@orpc/server 2.0.0-beta.49 → 2.0.0-beta.50

package/dist/plugins/cors.d.ts

@@ -1,56 +1,52 @@
-import type { Promisable, Value } from '@orpc/shared';
-import type { StandardHandlerOptions, StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions } from '../adapters/standard/index.ts';
-import type { Context } from '../context.ts';
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions, StandardHandlerRoutingInterceptorOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+import { Promisable, Value } from "@orpc/shared";
 export interface CORSHandlerPluginOptions<T extends Context> {
-    /**
-     * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
-     *
-     * A function must only return origins it has validated: returning the incoming origin
-     * unchecked allows every origin.
-     *
-     * @default '*'
-     */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [
-        origin: string,
-        options: StandardHandlerRoutingInterceptorOptions<T>
-    ]> | undefined;
-    /**
-     * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
-     */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [
-        origin: string,
-        options: StandardHandlerRoutingInterceptorOptions<T>
-    ]> | undefined;
-    /**
-     * Configures the `Access-Control-Allow-Methods` header for preflight requests.
-     *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
-     */
-    allowMethods?: readonly string[] | undefined;
-    /**
-     * Configures the `Access-Control-Allow-Headers` header for preflight requests.
-     * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     * When set, it replaces that fallback, so include every non-safelisted header
-     * clients send, such as `Content-Type`.
-     */
-    allowHeaders?: readonly string[] | undefined;
-    /**
-     * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     */
-    maxAge?: number | undefined;
-    /**
-     * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
-     * authenticated requests as your users and read the responses.
-     */
-    credentials?: boolean | undefined;
-    /**
-     * Configures the `Access-Control-Expose-Headers` header.
-     */
-    exposeHeaders?: readonly string[] | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Origin` header.
+   * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+   *
+   * A function must only return origins it has validated: returning the incoming origin
+   * unchecked allows every origin.
+   *
+   * @default '*'
+   */
+  origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Configures the `Timing-Allow-Origin` header.
+   * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+   */
+  timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Methods` header for preflight requests.
+   *
+   * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
+   */
+  allowMethods?: readonly string[] | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Headers` header for preflight requests.
+   * Falls back to the request's `Access-Control-Request-Headers` if not set.
+   * When set, it replaces that fallback, so include every non-safelisted header
+   * clients send, such as `Content-Type`.
+   */
+  allowHeaders?: readonly string[] | undefined;
+  /**
+   * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
+   */
+  maxAge?: number | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Credentials` header.
+   *
+   * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+   * authenticated requests as your users and read the responses.
+   */
+  credentials?: boolean | undefined;
+  /**
+   * Configures the `Access-Control-Expose-Headers` header.
+   */
+  exposeHeaders?: readonly string[] | undefined;
 }
 /**
  * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
@@ -59,15 +55,15 @@ export interface CORSHandlerPluginOptions<T extends Context> {
  * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
  */
 export declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    private readonly options;
-    name: string;
-    /**
-     * - Do not create spans for CORS preflight requests.
-     * - Run CORS interceptors before batch interceptors so headers are applied to
-     *  the actual response rather than sub-responses.
-     */
-    after: string[];
-    constructor(options?: CORSHandlerPluginOptions<T>);
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-    private resolveOrigin;
-}
+  private readonly options;
+  name: string;
+  /**
+   * - Do not create spans for CORS preflight requests.
+   * - Run CORS interceptors before batch interceptors so headers are applied to
+   *  the actual response rather than sub-responses.
+   */
+  after: string[];
+  constructor(options?: CORSHandlerPluginOptions<T>);
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+  private resolveOrigin;
+}

