@orpc/server 2.0.0-beta.5 → 2.0.0-beta.50

package/dist/plugins/batch.d.ts

@@ -0,0 +1,102 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions, StandardHandlerRoutingInterceptorOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+import { Promisable, Value } from "@orpc/shared";
+import { StandardHeaders, StandardLazyRequest, StandardResponse } from "@standard-server/core";
+/**
+ * Content type for batch responses that use the length-prefixed binary framing,
+ * which they do in `streaming` mode, or when any sub-response contains binary or is a stream.
+ *
+ * Decoding is driven by the `standard-server` body hint, not this header,
+ * so it only serves to describe the payload to logs, proxies, and dev tools.
+ */
+export declare const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
+export interface BatchHandlerPluginOptions<T extends Context> {
+  /**
+   * The max size of the batch allowed. Larger batches are rejected with a `413`,
+   * so keep the client Batch Link Plugin's `maxSize` at or below it.
+   *
+   * @default DEFAULT_BATCH_MAX_SIZE (10)
+   * @see {@link https://orpc.dev/docs/plugins/batch#max-size | Batch Plugin - Max Size}
+   */
+  maxSize?: Value<Promisable<number>, [options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Map each subrequest in the batch before it is processed.
+   *
+   * @default merges the batch request headers into the subrequest, giving them priority over
+   * the subrequest headers, and removes the `orpc-batch` header to prevent nested batching
+   */
+  mapSubrequest?: ((subrequest: StandardLazyRequest, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardLazyRequest) | undefined;
+  /**
+   * Map each sub-response in the batch before it is sent.
+   *
+   * @default removes the headers the batch response already has with the same value, which the client
+   * merges back, and `set-cookie`, which the browser ignores there and JavaScript could read
+   */
+  mapSubresponse?: ((subresponse: StandardResponse, partialBatchResponse: Pick<StandardResponse, "status" | "headers">, batchOptions: StandardHandlerRoutingInterceptorOptions<T>) => StandardResponse) | undefined;
+  /**
+   * Success batch response status code.
+   *
+   * @default 207
+   */
+  successStatus?: Value<Promisable<number>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Success batch response headers.
+   *
+   * In `buffered` mode, the batch response also gets the cookies its sub-responses set, and the headers they all share.
+   * In `streaming` mode, it gets only the cookies of the first sub-response to be ready.
+   * Headers set here win, and setting one to `undefined` keeps it off, except `set-cookie` and `vary`, which merge.
+   *
+   * @default {}
+   */
+  headers?: Value<Promisable<StandardHeaders>, [batchOptions: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Keep-alive frames for batch responses that stream.
+   *
+   * A zero-length length-prefixed frame is sent periodically while the stream is idle
+   * (no message sent for `interval` ms). Clients ignore these frames.
+   *
+   * `false` disables it, an object customizes it.
+   *
+   * @default true
+   */
+  keepAlive?: boolean | {
+    /**
+     * Interval (in milliseconds) between keep-alive frames after the last message.
+     *
+     * @default 15000
+     */
+    interval?: number | undefined;
+  } | undefined;
+}
+/**
+ * Handles batch requests sent by the client Batch Link Plugin, splitting each
+ * batch into sub-requests and sending their responses back together.
+ *
+ * @remarks
+ * The client Batch Link Plugin's `mode` picks how each batch responds: `buffered` (default) waits for every
+ * sub-response and carries their cookies and shared headers; `streaming` starts once the first is ready and
+ * carries only its cookies.
+ *
+ * **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+ */
+export declare class BatchHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  /**
+   * Run batch interceptors inside the tracing interceptors
+   * so each subrequest gets its own span instead of sharing one batch-level span.
+   */
+  after: string[];
+  private readonly maxSize;
+  private readonly mapSubrequest;
+  private readonly mapSubresponse;
+  private readonly successStatus;
+  private readonly headers;
+  private readonly keepAliveEnabled;
+  private readonly keepAliveInterval;
+  constructor(options?: BatchHandlerPluginOptions<T>);
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+}

package/dist/plugins/batch.js

@@ -0,0 +1,371 @@
+import { isAsyncIteratorObject, listenAbort, promiseWithResolvers, toArray, value } from "@orpc/shared";
+import { ORPCError } from "@orpc/client";
+import { flattenStandardHeader, parseStandardUrl } from "@standard-server/core";
+import { BATCH_HEADER, DEFAULT_BATCH_MAX_SIZE } from "@orpc/client/plugins";
+import { ServerPeer, encodePeerMessage, isClientPeerSendMessage, isPeerMessage } from "@standard-server/peer";
+// src/plugins/batch.ts
+/**
+* Content type for batch responses that use the length-prefixed binary framing,
+* which they do in `streaming` mode, or when any sub-response contains binary or is a stream.
