@orpc/server 2.0.0-beta.5 → 2.0.0-beta.50

package/dist/plugins/get-method-csrf-protection.js

@@ -0,0 +1,48 @@
+import { toArray } from "@orpc/shared";
+import { ORPCError } from "@orpc/client";
+import { flattenStandardHeader } from "@standard-server/core";
+// src/plugins/get-method-csrf-protection.ts
+/**
+* Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+* secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+* navigations initiated cross-site or from outside the browser, the only context where
+* another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+* Requests matching no procedure stay unmatched, so they can fall through to whatever
+* serves the rest of the site.
+*
+* @remarks
+* **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+* and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+* requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+* since browsers may attach other cookies to the requests that pass.
+*
+* @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+*/
+var GetMethodCsrfProtectionHandlerPlugin = class {
+	name = "~get-method-csrf-protection";
+	init(options) {
+		/**
+		* Batch sub-requests are judged individually here, which is safe: navigations cannot
+		* carry the custom `orpc-batch` header, and the batch plugin's default `mapSubrequest`
+		* keeps the transport headers authoritative over client-authored sub-request headers.
+		*/
+		const interceptor = (interceptorOptions) => {
+			if (this.isAllowed(interceptorOptions)) return interceptorOptions.next();
+			throw new ORPCError("FORBIDDEN", { message: "Request blocked by CSRF protection." });
+		};
+		return {
+			...options,
+			interceptors: [interceptor, ...toArray(options.interceptors)]
+		};
+	}
+	isAllowed({ request }) {
+		if (request.method !== "GET") return true;
+		const site = flattenStandardHeader(request.headers["sec-fetch-site"])?.toLowerCase();
+		if (site === void 0 || site === "same-origin" || site === "same-site") return true;
+		const mode = flattenStandardHeader(request.headers["sec-fetch-mode"])?.toLowerCase();
+		const dest = flattenStandardHeader(request.headers["sec-fetch-dest"])?.toLowerCase();
+		if (mode === void 0 || dest === void 0) return false;
+		return mode !== "navigate" || dest !== "document";
+	}
+};
+export { GetMethodCsrfProtectionHandlerPlugin };

package/dist/plugins/head-method.d.ts

@@ -0,0 +1,25 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+/**
+ * Answers `HEAD` requests with the headers of the matching `GET` procedure, like Fastify's
+ * `exposeHeadRoutes`, so clients can check a resource's existence, type, and size without
+ * downloading it. A procedure routed as `HEAD` itself takes precedence over the `GET` one.
+ *
+ * @remarks
+ * - `HEAD` responses never carry a body: the plugin discards it, cancelling streams and
+ *   event iterators, and keeps the headers it implies, such as `Content-Type`, and
+ *   `Content-Length` when its size is known up front.
+ * - `GET` procedures still need to be reachable, so with `RPCHandler`, `GET` must be in `allowMethods`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/head-method | HEAD Method Plugin}
+ */
+export declare class HeadMethodHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  /**
+   * Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
+   */
+  after: string[];
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/head-method.js