package/dist/plugins/cors.js

@@ -1,112 +1,119 @@
-import { toArray } from '@orpc/shared';
-import { flattenStandardHeader } from '@standard-server/core';
+import { toArray } from "@orpc/shared";
+import { flattenStandardHeader } from "@standard-server/core";
+// src/plugins/cors.ts
 /**
- * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
- * for your API, including preflight requests.
- *
- * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
- */
-export class CORSHandlerPlugin {
-    options;
-    name = '~cors';
-    /**
-     * - Do not create spans for CORS preflight requests.
-     * - Run CORS interceptors before batch interceptors so headers are applied to
-     *  the actual response rather than sub-responses.
-     */
-    after = ['~tracing', '~batch'];
-    constructor(options = {}) {
-        const defaults = {
-            origin: '*',
-            allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY'],
-        };
-        this.options = {
-            ...defaults,
-            ...options,
-        };
-    }
-    init(options) {
-        const corsHeadersInterceptor = async (interceptorOptions) => {
-            const result = await interceptorOptions.next();
-            if (!result.matched) {
-                return result;
-            }
-            const resHeaders = { ...result.response.headers };
-            const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
-            const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
-            const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
-            if (allowOrigin.value !== undefined) {
-                resHeaders['access-control-allow-origin'] = allowOrigin.value;
-            }
-            if (timingAllowOrigin.value !== undefined) {
-                resHeaders['timing-allow-origin'] = timingAllowOrigin.value;
-            }
-            if (allowOrigin.varies || timingAllowOrigin.varies) {
-                const existingVary = flattenStandardHeader(resHeaders.vary);
-                if (!existingVary?.split(',').some((v) => v.trim().toLowerCase() === 'origin')) {
-                    resHeaders.vary = existingVary ? `${existingVary}, Origin` : 'Origin';
-                }
-            }
-            if (this.options.credentials) {
-                resHeaders['access-control-allow-credentials'] = 'true';
-            }
-            if (this.options.exposeHeaders?.length) {
-                resHeaders['access-control-expose-headers'] = flattenStandardHeader(this.options.exposeHeaders);
-            }
-            return { ...result, response: { ...result.response, headers: resHeaders } };
-        };
-        const preflightInterceptor = async (interceptorOptions) => {
-            if (interceptorOptions.request.method === 'OPTIONS') {
-                const resHeaders = {};
-                if (this.options.maxAge !== undefined) {
-                    resHeaders['access-control-max-age'] = this.options.maxAge.toString();
-                }
-                if (this.options.allowMethods?.length) {
-                    resHeaders['access-control-allow-methods'] = flattenStandardHeader(this.options.allowMethods);
-                }
-                const allowHeaders = this.options.allowHeaders ??
-                    interceptorOptions.request.headers['access-control-request-headers'];
-                if (typeof allowHeaders === 'string' || allowHeaders?.length) {
-                    resHeaders['access-control-allow-headers'] = flattenStandardHeader(allowHeaders);
-                }
-                return {
-                    matched: true,
-                    response: {
-                        status: 204,
-                        headers: resHeaders,
-                        body: undefined,
-                    },
-                };
-            }
-            return interceptorOptions.next();
-        };
-        return {
-            ...options,
-            routingInterceptors: [
-                corsHeadersInterceptor,
-                preflightInterceptor,
-                ...toArray(options.routingInterceptors),
-            ],
-        };
-    }
-    async resolveOrigin(option, origin, interceptorOptions) {
-        if (typeof option === 'function') {
-            if (origin === undefined) {