+*
+* Decoding is driven by the `standard-server` body hint, not this header,
+* so it only serves to describe the payload to logs, proxies, and dev tools.
+*/
+const BATCH_CONTENT_TYPE = "application/vnd.orpc.batch";
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+function encodeLengthPrefix(length) {
+	const prefix = /* @__PURE__ */ new Uint8Array(4);
+	new DataView(prefix.buffer).setUint32(0, length, false);
+	return prefix;
+}
+/**
+* Encodes a message as a length-prefixed frame: its 4-byte big-endian length, then its bytes.
+*/
+async function encodeFrame(message) {
+	const encoded = await encodePeerMessage(message);
+	const bytes = typeof encoded === "string" ? textEncoder.encode(encoded) : encoded;
+	return [encodeLengthPrefix(bytes.byteLength), bytes];
+}
+/**
+* Whether a header describes a subresponse's own body, which the batch response does not share.
+*/
+function isBodyHeader(name) {
+	return name.startsWith("content-") || name === "standard-server";
+}
+/**
+* Whether untrusted batch JSON is a list of client peer messages.
+* `isPeerMessage` must run first, since `isClientPeerSendMessage` does not check `id` or `binary`.
+*/
+function isClientPeerSendMessages(maybe) {
+	return Array.isArray(maybe) && maybe.every((m) => isPeerMessage(m) && isClientPeerSendMessage(m));
+}
+/**
+* Errors should not occur at the routing interceptor level.
+* Reject the promise so it can be handled by the unhandledRejection handler
+* for global logging or error handling.
+*/
+function internalError(err) {
+	Promise.reject(err);
+	return {
+		status: 500,
+		headers: {},
+		body: "Internal server error"
+	};
+}
+/**
+* Resolves with the first subresponse head, or `undefined` if none has one.
+*/
+function firstSubresponseHead(heads) {
+	return new Promise((resolve) => {
+		for (const promise of heads) promise.then((head) => head && resolve(head));
+		Promise.all(heads).then(() => resolve(void 0));
+	});
+}
+/**
+* Sets the distinct cookies of every source on the headers.
+*/
+function liftCookies(headers, sources) {
+	const cookies = new Set(sources.flatMap((source) => toArray(source["set-cookie"])));
+	return cookies.size > 0 ? {
+		...headers,
+		"set-cookie": [...cookies]
+	} : headers;
+}
+/**
+* Builds the batch response headers: the headers the subresponses all have with the same value, as
+* the client does with the headers every subrequest shares, then the batch headers, which win, and
+* the distinct cookies and `vary` fields of both. A cache must vary on whatever any subresponse varies on.
+*/
+function liftSubresponseHeaders(batchHeaders, subresponseHeaders) {
+	const [first = {}, ...rest] = subresponseHeaders;
+	const shared = {};
+	for (const [name, value] of Object.entries(first)) {
+		if (value === void 0 || isBodyHeader(name)) continue;
+		const flattened = flattenStandardHeader(value);
+		if (rest.every((other) => flattenStandardHeader(other[name]) === flattened)) shared[name] = value;
+	}
+	const headers = liftCookies({
+		...shared,
+		...batchHeaders
+	}, [batchHeaders, ...subresponseHeaders]);
+	const varies = /* @__PURE__ */ new Map();
+	for (const value of [batchHeaders, ...subresponseHeaders].flatMap((other) => toArray(other.vary))) for (const field of value.split(",")) {
+		const name = field.trim();
+		const key = name.toLowerCase();
+		if (name && !varies.has(key)) varies.set(key, name);
+	}
+	if (varies.size > 0) headers.vary = varies.has("*") ? "*" : [...varies.values()].join(", ");
+	return headers;
+}
+/**
+* Handles batch requests sent by the client Batch Link Plugin, splitting each
+* batch into sub-requests and sending their responses back together.
