@orpc/server 2.0.0-beta.46 → 2.0.0-beta.48

package/dist/middleware.mjs

@@ -0,0 +1 @@
+export {};

package/dist/plugins/batch.d.mts

@@ -0,0 +1,104 @@
+import type { Promisable, Value } from "@orpc/shared";
+import type { StandardHeaders, StandardLazyRequest, StandardResponse } from "@standard-server/core";
+import type { StandardHandlerOptions, StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions } from "../adapters/standard/index.mjs";
+import type { Context } from "../context.mjs";
+/**
+* Content type for batch responses that use the length-prefixed binary framing,
+* which they do in `streaming` mode, or when any sub-response contains binary or is a stream.
+*
+* Decoding is driven by the `standard-server` body hint, not this header,
+* so it only serves to describe the payload to logs, proxies, and dev tools.
+*/
+export declare const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
+export interface BatchHandlerPluginOptions<T extends Context> {
+	/**
+	* The max size of the batch allowed. Larger batches are rejected with a `413`,
+	* so keep the client Batch Link Plugin's `maxSize` at or below it.
+	*
+	* @default DEFAULT_BATCH_MAX_SIZE (10)
+	* @see {@link https://orpc.dev/docs/plugins/batch#max-size | Batch Plugin - Max Size}
+	*/
+	maxSize?: Value<Promisable<number>, [options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+	/**
+	* Map each subrequest in the batch before it is processed.
+	*
+	* @default merges the batch request headers into the subrequest, giving them priority over
+	* the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
+	*/
+	mapSubrequest?: ((subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest) | undefined;
+	/**
+	* Map each sub-response in the batch before it is sent.
+	*
+	* @default removes the headers the batch response already has with the same value, which the client
+	* merges back, and `set-cookie`, which the browser ignores there and JavaScript could read
+	*/
+	mapSubresponse?: ((subresponse: StandardResponse, partialBatchResponse: Pick<StandardResponse, "status" | "headers">, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardResponse) | undefined;
+	/**
+	* Success batch response status code.
+	*
+	* @default 207
+	*/
+	successStatus?: Value<Promisable<number>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+	/**
+	* Success batch response headers.
+	*
+	* In `buffered` mode, the batch response also gets the cookies its sub-responses set, and the headers they all share.
+	* In `streaming` mode, it gets only the cookies of the first sub-response to be ready.
+	* Headers set here win, and setting one to `undefined` keeps it off, except `set-cookie` and `vary`, which merge.
+	*
+	* @default {}
+	*/
+	headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+	/**
+	* Keep-alive settings for batch responses that stream.
+	*
+	* When enabled, a zero-length length-prefixed frame is sent periodically while the
+	* stream is idle (no message sent for `interval` ms). Clients ignore these frames.
+	*
+	* @default { enabled: true, interval: 15000 }
+	*/
+	keepAlive?: {
+		/**
+		* If true, a keep-alive frame is sent periodically while the stream is idle.
+		*
+		* @default true
+		*/
+		enabled: boolean;
+		/**
+		* Interval (in milliseconds) between keep-alive frames after the last message.
+		*
+		* @default 15000
+		*/
+		interval?: number | undefined;
+	} | undefined;
+}
+/**
+* Handles batch requests sent by the client Batch Link Plugin, splitting each
+* batch into sub-requests and sending their responses back together.
+*
+* @remarks
+* The client Batch Link Plugin's `mode` picks how each batch responds: `buffered` (default) waits for every
+* sub-response and carries their cookies and shared headers; `streaming` starts once the first is ready and
+* carries only its cookies.
+*
+* **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+*
+* @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+*/
+export declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+	name: string;
+	/**
+	* Run batch interceptors inside the tracing interceptors
+	* so each subrequest gets its own span instead of sharing one batch-level span.
+	*/
+	after: string[];
+	private readonly maxSize;
+	private readonly mapSubrequest;
+	private readonly mapSubresponse;
+	private readonly successStatus;
+	private readonly headers;
+	private readonly keepAliveEnabled;
+	private readonly keepAliveInterval;
+	constructor(options?: BatchHandlerPluginOptions<T>);
+	init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/batch.mjs

