acrylblends 1.0.3 → 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (256) hide show
  1. package/docs/framework/agents/index.md +6 -4
  2. package/docs/framework/workshop/README.md +3 -3
  3. package/docs/framework/workshop/facilitator.md +1 -0
  4. package/lib/accept-CNNHu4Cf.js +193 -0
  5. package/lib/{accepts-XBuZPVRI.js → accepts-Btq83xPd.js} +1 -1
  6. package/lib/accepts.js +1 -1
  7. package/lib/acryl-base.js +1 -331
  8. package/lib/adapter-CaZ6FZUU.js +37 -0
  9. package/lib/adapter.js +1 -36
  10. package/lib/{app-BM0rTCp7.js → app-CQcGWjrk.js} +4 -4
  11. package/lib/app-base-CpRMZL4v.js +332 -0
  12. package/lib/{audit-BXnYsLge.d.ts → audit-D5z9uwOP.d.ts} +14 -1
  13. package/lib/{base-NSN_SNv-.js → base-D_6kfOr-.js} +1 -1
  14. package/lib/basic-auth-C0HTRpXh.js +20 -0
  15. package/lib/basic-auth-DFLflXNe.js +95 -0
  16. package/lib/basic-auth.js +1 -94
  17. package/lib/bearer-auth-Cwxt-vgS.js +94 -0
  18. package/lib/bearer-auth.js +1 -93
  19. package/lib/body-D7f4e7w_.js +94 -0
  20. package/lib/body-limit-WmIjWRLt.js +66 -0
  21. package/lib/body-limit.js +1 -65
  22. package/lib/buffer-CkEOJCcY.js +51 -0
  23. package/lib/bun.js +3 -3
  24. package/lib/cache-B0bHH7s5.js +169 -0
  25. package/lib/cache.js +1 -168
  26. package/lib/{client-DDLXwhBo.js → client-BrMFnMEd.js} +1 -1
  27. package/lib/{client-modules-CLvWOjbd.js → client-modules-drj4mjhj.js} +4 -4
  28. package/lib/client.js +1 -1
  29. package/lib/color-COa3DplO.js +37 -0
  30. package/lib/combine-TWuGdcbC.js +137 -0
  31. package/lib/combine.js +1 -136
  32. package/lib/{components-cEW3ovK0.js → components-B2ka9Ax1.js} +4 -4
  33. package/lib/{components-JXVm45kK.js → components-PVXwaOaC.js} +2 -2
  34. package/lib/compress-BzWqsHF1.js +79 -0
  35. package/lib/compress-C-9vK4B2.d.ts +11 -0
  36. package/lib/compress-DCyrrQ5D.js +11 -0
  37. package/lib/compress.d.ts +1 -1
  38. package/lib/compress.js +2 -78
  39. package/lib/concurrent-DrF3d2c-.js +30 -0
  40. package/lib/conninfo-BCROmdnf.d.ts +11 -0
  41. package/lib/conninfo-CWJwieh4.js +19 -0
  42. package/lib/constants-CBSEudrb.js +7 -0
  43. package/lib/{context-DDO0cfuP.js → context-CkOh7Ygv.js} +2 -2
  44. package/lib/context-storage-iuPoI_CR.js +52 -0
  45. package/lib/context-storage.js +1 -51
  46. package/lib/cookie-B1LlkzOe.js +125 -0
  47. package/lib/cookie-BHIduy2T.js +82 -0
  48. package/lib/cookie.js +1 -81
  49. package/lib/cordis/db-sqlite.d.ts +1 -1
  50. package/lib/cordis/door.d.ts +17 -3
  51. package/lib/cordis/door.js +123 -16
  52. package/lib/cordis/inspect.js +4 -4
  53. package/lib/cordis/kv-db.d.ts +1 -1
  54. package/lib/cordis/kv-db.js +1 -1
  55. package/lib/cordis/kv-json.d.ts +1 -1
  56. package/lib/cordis/kv-json.js +1 -1
  57. package/lib/cordis/node-server.d.ts +1 -1
  58. package/lib/cordis/node-server.js +3 -116
  59. package/lib/cordis/router-http.d.ts +1 -1
  60. package/lib/cordis/router-http.js +2 -2
  61. package/lib/cordis/router.d.ts +1 -1
  62. package/lib/cordis/router.js +4 -4
  63. package/lib/cordis/state.js +7 -7
  64. package/lib/{core-CaY8XDZ6.js → core-BOu1jYua.js} +1 -1
  65. package/lib/cors-CbAQ-8qU.js +106 -0
  66. package/lib/cors.js +1 -105
  67. package/lib/crypto-iVP-N-tS.js +34 -0
  68. package/lib/csrf-DqqOZtgy.js +101 -0
  69. package/lib/csrf.js +1 -100
  70. package/lib/css-C5CPVMvM.js +134 -0
  71. package/lib/css.js +2 -133
  72. package/lib/db/sqlite.d.ts +1 -25
  73. package/lib/dev-CLgu-JRe.js +50 -0
  74. package/lib/dev.js +1 -49
  75. package/lib/dom-YjND9Jt3.js +74 -0
  76. package/lib/door/host.d.ts +2 -2
  77. package/lib/door/host.js +1 -1
  78. package/lib/door/page.d.ts +12 -1
  79. package/lib/door/page.js +22 -1
  80. package/lib/door/protocol.d.ts +2 -2
  81. package/lib/door/protocol.js +2 -197
  82. package/lib/encode-BhbNLrjp.js +33 -0
  83. package/lib/factory-CLdSf-xS.js +30 -0
  84. package/lib/factory.js +1 -29
  85. package/lib/handler-C0wZ0KwO.js +12 -0
  86. package/lib/helpers-BEjcdbgw.js +5 -0
  87. package/lib/{hooks-w72iLeFR.js → hooks-CfC07ri0.js} +1 -1
  88. package/lib/html-CgNa89xw.js +31 -0
  89. package/lib/html-DGExBFNg.js +103 -0
  90. package/lib/html.d.ts +2 -5
  91. package/lib/html.js +2 -30
  92. package/lib/http-exception-MjWkT89V.js +54 -0
  93. package/lib/http-exception.js +1 -53
  94. package/lib/{index-D4nVR3wu.d.ts → index-DMOtA-NJ.d.ts} +7 -1
  95. package/lib/index-dAzQsJG9.d.ts +6 -0
  96. package/lib/index.js +3 -3
  97. package/lib/ip-restriction-jKtKCRM_.js +166 -0
  98. package/lib/ip-restriction.js +1 -165
  99. package/lib/ipaddr-DCoIo528.js +238 -0
  100. package/lib/jsx/dom/client.js +1 -1
  101. package/lib/jsx/dom/jsx-dev-runtime.js +1 -1
  102. package/lib/jsx/dom/jsx-runtime.js +2 -1
  103. package/lib/jsx/dom/server.js +3 -3
  104. package/lib/jsx/dom.js +5 -73
  105. package/lib/jsx/jsx-dev-runtime.d.ts +2 -5
  106. package/lib/jsx/jsx-dev-runtime.js +2 -13
  107. package/lib/jsx/jsx-runtime.d.ts +2 -2
  108. package/lib/jsx/jsx-runtime.js +4 -4
  109. package/lib/jsx/streaming.js +1 -1
  110. package/lib/jsx-CUQgttxU.js +47 -0
  111. package/lib/jsx-dev-runtime-B4WTyq8r.js +14 -0
  112. package/lib/{jsx-dev-runtime-CWLRA2F3.js → jsx-dev-runtime-BLfA-EhI.js} +2 -2
  113. package/lib/jsx-dev-runtime-CGt4kNYr.d.ts +6 -0
  114. package/lib/jsx-renderer-CfifM4hT.js +99 -0
  115. package/lib/jsx-renderer.js +1 -98
  116. package/lib/jsx-runtime-COCRWBJ9.js +2 -0
  117. package/lib/jsx.js +5 -46
  118. package/lib/{jwk-LkzeoaU8.js → jwk-CDPpYQpD.js} +3 -3
  119. package/lib/jwk.js +1 -1
  120. package/lib/{jwt-BGJBw5AF.js → jwt-BXoIA2fQ.js} +2 -2
  121. package/lib/{jwt-CskdhEW9.js → jwt-lyS4Q3mT.js} +3 -3
  122. package/lib/jwt.js +2 -2
  123. package/lib/kv/db.d.ts +1 -10
  124. package/lib/kv/db.js +1 -56
  125. package/lib/kv/json.d.ts +1 -9
  126. package/lib/kv/json.js +1 -223
  127. package/lib/{language-D9a4zqvn.js → language-DeGRtLJt.js} +2 -2
  128. package/lib/language.js +1 -1
  129. package/lib/{linear-router-C3FPib6h.js → linear-router-CmZn_JLV.js} +2 -2
  130. package/lib/logger-Ckxu8diz.js +54 -0
  131. package/lib/logger.js +1 -53
  132. package/lib/loopback-only-BbasoF7R.js +90 -0
  133. package/lib/loopback-only.js +1 -89
  134. package/lib/method-not-allowed-TO2_hnfl.js +82 -0
  135. package/lib/method-not-allowed.js +1 -81
  136. package/lib/method-override-DnZKfJbV.js +103 -0
  137. package/lib/method-override.js +1 -102
  138. package/lib/middleware-BfG_fp8P.js +12 -0
  139. package/lib/mime-BnScXkQn.js +77 -0
  140. package/lib/mount-QkK_3NtJ.js +67 -0
  141. package/lib/mount.js +1 -66
  142. package/lib/node-server/conninfo.d.ts +1 -10
  143. package/lib/node-server/conninfo.js +1 -18
  144. package/lib/node-server/register.js +25 -2
  145. package/lib/node-server/serve-static.d.ts +1 -17
  146. package/lib/node-server/serve-static.js +1 -1
  147. package/lib/node-server.d.ts +2 -2
  148. package/lib/node-server.js +4 -4
  149. package/lib/open-BqK4D2Wn.d.ts +11 -0
  150. package/lib/open-But9E2rL.js +57 -0
  151. package/lib/open-CULVJgOc.d.ts +12 -0
  152. package/lib/open-Dp4sxspc.js +224 -0
  153. package/lib/open-T7kgbO2O.d.ts +27 -0
  154. package/lib/{pattern-router-HZxjDGEQ.js → pattern-router-CJBecJBd.js} +1 -1
  155. package/lib/powered-by-CXQNjNIX.js +24 -0
  156. package/lib/powered-by.js +1 -23
  157. package/lib/pretty-json-CeC1yvYt.js +39 -0
  158. package/lib/pretty-json.js +1 -38
  159. package/lib/{protocol-BizVt4J6.d.ts → protocol-C37gPePD.d.ts} +9 -2
  160. package/lib/protocol-Dt0AZBOz.js +213 -0
  161. package/lib/proxy-C2w_mH7k.js +121 -0
  162. package/lib/proxy.js +1 -120
  163. package/lib/quick.js +4 -4
  164. package/lib/{reg-exp-router-DC1R3qoY.js → reg-exp-router-C_WV84eV.js} +2 -2
  165. package/lib/request-DvMgGtlW.js +323 -0
  166. package/lib/request.js +1 -322
  167. package/lib/route-D8m-a2I1.js +126 -0
  168. package/lib/route.js +1 -125
  169. package/lib/router/linear-router.js +1 -1
  170. package/lib/router/pattern-router.js +1 -1
  171. package/lib/router/reg-exp-router.js +1 -1
  172. package/lib/router/smart-router.js +1 -1
  173. package/lib/router/trie-router.js +1 -1
  174. package/lib/router-Be_o6nFu.js +35 -0
  175. package/lib/router.js +1 -34
  176. package/lib/schema-validator-EK3cUUCt.js +22 -0
  177. package/lib/schema-validator.js +1 -21
  178. package/lib/{secure-headers-mP3j6Hm6.js → secure-headers-C5ZOcXqk.js} +1 -1
  179. package/lib/secure-headers.js +1 -1
  180. package/lib/serve-static-B7sqnftW.d.ts +18 -0
  181. package/lib/{serve-static-3uo_9rjF.js → serve-static-C1Nkj_xB.js} +2 -2
  182. package/lib/{serve-static-Cp5adzGo.js → serve-static-EiJf1zkO.js} +4 -4
  183. package/lib/serve-static.js +1 -1
  184. package/lib/{smart-router-C5CZ5XSM.js → smart-router-BjxkDQCE.js} +1 -1
  185. package/lib/{snapshot-text-DmE0YfeZ.js → snapshot-text-Bbx43mN0.js} +57 -9
  186. package/lib/{src-2Z4mJg0x.js → src-BTBm4OPD.js} +22 -6
  187. package/lib/src-LX0E4ec4.js +117 -0
  188. package/lib/{ssg-BwjcA-Ge.js → ssg-BEl7MHqg.js} +5 -5
  189. package/lib/ssg.js +1 -1
  190. package/lib/stream-CzM_SHkq.js +88 -0
  191. package/lib/{streaming-DHST3Scg.js → streaming-BlDaph8U.js} +3 -3
  192. package/lib/streaming.js +1 -1
  193. package/lib/{test-websocket-D8WWqE5G.js → test-websocket-BLeEvybj.js} +2 -2
  194. package/lib/testing-BQx5T_UX.js +17 -0
  195. package/lib/testing.js +1 -16
  196. package/lib/timeout-FeqZ9A-0.js +42 -0
  197. package/lib/timeout.js +1 -41
  198. package/lib/tiny.js +2 -2
  199. package/lib/trailing-slash-DwTx-1sk.js +85 -0
  200. package/lib/trailing-slash.js +1 -84
  201. package/lib/{trie-router-CfFbapzL.js → trie-router-JydLKUa2.js} +2 -2
  202. package/lib/url-BPh4d6j-.js +197 -0
  203. package/lib/utils/accept.js +1 -192
  204. package/lib/utils/basic-auth.js +1 -19
  205. package/lib/utils/body.js +1 -93
  206. package/lib/utils/buffer.js +1 -50
  207. package/lib/utils/color.js +1 -36
  208. package/lib/utils/compress.d.ts +1 -10
  209. package/lib/utils/compress.js +1 -10
  210. package/lib/utils/concurrent.js +1 -29
  211. package/lib/utils/constants.js +1 -6
  212. package/lib/utils/cookie.js +1 -124
  213. package/lib/utils/crypto.js +1 -33
  214. package/lib/utils/encode.js +1 -32
  215. package/lib/utils/handler.js +1 -11
  216. package/lib/utils/html.js +1 -102
  217. package/lib/utils/ipaddr.js +1 -237
  218. package/lib/utils/jwt.js +1 -1
  219. package/lib/utils/mime.js +1 -76
  220. package/lib/utils/stream.js +1 -87
  221. package/lib/utils/url.js +1 -196
  222. package/lib/{validator-D84mq-dO.js → validator-Btiyt5VJ.js} +3 -3
  223. package/lib/validator.js +1 -1
  224. package/lib/websocket-DsyBIKVA.js +56 -0
  225. package/lib/ws.js +1 -55
  226. package/package.json +1 -1
  227. package/plugins/acryl-door/src/cli/acryl.ts +5 -3
  228. package/plugins/acryl-door/src/host/channel.ts +36 -0
  229. package/plugins/acryl-door/src/host/chat-tools.ts +2 -0
  230. package/plugins/acryl-door/src/host/door.ts +44 -5
  231. package/plugins/acryl-door/src/host/shim.ts +23 -0
  232. package/plugins/acryl-door/src/host/verbs.ts +4 -3
  233. package/plugins/acryl-door/src/index.ts +39 -3
  234. package/plugins/acryl-door/src/page/driver/driver.ts +22 -1
  235. package/plugins/acryl-door/src/page/protocol.ts +13 -2
  236. package/plugins/acryl-node-server/src/register.ts +29 -2
  237. package/plugins/acryl-router/src/service.ts +19 -1
  238. package/plugins/agent/model.ts +6 -1
  239. package/plugins/agent/tools.ts +12 -2
  240. package/plugins/agent-panel/client/describe.ts +44 -0
  241. package/plugins/agent-panel/client/main.ts +67 -35
  242. package/plugins/agent-panel/index.ts +137 -35
  243. package/plugins/desktop/attach.ts +72 -0
  244. package/plugins/desktop/main.ts +17 -4
  245. package/plugins/extensions/index.ts +3 -4
  246. package/plugins/extensions/stage.ts +33 -5
  247. package/plugins/openai/index.ts +1 -1
  248. package/shared/DEFAULTS.md +4 -0
  249. package/templates/agent/AGENTS.md +2 -0
  250. package/templates/agent/blend.yaml +4 -1
  251. package/templates/agent/src/app.ts +2 -0
  252. package/templates/agent/src/routes.ts +1 -1
  253. package/templates/agent/template.json +1 -0
  254. package/templates/agent/test/builder.test.ts +26 -21
  255. package/lib/helpers-CvTauQT5.js +0 -5
  256. package/lib/middleware-CPQ8himN.js +0 -12
@@ -0,0 +1,90 @@
1
+ import { t as connectionOf } from "./connection-C7xgP1hP.js";
2
+ import { BlockList, isIP } from "node:net";
3
+ //#region ../../plugins/acryl-router/src/middleware/loopback-only.ts
4
+ const loopback = new BlockList();
5
+ loopback.addSubnet("127.0.0.0", 8, "ipv4");
6
+ loopback.addSubnet("::1", 128, "ipv6");
7
+ const SAFE_METHODS = /* @__PURE__ */ new Set([
8
+ "GET",
9
+ "HEAD",
10
+ "OPTIONS"
11
+ ]);
12
+ /**
13
+ * The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
14
+ * real local port, names another host, or is marked cross-site by the browser. The peer and the port come from the transport (`connectionOf(c)`), never
15
+ * from a header; an in-process call has neither and is refused.
16
+ */
17
+ const LOOPBACK_HOSTNAMES = [
18
+ "127.0.0.1",
19
+ "localhost",
20
+ "[::1]"
21
+ ];
22
+ function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
23
+ const { remoteAddress, localPort } = connectionOf(c);
24
+ const host = c.req.header("host");
25
+ if (remoteAddress === void 0 || localPort === void 0 || host === void 0) return void 0;
26
+ const address = (remoteAddress.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
27
+ const family = isIP(address);
28
+ if (family === 0 || !loopback.check(address, family === 4 ? "ipv4" : "ipv6")) return void 0;
29
+ let authority;
30
+ try {
31
+ authority = new URL(`http://${host}`);
32
+ } catch {
33
+ return;
34
+ }
35
+ if (authority.protocol !== "http:" || Number(authority.port || "80") !== localPort || !hostnames.includes(authority.hostname) || c.req.header("sec-fetch-site") === "cross-site") return void 0;
36
+ return authority;
37
+ }
38
+ /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
39
+ function sameOrigin(c, authority) {
40
+ const origin = c.req.header("origin");
41
+ if (origin === void 0) return true;
42
+ try {
43
+ const parsed = new URL(origin);
44
+ return parsed.protocol === "http:" && parsed.host === authority.host && parsed.pathname === "/";
45
+ } catch {
46
+ return false;
47
+ }
48
+ }
49
+ function originOf(value) {
50
+ if (value === void 0) return void 0;
51
+ try {
52
+ return new URL(value).origin;
53
+ } catch {
54
+ return;
55
+ }
56
+ }
57
+ /** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
58
+ function fromOwnPage(c, authority) {
59
+ const origin = c.req.header("origin");
60
+ const fetchSite = c.req.header("sec-fetch-site");
61
+ if (origin !== void 0 && originOf(origin) === origin && origin === authority.origin) return fetchSite === void 0 || fetchSite === "same-origin";
62
+ return SAFE_METHODS.has(c.req.method) && fetchSite === "same-origin" && originOf(c.req.header("referer")) === authority.origin;
63
+ }
64
+ /**
65
+ * Only requests from this machine to this app: loopback peer, the real port, an allowed `Host`, and for mutations a matching `Origin` (with
66
+ * `callers: 'own-page'`, every request from this app's own page). Everything else gets a 403.
67
+ */
68
+ function loopbackOnly(options = {}) {
69
+ const mutations = options.mutations ?? "same-origin";
70
+ const inProcess = options.inProcess ?? "deny";
71
+ const ownPage = options.callers === "own-page";
72
+ return async (c, next) => {
73
+ const connection = connectionOf(c);
74
+ if (inProcess === "allow" && connection.remoteAddress === void 0 && connection.localPort === void 0) {
75
+ await next();
76
+ return;
77
+ }
78
+ const authority = loopbackAuthority(c, options.hostnames);
79
+ if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
80
+ if (ownPage) {
81
+ if (!fromOwnPage(c, authority)) return c.json({ error: "only this app's own page may call this" }, 403);
82
+ await next();
83
+ return;
84
+ }
85
+ if (mutations === "same-origin" && !SAFE_METHODS.has(c.req.method) && !sameOrigin(c, authority)) return c.json({ error: "a change must come from this app's own origin" }, 403);
86
+ await next();
87
+ };
88
+ }
89
+ //#endregion
90
+ export { sameOrigin as a, loopbackOnly as i, fromOwnPage as n, loopbackAuthority as r, LOOPBACK_HOSTNAMES as t };
@@ -1,90 +1,2 @@
1
- import { t as connectionOf } from "./connection-C7xgP1hP.js";
2
- import { BlockList, isIP } from "node:net";
3
- //#region ../../plugins/acryl-router/src/middleware/loopback-only.ts
4
- const loopback = new BlockList();
5
- loopback.addSubnet("127.0.0.0", 8, "ipv4");
6
- loopback.addSubnet("::1", 128, "ipv6");
7
- const SAFE_METHODS = /* @__PURE__ */ new Set([
8
- "GET",
9
- "HEAD",
10
- "OPTIONS"
11
- ]);
12
- /**
13
- * The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
14
- * real local port, names another host, or is marked cross-site by the browser. The peer and the port come from the transport (`connectionOf(c)`), never
15
- * from a header; an in-process call has neither and is refused.
16
- */
17
- const LOOPBACK_HOSTNAMES = [
18
- "127.0.0.1",
19
- "localhost",
20
- "[::1]"
21
- ];
22
- function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
23
- const { remoteAddress, localPort } = connectionOf(c);
24
- const host = c.req.header("host");
25
- if (remoteAddress === void 0 || localPort === void 0 || host === void 0) return void 0;
26
- const address = (remoteAddress.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
27
- const family = isIP(address);
28
- if (family === 0 || !loopback.check(address, family === 4 ? "ipv4" : "ipv6")) return void 0;
29
- let authority;
30
- try {
31
- authority = new URL(`http://${host}`);
32
- } catch {
33
- return;
34
- }
35
- if (authority.protocol !== "http:" || Number(authority.port || "80") !== localPort || !hostnames.includes(authority.hostname) || c.req.header("sec-fetch-site") === "cross-site") return void 0;
36
- return authority;
37
- }
38
- /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
39
- function sameOrigin(c, authority) {
40
- const origin = c.req.header("origin");
41
- if (origin === void 0) return true;
42
- try {
43
- const parsed = new URL(origin);
44
- return parsed.protocol === "http:" && parsed.host === authority.host && parsed.pathname === "/";
45
- } catch {
46
- return false;
47
- }
48
- }
49
- function originOf(value) {
50
- if (value === void 0) return void 0;
51
- try {
52
- return new URL(value).origin;
53
- } catch {
54
- return;
55
- }
56
- }
57
- /** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
58
- function fromOwnPage(c, authority) {
59
- const origin = c.req.header("origin");
60
- const fetchSite = c.req.header("sec-fetch-site");
61
- if (origin !== void 0 && originOf(origin) === origin && origin === authority.origin) return fetchSite === void 0 || fetchSite === "same-origin";
62
- return SAFE_METHODS.has(c.req.method) && fetchSite === "same-origin" && originOf(c.req.header("referer")) === authority.origin;
63
- }
64
- /**
65
- * Only requests from this machine to this app: loopback peer, the real port, an allowed `Host`, and for mutations a matching `Origin` (with
66
- * `callers: 'own-page'`, every request from this app's own page). Everything else gets a 403.
67
- */
68
- function loopbackOnly(options = {}) {
69
- const mutations = options.mutations ?? "same-origin";
70
- const inProcess = options.inProcess ?? "deny";
71
- const ownPage = options.callers === "own-page";
72
- return async (c, next) => {
73
- const connection = connectionOf(c);
74
- if (inProcess === "allow" && connection.remoteAddress === void 0 && connection.localPort === void 0) {
75
- await next();
76
- return;
77
- }
78
- const authority = loopbackAuthority(c, options.hostnames);
79
- if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
80
- if (ownPage) {
81
- if (!fromOwnPage(c, authority)) return c.json({ error: "only this app's own page may call this" }, 403);
82
- await next();
83
- return;
84
- }
85
- if (mutations === "same-origin" && !SAFE_METHODS.has(c.req.method) && !sameOrigin(c, authority)) return c.json({ error: "a change must come from this app's own origin" }, 403);
86
- await next();
87
- };
88
- }
89
- //#endregion
1
+ import { a as sameOrigin, i as loopbackOnly, n as fromOwnPage, r as loopbackAuthority, t as LOOPBACK_HOSTNAMES } from "./loopback-only-BbasoF7R.js";
90
2
  export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };
@@ -0,0 +1,82 @@
1
+ import "./router-Be_o6nFu.js";
2
+ import { t as TrieRouter } from "./trie-router-JydLKUa2.js";
3
+ import { r as matchedRoutes, t as basePath } from "./route-D8m-a2I1.js";
4
+ //#region ../../plugins/acryl-router/src/core/middleware/method-not-allowed/index.ts
5
+ /**
6
+ * Method Not Allowed Middleware for Acryl.
7
+ *
8
+ * Returns a `405 Method Not Allowed` response with an `Allow` header when the request path
9
+ * matches a registered route but the request method is not supported.
10
+ *
11
+ * @param {MethodNotAllowedOptions} options - The options for the middleware.
12
+ * @param {Acryl} options.app - The Acryl instance used by the application.
13
+ * @param {MethodNotAllowedHandler} [options.onMethodNotAllowed] - Generates the response, including its `Allow` header.
14
+ * @returns {MiddlewareHandler} The middleware handler function.
15
+ *
16
+ * @example
17
+ * ```ts
18
+ * const app = new Acryl()
19
+ *
20
+ * app.use(methodNotAllowed({ app }))
21
+ *
22
+ * app.get('/hello', (c) => c.text('Hello!'))
23
+ * app.post('/hello', (c) => c.text('Posted!'))
24
+ *
25
+ * // PUT /hello -> 405 Method Not Allowed
26
+ * // Allow: GET, HEAD, POST
27
+ * ```
28
+ *
29
+ * @example
30
+ * ```ts
31
+ * app.use(
32
+ * methodNotAllowed({
33
+ * app,
34
+ * onMethodNotAllowed: (c, methods) =>
35
+ * c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
36
+ * })
37
+ * )
38
+ * ```
39
+ */
40
+ const methodNotAllowed = (options) => {
41
+ let methodRouter;
42
+ return async function methodNotAllowed(c, next) {
43
+ const routeIndex = c.req.routeIndex;
44
+ await next();
45
+ if (c.res.status !== 404) return;
46
+ if (c.error) return;
47
+ if (!methodRouter) {
48
+ const methodsByPath = /* @__PURE__ */ new Map();
49
+ for (const route of options.app.routes) {
50
+ if (route.method === "ALL" || route.method === "HEAD") continue;
51
+ const methods = methodsByPath.get(route.path) ?? /* @__PURE__ */ new Set();
52
+ methods.add(route.method);
53
+ if (route.method === "GET") methods.add("HEAD");
54
+ methodsByPath.set(route.path, methods);
55
+ }
56
+ methodRouter = new TrieRouter();
57
+ for (const [path, methods] of methodsByPath) methodRouter.add("ALL", path, [...methods]);
58
+ }
59
+ let requestPath = c.req.path;
60
+ const currentRoute = matchedRoutes(c)[routeIndex];
61
+ const sourceRoute = options.app.routes.find((route) => route.handler === methodNotAllowed);
62
+ if (currentRoute && sourceRoute) {
63
+ const currentBasePathParts = basePath(c, routeIndex).split("/").filter(Boolean);
64
+ const sourceBasePathLength = sourceRoute.basePath.split("/").filter(Boolean).length;
65
+ const mountBasePathParts = currentBasePathParts.slice(0, currentBasePathParts.length - sourceBasePathLength);
66
+ if (mountBasePathParts.length > 0) {
67
+ const mountBasePath = `/${mountBasePathParts.join("/")}`;
68
+ requestPath = c.req.path.slice(mountBasePath.length) || "/";
69
+ }
70
+ }
71
+ const allowedMethods = /* @__PURE__ */ new Set();
72
+ for (const [methods] of methodRouter.match("ALL", requestPath)[0]) for (const method of methods) allowedMethods.add(method);
73
+ if (allowedMethods.size === 0 || allowedMethods.has(c.req.method)) return;
74
+ c.res.headers.delete("Allow");
75
+ c.res.headers.delete("Content-Length");
76
+ const methods = [...allowedMethods];
77
+ const allow = methods.join(", ");
78
+ c.res = options.onMethodNotAllowed ? await options.onMethodNotAllowed(c, methods) : c.text("Method Not Allowed", 405, { Allow: allow });
79
+ };
80
+ };
81
+ //#endregion
82
+ export { methodNotAllowed as t };
@@ -1,82 +1,2 @@
1
- import "./router.js";
2
- import { t as TrieRouter } from "./trie-router-CfFbapzL.js";
3
- import { basePath, matchedRoutes } from "./route.js";
4
- //#region ../../plugins/acryl-router/src/core/middleware/method-not-allowed/index.ts
5
- /**
6
- * Method Not Allowed Middleware for Acryl.
7
- *
8
- * Returns a `405 Method Not Allowed` response with an `Allow` header when the request path
9
- * matches a registered route but the request method is not supported.
10
- *
11
- * @param {MethodNotAllowedOptions} options - The options for the middleware.
12
- * @param {Acryl} options.app - The Acryl instance used by the application.
13
- * @param {MethodNotAllowedHandler} [options.onMethodNotAllowed] - Generates the response, including its `Allow` header.
14
- * @returns {MiddlewareHandler} The middleware handler function.
15
- *
16
- * @example
17
- * ```ts
18
- * const app = new Acryl()
19
- *
20
- * app.use(methodNotAllowed({ app }))
21
- *
22
- * app.get('/hello', (c) => c.text('Hello!'))
23
- * app.post('/hello', (c) => c.text('Posted!'))
24
- *
25
- * // PUT /hello -> 405 Method Not Allowed
26
- * // Allow: GET, HEAD, POST
27
- * ```
28
- *
29
- * @example
30
- * ```ts
31
- * app.use(
32
- * methodNotAllowed({
33
- * app,
34
- * onMethodNotAllowed: (c, methods) =>
35
- * c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
36
- * })
37
- * )
38
- * ```
39
- */
40
- const methodNotAllowed = (options) => {
41
- let methodRouter;
42
- return async function methodNotAllowed(c, next) {
43
- const routeIndex = c.req.routeIndex;
44
- await next();
45
- if (c.res.status !== 404) return;
46
- if (c.error) return;
47
- if (!methodRouter) {
48
- const methodsByPath = /* @__PURE__ */ new Map();
49
- for (const route of options.app.routes) {
50
- if (route.method === "ALL" || route.method === "HEAD") continue;
51
- const methods = methodsByPath.get(route.path) ?? /* @__PURE__ */ new Set();
52
- methods.add(route.method);
53
- if (route.method === "GET") methods.add("HEAD");
54
- methodsByPath.set(route.path, methods);
55
- }
56
- methodRouter = new TrieRouter();
57
- for (const [path, methods] of methodsByPath) methodRouter.add("ALL", path, [...methods]);
58
- }
59
- let requestPath = c.req.path;
60
- const currentRoute = matchedRoutes(c)[routeIndex];
61
- const sourceRoute = options.app.routes.find((route) => route.handler === methodNotAllowed);
62
- if (currentRoute && sourceRoute) {
63
- const currentBasePathParts = basePath(c, routeIndex).split("/").filter(Boolean);
64
- const sourceBasePathLength = sourceRoute.basePath.split("/").filter(Boolean).length;
65
- const mountBasePathParts = currentBasePathParts.slice(0, currentBasePathParts.length - sourceBasePathLength);
66
- if (mountBasePathParts.length > 0) {
67
- const mountBasePath = `/${mountBasePathParts.join("/")}`;
68
- requestPath = c.req.path.slice(mountBasePath.length) || "/";
69
- }
70
- }
71
- const allowedMethods = /* @__PURE__ */ new Set();
72
- for (const [methods] of methodRouter.match("ALL", requestPath)[0]) for (const method of methods) allowedMethods.add(method);
73
- if (allowedMethods.size === 0 || allowedMethods.has(c.req.method)) return;
74
- c.res.headers.delete("Allow");
75
- c.res.headers.delete("Content-Length");
76
- const methods = [...allowedMethods];
77
- const allow = methods.join(", ");
78
- c.res = options.onMethodNotAllowed ? await options.onMethodNotAllowed(c, methods) : c.text("Method Not Allowed", 405, { Allow: allow });
79
- };
80
- };
81
- //#endregion
1
+ import { t as methodNotAllowed } from "./method-not-allowed-TO2_hnfl.js";
82
2
  export { methodNotAllowed };
@@ -0,0 +1,103 @@
1
+ import { t as parseBody } from "./body-D7f4e7w_.js";
2
+ //#region ../../plugins/acryl-router/src/core/middleware/method-override/index.ts
3
+ const DEFAULT_METHOD_FORM_NAME = "_method";
4
+ /**
5
+ * Method Override Middleware for Acryl.
6
+ *
7
+ *
8
+ * @param {MethodOverrideOptions} options - The options for the method override middleware.
9
+ * @param {Acryl} options.app - The instance of Acryl is used in your application.
10
+ * @param {string} [options.form=_method] - Form key with a value containing the method name.
11
+ * @param {string} [options.header] - Header name with a value containing the method name.
12
+ * @param {string} [options.query] - Query parameter key with a value containing the method name.
13
+ * @returns {MiddlewareHandler} The middleware handler function.
14
+ *
15
+ * @example
16
+ * ```ts
17
+ * const app = new Acryl()
18
+ *
19
+ * // If no options are specified, the value of `_method` in the form,
20
+ * // e.g. DELETE, is used as the method.
21
+ * app.use('/posts', methodOverride({ app }))
22
+ *
23
+ * app.delete('/posts', (c) => {
24
+ * // ....
25
+ * })
26
+ * ```
27
+ */
28
+ const methodOverride = (options) => async function methodOverride(c, next) {
29
+ if (c.req.method === "GET") return await next();
30
+ const app = options.app;
31
+ if (!(options.header || options.query)) {
32
+ const contentType = c.req.header("content-type");
33
+ const methodFormName = options.form || DEFAULT_METHOD_FORM_NAME;
34
+ const clonedRequest = c.req.raw.clone();
35
+ const newRequest = clonedRequest.clone();
36
+ if (contentType?.startsWith("multipart/form-data")) {
37
+ const method = (await clonedRequest.formData()).get(methodFormName);
38
+ if (method) {
39
+ const newForm = await newRequest.formData();
40
+ newForm.delete(methodFormName);
41
+ const newHeaders = new Headers(clonedRequest.headers);
42
+ newHeaders.delete("content-type");
43
+ newHeaders.delete("content-length");
44
+ const request = new Request(c.req.url, {
45
+ body: newForm,
46
+ headers: newHeaders,
47
+ method
48
+ });
49
+ return app.fetch(request, c.env, getExecutionCtx(c));
50
+ }
51
+ }
52
+ if (contentType?.startsWith("application/x-www-form-urlencoded")) {
53
+ const params = await parseBody(clonedRequest);
54
+ const method = params[methodFormName];
55
+ if (method) {
56
+ delete params[methodFormName];
57
+ const newParams = new URLSearchParams(params);
58
+ const request = new Request(newRequest, {
59
+ body: newParams,
60
+ method
61
+ });
62
+ return app.fetch(request, c.env, getExecutionCtx(c));
63
+ }
64
+ }
65
+ } else if (options.header) {
66
+ const headerName = options.header;
67
+ const method = c.req.header(headerName);
68
+ if (method) {
69
+ const newHeaders = new Headers(c.req.raw.headers);
70
+ newHeaders.delete(headerName);
71
+ const request = new Request(c.req.raw, {
72
+ headers: newHeaders,
73
+ method
74
+ });
75
+ return app.fetch(request, c.env, getExecutionCtx(c));
76
+ }
77
+ } else if (options.query) {
78
+ const queryName = options.query;
79
+ const method = c.req.query(queryName);
80
+ if (method) {
81
+ const url = new URL(c.req.url);
82
+ url.searchParams.delete(queryName);
83
+ const requestInit = {
84
+ body: c.req.raw.body,
85
+ headers: c.req.raw.headers,
86
+ method,
87
+ duplex: c.req.raw.body ? "half" : void 0
88
+ };
89
+ const request = new Request(url.toString(), requestInit);
90
+ return app.fetch(request, c.env, getExecutionCtx(c));
91
+ }
92
+ }
93
+ await next();
94
+ };
95
+ const getExecutionCtx = (c) => {
96
+ let executionCtx;
97
+ try {
98
+ executionCtx = c.executionCtx;
99
+ } catch {}
100
+ return executionCtx;
101
+ };
102
+ //#endregion
103
+ export { methodOverride as t };
@@ -1,103 +1,2 @@
1
- import { parseBody } from "./utils/body.js";
2
- //#region ../../plugins/acryl-router/src/core/middleware/method-override/index.ts
3
- const DEFAULT_METHOD_FORM_NAME = "_method";
4
- /**
5
- * Method Override Middleware for Acryl.
6
- *
7
- *
8
- * @param {MethodOverrideOptions} options - The options for the method override middleware.
9
- * @param {Acryl} options.app - The instance of Acryl is used in your application.
10
- * @param {string} [options.form=_method] - Form key with a value containing the method name.
11
- * @param {string} [options.header] - Header name with a value containing the method name.
12
- * @param {string} [options.query] - Query parameter key with a value containing the method name.
13
- * @returns {MiddlewareHandler} The middleware handler function.
14
- *
15
- * @example
16
- * ```ts
17
- * const app = new Acryl()
18
- *
19
- * // If no options are specified, the value of `_method` in the form,
20
- * // e.g. DELETE, is used as the method.
21
- * app.use('/posts', methodOverride({ app }))
22
- *
23
- * app.delete('/posts', (c) => {
24
- * // ....
25
- * })
26
- * ```
27
- */
28
- const methodOverride = (options) => async function methodOverride(c, next) {
29
- if (c.req.method === "GET") return await next();
30
- const app = options.app;
31
- if (!(options.header || options.query)) {
32
- const contentType = c.req.header("content-type");
33
- const methodFormName = options.form || DEFAULT_METHOD_FORM_NAME;
34
- const clonedRequest = c.req.raw.clone();
35
- const newRequest = clonedRequest.clone();
36
- if (contentType?.startsWith("multipart/form-data")) {
37
- const method = (await clonedRequest.formData()).get(methodFormName);
38
- if (method) {
39
- const newForm = await newRequest.formData();
40
- newForm.delete(methodFormName);
41
- const newHeaders = new Headers(clonedRequest.headers);
42
- newHeaders.delete("content-type");
43
- newHeaders.delete("content-length");
44
- const request = new Request(c.req.url, {
45
- body: newForm,
46
- headers: newHeaders,
47
- method
48
- });
49
- return app.fetch(request, c.env, getExecutionCtx(c));
50
- }
51
- }
52
- if (contentType?.startsWith("application/x-www-form-urlencoded")) {
53
- const params = await parseBody(clonedRequest);
54
- const method = params[methodFormName];
55
- if (method) {
56
- delete params[methodFormName];
57
- const newParams = new URLSearchParams(params);
58
- const request = new Request(newRequest, {
59
- body: newParams,
60
- method
61
- });
62
- return app.fetch(request, c.env, getExecutionCtx(c));
63
- }
64
- }
65
- } else if (options.header) {
66
- const headerName = options.header;
67
- const method = c.req.header(headerName);
68
- if (method) {
69
- const newHeaders = new Headers(c.req.raw.headers);
70
- newHeaders.delete(headerName);
71
- const request = new Request(c.req.raw, {
72
- headers: newHeaders,
73
- method
74
- });
75
- return app.fetch(request, c.env, getExecutionCtx(c));
76
- }
77
- } else if (options.query) {
78
- const queryName = options.query;
79
- const method = c.req.query(queryName);
80
- if (method) {
81
- const url = new URL(c.req.url);
82
- url.searchParams.delete(queryName);
83
- const requestInit = {
84
- body: c.req.raw.body,
85
- headers: c.req.raw.headers,
86
- method,
87
- duplex: c.req.raw.body ? "half" : void 0
88
- };
89
- const request = new Request(url.toString(), requestInit);
90
- return app.fetch(request, c.env, getExecutionCtx(c));
91
- }
92
- }
93
- await next();
94
- };
95
- const getExecutionCtx = (c) => {
96
- let executionCtx;
97
- try {
98
- executionCtx = c.executionCtx;
99
- } catch {}
100
- return executionCtx;
101
- };
102
- //#endregion
1
+ import { t as methodOverride } from "./method-override-DnZKfJbV.js";
103
2
  export { methodOverride };
@@ -0,0 +1,12 @@
1
+ import "./basic-auth-DFLflXNe.js";
2
+ import "./combine-TWuGdcbC.js";
3
+ import "./context-storage-iuPoI_CR.js";
4
+ import "./ip-restriction-jKtKCRM_.js";
5
+ import "./jsx-renderer-CfifM4hT.js";
6
+ import "./jwk-CDPpYQpD.js";
7
+ import "./jwt-lyS4Q3mT.js";
8
+ import "./method-not-allowed-TO2_hnfl.js";
9
+ import "./serve-static-EiJf1zkO.js";
10
+ import "./timeout-FeqZ9A-0.js";
11
+ import "./loopback-only-BbasoF7R.js";
12
+ export {};
@@ -0,0 +1,77 @@
1
+ //#region ../../plugins/acryl-router/src/core/utils/mime.ts
2
+ /**
3
+ * @module
4
+ * MIME utility.
5
+ */
6
+ const getMimeType = (filename, mimes = baseMimes) => {
7
+ const match = filename.match(/\.([a-zA-Z0-9]+?)$/);
8
+ if (!match) return;
9
+ return mimes[match[1].toLowerCase()];
10
+ };
11
+ const getExtension = (mimeType) => {
12
+ const baseType = mimeType.split(";", 1)[0].trim();
13
+ for (const ext in baseMimes) {
14
+ const stored = baseMimes[ext];
15
+ if (stored === mimeType || stored.split(";", 1)[0].trim() === baseType) return ext;
16
+ }
17
+ };
18
+ const baseMimes = {
19
+ aac: "audio/aac",
20
+ avi: "video/x-msvideo",
21
+ avif: "image/avif",
22
+ av1: "video/av1",
23
+ bin: "application/octet-stream",
24
+ bmp: "image/bmp",
25
+ css: "text/css; charset=utf-8",
26
+ csv: "text/csv; charset=utf-8",
27
+ eot: "application/vnd.ms-fontobject",
28
+ epub: "application/epub+zip",
29
+ gif: "image/gif",
30
+ gz: "application/gzip",
31
+ htm: "text/html; charset=utf-8",
32
+ html: "text/html; charset=utf-8",
33
+ ico: "image/x-icon",
34
+ ics: "text/calendar; charset=utf-8",
35
+ jpeg: "image/jpeg",
36
+ jpg: "image/jpeg",
37
+ js: "text/javascript; charset=utf-8",
38
+ json: "application/json",
39
+ jsonld: "application/ld+json",
40
+ map: "application/json",
41
+ mid: "audio/x-midi",
42
+ midi: "audio/x-midi",
43
+ mjs: "text/javascript; charset=utf-8",
44
+ mp3: "audio/mpeg",
45
+ mp4: "video/mp4",
46
+ mpeg: "video/mpeg",
47
+ oga: "audio/ogg",
48
+ ogv: "video/ogg",
49
+ ogx: "application/ogg",
50
+ opus: "audio/opus",
51
+ otf: "font/otf",
52
+ pdf: "application/pdf",
53
+ png: "image/png",
54
+ rtf: "application/rtf",
55
+ svg: "image/svg+xml; charset=utf-8",
56
+ tif: "image/tiff",
57
+ tiff: "image/tiff",
58
+ ts: "video/mp2t",
59
+ ttf: "font/ttf",
60
+ txt: "text/plain; charset=utf-8",
61
+ wasm: "application/wasm",
62
+ webm: "video/webm",
63
+ weba: "audio/webm",
64
+ webmanifest: "application/manifest+json",
65
+ webp: "image/webp",
66
+ woff: "font/woff",
67
+ woff2: "font/woff2",
68
+ xhtml: "application/xhtml+xml; charset=utf-8",
69
+ xml: "application/xml; charset=utf-8",
70
+ zip: "application/zip",
71
+ "3gp": "video/3gpp",
72
+ "3g2": "video/3gpp2",
73
+ gltf: "model/gltf+json",
74
+ glb: "model/gltf-binary"
75
+ };
76
+ //#endregion
77
+ export { getExtension as n, getMimeType as r, baseMimes as t };