@orpc/server 2.0.0-beta.43 → 2.0.0-beta.45

package/dist/helpers/index.d.ts

@@ -17,7 +17,8 @@ import { ParseOptions, SetCookie, StringifyOptions } from 'cookie';
 declare function encodeBase64url(data: Uint8Array): string;
 /**
  * Decodes a base64url string to Uint8Array
- * Returns undefined if the input is invalid
+ * Only accepts canonical, unpadded base64url (the form produced by `encodeBase64url`),
+ * returns undefined for anything else, including padded or standard base64 input
  *
  * @example
  * ```ts

package/dist/helpers/index.mjs

@@ -1,14 +1,8 @@
+import { encodeBase64 } from '@orpc/shared';
 import { parseCookie, stringifySetCookie } from 'cookie';
 
 function encodeBase64url(data) {
-  const chunkSize = 8192;
-  let binaryString = "";
-  for (let i = 0; i < data.length; i += chunkSize) {
-    const chunk = data.subarray(i, i + chunkSize);
-    binaryString += String.fromCharCode(...chunk);
-  }
-  const base64 = btoa(binaryString);
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return encodeBase64(data).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function decodeBase64url(base64url) {
   try {
@@ -24,7 +18,7 @@ function decodeBase64url(base64url) {
     for (let i = 0; i < binaryString.length; i++) {
       bytes[i] = binaryString.charCodeAt(i);
     }
-    return bytes;
+    return encodeBase64url(bytes) === base64url ? bytes : void 0;
   } catch {
     return void 0;
   }

package/dist/index.d.mts

@@ -1,11 +1,11 @@
-import { ErrorMap, MergedErrorMap, AnySchema, MetaPlugin, InferSchemaOutput, InferSchemaInput, AugmentContractRouterOptions, RouterContract, AnyProcedureContract, InitialInputSchema, InitialOutputSchema, MergedSchema, ORPCErrorConstructorMap, Schema, ProcedureContractDefinition, ProcedureContract, InferRouterContractErrorMap, ORPCErrorFromErrorMap } from '@orpc/contract';
+import { ErrorMap, MergedErrorMap, AnySchema, MetaPlugin, InferSchemaOutput, InferSchemaInput, AugmentContractRouterOptions, AnyProcedureContract, RouterContract, InitialInputSchema, InitialOutputSchema, MergedSchema, ORPCErrorConstructorMap, Schema, ProcedureContractDefinition, ProcedureContract, InferRouterContractErrorMap, ORPCErrorFromErrorMap } from '@orpc/contract';
 export { AnyMetaPlugin, AnySchema, ErrorMap, ErrorMapItem, InferSchemaInput, InferSchemaOutput, InitialInputSchema, InitialOutputSchema, MergedErrorMap, Meta, MetaPlugin, MetaPluginDefinition, ORPCErrorConstructorMap, ORPCErrorConstructorMapItem, ORPCErrorConstructorMapItemOptions, ORPCErrorFactory, ORPCErrorFactoryOptions, ORPCErrorFromErrorMap, ProcedureContract, ProcedureContractDefinition, RouterContract, Schema, ValidationError, asyncIteratorObject, defineMeta, error, eventIterator, reconcileORPCError, type } from '@orpc/contract';
 import { IntersectPick, Promisable, Public, PromiseWithError, ThrowableError, MaybeOptionalOptions } from '@orpc/shared';
 export { AsyncCleanupFn, AsyncIteratorClass, AsyncIteratorClassNextFn, MaybeOptionalOptions, PromiseWithError, Registry, ThrowableError, asyncIteratorToStream, asyncIteratorToUnproxiedDataStream, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onAsyncIteratorObjectError, onError, onFinish, onReadableStreamError, onStart, onSuccess, streamToAsyncIteratorObject, streamToAsyncIteratorObject as streamToEventIterator } from '@orpc/shared';
-import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialContext, a as Procedure, f as ProcedureConfig, g as AnyMiddleware, h as Lazy, A as AnyProcedure, L as Lazyable, i as ProcedureHandler, O as OrderedMiddleware, P as ProcedureClientOptions, b as ProcedureClient } from './shared/server.BEdOJs6S.mjs';
-export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.BEdOJs6S.mjs';
-import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.DD1roZl9.mjs';
-export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.DD1roZl9.mjs';
