@orpc/server 2.0.0-beta.24 → 2.0.0-beta.25

package/dist/adapters/aws-lambda/index.d.mts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { S as StandardHandlerPlugin, b as StandardHandler, c as StandardHandlerHandleOptions, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -75,17 +75,6 @@ declare class AwsLambdaHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends AwsLambdaHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol on AWS Lambda,

package/dist/adapters/aws-lambda/index.d.ts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { S as StandardHandlerPlugin, b as StandardHandler, c as StandardHandlerHandleOptions, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -75,17 +75,6 @@ declare class AwsLambdaHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends AwsLambdaHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol on AWS Lambda,

package/dist/adapters/aws-lambda/index.mjs

@@ -1,8 +1,7 @@
-import { sortPlugins, intercept, resolveMaybeOptionalOptions, toArray } from '@orpc/shared';
+import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/aws-lambda';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { C as CSRFGuardHandlerPlugin } from '../../shared/server.D_QauotT.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';
@@ -58,12 +57,6 @@ class AwsLambdaHandler {
 
 class RPCHandler extends AwsLambdaHandler {
   constructor(router, options = {}) {
-    if (options.csrfGuardPlugin?.enabled !== false) {
-      options = {
-        ...options,
-        plugins: [...toArray(options.plugins), new CSRFGuardHandlerPlugin()]
-      };
-    }
     const codec = new RPCHandlerCodec(router, options);
     const handler = new StandardHandler(codec, options);
     super(handler, options);

package/dist/adapters/crossws/index.d.mts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/crossws/index.d.ts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/crossws/index.mjs

@@ -1,7 +1,7 @@
 import { resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';

package/dist/adapters/fastify/index.d.mts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -71,17 +71,6 @@ declare class FastifyHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends FastifyHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol inside a Fastify server.

package/dist/adapters/fastify/index.d.ts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -71,17 +71,6 @@ declare class FastifyHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends FastifyHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol inside a Fastify server.

package/dist/adapters/fastify/index.mjs

@@ -1,8 +1,7 @@
-import { sortPlugins, intercept, resolveMaybeOptionalOptions, toArray } from '@orpc/shared';
+import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/fastify';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { C as CSRFGuardHandlerPlugin } from '../../shared/server.D_QauotT.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';
@@ -58,12 +57,6 @@ class FastifyHandler {
 
 class RPCHandler extends FastifyHandler {
   constructor(router, options = {}) {
-    if (options.csrfGuardPlugin?.enabled !== false) {
-      options = {
-        ...options,
-        plugins: [...toArray(options.plugins), new CSRFGuardHandlerPlugin()]
-      };
-    }
     const codec = new RPCHandlerCodec(router, options);
     const handler = new StandardHandler(codec, options);
     super(handler, options);

package/dist/adapters/fetch/index.d.mts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -73,17 +73,6 @@ declare class FetchHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends FetchHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardHandlerPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol using the Fetch API

package/dist/adapters/fetch/index.d.ts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -73,17 +73,6 @@ declare class FetchHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends FetchHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardHandlerPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol using the Fetch API

package/dist/adapters/fetch/index.mjs

@@ -1,9 +1,8 @@
 export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
-import { sortPlugins, intercept, resolveMaybeOptionalOptions, toArray } from '@orpc/shared';
+import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, toFetchResponse } from '@standardserver/fetch';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { C as CSRFGuardHandlerPlugin } from '../../shared/server.D_QauotT.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';
@@ -60,12 +59,6 @@ class FetchHandler {
 
 class RPCHandler extends FetchHandler {
   constructor(router, options = {}) {
-    if (options.csrfGuardHandlerPlugin?.enabled !== false) {
-      options = {
-        ...options,
-        plugins: [...toArray(options.plugins), new CSRFGuardHandlerPlugin()]
-      };
-    }
     const codec = new RPCHandlerCodec(router, options);
     const handler = new StandardHandler(codec, options);
     super(handler, options);

package/dist/adapters/message-port/index.d.mts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/message-port/index.d.ts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/message-port/index.mjs

