
           return { status: 500, headers: {}, body: "Internal server error" };
         }
       };
-      const runSubrequests = async (peer2) => {
-        const promise = Promise.all(messages.map((msg) => peer2.message(msg, handleIndividualRequest)));
+      const runSubrequests = async () => {
+        const promise = Promise.all(messages.map((msg) => peer.message(msg, handleIndividualRequest)));
         const signal = interceptorOptions.request.signal;
-        const closePeer = () => peer2.close(signal?.reason);
+        const closePeer = () => peer.close(signal?.reason);
         if (signal?.aborted) {
           closePeer();
         }
@@ -128,25 +199,12 @@ class BatchHandlerPlugin {
           signal?.removeEventListener("abort", closePeer);
         }
       };
-      const status = await value(this.successStatus, interceptorOptions);
-      const headers = await value(this.headers, interceptorOptions);
-      if (mode === "buffered") {
-        const responseMessages = [];
-        const peer2 = new ServerPeer(async (message) => {
-          responseMessages.push(message);
-        });
-        await runSubrequests(peer2);
-        await peer2.close();
-        if (responseMessages.some((msg) => msg.binary !== void 0)) {
-          const chunks = [];
-          for (const message of responseMessages) {
-            const encoded = await encodePeerMessage(message);
-            const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
-            const lengthBuffer = new ArrayBuffer(4);
-            new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
-            chunks.push(new Uint8Array(lengthBuffer));
-            chunks.push(bytes);
-          }
+      const subrequests = runSubrequests();
+      const started = await Promise.race([streaming.promise, subrequests.then(() => void 0)]);
+      if (started === void 0) {
+        await peer.close();
+        if (bufferedMessages.some((msg) => msg.binary !== void 0)) {
+          const chunks = (await Promise.all(bufferedMessages.map(encodeFrame))).flat();
           return {
             matched: true,
             response: {
@@ -158,52 +216,10 @@ class BatchHandlerPlugin {
         }
         return {
           matched: true,
-          response: { status, headers, body: responseMessages }
+          response: { status, headers, body: bufferedMessages }
         };
       }
-      let streamController;
-      let keepAliveTimer;
-      const clearKeepAlive = () => {
-        if (keepAliveTimer !== void 0) {
-          clearInterval(keepAliveTimer);
-          keepAliveTimer = void 0;
-        }
-      };
-      const scheduleKeepAlive = () => {
-        if (!this.keepAliveEnabled) {
-          return;
-        }
-        clearKeepAlive();
-        keepAliveTimer = setInterval(() => {
-          try {
-            const lengthBuffer = new ArrayBuffer(4);
-            new DataView(lengthBuffer).setUint32(0, 0, false);
-            streamController.enqueue(new Uint8Array(lengthBuffer));
-          } catch {
-            clearKeepAlive();
-          }
-        }, this.keepAliveInterval);
-      };
-      const peer = new ServerPeer(async (message) => {
-        const encoded = await encodePeerMessage(message);
-        const bytes = typeof encoded === "string" ? new TextEncoder().encode(encoded) : encoded;
-        const lengthBuffer = new ArrayBuffer(4);
-        new DataView(lengthBuffer).setUint32(0, bytes.byteLength, false);
-        streamController.enqueue(new Uint8Array(lengthBuffer));
-        streamController.enqueue(bytes);
-        scheduleKeepAlive();
-      });
-      const stream = new ReadableStream({
-        start(controller) {
-          streamController = controller;
-          scheduleKeepAlive();
-        },
-        async cancel(reason) {
-          clearKeepAlive();
-          await peer.close(reason);
-        }
-      });
-      runSubrequests(peer).then(async () => {
+      Promise.all([started.flushed, subrequests]).then(async () => {
         clearKeepAlive();
         streamController.close();
         await peer.close();
