acrylblends 0.4.1 → 0.5.0

package/lib/jwt.js

@@ -0,0 +1,115 @@
+import { HTTPException } from "./http-exception.js";
+import { getCookie, getSignedCookie } from "./cookie.js";
+import { n as AlgorithmTypes, t as Jwt } from "./jwt-BGJBw5AF.js";
+//#region ../../plugins/acryl-router/src/core/middleware/jwt/jwt.ts
+/**
+* JWT Auth Middleware for Acryl.
+*
+*
+* @param {object} options - The options for the JWT middleware.
+* @param {SignatureKey} options.secret - A value of your secret key.
+* @param {string} [options.cookie] - If this value is set, then the value is retrieved from the cookie header using that value as a key, which is then validated as a token.
+* @param {SignatureAlgorithm} options.alg - An algorithm type that is used for verifying (required). Available types are `HS256` | `HS384` | `HS512` | `RS256` | `RS384` | `RS512` | `PS256` | `PS384` | `PS512` | `ES256` | `ES384` | `ES512` | `EdDSA`.
+* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+* @param {VerifyOptions} [options.verification] - Additional options for JWT payload verification.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use(
+*   '/auth/*',
+*   jwt({
+*     secret: process.env.JWT_SECRET, // never a literal in source
+*     alg: 'HS256',
+*     headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+*   })
+* )
+*
+* app.get('/auth/page', (c) => {
+*   return c.text('You are authorized')
+* })
+* ```
+*/
+const jwt = (options) => {
+	const verifyOpts = options.verification || {};
+	if (!options || !options.secret) throw new Error("JWT auth middleware requires options for \"secret\"");
+	if (!options.alg) throw new Error("JWT auth middleware requires options for \"alg\"");
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	return async function jwt(ctx, next) {
+		const headerName = options.headerName || "Authorization";
+		const credentials = ctx.req.raw.headers.get(headerName);
+		let token;
+		if (credentials) {
+			const parts = credentials.split(/\s+/);
+			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+				const errDescription = "invalid credentials structure";
+				throw new HTTPException(401, {
+					message: errDescription,
+					res: unauthorizedResponse({
+						ctx,
+						error: "invalid_request",
+						errDescription,
+						realm: options.realm
+					})
+				});
+			} else token = parts[1];
+		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
+		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
+		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
+		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
+		else token = getCookie(ctx, options.cookie.key);
+		if (!token) {
+			const errDescription = "no authorization included in request";
+			throw new HTTPException(401, {
+				message: errDescription,
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_request",
+					errDescription,
+					realm: options.realm
+				})
+			});
+		}
+		let payload;
+		let cause;
+		try {
+			payload = await Jwt.verify(token, options.secret, {
+				alg: options.alg,
+				...verifyOpts
+			});
+		} catch (e) {
+			cause = e;
+		}
+		if (!payload) throw new HTTPException(401, {
+			message: "Unauthorized",
+			res: unauthorizedResponse({
+				ctx,
+				error: "invalid_token",
+				statusText: "Unauthorized",
+				errDescription: "token verification failure",
+				realm: options.realm
+			}),
+			cause
+		});
+		ctx.set("jwtPayload", payload);
+		await next();
+	};
+};
+function unauthorizedResponse(opts) {
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
+	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	return new Response("Unauthorized", {
+		status: 401,
+		statusText: opts.statusText,
+		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
+	});
+}
+const verifyWithJwks = Jwt.verifyWithJwks;
+const verify = Jwt.verify;
+const decode = Jwt.decode;
+const sign = Jwt.sign;
+//#endregion
+export { AlgorithmTypes, decode, jwt, sign, verify, verifyWithJwks };

