@orpc/server 1.14.6 → 2.0.0-beta.10

package/dist/shared/server.Cj5lgPuG.d.mts

@@ -0,0 +1,66 @@
+import { RPCSerializer, AnyORPCError } from '@orpc/client';
+import { Value, Promisable } from '@orpc/shared';
+import { StandardMethod, StandardLazyRequest, StandardResponse } from '@standardserver/core';
+import { A as AnyProcedure, C as Context } from './server.BL22TloH.mjs';
+import { A as AnyRouter } from './server.BsNNjG5J.mjs';
+import { AnyProcedureContract } from '@orpc/contract';
+import { b as StandardHandlerHandleOptions, c as StandardHandlerCodec, d as StandardHandlerCodecResolvedProcedure } from './server.DJIkub_t.mjs';
+
+interface RPCMatcherOptions {
+    /**
+     * Filter which procedures are exposed for matching. Return `false` to exclude.
+     *
+     * @default true
+     */
+    filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+}
+declare class RPCMatcher {
+    private readonly filter;
+    private readonly rootRouter;
+    private readonly tree;
+    private pendingLazyRouters;
+    constructor(router: AnyRouter, options?: RPCMatcherOptions);
+    private index;
+    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+        path: string[];
+        procedure: AnyProcedure;
+    } | undefined>;
+    private matchPathname;
+    private resolvePendingLazyRouters;
+    private resolveProcedure;
+}
+
+interface RPCHandlerCodecOptions<T extends Context> extends RPCMatcherOptions {
+    /**
+     * Override the default RPC serializer.
+     */
+    serializer?: Pick<RPCSerializer, keyof RPCSerializer>;
+    /**
+     * Resolve HTTP status for encoded successful outputs.
+     *
+     * Value should be in range `200-299`
+     * Return `undefined` or `null` to fallback to default
+     *
+     * @default DEFAULT_ERROR_STATUS, DEFAULT_ERROR_STATUS
+     */
+    outputStatus?: Value<number | undefined | null, [output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>]>;
+    /**
+     * Mapping ORPCError Code -> HTTP Status Code
+     *
+     * @default COMMON_ERROR_STATUS_MAP
+     */
+    errorStatusMap?: Record<string, number> | undefined;
+}
+declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec<T> {
+    private readonly matcher;
+    private readonly serializer;
+    private readonly errorStatusMap;
+    private readonly outputStatus;
+    constructor(router: AnyRouter, options?: RPCHandlerCodecOptions<T>);
+    resolveProcedure(request: StandardLazyRequest, options: StandardHandlerHandleOptions<T>): Promise<StandardHandlerCodecResolvedProcedure | undefined>;
+    encodeOutput(output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+    encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+}
+
+export { RPCHandlerCodec as a, RPCMatcher as b };
+export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/server.CjOb6ItT.mjs

@@ -0,0 +1,41 @@
+import { resolveMetaPlugins, mergeErrorMap, getHiddenMetaPlugins } from '@orpc/contract';
+import { P as Procedure } from './server.CrlKQucM.mjs';
+
+class DecoratedProcedure extends Procedure {
+  meta(...plugins) {
+    const [meta, metaPlugins] = resolveMetaPlugins(this["~orpc"].meta, this["~orpc"].metaPlugins, plugins);
+    return new DecoratedProcedure({
+      ...this["~orpc"],
+      meta,
+      metaPlugins
+    });
+  }
+  errors(errors) {
+    let procedure = new DecoratedProcedure({
+      ...this["~orpc"],
+      errorMap: mergeErrorMap(this["~orpc"].errorMap, errors)
+    });
+    const plugins = getHiddenMetaPlugins(errors);
+    if (plugins) {
+      procedure = procedure.meta(...plugins);
+    }
+    return procedure;
+  }
+  use(middleware) {
+    let procedure = new DecoratedProcedure({
+      ...this["~orpc"],
+      errorMap: mergeErrorMap(middleware["~orpc"]?.errorMap, this["~orpc"].errorMap),
+      orderedMiddlewares: [...this["~orpc"].orderedMiddlewares, {
+        middleware,
+        inputSchemasLengthAtUse: this["~orpc"].inputSchemas?.length,
+        outputSchemasLengthAtUse: this["~orpc"].outputSchemas?.length
+      }]
+    });
+    if (middleware["~orpc"]?.metaPlugins) {
+      procedure = procedure.meta(...middleware["~orpc"]?.metaPlugins);
+    }
+    return procedure;
+  }
+}
+
+export { DecoratedProcedure as D };