@@ -217,7 +233,7 @@ class BatchHandlerPlugin {
         response: {
           status,
           headers: { ...headers, "content-type": BATCH_CONTENT_TYPE },
-          body: stream
+          body: started.body
         }
       };
     };
@@ -405,75 +421,6 @@ class MethodOverrideHandlerPlugin {
   }
 }
 
-class PrototypePollutionProtectionHandlerPlugin {
-  name = "~prototype-pollution-protection";
-  init(options) {
-    const interceptor = (interceptorOptions) => {
-      const input = interceptorOptions.input;
-      if (isAsyncIteratorObject(input)) {
-        const guardedInput = override(input, wrapAsyncIterator(input, {
-          mapResult: (result) => {
-            this.rejectPollutingInput(result.value);
-            return result;
-          }
-        }));
-        return interceptorOptions.next({ ...interceptorOptions, input: guardedInput });
-      }
-      this.rejectPollutingInput(input);
-      return interceptorOptions.next();
-    };
-    return {
-      ...options,
-      clientInterceptors: [interceptor, ...toArray(options.clientInterceptors)]
-    };
-  }
-  rejectPollutingInput(input) {
-    if (this.containsPollutingKey(input)) {
-      throw new ORPCError("BAD_REQUEST", { message: "Request blocked by prototype pollution protection." });
-    }
-  }
-  /**
-   * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
-   * objects, including null-prototype ones. Arrays get the same key checks as plain objects,
-   * since structured clone, as used over MessagePort, keeps named keys like `__proto__` on
-   * them. Other objects, such as files and dates, carry no attacker-authored keys and are
-   * left alone. The walk is iterative, so input nested deeper than the call stack allows
-   * still gets the intended verdict instead of a `RangeError`.
-   */
-  containsPollutingKey(root) {
-    const visited = /* @__PURE__ */ new WeakSet();
-    const stack = [root];
-    while (stack.length !== 0) {
-      const value = stack.pop();
-      if (typeof value !== "object" || value === null || visited.has(value)) {
-        continue;
-      }
-      visited.add(value);
-      if (value instanceof Map || value instanceof Set) {
-        for (const entry of value) {
-          stack.push(entry);
-        }
-        continue;
-      }
-      if (!Array.isArray(value) && !isPlainObject(value)) {
-        continue;
-      }
-      if (Object.hasOwn(value, "__proto__")) {
-        return true;
-      }
-      if (Object.hasOwn(value, "constructor") && isTypescriptObject(value.constructor) && Object.hasOwn(value.constructor, "prototype")) {
-        return true;
-      }
-      for (const item of Object.values(value)) {
-        if (typeof item === "object" && item !== null) {
-          stack.push(item);
-        }
-      }
-    }
-    return false;
-  }
-}
-
 const MAX_CONTENT_ENCODINGS = 5;
 class RequestCompressionHandlerPlugin {
   name = "~request-compression";
@@ -608,7 +555,8 @@ class ResponseCompressionHandlerPlugin {
           };
         }
       } else if (body instanceof Blob) {
-        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && this.isCompressibleContentType(body.type, interceptorOptions)) {
+        const contentType = headers["content-type"] ?? body.type;
+        if ((!Number.isFinite(body.size) || body.size >= this.threshold) && this.isCompressibleContentType(flattenStandardHeader(contentType), interceptorOptions)) {
           const contentDisposition = headers["content-disposition"] ?? generateContentDisposition(
             body instanceof File ? body.name : "blob"
           );
@@ -620,7 +568,7 @@ class ResponseCompressionHandlerPlugin {
               headers: {
                 ...toCompressedHeaders(headers, encoding),
                 "standard-server": "file",
-                "content-type": body.type,
+                "content-type": contentType,
                 "content-disposition": contentDisposition
               }
             }
@@ -875,4 +823,4 @@ class TimeoutHandlerPlugin {
   }
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };

package/dist/shared/{server.BFEVk-EI.mjs → server.B34dZrzY.mjs}

@@ -183,6 +183,7 @@ class TracingHandlerPlugin {
 }
 
 const RPC_DEFAULT_ALLOW_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+const NORMALIZABLE_PATHNAME_REGEX = /[^\w\-.!~*'()/]/;
 class RPCMatcher {
   filter;
   allowMethodsSet;
@@ -190,6 +191,8 @@ class RPCMatcher {
   rootRouter;
   tree = /* @__PURE__ */ new Map();
   pendingLazyRouters = /* @__PURE__ */ new Map();
+  /** segment count of the deepest pending key, never lowered so it stays an upper bound */
+  maxPendingLazyRouterDepth = 0;
   constructor(router, options = {}) {
     this.filter = options.filter ?? true;
     const allowMethods = options.allowMethods ?? RPC_DEFAULT_ALLOW_METHODS;
@@ -215,6 +218,7 @@ class RPCMatcher {
     }, path);
     for (const result of lazyResults) {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
+      this.maxPendingLazyRouterDepth = Math.max(this.maxPendingLazyRouterDepth, result.path.length);
     }
   }
   async match(method, pathname, prefix) {
@@ -244,7 +248,7 @@ class RPCMatcher {
       await loading;
     }
     let entry = this.tree.get(pathname);
-    if (entry === void 0 && pathname.includes("%")) {
+    if (entry === void 0 && NORMALIZABLE_PATHNAME_REGEX.test(pathname)) {
       const normalizedPathname = normalizeHttpPath(pathname);
       const normalizedLoading = this.resolvePendingLazyRouters(normalizedPathname);
       if (normalizedLoading !== void 0) {
@@ -269,22 +273,12 @@ class RPCMatcher {
       return;
     }
     let slashIndex = 0;
-    while (slashIndex !== -1) {
-      const nextSlashIndex = pathname.indexOf("/", slashIndex + 1);
-      const httpPathPrefix = nextSlashIndex === -1 ? pathname : pathname.slice(0, nextSlashIndex);
-      if (this.pendingLazyRouters.has(httpPathPrefix)) {
-        return this.loadPendingLazyRouters(pathname, slashIndex);
-      }
-      slashIndex = nextSlashIndex;
-    }
-  }
-  async loadPendingLazyRouters(pathname, slashIndex) {
-    while (slashIndex !== -1) {
+    for (let depth = 1; slashIndex !== -1 && depth <= this.maxPendingLazyRouterDepth; depth++) {
       const nextSlashIndex = pathname.indexOf("/", slashIndex + 1);
       const httpPathPrefix = nextSlashIndex === -1 ? pathname : pathname.slice(0, nextSlashIndex);
       const pending = this.pendingLazyRouters.get(httpPathPrefix);
       if (pending !== void 0) {
-        await this.loadPendingLazyRouter(httpPathPrefix, pending);
+        return this.loadPendingLazyRouter(httpPathPrefix, pending).then(() => this.resolvePendingLazyRouters(pathname));
       }
       slashIndex = nextSlashIndex;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.42",
+  "version": "2.0.0-beta.44",
   "description": "Build typesafe APIs with oRPC: RPC and OpenAPI support, middleware, and adapters for Node.js, Bun, Deno, Fetch, Fastify, WebSocket, AWS Lambda, and more",
   "license": "MIT",
   "funding": [
@@ -117,23 +117,23 @@
     }
   },
   "dependencies": {
-    "@orpc/client": "2.0.0-beta.42",
-    "@orpc/contract": "2.0.0-beta.42",
-    "@orpc/shared": "2.0.0-beta.42",
-    "@standard-server/aws-lambda": "~0.10.1",
-    "@standard-server/core": "~0.10.1",
-    "@standard-server/fastify": "~0.10.1",
-    "@standard-server/fetch": "~0.10.1",
-    "@standard-server/node": "~0.10.1",
-    "@standard-server/peer": "~0.10.1",
+    "@orpc/client": "2.0.0-beta.44",
+    "@orpc/contract": "2.0.0-beta.44",
+    "@orpc/shared": "2.0.0-beta.44",
+    "@standard-server/aws-lambda": "~0.10.3",
+    "@standard-server/core": "~0.10.3",
+    "@standard-server/fastify": "~0.10.3",
+    "@standard-server/fetch": "~0.10.3",
+    "@standard-server/node": "~0.10.3",
+    "@standard-server/peer": "~0.10.3",
     "cookie": "^2.0.1"
   },
   "devDependencies": {
-    "crossws": "^0.4.6",
-    "fastify": "^5.12.1",
-    "supertest": "^7.2.2",
-    "ws": "^8.21.3",
-    "zod": "^4.5.4"
+    "crossws": "^0.4.15",
+    "fastify": "^5.12.5",
+    "supertest": "^7.3.1",
+    "ws": "^8.22.0",
+    "zod": "^4.6.5"
   },
   "scripts": {
     "type:check": "tsc -b"