+import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialContext, a as Procedure, f as ProcedureConfig, g as AnyMiddleware, h as Lazy, A as AnyProcedure, L as Lazyable, i as ProcedureHandler, O as OrderedMiddleware, P as ProcedureClientOptions, b as ProcedureClient } from './shared/server.BWhT-63L.mjs';
+export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.BWhT-63L.mjs';
+import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.TjEHK8V3.mjs';
+export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.TjEHK8V3.mjs';
 import { ClientOptions, ClientContext } from '@orpc/client';
 export { AnyORPCError, AnyORPCErrorJSON, COMMON_ERROR_STATUS_MAP, Client, ClientContext, ClientOptions, ClientRest, FriendlyClientOptions, ORPCError, ORPCErrorCode, ORPCErrorJSON, ORPCErrorOptions, RPCJsonSerialization, RPCJsonSerializationMeta, RPCJsonSerializer, RPCJsonSerializerHandler, RPCJsonSerializerOptions, RPCSerializer, RPCSerializerOptions, RPCSerializerSerializeOptions, SafeResult, cloneORPCError, isDefinedError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, EventMeta, StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl, getEventMeta, unwrapEvent, withEventMeta } from '@standard-server/core';
@@ -37,6 +37,13 @@ interface AugmentImplementedRouterOptions extends ProcedureConfig {
     middlewares: AnyMiddleware[];
 }
 declare function augmentImplementedRouter<T extends AnyRouter, TInitialContext extends Context, TCurrentContext extends Context>(router: T, options: AugmentImplementedRouterOptions): AugmentedRouter<T, object> | AugmentedRouterWithMiddlewares<T, TInitialContext, TCurrentContext, object>;
+/**
+ * Resolves the procedure of a contract walked from a router: the procedure itself,
+ * or the implementation of a contract-first procedure, looked up by its path.
+ *
+ * @throws {TypeError} If a contract-first procedure has no valid implementation.
+ */
+declare function resolveContractProcedure(router: AnyRouter, contract: AnyProcedureContract, path: readonly string[]): Promise<AnyProcedure>;
 declare function getRouter<T extends Lazyable<AnyRouter | undefined>>(router: T, path: readonly string[]): T extends Lazy<any> ? Lazy<AnyRouter | undefined> : Lazyable<AnyRouter | undefined>;
 interface WalkProcedureContractsLazyResult {
     router: Lazy<AnyRouter>;
@@ -389,7 +396,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
 declare const os: Builder<DefaultInitialContext & object, Record<never, never>>;
 
 declare const DEFAULT_SUCCESS_STATUS = 200;
-declare const DEFAULT_ERROR_STATUS = 500;
+declare const DEFAULT_ERROR_STATUS = 400;
 
 declare class ProcedureImplementer<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap> {
     '~orpc': BuilderDefinition<TInputSchema, TOutputSchema, TErrorMap>;
@@ -487,5 +494,5 @@ declare function createRouterClient<T extends AnyRouter, TClientContext extends
 declare function withHiddenRouterContract<T extends Lazyable<AnyRouter>>(router: T, contract: RouterContract): T;
 declare function getHiddenRouterContract(router: Lazyable<AnyRouter | RouterContract>): RouterContract | undefined;
 
-export { AnyMiddleware, AnyProcedure, AnyRouter, Builder, Context, ContractedRouter, DEFAULT_ERROR_STATUS, DEFAULT_SUCCESS_STATUS, DecoratedProcedure, ImplementedProcedure, InferRouterInitialContext, Lazy, Lazyable, MergedContext, MergedInitialContext, Middleware, OrderedMiddleware, Procedure, ProcedureClient, ProcedureClientOptions, ProcedureConfig, ProcedureHandler, ProcedureImplementer, Router, SharedRouterImplementer, augmentImplementedRouter, augmentRouter, call, createContractProcedure, createGuardedProcedureLazy, createRouterClient, createRouterImplementer, decorateMiddleware, getHiddenRouterContract, getRouter, implement, os, unlazyRouter, walkProcedureContractsAsync, walkProcedureContractsSync, withHiddenRouterContract };