package/dist/shared/server.CrlKQucM.mjs

@@ -0,0 +1,233 @@
+import { ORPCError, wrapEventIteratorPreservingMeta, cloneORPCError } from '@orpc/client';
+import { reconcileORPCError, ValidationError, ProcedureContract } from '@orpc/contract';
+import { getOrBind, resolveMaybeOptionalOptions, getConstructor, isTypescriptObject, toArray, value, runWithSpan, intercept, isAsyncIteratorObject, override, traceAsyncIterator, traceReadableStream } from '@orpc/shared';
+
+function createORPCErrorConstructorMap(errorMap) {
+  const proxy = new Proxy(errorMap, {
+    get(target, code) {
+      if (typeof code !== "string") {
+        return getOrBind(target, code);
+      }
+      const item = (...rest) => {
+        const options = resolveMaybeOptionalOptions(rest);
+        const config = errorMap[code];
+        const error = new ORPCError(code, {
+          message: options.message ?? config?.message,
+          data: options.data,
+          cause: options.cause
+        });
+        if (config) {
+          error.defined = true;
+          error.inferable = true;
+        }
+        return error;
+      };
+      return item;
+    }
+  });
+  return proxy;
+}
+
+class Lazy {
+  "~orpc";
+  constructor(def) {
+    this["~orpc"] = def;
+  }
+  /**
+   * Checks if the given instance satisfies the {@see Lazy} class/interface.
+   */
+  static [Symbol.hasInstance](instance) {
+    if (this !== Lazy) {
+      return Function.prototype[Symbol.hasInstance].call(this, instance);
+    }
+    const constructor = getConstructor(instance);
+    if (constructor === Lazy) {
+      return true;
+    }
+    return isTypescriptObject(instance) && isTypescriptObject(instance["~orpc"]) && isTypescriptObject(instance["~orpc"].meta) && (instance["~orpc"].metaPlugins === void 0 || Array.isArray(instance["~orpc"].metaPlugins)) && typeof instance["~orpc"].loader === "function";
+  }
+}
+function unlazy(maybeLazy) {
+  return maybeLazy instanceof Lazy ? maybeLazy["~orpc"].loader() : Promise.resolve({ default: maybeLazy });
+}
+
+function createProcedureClient(lazyableProcedure, ...rest) {
+  const options = resolveMaybeOptionalOptions(rest);
+  return async (...[input, callerOptions]) => {
+    const path = toArray(options.path);
+    const { default: procedure } = await unlazy(lazyableProcedure);
+    const clientContext = callerOptions?.context ?? {};
+    const context = await value(options.context, clientContext) ?? {};
+    const errors = createORPCErrorConstructorMap(procedure["~orpc"].errorMap);
+    const reconcileError = async (e) => {
+      if (e instanceof ORPCError) {
+        return await reconcileORPCError(procedure["~orpc"].errorMap, e);
+      }
+      return e;
+    };
+    try {
+      const output = await runWithSpan("call_procedure", (span) => {
+        span?.setAttribute("procedure.path", path);
+        return intercept(
+          options.interceptors,
+          {
+            context,
+            // input can be optional if it is undefinable
+            input,
+            errors,
+            path,
+            procedure,
+            signal: callerOptions?.signal,
+            lastEventId: callerOptions?.lastEventId
+          },
+          (interceptorOptions) => executeProcedureInternal(interceptorOptions.procedure, interceptorOptions)
+        );
+      });
+      if (isAsyncIteratorObject(output)) {
+        return override(output, wrapEventIteratorPreservingMeta(
+          traceAsyncIterator("consume_event_iterator_output", output),
+          { mapError: reconcileError }
+        ));
+      }
+      if (output instanceof ReadableStream) {
+        return override(output, traceReadableStream("consume_octet_stream_output", output));
+      }
+      return output;
+    } catch (e) {
+      throw await reconcileError(e);
+    }
+  };
+}
+async function validateInput(i, schema, input) {
+  return runWithSpan(`validate_input.${i}`, async (span) => {
+    span?.setAttribute("input_schema.index", i);
+    const result = await schema["~standard"].validate(input);
+    if (result.issues) {
+      throw new ORPCError("BAD_REQUEST", {
+        message: "Input validation failed",
+        data: {
+          issues: result.issues
+        },
+        cause: new ValidationError({
+          message: "Input validation failed",
+          issues: result.issues,
+          invalidData: input
+        })
+      });
+    }
+    return result.value;
+  });
+}
