@orpc/server 2.0.0-beta.47 → 2.0.0-beta.49

package/dist/plugins/batch.js

@@ -0,0 +1,405 @@
+import { ORPCError } from '@orpc/client';
+import { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from '@orpc/client/plugins';
+import { isAsyncIteratorObject, promiseWithResolvers, toArray, value } from '@orpc/shared';
+import { flattenStandardHeader, parseStandardUrl } from '@standard-server/core';
+import { encodePeerMessage, isClientPeerSendMessage, isPeerMessage, ServerPeer, } from '@standard-server/peer';
+/**
+ * Content type for batch responses that use the length-prefixed binary framing,
+ * which they do in `streaming` mode, or when any sub-response contains binary or is a stream.
+ *
+ * Decoding is driven by the `standard-server` body hint, not this header,
+ * so it only serves to describe the payload to logs, proxies, and dev tools.
+ */
+export const BATCH_CONTENT_TYPE = 'application/vnd.orpc.batch';
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+function encodeLengthPrefix(length) {
+    const prefix = new Uint8Array(4);
+    new DataView(prefix.buffer).setUint32(0, length, false);
+    return prefix;
+}
+/**
+ * Encodes a message as a length-prefixed frame: its 4-byte big-endian length, then its bytes.
+ */
+async function encodeFrame(message) {
+    const encoded = await encodePeerMessage(message);
+    const bytes = typeof encoded === 'string' ? textEncoder.encode(encoded) : encoded;
+    return [encodeLengthPrefix(bytes.byteLength), bytes];
+}
+/**
+ * Whether a header describes a subresponse's own body, which the batch response does not share.
+ */
+function isBodyHeader(name) {
+    return name.startsWith('content-') || name === 'standard-server';
+}
+/**
+ * Whether untrusted batch JSON is a list of client peer messages.
+ * `isPeerMessage` must run first, since `isClientPeerSendMessage` does not check `id` or `binary`.
+ */
+function isClientPeerSendMessages(maybe) {
+    return (Array.isArray(maybe) &&
+        maybe.every((m) => isPeerMessage(m) && isClientPeerSendMessage(m)));
+}
+/**
+ * Errors should not occur at the routing interceptor level.
+ * Reject the promise so it can be handled by the unhandledRejection handler
+ * for global logging or error handling.
+ */
+function internalError(err) {
+    void Promise.reject(err);
+    return { status: 500, headers: {}, body: 'Internal server error' };
+}
+/**
+ * Resolves with the first subresponse head, or `undefined` if none has one.
+ */
+function firstSubresponseHead(heads) {
+    return new Promise((resolve) => {
+        for (const promise of heads) {
+            void promise.then((head) => head && resolve(head));
+        }
+        void Promise.all(heads).then(() => resolve(undefined));
+    });
+}
+/**
+ * Sets the distinct cookies of every source on the headers.
+ */
+function liftCookies(headers, sources) {
+    const cookies = new Set(sources.flatMap((source) => toArray(source['set-cookie'])));
+    return cookies.size > 0 ? { ...headers, 'set-cookie': [...cookies] } : headers;
+}
+/**
+ * Builds the batch response headers: the headers the subresponses all have with the same value, as
+ * the client does with the headers every subrequest shares, then the batch headers, which win, and
+ * the distinct cookies and `vary` fields of both. A cache must vary on whatever any subresponse varies on.
