acrylblends 0.4.1 → 0.5.0

package/lib/http-exception.d.ts

@@ -0,0 +1,57 @@
+import { n as ContentfulStatusCode } from "./http-status-DaAwGAFL.js";
+
+//#region ../../plugins/acryl-router/src/core/http-exception.d.ts
+/**
+ * Options for creating an `HTTPException`.
+ * @property res - Optional response object to use.
+ * @property message - Optional custom error message.
+ * @property cause - Optional cause of the error.
+ */
+type HTTPExceptionOptions = {
+  res?: Response;
+  message?: string;
+  cause?: unknown;
+};
+/**
+ * `HTTPException` must be used when a fatal error such as authentication failure occurs.
+ *
+ *
+ * @param {StatusCode} status - status code of HTTPException
+ * @param {HTTPExceptionOptions} options - options of HTTPException
+ * @param {HTTPExceptionOptions["res"]} options.res - response of options of HTTPException
+ * @param {HTTPExceptionOptions["message"]} options.message - message of options of HTTPException
+ * @param {HTTPExceptionOptions["cause"]} options.cause - cause of options of HTTPException
+ *
+ * @example
+ * ```ts
+ * import { HTTPException } from 'acrylblends/http-exception'
+ *
+ * // ...
+ *
+ * app.post('/auth', async (c, next) => {
+ *   // authentication
+ *   if (authorized === false) {
+ *     throw new HTTPException(401, { message: 'Custom error message' })
+ *   }
+ *   await next()
+ * })
+ * ```
+ */
+declare class HTTPException extends Error {
+  readonly res?: Response;
+  readonly status: ContentfulStatusCode;
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(status?: ContentfulStatusCode, options?: HTTPExceptionOptions);
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse(): Response;
+}
+//#endregion
+export { HTTPException };

package/lib/http-exception.js

@@ -0,0 +1,54 @@
+//#region ../../plugins/acryl-router/src/core/http-exception.ts
+/**
+* `HTTPException` must be used when a fatal error such as authentication failure occurs.
+*
+*
+* @param {StatusCode} status - status code of HTTPException
+* @param {HTTPExceptionOptions} options - options of HTTPException
+* @param {HTTPExceptionOptions["res"]} options.res - response of options of HTTPException
+* @param {HTTPExceptionOptions["message"]} options.message - message of options of HTTPException
+* @param {HTTPExceptionOptions["cause"]} options.cause - cause of options of HTTPException
+*
+* @example
+* ```ts
+* import { HTTPException } from 'acrylblends/http-exception'
+*
+* // ...
+*
+* app.post('/auth', async (c, next) => {
+*   // authentication
+*   if (authorized === false) {
+*     throw new HTTPException(401, { message: 'Custom error message' })
+*   }
+*   await next()
+* })
+* ```
+*/
+var HTTPException = class extends Error {
+	res;
+	status;
+	/**
+	* Creates an instance of `HTTPException`.
+	* @param status - HTTP status code for the exception. Defaults to 500.
+	* @param options - Additional options for the exception.
+	*/
+	constructor(status = 500, options) {
+		super(options?.message, { cause: options?.cause });
+		this.res = options?.res;
+		this.status = status;
+	}
+	/**
+	* Returns the response object associated with the exception.
+	* If a response object is not provided, a new response is created with the error message and status code.
+	* @returns The response object.
+	*/
+	getResponse() {
+		if (this.res) return new Response(this.res.body, {
+			status: this.status,
+			headers: this.res.headers
+		});
+		return new Response(this.message, { status: this.status });
+	}
+};
+//#endregion
+export { HTTPException };

