Reviewing files that changed from the base of the PR and between c0ca4c7 and 6321853.

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

• packages/standard-server-fetch/src/body.test.ts (3 hunks)
• packages/standard-server-fetch/src/body.ts (4 hunks)
• packages/standard-server-node/src/body.test.ts (4 hunks)
• packages/standard-server-node/src/body.ts (3 hunks)
• packages/standard-server-node/src/response.test.ts (2 hunks)
• packages/standard-server/package.json (1 hunks)
• packages/standard-server/src/utils.test.ts (1 hunks)
• packages/standard-server/src/utils.ts (1 hunks)

packages/standard-server/package.json (1)

36-36: Dependency removed appropriately

The removal of the @tinyhttp/content-disposition dependency is consistent with the PR objectives, as this functionality has been replaced with custom implementations in the utils.ts file.

packages/standard-server-node/src/response.test.ts (2)

98-99: Updated content-disposition format with UTF-8 parameter

The test expectation has been correctly updated to match the new content-disposition format that includes UTF-8 encoding for better internationalization support.

---

109-110: Consistent header assertion

The assertion has been properly updated to match the same content-disposition format used in the spy expectation above, maintaining consistency throughout the test.

packages/standard-server/src/utils.test.ts (3)

1-2: Good test setup

The import statement correctly includes both new utility functions that are being tested in this file.

---

3-7: Comprehensive tests for content disposition generation

The tests for generateContentDisposition appropriately cover key scenarios:

• Empty filenames
• Standard filenames
• Filenames with special characters requiring escaping and encoding

This ensures the function handles all relevant use cases.

---

9-27: Thorough filename extraction testing

The tests for getFilenameFromContentDisposition are comprehensive, covering:

1. Both filename and filename* parameters
2. Empty filenames
3. Special characters requiring decoding
4. Different disposition types (inline/attachment)
5. Additional parameters in the header
6. Invalid format handling

This thorough testing should help prevent regressions in filename handling.

packages/standard-server/src/utils.ts (2)

4-13: Well-implemented content disposition generator

The generateContentDisposition function correctly:

1. Escapes double quotes in filenames
2. Properly encodes special characters according to RFC standards
3. Includes both standard and UTF-8 encoded filename parameters
4. Uses the appropriate format with single quotes for the UTF-8 charset parameter

The implementation follows the MDN recommendations referenced in the comment.

---

15-26:

Details

❓ Verification inconclusive

Robust filename extraction with proper fallback

The getFilenameFromContentDisposition function properly:

1. First attempts to extract from the UTF-8 encoded filename* parameter (preferred)
2. Falls back to the standard filename parameter if needed
3. Handles escaped quotes in the standard parameter
4. Returns undefined for invalid or missing parameters

However, there's a potential issue with empty filenames:

---

🏁 Script executed:

#!/bin/bash
# Search for places in the codebase where getFilenameFromContentDisposition is used
# to see if they handle undefined return values properly

rg -C 5 "getFilenameFromContentDisposition" --type ts

Length of output: 18312

---

Filename Extraction Fallback Behavior — Verify Empty String Handling

The extraction logic in getFilenameFromContentDisposition is robust: it correctly prioritizes the UTF‑8 encoded filename* and falls back to the standard filename (while unescaping quotes). We verified through usages in both Node (in packages/standard-server-node/src/body.ts) and Fetch (in packages/standard-server-fetch/src/body.ts) modules—and their corresponding tests—that when a filename isn’t provided (i.e. the function returns undefined), a default of "blob" is applied.

However, note that if the header contains an empty filename (for example, filename=""), the function returns an empty string rather than undefined. Because the nullish coalescing operator (?? 'blob') does not trigger on empty strings, this could unintentionally allow an empty filename to propagate. Please verify whether an empty filename should be considered invalid and trigger the fallback or if the current behavior is intended.

• Location: packages/standard-server/src/utils.ts (lines 15‑26)
• Usage Impact: Referenced in both Node and Fetch body handlers where fallback logic is applied.

packages/standard-server-fetch/src/body.test.ts (8)

2-2: Good addition of standard server module and test spies.

The code adds proper imports and spies for testing the content disposition functions, which enables effective validation of their behavior in the tests.

Also applies to: 6-7

---

10-12: Good addition of beforeEach hook to clear mocks.