+*
+* @remarks
+* The client Batch Link Plugin's `mode` picks how each batch responds: `buffered` (default) waits for every
+* sub-response and carries their cookies and shared headers; `streaming` starts once the first is ready and
+* carries only its cookies.
+*
+* **Note**: HTTP/2 and later already multiplex requests over a single connection, which often makes this plugin unnecessary.
+*
+* @see {@link https://orpc.dev/docs/plugins/batch | Batch Plugin}
+*/
+var BatchHandlerPlugin = class {
+	name = "~batch";
+	/**
+	* Run batch interceptors inside the tracing interceptors
+	* so each subrequest gets its own span instead of sharing one batch-level span.
+	*/
+	after = ["~tracing"];
+	maxSize;
+	mapSubrequest;
+	mapSubresponse;
+	successStatus;
+	headers;
+	keepAliveEnabled;
+	keepAliveInterval;
+	constructor(options = {}) {
+		this.maxSize = options.maxSize ?? DEFAULT_BATCH_MAX_SIZE;
+		this.mapSubrequest = options.mapSubrequest ?? ((subRequest, { request: batchRequest }) => ({
+			...subRequest,
+			headers: {
+				...subRequest.headers,
+				/**
+				* The batch request headers win over the subrequest ones. They are the only ones the
+				* transport actually saw, so headers the browser injects on its own, such as `cookie`
+				* or `origin`, cannot be overridden by a subrequest, which is just request payload.
+				*/
+				...batchRequest.headers,
+				[BATCH_HEADER]: void 0
+			}
+		}));
+		this.mapSubresponse = options.mapSubresponse ?? ((subresponse, { headers: batchHeaders }) => {
+			const headers = {};
+			for (const [name, value] of Object.entries(subresponse.headers)) if (name !== "set-cookie" && flattenStandardHeader(value) !== flattenStandardHeader(batchHeaders[name])) headers[name] = value;
+			return {
+				...subresponse,
+				headers
+			};
+		});
+		this.successStatus = options.successStatus ?? 207;
+		this.headers = options.headers ?? {};
+		this.keepAliveEnabled = options.keepAlive !== false;
+		this.keepAliveInterval = (typeof options.keepAlive === "object" ? options.keepAlive.interval : void 0) ?? 15e3;
+	}
+	init(options) {
+		const routingInterceptor = async (interceptorOptions) => {
+			const batchHeader = flattenStandardHeader(interceptorOptions.request.headers[BATCH_HEADER]);
+			if (batchHeader === void 0) return interceptorOptions.next();
+			const streaming = batchHeader === "streaming";
+			let messages;
+			try {
+				if (interceptorOptions.request.method === "GET") {
+					const [, search] = parseStandardUrl(interceptorOptions.request.url);
+					const data = new URLSearchParams(search).getAll("data").at(-1);
+					if (!data) return {
+						matched: true,
+						response: {
+							status: 400,
+							headers: {},
+							body: "Missing data parameter for batch request"
+						}
+					};
+					const mightBeMessages = JSON.parse(data);
+					if (!isClientPeerSendMessages(mightBeMessages)) return {
+						matched: true,
+						response: {
+							status: 400,
+							headers: {},
+							body: "Invalid batch request data parameter"
+						}
+					};
+					messages = mightBeMessages;
+				} else {
+					const mightBeMessages = await interceptorOptions.request.resolveBody();
+					if (!isClientPeerSendMessages(mightBeMessages)) return {
+						matched: true,
+						response: {
+							status: 400,
+							headers: {},
+							body: "Invalid batch request body"
+						}
+					};
+					messages = mightBeMessages;
+				}
+			} catch (error) {
+				return {
+					matched: true,
+					response: {
+						status: 400,
+						headers: {},
+						body: error instanceof ORPCError ? error.message : "Invalid batch request"
+					}
+				};
+			}
+			const outerMethod = interceptorOptions.request.method;
+			if ((outerMethod === "GET" || outerMethod === "QUERY") && messages.some((message) => message.kind === "request" && message.json.method !== outerMethod)) return {
+				matched: true,
+				response: {
+					status: 400,
+					headers: {},
+					body: `${outerMethod} batch requests only accept ${outerMethod} sub-requests`
+				}
+			};
+			const maxSize = await value(this.maxSize, interceptorOptions);
+			if (messages.length > maxSize) return {
+				matched: true,
+				response: {
+					status: 413,
+					headers: {},
+					body: "Batch request size exceeds the maximum allowed size"
+				}
+			};
+			const status = await value(this.successStatus, interceptorOptions);
+			const headers = await value(this.headers, interceptorOptions);
+			const bufferedMessages = [];
+			let streamController;
+			let keepAliveTimer;
+			const ready = messages.map(() => promiseWithResolvers());
+			const heads = ready.map(({ promise }) => promise);