@@ -2,7 +2,7 @@ import { onMessagePortMessage, onMessagePortClose, postMessagePortMessage } from
 import { value, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage, isPeerMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';

package/dist/adapters/node/index.d.mts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -72,17 +72,6 @@ declare class NodeHttpHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends NodeHttpHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol using Node.js built-in

package/dist/adapters/node/index.d.ts

@@ -5,7 +5,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { S as StandardHandlerPlugin, c as StandardHandlerHandleOptions, b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { FriendlyStandardHandlerHandleOptions } from '../standard/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';
@@ -72,17 +72,6 @@ declare class NodeHttpHandler<T extends Context> {
 }
 
 interface RPCHandlerOptions<T extends Context> extends NodeHttpHandlerOptions<T>, Omit<StandardHandlerOptions<T>, 'plugins'>, RPCHandlerCodecOptions<T> {
-    /**
-     * Configuration for {@link CSRFGuardHandlerPlugin}, which is enabled by default for `RPCHandler` over HTTP.
-     */
-    csrfGuardPlugin?: {
-        /**
-         * If `false`, this plugin is disabled.
-         *
-         * @default true
-         */
-        enabled?: boolean;
-    };
 }
 /**
  * Serves an oRPC router over the RPC protocol using Node.js built-in

package/dist/adapters/node/index.mjs

@@ -1,9 +1,8 @@
 export { R as BodyLimitPlugin } from '../../shared/server.Cd4Z1hpV.mjs';
-import { sortPlugins, intercept, resolveMaybeOptionalOptions, toArray } from '@orpc/shared';
+import { sortPlugins, intercept, resolveMaybeOptionalOptions } from '@orpc/shared';
 import { toStandardLazyRequest, sendStandardResponse } from '@standardserver/node';
 import { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
-import { C as CSRFGuardHandlerPlugin } from '../../shared/server.D_QauotT.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '@standardserver/fetch';
@@ -60,12 +59,6 @@ class NodeHttpHandler {
 
 class RPCHandler extends NodeHttpHandler {
   constructor(router, options = {}) {
-    if (options.csrfGuardPlugin?.enabled !== false) {
-      options = {
-        ...options,
-        plugins: [...toArray(options.plugins), new CSRFGuardHandlerPlugin()]
-      };
-    }
     const codec = new RPCHandlerCodec(router, options);
     const handler = new StandardHandler(codec, options);
     super(handler, options);

package/dist/adapters/standard/index.d.mts

@@ -1,6 +1,6 @@
 import { c as StandardHandlerHandleOptions } from '../../shared/server.JbCIPL4P.mjs';
 export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, b as StandardHandler, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure, h as StandardHandlerHandleResult, i as StandardHandlerInterceptor, g as StandardHandlerInterceptorOptions, a as StandardHandlerOptions, S as StandardHandlerPlugin, j as StandardHandlerRoutingInterceptor, f as StandardHandlerRoutingInterceptorOptions } from '../../shared/server.JbCIPL4P.mjs';
-export { a as RPCHandlerCodec, R as RPCHandlerCodecOptions, b as RPCMatcher, c as RPCMatcherOptions } from '../../shared/server.zySQaS-n.mjs';
+export { a as RPCHandlerCodec, R as RPCHandlerCodecOptions, b as RPCMatcher, c as RPCMatcherOptions, d as RPC_DEFAULT_ALLOW_METHODS } from '../../shared/server.CkNnZ5F-.mjs';
 import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 export { StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl } from '@standardserver/core';
 import '@orpc/client';

package/dist/adapters/standard/index.d.ts

@@ -1,6 +1,6 @@
 import { c as StandardHandlerHandleOptions } from '../../shared/server.DrN1Pj1-.js';
 export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, b as StandardHandler, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure, h as StandardHandlerHandleResult, i as StandardHandlerInterceptor, g as StandardHandlerInterceptorOptions, a as StandardHandlerOptions, S as StandardHandlerPlugin, j as StandardHandlerRoutingInterceptor, f as StandardHandlerRoutingInterceptorOptions } from '../../shared/server.DrN1Pj1-.js';
-export { a as RPCHandlerCodec, R as RPCHandlerCodecOptions, b as RPCMatcher, c as RPCMatcherOptions } from '../../shared/server.BUvC0G_8.js';
+export { a as RPCHandlerCodec, R as RPCHandlerCodecOptions, b as RPCMatcher, c as RPCMatcherOptions, d as RPC_DEFAULT_ALLOW_METHODS } from '../../shared/server.C2n16pp0.js';
 import { C as Context } from '../../shared/server.CwrYlF72.js';
 export { StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl } from '@standardserver/core';
 import '@orpc/client';