@@ -0,0 +1,107 @@
+import { isAsyncIteratorObject, toArray } from "@orpc/shared";
+import { cancelStandardBody, getRequiredStandardBodyHint } from "@standard-server/core";
+import { toFetchBody } from "@standard-server/fetch";
+// src/plugins/head-method.ts
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+/**
+* Answers `HEAD` requests with the headers of the matching `GET` procedure, like Fastify's
+* `exposeHeadRoutes`, so clients can check a resource's existence, type, and size without
+* downloading it. A procedure routed as `HEAD` itself takes precedence over the `GET` one.
+*
+* @remarks
+* - `HEAD` responses never carry a body: the plugin discards it, cancelling streams and
+*   event iterators, and keeps the headers it implies, such as `Content-Type`, and
+*   `Content-Length` when its size is known up front.
+* - `GET` procedures still need to be reachable, so with `RPCHandler`, `GET` must be in `allowMethods`.
+*
+* @see {@link https://orpc.dev/docs/plugins/head-method | HEAD Method Plugin}
+*/
+var HeadMethodHandlerPlugin = class {
+	name = "~head-method";
+	/**
+	* Discard the body after response compression, so `HEAD` reports the same `Content-Encoding` as `GET`.
+	*/
+	after = ["~response-compression"];
+	init(options) {
+		const bodyInterceptor = async ({ next, request }) => {
+			if (request.method !== "HEAD") return next();
+			const result = await next();
+			if (!result.matched) return result;
+			return {
+				...result,
+				response: toHeadResponse(result.response)
+			};
+		};
+		/**
+		* Placed last, so falling back to `GET` repeats routing rather than the routing interceptors before this one.
+		*/
+		const fallbackInterceptor = async (interceptorOptions) => {
+			const { next, request } = interceptorOptions;
+			if (request.method !== "HEAD") return next();
+			const result = await next();
+			if (result.matched) return result;
+			return next({
+				...interceptorOptions,
+				request: {
+					...request,
+					method: "GET"
+				}
+			});
+		};
+		return {
+			...options,
+			routingInterceptors: [
+				bodyInterceptor,
+				...toArray(options.routingInterceptors),
+				fallbackInterceptor
+			]
+		};
+	}
+};
+/**
+* Replaces the body with an empty stream, keeping the headers adapters derive from it.
+* An empty stream rather than no body, because adapters drop `Content-Type` and `Content-Length` when the body is `undefined`,
+* and an empty `Standard-Server` hint rather than none, so they do not hint the stream as `octet-stream`.
+*/
+function toHeadResponse(response) {
+	const { body } = response;
+	if (body === void 0) return response;
+	if (isAsyncIteratorObject(body)) {
+		discardBody(body);
+		const headers = {
+			...response.headers,
+			"content-length": void 0
+		};
+		headers["content-type"] ??= "text/event-stream";
+		headers["standard-server"] = getRequiredStandardBodyHint("event-stream", headers) ?? [];
+		return {
+			...response,
+			headers,
+			body: createEmptyStream()
+		};
+	}
+	const [encoded, headers] = toFetchBody(body, response.headers);
+	if (encoded instanceof ReadableStream) discardBody(encoded);
+	else if (encoded instanceof FormData) {
+		headers["standard-server"] = [];
+		headers["content-type"] = new Response(encoded).headers.get("content-type");
+	} else if (typeof encoded === "string" || encoded instanceof URLSearchParams) {
+		headers["standard-server"] ??= [];
+		headers["content-length"] = textEncoder.encode(encoded.toString()).byteLength.toString();
+	}
+	return {
+		...response,
+		headers,
+		body: createEmptyStream()
+	};
+}
+function createEmptyStream() {
+	return new ReadableStream({ start: (controller) => controller.close() });
+}
+/**
+* Nothing reads the body anymore, so a failure to cancel it has nowhere to go.
+*/
+function discardBody(body) {
+	cancelStandardBody(body).catch(() => {});
+}
+export { HeadMethodHandlerPlugin };