@@ -0,0 +1,373 @@
+import { ORPCError } from "@orpc/client";
+import { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from "@orpc/client/plugins";
+import { isAsyncIteratorObject, promiseWithResolvers, toArray, value } from "@orpc/shared";
+import { flattenStandardHeader, parseStandardUrl } from "@standard-server/core";
+import { encodePeerMessage, isClientPeerSendMessage, isPeerMessage, ServerPeer } from "@standard-server/peer";
+
+export const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+function encodeLengthPrefix(length) {
+	const prefix = new Uint8Array(4);
+	new DataView(prefix.buffer).setUint32(0, length, false);
+	return prefix;
+}
+
+async function encodeFrame(message) {
+	const encoded = await encodePeerMessage(message);
+	const bytes = typeof encoded === "string" ? textEncoder.encode(encoded) : encoded;
+	return [encodeLengthPrefix(bytes.byteLength), bytes];
+}
+
+function isBodyHeader(name) {
+	return name.startsWith("content-") || name === "standard-server";
+}
+
+function isClientPeerSendMessages(maybe) {
+	return Array.isArray(maybe) && maybe.every((m) => isPeerMessage(m) && isClientPeerSendMessage(m));
+}
+
+function internalError(err) {
+	Promise.reject(err);
+	return {
+		status: 500,
+		headers: {},
+		body: "Internal server error"
+	};
+}
+
+function firstSubresponseHead(heads) {
+	return new Promise((resolve) => {
+		for (const promise of heads) {
+			void promise.then((head) => head && resolve(head));
+		}
+		void Promise.all(heads).then(() => resolve(undefined));
+	});
+}
+
+function liftCookies(headers, sources) {
+	const cookies = new Set(sources.flatMap((source) => toArray(source["set-cookie"])));
+	return cookies.size > 0 ? {
+		...headers,
+		"set-cookie": [...cookies]
+	} : headers;
+}
+
+function liftSubresponseHeaders(batchHeaders, subresponseHeaders) {
+	const [first = {}, ...rest] = subresponseHeaders;
+	const shared = {};
+	for (const [name, value] of Object.entries(first)) {
+		if (value === undefined || isBodyHeader(name)) {
+			continue;
+		}
+		const flattened = flattenStandardHeader(value);
+		if (rest.every((other) => flattenStandardHeader(other[name]) === flattened)) {
+			shared[name] = value;
+		}
+	}
+	const headers = liftCookies({
+		...shared,
+		...batchHeaders
+	}, [batchHeaders, ...subresponseHeaders]);
+	const varies = new Map();
+	for (const value of [batchHeaders, ...subresponseHeaders].flatMap((other) => toArray(other.vary))) {
+		for (const field of value.split(",")) {
+			const name = field.trim();
+			const key = name.toLowerCase();
+			if (name && !varies.has(key)) {
+				varies.set(key, name);
+			}
+		}
+	}
+	if (varies.size > 0) {
+		headers.vary = varies.has("*") ? "*" : [...varies.values()].join(", ");
+	}
+	return headers;
+}
+
+export class BatchHandlerPlugin {
+	name = "~batch";
+	
+	after = ["~tracing"];
+	maxSize;
+	mapSubrequest;
+	mapSubresponse;
+	successStatus;
+	headers;
+	keepAliveEnabled;
+	keepAliveInterval;
+	constructor(options = {}) {
+		this.maxSize = options.maxSize ?? DEFAULT_BATCH_MAX_SIZE;
+		this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
+			...subRequest,
+			headers: {
+				...subRequest.headers,
+				
+				...batchRequest.headers,
+				[BATCH_HEADER]: undefined
+			}
+		}));
+		this.mapSubresponse = options.mapSubresponse ?? ((subresponse, { headers: batchHeaders }) => {
+			const headers = {};
+			for (const [name, value] of Object.entries(subresponse.headers)) {
+				if (name !== "set-cookie" && flattenStandardHeader(value) !== flattenStandardHeader(batchHeaders[name])) {
+					headers[name] = value;
+				}
+			}
+			return {
+				...subresponse,
+				headers
+			};
+		});
+		this.successStatus = options.successStatus ?? 207;
+		this.headers = options.headers ?? {};
+		this.keepAliveEnabled = options.keepAlive?.enabled ?? true;
+		this.keepAliveInterval = options.keepAlive?.interval ?? 15e3;
+	}
+	init(options) {
+		const routingInterceptor = async (interceptorOptions) => {
+			const batchHeader = flattenStandardHeader(interceptorOptions.request.headers[BATCH_HEADER]);
+			if (batchHeader === undefined) {
+				return interceptorOptions.next();
+			}
+			const streaming = batchHeader === "streaming";
+			let messages;
+			try {
+				if (interceptorOptions.request.method === "GET") {
+					const [, search] = parseStandardUrl(interceptorOptions.request.url);
+					const params = new URLSearchParams(search);
+					const data = params.getAll("data").at(-1);
+					if (!data) {
+						return {
+							matched: true,
+							response: {
+								status: 400,
+								headers: {},
+								body: "Missing data parameter for batch request"
+							}
+						};
+					}
+					const mightBeMessages = JSON.parse(data);
+					if (!isClientPeerSendMessages(mightBeMessages)) {
+						return {
+							matched: true,
+							response: {
+								status: 400,
+								headers: {},
+								body: "Invalid batch request data parameter"
+							}
+						};
+					}
+					messages = mightBeMessages;
+				} else {
+					const mightBeMessages = await interceptorOptions.request.resolveBody();
+					if (!isClientPeerSendMessages(mightBeMessages)) {
+						return {
+							matched: true,
+							response: {
+								status: 400,
+								headers: {},
+								body: "Invalid batch request body"
+							}
+						};
+					}
+					messages = mightBeMessages;
+				}
+			} catch (error) {
+				return {
+					matched: true,
+					response: {
+						status: 400,
+						headers: {},