+export { AnyMiddleware, AnyProcedure, AnyRouter, Builder, Context, ContractedRouter, DEFAULT_ERROR_STATUS, DEFAULT_SUCCESS_STATUS, DecoratedProcedure, ImplementedProcedure, InferRouterInitialContext, Lazy, Lazyable, MergedContext, MergedInitialContext, Middleware, OrderedMiddleware, Procedure, ProcedureClient, ProcedureClientOptions, ProcedureConfig, ProcedureHandler, ProcedureImplementer, Router, SharedRouterImplementer, augmentImplementedRouter, augmentRouter, call, createContractProcedure, createGuardedProcedureLazy, createRouterClient, createRouterImplementer, decorateMiddleware, getHiddenRouterContract, getRouter, implement, os, resolveContractProcedure, unlazyRouter, walkProcedureContractsAsync, walkProcedureContractsSync, withHiddenRouterContract };
 export type { AugmentImplementedRouterOptions, AugmentRouterOptions, AugmentedRouter, AugmentedRouterWithMiddlewares, BuilderDefinition, BuilderWithInput, BuilderWithInputOutput, BuilderWithMiddlewares, BuilderWithOutput, CallOptions, CallRest, DecoratedMiddleware, DefaultInitialContext, Implementer, RouterClient, RouterImplementer, RouterImplementerWithMiddlewares, SharedRouterImplementerWithMiddlewares, UnlaziedRouter, WalkProcedureContractsLazyResult };

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { ErrorMap, MergedErrorMap, AnySchema, MetaPlugin, InferSchemaOutput, InferSchemaInput, AugmentContractRouterOptions, RouterContract, AnyProcedureContract, InitialInputSchema, InitialOutputSchema, MergedSchema, ORPCErrorConstructorMap, Schema, ProcedureContractDefinition, ProcedureContract, InferRouterContractErrorMap, ORPCErrorFromErrorMap } from '@orpc/contract';
+import { ErrorMap, MergedErrorMap, AnySchema, MetaPlugin, InferSchemaOutput, InferSchemaInput, AugmentContractRouterOptions, AnyProcedureContract, RouterContract, InitialInputSchema, InitialOutputSchema, MergedSchema, ORPCErrorConstructorMap, Schema, ProcedureContractDefinition, ProcedureContract, InferRouterContractErrorMap, ORPCErrorFromErrorMap } from '@orpc/contract';
 export { AnyMetaPlugin, AnySchema, ErrorMap, ErrorMapItem, InferSchemaInput, InferSchemaOutput, InitialInputSchema, InitialOutputSchema, MergedErrorMap, Meta, MetaPlugin, MetaPluginDefinition, ORPCErrorConstructorMap, ORPCErrorConstructorMapItem, ORPCErrorConstructorMapItemOptions, ORPCErrorFactory, ORPCErrorFactoryOptions, ORPCErrorFromErrorMap, ProcedureContract, ProcedureContractDefinition, RouterContract, Schema, ValidationError, asyncIteratorObject, defineMeta, error, eventIterator, reconcileORPCError, type } from '@orpc/contract';
 import { IntersectPick, Promisable, Public, PromiseWithError, ThrowableError, MaybeOptionalOptions } from '@orpc/shared';
 export { AsyncCleanupFn, AsyncIteratorClass, AsyncIteratorClassNextFn, MaybeOptionalOptions, PromiseWithError, Registry, ThrowableError, asyncIteratorToStream, asyncIteratorToUnproxiedDataStream, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onAsyncIteratorObjectError, onError, onFinish, onReadableStreamError, onStart, onSuccess, streamToAsyncIteratorObject, streamToAsyncIteratorObject as streamToEventIterator } from '@orpc/shared';
-import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialContext, a as Procedure, f as ProcedureConfig, g as AnyMiddleware, h as Lazy, A as AnyProcedure, L as Lazyable, i as ProcedureHandler, O as OrderedMiddleware, P as ProcedureClientOptions, b as ProcedureClient } from './shared/server.BEdOJs6S.js';
-export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.BEdOJs6S.js';
-import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.DZeVx8K9.js';
-export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.DZeVx8K9.js';
+import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialContext, a as Procedure, f as ProcedureConfig, g as AnyMiddleware, h as Lazy, A as AnyProcedure, L as Lazyable, i as ProcedureHandler, O as OrderedMiddleware, P as ProcedureClientOptions, b as ProcedureClient } from './shared/server.BWhT-63L.js';