-                return { value: undefined, varies: true };
-            }
-            const allowed = toArray(await option(origin, interceptorOptions));
-            if (allowed.includes('*')) {
-                return { value: '*', varies: true };
-            }
-            return { value: allowed.includes(origin) ? origin : undefined, varies: true };
-        }
-        const allowed = toArray(await option);
-        if (allowed.includes('*')) {
-            return { value: '*', varies: false };
-        }
-        if (origin !== undefined && allowed.includes(origin)) {
-            return { value: origin, varies: true };
-        }
-        return { value: undefined, varies: allowed.length > 0 };
-    }
-}
+* Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+* for your API, including preflight requests.
+*
+* @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+*/
+var CORSHandlerPlugin = class {
+	options;
+	name = "~cors";
+	/**
+	* - Do not create spans for CORS preflight requests.
+	* - Run CORS interceptors before batch interceptors so headers are applied to
+	*  the actual response rather than sub-responses.
+	*/
+	after = ["~tracing", "~batch"];
+	constructor(options = {}) {
+		const defaults = {
+			origin: "*",
+			allowMethods: [
+				"GET",
+				"HEAD",
+				"PUT",
+				"POST",
+				"DELETE",
+				"PATCH",
+				"QUERY"
+			]
+		};
+		this.options = {
+			...defaults,
+			...options
+		};
+	}
+	init(options) {
+		const corsHeadersInterceptor = async (interceptorOptions) => {
+			const result = await interceptorOptions.next();
+			if (!result.matched) return result;
+			const resHeaders = { ...result.response.headers };
+			const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+			const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
+			const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
+			if (allowOrigin.value !== void 0) resHeaders["access-control-allow-origin"] = allowOrigin.value;
+			if (timingAllowOrigin.value !== void 0) resHeaders["timing-allow-origin"] = timingAllowOrigin.value;
+			if (allowOrigin.varies || timingAllowOrigin.varies) {
+				const existingVary = flattenStandardHeader(resHeaders.vary);
+				if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
+			}
+			if (this.options.credentials) resHeaders["access-control-allow-credentials"] = "true";
+			if (this.options.exposeHeaders?.length) resHeaders["access-control-expose-headers"] = flattenStandardHeader(this.options.exposeHeaders);
+			return {
+				...result,
+				response: {
+					...result.response,
+					headers: resHeaders
+				}
+			};
+		};
+		const preflightInterceptor = async (interceptorOptions) => {
+			if (interceptorOptions.request.method === "OPTIONS") {
+				const resHeaders = {};
+				if (this.options.maxAge !== void 0) resHeaders["access-control-max-age"] = this.options.maxAge.toString();
+				if (this.options.allowMethods?.length) resHeaders["access-control-allow-methods"] = flattenStandardHeader(this.options.allowMethods);
+				const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
+				if (typeof allowHeaders === "string" || allowHeaders?.length) resHeaders["access-control-allow-headers"] = flattenStandardHeader(allowHeaders);
+				return {
+					matched: true,
+					response: {
+						status: 204,
+						headers: resHeaders,
+						body: void 0
+					}
+				};
+			}
+			return interceptorOptions.next();
+		};
+		return {
+			...options,
+			routingInterceptors: [
+				corsHeadersInterceptor,
+				preflightInterceptor,
+				...toArray(options.routingInterceptors)
+			]
+		};
+	}
+	async resolveOrigin(option, origin, interceptorOptions) {
+		if (typeof option === "function") {
+			if (origin === void 0) return {
+				value: void 0,
+				varies: true
+			};
+			const allowed = toArray(await option(origin, interceptorOptions));
+			if (allowed.includes("*")) return {
+				value: "*",
+				varies: true
+			};
+			return {
+				value: allowed.includes(origin) ? origin : void 0,
+				varies: true
+			};
+		}
+		const allowed = toArray(await option);
+		if (allowed.includes("*")) return {
+			value: "*",
+			varies: false
+		};
+		if (origin !== void 0 && allowed.includes(origin)) return {
+			value: origin,
+			varies: true
+		};
+		return {
+			value: void 0,
+			varies: allowed.length > 0
+		};
+	}
+};
+export { CORSHandlerPlugin };