+						body: error instanceof ORPCError ? error.message : "Invalid batch request"
+					}
+				};
+			}
+			const outerMethod = interceptorOptions.request.method;
+			if ((outerMethod === "GET" || outerMethod === "QUERY") && messages.some((message) => message.kind === "request" && message.json.method !== outerMethod)) {
+				return {
+					matched: true,
+					response: {
+						status: 400,
+						headers: {},
+						body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests`
+					}
+				};
+			}
+			const maxSize = await value(this.maxSize, interceptorOptions);
+			if (messages.length > maxSize) {
+				return {
+					matched: true,
+					response: {
+						status: 413,
+						headers: {},
+						body: "Batch request size exceeds the maximum allowed size"
+					}
+				};
+			}
+			const status = await value(this.successStatus, interceptorOptions);
+			const headers = await value(this.headers, interceptorOptions);
+			
+			const bufferedMessages = [];
+			let streamController;
+			let keepAliveTimer;
+			
+			const ready = messages.map(() => promiseWithResolvers());
+			const heads = ready.map(({ promise }) => promise);
+			const lifting = streaming ? firstSubresponseHead(heads).then((head) => ({
+				batchHeaders: liftCookies(headers, [headers, head?.headers ?? {}]),
+				streams: true
+			})) : Promise.all(heads).then((all) => {
+				const present = all.filter((head) => head !== undefined);
+				return {
+					batchHeaders: liftSubresponseHeaders(headers, present.map((head) => head.headers)),
+					streams: present.some((head) => head.stream)
+				};
+			});
+			const clearKeepAlive = () => {
+				if (keepAliveTimer !== undefined) {
+					clearInterval(keepAliveTimer);
+					keepAliveTimer = undefined;
+				}
+			};
+			const scheduleKeepAlive = () => {
+				if (!this.keepAliveEnabled) {
+					return;
+				}
+				clearKeepAlive();
+				keepAliveTimer = setInterval(() => {
+					try {
+						
+						streamController.enqueue(encodeLengthPrefix(0));
+					} catch {
+						
+						clearKeepAlive();
+					}
+				}, this.keepAliveInterval);
+			};
+			const enqueueMessage = async (message) => {
+				for (const chunk of await encodeFrame(message)) {
+					streamController.enqueue(chunk);
+				}
+				scheduleKeepAlive();
+			};
+			const peer = new ServerPeer(async (message) => {
+				if (streamController === undefined) {
+					bufferedMessages.push(message);
+				} else {
+					await enqueueMessage(message);
+				}
+			});
+			const handleIndividualRequest = async (request, markReady) => {
+				let response;
+				try {
+					request = this.mapSubrequest(request, interceptorOptions);
+					const result = await interceptorOptions.next({
+						...interceptorOptions,
+						request
+					});
+					response = result.matched ? result.response : {
+						status: 404,
+						headers: {},
+						body: "No procedure matched"
+					};
+				} catch (err) {
+					response = internalError(err);
+				}
+				markReady({
+					headers: response.headers,
+					stream: response.body instanceof ReadableStream || isAsyncIteratorObject(response.body)
+				});
+				const { batchHeaders } = await lifting;
+				try {
+					return this.mapSubresponse(response, {
+						status,
+						headers: batchHeaders
+					}, interceptorOptions);
+				} catch (err) {
+					return internalError(err);
+				}
+			};
+			const runSubrequests = async () => {
+				const promise = Promise.all(messages.map((msg, i) => {
+					const { resolve } = ready[i];
+					
+					return peer.message(msg, (request) => handleIndividualRequest(request, resolve)).finally(() => resolve(undefined));
+				}));
+				const signal = interceptorOptions.request.signal;
+				const closePeer = () => peer.close(signal?.reason);
+				if (signal?.aborted) {
+					closePeer();
+				}
+				signal?.addEventListener("abort", closePeer);
+				try {
+					await promise;
+				} finally {
+					signal?.removeEventListener("abort", closePeer);
+				}
+			};
+			const subrequests = runSubrequests();
+			const { batchHeaders, streams } = await lifting;
+			const framedHeaders = {
+				...batchHeaders,
+				"content-type": batchHeaders["content-type"] ?? BATCH_CONTENT_TYPE
+			};
+			if (!streams) {
+				await subrequests;
+				await peer.close();
+				if (bufferedMessages.some((msg) => msg.binary !== undefined)) {
+					const chunks = (await Promise.all(bufferedMessages.map(encodeFrame))).flat();
+					return {
+						matched: true,
+						response: {
+							status,
+							headers: framedHeaders,
+							body: new Blob(chunks)
+						}
+					};
+				}
+				return {
+					matched: true,
+					response: {
+						status,
+						headers: batchHeaders,
+						body: bufferedMessages
+					}
+				};
+			}
+			
+			const body = new ReadableStream({
+				start(controller) {
+					streamController = controller;
+					scheduleKeepAlive();
+				},
+				async cancel(reason) {
+					clearKeepAlive();
+					await peer.close(reason);
+				}
+			});
+			const flushed = Promise.all(bufferedMessages.splice(0).map(enqueueMessage));
+			
+			Promise.all([flushed, subrequests]).then(async () => {
+				clearKeepAlive();
+				streamController.close();
+				await peer.close();
+			}).catch(async (error) => {
+				clearKeepAlive();
+				streamController.error(error);
+				await peer.close(error);
+			});
+			return {
+				matched: true,
+				response: {
+					status,
+					headers: framedHeaders,
+					body
+				}
+			};
+		};
+		return {
+			...options,
+			routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+		};
+	}
+}