+			const lifting = streaming ? firstSubresponseHead(heads).then((head) => ({
+				batchHeaders: liftCookies(headers, [headers, head?.headers ?? {}]),
+				streams: true
+			})) : Promise.all(heads).then((all) => {
+				const present = all.filter((head) => head !== void 0);
+				return {
+					batchHeaders: liftSubresponseHeaders(headers, present.map((head) => head.headers)),
+					streams: present.some((head) => head.stream)
+				};
+			});
+			const clearKeepAlive = () => {
+				if (keepAliveTimer !== void 0) {
+					clearInterval(keepAliveTimer);
+					keepAliveTimer = void 0;
+				}
+			};
+			const scheduleKeepAlive = () => {
+				if (!this.keepAliveEnabled) return;
+				clearKeepAlive();
+				keepAliveTimer = setInterval(() => {
+					try {
+						streamController.enqueue(encodeLengthPrefix(0));
+					} catch {
+						clearKeepAlive();
+					}
+				}, this.keepAliveInterval);
+			};
+			const enqueueMessage = async (message) => {
+				for (const chunk of await encodeFrame(message)) streamController.enqueue(chunk);
+				scheduleKeepAlive();
+			};
+			const peer = new ServerPeer(async (message) => {
+				if (streamController === void 0) bufferedMessages.push(message);
+				else await enqueueMessage(message);
+			});
+			const handleIndividualRequest = async (request, markReady) => {
+				let response;
+				try {
+					request = this.mapSubrequest(request, interceptorOptions);
+					const result = await interceptorOptions.next({
+						...interceptorOptions,
+						request
+					});
+					response = result.matched ? result.response : {
+						status: 404,
+						headers: {},
+						body: "No procedure matched"
+					};
+				} catch (err) {
+					response = internalError(err);
+				}
+				markReady({
+					headers: response.headers,
+					stream: response.body instanceof ReadableStream || isAsyncIteratorObject(response.body)
+				});
+				const { batchHeaders } = await lifting;
+				try {
+					return this.mapSubresponse(response, {
+						status,
+						headers: batchHeaders
+					}, interceptorOptions);
+				} catch (err) {
+					return internalError(err);
+				}
+			};
+			const runSubrequests = async () => {
+				const promise = Promise.all(messages.map((msg, i) => {
+					const { resolve } = ready[i];
+					return peer.message(msg, (request) => handleIndividualRequest(request, resolve)).finally(() => resolve(void 0));
+				}));
+				const unlisten = listenAbort(interceptorOptions.request.signal, (reason) => void peer.close(reason));
+				try {
+					await promise;
+				} finally {
+					unlisten();
+				}
+			};
+			const subrequests = runSubrequests();
+			const { batchHeaders, streams } = await lifting;
+			const framedHeaders = {
+				...batchHeaders,
+				"content-type": batchHeaders["content-type"] ?? "application/vnd.orpc.batch"
+			};
+			if (!streams) {
+				await subrequests;
+				await peer.close();
+				if (bufferedMessages.some((msg) => msg.binary !== void 0)) {
+					const chunks = (await Promise.all(bufferedMessages.map(encodeFrame))).flat();
+					return {
+						matched: true,
+						response: {
+							status,
+							headers: framedHeaders,
+							body: new Blob(chunks)
+						}
+					};
+				}
+				return {
+					matched: true,
+					response: {
+						status,
+						headers: batchHeaders,
+						body: bufferedMessages
+					}
+				};
+			}
+			const body = new ReadableStream({
+				start(controller) {
+					streamController = controller;
+					scheduleKeepAlive();
+				},
+				async cancel(reason) {
+					clearKeepAlive();
+					await peer.close(reason);
+				}
+			});
+			const flushed = Promise.all(bufferedMessages.splice(0).map(enqueueMessage));
+			Promise.all([flushed, subrequests]).then(async () => {
+				clearKeepAlive();
+				streamController.close();
+				await peer.close();
+			}).catch(async (error) => {
+				clearKeepAlive();
+				streamController.error(error);
+				await peer.close(error);
+			});
+			return {
+				matched: true,
+				response: {
+					status,
+					headers: framedHeaders,
+					body
+				}
+			};
+		};
+		return {
+			...options,
+			routingInterceptors: [routingInterceptor, ...toArray(options.routingInterceptors)]
+		};
+	}
+};
+export { BATCH_CONTENT_TYPE, BatchHandlerPlugin };

package/dist/plugins/cors.d.ts

@@ -0,0 +1,69 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions, StandardHandlerRoutingInterceptorOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+import { Promisable, Value } from "@orpc/shared";
+export interface CORSHandlerPluginOptions<T extends Context> {
+  /**
+   * Configures the `Access-Control-Allow-Origin` header.
