acrylblends 0.8.1 → 0.9.0

package/lib/index-BqVQkTnu.d.ts

@@ -0,0 +1,98 @@
+import { B as NotFoundHandler, y as ErrorHandler } from "./context-DS3fYyG-.js";
+import { t as ConnectionInfo } from "./connection-ZLEso7XL.js";
+import { Context, Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+
+//#region ../../plugins/acryl-router/src/service.d.ts
+/** How a trailing slash is read: `strict` keeps `/a` and `/a/` distinct, `ignore` treats them as one path. */
+type TrailingSlash = 'strict' | 'ignore';
+/** Validated plugin configuration. */
+interface Config {
+  trailingSlash: TrailingSlash;
+  disposeGraceMs: number;
+}
+/** Every field has a default, so a caller passes only what it changes: `ctx.plugin(plugin, { ... })` takes the partial shape. */
+declare const Config: z<Partial<Config>, Config>;
+/**
+ * The Web adapter's service (`ctx.routerHttp`, provided by `acryl-router-http`). Declared here, beside `router`, so a plugin can ask for its routes to be
+ * served over HTTP without depending on the adapter package.
+ */
+interface RouterHttpService {
+  /** Serve `prefix` and everything below it through the router; returns a remover. The mount also goes away when the calling plugin unloads. */
+  mount(prefix: string): () => void;
+}
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    router: Router;
+    routerHttp: RouterHttpService;
+  }
+}
+/** Stable Cordis plugin name, equal to the package name and the Loader row id. */
+declare const name = "acryl-router";
+/**
+ * What {@link Router.route} takes: any app with routes, read structurally. An `Acryl` from this package qualifies, and so does one built from
+ * another copy of the framework (the published `acrylblends`), whose classes TypeScript would refuse nominally for their private members:
+ * mounting copies the app's routes (and keeps its own `onError`), which is all the router reads. Their handlers are then called with this
+ * router's `Context`, which has the same shape.
+ */
+interface MountableApp {
+  readonly routes: readonly MountableRoute[];
+}
+/** One route of a {@link MountableApp}, as the core lists it. A handler of any context type fits (`never` parameters accept every function). */
+interface MountableRoute {
+  readonly basePath: string;
+  readonly path: string;
+  readonly method: string;
+  readonly handler: (c: never, next: never) => unknown;
+}
+declare class Router extends Service {
+  /** Everything that changes after construction, kept in one object so the service's live state is in one place. */
+  private readonly state;
+  private readonly flights;
+  /** The flight of each request the router dispatched, keyed by the request its handlers see as `c.req.raw`. */
+  private readonly flightOf;
+  private readonly strict;
+  private readonly graceMs;
+  private readonly logError;
+  constructor(ctx: Context, config?: Partial<Config>);
+  /** Registrations currently held (mounts, and the router-wide error and not-found handlers); a leak check for reload tests. */
+  get size(): number;
+  /**
+   * Serve `app` under `path` (`'/'` for its own paths as they are). The mount belongs to the calling plugin and goes away when it unloads;
+   * the returned function removes it sooner. Mounts are composed in the order they were made. Like the core's own `app.route`, the routes
+   * are copied now: one the app registers after this call is not served (mount again, or finish the app first).
+   */
+  route(path: string, app: MountableApp): () => void;
+  /**
+   * The mount's own copy of `app`'s routes as they are now (like the core's `app.route`), each handler wrapped so the router knows which
+   * mount's code a request is in. The core's `app.route` runs first so a sub-app's own `onError` still applies to its routes.
+   */
+  private snapshot;
+  /** Abort `flights`, cut their bodies short and wait for them to settle, at most `disposeGraceMs`. */
+  private end;
+  /** Turn errors no mounted app handled into responses. One handler per router; the calling plugin owns it. */
+  onError(handler: ErrorHandler): () => void;
+  /** Answer requests no route claimed. One handler per router; the calling plugin owns it. */
+  notFound(handler: NotFoundHandler): () => void;
+  /**
+   * Call the router the way a test calls an app: a path or URL string, a `URL` or a `Request`, with the usual init.
+   * A relative path is resolved against `http://localhost`.
+   */
+  request(input: string | URL | Request, init?: RequestInit, connection?: ConnectionInfo): Promise<Response>;
+  /**
+   * Run a request in process. Never throws: failures become a 500, a disposed router answers 503. `connection` describes the transport
+   * (an HTTP adapter passes the socket's peer address and local port); an in-process caller omits it. Handlers read it with
+   * `connectionOf(c)`, abort with `c.req.raw.signal` and keep the request in flight with `c.executionCtx.waitUntil(task)`.
+   */
+  fetch(request: Request, connection?: ConnectionInfo): Promise<Response>;
+  private dispatch;
+  private app;
+  /**
+   * Hand the caller a body the router can end. Reading it passes the handler's chunks through; disposal cancels the handler's stream (which runs
+   * the stream helpers' own abort cleanup) and closes the caller's side, so a stream never outlives the plugin that served it.
+   */
+  private track;
+}
+declare function apply(ctx: Context, config?: Partial<Config>): void;
+//#endregion
+export { TrailingSlash as a, RouterHttpService as i, MountableApp as n, apply as o, Router as r, name as s, Config as t };

package/lib/index-Dmst2QCQ.d.ts

@@ -0,0 +1,44 @@
+import { t as Db } from "./database-DBHdwefi.js";
+
+//#region ../../plugins/acryl-db/src/facade/migrations.d.ts
+type Migration = {
+  readonly version: number;
+  readonly statements: readonly string[];
+};
+/**
+ * Apply all pending migrations atomically, tracking their version in the named metadata table.
+ *
+ * The bookkeeping SQL runs unchanged on SQLite and Postgres: no `STRICT` table, `ON CONFLICT DO NOTHING`
+ * instead of `INSERT OR IGNORE`, and the version written as a checked integer rather than a binding,
+ * since the two dialects spell placeholders differently.
+ */
+declare function applyMigrations(database: Db, migrations: readonly Migration[], options: {
+  readonly table: string;
+}): Promise<void>;
+//#endregion
+//#region ../../plugins/acryl-db/src/facade/schema.d.ts
+/** Validate a prefix before using it as part of a SQL identifier. */
+declare function validateSchemaPrefix(prefix: string): void;
+//#endregion
+//#region ../../plugins/acryl-db/src/migration-files.d.ts
+/**
+ * Read every `NNN-name.sql` file of a folder, in number order.
+ * @throws when a `.sql` file is not named `NNN-name.sql`, or the numbers do not run 1, 2, 3, ... without gaps or repeats.
+ */
+declare function readMigrationFiles(folder: string | URL): Promise<Migration[]>;
+//#endregion
+//#region ../../plugins/acryl-db/src/index.d.ts
+/**
+ * The `db` port: what an app's code sees of its relational database, whichever provider (`acryl-db-sqlite`, `acryl-db-postgres`) serves
+ * it. Plain code (an acrylblends app) opens a database with a provider's `openDb`; a Cordis plugin declares `inject: ['db']`, imports
+ * `acryl-db/cordis` for the `ctx.db` type, and never imports a driver.
+ *
+ * Bindings are positional `?` placeholders on every provider; a provider whose database spells them differently translates them.
+ * This entry imports nothing from Cordis, at runtime or in its types.
+ */
+/** The service name every `db` provider registers. */
+declare const DB_SERVICE = "db";
+/** The table that records an app's migration version. */
+declare const MIGRATIONS_TABLE = "_migrations";
+//#endregion
+export { Migration as a, validateSchemaPrefix as i, MIGRATIONS_TABLE as n, applyMigrations as o, readMigrationFiles as r, DB_SERVICE as t };

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 import { B as NotFoundHandler, L as MiddlewareHandler, O as Handler, Q as ValidationTargets, V as NotFoundResponse, X as ToSchema, Y as Schema, Z as TypedResponse, a as ExecutionContext, j as Input, n as ContextRenderer, r as ContextVariableMap, s as AcrylRequest, t as Context, v as Env, y as ErrorHandler, z as Next } from "./context-DS3fYyG-.js";
 import { t as Acryl } from "./app-D8riatvv.js";
 import { c as InferRequestType, i as ClientRequestOptions, l as InferResponseType } from "./types-zNxyEpG2.js";
-import { n as AppRequest, t as App } from "./index-CTy4N7ng.js";
+import { n as AppRequest, t as App } from "./deprecated-CTy4N7ng.js";
 export { Acryl, type AcrylRequest, App, type AppRequest, type ClientRequestOptions, Context, type ContextRenderer, type ContextVariableMap, type Env, type ErrorHandler, type ExecutionContext, type Handler, type InferRequestType, type InferResponseType, type Input, type MiddlewareHandler, type Next, type NotFoundHandler, type NotFoundResponse, type Schema, type ToSchema, type TypedResponse, type ValidationTargets };

package/lib/index.js

@@ -1,4 +1,5 @@
 import { t as Context } from "./context-DDO0cfuP.js";
 import { t as Acryl } from "./app-BM0rTCp7.js";
-import { t as App } from "./src-0hI7M7cN.js";
+import "./core-CaY8XDZ6.js";
+import { t as App } from "./deprecated-BP4fPt38.js";
 export { Acryl, App, Context };

package/lib/jwk-LkzeoaU8.js

@@ -0,0 +1,117 @@
+import { HTTPException } from "./http-exception.js";
+import { getCookie, getSignedCookie } from "./cookie.js";
+import { t as Jwt } from "./jwt-BGJBw5AF.js";
+//#region ../../plugins/acryl-router/src/core/middleware/jwk/jwk.ts
+/**
+* JWK Auth Middleware for Acryl.
+*
+*
+* @param {object} options - The options for the JWK middleware.
+* @param {AcrylJsonWebKey[] | ((ctx: Context) => Promise<AcrylJsonWebKey[]> | AcrylJsonWebKey[])} [options.keys] - The public keys used for JWK verification, or a function that returns them.
+* @param {string | ((ctx: Context) => Promise<string> | string)} [options.jwks_uri] - If set to a URI string or a function that returns a URI string, attempt to fetch JWKs from it. The response must be a JSON object containing a `keys` array, which will be merged with the `keys` option.
+* @param {boolean} [options.allow_anon] - If set to `true`, the middleware allows requests without a token to proceed without authentication.
+* @param {string} [options.cookie] - If set, the middleware attempts to retrieve the token from a cookie with these options (optionally signed) only if no token is found in the header.
+* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+* @param {AsymmetricAlgorithm[]} options.alg - An array of allowed asymmetric algorithms for JWT verification. Only tokens signed with these algorithms will be accepted.
+* @param {RequestInit} [init] - Optional init options for the `fetch` request when retrieving JWKS from a URI.
+* @param {VerifyOptions} [options.verification] - Additional options for JWK payload verification.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use("/auth/*", jwk({
+*   jwks_uri: (c) => `https://${c.env.authServer}/.well-known/jwks.json`,
+*   headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+* }))
+*
+* app.get('/auth/page', (c) => {
+*   return c.text('You are authorized')
+* })
+* ```
+*/
+const jwk = (options, init) => {
+	const verifyOpts = options.verification || {};
+	if (!options || !(options.keys || options.jwks_uri)) throw new Error("JWK auth middleware requires options for either \"keys\" or \"jwks_uri\" or both");
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWK auth middleware requires it.");
+	return async function jwk(ctx, next) {
+		const headerName = options.headerName || "Authorization";
+		const credentials = ctx.req.raw.headers.get(headerName);
+		let token;
+		if (credentials) {
+			const parts = credentials.split(/\s+/);
+			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+				const errDescription = "invalid credentials structure";
+				throw new HTTPException(401, {
+					message: errDescription,
+					res: unauthorizedResponse({
+						ctx,
+						error: "invalid_request",
+						errDescription,
+						realm: options.realm
+					})
+				});
+			} else token = parts[1];
+		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
+		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
+		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
+		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
+		else token = getCookie(ctx, options.cookie.key);
+		if (!token) {
+			if (options.allow_anon) return next();
+			const errDescription = "no authorization included in request";
+			throw new HTTPException(401, {
+				message: errDescription,
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_request",
+					errDescription,
+					realm: options.realm
+				})
+			});
+		}
+		let payload;
+		let cause;
+		try {
+			const keys = typeof options.keys === "function" ? await options.keys(ctx) : options.keys;
+			const jwks_uri = typeof options.jwks_uri === "function" ? await options.jwks_uri(ctx) : options.jwks_uri;
+			payload = await Jwt.verifyWithJwks(token, {
+				keys,
+				jwks_uri,
+				verification: verifyOpts,
+				allowedAlgorithms: options.alg
+			}, init);
+		} catch (e) {
+			cause = e;
+		}
+		if (!payload) {
+			if (cause instanceof Error && cause.constructor === Error) throw cause;
+			throw new HTTPException(401, {
+				message: "Unauthorized",
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_token",
+					statusText: "Unauthorized",
+					errDescription: "token verification failure",
+					realm: options.realm
+				}),
+				cause
+			});
+		}
+		ctx.set("jwtPayload", payload);
+		await next();
+	};
+};
+function unauthorizedResponse(opts) {
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
+	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	return new Response("Unauthorized", {
+		status: 401,
+		statusText: opts.statusText,
+		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
+	});
+}
+//#endregion
+export { jwk as t };

package/lib/jwk.js

@@ -1,117 +1,2 @@
-import { HTTPException } from "./http-exception.js";
-import { getCookie, getSignedCookie } from "./cookie.js";
-import { t as Jwt } from "./jwt-BGJBw5AF.js";
-//#region ../../plugins/acryl-router/src/core/middleware/jwk/jwk.ts
-/**
-* JWK Auth Middleware for Acryl.
-*
-*
-* @param {object} options - The options for the JWK middleware.
-* @param {AcrylJsonWebKey[] | ((ctx: Context) => Promise<AcrylJsonWebKey[]> | AcrylJsonWebKey[])} [options.keys] - The public keys used for JWK verification, or a function that returns them.
-* @param {string | ((ctx: Context) => Promise<string> | string)} [options.jwks_uri] - If set to a URI string or a function that returns a URI string, attempt to fetch JWKs from it. The response must be a JSON object containing a `keys` array, which will be merged with the `keys` option.
-* @param {boolean} [options.allow_anon] - If set to `true`, the middleware allows requests without a token to proceed without authentication.
-* @param {string} [options.cookie] - If set, the middleware attempts to retrieve the token from a cookie with these options (optionally signed) only if no token is found in the header.
-* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
-* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
-* @param {AsymmetricAlgorithm[]} options.alg - An array of allowed asymmetric algorithms for JWT verification. Only tokens signed with these algorithms will be accepted.
-* @param {RequestInit} [init] - Optional init options for the `fetch` request when retrieving JWKS from a URI.
-* @param {VerifyOptions} [options.verification] - Additional options for JWK payload verification.
-* @returns {MiddlewareHandler} The middleware handler function.
-*
-* @example
-* ```ts
-* const app = new Acryl()
-*
-* app.use("/auth/*", jwk({
-*   jwks_uri: (c) => `https://${c.env.authServer}/.well-known/jwks.json`,
-*   headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
-* }))
-*
-* app.get('/auth/page', (c) => {
-*   return c.text('You are authorized')
-* })
-* ```
-*/
-const jwk = (options, init) => {
-	const verifyOpts = options.verification || {};
-	if (!options || !(options.keys || options.jwks_uri)) throw new Error("JWK auth middleware requires options for either \"keys\" or \"jwks_uri\" or both");
-	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWK auth middleware requires it.");
-	return async function jwk(ctx, next) {
-		const headerName = options.headerName || "Authorization";
-		const credentials = ctx.req.raw.headers.get(headerName);
-		let token;
-		if (credentials) {
-			const parts = credentials.split(/\s+/);
-			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
-				const errDescription = "invalid credentials structure";
-				throw new HTTPException(401, {
-					message: errDescription,
-					res: unauthorizedResponse({
-						ctx,
-						error: "invalid_request",
-						errDescription,
-						realm: options.realm
-					})
-				});
-			} else token = parts[1];
-		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
-		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
-		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
-		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
-		else token = getCookie(ctx, options.cookie.key);
-		if (!token) {
-			if (options.allow_anon) return next();
-			const errDescription = "no authorization included in request";
-			throw new HTTPException(401, {
-				message: errDescription,
-				res: unauthorizedResponse({
-					ctx,
-					error: "invalid_request",
-					errDescription,
-					realm: options.realm
-				})
-			});
-		}
-		let payload;
-		let cause;
-		try {
-			const keys = typeof options.keys === "function" ? await options.keys(ctx) : options.keys;
-			const jwks_uri = typeof options.jwks_uri === "function" ? await options.jwks_uri(ctx) : options.jwks_uri;
-			payload = await Jwt.verifyWithJwks(token, {
-				keys,
-				jwks_uri,
-				verification: verifyOpts,
-				allowedAlgorithms: options.alg
-			}, init);
-		} catch (e) {
-			cause = e;
-		}
-		if (!payload) {
-			if (cause instanceof Error && cause.constructor === Error) throw cause;
-			throw new HTTPException(401, {
-				message: "Unauthorized",
-				res: unauthorizedResponse({
-					ctx,
-					error: "invalid_token",
-					statusText: "Unauthorized",
-					errDescription: "token verification failure",
-					realm: options.realm
-				}),
-				cause
-			});
-		}
-		ctx.set("jwtPayload", payload);
-		await next();
-	};
-};
-function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
-	return new Response("Unauthorized", {
-		status: 401,
-		statusText: opts.statusText,
-		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
-	});
-}
-//#endregion
+import { t as jwk } from "./jwk-LkzeoaU8.js";
 export { jwk };

package/lib/jwt-CskdhEW9.js

@@ -0,0 +1,115 @@
+import { HTTPException } from "./http-exception.js";
+import { getCookie, getSignedCookie } from "./cookie.js";
+import { t as Jwt } from "./jwt-BGJBw5AF.js";
+//#region ../../plugins/acryl-router/src/core/middleware/jwt/jwt.ts
+/**
+* JWT Auth Middleware for Acryl.
+*
+*
+* @param {object} options - The options for the JWT middleware.
+* @param {SignatureKey} options.secret - A value of your secret key.
+* @param {string} [options.cookie] - If this value is set, then the value is retrieved from the cookie header using that value as a key, which is then validated as a token.
+* @param {SignatureAlgorithm} options.alg - An algorithm type that is used for verifying (required). Available types are `HS256` | `HS384` | `HS512` | `RS256` | `RS384` | `RS512` | `PS256` | `PS384` | `PS512` | `ES256` | `ES384` | `ES512` | `EdDSA`.
+* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+* @param {VerifyOptions} [options.verification] - Additional options for JWT payload verification.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use(
+*   '/auth/*',
+*   jwt({
+*     secret: process.env.JWT_SECRET, // never a literal in source
+*     alg: 'HS256',
+*     headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+*   })
+* )
+*
+* app.get('/auth/page', (c) => {
+*   return c.text('You are authorized')
+* })
+* ```
+*/
+const jwt = (options) => {
+	const verifyOpts = options.verification || {};
+	if (!options || !options.secret) throw new Error("JWT auth middleware requires options for \"secret\"");
+	if (!options.alg) throw new Error("JWT auth middleware requires options for \"alg\"");
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	return async function jwt(ctx, next) {
+		const headerName = options.headerName || "Authorization";
+		const credentials = ctx.req.raw.headers.get(headerName);
+		let token;
+		if (credentials) {
+			const parts = credentials.split(/\s+/);
+			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+				const errDescription = "invalid credentials structure";
+				throw new HTTPException(401, {
+					message: errDescription,
+					res: unauthorizedResponse({
+						ctx,
+						error: "invalid_request",
+						errDescription,
+						realm: options.realm
+					})
+				});
+			} else token = parts[1];
+		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
+		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
+		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
+		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
+		else token = getCookie(ctx, options.cookie.key);
+		if (!token) {
+			const errDescription = "no authorization included in request";
+			throw new HTTPException(401, {
+				message: errDescription,
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_request",
+					errDescription,
+					realm: options.realm
+				})
+			});
+		}
+		let payload;
+		let cause;
+		try {
+			payload = await Jwt.verify(token, options.secret, {
+				alg: options.alg,
+				...verifyOpts
+			});
+		} catch (e) {
+			cause = e;
+		}
+		if (!payload) throw new HTTPException(401, {
+			message: "Unauthorized",
+			res: unauthorizedResponse({
+				ctx,
+				error: "invalid_token",
+				statusText: "Unauthorized",
+				errDescription: "token verification failure",
+				realm: options.realm
+			}),
+			cause
+		});
+		ctx.set("jwtPayload", payload);
+		await next();
+	};
+};
+function unauthorizedResponse(opts) {
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
+	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	return new Response("Unauthorized", {
+		status: 401,
+		statusText: opts.statusText,
+		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
+	});
+}
+const verifyWithJwks = Jwt.verifyWithJwks;
+const verify = Jwt.verify;
+const decode = Jwt.decode;
+const sign = Jwt.sign;
+//#endregion
+export { verifyWithJwks as a, verify as i, jwt as n, sign as r, decode as t };

package/lib/jwt.js

@@ -1,115 +1,3 @@
-import { HTTPException } from "./http-exception.js";
-import { getCookie, getSignedCookie } from "./cookie.js";
-import { n as AlgorithmTypes, t as Jwt } from "./jwt-BGJBw5AF.js";
-//#region ../../plugins/acryl-router/src/core/middleware/jwt/jwt.ts
-/**
-* JWT Auth Middleware for Acryl.
-*
-*
-* @param {object} options - The options for the JWT middleware.
-* @param {SignatureKey} options.secret - A value of your secret key.
-* @param {string} [options.cookie] - If this value is set, then the value is retrieved from the cookie header using that value as a key, which is then validated as a token.
-* @param {SignatureAlgorithm} options.alg - An algorithm type that is used for verifying (required). Available types are `HS256` | `HS384` | `HS512` | `RS256` | `RS384` | `RS512` | `PS256` | `PS384` | `PS512` | `ES256` | `ES384` | `ES512` | `EdDSA`.
-* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
-* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
-* @param {VerifyOptions} [options.verification] - Additional options for JWT payload verification.
-* @returns {MiddlewareHandler} The middleware handler function.
-*
-* @example
-* ```ts
-* const app = new Acryl()
-*
-* app.use(
-*   '/auth/*',
-*   jwt({
-*     secret: process.env.JWT_SECRET, // never a literal in source
-*     alg: 'HS256',
-*     headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
-*   })
-* )
-*
-* app.get('/auth/page', (c) => {
-*   return c.text('You are authorized')
-* })
-* ```
-*/
-const jwt = (options) => {
-	const verifyOpts = options.verification || {};
-	if (!options || !options.secret) throw new Error("JWT auth middleware requires options for \"secret\"");
-	if (!options.alg) throw new Error("JWT auth middleware requires options for \"alg\"");
-	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
-	return async function jwt(ctx, next) {
-		const headerName = options.headerName || "Authorization";
-		const credentials = ctx.req.raw.headers.get(headerName);
-		let token;
-		if (credentials) {
-			const parts = credentials.split(/\s+/);
-			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
-				const errDescription = "invalid credentials structure";
-				throw new HTTPException(401, {
-					message: errDescription,
-					res: unauthorizedResponse({
-						ctx,
-						error: "invalid_request",
-						errDescription,
-						realm: options.realm
-					})
-				});
-			} else token = parts[1];
-		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
-		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
-		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
-		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
-		else token = getCookie(ctx, options.cookie.key);
-		if (!token) {
-			const errDescription = "no authorization included in request";
-			throw new HTTPException(401, {
-				message: errDescription,
-				res: unauthorizedResponse({
-					ctx,
-					error: "invalid_request",
-					errDescription,
-					realm: options.realm
-				})
-			});
-		}
-		let payload;
-		let cause;
-		try {
-			payload = await Jwt.verify(token, options.secret, {
-				alg: options.alg,
-				...verifyOpts
-			});
-		} catch (e) {
-			cause = e;
-		}
-		if (!payload) throw new HTTPException(401, {
-			message: "Unauthorized",
-			res: unauthorizedResponse({
-				ctx,
-				error: "invalid_token",
-				statusText: "Unauthorized",
-				errDescription: "token verification failure",
-				realm: options.realm
-			}),
-			cause
-		});
-		ctx.set("jwtPayload", payload);
-		await next();
-	};
-};
-function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
-	return new Response("Unauthorized", {
-		status: 401,
-		statusText: opts.statusText,
-		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
-	});
-}
-const verifyWithJwks = Jwt.verifyWithJwks;
-const verify = Jwt.verify;
-const decode = Jwt.decode;
-const sign = Jwt.sign;
-//#endregion
+import { n as AlgorithmTypes } from "./jwt-BGJBw5AF.js";
+import { a as verifyWithJwks, i as verify, n as jwt, r as sign, t as decode } from "./jwt-CskdhEW9.js";
 export { AlgorithmTypes, decode, jwt, sign, verify, verifyWithJwks };

package/lib/kv/conformance.d.ts

@@ -0,0 +1,13 @@
+import { n as Kv } from "../kv-9f-AlRKN.js";
+
+//#region ../../plugins/acryl-kv/src/conformance.d.ts
+/** A fresh, empty store from the provider under test. */
+interface KvUnderTest {
+  readonly kv: Kv;
+  close(): Promise<void>;
+  /** Close this store (if it is still open) and open the same storage again, to prove what was written is durable. */
+  reopen(): Promise<KvUnderTest>;
+}
+declare function describeKvConformance(provider: string, open: () => Promise<KvUnderTest>): void;
+//#endregion
+export { KvUnderTest, describeKvConformance };