package/lib/http-status-DaAwGAFL.d.ts

@@ -0,0 +1,35 @@
+//#region ../../plugins/acryl-router/src/core/utils/http-status.d.ts
+/**
+ * @module
+ * HTTP Status utility.
+ */
+type InfoStatusCode = 100 | 101 | 102 | 103;
+type SuccessStatusCode = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226;
+type DeprecatedStatusCode = 305 | 306;
+type RedirectStatusCode = 300 | 301 | 302 | 303 | 304 | DeprecatedStatusCode | 307 | 308;
+type ClientErrorStatusCode = 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451;
+type ServerErrorStatusCode = 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511;
+/**
+ * `UnofficialStatusCode` can be used to specify an unofficial status code.
+ * @example
+ *
+ * ```ts
+ * app.get('/unknown', (c) => {
+ *   return c.text("Unknown Error", 520 as UnofficialStatusCode)
+ * })
+ * ```
+ */
+type UnofficialStatusCode = -1;
+/**
+ * @deprecated
+ * Use `UnofficialStatusCode` instead.
+ */
+type UnOfficalStatusCode = UnofficialStatusCode;
+/**
+ * If you want to use an unofficial status, use `UnofficialStatusCode`.
+ */
+type StatusCode = InfoStatusCode | SuccessStatusCode | RedirectStatusCode | ClientErrorStatusCode | ServerErrorStatusCode | UnofficialStatusCode;
+type ContentlessStatusCode = 101 | 204 | 205 | 304;
+type ContentfulStatusCode = Exclude<StatusCode, ContentlessStatusCode>;
+//#endregion
+export { InfoStatusCode as a, StatusCode as c, UnofficialStatusCode as d, DeprecatedStatusCode as i, SuccessStatusCode as l, ContentfulStatusCode as n, RedirectStatusCode as o, ContentlessStatusCode as r, ServerErrorStatusCode as s, ClientErrorStatusCode as t, UnOfficalStatusCode as u };

package/lib/index-B-3F4wt2.d.ts

@@ -0,0 +1,12 @@
+import { A as Input, J as Schema, _ as Env, h as BlankSchema, o as AcrylRequest, p as BlankEnv } from "./context-Bm7rI-oK.js";
+import { t as Acryl } from "./app-CmAYW1Al.js";
+
+//#region ../../plugins/acryl-router/src/deprecated.d.ts
+/** @deprecated Use `Acryl` (`new Acryl()`); `App` is the 0.4 name and goes away in the next release. */
+declare const App: typeof Acryl;
+/** @deprecated Use `Acryl`; `App` is the 0.4 name and goes away in the next release. */
+type App<E extends Env = BlankEnv, S extends Schema = BlankSchema, BasePath extends string = '/'> = Acryl<E, S, BasePath>;
+/** @deprecated Use `AcrylRequest`; `AppRequest` is the 0.4 name and goes away in the next release. */
+type AppRequest<P extends string = '/', I extends Input['out'] = {}> = AcrylRequest<P, I>;
+//#endregion
+export { AppRequest as n, App as t };

package/lib/index-UTBmM3GX.d.ts

@@ -0,0 +1,68 @@
+import { I as MiddlewareHandler, X as TypedResponse, t as Context } from "./context-Bm7rI-oK.js";
+import { c as StatusCode } from "./http-status-DaAwGAFL.js";
+import { r as CloseEvent, t as BinaryType, v as MessageEvent } from "./types-CwrQjlaM.js";
+
+//#region ../../plugins/acryl-router/src/core/helper/websocket/index.d.ts
+/**
+ * WebSocket Event Listeners type
+ */
+interface WSEvents<T = unknown> {
+  onOpen?: (evt: Event, ws: WSContext<T>) => void;
+  onMessage?: (evt: MessageEvent<WSMessageReceive>, ws: WSContext<T>) => void;
+  onClose?: (evt: CloseEvent, ws: WSContext<T>) => void;
+  onError?: (evt: Event, ws: WSContext<T>) => void;
+}
+/**
+ * Upgrade WebSocket Type
+ */
+interface UpgradeWebSocket<T = unknown, U = any, _WSEvents = WSEvents<T>> {
+  (createEvents: (c: Context) => _WSEvents | Promise<_WSEvents>, options?: U): MiddlewareHandler<any, string, {
+    outputFormat: 'ws';
+  }>;
+  (c: Context, events: _WSEvents, options?: U): Promise<Response & TypedResponse<{}, StatusCode, 'ws'>>;
+}
+/**
+ * ReadyState for WebSocket
+ */
+type WSReadyState = 0 | 1 | 2 | 3;
+/**
+ * An argument for WSContext class
+ */
+interface WSContextInit<T = unknown> {
+  send(data: string | ArrayBuffer | Uint8Array<ArrayBuffer>, options: SendOptions): void;
+  close(code?: number, reason?: string): void;
+  raw?: T;
+  readyState: WSReadyState;
+  url?: string | URL | null;
+  protocol?: string | null;
+}
+/**
+ * Options for sending message
+ */
+interface SendOptions {
+  compress?: boolean;
+}
+/**
+ * A context for controlling WebSockets
+ */
+declare class WSContext<T = unknown> {
+  #private;
+  constructor(init: WSContextInit<T>);
+  send(source: string | ArrayBuffer | Uint8Array<ArrayBuffer>, options?: SendOptions): void;
+  raw?: T;
+  binaryType: BinaryType;
+  get readyState(): WSReadyState;
+  url: URL | null;
+  protocol: string | null;
+  close(code?: number, reason?: string): void;
+}
+type WSMessageReceive = string | Blob | ArrayBufferLike;
+declare const createWSMessageEvent: (source: WSMessageReceive) => MessageEvent<WSMessageReceive>;
+interface WebSocketHelperDefineContext {}
+type WebSocketHelperDefineHandler<T, U> = (c: Context, events: WSEvents<T>, options?: U) => Promise<Response | void> | Response | void;
+/**
+ * Create a WebSocket adapter/helper
+ */
+declare const defineWebSocketHelper: <T = unknown, U = any>(handler: WebSocketHelperDefineHandler<T, U>) => UpgradeWebSocket<T, U>;
+//#endregion
+export { WSEvents as a, WebSocketHelperDefineContext as c, defineWebSocketHelper as d, WSContextInit as i, WebSocketHelperDefineHandler as l, UpgradeWebSocket as n, WSMessageReceive as o, WSContext as r, WSReadyState as s, SendOptions as t, createWSMessageEvent as u };

