@orpc/server 2.0.0-beta.48 → 2.0.0-beta.49

package/dist/plugins/cors.d.ts

@@ -0,0 +1,73 @@
+import type { Promisable, Value } from '@orpc/shared';
+import type { StandardHandlerOptions, StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+export interface CORSHandlerPluginOptions<T extends Context> {
+    /**
+     * Configures the `Access-Control-Allow-Origin` header.
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+     *
+     * A function must only return origins it has validated: returning the incoming origin
+     * unchecked allows every origin.
+     *
+     * @default '*'
+     */
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [
+        origin: string,
+        options: StandardHandlerRoutingInterceptorOptions<T>
+    ]> | undefined;
+    /**
+     * Configures the `Timing-Allow-Origin` header.
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+     */
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [
+        origin: string,
+        options: StandardHandlerRoutingInterceptorOptions<T>
+    ]> | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Methods` header for preflight requests.
+     *
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
+     */
+    allowMethods?: readonly string[] | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Headers` header for preflight requests.
+     * Falls back to the request's `Access-Control-Request-Headers` if not set.
+     * When set, it replaces that fallback, so include every non-safelisted header
+     * clients send, such as `Content-Type`.
+     */
+    allowHeaders?: readonly string[] | undefined;
+    /**
+     * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
+     */
+    maxAge?: number | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Credentials` header.
+     *
+     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+     * authenticated requests as your users and read the responses.
+     */
+    credentials?: boolean | undefined;
+    /**
+     * Configures the `Access-Control-Expose-Headers` header.
+     */
+    exposeHeaders?: readonly string[] | undefined;
+}
+/**
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+ */
+export declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    private readonly options;
+    name: string;
+    /**
+     * - Do not create spans for CORS preflight requests.
+     * - Run CORS interceptors before batch interceptors so headers are applied to
+     *  the actual response rather than sub-responses.
+     */
+    after: string[];
+    constructor(options?: CORSHandlerPluginOptions<T>);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private resolveOrigin;
+}

package/dist/plugins/cors.js

@@ -0,0 +1,112 @@
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standard-server/core';
+/**
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+ */
+export class CORSHandlerPlugin {
+    options;
+    name = '~cors';
+    /**
+     * - Do not create spans for CORS preflight requests.
+     * - Run CORS interceptors before batch interceptors so headers are applied to
+     *  the actual response rather than sub-responses.
+     */
+    after = ['~tracing', '~batch'];
+    constructor(options = {}) {
+        const defaults = {
+            origin: '*',
+            allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY'],
+        };
+        this.options = {
+            ...defaults,
+            ...options,
+        };
+    }
+    init(options) {
+        const corsHeadersInterceptor = async (interceptorOptions) => {
+            const result = await interceptorOptions.next();
+            if (!result.matched) {
+                return result;
+            }
+            const resHeaders = { ...result.response.headers };
+            const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+            const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
+            const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
+            if (allowOrigin.value !== undefined) {
+                resHeaders['access-control-allow-origin'] = allowOrigin.value;
+            }
+            if (timingAllowOrigin.value !== undefined) {
+                resHeaders['timing-allow-origin'] = timingAllowOrigin.value;
+            }
+            if (allowOrigin.varies || timingAllowOrigin.varies) {
+                const existingVary = flattenStandardHeader(resHeaders.vary);
+                if (!existingVary?.split(',').some((v) => v.trim().toLowerCase() === 'origin')) {
+                    resHeaders.vary = existingVary ? `${existingVary}, Origin` : 'Origin';
+                }
+            }
+            if (this.options.credentials) {
+                resHeaders['access-control-allow-credentials'] = 'true';
+            }
+            if (this.options.exposeHeaders?.length) {
+                resHeaders['access-control-expose-headers'] = flattenStandardHeader(this.options.exposeHeaders);
+            }
+            return { ...result, response: { ...result.response, headers: resHeaders } };
+        };
+        const preflightInterceptor = async (interceptorOptions) => {
+            if (interceptorOptions.request.method === 'OPTIONS') {
+                const resHeaders = {};
+                if (this.options.maxAge !== undefined) {
+                    resHeaders['access-control-max-age'] = this.options.maxAge.toString();
+                }
+                if (this.options.allowMethods?.length) {
+                    resHeaders['access-control-allow-methods'] = flattenStandardHeader(this.options.allowMethods);
+                }
+                const allowHeaders = this.options.allowHeaders ??
+                    interceptorOptions.request.headers['access-control-request-headers'];
+                if (typeof allowHeaders === 'string' || allowHeaders?.length) {
+                    resHeaders['access-control-allow-headers'] = flattenStandardHeader(allowHeaders);
+                }
+                return {
+                    matched: true,
+                    response: {
+                        status: 204,
+                        headers: resHeaders,
+                        body: undefined,
+                    },
+                };
+            }
+            return interceptorOptions.next();
+        };
+        return {
+            ...options,
+            routingInterceptors: [
+                corsHeadersInterceptor,
+                preflightInterceptor,
+                ...toArray(options.routingInterceptors),
+            ],
+        };
+    }
+    async resolveOrigin(option, origin, interceptorOptions) {
+        if (typeof option === 'function') {
+            if (origin === undefined) {
+                return { value: undefined, varies: true };
+            }
+            const allowed = toArray(await option(origin, interceptorOptions));
+            if (allowed.includes('*')) {
+                return { value: '*', varies: true };
+            }
+            return { value: allowed.includes(origin) ? origin : undefined, varies: true };
+        }
+        const allowed = toArray(await option);
+        if (allowed.includes('*')) {
+            return { value: '*', varies: false };
+        }
+        if (origin !== undefined && allowed.includes(origin)) {
+            return { value: origin, varies: true };
+        }
+        return { value: undefined, varies: allowed.length > 0 };
+    }
+}