package/dist/plugins/index.d.ts

@@ -1,197 +1,15 @@
-import { Value, Promisable, ThrowableError } from '@orpc/shared';
-import { StandardLazyRequest, StandardHeaders } from '@standardserver/core';
-import { C as Context } from '../shared/server.BL22TloH.js';
-import { e as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.DBANIheG.js';
-import '@orpc/client';
-import '@orpc/contract';
-
-interface BatchHandlerPluginOptions<T extends Context> {
-    /**
-     * The max size of the batch allowed.
-     *
-     * @default 10
-     */
-    maxSize?: Value<Promisable<number>, [options: StandardHandlerRoutingInterceptorOptions<T>]>;
-    /**
-     * Map each subrequest in the batch before it is processed.
-     *
-     * @default merges the batch request headers into the subrequest and remove `orpc-batch` header to prevent nested batching
-     */
-    mapSubrequest?: (subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest;
-    /**
-     * Success batch response status code.
-     *
-     * @default 207
-     */
-    successStatus?: Value<Promisable<number>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]>;
-    /**
-     * Success batch response headers.
-     *
-     * @default {}
-     */
-    headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]>;
-}
-declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    /**
-     * Run batch interceptors before OpenTelemetry interceptors
-     * so each subrequest gets its own span instead of sharing one batch-level span.
-     */
-    after: string[];
-    private readonly maxSize;
-    private readonly mapSubrequest;
-    private readonly successStatus;
-    private readonly headers;
-    constructor(options?: BatchHandlerPluginOptions<T>);
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-interface CORSHandlerPluginOptions<T extends Context> {
-    /**
-     * Configures the `Access-Control-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default (origin) => origin
-     */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
-    /**
-     * Configures the `Timing-Allow-Origin` header.
-     * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
-     *
-     * @default undefined
-     */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
-    /**
-     * Configures the `Access-Control-Allow-Methods` header for preflight requests.
-     *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
-     */
-    allowMethods?: readonly string[];
-    /**
-     * Configures the `Access-Control-Allow-Headers` header for preflight requests.
-     * Falls back to the request's `Access-Control-Request-Headers` if not set.
-     *
-     * @default undefined
-     */
-    allowHeaders?: readonly string[];
-    /**
-     * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
-     *
-     * @default undefined
-     */
-    maxAge?: number;
-    /**
-     * Configures the `Access-Control-Allow-Credentials` header.
-     *
-     * @default undefined
-     */
-    credentials?: boolean;
-    /**
-     * Configures the `Access-Control-Expose-Headers` header.
-     *
-     * @default undefined
-     */
-    exposeHeaders?: readonly string[];
-}
-/**
- * CORSHandlerPlugin is a plugin for oRPC that allows you to configure CORS for your API.
- *
- * @see {@link https://orpc.dev/docs/plugins/cors CORS Plugin Docs}
- */
-declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    private readonly options;
-    name: string;
-    /**
-     * - Do not create spans for CORS preflight requests.
-     * - Run CORS interceptors before batch interceptors so headers are applied to
-     *  the actual response rather than sub-responses.
-     */
-    after: string[];
-    constructor(options?: CORSHandlerPluginOptions<T>);
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-/**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @info This plugin is enabled by default for `RPCHandler` over HTTP.
- */
-declare class CSRFGuardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-interface RequestHeadersHandlerPluginContext {
-    /**
-     * Request headers as a Headers instance. This is injected by the Request Headers Plugin.
-     */
-    reqHeaders?: Headers | undefined;
-}
-/**
- * The Request Headers Plugin injects a `reqHeaders` instance into the context,
- * allowing access to request headers in oRPC.
- *
- * @see {@link https://orpc.dev/docs/plugins/request-headers Request Headers Plugin Docs}
- */
-declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-interface ResponseHeadersHandlerPluginContext {
-    /**
-     * Response headers as a Headers instance. This is injected by the Response Headers Plugin.
-     * When set before the response is sent, these headers will be included in the response. If not set, no additional headers will be added.
-     */
-    resHeaders?: Headers | undefined;
-}
-/**
- * The Response Headers Plugin allows you to set response headers in oRPC.
- * It injects a resHeaders instance into the context, enabling you to modify response headers easily.
- *
- * @see {@link https://orpc.dev/docs/plugins/response-headers Response Headers Plugin Docs}
- */
-declare class ResponseHeadersHandlerPlugin<T extends ResponseHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
-    name: string;
-    /**
-     * Interceptors should run after batch interceptors so headers are applied to each sub-response.
-     */
-    before: string[];
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-interface RethrowHandlerPluginOptions<T extends Context> {
-    /**
-     * Decide which errors should be rethrown.
-     *
-     * @example
-     * ```ts
-     * const rethrowPlugin = new RethrowHandlerPlugin({
-     *   filter: (error) => {
-     *     // Rethrow all non-ORPCError errors
-     *     return !(error instanceof ORPCError)
-     *   }
-     * })
-     * ```
-     */
-    filter: (error: ThrowableError, options: StandardHandlerInterceptorOptions<T>) => boolean;
-}
-/**
- * The plugin can bypass oRPC's built-in error handling
- * and rethrow matching errors directly to your framework's error handling mechanism
- * (e.g., NestJS exception filters, Express error middleware).
- *
- * @see {@link https://orpc.dev/docs/plugins/rethrow Rethrow Plugin Documentation}
- */
-declare class RethrowHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    private readonly filter;
-    private readonly CONTEXT_SYMBOL;
-    constructor(options: RethrowHandlerPluginOptions<T>);
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
-export { BatchHandlerPlugin, CORSHandlerPlugin, CSRFGuardHandlerPlugin, RequestHeadersHandlerPlugin, ResponseHeadersHandlerPlugin, RethrowHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext, RethrowHandlerPluginOptions };
+import { BATCH_CONTENT_TYPE, BatchHandlerPlugin, BatchHandlerPluginOptions } from "./batch.js";
+import { CORSHandlerPlugin, CORSHandlerPluginOptions } from "./cors.js";
+import { GetMethodCsrfProtectionHandlerPlugin } from "./get-method-csrf-protection.js";
+import { HeadMethodHandlerPlugin } from "./head-method.js";
+import { MethodOverrideHandlerPlugin, MethodOverrideHandlerPluginOptions } from "./method-override.js";
+import { RequestCompressionHandlerPlugin } from "./request-compression.js";
+import { RequestHeadersHandlerPlugin, RequestHeadersHandlerPluginContext } from "./request-headers.js";
+import { RequestLimitHandlerPlugin, RequestLimitHandlerPluginOptions } from "./request-limit.js";
+import { ResponseCompressionHandlerPlugin, ResponseCompressionHandlerPluginOptions, negotiateResponseCompressionEncoding, toCompressedHeaders } from "./response-compression.js";
+import { ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPluginContext } from "./response-headers.js";
+import { RethrowHandlerPlugin, RethrowHandlerPluginOptions } from "./rethrow.js";
+import { SignalSyncHandlerPlugin } from "./signal-sync.js";
+import { TimeoutHandlerPlugin, TimeoutHandlerPluginOptions } from "./timeout.js";
+import { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from "@orpc/client/plugins";
+export { BATCH_CONTENT_TYPE, BATCH_HEADER, BatchHandlerPlugin, BatchHandlerPluginOptions, CORSHandlerPlugin, CORSHandlerPluginOptions, CORSHandlerPlugin as CORSPlugin, DEFAULT_BATCH_MAX_SIZE, GetMethodCsrfProtectionHandlerPlugin, HeadMethodHandlerPlugin, MethodOverrideHandlerPlugin, MethodOverrideHandlerPluginOptions, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPlugin as RequestHeadersPlugin, type RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, RequestLimitHandlerPlugin, RequestLimitHandlerPluginOptions, ResponseCompressionHandlerPlugin, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, type ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPlugin, RethrowHandlerPluginOptions, SignalSyncHandlerPlugin, TimeoutHandlerPlugin, TimeoutHandlerPluginOptions, negotiateResponseCompressionEncoding, toCompressedHeaders };

package/dist/plugins/index.js

@@ -0,0 +1,14 @@
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin } from "./batch.js";
+export { CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin } from "./cors.js";
+export { GetMethodCsrfProtectionHandlerPlugin } from "./get-method-csrf-protection.js";
+export { HeadMethodHandlerPlugin } from "./head-method.js";
+export { MethodOverrideHandlerPlugin } from "./method-override.js";
+export { RequestCompressionHandlerPlugin } from "./request-compression.js";
+export { RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin } from "./request-headers.js";
+export { RequestLimitHandlerPlugin } from "./request-limit.js";
+export { ResponseCompressionHandlerPlugin, negotiateResponseCompressionEncoding, toCompressedHeaders } from "./response-compression.js";
+export { ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin } from "./response-headers.js";
+export { RethrowHandlerPlugin } from "./rethrow.js";
+export { SignalSyncHandlerPlugin } from "./signal-sync.js";
+export { TimeoutHandlerPlugin } from "./timeout.js";
+export { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from "@orpc/client/plugins";

package/dist/plugins/method-override.d.ts

@@ -0,0 +1,40 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+import { StandardMethod } from "@standard-server/core";
+export interface MethodOverrideHandlerPluginOptions {
+  /**
+   * The query parameter carrying the override method.
+   *
+   * @default 'method'
+   */
+  param?: string | undefined;
+  /**
+   * The methods a POST request may be overridden to.
+   *
+   * GET and HEAD are excluded by default because they switch input decoding
+   * from the request body to the query string and widen the CSRF surface.
+   *
+   * @default ['PUT', 'PATCH', 'DELETE']
+   */
+  methods?: readonly StandardMethod[] | undefined;
+}
+/**
+ * Overrides the HTTP method of a POST request based on a query parameter,
+ * so HTML forms (which only support GET and POST) can invoke procedures
+ * routed as PUT, PATCH, or DELETE.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+ */
+export declare class MethodOverrideHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  /**
+   * Should override batch sub-request methods, not the original batch request.
+   */
+  before: string[];
+  private readonly param;
+  private readonly methods;
+  constructor(options?: MethodOverrideHandlerPluginOptions);
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/method-override.js

@@ -0,0 +1,54 @@
+import { toArray } from "@orpc/shared";
+import { parseStandardUrl } from "@standard-server/core";
+// src/plugins/method-override.ts
+/**
+* Overrides the HTTP method of a POST request based on a query parameter,
+* so HTML forms (which only support GET and POST) can invoke procedures
+* routed as PUT, PATCH, or DELETE.
+*
+* @see {@link https://orpc.dev/docs/plugins/method-override | Method Override Plugin}
+*/
+var MethodOverrideHandlerPlugin = class {
+	name = "~method-override";
+	/**
+	* Should override batch sub-request methods, not the original batch request.
+	*/
+	before = ["~batch"];
+	param;
+	methods;
+	constructor(options = {}) {
+		this.param = options.param ?? "method";
+		this.methods = new Set((options.methods ?? [
+			"PUT",
+			"PATCH",
+			"DELETE"
+		]).map((method) => method.toUpperCase()));
+	}
+	init(options) {
+		const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+			const { request } = interceptorOptions;
+			if (request.method !== "POST") return next();
+			const [pathname, search, hash] = parseStandardUrl(request.url);
+			const params = new URLSearchParams(search);
+			const raw = params.getAll(this.param).at(-1);
+			if (raw === void 0) return next();
+			const method = raw.toUpperCase();
+			if (!this.methods.has(method)) return next();
+			params.delete(this.param);
+			const url = `${pathname}${params.size ? `?${params}` : ""}${hash ?? ""}`;
+			return next({
+				...interceptorOptions,
+				request: {
+					...request,
+					method,
+					url
+				}
+			});
+		};
+		return {
+			...options,
+			routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+		};
+	}
+};
+export { MethodOverrideHandlerPlugin };

package/dist/plugins/request-compression.d.ts

@@ -0,0 +1,18 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+/**
+ * Decompresses incoming request bodies based on the Content-Encoding header,
+ * supporting gzip, deflate, and deflate-raw.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
+ */
+export declare class RequestCompressionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  /**
+   * Should decompress the original batch request body instead of sub-requests.
+   */
+  after: string[];
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/request-compression.js