package/lib/index-oOClm_Xk.d.ts

@@ -0,0 +1,45 @@
+import { n as ContentfulStatusCode, s as ServerErrorStatusCode, t as ClientErrorStatusCode } from "./http-status-DaAwGAFL.js";
+import { T as UnionToIntersection } from "./types-CwrQjlaM.js";
+import { t as Acryl } from "./app-CmAYW1Al.js";
+import { a as ClientResponse, i as ClientRequestOptions, n as Client, s as FilterClientResponseByStatusCode } from "./types-CHesD1KG.js";
+
+//#region ../../plugins/acryl-router/src/core/client/client.d.ts
+declare const hc: <T extends Acryl<any, any, any>, Prefix extends string = string>(baseUrl: Prefix, options?: ClientRequestOptions) => UnionToIntersection<Client<T, Prefix>>;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/client/fetch-result-please.d.ts
+declare class DetailedError extends Error {
+  /**
+   * Additional `message` that will be logged AND returned to client
+   */
+  detail?: any;
+  /**
+   * Additional `code` that will be logged AND returned to client
+   */
+  code?: any;
+  /**
+   * Additional value that will be logged AND NOT returned to client
+   */
+  log?: any;
+  /**
+   * Optionally set the status code to return, in a web server context
+   */
+  statusCode?: any;
+  constructor(message: string, options?: {
+    detail?: any;
+    code?: any;
+    statusCode?: number;
+    log?: any;
+  });
+}
+//#endregion
+//#region ../../plugins/acryl-router/src/core/client/utils.d.ts
+/**
+ * Shortcut to get a consumable response from `hc`'s fetch calls (Response), with types inference.
+ *
+ * Smartly parse the response data, throwing a structured error if the response is not `ok`. ({@link DetailedError})
+ *
+ * @example const result = await parseResponse(client.posts.$get())
+ */
+declare function parseResponse<T extends ClientResponse<any>>(fetchRes: T | Promise<T>): Promise<FilterClientResponseByStatusCode<T, Exclude<ContentfulStatusCode, ClientErrorStatusCode | ServerErrorStatusCode>> extends never ? undefined : FilterClientResponseByStatusCode<T, Exclude<ContentfulStatusCode, ClientErrorStatusCode | ServerErrorStatusCode>> extends ClientResponse<infer RT, infer _, infer RF> ? RF extends 'json' ? RT : RT extends string ? RT : string : undefined>;
+//#endregion
+export { DetailedError as n, hc as r, parseResponse as t };

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+import { A as Input, B as NotFoundResponse, D as Handler, I as MiddlewareHandler, J as Schema, R as Next, X as TypedResponse, Y as ToSchema, Z as ValidationTargets, _ as Env, a as ExecutionContext, n as ContextRenderer, o as AcrylRequest, r as ContextVariableMap, t as Context, v as ErrorHandler, z as NotFoundHandler } from "./context-Bm7rI-oK.js";
+import { t as Acryl } from "./app-CmAYW1Al.js";
+import { c as InferRequestType, i as ClientRequestOptions, l as InferResponseType } from "./types-CHesD1KG.js";
+import { n as AppRequest, t as App } from "./index-B-3F4wt2.js";
+export { Acryl, type AcrylRequest, App, type AppRequest, type ClientRequestOptions, Context, type ContextRenderer, type ContextVariableMap, type Env, type ErrorHandler, type ExecutionContext, type Handler, type InferRequestType, type InferResponseType, type Input, type MiddlewareHandler, type Next, type NotFoundHandler, type NotFoundResponse, type Schema, type ToSchema, type TypedResponse, type ValidationTargets };