package/dist/adapters/standard/index.mjs

@@ -1,4 +1,4 @@
-export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 export { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@orpc/shared';

package/dist/adapters/websocket/index.d.mts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.mjs';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.mjs';
 import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.zySQaS-n.mjs';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/websocket/index.d.ts

@@ -4,7 +4,7 @@ import { C as Context } from '../../shared/server.CwrYlF72.js';
 import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.js';
 import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.BUvC0G_8.js';
+import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/websocket/index.mjs

@@ -1,7 +1,7 @@
 import { toStringOrBytes, resolveMaybeOptionalOptions, sequential, loadBytes } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.DEGjTAPW.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
 import '@orpc/client';
 import '@standardserver/core';
 import '../../shared/server.7T18Khvf.mjs';

package/dist/plugins/index.d.mts

@@ -155,21 +155,6 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @remarks
- * **Note**: This plugin is enabled by default for `RPCHandler` over HTTP.
- *
- * @see {@link https://orpc.dev/docs/plugins/csrf-guard | CSRF Guard Plugin}
- */
-declare class CSRFGuardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -302,5 +287,22 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, CSRFGuardHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };
+/**
+ * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
+ * When a request includes cookies, it helps ensure the request originates from JavaScript
+ * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
+ *
+ * @remarks
+ * Unlike `SameSite` cookies, this protection also covers cross-site requests that
+ * still carry cookies, so it is the recommended safeguard when you enable the `GET`
+ * method on RPC handlers or rely on cookie-based authentication.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
+ */
+declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };

package/dist/plugins/index.d.ts

@@ -155,21 +155,6 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-/**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @remarks
- * **Note**: This plugin is enabled by default for `RPCHandler` over HTTP.
- *
- * @see {@link https://orpc.dev/docs/plugins/csrf-guard | CSRF Guard Plugin}
- */
-declare class CSRFGuardHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
-    name: string;
-    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
-}
-
 /**
  * Decompresses incoming request bodies based on the Content-Encoding header,
  * supporting gzip, deflate, and deflate-raw.
@@ -302,5 +287,22 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, CSRFGuardHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };
+/**
+ * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
+ * When a request includes cookies, it helps ensure the request originates from JavaScript
+ * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
+ *
+ * @remarks
+ * Unlike `SameSite` cookies, this protection also covers cross-site requests that
+ * still carry cookies, so it is the recommended safeguard when you enable the `GET`
+ * method on RPC handlers or rely on cookie-based authentication.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
+ */
+declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
 export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };

package/dist/plugins/index.mjs

@@ -1,10 +1,9 @@
 import { toArray, value, isCompressibleContentType, isAsyncIteratorObject, stringifyJSON } from '@orpc/shared';
 import { flattenStandardHeader, parseStandardUrl, generateContentDisposition, mergeStandardHeaders } from '@standardserver/core';
 import { isClientPeerSendMessage, ServerPeer, encodePeerMessage } from '@standardserver/peer';
-export { C as CSRFGuardHandlerPlugin } from '../shared/server.D_QauotT.mjs';
 import { toFetchHeaders, toStandardBody, toStandardHeaders } from '@standardserver/fetch';
 export { R as RequestLimitHandlerPlugin } from '../shared/server.Cd4Z1hpV.mjs';
-import '@orpc/client';
+import { ORPCError } from '@orpc/client';
 