package/dist/plugins/get-method-csrf-protection.d.ts

@@ -0,0 +1,23 @@
+import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+export declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}

package/dist/plugins/get-method-csrf-protection.js

@@ -0,0 +1,64 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standard-server/core';
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+export class GetMethodCsrfProtectionHandlerPlugin {
+    name = '~get-method-csrf-protection';
+    init(options) {
+        /**
+         * Batch sub-requests are judged individually here, which is safe: navigations cannot
+         * carry the custom `orpc-batch` header, and the batch plugin's default `mapSubrequest`
+         * keeps the transport headers authoritative over client-authored sub-request headers.
+         */
+        const interceptor = (interceptorOptions) => {
+            if (this.isAllowed(interceptorOptions)) {
+                return interceptorOptions.next();
+            }
+            throw new ORPCError('FORBIDDEN', { message: 'Request blocked by CSRF protection.' });
+        };
+        return {
+            ...options,
+            interceptors: [interceptor, ...toArray(options.interceptors)],
+        };
+    }
+    isAllowed({ request }) {
+        // Navigations can only use `GET` or `POST` per the HTML spec, and `POST` is unsafe, so
+        // `GET` is the only method `SameSite=Lax` cookies ride cross-site.
+        if (request.method !== 'GET') {
+            return true;
+        }
+        const site = flattenStandardHeader(request.headers['sec-fetch-site'])?.toLowerCase();
+        // Absent for non-browser clients, browsers too old to send Fetch Metadata, and any browser
+        // over plain HTTP, where the headers are never appended. Nothing to judge in those cases.
+        // Same-site origins are trusted, matching the `SameSite` cookie model where the site is
+        // the trust boundary.
+        if (site === undefined || site === 'same-origin' || site === 'same-site') {
+            return true;
+        }
+        // Cross-site, and on browser-initiated requests such as email links, `Lax` cookies ride
+        // only top-level navigations: mode `navigate` targeting dest `document`. Embedded
+        // navigations such as `<iframe>` pass, since they are not top-level. Browsers send both
+        // headers together, so a stripped one blocks the request rather than bypassing the check.
+        const mode = flattenStandardHeader(request.headers['sec-fetch-mode'])?.toLowerCase();
+        const dest = flattenStandardHeader(request.headers['sec-fetch-dest'])?.toLowerCase();
+        if (mode === undefined || dest === undefined) {
+            return false;
+        }
+        return mode !== 'navigate' || dest !== 'document';
+    }
+}

package/dist/plugins/head-method.d.ts

@@ -0,0 +1,23 @@
+import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+/**
+ * Answers `HEAD` requests with the headers of the matching `GET` procedure, like Fastify's
+ * `exposeHeadRoutes`, so clients can check a resource's existence, type, and size without
+ * downloading it. A procedure routed as `HEAD` itself takes precedence over the `GET` one.
+ *
+ * @remarks
+ * - `HEAD` responses never carry a body: the plugin discards it, cancelling streams and
+ *   event iterators, and keeps the headers it implies, such as `Content-Type`, and
+ *   `Content-Length` when its size is known up front.
+ * - `GET` procedures still need to be reachable, so with `RPCHandler`, `GET` must be in `allowMethods`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/head-method | HEAD Method Plugin}
+ */
+export declare class HeadMethodHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
+     */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/head-method.js