package/lib/index.js

@@ -0,0 +1,28 @@
+import { t as Context } from "./context-DDO0cfuP.js";
+import { t as Acryl } from "./app-BM0rTCp7.js";
+//#region ../../plugins/acryl-router/src/core/index.ts
+/**
+* @module
+*
+* Acryl - Web Framework built on Web Standards
+*
+* @example
+* ```ts
+* import { Acryl } from 'acrylblends'
+* const app = new Acryl()
+*
+* app.get('/', (c) => c.text('Acryl!'))
+*
+* export default app
+* ```
+*/
+//#endregion
+//#region ../../plugins/acryl-router/src/deprecated.ts
+/**
+* The 0.4 names, kept for one release so code written against them keeps working: `App` is now `Acryl` and `AppRequest` is now `AcrylRequest`,
+* the upstream names with the project renamed. Not part of the ported core; both the plugin's root and the public package's root export these.
+*/
+/** @deprecated Use `Acryl` (`new Acryl()`); `App` is the 0.4 name and goes away in the next release. */
+const App = Acryl;
+//#endregion
+export { Acryl, App, Context };

package/lib/ip-restriction.d.ts

@@ -0,0 +1,68 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+import { r as GetConnInfo, t as AddressType } from "./types-CDO6I3B0.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/ip-restriction/index.d.ts
+/**
+ * Function to get IP Address
+ */
+type GetIPAddr = GetConnInfo | ((c: Context) => string);
+type IPRestrictionRule = string | ((addr: {
+  addr: string;
+  type: AddressType;
+}) => boolean);
+/**
+ * Rules for IP Restriction Middleware
+ */
+interface IPRestrictionRules {
+  denyList?: IPRestrictionRule[];
+  allowList?: IPRestrictionRule[];
+}
+/**
+ * IP Restriction Middleware for Acryl.
+ *
+ *
+ * @param {GetConnInfo | ((c: Context) => string)} getIP - A function to retrieve the client IP address. Use `getConnInfo` from the appropriate runtime adapter.
+ * @param {IPRestrictionRules} rules - An object with optional `denyList` and `allowList` arrays of IP rules. Each rule can be a static IP, a CIDR range, or a custom function.
+ * @param {(remote: { addr: string; type: AddressType }, c: Context) => Response | Promise<Response>} [onError] - Optional custom handler invoked when a request is blocked. Defaults to returning a 403 Forbidden response.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * import { Acryl } from 'acrylblends'
+ * import { ipRestriction } from 'acrylblends/ip-restriction'
+ * import { getConnInfo } from 'acrylblends/cloudflare-workers'
+ *
+ * const app = new Acryl()
+ *
+ * app.use(
+ *   '*',
+ *   ipRestriction(getConnInfo, {
+ *     // Block a specific IP and an entire subnet
+ *     denyList: ['192.168.0.5', '10.0.0.0/8'],
+ *     // Only allow requests from localhost and a private range
+ *     allowList: ['127.0.0.1', '::1', '192.168.1.0/24'],
+ *   })
+ * )
+ *
+ * // With a custom error handler
+ * app.use(
+ *   '/admin/*',
+ *   ipRestriction(
+ *     getConnInfo,
+ *     { allowList: ['203.0.113.0/24'] },
+ *     (remote, c) => c.text(`Access denied for ${remote.addr}`, 403)
+ *   )
+ * )
+ *
+ * app.get('/', (c) => c.text('Hello!'))
+ * ```
+ */
+declare const ipRestriction: (getIP: GetIPAddr, {
+  denyList,
+  allowList
+}: IPRestrictionRules, onError?: (remote: {
+  addr: string;
+  type: AddressType;
+}, c: Context) => Response | Promise<Response>) => MiddlewareHandler;
+//#endregion
+export { IPRestrictionRule, IPRestrictionRules, ipRestriction };