+   * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+   *
+   * A function must only return origins it has validated: returning the incoming origin
+   * unchecked allows every origin.
+   *
+   * @default '*'
+   */
+  origin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Configures the `Timing-Allow-Origin` header.
+   * Can be a string, an array of allowed origins, or a function (optionally async) that returns the allowed origin(s).
+   */
+  timingOrigin?: Value<Promisable<string | readonly string[] | null | undefined>, [origin: string, options: StandardHandlerRoutingInterceptorOptions<T>]> | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Methods` header for preflight requests.
+   *
+   * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']
+   */
+  allowMethods?: readonly string[] | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Headers` header for preflight requests.
+   * Falls back to the request's `Access-Control-Request-Headers` if not set.
+   * When set, it replaces that fallback, so include every non-safelisted header
+   * clients send, such as `Content-Type`.
+   */
+  allowHeaders?: readonly string[] | undefined;
+  /**
+   * Configures the `Access-Control-Max-Age` header (in seconds) for preflight requests.
+   */
+  maxAge?: number | undefined;
+  /**
+   * Configures the `Access-Control-Allow-Credentials` header.
+   *
+   * When enabled, `origin` must allow trusted origins only: every allowed origin can send
+   * authenticated requests as your users and read the responses.
+   */
+  credentials?: boolean | undefined;
+  /**
+   * Configures the `Access-Control-Expose-Headers` header.
+   */
+  exposeHeaders?: readonly string[] | undefined;
+}
+/**
+ * Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+ * for your API, including preflight requests.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+ */
+export declare class CORSHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  private readonly options;
+  name: string;
+  /**
+   * - Do not create spans for CORS preflight requests.
+   * - Run CORS interceptors before batch interceptors so headers are applied to
+   *  the actual response rather than sub-responses.
+   */
+  after: string[];
+  constructor(options?: CORSHandlerPluginOptions<T>);
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+  private resolveOrigin;
+}

package/dist/plugins/cors.js

@@ -0,0 +1,119 @@
+import { toArray } from "@orpc/shared";
+import { flattenStandardHeader } from "@standard-server/core";
+// src/plugins/cors.ts
+/**
+* Configures the [CORS Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+* for your API, including preflight requests.
+*
+* @see {@link https://orpc.dev/docs/plugins/cors | CORS Handler Plugin}
+*/
+var CORSHandlerPlugin = class {
+	options;
+	name = "~cors";
+	/**
+	* - Do not create spans for CORS preflight requests.
+	* - Run CORS interceptors before batch interceptors so headers are applied to
+	*  the actual response rather than sub-responses.