+export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.BWhT-63L.js';
+import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.DcDZdSrg.js';
+export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.DcDZdSrg.js';
 import { ClientOptions, ClientContext } from '@orpc/client';
 export { AnyORPCError, AnyORPCErrorJSON, COMMON_ERROR_STATUS_MAP, Client, ClientContext, ClientOptions, ClientRest, FriendlyClientOptions, ORPCError, ORPCErrorCode, ORPCErrorJSON, ORPCErrorOptions, RPCJsonSerialization, RPCJsonSerializationMeta, RPCJsonSerializer, RPCJsonSerializerHandler, RPCJsonSerializerOptions, RPCSerializer, RPCSerializerOptions, RPCSerializerSerializeOptions, SafeResult, cloneORPCError, isDefinedError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, EventMeta, StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl, getEventMeta, unwrapEvent, withEventMeta } from '@standard-server/core';
@@ -37,6 +37,13 @@ interface AugmentImplementedRouterOptions extends ProcedureConfig {
     middlewares: AnyMiddleware[];
 }
 declare function augmentImplementedRouter<T extends AnyRouter, TInitialContext extends Context, TCurrentContext extends Context>(router: T, options: AugmentImplementedRouterOptions): AugmentedRouter<T, object> | AugmentedRouterWithMiddlewares<T, TInitialContext, TCurrentContext, object>;
+/**
+ * Resolves the procedure of a contract walked from a router: the procedure itself,
+ * or the implementation of a contract-first procedure, looked up by its path.
+ *
+ * @throws {TypeError} If a contract-first procedure has no valid implementation.
+ */
+declare function resolveContractProcedure(router: AnyRouter, contract: AnyProcedureContract, path: readonly string[]): Promise<AnyProcedure>;
 declare function getRouter<T extends Lazyable<AnyRouter | undefined>>(router: T, path: readonly string[]): T extends Lazy<any> ? Lazy<AnyRouter | undefined> : Lazyable<AnyRouter | undefined>;
 interface WalkProcedureContractsLazyResult {
     router: Lazy<AnyRouter>;
@@ -389,7 +396,7 @@ declare class Builder<TInitialContext extends Context, TErrorMap extends ErrorMa
 declare const os: Builder<DefaultInitialContext & object, Record<never, never>>;
 
 declare const DEFAULT_SUCCESS_STATUS = 200;
-declare const DEFAULT_ERROR_STATUS = 500;
+declare const DEFAULT_ERROR_STATUS = 400;
 
 declare class ProcedureImplementer<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap> {
     '~orpc': BuilderDefinition<TInputSchema, TOutputSchema, TErrorMap>;
@@ -487,5 +494,5 @@ declare function createRouterClient<T extends AnyRouter, TClientContext extends
 declare function withHiddenRouterContract<T extends Lazyable<AnyRouter>>(router: T, contract: RouterContract): T;
 declare function getHiddenRouterContract(router: Lazyable<AnyRouter | RouterContract>): RouterContract | undefined;
 
-export { AnyMiddleware, AnyProcedure, AnyRouter, Builder, Context, ContractedRouter, DEFAULT_ERROR_STATUS, DEFAULT_SUCCESS_STATUS, DecoratedProcedure, ImplementedProcedure, InferRouterInitialContext, Lazy, Lazyable, MergedContext, MergedInitialContext, Middleware, OrderedMiddleware, Procedure, ProcedureClient, ProcedureClientOptions, ProcedureConfig, ProcedureHandler, ProcedureImplementer, Router, SharedRouterImplementer, augmentImplementedRouter, augmentRouter, call, createContractProcedure, createGuardedProcedureLazy, createRouterClient, createRouterImplementer, decorateMiddleware, getHiddenRouterContract, getRouter, implement, os, unlazyRouter, walkProcedureContractsAsync, walkProcedureContractsSync, withHiddenRouterContract };