@@ -0,0 +1,55 @@
+import { isCompressionEncoding, parseContentEncodings, toArray } from "@orpc/shared";
+import { ORPCError } from "@orpc/client";
+import { flattenStandardHeader } from "@standard-server/core";
+import { toFetchHeaders, toStandardBody } from "@standard-server/fetch";
+// src/plugins/request-compression.ts
+/**
+* Each coding adds a decompressor to the chain, so an unbounded list lets a tiny
+* request cost unbounded CPU and memory. Same limit as undici and curl.
+*/
+const MAX_CONTENT_ENCODINGS = 5;
+/**
+* Decompresses incoming request bodies based on the Content-Encoding header,
+* supporting gzip, deflate, and deflate-raw.
+*
+* @see {@link https://orpc.dev/docs/plugins/request-compression | Request Compression Plugin}
+*/
+var RequestCompressionHandlerPlugin = class {
+	name = "~request-compression";
+	/**
+	* Should decompress the original batch request body instead of sub-requests.
+	*/
+	after = ["~batch"];
+	init(options) {
+		const routingInterceptor = async ({ next, ...interceptorOptions }) => {
+			const encodings = parseContentEncodings(flattenStandardHeader(interceptorOptions.request.headers["content-encoding"]));
+			if (encodings.length === 0 || !encodings.every(isCompressionEncoding)) return next();
+			const decompressedHeaders = {
+				...interceptorOptions.request.headers,
+				"content-length": void 0,
+				"content-encoding": void 0
+			};
+			return next({
+				...interceptorOptions,
+				request: {
+					...interceptorOptions.request,
+					headers: decompressedHeaders,
+					async resolveBody(hint) {
+						const stream = await interceptorOptions.request.resolveBody("octet-stream");
+						if (!(stream instanceof ReadableStream)) return stream;
+						if (encodings.length > MAX_CONTENT_ENCODINGS) throw new ORPCError("UNSUPPORTED_MEDIA_TYPE", { message: "Too many content encodings." });
+						let decompressedStream = stream;
+						for (let i = encodings.length - 1; i >= 0; i--) decompressedStream = decompressedStream.pipeThrough(new DecompressionStream(encodings[i]));
+						const response = new Response(decompressedStream, { headers: toFetchHeaders(decompressedHeaders) });
+						return toStandardBody(response, { hint });
+					}
+				}
+			});
+		};
+		return {
+			...options,
+			routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+		};
+	}
+};
+export { RequestCompressionHandlerPlugin };

package/dist/plugins/request-headers.d.ts

@@ -0,0 +1,24 @@
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import "../adapters/standard/index.js";
+/**
+ * The context shape into which the Request Headers Plugin injects `reqHeaders`.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
+ */
+export interface RequestHeadersHandlerPluginContext {
+  /**
+   * Request headers as a Headers instance. This is injected by the Request Headers Plugin.
+   */
+  reqHeaders?: Headers | undefined;
+}
+/**
+ * The Request Headers Plugin injects a `reqHeaders` instance into the context,
+ * allowing access to request headers in oRPC.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
+ */
+export declare class RequestHeadersHandlerPlugin<T extends RequestHeadersHandlerPluginContext> implements StandardHandlerPlugin<T> {
+  name: string;
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/request-headers.js

@@ -0,0 +1,28 @@
+import { toArray } from "@orpc/shared";
+import { toFetchHeaders } from "@standard-server/fetch";
+// src/plugins/request-headers.ts
+/**
+* The Request Headers Plugin injects a `reqHeaders` instance into the context,
+* allowing access to request headers in oRPC.
+*
+* @see {@link https://orpc.dev/docs/plugins/request-headers | Request Headers Plugin}
+*/
+var RequestHeadersHandlerPlugin = class {
+	name = "~request-headers";
+	init(options) {
+		return {
+			...options,
+			interceptors: [(interceptorOptions) => {
+				const reqHeaders = interceptorOptions.context.reqHeaders ?? toFetchHeaders(interceptorOptions.request.headers);
+				return interceptorOptions.next({
+					...interceptorOptions,
+					context: {
+						...interceptorOptions.context,
+						reqHeaders
+					}
+				});
+			}, ...toArray(options.interceptors)]
+		};
+	}
+};
+export { RequestHeadersHandlerPlugin };

package/dist/plugins/request-limit.d.ts

@@ -0,0 +1,32 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+export interface RequestLimitHandlerPluginOptions {
+  /**
+   * The maximum allowed request body size in bytes.
+   */
+  maxBodySize: number;
+}
+/**
+ * Rejects requests whose body exceeds `maxBodySize`.
+ *
+ * When used with the request compression plugin, the limit applies to the
+ * decompressed payload rather than the compressed wire size.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/request-limit | Request Limit Plugin}
+ */
+export declare class RequestLimitHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  /**
+   * Should limit the original batch request body instead of sub-requests.
+   */
+  after: string[];
+  /**
+   * Should limit the final body size instead of the compressed one.
+   */
+  before: string[];
+  private readonly maxBodySize;
+  constructor(options: RequestLimitHandlerPluginOptions);
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}