@@ -0,0 +1,104 @@
+import { isAsyncIteratorObject, toArray } from '@orpc/shared';
+import { cancelStandardBody, getRequiredStandardBodyHint } from '@standard-server/core';
+import { toFetchBody } from '@standard-server/fetch';
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+/**
+ * Answers `HEAD` requests with the headers of the matching `GET` procedure, like Fastify's
+ * `exposeHeadRoutes`, so clients can check a resource's existence, type, and size without
+ * downloading it. A procedure routed as `HEAD` itself takes precedence over the `GET` one.
+ *
+ * @remarks
+ * - `HEAD` responses never carry a body: the plugin discards it, cancelling streams and
+ *   event iterators, and keeps the headers it implies, such as `Content-Type`, and
+ *   `Content-Length` when its size is known up front.
+ * - `GET` procedures still need to be reachable, so with `RPCHandler`, `GET` must be in `allowMethods`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/head-method | HEAD Method Plugin}
+ */
+export class HeadMethodHandlerPlugin {
+    name = '~head-method';
+    /**
+     * Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
+     */
+    after = ['~response-compression'];
+    init(options) {
+        // oxlint-disable-next-line unicorn/consistent-function-scoping
+        const bodyInterceptor = async ({ next, request }) => {
+            if (request.method !== 'HEAD') {
+                return next();
+            }
+            const result = await next();
+            if (!result.matched) {
+                return result;
+            }
+            return { ...result, response: toHeadResponse(result.response) };
+        };
+        /**
+         * Placed last, so falling back to `GET` repeats routing rather than the routing interceptors before this one.
+         */
+        // oxlint-disable-next-line unicorn/consistent-function-scoping
+        const fallbackInterceptor = async (interceptorOptions) => {
+            const { next, request } = interceptorOptions;
+            if (request.method !== 'HEAD') {
+                return next();
+            }
+            const result = await next();
+            if (result.matched) {
+                return result;
+            }
+            return next({
+                ...interceptorOptions,
+                request: { ...request, method: 'GET' },
+            });
+        };
+        return {
+            ...options,
+            routingInterceptors: [
+                bodyInterceptor,
+                ...toArray(options.routingInterceptors),
+                fallbackInterceptor,
+            ],
+        };
+    }
+}
+/**
+ * Replaces the body with an empty stream, keeping the headers adapters derive from it.
+ * An empty stream rather than no body, because adapters drop `Content-Type` and `Content-Length` when the body is `undefined`,
+ * and an empty `Standard-Server` hint rather than none, so they do not hint the stream as `octet-stream`.
+ */
+function toHeadResponse(response) {
+    const { body } = response;
+    if (body === undefined) {
+        return response;
+    }
+    if (isAsyncIteratorObject(body)) {
+        discardBody(body);
+        const headers = { ...response.headers, 'content-length': undefined };
+        headers['content-type'] ??= 'text/event-stream';
+        headers['standard-server'] = getRequiredStandardBodyHint('event-stream', headers) ?? [];
+        return { ...response, headers, body: createEmptyStream() };
+    }
+    const [encoded, headers] = toFetchBody(body, response.headers);
+    if (encoded instanceof ReadableStream) {
+        discardBody(encoded);
+    }
+    else if (encoded instanceof FormData) {
+        // The encoded body is never cancelled, since undici rejects unhandled when cancelled mid-serialization
+        headers['standard-server'] = [];
+        headers['content-type'] = new Response(encoded).headers.get('content-type');
+    }
+    else if (typeof encoded === 'string' || encoded instanceof URLSearchParams) {
+        headers['standard-server'] ??= [];
+        headers['content-length'] = textEncoder.encode(encoded.toString()).byteLength.toString();
+    }
+    return { ...response, headers, body: createEmptyStream() };
+}
+function createEmptyStream() {
+    return new ReadableStream({ start: (controller) => controller.close() });
+}
+/**
+ * Nothing reads the body anymore, so a failure to cancel it has nowhere to go.
+ */
+function discardBody(body) {
+    cancelStandardBody(body).catch(() => { });
+}