Adding this hook ensures that each test runs with fresh mocks, preventing test interference.

---

123-123: Appropriate verification of spy not being called.

This verifies that getFilenameFromContentDisposition isn't called when there's no content-disposition header, which validates the expected behavior.

---

126-144: Test correctly validates filename extraction from content disposition.

The test now uses JSON data instead of PDF and properly validates that getFilenameFromContentDisposition is called with the correct header value and that its return value is used for the file name.

---

147-166: Good new test case for missing filename in content-disposition.

This test case verifies the handling of content-disposition headers without a filename parameter, ensuring the default 'blob' value is used when the function returns undefined.

---

226-239: Proper testing of content disposition generation for blobs.

The test correctly mocks the content disposition generation function and verifies it's called with the default 'blob' name for regular Blob objects.

---

246-259: Proper testing of content disposition generation for files.

The test correctly mocks the content disposition generation function and verifies it's called with the actual filename when handling File objects.

---

262-277: Good test for preserving existing content disposition headers.

This test ensures that when a content-disposition header already exists, it's preserved and the generation function isn't called.

packages/standard-server-node/src/body.test.ts (8)

6-6: Good addition of standard server module and test spies.

The code adds proper imports and spies for testing the content disposition functions, providing consistent testing between the fetch and node implementations.

Also applies to: 12-13

---

15-17: Good addition of beforeEach hook to clear mocks.

Adding this hook ensures that each test runs with fresh mocks, preventing test interference.

---

142-142: Appropriate verification of spy not being called.

This verifies that getFilenameFromContentDisposition isn't called when there's no content-disposition header, which validates the expected behavior.

---

148-165: Test correctly validates filename extraction from content disposition.

The test now uses JSON data instead of PDF and properly validates that getFilenameFromContentDisposition is called with the correct header value and that its return value is used for the file name.

---

168-188: Good new test case for missing filename in content-disposition.

This test case verifies the handling of content-disposition headers without a filename parameter, ensuring the default 'blob' value is used when the function returns undefined.

---

259-272: Proper testing of content disposition generation for blobs.

The test correctly mocks the content disposition generation function and verifies it's called with the default 'blob' name for regular Blob objects.

---

287-300: Proper testing of content disposition generation for files.

The test correctly mocks the content disposition generation function and verifies it's called with the actual filename when handling File objects.

---

311-325: Good test for preserving existing content disposition headers.

This test ensures that when a content-disposition header already exists, it's preserved and the generation function isn't called.

packages/standard-server-fetch/src/body.ts (3)

3-3: Good replacement of external dependency with in-house utilities.

Importing utility functions from @orpc/standard-server instead of external libraries improves maintainability and reduces external dependencies.

---

13-20: Improved content disposition handling for file extraction.

The code now:

1. Properly checks that content disposition is a string
2. Uses the utility function to extract the filename
3. Provides a fallback to 'blob' when no filename is found

This matches the behavior in the node implementation and handles empty filenames correctly.

---

63-77: Enhanced content disposition handling for HTTP responses.

The changes preserve any existing content-disposition header and only generate a new one if needed, using the appropriate filename based on the type of blob (File or regular Blob).

packages/standard-server-node/src/body.ts (3)

5-6: Good replacement of external dependency with in-house utilities.

Importing utility functions from @orpc/standard-server and adding toArray from @orpc/shared improves maintainability and reduces external dependencies.

---

19-22: Improved content disposition handling for file extraction.

The code now:

1. Properly checks that content disposition is a string
2. Uses the utility function to extract the filename
3. Provides a fallback to 'blob' when no filename is found

This matches the behavior in the fetch implementation and handles empty filenames correctly.

---

62-74: Enhanced content disposition handling for HTTP responses.

The changes properly extract the first value from the content-disposition header (handling Node.js specifics) and preserve any existing header, only generating a new one if needed. This uses the appropriate filename based on the type of blob (File or regular Blob).

🧰 Tools

🪛 Biome (1.9.4)

[error] 64-64: Avoid the delete operator which can impact performance.

Unsafe fix: Use an undefined assignment instead.

(lint/performance/noDelete)

---

[error] 65-65: Avoid the delete operator which can impact performance.

Unsafe fix: Use an undefined assignment instead.

(lint/performance/noDelete)