acrylblends 1.0.3 → 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (256) hide show
  1. package/docs/framework/agents/index.md +6 -4
  2. package/docs/framework/workshop/README.md +3 -3
  3. package/docs/framework/workshop/facilitator.md +1 -0
  4. package/lib/accept-CNNHu4Cf.js +193 -0
  5. package/lib/{accepts-XBuZPVRI.js → accepts-Btq83xPd.js} +1 -1
  6. package/lib/accepts.js +1 -1
  7. package/lib/acryl-base.js +1 -331
  8. package/lib/adapter-CaZ6FZUU.js +37 -0
  9. package/lib/adapter.js +1 -36
  10. package/lib/{app-BM0rTCp7.js → app-CQcGWjrk.js} +4 -4
  11. package/lib/app-base-CpRMZL4v.js +332 -0
  12. package/lib/{audit-BXnYsLge.d.ts → audit-D5z9uwOP.d.ts} +14 -1
  13. package/lib/{base-NSN_SNv-.js → base-D_6kfOr-.js} +1 -1
  14. package/lib/basic-auth-C0HTRpXh.js +20 -0
  15. package/lib/basic-auth-DFLflXNe.js +95 -0
  16. package/lib/basic-auth.js +1 -94
  17. package/lib/bearer-auth-Cwxt-vgS.js +94 -0
  18. package/lib/bearer-auth.js +1 -93
  19. package/lib/body-D7f4e7w_.js +94 -0
  20. package/lib/body-limit-WmIjWRLt.js +66 -0
  21. package/lib/body-limit.js +1 -65
  22. package/lib/buffer-CkEOJCcY.js +51 -0
  23. package/lib/bun.js +3 -3
  24. package/lib/cache-B0bHH7s5.js +169 -0
  25. package/lib/cache.js +1 -168
  26. package/lib/{client-DDLXwhBo.js → client-BrMFnMEd.js} +1 -1
  27. package/lib/{client-modules-CLvWOjbd.js → client-modules-drj4mjhj.js} +4 -4
  28. package/lib/client.js +1 -1
  29. package/lib/color-COa3DplO.js +37 -0
  30. package/lib/combine-TWuGdcbC.js +137 -0
  31. package/lib/combine.js +1 -136
  32. package/lib/{components-cEW3ovK0.js → components-B2ka9Ax1.js} +4 -4
  33. package/lib/{components-JXVm45kK.js → components-PVXwaOaC.js} +2 -2
  34. package/lib/compress-BzWqsHF1.js +79 -0
  35. package/lib/compress-C-9vK4B2.d.ts +11 -0
  36. package/lib/compress-DCyrrQ5D.js +11 -0
  37. package/lib/compress.d.ts +1 -1
  38. package/lib/compress.js +2 -78
  39. package/lib/concurrent-DrF3d2c-.js +30 -0
  40. package/lib/conninfo-BCROmdnf.d.ts +11 -0
  41. package/lib/conninfo-CWJwieh4.js +19 -0
  42. package/lib/constants-CBSEudrb.js +7 -0
  43. package/lib/{context-DDO0cfuP.js → context-CkOh7Ygv.js} +2 -2
  44. package/lib/context-storage-iuPoI_CR.js +52 -0
  45. package/lib/context-storage.js +1 -51
  46. package/lib/cookie-B1LlkzOe.js +125 -0
  47. package/lib/cookie-BHIduy2T.js +82 -0
  48. package/lib/cookie.js +1 -81
  49. package/lib/cordis/db-sqlite.d.ts +1 -1
  50. package/lib/cordis/door.d.ts +17 -3
  51. package/lib/cordis/door.js +123 -16
  52. package/lib/cordis/inspect.js +4 -4
  53. package/lib/cordis/kv-db.d.ts +1 -1
  54. package/lib/cordis/kv-db.js +1 -1
  55. package/lib/cordis/kv-json.d.ts +1 -1
  56. package/lib/cordis/kv-json.js +1 -1
  57. package/lib/cordis/node-server.d.ts +1 -1
  58. package/lib/cordis/node-server.js +3 -116
  59. package/lib/cordis/router-http.d.ts +1 -1
  60. package/lib/cordis/router-http.js +2 -2
  61. package/lib/cordis/router.d.ts +1 -1
  62. package/lib/cordis/router.js +4 -4
  63. package/lib/cordis/state.js +7 -7
  64. package/lib/{core-CaY8XDZ6.js → core-BOu1jYua.js} +1 -1
  65. package/lib/cors-CbAQ-8qU.js +106 -0
  66. package/lib/cors.js +1 -105
  67. package/lib/crypto-iVP-N-tS.js +34 -0
  68. package/lib/csrf-DqqOZtgy.js +101 -0
  69. package/lib/csrf.js +1 -100
  70. package/lib/css-C5CPVMvM.js +134 -0
  71. package/lib/css.js +2 -133
  72. package/lib/db/sqlite.d.ts +1 -25