package/lib/language.d.ts

@@ -0,0 +1,88 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/language/language.d.ts
+type DetectorType = 'path' | 'querystring' | 'cookie' | 'header';
+type CacheType = 'cookie';
+interface DetectorOptions {
+  /** Order of language detection strategies */
+  order: DetectorType[];
+  /** Query parameter name for language */
+  lookupQueryString: string;
+  /** Cookie name for language */
+  lookupCookie: string;
+  /** Index in URL path where language code appears */
+  lookupFromPathIndex: number;
+  /** Header key for language detection */
+  lookupFromHeaderKey: string;
+  /** Caching strategies */
+  caches: CacheType[] | false;
+  /** Cookie configuration options */
+  cookieOptions?: {
+    domain?: string;
+    path?: string;
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    secure?: boolean;
+    maxAge?: number;
+    httpOnly?: boolean;
+  };
+  /** Whether to ignore case in language codes */
+  ignoreCase: boolean;
+  /** Default language if none detected */
+  fallbackLanguage: string;
+  /** List of supported language codes */
+  supportedLanguages: string[];
+  /** Optional function to transform detected language codes */
+  convertDetectedLanguage?: (lang: string) => string;
+  /** Enable debug logging */
+  debug?: boolean;
+}
+interface LanguageVariables {
+  language: string;
+}
+/**
+ * Detects language from query parameter
+ */
+declare const detectFromQuery: (c: Context, options: DetectorOptions) => string | undefined;
+/**
+ * Detects language from cookie
+ */
+declare const detectFromCookie: (c: Context, options: DetectorOptions) => string | undefined;
+/**
+ * Detects language from Accept-Language header
+ */
+declare function detectFromHeader(c: Context, options: DetectorOptions): string | undefined;
+/**
+ * Detects language from URL path
+ */
+declare function detectFromPath(c: Context, options: DetectorOptions): string | undefined;
+/**
+ * Language detector middleware factory
+ * @param userOptions Configuration options for the language detector
+ * @returns Acryl middleware function
+ *
+ * @example
+ * ```ts
+ * type Variables = LanguageVariables
+ * const app = new Acryl<{ Variables: Variables }>()
+ *
+ * app.use(
+ *   languageDetector({
+ *     supportedLanguages: ['en', 'ja'], // Must include fallback
+ *     fallbackLanguage: 'en', // Required
+ *   })
+ * )
+ *
+ * app.get('/', (c) => {
+ *   const lang = c.get('language')
+ *   return c.text(`Current language: ${lang}`)
+ * })
+ * ```
+ */
+declare const languageDetector: (userOptions: Partial<DetectorOptions>) => MiddlewareHandler;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/middleware/language/index.d.ts
+declare module '../../context.ts' {
+  interface ContextVariableMap extends LanguageVariables {}
+}
+//#endregion
+export { type CacheType, type DetectorOptions, type DetectorType, type LanguageVariables, detectFromCookie, detectFromHeader, detectFromPath, detectFromQuery, languageDetector };