+async function validateOutput(i, schema, output) {
+  return runWithSpan(`validate_output.${i}`, async (span) => {
+    span?.setAttribute("output_schema.index", i);
+    const result = await schema["~standard"].validate(output);
+    if (result.issues) {
+      throw new ORPCError("INTERNAL_SERVER_ERROR", {
+        message: "Output validation failed",
+        cause: new ValidationError({
+          message: "Output validation failed",
+          issues: result.issues,
+          invalidData: output
+        })
+      });
+    }
+    return result.value;
+  });
+}
+const middlewareDone = (...rest) => {
+  const options = resolveMaybeOptionalOptions(rest);
+  return {
+    output: options.output,
+    // context can be undefined when all field is optional
+    context: options.context ?? {}
+  };
+};
+async function executeProcedureInternal(procedure, options) {
+  const inputSchemas = toArray(procedure["~orpc"].inputSchemas);
+  const outputSchemas = toArray(procedure["~orpc"].outputSchemas);
+  const orderedMiddlewares = procedure["~orpc"].orderedMiddlewares;
+  const next = async (midIndex, context, input) => {
+    let currentInput = input;
+    const startInputIndex = midIndex === 0 ? 0 : orderedMiddlewares[midIndex - 1].inputSchemasLengthAtUse ?? 0;
+    const endInputIndex = midIndex === orderedMiddlewares.length ? inputSchemas.length : orderedMiddlewares[midIndex].inputSchemasLengthAtUse ?? 0;
+    for (let i = startInputIndex; i < endInputIndex; i++) {
+      currentInput = await validateInput(i, inputSchemas[i], currentInput);
+    }
+    let currentOutput;
+    let currentContext = context;
+    if (midIndex < orderedMiddlewares.length) {
+      const { middleware } = orderedMiddlewares[midIndex];
+      const result = await runWithSpan(`middleware.${middleware.name}`, async (span) => {
+        span?.setAttribute("middleware.index", midIndex);
+        return await middleware(
+          {
+            ...options,
+            context,
+            next: (...rest) => {
+              const nextOptions = resolveMaybeOptionalOptions(rest);
+              const nextContext = nextOptions.context ?? {};
+              return next(
+                midIndex + 1,
+                { ...context, ...nextContext },
+                currentInput
+              );
+            },
+            lastEventId: options.lastEventId
+          },
+          currentInput,
+          middlewareDone
+        );
+      });
+      currentOutput = result.output;
+      currentContext = { ...context, ...result.context };
+    } else {
+      currentOutput = await runWithSpan(
+        "handler",
+        () => procedure["~orpc"].handler({ ...options, context, input: currentInput }, currentInput)
+      );
+      if (currentOutput instanceof ORPCError) {
+        if (procedure["~orpc"].opaqueReturnedErrors) {
+          throw currentOutput;
+        }
+        if (currentOutput.inferable && !currentOutput.defined) {
+          throw currentOutput;
+        }
+        const error = cloneORPCError(currentOutput);
+        error.defined = false;
+        error.inferable = true;
+        throw error;
+      }
+    }
+    const startOutputIndex = midIndex === 0 ? 0 : orderedMiddlewares[midIndex - 1].outputSchemasLengthAtUse ?? 0;
+    const endOutputIndex = midIndex === orderedMiddlewares.length ? outputSchemas.length : orderedMiddlewares[midIndex].outputSchemasLengthAtUse ?? 0;
+    for (let i = endOutputIndex - 1; i >= startOutputIndex; i--) {
+      currentOutput = await validateOutput(i, outputSchemas[i], currentOutput);
+    }
+    return { output: currentOutput, context: currentContext };
+  };
+  const { output } = await next(0, options.context, options.input);
+  return output;
+}
+
+class Procedure {
+  "~orpc";
+  constructor(def) {
+    this["~orpc"] = def;
+  }
+  /**
+   * Checks if the given instance satisfies the {@see Procedure} class/interface.
+   */
+  static [Symbol.hasInstance](instance) {
+    if (this !== Procedure) {
+      return Function.prototype[Symbol.hasInstance].call(this, instance);
+    }
+    const constructor = getConstructor(instance);
+    if (constructor === Procedure) {
+      return true;
+    }
+    return instance instanceof ProcedureContract && Array.isArray(instance["~orpc"].orderedMiddlewares) && typeof instance["~orpc"].handler === "function";
+  }
+}
+
+export { Lazy as L, Procedure as P, createORPCErrorConstructorMap as a, createProcedureClient as c, unlazy as u };