+ */
+function liftSubresponseHeaders(batchHeaders, subresponseHeaders) {
+    const [first = {}, ...rest] = subresponseHeaders;
+    const shared = {};
+    for (const [name, value] of Object.entries(first)) {
+        if (value === undefined || isBodyHeader(name)) {
+            continue;
+        }
+        const flattened = flattenStandardHeader(value);
+        if (rest.every((other) => flattenStandardHeader(other[name]) === flattened)) {
+            shared[name] = value;
+        }
+    }
+    const headers = liftCookies({ ...shared, ...batchHeaders }, [batchHeaders, ...subresponseHeaders]);
+    const varies = new Map();
+    for (const value of [batchHeaders, ...subresponseHeaders].flatMap((other) => toArray(other.vary))) {
+        for (const field of value.split(',')) {
+            const name = field.trim();
+            const key = name.toLowerCase();
+            if (name && !varies.has(key)) {
+                varies.set(key, name);
+            }
+        }
+    }
+    if (varies.size > 0) {
+        headers.vary = varies.has('*') ? '*' : [...varies.values()].join(', ');
+    }
+    return headers;
+}
+/**
+ * Handles batch requests sent by the client Batch Link Plugin, splitting each
+ * batch into sub-requests and sending their responses back together.
+ *
+ * @remarks
+ * The client Batch Link Plugin's `mode` picks how each batch responds: `buffered` (default) waits for every
+ * sub-response and carries their cookies and shared headers; `streaming` starts once the first is ready and
+ * carries only its cookies.
+ *
+ * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+ */
+export class BatchHandlerPlugin {
+    name = '~batch';
+    /**
+     * Run batch interceptors inside the tracing interceptors
+     * so each subrequest gets its own span instead of sharing one batch-level span.
+     */
+    after = ['~tracing'];
+    maxSize;
+    mapSubrequest;
+    mapSubresponse;
+    successStatus;
+    headers;
+    keepAliveEnabled;
+    keepAliveInterval;
+    constructor(options = {}) {
+        this.maxSize = options.maxSize ?? DEFAULT_BATCH_MAX_SIZE;
+        this.mapSubrequest =
+            options.mapSubrequest ??
+                ((subRequest, { request: batchRequest }) => ({
+                    ...subRequest,
+                    headers: {
+                        ...subRequest.headers,
+                        /**
+                         * The batch request headers win over the subrequest ones. They are the only ones the
+                         * transport actually saw, so headers the browser injects on its own, such as `cookie`
+                         * or `origin`, cannot be overridden by a subrequest, which is just request payload.
+                         */
+                        ...batchRequest.headers,
+                        [BATCH_HEADER]: undefined, // useful in case batch plugin is used multiple times
+                    },
+                }));
+        this.mapSubresponse =
+            options.mapSubresponse ??
+                ((subresponse, { headers: batchHeaders }) => {
+                    const headers = {};
+                    for (const [name, value] of Object.entries(subresponse.headers)) {
+                        if (name !== 'set-cookie' &&
+                            flattenStandardHeader(value) !== flattenStandardHeader(batchHeaders[name])) {
+                            headers[name] = value;
+                        }
+                    }
+                    return { ...subresponse, headers };
+                });
+        this.successStatus = options.successStatus ?? 207;
+        this.headers = options.headers ?? {};
+        this.keepAliveEnabled = options.keepAlive !== false;
+        this.keepAliveInterval =
+            (typeof options.keepAlive === 'object' ? options.keepAlive.interval : undefined) ?? 15_000;
+    }
+    init(options) {
+        const routingInterceptor = async (interceptorOptions) => {
+            const batchHeader = flattenStandardHeader(interceptorOptions.request.headers[BATCH_HEADER]);
+            if (batchHeader === undefined) {
+                return interceptorOptions.next();
+            }
+            const streaming = batchHeader === 'streaming';
+            let messages;
+            try {
+                if (interceptorOptions.request.method === 'GET') {
+                    const [, search] = parseStandardUrl(interceptorOptions.request.url);
+                    const params = new URLSearchParams(search);
+                    const data = params.getAll('data').at(-1);
+                    if (!data) {
+                        return {
+                            matched: true,