package/lib/language.js

@@ -0,0 +1,198 @@
+import { parseAccept } from "./utils/accept.js";
+import { getCookie, setCookie } from "./cookie.js";
+//#region ../../plugins/acryl-router/src/core/middleware/language/language.ts
+const DEFAULT_OPTIONS = {
+	order: [
+		"querystring",
+		"cookie",
+		"header"
+	],
+	lookupQueryString: "lang",
+	lookupCookie: "language",
+	lookupFromHeaderKey: "accept-language",
+	lookupFromPathIndex: 0,
+	caches: ["cookie"],
+	ignoreCase: true,
+	fallbackLanguage: "en",
+	supportedLanguages: ["en"],
+	cookieOptions: {
+		sameSite: "Strict",
+		secure: true,
+		maxAge: 365 * 24 * 60 * 60,
+		httpOnly: true
+	},
+	debug: false
+};
+/**
+* Parse Accept-Language header values with quality scores
+* @param header Accept-Language header string
+* @returns Array of parsed languages with quality scores
+*/
+function parseAcceptLanguage(header) {
+	return parseAccept(header).map(({ type, q }) => ({
+		lang: type,
+		q
+	}));
+}
+/**
+* Validate and normalize language codes
+* @param lang Language code to normalize
+* @param options Detector options
+* @returns Normalized language code or undefined
+*/
+const normalizeLanguage = (lang, options) => {
+	if (!lang) return;
+	try {
+		let normalizedLang = lang.trim();
+		if (options.convertDetectedLanguage) normalizedLang = options.convertDetectedLanguage(normalizedLang);
+		const compLang = options.ignoreCase ? normalizedLang.toLowerCase() : normalizedLang;
+		const compSupported = options.supportedLanguages.map((l) => options.ignoreCase ? l.toLowerCase() : l);
+		const exactIndex = compSupported.indexOf(compLang);
+		if (exactIndex !== -1) return options.supportedLanguages[exactIndex];
+		let longestMatchIndex = -1;
+		let longestMatchLength = -1;
+		for (let i = 0; i < compSupported.length; i++) {
+			const candidate = compSupported[i];
+			if (candidate.length < compLang.length && candidate.length > longestMatchLength && compLang.startsWith(candidate) && compLang[candidate.length] === "-") {
+				longestMatchIndex = i;
+				longestMatchLength = candidate.length;
+			}
+		}
+		if (longestMatchIndex !== -1) return options.supportedLanguages[longestMatchIndex];
+		return;
+	} catch {
+		return;
+	}
+};
+/**
+* Detects language from query parameter
+*/
+const detectFromQuery = (c, options) => {
+	const query = c.req.query(options.lookupQueryString);
+	return normalizeLanguage(query, options);
+};
+/**
+* Detects language from cookie
+*/
+const detectFromCookie = (c, options) => {
+	const cookie = getCookie(c, options.lookupCookie);
+	return normalizeLanguage(cookie, options);
+};
+/**
+* Detects language from Accept-Language header
+*/
+function detectFromHeader(c, options) {
+	try {
+		const acceptLanguage = c.req.header(options.lookupFromHeaderKey);
+		if (!acceptLanguage) return;
+		const languages = parseAcceptLanguage(acceptLanguage);
+		for (const { lang, q } of languages) {
+			if (q === 0) continue;
+			const normalizedLang = normalizeLanguage(lang, options);
+			if (normalizedLang) return normalizedLang;
+		}
+		return;
+	} catch {
+		return;
+	}
+}
+/**
+* Detects language from URL path
+*/
+function detectFromPath(c, options) {
+	const langSegment = new URL(c.req.url).pathname.split("/").filter(Boolean)[options.lookupFromPathIndex];
+	return normalizeLanguage(langSegment, options);
+}
+/**
+* Collection of all language detection strategies
+*/
+const detectors = {
+	querystring: detectFromQuery,
+	cookie: detectFromCookie,
+	header: detectFromHeader,
+	path: detectFromPath
+};
+/**
+* Validate detector options
+* @param options Detector options to validate
+* @throws Error if options are invalid
+*/
+function validateOptions(options) {
+	if (!options.supportedLanguages.includes(options.fallbackLanguage)) throw new Error("Fallback language must be included in supported languages");
+	if (options.lookupFromPathIndex < 0) throw new Error("Path index must be non-negative");
+	if (!options.order.every((detector) => Object.keys(detectors).includes(detector))) throw new Error("Invalid detector type in order array");
+}
+/**
+* Cache detected language
+*/
+function cacheLanguage(c, language, options) {
+	if (!Array.isArray(options.caches) || !options.caches.includes("cookie")) return;
+	try {
+		setCookie(c, options.lookupCookie, language, options.cookieOptions);
+	} catch (error) {
+		if (options.debug) console.error("Failed to cache language:", error);
+	}
+}
+/**
+* Detect language from request
+*/
+const detectLanguage = (c, options) => {
+	let detectedLang;
+	for (const detectorName of options.order) {
+		const detector = detectors[detectorName];
+		try {
+			detectedLang = detector(c, options);
+			if (detectedLang) {
+				if (options.debug) console.log(`Language detected from ${detectorName}: ${detectedLang}`);
+				break;
+			}
+		} catch (error) {
+			if (options.debug) console.error(`Error in ${detectorName} detector:`, error);
+			continue;
+		}
+	}
+	const finalLang = detectedLang || options.fallbackLanguage;
+	if (detectedLang && options.caches) cacheLanguage(c, finalLang, options);
+	return finalLang;
+};
+/**
+* Language detector middleware factory
+* @param userOptions Configuration options for the language detector
+* @returns Acryl middleware function
+*
+* @example
+* ```ts
+* type Variables = LanguageVariables
+* const app = new Acryl<{ Variables: Variables }>()
+*
+* app.use(
+*   languageDetector({
+*     supportedLanguages: ['en', 'ja'], // Must include fallback
+*     fallbackLanguage: 'en', // Required
+*   })
+* )
+*
+* app.get('/', (c) => {
+*   const lang = c.get('language')
+*   return c.text(`Current language: ${lang}`)
+* })
+* ```
+*/
+const languageDetector = (userOptions) => {
+	const options = {
+		...DEFAULT_OPTIONS,
+		...userOptions,
+		cookieOptions: {
+			...DEFAULT_OPTIONS.cookieOptions,
+			...userOptions.cookieOptions
+		}
+	};
+	validateOptions(options);
+	return async function languageDetector(ctx, next) {
+		const lang = detectLanguage(ctx, options);
+		ctx.set("language", lang);
+		await next();
+	};
+};
+//#endregion
+export { detectFromCookie, detectFromHeader, detectFromPath, detectFromQuery, languageDetector };