package/dist/shared/server.DBANIheG.d.ts

@@ -0,0 +1,104 @@
+import { AnyORPCError } from '@orpc/client';
+import { OrderablePlugin, Interceptor, Promisable } from '@orpc/shared';
+import { StandardLazyRequest, StandardResponse } from '@standardserver/core';
+import { C as Context, c as ProcedureClientInterceptor, A as AnyProcedure } from './server.BL22TloH.js';
+import { Schema, ErrorMap } from '@orpc/contract';
+
+interface StandardHandlerPlugin<T extends Context> extends OrderablePlugin {
+    /**
+     * Initializes the plugin and returns new handler options.
+     * Called once per plugin instance during composition.
+     *
+     * This method allows plugins to wrap, extend, or transform handler options
+     * such as interceptors, or configuration.
+     *
+     * @param options - The current handler options from previous plugins or base configuration
+     * @returns Transformed handler options with plugin's modifications applied
+     *
+     * @example
+     * ```ts
+     * init(options) {
+     *   return {
+     *     ...options,
+     *     interceptors: [...(options.interceptors || []), myInterceptor]
+     *   }
+     * }
+     * ```
+     */
+    init?(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+declare class CompositeStandardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    readonly name = "~composite";
+    protected readonly plugins: StandardHandlerPlugin<T>[];
+    constructor(plugins?: StandardHandlerPlugin<T>[]);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+interface StandardHandlerHandleOptions<T extends Context> {
+    prefix?: `/${string}` | undefined;
+    context: T;
+}
+type StandardHandlerHandleResult = {
+    matched: true;
+    response: StandardResponse;
+} | {
+    matched: false;
+    response?: undefined;
+};
+interface StandardHandlerInterceptorOptions<T extends Context> extends StandardHandlerCodecResolvedProcedure, StandardHandlerHandleOptions<T> {
+    request: StandardLazyRequest;
+}
+type StandardHandlerInterceptor<T extends Context> = Interceptor<StandardHandlerInterceptorOptions<T>, Promise<StandardResponse>>;
+interface StandardHandlerRoutingInterceptorOptions<T extends Context> extends StandardHandlerHandleOptions<T> {
+    request: StandardLazyRequest;
+}
+type StandardHandlerRoutingInterceptor<T extends Context> = Interceptor<StandardHandlerRoutingInterceptorOptions<T>, Promise<StandardHandlerHandleResult>>;
+interface StandardHandlerOptions<TContext extends Context> {
+    /**
+     * Fired on every request before routing, useful when you want
+     * to intercept all requests regardless of whether they match a procedure or not.
+     *
+     * @examples
+     * - batch plugins - separate one request into multiple and call multiple next
+     * - openapi spec plugin - to intercept a request and early response
+     */
+    routingInterceptors?: StandardHandlerRoutingInterceptor<TContext>[];
+    /**
+     * interceptor run after routing and before error handler,
+     * useful for error handling, logging, metrics, etc.
+     */
+    interceptors?: StandardHandlerInterceptor<TContext>[];
+    /**
+     *
+     * ClientInterceptor equivalent with createRouterClient.interceptors / createProcedure.interceptors
+     * useful for error handling, logging, metrics, etc. (not counting encoding/decoding)
+     */
+    clientInterceptors?: ProcedureClientInterceptor<TContext, Schema<unknown>, ErrorMap, any>[];
+    plugins?: StandardHandlerPlugin<TContext>[];
+}
+declare class StandardHandler<T extends Context> {
+    private readonly codec;
+    private readonly routingInterceptors;
+    private readonly interceptors;
+    private readonly clientInterceptors;
+    constructor(codec: StandardHandlerCodec<T>, options: StandardHandlerOptions<T>);
+    handle(request: StandardLazyRequest, { context, prefix }: StandardHandlerHandleOptions<T>): Promise<StandardHandlerHandleResult>;
+}
+declare class OtelHandlerPlugin implements StandardHandlerPlugin<any> {
+    name: string;
+    init(options: StandardHandlerOptions<any>): StandardHandlerOptions<any>;
+}
+
+interface StandardHandlerCodecResolvedProcedure {
+    path: string[];
+    procedure: AnyProcedure;
+    decodeInput: () => Promise<unknown>;
+}
+interface StandardHandlerCodec<T extends Context> {
+    resolveProcedure(request: StandardLazyRequest, options: StandardHandlerHandleOptions<T>): Promisable<StandardHandlerCodecResolvedProcedure | undefined>;
+    encodeOutput(output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+    encodeError(error: AnyORPCError, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+}
+
+export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, StandardHandler as S };
+export type { StandardHandlerOptions as a, StandardHandlerHandleOptions as b, StandardHandlerCodec as c, StandardHandlerCodecResolvedProcedure as d, StandardHandlerPlugin as e, StandardHandlerRoutingInterceptorOptions as f, StandardHandlerInterceptorOptions as g, StandardHandlerHandleResult as h, StandardHandlerInterceptor as i, StandardHandlerRoutingInterceptor as j };

