@orpc/server 2.0.0-beta.26 → 2.0.0-beta.28

package/dist/adapters/standard/index.mjs

@@ -1,8 +1,8 @@
-export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
+export { C as CompositeStandardHandlerPlugin, O as OtelHandlerPlugin, R as RPCHandlerCodec, a as RPCMatcher, b as RPC_DEFAULT_ALLOW_METHODS, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
 export { r as resolveFriendlyStandardHandlerHandleOptions } from '../../shared/server.W91HSRkE.mjs';
 import '@orpc/client';
 import '@orpc/shared';
 import '@standardserver/core';
-import '../../shared/server.7T18Khvf.mjs';
+import '../../shared/server.CkButhNT.mjs';
 import '@orpc/contract';
-import '../../shared/server.DgunZU0v.mjs';
+import '../../shared/server.Dh77P3ii.mjs';

package/dist/adapters/standard-peer/index.d.mts

@@ -1,7 +1,7 @@
 import { Value, Promisable } from '@orpc/shared';
 import { StandardLazyRequest, StandardResponse } from '@standardserver/core';
-import { C as Context } from '../../shared/server.CwrYlF72.mjs';
-import { c as StandardHandlerHandleOptions, b as StandardHandler } from '../../shared/server.JbCIPL4P.mjs';
+import { Context } from '../../index.mjs';
+import { StandardHandlerHandleOptions, StandardHandler } from '../standard/index.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 

package/dist/adapters/standard-peer/index.d.ts

@@ -1,7 +1,7 @@
 import { Value, Promisable } from '@orpc/shared';
 import { StandardLazyRequest, StandardResponse } from '@standardserver/core';
-import { C as Context } from '../../shared/server.CwrYlF72.js';
-import { c as StandardHandlerHandleOptions, b as StandardHandler } from '../../shared/server.DrN1Pj1-.js';
+import { Context } from '../../index.js';
+import { StandardHandlerHandleOptions, StandardHandler } from '../standard/index.js';
 import '@orpc/client';
 import '@orpc/contract';
 

package/dist/adapters/websocket/index.d.mts

@@ -1,10 +1,10 @@
 import { Arrayable, MaybeOptionalOptions } from '@orpc/shared';
 import { EncodePeerMessageOptions, DecodePeerMessageOptions } from '@standardserver/peer';
-import { C as Context } from '../../shared/server.CwrYlF72.mjs';
-import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.JbCIPL4P.mjs';
+import { Context } from '../../index.mjs';
+import { StandardHandler, StandardHandlerOptions } from '../standard/index.mjs';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.mjs';
-import { R as Router } from '../../shared/server.Dm0os-OP.mjs';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.CkNnZ5F-.mjs';
+import { Router } from '../../index.mjs';
+import { RPCHandlerCodecOptions } from '../standard/index.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/websocket/index.d.ts

@@ -1,10 +1,10 @@
 import { Arrayable, MaybeOptionalOptions } from '@orpc/shared';
 import { EncodePeerMessageOptions, DecodePeerMessageOptions } from '@standardserver/peer';
-import { C as Context } from '../../shared/server.CwrYlF72.js';
-import { b as StandardHandler, a as StandardHandlerOptions } from '../../shared/server.DrN1Pj1-.js';
+import { Context } from '../../index.js';
+import { StandardHandler, StandardHandlerOptions } from '../standard/index.js';
 import { StandardPeerRequestHandlerOptions } from '../standard-peer/index.js';
-import { R as Router } from '../../shared/server.DtfwuV6U.js';
-import { R as RPCHandlerCodecOptions } from '../../shared/server.C2n16pp0.js';
+import { Router } from '../../index.js';
+import { RPCHandlerCodecOptions } from '../standard/index.js';
 import '@orpc/client';
 import '@orpc/contract';
 import '@standardserver/core';

package/dist/adapters/websocket/index.mjs

@@ -1,12 +1,12 @@
 import { toStringOrBytes, resolveMaybeOptionalOptions, sequential, loadBytes } from '@orpc/shared';
 import { ServerPeer, encodePeerMessage, decodePeerMessage, isClientPeerSendMessage } from '@standardserver/peer';
 import { c as createStandardPeerRequestHandler } from '../../shared/server.CX4vUnDk.mjs';
-import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.Cbv46U7N.mjs';
+import { R as RPCHandlerCodec, S as StandardHandler } from '../../shared/server.D9VprDph.mjs';
 import '@orpc/client';
 import '@standardserver/core';
-import '../../shared/server.7T18Khvf.mjs';
+import '../../shared/server.CkButhNT.mjs';
 import '@orpc/contract';
-import '../../shared/server.DgunZU0v.mjs';
+import '../../shared/server.Dh77P3ii.mjs';
 