+export { AnyMiddleware, AnyProcedure, AnyRouter, Builder, Context, ContractedRouter, DEFAULT_ERROR_STATUS, DEFAULT_SUCCESS_STATUS, DecoratedProcedure, ImplementedProcedure, InferRouterInitialContext, Lazy, Lazyable, MergedContext, MergedInitialContext, Middleware, OrderedMiddleware, Procedure, ProcedureClient, ProcedureClientOptions, ProcedureConfig, ProcedureHandler, ProcedureImplementer, Router, SharedRouterImplementer, augmentImplementedRouter, augmentRouter, call, createContractProcedure, createGuardedProcedureLazy, createRouterClient, createRouterImplementer, decorateMiddleware, getHiddenRouterContract, getRouter, implement, os, resolveContractProcedure, unlazyRouter, walkProcedureContractsAsync, walkProcedureContractsSync, withHiddenRouterContract };
 export type { AugmentImplementedRouterOptions, AugmentRouterOptions, AugmentedRouter, AugmentedRouterWithMiddlewares, BuilderDefinition, BuilderWithInput, BuilderWithInputOutput, BuilderWithMiddlewares, BuilderWithOutput, CallOptions, CallRest, DecoratedMiddleware, DefaultInitialContext, Implementer, RouterClient, RouterImplementer, RouterImplementerWithMiddlewares, SharedRouterImplementerWithMiddlewares, UnlaziedRouter, WalkProcedureContractsLazyResult };

package/dist/index.mjs

@@ -5,8 +5,8 @@ export { AsyncIteratorClass, asyncIteratorToStream, asyncIteratorToUnproxiedData
 import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.FEqy7Hrj.mjs';
 export { u as unlazy } from './shared/server.FEqy7Hrj.mjs';
 import { D as DecoratedProcedure } from './shared/server.AVQWL-DI.mjs';
-import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.BgvqVW_v.mjs';
-export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.BgvqVW_v.mjs';
+import { b as augmentRouter, c as augmentImplementedRouter, d as withHiddenRouterContract, e as createGuardedProcedureLazy, g as getRouter } from './shared/server.BcxD3fmU.mjs';
+export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, f as call, h as createContractProcedure, i as getHiddenRouterContract, r as resolveContractProcedure, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.BcxD3fmU.mjs';
 import { RECURSIVE_CLIENT_UNWRAP_KEYS } from '@orpc/client';
 export { COMMON_ERROR_STATUS_MAP, ORPCError, RPCJsonSerializer, RPCSerializer, cloneORPCError, isDefinedError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, getEventMeta, unwrapEvent, withEventMeta } from '@standard-server/core';

package/dist/plugins/index.d.mts

@@ -1,14 +1,15 @@
 import { Value, Promisable, ThrowableError } from '@orpc/shared';
-import { StandardLazyRequest, StandardHeaders, StandardMethod, StandardResponse } from '@standard-server/core';
+import { StandardLazyRequest, StandardResponse, StandardHeaders, StandardMethod } from '@standard-server/core';
 import { Context } from '../index.mjs';
 import { StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions, StandardHandlerOptions, StandardHandlerInterceptorOptions } from '../adapters/standard/index.mjs';
-export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.BllfVJLm.mjs';
+export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.B4hFgqPr.mjs';
+export { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from '@orpc/client/plugins';
 import '@orpc/client';
 import '@orpc/contract';
 
 /**
- * Content type for batch responses that use the length-prefixed binary framing
- * (streaming mode, and buffered mode when any sub-response contains binary).
+ * Content type for batch responses that use the length-prefixed binary framing,
+ * which they do when any sub-response contains binary or is a stream.
  *
  * Decoding is driven by the `standard-server` body hint, not this header,
  * so it only serves to describe the payload to logs, proxies, and dev tools.
@@ -16,40 +17,51 @@ import '@orpc/contract';
 declare const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 interface BatchHandlerPluginOptions<T extends Context> {
     /**
-     * The max size of the batch allowed.
+     * The max size of the batch allowed. Larger batches are rejected with a `413`,
+     * so keep the client Batch Link Plugin's `maxSize` at or below it.