package/dist/shared/server.DJIkub_t.d.mts

@@ -0,0 +1,104 @@
+import { AnyORPCError } from '@orpc/client';
+import { OrderablePlugin, Interceptor, Promisable } from '@orpc/shared';
+import { StandardLazyRequest, StandardResponse } from '@standardserver/core';
+import { C as Context, c as ProcedureClientInterceptor, A as AnyProcedure } from './server.BL22TloH.mjs';
+import { Schema, ErrorMap } from '@orpc/contract';
+
+interface StandardHandlerPlugin<T extends Context> extends OrderablePlugin {
+    /**
+     * Initializes the plugin and returns new handler options.
+     * Called once per plugin instance during composition.
+     *
+     * This method allows plugins to wrap, extend, or transform handler options
+     * such as interceptors, or configuration.
+     *
+     * @param options - The current handler options from previous plugins or base configuration
+     * @returns Transformed handler options with plugin's modifications applied
+     *
+     * @example
+     * ```ts
+     * init(options) {
+     *   return {
+     *     ...options,
+     *     interceptors: [...(options.interceptors || []), myInterceptor]
+     *   }
+     * }
+     * ```
+     */
+    init?(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+declare class CompositeStandardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    readonly name = "~composite";
+    protected readonly plugins: StandardHandlerPlugin<T>[];
+    constructor(plugins?: StandardHandlerPlugin<T>[]);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+interface StandardHandlerHandleOptions<T extends Context> {
+    prefix?: `/${string}` | undefined;
+    context: T;
+}
+type StandardHandlerHandleResult = {
+    matched: true;
+    response: StandardResponse;
+} | {
+    matched: false;
+    response?: undefined;
+};
+interface StandardHandlerInterceptorOptions<T extends Context> extends StandardHandlerCodecResolvedProcedure, StandardHandlerHandleOptions<T> {
+    request: StandardLazyRequest;
+}
+type StandardHandlerInterceptor<T extends Context> = Interceptor<StandardHandlerInterceptorOptions<T>, Promise<StandardResponse>>;
+interface StandardHandlerRoutingInterceptorOptions<T extends Context> extends StandardHandlerHandleOptions<T> {
+    request: StandardLazyRequest;
+}
+type StandardHandlerRoutingInterceptor<T extends Context> = Interceptor<StandardHandlerRoutingInterceptorOptions<T>, Promise<StandardHandlerHandleResult>>;
+interface StandardHandlerOptions<TContext extends Context> {
+    /**
+     * Fired on every request before routing, useful when you want
+     * to intercept all requests regardless of whether they match a procedure or not.
+     *
+     * @examples
+     * - batch plugins - separate one request into multiple and call multiple next
+     * - openapi spec plugin - to intercept a request and early response
+     */
+    routingInterceptors?: StandardHandlerRoutingInterceptor<TContext>[];
+    /**
+     * interceptor run after routing and before error handler,
+     * useful for error handling, logging, metrics, etc.