package/lib/ip-restriction.js

@@ -0,0 +1,166 @@
+import { HTTPException } from "./http-exception.js";
+import { convertIPv4MappedIPv6ToIPv4, convertIPv4ToBinary, convertIPv6BinaryToString, convertIPv6ToBinary, distinctRemoteAddr, isIPv4MappedIPv6 } from "./utils/ipaddr.js";
+//#region ../../plugins/acryl-router/src/core/middleware/ip-restriction/index.ts
+const IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
+const parseCidrPrefix = (rule, prefix, max) => {
+	if (!/^[0-9]{1,3}$/.test(prefix)) throw new TypeError(`Invalid rule: ${rule}`);
+	const parsedPrefix = parseInt(prefix);
+	if (parsedPrefix > max) throw new TypeError(`Invalid rule: ${rule}`);
+	return parsedPrefix;
+};
+const buildMatcher = (rules) => {
+	const functionRules = [];
+	const staticRules = /* @__PURE__ */ new Set();
+	const staticIPv4Rules = /* @__PURE__ */ new Set();
+	const staticIPv6Rules = /* @__PURE__ */ new Set();
+	const cidrRules = [];
+	const registerStaticRule = (rule) => {
+		const type = distinctRemoteAddr(rule);
+		if (type === void 0) throw new TypeError(`Invalid rule: ${rule}`);
+		if (type === "IPv4") {
+			const ipv4binary = convertIPv4ToBinary(rule);
+			staticRules.add(rule);
+			staticRules.add(`::ffff:${rule}`);
+			staticIPv4Rules.add(ipv4binary);
+			staticIPv6Rules.add(65535n << 32n | ipv4binary);
+		} else {
+			const ipv6binary = convertIPv6ToBinary(rule);
+			const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+			staticRules.add(ipv6Addr);
+			staticIPv6Rules.add(ipv6binary);
+			if (isIPv4MappedIPv6(ipv6binary)) {
+				staticRules.add(ipv6Addr.substring(7));
+				staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
+			}
+		}
+	};
+	for (let rule of rules) if (rule === "*") return () => true;
+	else if (typeof rule === "function") functionRules.push(rule);
+	else {
+		if (IS_CIDR_NOTATION_REGEX.test(rule)) {
+			const separatedRule = rule.split("/");
+			const addrStr = separatedRule[0];
+			const type = distinctRemoteAddr(addrStr);
+			if (type === void 0) throw new TypeError(`Invalid rule: ${rule}`);
+			let isIPv4 = type === "IPv4";
+			let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
+			if (isIPv4 ? prefix === 32 : prefix === 128) rule = addrStr;
+			else {
+				let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
+				if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+					isIPv4 = true;
+					addr = convertIPv4MappedIPv6ToIPv4(addr);
+					prefix -= 96;
+				}
+				const mask = (1n << BigInt(prefix)) - 1n << BigInt((isIPv4 ? 32 : 128) - prefix);
+				cidrRules.push([
+					isIPv4,
+					addr & mask,
+					mask
+				]);
+				continue;
+			}
+		}
+		registerStaticRule(rule);
+	}
+	return (remote) => {
+		if (staticRules.has(remote.addr)) return true;
+		const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
+		const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
+		if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) return true;
+		for (const [isIPv4, addr, mask] of cidrRules) {
+			if (isIPv4) {
+				if (remoteIPv4Addr === void 0) continue;
+				if ((remoteIPv4Addr & mask) === addr) return true;
+				continue;
+			}
+			if (remote.isIPv4) continue;
+			if ((remoteAddr & mask) === addr) return true;
+		}
+		for (const rule of functionRules) if (rule({
+			addr: remote.addr,
+			type: remote.type
+		})) return true;
+		return false;
+	};
+};
+/**
+* IP Restriction Middleware for Acryl.
+*
+*
+* @param {GetConnInfo | ((c: Context) => string)} getIP - A function to retrieve the client IP address. Use `getConnInfo` from the appropriate runtime adapter.
+* @param {IPRestrictionRules} rules - An object with optional `denyList` and `allowList` arrays of IP rules. Each rule can be a static IP, a CIDR range, or a custom function.
+* @param {(remote: { addr: string; type: AddressType }, c: Context) => Response | Promise<Response>} [onError] - Optional custom handler invoked when a request is blocked. Defaults to returning a 403 Forbidden response.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* import { Acryl } from 'acrylblends'
+* import { ipRestriction } from 'acrylblends/ip-restriction'
+* import { getConnInfo } from 'acrylblends/cloudflare-workers'
+*
+* const app = new Acryl()
+*
+* app.use(
+*   '*',
+*   ipRestriction(getConnInfo, {
+*     // Block a specific IP and an entire subnet
+*     denyList: ['192.168.0.5', '10.0.0.0/8'],
+*     // Only allow requests from localhost and a private range
+*     allowList: ['127.0.0.1', '::1', '192.168.1.0/24'],
+*   })
+* )
+*
+* // With a custom error handler
+* app.use(
+*   '/admin/*',
+*   ipRestriction(
+*     getConnInfo,
+*     { allowList: ['203.0.113.0/24'] },
+*     (remote, c) => c.text(`Access denied for ${remote.addr}`, 403)
+*   )
+* )
+*
+* app.get('/', (c) => c.text('Hello!'))
+* ```
+*/
+const ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
+	const allowLength = allowList.length;
+	const denyMatcher = buildMatcher(denyList);
+	const allowMatcher = buildMatcher(allowList);
+	const blockError = (c) => new HTTPException(403, { res: c.text("Forbidden", { status: 403 }) });
+	return async function ipRestriction(c, next) {
+		const connInfo = getIP(c);
+		const addr = typeof connInfo === "string" ? connInfo : connInfo.remote.address;
+		if (!addr) throw blockError(c);
+		const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
+		const remoteData = {
+			addr,
+			type,
+			isIPv4: type === "IPv4"
+		};
+		try {
+			if (denyMatcher(remoteData)) {
+				if (onError) return onError({
+					addr,
+					type
+				}, c);
+				throw blockError(c);
+			}
+			if (allowMatcher(remoteData)) return await next();
+		} catch (e) {
+			if (e instanceof TypeError && e.code === "ERR_INVALID_IP_ADDRESS") throw blockError(c);
+			throw e;
+		}
+		if (allowLength === 0) return await next();
+		else {
+			if (onError) return await onError({
+				addr,
+				type
+			}, c);
+			throw blockError(c);
+		}
+	};
+};
+//#endregion
+export { ipRestriction };