 const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
 class BatchHandlerPlugin {
@@ -633,4 +632,29 @@ class RethrowHandlerPlugin {
   }
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin };
+class SimpleCsrfProtectionHandlerPlugin {
+  name = "~simple-csrf-protection";
+  init(options) {
+    const interceptor = async (interceptorOptions) => {
+      const mode = flattenStandardHeader(
+        interceptorOptions.request.headers["sec-fetch-mode"]
+      )?.toLowerCase();
+      if (mode === void 0) {
+        return interceptorOptions.next();
+      }
+      if (mode === "cors" || mode === "same-origin") {
+        return interceptorOptions.next();
+      }
+      throw new ORPCError("FORBIDDEN", {
+        message: "Request blocked by CSRF protection."
+      });
+    };
+    return {
+      ...options,
+      // appended last so user's interceptors can catch ORPCError
+      interceptors: [...toArray(options.interceptors), interceptor]
+    };
+  }
+}
+
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };

package/dist/shared/{server.BUvC0G_8.d.ts → server.C2n16pp0.d.ts}

@@ -6,6 +6,16 @@ import { A as AnyRouter } from './server.DtfwuV6U.js';
 import { AnyProcedureContract } from '@orpc/contract';
 import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.DrN1Pj1-.js';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,15 +23,27 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
@@ -65,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/dist/shared/{server.DEGjTAPW.mjs → server.Cbv46U7N.mjs}

@@ -121,13 +121,22 @@ class OtelHandlerPlugin {
   }
 }
 
+const RPC_DEFAULT_ALLOW_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
 class RPCMatcher {
   filter;
+  allowMethodsSet;
+  allowMethodsFn;
   rootRouter;
   tree = /* @__PURE__ */ new Map();
   pendingLazyRouters = /* @__PURE__ */ new Map();
   constructor(router, options = {}) {
     this.filter = options.filter ?? true;
+    const allowMethods = options.allowMethods ?? RPC_DEFAULT_ALLOW_METHODS;
+    if (typeof allowMethods !== "function") {
+      this.allowMethodsSet = new Set(allowMethods);
+    } else {
+      this.allowMethodsFn = allowMethods;
+    }
     this.rootRouter = router;
     this.index(router);
   }
@@ -147,7 +156,10 @@ class RPCMatcher {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
   }
-  async match(_method, pathname, prefix) {
+  async match(method, pathname, prefix) {
+    if (this.allowMethodsSet && !this.allowMethodsSet.has(method)) {
+      return void 0;
+    }
     if (pathname.length > 1 && pathname.endsWith("/")) {
       pathname = pathname.slice(0, -1);
     }
@@ -182,9 +194,13 @@ class RPCMatcher {
     if (entry === void 0) {
       return void 0;
     }
+    const procedure = entry.procedure ?? await this.resolveProcedure(entry);
+    if (this.allowMethodsFn && !this.allowMethodsFn(method, procedure, entry.path)) {
+      return void 0;
+    }
     return {
       path: entry.path,
-      procedure: entry.procedure ?? await this.resolveProcedure(entry)
+      procedure
     };
   }
   resolvePendingLazyRouters(pathname) {
@@ -285,4 +301,4 @@ class RPCHandlerCodec {
   }
 }
 
-export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a };
+export { CompositeStandardHandlerPlugin as C, OtelHandlerPlugin as O, RPCHandlerCodec as R, StandardHandler as S, RPCMatcher as a, RPC_DEFAULT_ALLOW_METHODS as b };

package/dist/shared/{server.zySQaS-n.d.mts → server.CkNnZ5F-.d.mts}

@@ -6,6 +6,16 @@ import { A as AnyRouter } from './server.Dm0os-OP.mjs';
 import { AnyProcedureContract } from '@orpc/contract';
 import { c as StandardHandlerHandleOptions, d as StandardHandlerCodec, e as StandardHandlerCodecResolvedProcedure } from './server.JbCIPL4P.mjs';
 