      *
-     * @default 10
+     * @default DEFAULT_BATCH_MAX_SIZE (10)
+     * @see {@link https://orpc.dev/docs/plugins/batch#max-size | Batch Plugin - Max Size}
      */
-    maxSize?: Value<Promisable<number>, [options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    maxSize?: Value<Promisable<number>, [options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
     /**
      * Map each subrequest in the batch before it is processed.
      *
      * @default merges the batch request headers into the subrequest, giving them priority over
      * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
      */
-    mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
+    mapSubrequest?: ((subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest) | undefined;
+    /**
+     * Map each sub-response in the batch before it is sent.
+     *
+     * @default removes the headers the batch response already has with the same value, which the client
+     * merges back, and `set-cookie`, which the browser ignores there and JavaScript could read
+     */
+    mapSubresponse?: ((subresponse: StandardResponse, partialBatchResponse: Pick<StandardResponse, 'status' | 'headers'>, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardResponse) | undefined;
     /**
      * Success batch response status code.
      *
      * @default 207
      */
-    successStatus?: Value<Promisable<number>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]>;
+    successStatus?: Value<Promisable<number>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
     /**
      * Success batch response headers.
      *
+     * The batch response also gets the cookies its sub-responses set, and the headers they all share.
+     * Headers set here win, and setting one to `undefined` keeps it off, except `set-cookie` and `vary`, which merge.
+     *
      * @default {}
      */
-    headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]>;
+    headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
     /**
-     * Keep-alive settings for streaming batch responses.
+     * Keep-alive settings for batch responses that stream.
      *
      * When enabled, a zero-length length-prefixed frame is sent periodically while the
      * stream is idle (no message sent for `interval` ms). Clients ignore these frames.
-     * Only applies to streaming mode.
      *
      * @default { enabled: true, interval: 15000 }
      */
-    keepAlive?: undefined | {
+    keepAlive?: {
         /**
          * If true, a keep-alive frame is sent periodically while the stream is idle.
          *
@@ -61,14 +73,17 @@ interface BatchHandlerPluginOptions<T extends Context> {
          *
          * @default 15000
          */
-        interval?: number;
-    };
+        interval?: number | undefined;
+    } | undefined;
 }
 /**
  * Handles batch requests sent by the client Batch Link Plugin, splitting each
- * batch into sub-requests and streaming their responses back together.
+ * batch into sub-requests and sending their responses back together.
  *
  * @remarks
+ * The batch starts the response once every sub-response is ready, so it carries the cookies sub-requests
+ * set and the headers every sub-response shares. It streams when a sub-response is a stream.
+ *
  * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
  *
  * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
@@ -82,6 +97,7 @@ declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPl
     after: string[];
     private readonly maxSize;
     private readonly mapSubrequest;
+    private readonly mapSubresponse;
     private readonly successStatus;
     private readonly headers;
     private readonly keepAliveEnabled;
@@ -95,39 +111,45 @@ interface CORSHandlerPluginOptions<T extends Context> {
      * Configures the `Access-Control-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      *
+     * A function must only return origins it has validated: returning the incoming origin
+     * unchecked allows every origin.
+     *
      * @default '*'
      */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
     /**
      * Configures the `Timing-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
      */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
      * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
      */
-    allowMethods?: readonly string[];
+    allowMethods?: readonly string[] | undefined;
     /**
      * Configures the `Access-Control-Allow-Headers` header for preflight requests.
      * Falls back to the request's `Access-Control-Request-Headers` if not set.
      * When set, it replaces that fallback, so include every non-safelisted header
      * clients send, such as `Content-Type`.
      */
-    allowHeaders?: readonly string[];
+    allowHeaders?: readonly string[] | undefined;
     /**
      * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
      */
-    maxAge?: number;
+    maxAge?: number | undefined;
     /**
      * Configures the `Access-Control-Allow-Credentials` header.
+     *
+     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+     * authenticated requests as your users and read the responses.
      */
-    credentials?: boolean;
+    credentials?: boolean | undefined;
     /**
      * Configures the `Access-Control-Expose-Headers` header.
      */
-    exposeHeaders?: readonly string[];
+    exposeHeaders?: readonly string[] | undefined;
 }
 /**
  * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
@@ -177,7 +199,7 @@ interface MethodOverrideHandlerPluginOptions {
      *
      * @default 'method'
      */
-    param?: string;
+    param?: string | undefined;
     /**
      * The methods a POST request may be overridden to.