package/dist/plugins/cors.d.mts

@@ -0,0 +1,67 @@
+import type { Promisable, Value } from "@orpc/shared";
+import type { StandardHandlerOptions, StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions } from "../adapters/standard/index.mjs";
+import type { Context } from "../context.mjs";
+export interface CORSHandlerPluginOptions<T extends Context> {
+	/**
+	* Configures the `Access-Control-Allow-Origin` header.
+	* Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+	*
+	* A function must only return origins it has validated: returning the incoming origin
+	* unchecked allows every origin.
+	*
+	* @default '*'
+	*/
+	origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+	/**
+	* Configures the `Timing-Allow-Origin` header.
+	* Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+	*/
+	timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+	/**
+	* Configures the `Access-Control-Allow-Methods` header for preflight requests.
+	*
+	* @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
+	*/
+	allowMethods?: readonly string[] | undefined;
+	/**
+	* Configures the `Access-Control-Allow-Headers` header for preflight requests.
+	* Falls back to the request's `Access-Control-Request-Headers` if not set.
+	* When set, it replaces that fallback, so include every non-safelisted header
+	* clients send, such as `Content-Type`.
+	*/
+	allowHeaders?: readonly string[] | undefined;
+	/**
+	* Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
+	*/
+	maxAge?: number | undefined;
+	/**
+	* Configures the `Access-Control-Allow-Credentials` header.
+	*
+	* When enabled, `origin` must allow trusted origins only: every allowed origin can send
+	* authenticated requests as your users and read the responses.
+	*/
+	credentials?: boolean | undefined;
+	/**
+	* Configures the `Access-Control-Expose-Headers` header.
+	*/
+	exposeHeaders?: readonly string[] | undefined;
+}
+/**
+* Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+* for your API, including preflight requests.
+*
+* @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+*/
+export declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+	private readonly options;
+	name: string;
+	/**
+	* - Do not create spans for CORS preflight requests.
+	* - Run CORS interceptors before batch interceptors so headers are applied to
+	*  the actual response rather than sub-responses.
+	*/
+	after: string[];
+	constructor(options?: CORSHandlerPluginOptions<T>);
+	init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+	private resolveOrigin;
+}