+/**
+ * Methods that can invoke procedures by default. Browsers cannot trigger them
+ * cross-site without a CORS preflight or an HTML form, unlike `GET`, which a plain
+ * `<a>` click or redirect can trigger with `SameSite=Lax` cookies attached. Other
+ * methods (`HEAD`, `OPTIONS`, `QUERY`, ...) have safe semantics that should not
+ * invoke a procedure that can modify data.
+ *
+ * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+ */
+declare const RPC_DEFAULT_ALLOW_METHODS: readonly StandardMethod[];
 interface RPCMatcherOptions {
     /**
      * Filter which procedures are exposed for matching. Return `false` to exclude.
@@ -13,15 +23,27 @@ interface RPCMatcherOptions {
      * @default true
      */
     filter?: Value<boolean, [procedure: AnyProcedureContract | AnyProcedure, path: string[]]>;
+    /**
+     * Restricts which HTTP methods can invoke procedures, either with a list of allowed
+     * methods or decided per request via a function. Requests using a disallowed method
+     * are treated as unmatched. `GET` is excluded by default because it is exposed to
+     * Cross-Site Request Forgery (CSRF) attacks.
+     *
+     * @default RPC_DEFAULT_ALLOW_METHODS (['POST', 'PUT', 'PATCH', 'DELETE'])
+     * @see {@link https://orpc.dev/docs/rpc/handler#supported-http-methods | RPC Handler - Supported HTTP Methods}
+     */
+    allowMethods?: readonly StandardMethod[] | ((method: StandardMethod, procedure: AnyProcedure, path: string[]) => boolean);
 }
 declare class RPCMatcher {
     private readonly filter;
+    private readonly allowMethodsSet;
+    private readonly allowMethodsFn;
     private readonly rootRouter;
     private readonly tree;
     private readonly pendingLazyRouters;
     constructor(router: AnyRouter, options?: RPCMatcherOptions);
     private index;
-    match(_method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
+    match(method: StandardMethod, pathname: `/${string}`, prefix: `/${string}` | undefined): Promise<{
         path: string[];
         procedure: AnyProcedure;
     } | undefined>;
@@ -65,5 +87,5 @@ declare class RPCHandlerCodec<T extends Context> implements StandardHandlerCodec
     encodeError(error: AnyORPCError, _procedure: AnyProcedure, _path: string[], _options: StandardHandlerHandleOptions<T>): Promisable<StandardResponse>;
 }
 
-export { RPCHandlerCodec as a, RPCMatcher as b };
+export { RPCHandlerCodec as a, RPCMatcher as b, RPC_DEFAULT_ALLOW_METHODS as d };
 export type { RPCHandlerCodecOptions as R, RPCMatcherOptions as c };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/server",
   "type": "module",
-  "version": "2.0.0-beta.24",
+  "version": "2.0.0-beta.25",
   "license": "MIT",
   "homepage": "https://orpc.dev",
   "repository": {
@@ -106,9 +106,9 @@
     "@standardserver/node": "^0.7.1",
     "@standardserver/peer": "^0.7.1",
     "cookie": "^2.0.1",
-    "@orpc/client": "2.0.0-beta.24",
-    "@orpc/contract": "2.0.0-beta.24",
-    "@orpc/shared": "2.0.0-beta.24"
+    "@orpc/client": "2.0.0-beta.25",
+    "@orpc/contract": "2.0.0-beta.25",
+    "@orpc/shared": "2.0.0-beta.25"
   },
   "devDependencies": {
     "crossws": "^0.4.6",

package/dist/shared/server.D_QauotT.mjs

@@ -1,30 +0,0 @@
-import { ORPCError } from '@orpc/client';
-import { toArray } from '@orpc/shared';
-import { flattenStandardHeader } from '@standardserver/core';
-
-class CSRFGuardHandlerPlugin {
-  name = "~csrf-guard";
-  init(options) {
-    const interceptor = async (interceptorOptions) => {
-      const mode = flattenStandardHeader(
-        interceptorOptions.request.headers["sec-fetch-mode"]
-      )?.toLowerCase();
-      if (mode === void 0) {
-        return interceptorOptions.next();
-      }
-      if (mode === "cors" || mode === "same-origin") {
-        return interceptorOptions.next();
-      }
-      throw new ORPCError("FORBIDDEN", {
-        message: "Request blocked by CSRF protection."
-      });
-    };
-    return {
-      ...options,
-      // appended last so user's interceptors can catch ORPCError
-      interceptors: [...toArray(options.interceptors), interceptor]
-    };
-  }
-}
-
-export { CSRFGuardHandlerPlugin as C };