      *
@@ -186,7 +208,7 @@ interface MethodOverrideHandlerPluginOptions {
      *
      * @default ['PUT', 'PATCH', 'DELETE']
      */
-    methods?: readonly StandardMethod[];
+    methods?: readonly StandardMethod[] | undefined;
 }
 /**
  * Overrides the HTTP method of a POST request based on a query parameter,
@@ -207,31 +229,6 @@ declare class MethodOverrideHandlerPlugin<T extends Context> implements Standard
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Rejects requests whose decoded input contains prototype-polluting keys: an own
- * `__proto__` key, or an own `constructor` key holding a `prototype` key. oRPC's own
- * decoding never assigns through the prototype chain, so this plugin exists to stop such
- * keys from reaching application code that merges, clones, or path-sets input with a
- * library vulnerable to prototype pollution. An `AsyncIteratorObject` input is checked
- * value by value as it arrives, and a polluting value fails that iteration instead.
- *
- * @see {@link https://orpc.dev/docs/plugins/prototype-pollution-protection | Prototype Pollution Protection Plugin}
- */
-declare class PrototypePollutionProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-    private rejectPollutingInput;
-    /**
-     * Walks the containers the built-in codecs can produce: arrays, maps, sets, and plain
-     * objects, including null-prototype ones. Arrays get the same key checks as plain objects,
-     * since structured clone, as used over MessagePort, keeps named keys like `__proto__` on
-     * them. Other objects, such as files and dates, carry no attacker-authored keys and are
-     * left alone. The walk is iterative, so input nested deeper than the call stack allows
-     * still gets the intended verdict instead of a `RangeError`.
-     */
-    private containsPollutingKey;
-}
-
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -277,7 +274,7 @@ interface ResponseCompressionHandlerPluginOptions<T extends Context> {
      *
      * @default ['gzip', 'deflate']
      */
-    encodings?: readonly ('gzip' | 'deflate' | 'deflate-raw')[];
+    encodings?: readonly ('gzip' | 'deflate' | 'deflate-raw')[] | undefined;
     /**
      * The minimum response size in bytes required to trigger compression.
      * Responses smaller than this threshold will not be compressed to avoid overhead.
@@ -285,7 +282,7 @@ interface ResponseCompressionHandlerPluginOptions<T extends Context> {
      *
      * @default 1024 (1KB)
      */
-    threshold?: number;
+    threshold?: number | undefined;
     /**
      * Determines whether a response with the given Content-Type should be compressed.
      * Only consulted for binary transfers (streams, files, and file form-data parts).
@@ -293,7 +290,7 @@ interface ResponseCompressionHandlerPluginOptions<T extends Context> {
      *
      * @default isCompressibleContentType (covers common text-based formats)
      */
-    isCompressibleContentType?: (contentType: string | null | undefined, options: StandardHandlerRoutingInterceptorOptions<T>) => boolean;
+    isCompressibleContentType?: ((contentType: string | null | undefined, options: StandardHandlerRoutingInterceptorOptions<T>) => boolean) | undefined;
 }
 /**
  * Compresses response bodies based on the client's Accept-Encoding header.
@@ -384,6 +381,18 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Keeps the request signal and a streaming output (async iterator object or readable stream) in sync:
+ * cancelling the output aborts the signal with an `AbortError`,
+ * and aborting the signal ends the output with the abort reason and cancels it.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/signal-sync | Signal Sync Plugin}
+ */
+declare class SignalSyncHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
 interface TimeoutHandlerPluginOptions<T extends Context> {
     /**
      * Timeout in milliseconds before the request signal is aborted.
@@ -402,7 +411,7 @@ interface TimeoutHandlerPluginOptions<T extends Context> {
      *
      * @default undefined (streaming responses run without limit)
      */
-    streamingTimeout?: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+    streamingTimeout?: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]> | undefined;
 }
 /**
  * The Timeout Handler Plugin aborts the request signal with an `AbortError`
@@ -419,5 +428,5 @@ declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, PrototypePollutionProtectionHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SignalSyncHandlerPlugin, TimeoutHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };