
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@orpc/contract
Advanced tools
Define typesafe API contracts as the single source of truth for oRPC, powered by Standard Schema
You can read the documentation here.
Core
| Package | Purpose | Docs |
|---|---|---|
| @orpc/contract | Define API contract as the single source of truth. | Procedure Contract, Contract Router, Implementation, Generate from OpenAPI |
| @orpc/server | Build APIs or implement contracts. | Procedure, Router, Middleware, Context, RPC Handler |
| @orpc/client | Consume APIs with end-to-end type safety. | Client-Side Clients, Server-Side Clients, RPC Link, Error Handling |
| @orpc/openapi | Add OpenAPI compatibility to APIs. | OpenAPI Handler, OpenAPI Link, Specification, Scalar |
Schema validation
| Package | Purpose | Docs |
|---|---|---|
| @orpc/zod | Integrate with Zod. | Zod |
| @orpc/valibot | Integrate with Valibot. | Valibot |
| @orpc/arktype | Integrate with ArkType. | ArkType |
Built-in features
| Package | Purpose | Docs |
|---|---|---|
| @orpc/publisher | Pub/Sub with memory, Redis, and Upstash adapters. | Publisher |
| @orpc/ratelimit | Rate limiting with memory, Redis, and Upstash adapters. | Rate Limit |
| @orpc/hibernation | Leverage Hibernation APIs like Cloudflare's Hibernation WebSocket. | Hibernation |
| @orpc/json-schema | Smart coercion for OpenAPI requests. | Smart Coercion |
Framework & ecosystem integrations
| Package | Purpose | Docs |
|---|---|---|
| @orpc/next | Integrate with Next.js Server Functions. | Next.js |
| @orpc/ai-sdk | Turn contracts and procedures into AI SDK tools. | AI SDK |
| @orpc/tanstack-query | Integrate with TanStack Query. | TanStack Query |
| @orpc/pinia-colada | Integrate with Pinia Colada. | Pinia Colada |
| @orpc/swr | Integrate with SWR. | SWR |
| @orpc/experimental-msw | Mock procedures with Mock Service Worker. | MSW |
| @orpc/experimental-effect | Integrate with Effect. | Effect |
| @orpc/nest | Implement your contract with NestJS. | NestJS |
| @orpc/node | Node.js plugins for static file serving and large uploads. | Static File, Tmp File Upload, Batch Response Compression |
| @orpc/bun | Adapters for Bun's Redis. | Publisher, Rate Limit |
| @orpc/cloudflare | Adapters for Cloudflare's RateLimit and Durable Objects. | Publisher, Rate Limit |
| @orpc/trpc | Reuse existing tRPC routers within oRPC. | tRPC |
Observability
| Package | Purpose | Docs |
|---|---|---|
| @orpc/opentelemetry | Integrate with OpenTelemetry for distributed tracing. | OpenTelemetry |
| @orpc/pino | Integrate with Pino for logging. | Pino |
| @orpc/evlog | Integrate with Evlog for logging. | Evlog |
Like what we build over at middleapi? You can help keep it going through GitHub Sponsors or Open Collective. Every bit helps! π
The screenshot API for developers |
We're hiring NYC based engineers |
MisskeyHQDecentralized microblogging SNS born on Earth |
LN Markets |
David Walsh | IPv4Addr | Robbe Vaes | Aidan Sunbury | soonoo | Kevin Porten | Denis |
Christopher Kapic | Tom Ballinger | Sam | Titoine | Igor Makowski | hanayashiki | Lev Dubinets |
Kelly Peilin Chan | Guy Ariely | PaulSenon | Alex | Andrey Gubanov |
With thanks to 36 past sponsors who helped get oRPC here.
oRPC is inspired by existing solutions that prioritize type safety and developer experience. Special acknowledgments to:
Distributed under the MIT License. See LICENSE for more information.
FAQs
Unknown package
The npm package @orpc/contract receives a total of 758,321 weekly downloads. As such, @orpc/contract popularity was classified as popular.
We found that @orpc/contract demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.