package/dist/plugins/index.d.ts

@@ -0,0 +1,39 @@
+export * from './batch.ts';
+export * from './cors.ts';
+export { 
+/**
+ * @deprecated Use `CORSHandlerPlugin` instead.
+ */
+CORSHandlerPlugin as CORSPlugin, } from './cors.ts';
+export * from './get-method-csrf-protection.ts';
+export * from './head-method.ts';
+export * from './method-override.ts';
+export * from './request-compression.ts';
+export * from './request-headers.ts';
+export { 
+/**
+ * @deprecated Use `RequestHeadersHandlerPlugin` instead.
+ */
+RequestHeadersHandlerPlugin as RequestHeadersPlugin, } from './request-headers.ts';
+export type { 
+/**
+ * @deprecated Use `RequestHeadersHandlerPluginContext` instead.
+ */
+RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, } from './request-headers.ts';
+export * from './request-limit.ts';
+export * from './response-compression.ts';
+export * from './response-headers.ts';
+export { 
+/**
+ * @deprecated Use `ResponseHeadersHandlerPlugin` instead.
+ */
+ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, } from './response-headers.ts';
+export type { 
+/**
+ * @deprecated Use `ResponseHeadersHandlerPluginContext` instead.
+ */
+ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, } from './response-headers.ts';
+export * from './rethrow.ts';
+export * from './signal-sync.ts';
+export * from './timeout.ts';
+export { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from '@orpc/client/plugins';

package/dist/plugins/index.js

@@ -0,0 +1,29 @@
+export * from './batch.js';
+export * from './cors.js';
+export { 
+/**
+ * @deprecated Use `CORSHandlerPlugin` instead.
+ */
+CORSHandlerPlugin as CORSPlugin, } from './cors.js';
+export * from './get-method-csrf-protection.js';
+export * from './head-method.js';
+export * from './method-override.js';
+export * from './request-compression.js';
+export * from './request-headers.js';
+export { 
+/**
+ * @deprecated Use `RequestHeadersHandlerPlugin` instead.
+ */
+RequestHeadersHandlerPlugin as RequestHeadersPlugin, } from './request-headers.js';
+export * from './request-limit.js';
+export * from './response-compression.js';
+export * from './response-headers.js';
+export { 
+/**
+ * @deprecated Use `ResponseHeadersHandlerPlugin` instead.
+ */
+ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, } from './response-headers.js';
+export * from './rethrow.js';
+export * from './signal-sync.js';
+export * from './timeout.js';
+export { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from '@orpc/client/plugins';

package/dist/plugins/method-override.d.ts

@@ -0,0 +1,38 @@
+import type { StandardMethod } from '@standard-server/core';
+import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+export interface MethodOverrideHandlerPluginOptions {
+    /**
+     * The query parameter carrying the override method.
+     *
+     * @default 'method'
+     */
+    param?: string | undefined;
+    /**
+     * The methods a POST request may be overridden to.
+     *
+     * GET and HEAD are excluded by default because they switch input decoding
+     * from the request body to the query string and widen the CSRF surface.
+     *
+     * @default ['PUT', 'PATCH', 'DELETE']
+     */
+    methods?: readonly StandardMethod[] | undefined;
+}
+/**
+ * Overrides the HTTP method of a POST request based on a query parameter,
+ * so HTML forms (which only support GET and POST) can invoke procedures
+ * routed as PUT, PATCH, or DELETE.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+ */
+export declare class MethodOverrideHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should override batch sub-request methods, not the original batch request.
+     */
+    before: string[];
+    private readonly param;
+    private readonly methods;
+    constructor(options?: MethodOverrideHandlerPluginOptions);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/method-override.js