 class WebSocketHandler {
   constructor(handler, options = {}) {

package/dist/extensions/callable.d.mts

@@ -1,7 +1,7 @@
 import { AnyORPCError, ClientContext } from '@orpc/client';
 import { AnySchema, ErrorMap } from '@orpc/contract';
 import { MaybeOptionalOptions } from '@orpc/shared';
-import { C as Context, P as ProcedureClientOptions, a as Procedure, b as ProcedureClient } from '../shared/server.CwrYlF72.mjs';
+import { Context, ProcedureClientOptions, Procedure, ProcedureClient } from '../index.mjs';
 
 declare module '@orpc/server' {
     interface DecoratedProcedure<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> {

package/dist/extensions/callable.d.ts

@@ -1,7 +1,7 @@
 import { AnyORPCError, ClientContext } from '@orpc/client';
 import { AnySchema, ErrorMap } from '@orpc/contract';
 import { MaybeOptionalOptions } from '@orpc/shared';
-import { C as Context, P as ProcedureClientOptions, a as Procedure, b as ProcedureClient } from '../shared/server.CwrYlF72.js';
+import { Context, ProcedureClientOptions, Procedure, ProcedureClient } from '../index.js';
 
 declare module '@orpc/server' {
     interface DecoratedProcedure<TInitialContext extends Context, TInjectedContext extends Context, TInputSchema extends AnySchema, TOutputSchema extends AnySchema, TErrorMap extends ErrorMap, TReturnedError extends AnyORPCError> {

package/dist/extensions/callable.mjs

@@ -1,5 +1,5 @@
-import { c as createProcedureClient } from '../shared/server.7T18Khvf.mjs';
-import { D as DecoratedProcedure } from '../shared/server.B2pXdfpL.mjs';
+import { c as createProcedureClient } from '../shared/server.CkButhNT.mjs';
+import { D as DecoratedProcedure } from '../shared/server.eCTV8Vpp.mjs';
 import '@orpc/client';
 import '@orpc/contract';
 import '@orpc/shared';

package/dist/index.d.mts

@@ -8,7 +8,7 @@ import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialCo
 export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.CwrYlF72.mjs';
 import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.Dm0os-OP.mjs';
 export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.Dm0os-OP.mjs';
-export { ErrorEvent, EventMeta, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
+export { ErrorEvent, EventMeta, StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
 
 interface DecoratedMiddleware<TInContext extends Context, TOutContext extends Context, TInput, TOutput, TErrorMap extends ErrorMap> extends Middleware<TInContext, TOutContext, TInput, TOutput, TErrorMap> {
     adaptInput<T>(adapt: (input: T) => TInput): DecoratedMiddleware<TInContext, TOutContext, T, TOutput, TErrorMap>;

package/dist/index.d.ts

@@ -8,7 +8,7 @@ import { C as Context, d as Middleware, M as MergedContext, e as MergedInitialCo
 export { j as LazyDefinition, k as MiddlewareDefinition, l as MiddlewareDone, m as MiddlewareDoneOptions, n as MiddlewareNext, o as MiddlewareNextOptions, p as MiddlewareOptions, q as MiddlewareResult, c as ProcedureClientInterceptor, r as ProcedureClientInterceptorOptions, s as ProcedureDefinition, t as ProcedureHandlerOptions, u as createProcedureClient, v as unlazy } from './shared/server.CwrYlF72.js';
 import { A as AnyRouter, R as Router, C as ContractedRouter, I as InferRouterInitialContext } from './shared/server.DtfwuV6U.js';
 export { a as InferRouterCurrentContexts, b as InferRouterError, c as InferRouterErrors, a as InferRouterFinalContexts, d as InferRouterInitialContexts, e as InferRouterInputs, f as InferRouterOutputs } from './shared/server.DtfwuV6U.js';
-export { ErrorEvent, EventMeta, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
+export { ErrorEvent, EventMeta, StandardBody, StandardBodyHint, StandardHeaders, StandardLazyRequest, StandardLazyResponse, StandardMethod, StandardRequest, StandardResponse, StandardUrl, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';
 
 interface DecoratedMiddleware<TInContext extends Context, TOutContext extends Context, TInput, TOutput, TErrorMap extends ErrorMap> extends Middleware<TInContext, TOutContext, TInput, TOutput, TErrorMap> {
     adaptInput<T>(adapt: (input: T) => TInput): DecoratedMiddleware<TInContext, TOutContext, T, TOutput, TErrorMap>;