+	*/
+	after = ["~tracing", "~batch"];
+	constructor(options = {}) {
+		const defaults = {
+			origin: "*",
+			allowMethods: [
+				"GET",
+				"HEAD",
+				"PUT",
+				"POST",
+				"DELETE",
+				"PATCH",
+				"QUERY"
+			]
+		};
+		this.options = {
+			...defaults,
+			...options
+		};
+	}
+	init(options) {
+		const corsHeadersInterceptor = async (interceptorOptions) => {
+			const result = await interceptorOptions.next();
+			if (!result.matched) return result;
+			const resHeaders = { ...result.response.headers };
+			const origin = flattenStandardHeader(interceptorOptions.request.headers.origin);
+			const allowOrigin = await this.resolveOrigin(this.options.origin, origin, interceptorOptions);
+			const timingAllowOrigin = await this.resolveOrigin(this.options.timingOrigin, origin, interceptorOptions);
+			if (allowOrigin.value !== void 0) resHeaders["access-control-allow-origin"] = allowOrigin.value;
+			if (timingAllowOrigin.value !== void 0) resHeaders["timing-allow-origin"] = timingAllowOrigin.value;
+			if (allowOrigin.varies || timingAllowOrigin.varies) {
+				const existingVary = flattenStandardHeader(resHeaders.vary);
+				if (!existingVary?.split(",").some((v) => v.trim().toLowerCase() === "origin")) resHeaders.vary = existingVary ? `${existingVary}, Origin` : "Origin";
+			}
+			if (this.options.credentials) resHeaders["access-control-allow-credentials"] = "true";
+			if (this.options.exposeHeaders?.length) resHeaders["access-control-expose-headers"] = flattenStandardHeader(this.options.exposeHeaders);
+			return {
+				...result,
+				response: {
+					...result.response,
+					headers: resHeaders
+				}
+			};
+		};
+		const preflightInterceptor = async (interceptorOptions) => {
+			if (interceptorOptions.request.method === "OPTIONS") {
+				const resHeaders = {};
+				if (this.options.maxAge !== void 0) resHeaders["access-control-max-age"] = this.options.maxAge.toString();
+				if (this.options.allowMethods?.length) resHeaders["access-control-allow-methods"] = flattenStandardHeader(this.options.allowMethods);
+				const allowHeaders = this.options.allowHeaders ?? interceptorOptions.request.headers["access-control-request-headers"];
+				if (typeof allowHeaders === "string" || allowHeaders?.length) resHeaders["access-control-allow-headers"] = flattenStandardHeader(allowHeaders);
+				return {
+					matched: true,
+					response: {
+						status: 204,
+						headers: resHeaders,
+						body: void 0
+					}
+				};
+			}
+			return interceptorOptions.next();
+		};
+		return {
+			...options,
+			routingInterceptors: [
+				corsHeadersInterceptor,
+				preflightInterceptor,
+				...toArray(options.routingInterceptors)
+			]
+		};
+	}
+	async resolveOrigin(option, origin, interceptorOptions) {
+		if (typeof option === "function") {
+			if (origin === void 0) return {
+				value: void 0,
+				varies: true
+			};
+			const allowed = toArray(await option(origin, interceptorOptions));
+			if (allowed.includes("*")) return {
+				value: "*",
+				varies: true
+			};
+			return {
+				value: allowed.includes(origin) ? origin : void 0,
+				varies: true
+			};
+		}
+		const allowed = toArray(await option);
+		if (allowed.includes("*")) return {
+			value: "*",
+			varies: false
+		};
+		if (origin !== void 0 && allowed.includes(origin)) return {
+			value: origin,
+			varies: true
+		};
+		return {
+			value: void 0,
+			varies: allowed.length > 0
+		};
+	}
+};
+export { CORSHandlerPlugin };

package/dist/plugins/get-method-csrf-protection.d.ts

@@ -0,0 +1,25 @@
+import "../adapters/standard/index.js";
+import { StandardHandlerPlugin } from "../adapters/standard/plugin.js";
+import { StandardHandlerOptions } from "../adapters/standard/handler.js";
+import { Context } from "../context.js";
+/**
+ * Adds Cross-Site Request Forgery (CSRF) protection that makes the safe `GET` method as
+ * secure as unsafe ones such as `POST`. It rejects `GET` requests arriving as top-level
+ * navigations initiated cross-site or from outside the browser, the only context where
+ * another site can make a browser attach `SameSite=Lax` cookies to a safe-method request.
+ * Requests matching no procedure stay unmatched, so they can fall through to whatever
+ * serves the rest of the site.
+ *
+ * @remarks
+ * **Note**: Requests browsers send without `SameSite=Lax` cookies, such as cross-site `fetch`
+ * and `<img>`, pass through, so procedures stay reachable from other sites. This safeguard
+ * requires authentication cookies explicitly marked `SameSite=Lax` or `SameSite=Strict`,
+ * since browsers may attach other cookies to the requests that pass.
+ *
+ * @see {@link https://orpc.dev/docs/plugins/get-method-csrf-protection | GET Method CSRF Protection Plugin}
+ */
+export declare class GetMethodCsrfProtectionHandlerPlugin<T extends Context> implements StandardHandlerPlugin<T> {
+  name: string;
+  init(options: StandardHandlerOptions<T>): StandardHandlerOptions<T>;
+  private isAllowed;
+}