@suveren/gateway 0.8.7 → 0.9.0

package/node_modules/hono/dist/middleware/compress/index.js

@@ -1,74 +1,80 @@
-// src/middleware/compress/index.ts
 import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
-var ENCODING_TYPES = ["gzip", "deflate"];
-var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
-var selectEncoding = (header, candidates) => {
-  if (header === void 0) {
-    return void 0;
-  }
-  const accepts = parseAccept(header);
-  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
-  let best;
-  for (const enc of candidates) {
-    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
-    const q = explicit ? explicit.q : wildcardQ ?? 0;
-    if (q === 1) {
-      return enc;
-    } else if (q > 0 && (!best || q > best.q)) {
-      best = { encoding: enc, q };
-    }
-  }
-  return best?.encoding;
+//#region src/middleware/compress/index.ts
+const ENCODING_TYPES = ["gzip", "deflate"];
+const cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+const selectEncoding = (header, candidates) => {
+	if (header === void 0) return;
+	const accepts = parseAccept(header);
+	const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+	let best;
+	for (const enc of candidates) {
+		const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+		const q = explicit ? explicit.q : wildcardQ ?? 0;
+		if (q === 1) return enc;
+		else if (q > 0 && (!best || q > best.q)) best = {
+			encoding: enc,
+			q
+		};
+	}
+	return best?.encoding;
 };
-var varyAcceptEncodingRegExp = /(?:^|,)\s*accept-encoding\s*(?:,|$)/i;
-var compress = (options) => {
-  const threshold = options?.threshold ?? 1024;
-  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
-  const contentTypeFilter = options?.contentTypeFilter ?? COMPRESSIBLE_CONTENT_TYPE_REGEX;
-  const shouldCompress = typeof contentTypeFilter === "function" ? (res) => {
-    const type = res.headers.get("Content-Type");
-    return type && contentTypeFilter(type);
-  } : (res) => {
-    const type = res.headers.get("Content-Type");
-    return type && contentTypeFilter.test(type);
-  };
-  return async function compress2(ctx, next) {
-    await next();
-    const contentLength = ctx.res.headers.get("Content-Length");
-    if (ctx.res.status === 206 || // partial content, Content-Range refers to the uncompressed bytes
-    ctx.res.headers.has("Content-Encoding") || // already encoded
-    ctx.res.headers.has("Transfer-Encoding") || // already encoded or chunked
-    ctx.req.method === "HEAD" || // HEAD request
-    contentLength && Number(contentLength) < threshold || // content-length below threshold
-    !shouldCompress(ctx.res) || // not compressible type
-    !shouldTransform(ctx.res)) {
-      return;
-    }
-    const current = ctx.res.headers.get("Vary");
-    if (current !== "*" && !(current && varyAcceptEncodingRegExp.test(current))) {
-      ctx.header("Vary", current ? `${current}, Accept-Encoding` : "Accept-Encoding");
-    }
-    const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = selectEncoding(accepted, candidates);
-    if (!encoding || !ctx.res.body) {
-      return;
-    }
-    const stream = new CompressionStream(encoding);
-    ctx.res = new Response(ctx.res.body.pipeThrough(stream), ctx.res);
-    ctx.res.headers.delete("Content-Length");
-    ctx.res.headers.set("Content-Encoding", encoding);
-    const etag = ctx.res.headers.get("ETag");
-    if (etag && !etag.startsWith("W/")) {
-      ctx.res.headers.set("ETag", `W/${etag}`);
-    }
-  };
+const varyAcceptEncodingRegExp = /(?:^|,)\s*accept-encoding\s*(?:,|$)/i;
+/**
+* Compress Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/compress}
+*
+* @param {CompressionOptions} [options] - The options for the compress middleware.
+* @param {'gzip' | 'deflate'} [options.encoding] - The compression scheme to allow for response compression. Either 'gzip' or 'deflate'. If not defined, both are allowed and will be used based on the Accept-Encoding header. 'gzip' is prioritized if this option is not provided and the client provides both in the Accept-Encoding header.
+* @param {number} [options.threshold=1024] - The minimum size in bytes to compress. Defaults to 1024 bytes.
+* @param {RegExp | Function} [options.contentTypeFilter=COMPRESSIBLE_CONTENT_TYPE_REGEX] - A RegExp or function to determine if the response Content-Type should be compressed.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* app.use(compress())
+*
+* // Compress only JSON responses
+* app.use(compress({ contentTypeFilter: /^application\/json/ }))
+*
+* // Compress based on custom Content-Type logic
+* app.use(compress({ contentTypeFilter: (type) => COMPRESSIBLE_CONTENT_TYPE_REGEX.test(type) || type === "application/x-myformat" }))
+* ```
+*/
+const compress = (options) => {
+	const threshold = options?.threshold ?? 1024;
+	const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
+	const contentTypeFilter = options?.contentTypeFilter ?? COMPRESSIBLE_CONTENT_TYPE_REGEX;
+	const shouldCompress = typeof contentTypeFilter === "function" ? (res) => {
+		const type = res.headers.get("Content-Type");
+		return type && contentTypeFilter(type);
+	} : (res) => {
+		const type = res.headers.get("Content-Type");
+		return type && contentTypeFilter.test(type);
+	};
+	return async function compress(ctx, next) {
+		await next();
+		const contentLength = ctx.res.headers.get("Content-Length");
+		if (ctx.res.status === 206 || ctx.res.headers.has("Content-Encoding") || ctx.res.headers.has("Transfer-Encoding") || ctx.req.method === "HEAD" || contentLength && Number(contentLength) < threshold || !shouldCompress(ctx.res) || !shouldTransform(ctx.res)) return;
+		const current = ctx.res.headers.get("Vary");
+		if (current !== "*" && !(current && varyAcceptEncodingRegExp.test(current))) ctx.header("Vary", current ? `${current}, Accept-Encoding` : "Accept-Encoding");
+		const accepted = ctx.req.header("Accept-Encoding");
+		const encoding = selectEncoding(accepted, candidates);
+		if (!encoding || !ctx.res.body) return;
+		const stream = new CompressionStream(encoding);
+		ctx.res = new Response(ctx.res.body.pipeThrough(stream), ctx.res);
+		ctx.res.headers.delete("Content-Length");
+		ctx.res.headers.set("Content-Encoding", encoding);
+		const etag = ctx.res.headers.get("ETag");
+		if (etag && !etag.startsWith("W/")) ctx.res.headers.set("ETag", `W/${etag}`);
+	};
 };
-var shouldTransform = (res) => {
-  const cacheControl = res.headers.get("Cache-Control");
-  return !cacheControl || !cacheControlNoTransformRegExp.test(cacheControl);
-};
-export {
-  COMPRESSIBLE_CONTENT_TYPE_REGEX,
-  compress
+const shouldTransform = (res) => {
+	const cacheControl = res.headers.get("Cache-Control");
+	return !cacheControl || !cacheControlNoTransformRegExp.test(cacheControl);
 };
+//#endregion
+export { COMPRESSIBLE_CONTENT_TYPE_REGEX, compress };

package/node_modules/hono/dist/middleware/context-storage/index.js

@@ -1,23 +1,53 @@
-// src/middleware/context-storage/index.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-var asyncLocalStorage = new AsyncLocalStorage();
-var contextStorage = () => {
-  return async function contextStorage2(c, next) {
-    await asyncLocalStorage.run(c, next);
-  };
+//#region src/middleware/context-storage/index.ts
+/**
+* @module
+* Context Storage Middleware for Hono.
+*/
+const asyncLocalStorage = new AsyncLocalStorage();
+/**
+* Context Storage Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/context-storage}
+*
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* type Env = {
+*   Variables: {
+*     message: string
+*   }
+* }
+*
+* const app = new Hono<Env>()
+*
+* app.use(contextStorage())
+*
+* app.use(async (c, next) => {
+*   c.set('message', 'Hono is hot!!')
+*   await next()
+* })
+*
+* app.get('/', async (c) => c.text(getMessage()))
+*
+* const getMessage = () => {
+*   return getContext<Env>().var.message
+* }
+* ```
+*/
+const contextStorage = () => {
+	return async function contextStorage(c, next) {
+		await asyncLocalStorage.run(c, next);
+	};
 };
-var tryGetContext = () => {
-  return asyncLocalStorage.getStore();
+const tryGetContext = () => {
+	return asyncLocalStorage.getStore();
 };
-var getContext = () => {
-  const context = tryGetContext();
-  if (!context) {
-    throw new Error("Context is not available");
-  }
-  return context;
-};
-export {
-  contextStorage,
-  getContext,
-  tryGetContext
+const getContext = () => {
+	const context = tryGetContext();
+	if (!context) throw new Error("Context is not available");
+	return context;
 };
+//#endregion
+export { contextStorage, getContext, tryGetContext };

package/node_modules/hono/dist/middleware/cors/index.js

@@ -1,87 +1,108 @@
-// src/middleware/cors/index.ts
-var cors = (options) => {
-  const opts = {
-    origin: "*",
-    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"],
-    allowHeaders: [],
-    exposeHeaders: [],
-    ...options
-  };
-  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
-  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
-  const findAllowOrigin = ((optsOrigin) => {
-    if (typeof optsOrigin === "string") {
-      if (optsOrigin === "*") {
-        return () => optsOrigin;
-      } else {
-        return (origin) => optsOrigin === origin ? origin : null;
-      }
-    } else if (typeof optsOrigin === "function") {
-      return optsOrigin;
-    } else {
-      return (origin) => optsOrigin.includes(origin) ? origin : null;
-    }
-  })(opts.origin);
-  const findAllowMethods = ((optsAllowMethods) => {
-    if (typeof optsAllowMethods === "function") {
-      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
-    } else if (Array.isArray(optsAllowMethods)) {
-      const methodsStr = optsAllowMethods.join(",");
-      return () => methodsStr;
-    } else {
-      return () => "";
-    }
-  })(opts.allowMethods);
-  return async function cors2(c, next) {
-    function set(key, value) {
-      c.res.headers.set(key, value);
-    }
-    const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
-    if (allowOrigin) {
-      set("Access-Control-Allow-Origin", allowOrigin);
-    }
-    if (opts.credentials) {
-      set("Access-Control-Allow-Credentials", "true");
-    }
-    if (exposeHeadersStr) {
-      set("Access-Control-Expose-Headers", exposeHeadersStr);
-    }
-    if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*") {
-        c.res.headers.append("Vary", "Origin");
-      }
-      if (opts.maxAge != null) {
-        set("Access-Control-Max-Age", opts.maxAge.toString());
-      }
-      const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods) {
-        set("Access-Control-Allow-Methods", allowMethods);
-      }
-      let headersStr = allowHeadersStr;
-      if (!headersStr) {
-        const requestHeaders = c.req.header("Access-Control-Request-Headers");
-        if (requestHeaders) {
-          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
-        }
-      }
-      if (headersStr) {
-        set("Access-Control-Allow-Headers", headersStr);
-        c.res.headers.append("Vary", "Access-Control-Request-Headers");
-      }
-      c.res.headers.delete("Content-Length");
-      c.res.headers.delete("Content-Type");
-      return new Response(null, {
-        headers: c.res.headers,
-        status: 204,
-        statusText: "No Content"
-      });
-    }
-    await next();
-    if (opts.origin !== "*") {
-      c.header("Vary", "Origin", { append: true });
-    }
-  };
-};
-export {
-  cors
+//#region src/middleware/cors/index.ts
+/**
+* CORS Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/cors}
+*
+* @param {CORSOptions} [options] - The options for the CORS middleware.
+* @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
+* @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
+* @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
+* @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
+* @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
+* @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* app.use('/api/*', cors())
+* app.use(
+*   '/api2/*',
+*   cors({
+*     origin: 'http://example.com',
+*     allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
+*     allowMethods: ['POST', 'GET', 'OPTIONS'],
+*     exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
+*     maxAge: 600,
+*     credentials: true,
+*   })
+* )
+*
+* app.all('/api/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* app.all('/api2/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* ```
+*/
+const cors = (options) => {
+	const opts = {
+		origin: "*",
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"POST",
+			"DELETE",
+			"PATCH",
+			"QUERY"
+		],
+		allowHeaders: [],
+		exposeHeaders: [],
+		...options
+	};
+	const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+	const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
+	const findAllowOrigin = ((optsOrigin) => {
+		if (typeof optsOrigin === "string") {
+			if (optsOrigin === "*") return () => optsOrigin;
+			else return (origin) => optsOrigin === origin ? origin : null;
+		} else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin) ? origin : null;
+	})(opts.origin);
+	const findAllowMethods = ((optsAllowMethods) => {
+		if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
+		else if (Array.isArray(optsAllowMethods)) {
+			const methodsStr = optsAllowMethods.join(",");
+			return () => methodsStr;
+		} else return () => "";
+	})(opts.allowMethods);
+	return async function cors(c, next) {
+		function set(key, value) {
+			c.res.headers.set(key, value);
+		}
+		const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+		if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
+		if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
+		if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
+		if (c.req.method === "OPTIONS") {
+			if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
+			if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
+			const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+			if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
+			let headersStr = allowHeadersStr;
+			if (!headersStr) {
+				const requestHeaders = c.req.header("Access-Control-Request-Headers");
+				if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
+			}
+			if (headersStr) {
+				set("Access-Control-Allow-Headers", headersStr);
+				c.res.headers.append("Vary", "Access-Control-Request-Headers");
+			}
+			c.res.headers.delete("Content-Length");
+			c.res.headers.delete("Content-Type");
+			return new Response(null, {
+				headers: c.res.headers,
+				status: 204,
+				statusText: "No Content"
+			});
+		}
+		await next();
+		if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
+	};
 };
+//#endregion
+export { cors };