package/lib/jwk.d.ts

@@ -0,0 +1,52 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+import { n as BufferSource } from "./types-CwrQjlaM.js";
+import { i as CookiePrefixOptions } from "./cookie-ClMaKDQf.js";
+import { i as AcrylJsonWebKey, n as VerifyOptions, s as AsymmetricAlgorithm } from "./jwt-Dg493Tai.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/jwk/jwk.d.ts
+/**
+ * JWK Auth Middleware for Acryl.
+ *
+ *
+ * @param {object} options - The options for the JWK middleware.
+ * @param {AcrylJsonWebKey[] | ((ctx: Context) => Promise<AcrylJsonWebKey[]> | AcrylJsonWebKey[])} [options.keys] - The public keys used for JWK verification, or a function that returns them.
+ * @param {string | ((ctx: Context) => Promise<string> | string)} [options.jwks_uri] - If set to a URI string or a function that returns a URI string, attempt to fetch JWKs from it. The response must be a JSON object containing a `keys` array, which will be merged with the `keys` option.
+ * @param {boolean} [options.allow_anon] - If set to `true`, the middleware allows requests without a token to proceed without authentication.
+ * @param {string} [options.cookie] - If set, the middleware attempts to retrieve the token from a cookie with these options (optionally signed) only if no token is found in the header.
+ * @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+ * @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+ * @param {AsymmetricAlgorithm[]} options.alg - An array of allowed asymmetric algorithms for JWT verification. Only tokens signed with these algorithms will be accepted.
+ * @param {RequestInit} [init] - Optional init options for the `fetch` request when retrieving JWKS from a URI.
+ * @param {VerifyOptions} [options.verification] - Additional options for JWK payload verification.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * app.use("/auth/*", jwk({
+ *   jwks_uri: (c) => `https://${c.env.authServer}/.well-known/jwks.json`,
+ *   headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+ * }))
+ *
+ * app.get('/auth/page', (c) => {
+ *   return c.text('You are authorized')
+ * })
+ * ```
+ */
+declare const jwk: (options: {
+  keys?: AcrylJsonWebKey[] | ((ctx: Context) => Promise<AcrylJsonWebKey[]> | AcrylJsonWebKey[]);
+  jwks_uri?: string | ((ctx: Context) => Promise<string> | string);
+  allow_anon?: boolean;
+  cookie?: string | {
+    key: string;
+    secret?: string | BufferSource;
+    prefixOptions?: CookiePrefixOptions;
+  };
+  headerName?: string;
+  alg: AsymmetricAlgorithm[];
+  realm?: string;
+  verification?: VerifyOptions;
+}, init?: RequestInit) => MiddlewareHandler;
+//#endregion
+export { jwk };