@@ -0,0 +1,50 @@
+import { toArray } from '@orpc/shared';
+import { parseStandardUrl } from '@standard-server/core';
+/**
+ * Overrides the HTTP method of a POST request based on a query parameter,
+ * so HTML forms (which only support GET and POST) can invoke procedures
+ * routed as PUT, PATCH, or DELETE.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+ */
+export class MethodOverrideHandlerPlugin {
+    name = '~method-override';
+    /**
+     * Should override batch sub-request methods, not the original batch request.
+     */
+    before = ['~batch'];
+    param;
+    methods;
+    constructor(options = {}) {
+        this.param = options.param ?? 'method';
+        this.methods = new Set((options.methods ?? ['PUT', 'PATCH', 'DELETE']).map((method) => method.toUpperCase()));
+    }
+    init(options) {
+        const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+            const { request } = interceptorOptions;
+            if (request.method !== 'POST') {
+                return next();
+            }
+            const [pathname, search, hash] = parseStandardUrl(request.url);
+            const params = new URLSearchParams(search);
+            const raw = params.getAll(this.param).at(-1);
+            if (raw === undefined) {
+                return next();
+            }
+            const method = raw.toUpperCase();
+            if (!this.methods.has(method)) {
+                return next();
+            }
+            params.delete(this.param);
+            const url = `${pathname}${params.size ? `?${params}` : ''}${hash ?? ''}`;
+            return next({
+                ...interceptorOptions,
+                request: { ...request, method, url },
+            });
+        };
+        return {
+            ...options,
+            routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)],
+        };
+    }
+}

package/dist/plugins/request-compression.d.ts

@@ -0,0 +1,16 @@
+import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+/**
+ * Decompresses incoming request bodies based on the Content-Encoding header,
+ * supporting gzip, deflate, and deflate-raw.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
+ */
+export declare class RequestCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /**
+     * Should decompress the original batch request body instead of sub-requests.
+     */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/request-compression.js

@@ -0,0 +1,82 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standard-server/core';
+import { toFetchHeaders, toStandardBody } from '@standard-server/fetch';
+/**
+ * Each coding adds a decompressor to the chain, so an unbounded list lets a tiny
+ * request cost unbounded CPU and memory. Same limit as undici and curl.
+ */
+const MAX_CONTENT_ENCODINGS = 5;
+/**
+ * Decompresses incoming request bodies based on the Content-Encoding header,
+ * supporting gzip, deflate, and deflate-raw.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
+ */
+export class RequestCompressionHandlerPlugin {
+    name = '~request-compression';
+    /**
+     * Should decompress the original batch request body instead of sub-requests.
+     */
+    after = ['~batch'];
+    init(options) {
+        // oxlint-disable-next-line unicorn/consistent-function-scoping
+        const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+            const encodings = parseContentEncodings(flattenStandardHeader(interceptorOptions.request.headers['content-encoding']));
+            if (encodings.length === 0 || !encodings.every(isSupportedEncoding)) {
+                return next();
+            }
+            const decompressedHeaders = {
+                ...interceptorOptions.request.headers,
+                'content-length': undefined,
+                'content-encoding': undefined,
+            };
+            return next({
+                ...interceptorOptions,
+                request: {
+                    ...interceptorOptions.request,
+                    headers: decompressedHeaders,
+                    async resolveBody(hint) {
+                        const stream = await interceptorOptions.request.resolveBody('octet-stream');
+                        // adapter might not support hint (e.g peer adapter)
+                        if (!(stream instanceof ReadableStream)) {
+                            return stream;
+                        }
+                        if (encodings.length > MAX_CONTENT_ENCODINGS) {
+                            throw new ORPCError('UNSUPPORTED_MEDIA_TYPE', {
+                                message: 'Too many content encodings.',
+                            });
+                        }
+                        let decompressedStream = stream;
+                        for (let i = encodings.length - 1; i >= 0; i--) {
+                            decompressedStream = decompressedStream.pipeThrough(new DecompressionStream(encodings[i]));
+                        }
+                        const response = new Response(decompressedStream, {
+                            headers: toFetchHeaders(decompressedHeaders),
+                        });
+                        return toStandardBody(response, { hint });
+                    },
+                },
+            });
+        };
+        return {
+            ...options,
+            routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)],
+        };
+    }
+}
+const SUPPORTED_ENCODINGS = ['gzip', 'deflate', 'deflate-raw'];
+function isSupportedEncoding(encoding) {
+    return SUPPORTED_ENCODINGS.includes(encoding);
+}
+/**
+ * Parse Content-Encoding into ordered codings (order applied).
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc9110.html#name-content-encoding
+ */
+function parseContentEncodings(header) {
+    if (header === undefined) {
+        return [];
+    }
+    return header.split(',').map((part) => part.trim().toLowerCase());
+}