package/dist/plugins/cors.mjs

@@ -0,0 +1,134 @@
+import { toArray } from "@orpc/shared";
+import { flattenStandardHeader } from "@standard-server/core";
+
+export class CORSHandlerPlugin {
+	options;
+	name = "~cors";
+	
+	after = ["~tracing", "~batch"];
+	constructor(options = {}) {
+		const defaults = {
+			origin: "*",
+			allowMethods: [
+				"GET",
+				"HEAD",
+				"PUT",
+				"POST",
+				"DELETE",
+				"PATCH",
+				"QUERY"
+			]
+		};
+		this.options = {
+			...defaults,
+			...options
+		};
+	}
+	init(options) {
+		const corsHeadersInterceptor = async (interceptorOptions) => {
+			const result = await interceptorOptions.next();
+			if (!result.matched) {
+				return result;
+			}
+			const resHeaders = { ...result.response.headers };
+			const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+			const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
+			const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
+			if (allowOrigin.value !== undefined) {
+				resHeaders["access-control-allow-origin"] = allowOrigin.value;
+			}
+			if (timingAllowOrigin.value !== undefined) {
+				resHeaders["timing-allow-origin"] = timingAllowOrigin.value;
+			}
+			if (allowOrigin.varies || timingAllowOrigin.varies) {
+				const existingVary = flattenStandardHeader(resHeaders.vary);
+				if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) {
+					resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
+				}
+			}
+			if (this.options.credentials) {
+				resHeaders["access-control-allow-credentials"] = "true";
+			}
+			if (this.options.exposeHeaders?.length) {
+				resHeaders["access-control-expose-headers"] = flattenStandardHeader(this.options.exposeHeaders);
+			}
+			return {
+				...result,
+				response: {
+					...result.response,
+					headers: resHeaders
+				}
+			};
+		};
+		const preflightInterceptor = async (interceptorOptions) => {
+			if (interceptorOptions.request.method === "OPTIONS") {
+				const resHeaders = {};
+				if (this.options.maxAge !== undefined) {
+					resHeaders["access-control-max-age"] = this.options.maxAge.toString();
+				}
+				if (this.options.allowMethods?.length) {
+					resHeaders["access-control-allow-methods"] = flattenStandardHeader(this.options.allowMethods);
+				}
+				const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
+				if (typeof allowHeaders === "string" || allowHeaders?.length) {
+					resHeaders["access-control-allow-headers"] = flattenStandardHeader(allowHeaders);
+				}
+				return {
+					matched: true,
+					response: {
+						status: 204,
+						headers: resHeaders,
+						body: undefined
+					}
+				};
+			}
+			return interceptorOptions.next();
+		};
+		return {
+			...options,
+			routingInterceptors: [
+				corsHeadersInterceptor,
+				preflightInterceptor,
+				...toArray(options.routingInterceptors)
+			]
+		};
+	}
+	async resolveOrigin(option, origin, interceptorOptions) {
+		if (typeof option === "function") {
+			if (origin === undefined) {
+				return {
+					value: undefined,
+					varies: true
+				};
+			}
+			const allowed = toArray(await option(origin, interceptorOptions));
+			if (allowed.includes("*")) {
+				return {
+					value: "*",
+					varies: true
+				};
+			}
+			return {
+				value: allowed.includes(origin) ? origin : undefined,
+				varies: true
+			};
+		}
+		const allowed = toArray(await option);
+		if (allowed.includes("*")) {
+			return {
+				value: "*",
+				varies: false
+			};
+		}
+		if (origin !== undefined && allowed.includes(origin)) {
+			return {
+				value: origin,
+				varies: true
+			};
+		}
+		return {
+			value: undefined,
+			varies: allowed.length > 0
+		};
+	}
+}

package/dist/plugins/get-method-csrf-protection.d.mts

@@ -0,0 +1,23 @@
+import type { StandardHandlerOptions, StandardHandlerPlugin } from "../adapters/standard/index.mjs";
+import type { Context } from "../context.mjs";
+/**
+* Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+* secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+* navigations initiated cross-site or from outside the browser, the only context where
+* another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+* Requests matching no procedure stay unmatched, so they can fall through to whatever
+* serves the rest of the site.
+*
+* @remarks
+* **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+* and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+* requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+* since browsers may attach other cookies to the requests that pass.
+*
+* @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+*/
+export declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+	name: string;
+	init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+	private isAllowed;
+}