  73. package/lib/dev-CLgu-JRe.js +50 -0
  74. package/lib/dev.js +1 -49
  75. package/lib/dom-YjND9Jt3.js +74 -0
  76. package/lib/door/host.d.ts +2 -2
  77. package/lib/door/host.js +1 -1
  78. package/lib/door/page.d.ts +12 -1
  79. package/lib/door/page.js +22 -1
  80. package/lib/door/protocol.d.ts +2 -2
  81. package/lib/door/protocol.js +2 -197
  82. package/lib/encode-BhbNLrjp.js +33 -0
  83. package/lib/factory-CLdSf-xS.js +30 -0
  84. package/lib/factory.js +1 -29
  85. package/lib/handler-C0wZ0KwO.js +12 -0
  86. package/lib/helpers-BEjcdbgw.js +5 -0
  87. package/lib/{hooks-w72iLeFR.js → hooks-CfC07ri0.js} +1 -1
  88. package/lib/html-CgNa89xw.js +31 -0
  89. package/lib/html-DGExBFNg.js +103 -0
  90. package/lib/html.d.ts +2 -5
  91. package/lib/html.js +2 -30
  92. package/lib/http-exception-MjWkT89V.js +54 -0
  93. package/lib/http-exception.js +1 -53
  94. package/lib/{index-D4nVR3wu.d.ts → index-DMOtA-NJ.d.ts} +7 -1
  95. package/lib/index-dAzQsJG9.d.ts +6 -0
  96. package/lib/index.js +3 -3
  97. package/lib/ip-restriction-jKtKCRM_.js +166 -0
  98. package/lib/ip-restriction.js +1 -165
  99. package/lib/ipaddr-DCoIo528.js +238 -0
  100. package/lib/jsx/dom/client.js +1 -1
  101. package/lib/jsx/dom/jsx-dev-runtime.js +1 -1
  102. package/lib/jsx/dom/jsx-runtime.js +2 -1
  103. package/lib/jsx/dom/server.js +3 -3
  104. package/lib/jsx/dom.js +5 -73
  105. package/lib/jsx/jsx-dev-runtime.d.ts +2 -5
  106. package/lib/jsx/jsx-dev-runtime.js +2 -13
  107. package/lib/jsx/jsx-runtime.d.ts +2 -2
  108. package/lib/jsx/jsx-runtime.js +4 -4
  109. package/lib/jsx/streaming.js +1 -1
  110. package/lib/jsx-CUQgttxU.js +47 -0
  111. package/lib/jsx-dev-runtime-B4WTyq8r.js +14 -0
  112. package/lib/{jsx-dev-runtime-CWLRA2F3.js → jsx-dev-runtime-BLfA-EhI.js} +2 -2
  113. package/lib/jsx-dev-runtime-CGt4kNYr.d.ts +6 -0
  114. package/lib/jsx-renderer-CfifM4hT.js +99 -0
  115. package/lib/jsx-renderer.js +1 -98
  116. package/lib/jsx-runtime-COCRWBJ9.js +2 -0
  117. package/lib/jsx.js +5 -46
  118. package/lib/{jwk-LkzeoaU8.js → jwk-CDPpYQpD.js} +3 -3
  119. package/lib/jwk.js +1 -1
  120. package/lib/{jwt-BGJBw5AF.js → jwt-BXoIA2fQ.js} +2 -2
  121. package/lib/{jwt-CskdhEW9.js → jwt-lyS4Q3mT.js} +3 -3
  122. package/lib/jwt.js +2 -2
  123. package/lib/kv/db.d.ts +1 -10
  124. package/lib/kv/db.js +1 -56
  125. package/lib/kv/json.d.ts +1 -9
  126. package/lib/kv/json.js +1 -223
  127. package/lib/{language-D9a4zqvn.js → language-DeGRtLJt.js} +2 -2
  128. package/lib/language.js +1 -1
  129. package/lib/{linear-router-C3FPib6h.js → linear-router-CmZn_JLV.js} +2 -2
  130. package/lib/logger-Ckxu8diz.js +54 -0
  131. package/lib/logger.js +1 -53
  132. package/lib/loopback-only-BbasoF7R.js +90 -0
  133. package/lib/loopback-only.js +1 -89
  134. package/lib/method-not-allowed-TO2_hnfl.js +82 -0
  135. package/lib/method-not-allowed.js +1 -81
  136. package/lib/method-override-DnZKfJbV.js +103 -0
  137. package/lib/method-override.js +1 -102
  138. package/lib/middleware-BfG_fp8P.js +12 -0
  139. package/lib/mime-BnScXkQn.js +77 -0
  140. package/lib/mount-QkK_3NtJ.js +67 -0
  141. package/lib/mount.js +1 -66
  142. package/lib/node-server/conninfo.d.ts +1 -10
  143. package/lib/node-server/conninfo.js +1 -18
  144. package/lib/node-server/register.js +25 -2
  145. package/lib/node-server/serve-static.d.ts +1 -17
  146. package/lib/node-server/serve-static.js +1 -1
  147. package/lib/node-server.d.ts +2 -2