package/lib/logger.d.ts

@@ -0,0 +1,22 @@
+import { I as MiddlewareHandler } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/logger/index.d.ts
+type PrintFunc = (str: string, ...rest: string[]) => void;
+/**
+ * Logger Middleware for Acryl.
+ *
+ *
+ * @param {PrintFunc} [fn=console.log] - Optional function for customized logging behavior.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * app.use(logger())
+ * app.get('/', (c) => c.text('Hello Acryl!'))
+ * ```
+ */
+declare const logger: (fn?: PrintFunc) => MiddlewareHandler;
+//#endregion
+export { logger };

package/lib/logger.js

@@ -0,0 +1,54 @@
+import { getColorEnabledAsync } from "./utils/color.js";
+//#region ../../plugins/acryl-router/src/core/middleware/logger/index.ts
+const LogPrefix = {
+	Outgoing: "-->",
+	Incoming: "<--",
+	Error: "xxx"
+};
+const humanize = (times) => {
+	const [delimiter, separator] = [",", "."];
+	return times.map((v) => v.replace(/(\d)(?=(\d\d\d)+(?!\d))/g, "$1" + delimiter)).join(separator);
+};
+const time = (start) => {
+	const delta = Date.now() - start;
+	return humanize([delta < 1e3 ? delta + "ms" : Math.round(delta / 1e3) + "s"]);
+};
+const colorStatus = async (status) => {
+	if (await getColorEnabledAsync()) switch (status / 100 | 0) {
+		case 5: return `\x1b[31m${status}\x1b[0m`;
+		case 4: return `\x1b[33m${status}\x1b[0m`;
+		case 3: return `\x1b[36m${status}\x1b[0m`;
+		case 2: return `\x1b[32m${status}\x1b[0m`;
+	}
+	return `${status}`;
+};
+async function log(fn, prefix, method, path, status = 0, elapsed) {
+	fn(prefix === LogPrefix.Incoming ? `${prefix} ${method} ${path}` : `${prefix} ${method} ${path} ${await colorStatus(status)} ${elapsed}`);
+}
+/**
+* Logger Middleware for Acryl.
+*
+*
+* @param {PrintFunc} [fn=console.log] - Optional function for customized logging behavior.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use(logger())
+* app.get('/', (c) => c.text('Hello Acryl!'))
+* ```
+*/
+const logger = (fn = console.log) => {
+	return async function logger(c, next) {
+		const { method, url } = c.req;
+		const path = url.slice(url.indexOf("/", 8));
+		await log(fn, LogPrefix.Incoming, method, path);
+		const start = Date.now();
+		await next();
+		await log(fn, LogPrefix.Outgoing, method, path, c.res.status, time(start));
+	};
+};
+//#endregion
+export { logger };

package/lib/loopback-only.d.ts

@@ -0,0 +1,45 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/middleware/loopback-only.d.ts
+interface LoopbackOptions {
+  /** Hostnames a `Host` header may name. Default: the loopback names `127.0.0.1`, `localhost` and `[::1]`. */
+  readonly hostnames?: readonly string[];
+  /**
+   * What a request that changes things (not GET, HEAD or OPTIONS) must show: `same-origin` (default) refuses an `Origin` header that is not this same
+   * authority (including `null`), which stops another web page from driving a local app. A browser always sends `Origin` on a cross-origin change, so a
+   * request with no `Origin` (curl, a script) is allowed: the `Host` it names is already checked to be a loopback address with this server's port, which
+   * is what stops DNS rebinding. `none` checks only the peer and the `Host`.
+   */
+  readonly mutations?: 'same-origin' | 'none';
+  /**
+   * A call made inside the process (the terminal UI, a test) has no socket, so no peer to check. `deny` (default) refuses it, the safe choice for a route
+   * that guards something; `allow` lets it through for routes whose in-process caller is the host's own code. A request that came over a socket is always
+   * checked in full: only a call with no connection facts at all counts as in process.
+   */
+  readonly inProcess?: 'deny' | 'allow';
+  /**
+   * Who may call. `local` (default): any program on this machine, a browser page only as `mutations` allows. `own-page`: only this app's own page,
+   * for private routes a script on the machine must not drive or read either. A request then shows an `Origin` that is exactly this authority (with
+   * `Sec-Fetch-Site` absent or `same-origin`), or, for a read (GET, HEAD, OPTIONS), which browsers often send without `Origin`, `Sec-Fetch-Site:
+   * same-origin` and a `Referer` from this authority. `mutations` is not consulted: every request is held to that rule.
+   */
+  readonly callers?: 'local' | 'own-page';
+}
+/**
+ * The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
+ * real local port, names another host, or is marked cross-site by the browser. The peer and the port come from the transport (`connectionOf(c)`), never
+ * from a header; an in-process call has neither and is refused.
+ */
+declare const LOOPBACK_HOSTNAMES: readonly string[];
+declare function loopbackAuthority(c: Context, hostnames?: readonly string[]): URL | undefined;
+/** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
+declare function sameOrigin(c: Context, authority: URL): boolean;
+/** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
+declare function fromOwnPage(c: Context, authority: URL): boolean;
+/**
+ * Only requests from this machine to this app: loopback peer, the real port, an allowed `Host`, and for mutations a matching `Origin` (with
+ * `callers: 'own-page'`, every request from this app's own page). Everything else gets a 403.
+ */
+declare function loopbackOnly(options?: LoopbackOptions): MiddlewareHandler;
+//#endregion
+export { LOOPBACK_HOSTNAMES, LoopbackOptions, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };

package/lib/loopback-only.js

@@ -0,0 +1,90 @@
+import { t as connectionOf } from "./connection-C7xgP1hP.js";
+import { BlockList, isIP } from "node:net";
+//#region ../../plugins/acryl-router/src/middleware/loopback-only.ts
+const loopback = new BlockList();
+loopback.addSubnet("127.0.0.0", 8, "ipv4");
+loopback.addSubnet("::1", 128, "ipv6");
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
+* real local port, names another host, or is marked cross-site by the browser. The peer and the port come from the transport (`connectionOf(c)`), never
+* from a header; an in-process call has neither and is refused.
+*/
+const LOOPBACK_HOSTNAMES = [
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+];
+function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
+	const { remoteAddress, localPort } = connectionOf(c);
+	const host = c.req.header("host");
+	if (remoteAddress === void 0 || localPort === void 0 || host === void 0) return void 0;
+	const address = (remoteAddress.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
+	const family = isIP(address);
+	if (family === 0 || !loopback.check(address, family === 4 ? "ipv4" : "ipv6")) return void 0;
+	let authority;
+	try {
+		authority = new URL(`http://${host}`);
+	} catch {
+		return;
+	}
+	if (authority.protocol !== "http:" || Number(authority.port || "80") !== localPort || !hostnames.includes(authority.hostname) || c.req.header("sec-fetch-site") === "cross-site") return void 0;
+	return authority;
+}
+/** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
+function sameOrigin(c, authority) {
+	const origin = c.req.header("origin");
+	if (origin === void 0) return true;
+	try {
+		const parsed = new URL(origin);
+		return parsed.protocol === "http:" && parsed.host === authority.host && parsed.pathname === "/";
+	} catch {
+		return false;
+	}
+}
+function originOf(value) {
+	if (value === void 0) return void 0;
+	try {
+		return new URL(value).origin;
+	} catch {
+		return;
+	}
+}
+/** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
+function fromOwnPage(c, authority) {
+	const origin = c.req.header("origin");
+	const fetchSite = c.req.header("sec-fetch-site");
+	if (origin !== void 0 && originOf(origin) === origin && origin === authority.origin) return fetchSite === void 0 || fetchSite === "same-origin";
+	return SAFE_METHODS.has(c.req.method) && fetchSite === "same-origin" && originOf(c.req.header("referer")) === authority.origin;
+}
+/**
+* Only requests from this machine to this app: loopback peer, the real port, an allowed `Host`, and for mutations a matching `Origin` (with
+* `callers: 'own-page'`, every request from this app's own page). Everything else gets a 403.
+*/
+function loopbackOnly(options = {}) {
+	const mutations = options.mutations ?? "same-origin";
+	const inProcess = options.inProcess ?? "deny";
+	const ownPage = options.callers === "own-page";
+	return async (c, next) => {
+		const connection = connectionOf(c);
+		if (inProcess === "allow" && connection.remoteAddress === void 0 && connection.localPort === void 0) {
+			await next();
+			return;
+		}
+		const authority = loopbackAuthority(c, options.hostnames);
+		if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
+		if (ownPage) {
+			if (!fromOwnPage(c, authority)) return c.json({ error: "only this app's own page may call this" }, 403);
+			await next();
+			return;
+		}
+		if (mutations === "same-origin" && !SAFE_METHODS.has(c.req.method) && !sameOrigin(c, authority)) return c.json({ error: "a change must come from this app's own origin" }, 403);
+		await next();
+	};
+}
+//#endregion
+export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };

package/lib/method-not-allowed.d.ts

@@ -0,0 +1,47 @@
+import { I as MiddlewareHandler, _ as Env, t as Context } from "./context-Bm7rI-oK.js";
+import { t as Acryl } from "./app-CmAYW1Al.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/method-not-allowed/index.d.ts
+type MethodNotAllowedHandler<E extends Env> = (c: Context<E>, allowedMethods: string[]) => Response | Promise<Response>;
+type MethodNotAllowedOptions<E extends Env> = {
+  app: Acryl<E, any, any>;
+  onMethodNotAllowed?: MethodNotAllowedHandler<E>;
+};
+/**
+ * Method Not Allowed Middleware for Acryl.
+ *
+ * Returns a `405 Method Not Allowed` response with an `Allow` header when the request path
+ * matches a registered route but the request method is not supported.
+ *
+ * @param {MethodNotAllowedOptions} options - The options for the middleware.
+ * @param {Acryl} options.app - The Acryl instance used by the application.
+ * @param {MethodNotAllowedHandler} [options.onMethodNotAllowed] - Generates the response, including its `Allow` header.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * app.use(methodNotAllowed({ app }))
+ *
+ * app.get('/hello', (c) => c.text('Hello!'))
+ * app.post('/hello', (c) => c.text('Posted!'))
+ *
+ * // PUT /hello -> 405 Method Not Allowed
+ * // Allow: GET, HEAD, POST
+ * ```
+ *
+ * @example
+ * ```ts
+ * app.use(
+ *   methodNotAllowed({
+ *     app,
+ *     onMethodNotAllowed: (c, methods) =>
+ *       c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
+ *   })
+ * )
+ * ```
+ */
+declare const methodNotAllowed: <E extends Env = Env>(options: MethodNotAllowedOptions<E>) => MiddlewareHandler<E>;
+//#endregion
+export { methodNotAllowed };