package/node_modules/hono/dist/middleware/csrf/index.js

@@ -1,55 +1,105 @@
-// src/middleware/csrf/index.ts
 import { HTTPException } from "../../http-exception.js";
-var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
-var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
-var isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
-var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
-var csrf = (options) => {
-  const originHandler = ((optsOrigin) => {
-    if (!optsOrigin) {
-      return (origin, c) => origin === new URL(c.req.url).origin;
-    } else if (typeof optsOrigin === "string") {
-      return (origin) => origin === optsOrigin;
-    } else if (typeof optsOrigin === "function") {
-      return optsOrigin;
-    } else {
-      return (origin) => optsOrigin.includes(origin);
-    }
-  })(options?.origin);
-  const isAllowedOrigin = async (origin, c) => {
-    if (origin === void 0) {
-      return false;
-    }
-    return await originHandler(origin, c);
-  };
-  const secFetchSiteHandler = ((optsSecFetchSite) => {
-    if (!optsSecFetchSite) {
-      return (secFetchSite) => secFetchSite === "same-origin";
-    } else if (typeof optsSecFetchSite === "string") {
-      return (secFetchSite) => secFetchSite === optsSecFetchSite;
-    } else if (typeof optsSecFetchSite === "function") {
-      return optsSecFetchSite;
-    } else {
-      return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
-    }
-  })(options?.secFetchSite);
-  const isAllowedSecFetchSite = async (secFetchSite, c) => {
-    if (secFetchSite === void 0) {
-      return false;
-    }
-    if (!isSecFetchSite(secFetchSite)) {
-      return false;
-    }
-    return await secFetchSiteHandler(secFetchSite, c);
-  };
-  return async function csrf2(c, next) {
-    if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
-      const res = new Response("Forbidden", { status: 403 });
-      throw new HTTPException(403, { res });
-    }
-    await next();
-  };
-};
-export {
-  csrf
+//#region src/middleware/csrf/index.ts
+const secFetchSiteValues = [
+	"same-origin",
+	"same-site",
+	"none",
+	"cross-site"
+];
+const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
+const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
+const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+/**
+* CSRF Protection Middleware for Hono.
+*
+* Protects against Cross-Site Request Forgery attacks by validating request origins
+* and sec-fetch-site headers. The request is allowed if either validation passes.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/csrf}
+*
+* @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+* @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+*   Allowed origins for requests.
+*   - string: Single allowed origin (e.g., 'https://example.com')
+*   - string[]: Multiple allowed origins
+*   - function: Custom validation logic
+*   - Default: Only same origin as the request URL
+* @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+*   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+*   - string: Single allowed value (e.g., 'same-origin')
+*   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+*   - function: Custom validation with access to context
+*   - Default: Only allows 'same-origin'
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* // Default: both origin and sec-fetch-site validation
+* app.use('*', csrf())
+*
+* // Allow specific origins
+* app.use('*', csrf({ origin: 'https://example.com' }))
+* app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+*
+* // Allow specific sec-fetch-site values
+* app.use('*', csrf({ secFetchSite: 'same-origin' }))
+* app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+*
+* // Dynamic sec-fetch-site validation
+* app.use('*', csrf({
+*   secFetchSite: (secFetchSite, c) => {
+*     // Always allow same-origin
+*     if (secFetchSite === 'same-origin') return true
+*     // Allow cross-site for webhook endpoints
+*     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+*       return true
+*     }
+*     return false
+*   }
+* }))
+*
+* // Dynamic origin validation
+* app.use('*', csrf({
+*   origin: (origin, c) => {
+*     // Allow same origin
+*     if (origin === new URL(c.req.url).origin) return true
+*     // Allow specific trusted domains
+*     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+*   }
+* }))
+* ```
+*/
+const csrf = (options) => {
+	const originHandler = ((optsOrigin) => {
+		if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
+		else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin);
+	})(options?.origin);
+	const isAllowedOrigin = async (origin, c) => {
+		if (origin === void 0) return false;
+		return await originHandler(origin, c);
+	};
+	const secFetchSiteHandler = ((optsSecFetchSite) => {
+		if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
+		else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
+		else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
+		else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
+	})(options?.secFetchSite);
+	const isAllowedSecFetchSite = async (secFetchSite, c) => {
+		if (secFetchSite === void 0) return false;
+		if (!isSecFetchSite(secFetchSite)) return false;
+		return await secFetchSiteHandler(secFetchSite, c);
+	};
+	return async function csrf(c, next) {
+		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
+			const res = new Response("Forbidden", { status: 403 });
+			throw new HTTPException(403, { res });
+		}
+		await next();
+	};
 };
+//#endregion
+export { csrf };