+                            response: {
+                                status: 400,
+                                headers: {},
+                                body: 'Missing data parameter for batch request',
+                            },
+                        };
+                    }
+                    const mightBeMessages = JSON.parse(data);
+                    if (!isClientPeerSendMessages(mightBeMessages)) {
+                        return {
+                            matched: true,
+                            response: { status: 400, headers: {}, body: 'Invalid batch request data parameter' },
+                        };
+                    }
+                    messages = mightBeMessages;
+                }
+                else {
+                    const mightBeMessages = await interceptorOptions.request.resolveBody();
+                    if (!isClientPeerSendMessages(mightBeMessages)) {
+                        return {
+                            matched: true,
+                            response: { status: 400, headers: {}, body: 'Invalid batch request body' },
+                        };
+                    }
+                    messages = mightBeMessages;
+                }
+            }
+            catch (error) {
+                return {
+                    matched: true,
+                    response: {
+                        status: 400,
+                        headers: {},
+                        body: error instanceof ORPCError ? error.message : 'Invalid batch request',
+                    },
+                };
+            }
+            const outerMethod = interceptorOptions.request.method;
+            if ((outerMethod === 'GET' || outerMethod === 'QUERY') &&
+                messages.some((message) => message.kind === 'request' && message.json.method !== outerMethod)) {
+                return {
+                    matched: true,
+                    response: {
+                        status: 400,
+                        headers: {},
+                        body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests`,
+                    },
+                };
+            }
+            const maxSize = await value(this.maxSize, interceptorOptions);
+            if (messages.length > maxSize) {
+                return {
+                    matched: true,
+                    response: {
+                        status: 413,
+                        headers: {},
+                        body: 'Batch request size exceeds the maximum allowed size',
+                    },
+                };
+            }
+            const status = await value(this.successStatus, interceptorOptions);
+            const headers = await value(this.headers, interceptorOptions);
+            // Messages the peer sends before the response streams, or the whole body when it does not
+            const bufferedMessages = [];
+            let streamController;
+            let keepAliveTimer;
+            // Subresponses wait here for the batch headers: lifted from all of them, or only the first in streaming mode
+            const ready = messages.map(() => promiseWithResolvers());
+            const heads = ready.map(({ promise }) => promise);
+            const lifting = streaming
+                ? firstSubresponseHead(heads).then((head) => ({
+                    batchHeaders: liftCookies(headers, [headers, head?.headers ?? {}]),
+                    streams: true,
+                }))
+                : Promise.all(heads).then((all) => {
+                    const present = all.filter((head) => head !== undefined);
+                    return {
+                        batchHeaders: liftSubresponseHeaders(headers, present.map((head) => head.headers)),
+                        streams: present.some((head) => head.stream),
+                    };
+                });
+            const clearKeepAlive = () => {
+                if (keepAliveTimer !== undefined) {
+                    clearInterval(keepAliveTimer);
+                    keepAliveTimer = undefined;
+                }
+            };
+            const scheduleKeepAlive = () => {
+                if (!this.keepAliveEnabled) {
+                    return;
+                }
+                clearKeepAlive();
+                keepAliveTimer = setInterval(() => {
+                    try {
+                        // Zero-length length-prefixed frame = keep-alive (ignored by clients)
+                        streamController.enqueue(encodeLengthPrefix(0));
+                    }
+                    catch {
+                        // Stream may already be closed or errored.