+     */
+    interceptors?: StandardHandlerInterceptor<TContext>[];
+    /**
+     *
+     * ClientInterceptor equivalent with createRouterClient.interceptors / createProcedure.interceptors
+     * useful for error handling, logging, metrics, etc. (not counting encoding/decoding)
+     */
+    clientInterceptors?: ProcedureClientInterceptor<TContext, Schema<unknown>, ErrorMap, any>[];
+    plugins?: StandardHandlerPlugin<TContext>[];
+}
+declare class StandardHandler<T extends Context> {
+    private readonly codec;
+    private readonly routingInterceptors;
+    private readonly interceptors;
+    private readonly clientInterceptors;
+    constructor(codec: StandardHandlerCodec<T>, options: StandardHandlerOptions<T>);
+    handle(request: StandardLazyRequest, { context, prefix }: StandardHandlerHandleOptions<T>): Promise<StandardHandlerHandleResult>;
+}
+declare class OtelHandlerPlugin implements StandardHandlerPlugin<any> {
+    name: string;
+    init(options: StandardHandlerOptions<any>): StandardHandlerOptions<any>;
+}
+
+interface StandardHandlerCodecResolvedProcedure {
+    path: string[];
+    procedure: AnyProcedure;
+    decodeInput: () => Promise<unknown>;
+}
+interface StandardHandlerCodec<T extends Context> {
+    resolveProcedure(request: StandardLazyRequest, options: StandardHandlerHandleOptions<T>): Promisable<StandardHandlerCodecResolvedProcedure | undefined>;
+    encodeOutput(output: unknown, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+    encodeError(error: AnyORPCError, procedure: AnyProcedure, path: string[], options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
+}
+
+export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, StandardHandler as S };
+export type { StandardHandlerOptions as a, StandardHandlerHandleOptions as b, StandardHandlerCodec as c, StandardHandlerCodecResolvedProcedure as d, StandardHandlerPlugin as e, StandardHandlerRoutingInterceptorOptions as f, StandardHandlerInterceptorOptions as g, StandardHandlerHandleResult as h, StandardHandlerInterceptor as i, StandardHandlerRoutingInterceptor as j };

package/dist/shared/server.D_QauotT.mjs

@@ -0,0 +1,30 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standardserver/core';
+
+class CSRFGuardHandlerPlugin {
+  name = "~csrf-guard";
+  init(options) {
+    const interceptor = async (interceptorOptions) => {
+      const mode = flattenStandardHeader(
+        interceptorOptions.request.headers["sec-fetch-mode"]
+      )?.toLowerCase();
+      if (mode === void 0) {
+        return interceptorOptions.next();
+      }
+      if (mode === "cors" || mode === "same-origin") {
+        return interceptorOptions.next();
+      }
+      throw new ORPCError("FORBIDDEN", {
+        message: "Request blocked by CSRF protection."
+      });
+    };
+    return {
+      ...options,
+      // appended last so user's interceptors can catch ORPCError
+      interceptors: [...toArray(options.interceptors), interceptor]
+    };
+  }
+}
+
+export { CSRFGuardHandlerPlugin as C };