package/dist/index.mjs

@@ -2,11 +2,11 @@ import { mergeErrorMap, resolveMetaPlugins, getHiddenMetaPlugins, ProcedureContr
 export { ValidationError, asyncIteratorObject, defineMeta, error, eventIterator, reconcileORPCError, type } from '@orpc/contract';
 import { toArray, bindMethods, isTypescriptObject, resolveMaybeOptionalOptions } from '@orpc/shared';
 export { AsyncIteratorClass, asyncIteratorToStream, asyncIteratorToUnproxiedDataStream, asyncIteratorToStream as eventIteratorToStream, asyncIteratorToUnproxiedDataStream as eventIteratorToUnproxiedDataStream, onAsyncIteratorObjectError, onError, onFinish, onReadableStreamError, onStart, onSuccess, streamToAsyncIteratorObject, streamToAsyncIteratorObject as streamToEventIterator } from '@orpc/shared';
-import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.7T18Khvf.mjs';
-export { u as unlazy } from './shared/server.7T18Khvf.mjs';
-import { D as DecoratedProcedure } from './shared/server.B2pXdfpL.mjs';
-import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.DgunZU0v.mjs';
-export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.DgunZU0v.mjs';
+import { L as Lazy, P as Procedure, c as createProcedureClient } from './shared/server.CkButhNT.mjs';
+export { u as unlazy } from './shared/server.CkButhNT.mjs';
+import { D as DecoratedProcedure } from './shared/server.eCTV8Vpp.mjs';
+import { b as augmentRouter, d as augmentImplementedRouter, e as withHiddenRouterContract, f as createGuardedProcedureLazy, g as getRouter } from './shared/server.Dh77P3ii.mjs';
+export { a as DEFAULT_ERROR_STATUS, D as DEFAULT_SUCCESS_STATUS, h as call, c as createContractProcedure, i as getHiddenRouterContract, u as unlazyRouter, j as walkProcedureContractsAsync, w as walkProcedureContractsSync } from './shared/server.Dh77P3ii.mjs';
 import { RECURSIVE_CLIENT_UNWRAP_KEYS } from '@orpc/client';
 export { COMMON_ERROR_STATUS_MAP, ORPCError, RPCJsonSerializer, RPCSerializer, cloneORPCError, isDefinedError, isInferableError, safe, toORPCError } from '@orpc/client';
 export { ErrorEvent, getEventMeta, unwrapEvent, withEventMeta } from '@standardserver/core';

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
 import { Value, Promisable, ThrowableError } from '@orpc/shared';
 import { StandardLazyRequest, StandardHeaders, StandardMethod } from '@standardserver/core';
-import { C as Context } from '../shared/server.CwrYlF72.mjs';
-import { S as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.JbCIPL4P.mjs';
+import { Context } from '../index.mjs';
+import { StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions, StandardHandlerOptions, StandardHandlerInterceptorOptions } from '../adapters/standard/index.mjs';
 export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.D0Ipbmdv.mjs';
 import '@orpc/client';
 import '@orpc/contract';
@@ -96,18 +96,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
      *
      * @default (origin) => origin
      */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
      *
      * @default undefined
      */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
      */
     allowMethods?: readonly string[];
     /**
@@ -155,6 +155,28 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /** Judge the real request, before batch splits it into client-authored sub-requests. */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}
+
 interface MethodOverrideHandlerPluginOptions {
     /**
      * The query parameter carrying the override method.
@@ -323,22 +345,40 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+interface TimeoutHandlerPluginOptions<T extends Context> {
+    /**
+     * Timeout in milliseconds before the request signal is aborted.
+     * This only covers producing the response, use `streamingTimeout`
+     * to limit streaming response bodies.
+     * Use `null` or `undefined` to disable the timeout.
+     */
+    timeout: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+    /**
+     * Timeout in milliseconds for the full duration of a streaming response body
+     * (async iterator object or readable stream), measured from when the response is produced.
+     * When exceeded, the request signal is aborted and the body ends
+     * once its producer honors the signal.
+     * Usually higher than `timeout`.
+     * Use `null` or `undefined` to disable the timeout.
+     *
+     * @default undefined (streaming responses run without limit)
+     */
+    streamingTimeout?: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+}
 /**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @remarks
- * Unlike `SameSite` cookies, this protection also covers cross-site requests that
- * still carry cookies, so it is the recommended safeguard when you enable the `GET`
- * method on RPC handlers or rely on cookie-based authentication.
+ * The Timeout Handler Plugin aborts the request signal with an `AbortError`
+ * when handling exceeds a configured timeout. It only aborts the signal,
+ * the procedure must honor it to stop early and produce the response.
  *
- * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
+ * @see {@link https://orpc.dev/docs/plugins/timeout | Timeout Plugin}
  */
-declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    private readonly timeout;
+    private readonly streamingTimeout;
     name: string;
+    constructor(options: NoInfer<TimeoutHandlerPluginOptions<T>>);
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };

package/dist/plugins/index.d.ts

@@ -1,7 +1,7 @@
 import { Value, Promisable, ThrowableError } from '@orpc/shared';
 import { StandardLazyRequest, StandardHeaders, StandardMethod } from '@standardserver/core';
-import { C as Context } from '../shared/server.CwrYlF72.js';
-import { S as StandardHandlerPlugin, f as StandardHandlerRoutingInterceptorOptions, a as StandardHandlerOptions, g as StandardHandlerInterceptorOptions } from '../shared/server.DrN1Pj1-.js';
+import { Context } from '../index.js';
+import { StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions, StandardHandlerOptions, StandardHandlerInterceptorOptions } from '../adapters/standard/index.js';
 export { R as RequestLimitHandlerPlugin, a as RequestLimitHandlerPluginOptions } from '../shared/server.BhHrioCw.js';
 import '@orpc/client';
 import '@orpc/contract';
@@ -96,18 +96,18 @@ interface CORSHandlerPluginOptions<T extends Context> {
      *
      * @default (origin) => origin
      */
-    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    origin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Timing-Allow-Origin` header.
      * Can be a string, an array of allowed origins, or a function that returns the allowed origin(s).
      *
      * @default undefined
      */
-    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]>;
+    timingOrigin?: Value<string | readonly string[] | null | undefined, [origin: string | undefined, options: StandardHandlerRoutingInterceptorOptions<T>]>;
     /**
      * Configures the `Access-Control-Allow-Methods` header for preflight requests.
      *
-     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
      */
     allowMethods?: readonly string[];
     /**
@@ -155,6 +155,28 @@ declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlu
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    /** Judge the real request, before batch splits it into client-authored sub-requests. */
+    after: string[];
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}
+
 interface MethodOverrideHandlerPluginOptions {
     /**
      * The query parameter carrying the override method.
@@ -323,22 +345,40 @@ declare class RethrowHandlerPlugin<T extends Context> implements StandardHandler
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
+interface TimeoutHandlerPluginOptions<T extends Context> {
+    /**
+     * Timeout in milliseconds before the request signal is aborted.
+     * This only covers producing the response, use `streamingTimeout`
+     * to limit streaming response bodies.
+     * Use `null` or `undefined` to disable the timeout.
+     */
+    timeout: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+    /**
+     * Timeout in milliseconds for the full duration of a streaming response body
+     * (async iterator object or readable stream), measured from when the response is produced.
+     * When exceeded, the request signal is aborted and the body ends
+     * once its producer honors the signal.
+     * Usually higher than `timeout`.
+     * Use `null` or `undefined` to disable the timeout.
+     *
+     * @default undefined (streaming responses run without limit)
+     */
+    streamingTimeout?: Value<number | null | undefined, [options: StandardHandlerInterceptorOptions<T>]>;
+}
 /**
- * Adds basic Cross-Site Request Forgery (CSRF) protection to your oRPC application.
- * When a request includes cookies, it helps ensure the request originates from JavaScript
- * (for example, fetch/XHR) rather than from standard HTML forms or direct browser navigation.
- *
- * @remarks
- * Unlike `SameSite` cookies, this protection also covers cross-site requests that
- * still carry cookies, so it is the recommended safeguard when you enable the `GET`
- * method on RPC handlers or rely on cookie-based authentication.
+ * The Timeout Handler Plugin aborts the request signal with an `AbortError`
+ * when handling exceeds a configured timeout. It only aborts the signal,
+ * the procedure must honor it to stop early and produce the response.
  *
- * @see {@link https://orpc.dev/docs/plugins/simple-csrf-protection | Simple CSRF Protection Plugin}
+ * @see {@link https://orpc.dev/docs/plugins/timeout | Timeout Plugin}
  */
-declare class SimpleCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+declare class TimeoutHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    private readonly timeout;
+    private readonly streamingTimeout;
     name: string;
+    constructor(options: NoInfer<TimeoutHandlerPluginOptions<T>>);
     init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
 }
 
-export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, SimpleCsrfProtectionHandlerPlugin };
-export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions };
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin, CORSHandlerPlugin, CORSHandlerPlugin as CORSPlugin, GetMethodCsrfProtectionHandlerPlugin, MethodOverrideHandlerPlugin, RequestCompressionHandlerPlugin, RequestHeadersHandlerPlugin, RequestHeadersHandlerPlugin as RequestHeadersPlugin, ResponseCompressionHandlerPlugin, ResponseHeadersHandlerPlugin, ResponseHeadersHandlerPlugin as ResponseHeadersPlugin, RethrowHandlerPlugin, TimeoutHandlerPlugin };
+export type { BatchHandlerPluginOptions, CORSHandlerPluginOptions, MethodOverrideHandlerPluginOptions, RequestHeadersHandlerPluginContext, RequestHeadersHandlerPluginContext as RequestHeadersPluginContext, ResponseCompressionHandlerPluginOptions, ResponseHeadersHandlerPluginContext, ResponseHeadersHandlerPluginContext as ResponseHeadersPluginContext, RethrowHandlerPluginOptions, TimeoutHandlerPluginOptions };