+                        clearKeepAlive();
+                    }
+                }, this.keepAliveInterval);
+            };
+            const enqueueMessage = async (message) => {
+                for (const chunk of await encodeFrame(message)) {
+                    streamController.enqueue(chunk);
+                }
+                scheduleKeepAlive(); // reset idle timer
+            };
+            const peer = new ServerPeer(async (message) => {
+                if (streamController === undefined) {
+                    bufferedMessages.push(message);
+                }
+                else {
+                    await enqueueMessage(message);
+                }
+            });
+            const handleIndividualRequest = async (request, markReady) => {
+                let response;
+                try {
+                    request = this.mapSubrequest(request, interceptorOptions);
+                    const result = await interceptorOptions.next({ ...interceptorOptions, request });
+                    response = result.matched
+                        ? result.response
+                        : { status: 404, headers: {}, body: 'No procedure matched' };
+                }
+                catch (err) {
+                    response = internalError(err);
+                }
+                markReady({
+                    headers: response.headers,
+                    stream: response.body instanceof ReadableStream || isAsyncIteratorObject(response.body),
+                });
+                const { batchHeaders } = await lifting;
+                try {
+                    return this.mapSubresponse(response, { status, headers: batchHeaders }, interceptorOptions);
+                }
+                catch (err) {
+                    return internalError(err);
+                }
+            };
+            const runSubrequests = async () => {
+                const promise = Promise.all(messages.map((msg, i) => {
+                    const { resolve } = ready[i];
+                    // Not every message reaches the handler, such as a cancel or a repeated id
+                    return peer
+                        .message(msg, (request) => handleIndividualRequest(request, resolve))
+                        .finally(() => resolve(undefined));
+                }));
+                const signal = interceptorOptions.request.signal;
+                const closePeer = () => peer.close(signal?.reason);
+                if (signal?.aborted) {
+                    void closePeer();
+                }
+                signal?.addEventListener('abort', closePeer);
+                try {
+                    await promise;
+                }
+                finally {
+                    signal?.removeEventListener('abort', closePeer);
+                }
+            };
+            const subrequests = runSubrequests();
+            const { batchHeaders, streams } = await lifting;
+            const framedHeaders = {
+                ...batchHeaders,
+                'content-type': batchHeaders['content-type'] ?? BATCH_CONTENT_TYPE,
+            };
+            if (!streams) {
+                await subrequests;
+                await peer.close();
+                if (bufferedMessages.some((msg) => msg.binary !== undefined)) {
+                    const chunks = (await Promise.all(bufferedMessages.map(encodeFrame))).flat();
+                    return {
+                        matched: true,
+                        response: {
+                            status,
+                            headers: framedHeaders,
+                            body: new Blob(chunks),
+                        },
+                    };
+                }
+                return {
+                    matched: true,
+                    response: { status, headers: batchHeaders, body: bufferedMessages },
+                };
+            }
+            // Answer with a length-prefixed stream of every message, starting with those buffered so far
+            const body = new ReadableStream({
+                start(controller) {
+                    streamController = controller;
+                    scheduleKeepAlive();
+                },
+                async cancel(reason) {
+                    clearKeepAlive();
+                    await peer.close(reason);
+                },
+            });
+            const flushed = Promise.all(bufferedMessages.splice(0).map(enqueueMessage));
+            // DO NOT await here to block streaming response
+            Promise.all([flushed, subrequests])
+                .then(async () => {
+                clearKeepAlive();
+                streamController.close();
+                await peer.close();
+            })
+                .catch(async (error) => {
+                clearKeepAlive();
+                streamController.error(error);
+                await peer.close(error);
+            });
+            return {
+                matched: true,
+                response: {
+                    status,
+                    headers: framedHeaders,
+                    body,
+                },
+            };
+        };
+        return {
+            ...options,
+            routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)],
+        };
+    }
+}

package/dist/plugins/cors.d.ts

@@ -0,0 +1,73 @@
+import type { Promisable, Value } from '@orpc/shared';
+import type { StandardHandlerOptions, StandardHandlerPlugin, StandardHandlerRoutingInterceptorOptions } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+export interface CORSHandlerPluginOptions<T extends Context> {
+    /**
+     * Configures the `Access-Control-Allow-Origin` header.
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+     *
+     * A function must only return origins it has validated: returning the incoming origin
+     * unchecked allows every origin.
+     *
+     * @default '*'
+     */
+    origin?: Value<Promisable<string | readonly string[] | null | undefined>, [
+        origin: string,
+        options: StandardHandlerRoutingInterceptorOptions<T>
+    ]> | undefined;
+    /**
+     * Configures the `Timing-Allow-Origin` header.
+     * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+     */
+    timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [
+        origin: string,
+        options: StandardHandlerRoutingInterceptorOptions<T>
+    ]> | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Methods` header for preflight requests.