package/dist/plugins/get-method-csrf-protection.d.ts

@@ -1,5 +1,7 @@
-import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
-import type { Context } from '../context.ts';
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
 /**
  * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
  * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
@@ -17,7 +19,7 @@ import type { Context } from '../context.ts';
  * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
  */
 export declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-    private isAllowed;
-}
+  name: string;
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+  private isAllowed;
+}

package/dist/plugins/get-method-csrf-protection.js

@@ -1,64 +1,48 @@
-import { ORPCError } from '@orpc/client';
-import { toArray } from '@orpc/shared';
-import { flattenStandardHeader } from '@standard-server/core';
+import { toArray } from "@orpc/shared";
+import { ORPCError } from "@orpc/client";
+import { flattenStandardHeader } from "@standard-server/core";
+// src/plugins/get-method-csrf-protection.ts
 /**
- * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
- * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
- * navigations initiated cross-site or from outside the browser, the only context where
- * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
- * Requests matching no procedure stay unmatched, so they can fall through to whatever
- * serves the rest of the site.
- *
- * @remarks
- * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
- * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
- * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
- * since browsers may attach other cookies to the requests that pass.
- *
- * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
- */
-export class GetMethodCsrfProtectionHandlerPlugin {
-    name = '~get-method-csrf-protection';
-    init(options) {
-        /**
-         * Batch sub-requests are judged individually here, which is safe: navigations cannot
-         * carry the custom `orpc-batch` header, and the batch plugin's default `mapSubrequest`
-         * keeps the transport headers authoritative over client-authored sub-request headers.
-         */
-        const interceptor = (interceptorOptions) => {
-            if (this.isAllowed(interceptorOptions)) {
-                return interceptorOptions.next();
-            }
-            throw new ORPCError('FORBIDDEN', { message: 'Request blocked by CSRF protection.' });
-        };
-        return {
-            ...options,
-            interceptors: [interceptor, ...toArray(options.interceptors)],
-        };
-    }
-    isAllowed({ request }) {
-        // Navigations can only use `GET` or `POST` per the HTML spec, and `POST` is unsafe, so
-        // `GET` is the only method `SameSite=Lax` cookies ride cross-site.
-        if (request.method !== 'GET') {
-            return true;
-        }
-        const site = flattenStandardHeader(request.headers['sec-fetch-site'])?.toLowerCase();
-        // Absent for non-browser clients, browsers too old to send Fetch Metadata, and any browser
-        // over plain HTTP, where the headers are never appended. Nothing to judge in those cases.
-        // Same-site origins are trusted, matching the `SameSite` cookie model where the site is
-        // the trust boundary.
-        if (site === undefined || site === 'same-origin' || site === 'same-site') {
-            return true;
-        }
-        // Cross-site, and on browser-initiated requests such as email links, `Lax` cookies ride
-        // only top-level navigations: mode `navigate` targeting dest `document`. Embedded
-        // navigations such as `<iframe>` pass, since they are not top-level. Browsers send both
-        // headers together, so a stripped one blocks the request rather than bypassing the check.
-        const mode = flattenStandardHeader(request.headers['sec-fetch-mode'])?.toLowerCase();
-        const dest = flattenStandardHeader(request.headers['sec-fetch-dest'])?.toLowerCase();
-        if (mode === undefined || dest === undefined) {
-            return false;
-        }
-        return mode !== 'navigate' || dest !== 'document';
-    }
-}
+* Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+* secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+* navigations initiated cross-site or from outside the browser, the only context where
+* another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+* Requests matching no procedure stay unmatched, so they can fall through to whatever
+* serves the rest of the site.
+*
+* @remarks
+* **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+* and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+* requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+* since browsers may attach other cookies to the requests that pass.
+*
+* @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+*/
+var GetMethodCsrfProtectionHandlerPlugin = class {
+	name = "~get-method-csrf-protection";
+	init(options) {
+		/**
+		* Batch sub-requests are judged individually here, which is safe: navigations cannot
+		* carry the custom `orpc-batch` header, and the batch plugin's default `mapSubrequest`
+		* keeps the transport headers authoritative over client-authored sub-request headers.
+		*/
+		const interceptor = (interceptorOptions) => {
+			if (this.isAllowed(interceptorOptions)) return interceptorOptions.next();
+			throw new ORPCError("FORBIDDEN", { message: "Request blocked by CSRF protection." });
+		};
+		return {
+			...options,
+			interceptors: [interceptor, ...toArray(options.interceptors)]
+		};
+	}
+	isAllowed({ request }) {
+		if (request.method !== "GET") return true;
+		const site = flattenStandardHeader(request.headers["sec-fetch-site"])?.toLowerCase();
+		if (site === void 0 || site === "same-origin" || site === "same-site") return true;
+		const mode = flattenStandardHeader(request.headers["sec-fetch-mode"])?.toLowerCase();
+		const dest = flattenStandardHeader(request.headers["sec-fetch-dest"])?.toLowerCase();
+		if (mode === void 0 || dest === void 0) return false;
+		return mode !== "navigate" || dest !== "document";
+	}
+};
+export { GetMethodCsrfProtectionHandlerPlugin };

package/dist/plugins/head-method.d.ts

@@ -1,5 +1,7 @@
-import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
-import type { Context } from '../context.ts';
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
 /**
  * Answers `HEAD` requests with the headers of the matching `GET` procedure, like Fastify's
  * `exposeHeadRoutes`, so clients can check a resource's existence, type, and size without
@@ -14,10 +16,10 @@ import type { Context } from '../context.ts';
  * @see {@link https://orpc.dev/docs/plugins/head-method | HEAD Method Plugin}
  */
 export declare class HeadMethodHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    /**
-     * Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
-     */
-    after: string[];
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
+  name: string;
+  /**
+   * Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
+   */
+  after: string[];
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}