+     *
+     * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
+     */
+    allowMethods?: readonly string[] | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Headers` header for preflight requests.
+     * Falls back to the request's `Access-Control-Request-Headers` if not set.
+     * When set, it replaces that fallback, so include every non-safelisted header
+     * clients send, such as `Content-Type`.
+     */
+    allowHeaders?: readonly string[] | undefined;
+    /**
+     * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
+     */
+    maxAge?: number | undefined;
+    /**
+     * Configures the `Access-Control-Allow-Credentials` header.
+     *
+     * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+     * authenticated requests as your users and read the responses.
+     */
+    credentials?: boolean | undefined;
+    /**
+     * Configures the `Access-Control-Expose-Headers` header.
+     */
+    exposeHeaders?: readonly string[] | undefined;
+}
+/**
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+ */
+export declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    private readonly options;
+    name: string;
+    /**
+     * - Do not create spans for CORS preflight requests.
+     * - Run CORS interceptors before batch interceptors so headers are applied to
+     *  the actual response rather than sub-responses.
+     */
+    after: string[];
+    constructor(options?: CORSHandlerPluginOptions<T>);
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private resolveOrigin;
+}

package/dist/plugins/cors.js

@@ -0,0 +1,112 @@
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standard-server/core';
+/**
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+ */
+export class CORSHandlerPlugin {
+    options;
+    name = '~cors';
+    /**
+     * - Do not create spans for CORS preflight requests.
+     * - Run CORS interceptors before batch interceptors so headers are applied to
+     *  the actual response rather than sub-responses.
+     */
+    after = ['~tracing', '~batch'];
+    constructor(options = {}) {
+        const defaults = {
+            origin: '*',
+            allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY'],
+        };
+        this.options = {
+            ...defaults,
+            ...options,
+        };
+    }
+    init(options) {
+        const corsHeadersInterceptor = async (interceptorOptions) => {
+            const result = await interceptorOptions.next();
+            if (!result.matched) {
+                return result;
+            }
+            const resHeaders = { ...result.response.headers };
+            const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+            const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
+            const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
+            if (allowOrigin.value !== undefined) {
+                resHeaders['access-control-allow-origin'] = allowOrigin.value;
+            }
+            if (timingAllowOrigin.value !== undefined) {
+                resHeaders['timing-allow-origin'] = timingAllowOrigin.value;
+            }
+            if (allowOrigin.varies || timingAllowOrigin.varies) {
+                const existingVary = flattenStandardHeader(resHeaders.vary);
+                if (!existingVary?.split(',').some((v) => v.trim().toLowerCase() === 'origin')) {
+                    resHeaders.vary = existingVary ? `${existingVary}, Origin` : 'Origin';
+                }
+            }
+            if (this.options.credentials) {
+                resHeaders['access-control-allow-credentials'] = 'true';
+            }
+            if (this.options.exposeHeaders?.length) {
+                resHeaders['access-control-expose-headers'] = flattenStandardHeader(this.options.exposeHeaders);
+            }
+            return { ...result, response: { ...result.response, headers: resHeaders } };
+        };
+        const preflightInterceptor = async (interceptorOptions) => {
+            if (interceptorOptions.request.method === 'OPTIONS') {
+                const resHeaders = {};
+                if (this.options.maxAge !== undefined) {
+                    resHeaders['access-control-max-age'] = this.options.maxAge.toString();
+                }
+                if (this.options.allowMethods?.length) {
+                    resHeaders['access-control-allow-methods'] = flattenStandardHeader(this.options.allowMethods);
+                }
+                const allowHeaders = this.options.allowHeaders ??
+                    interceptorOptions.request.headers['access-control-request-headers'];
+                if (typeof allowHeaders === 'string' || allowHeaders?.length) {
+                    resHeaders['access-control-allow-headers'] = flattenStandardHeader(allowHeaders);
+                }
+                return {
+                    matched: true,
+                    response: {
+                        status: 204,
+                        headers: resHeaders,
+                        body: undefined,
+                    },
+                };
+            }
+            return interceptorOptions.next();
+        };
+        return {
+            ...options,
+            routingInterceptors: [
+                corsHeadersInterceptor,
+                preflightInterceptor,
+                ...toArray(options.routingInterceptors),
+            ],
+        };
+    }
+    async resolveOrigin(option, origin, interceptorOptions) {
+        if (typeof option === 'function') {
+            if (origin === undefined) {
+                return { value: undefined, varies: true };
+            }
+            const allowed = toArray(await option(origin, interceptorOptions));
+            if (allowed.includes('*')) {
+                return { value: '*', varies: true };
+            }
+            return { value: allowed.includes(origin) ? origin : undefined, varies: true };
+        }
+        const allowed = toArray(await option);
+        if (allowed.includes('*')) {
+            return { value: '*', varies: false };
+        }
+        if (origin !== undefined && allowed.includes(origin)) {
+            return { value: origin, varies: true };
+        }
+        return { value: undefined, varies: allowed.length > 0 };
+    }
+}

package/dist/plugins/get-method-csrf-protection.d.ts

@@ -0,0 +1,23 @@
+import type { StandardHandlerOptions, StandardHandlerPlugin } from '../adapters/standard/index.ts';
+import type { Context } from '../context.ts';
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+export declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+    name: string;
+    init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+    private isAllowed;
+}

package/dist/plugins/get-method-csrf-protection.js

@@ -0,0 +1,64 @@
+import { ORPCError } from '@orpc/client';
+import { toArray } from '@orpc/shared';
+import { flattenStandardHeader } from '@standard-server/core';
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+export class GetMethodCsrfProtectionHandlerPlugin {
+    name = '~get-method-csrf-protection';
+    init(options) {
+        /**
+         * Batch sub-requests are judged individually here, which is safe: navigations cannot
+         * carry the custom `orpc-batch` header, and the batch plugin's default `mapSubrequest`
+         * keeps the transport headers authoritative over client-authored sub-request headers.
+         */
+        const interceptor = (interceptorOptions) => {
+            if (this.isAllowed(interceptorOptions)) {
+                return interceptorOptions.next();
+            }
+            throw new ORPCError('FORBIDDEN', { message: 'Request blocked by CSRF protection.' });
+        };
+        return {
+            ...options,
+            interceptors: [interceptor, ...toArray(options.interceptors)],
+        };
+    }
+    isAllowed({ request }) {
+        // Navigations can only use `GET` or `POST` per the HTML spec, and `POST` is unsafe, so
+        // `GET` is the only method `SameSite=Lax` cookies ride cross-site.
+        if (request.method !== 'GET') {
+            return true;
+        }
+        const site = flattenStandardHeader(request.headers['sec-fetch-site'])?.toLowerCase();
+        // Absent for non-browser clients, browsers too old to send Fetch Metadata, and any browser
+        // over plain HTTP, where the headers are never appended. Nothing to judge in those cases.
+        // Same-site origins are trusted, matching the `SameSite` cookie model where the site is
+        // the trust boundary.
+        if (site === undefined || site === 'same-origin' || site === 'same-site') {
+            return true;
+        }
+        // Cross-site, and on browser-initiated requests such as email links, `Lax` cookies ride
+        // only top-level navigations: mode `navigate` targeting dest `document`. Embedded
+        // navigations such as `<iframe>` pass, since they are not top-level. Browsers send both
+        // headers together, so a stripped one blocks the request rather than bypassing the check.
+        const mode = flattenStandardHeader(request.headers['sec-fetch-mode'])?.toLowerCase();
+        const dest = flattenStandardHeader(request.headers['sec-fetch-dest'])?.toLowerCase();
+        if (mode === undefined || dest === undefined) {
+            return false;
+        }
+        return mode !== 'navigate' || dest !== 'document';
+    }
+}