  148. package/lib/node-server.js +4 -4
  149. package/lib/open-BqK4D2Wn.d.ts +11 -0
  150. package/lib/open-But9E2rL.js +57 -0
  151. package/lib/open-CULVJgOc.d.ts +12 -0
  152. package/lib/open-Dp4sxspc.js +224 -0
  153. package/lib/open-T7kgbO2O.d.ts +27 -0
  154. package/lib/{pattern-router-HZxjDGEQ.js → pattern-router-CJBecJBd.js} +1 -1
  155. package/lib/powered-by-CXQNjNIX.js +24 -0
  156. package/lib/powered-by.js +1 -23
  157. package/lib/pretty-json-CeC1yvYt.js +39 -0
  158. package/lib/pretty-json.js +1 -38
  159. package/lib/{protocol-BizVt4J6.d.ts → protocol-C37gPePD.d.ts} +9 -2
  160. package/lib/protocol-Dt0AZBOz.js +213 -0
  161. package/lib/proxy-C2w_mH7k.js +121 -0
  162. package/lib/proxy.js +1 -120
  163. package/lib/quick.js +4 -4
  164. package/lib/{reg-exp-router-DC1R3qoY.js → reg-exp-router-C_WV84eV.js} +2 -2
  165. package/lib/request-DvMgGtlW.js +323 -0
  166. package/lib/request.js +1 -322
  167. package/lib/route-D8m-a2I1.js +126 -0
  168. package/lib/route.js +1 -125
  169. package/lib/router/linear-router.js +1 -1
  170. package/lib/router/pattern-router.js +1 -1
  171. package/lib/router/reg-exp-router.js +1 -1
  172. package/lib/router/smart-router.js +1 -1
  173. package/lib/router/trie-router.js +1 -1
  174. package/lib/router-Be_o6nFu.js +35 -0
  175. package/lib/router.js +1 -34
  176. package/lib/schema-validator-EK3cUUCt.js +22 -0
  177. package/lib/schema-validator.js +1 -21
  178. package/lib/{secure-headers-mP3j6Hm6.js → secure-headers-C5ZOcXqk.js} +1 -1
  179. package/lib/secure-headers.js +1 -1
  180. package/lib/serve-static-B7sqnftW.d.ts +18 -0
  181. package/lib/{serve-static-3uo_9rjF.js → serve-static-C1Nkj_xB.js} +2 -2
  182. package/lib/{serve-static-Cp5adzGo.js → serve-static-EiJf1zkO.js} +4 -4
  183. package/lib/serve-static.js +1 -1
  184. package/lib/{smart-router-C5CZ5XSM.js → smart-router-BjxkDQCE.js} +1 -1
  185. package/lib/{snapshot-text-DmE0YfeZ.js → snapshot-text-Bbx43mN0.js} +57 -9
  186. package/lib/{src-2Z4mJg0x.js → src-BTBm4OPD.js} +22 -6
  187. package/lib/src-LX0E4ec4.js +117 -0
  188. package/lib/{ssg-BwjcA-Ge.js → ssg-BEl7MHqg.js} +5 -5
  189. package/lib/ssg.js +1 -1
  190. package/lib/stream-CzM_SHkq.js +88 -0
  191. package/lib/{streaming-DHST3Scg.js → streaming-BlDaph8U.js} +3 -3
  192. package/lib/streaming.js +1 -1
  193. package/lib/{test-websocket-D8WWqE5G.js → test-websocket-BLeEvybj.js} +2 -2
  194. package/lib/testing-BQx5T_UX.js +17 -0
  195. package/lib/testing.js +1 -16
  196. package/lib/timeout-FeqZ9A-0.js +42 -0
  197. package/lib/timeout.js +1 -41
  198. package/lib/tiny.js +2 -2
  199. package/lib/trailing-slash-DwTx-1sk.js +85 -0
  200. package/lib/trailing-slash.js +1 -84
  201. package/lib/{trie-router-CfFbapzL.js → trie-router-JydLKUa2.js} +2 -2
  202. package/lib/url-BPh4d6j-.js +197 -0
  203. package/lib/utils/accept.js +1 -192
  204. package/lib/utils/basic-auth.js +1 -19
  205. package/lib/utils/body.js +1 -93
  206. package/lib/utils/buffer.js +1 -50
  207. package/lib/utils/color.js +1 -36
  208. package/lib/utils/compress.d.ts +1 -10
  209. package/lib/utils/compress.js +1 -10
  210. package/lib/utils/concurrent.js +1 -29
  211. package/lib/utils/constants.js +1 -6
  212. package/lib/utils/cookie.js +1 -124
  213. package/lib/utils/crypto.js +1 -33
  214. package/lib/utils/encode.js +1 -32
  215. package/lib/utils/handler.js +1 -11
  216. package/lib/utils/html.js +1 -102
  217. package/lib/utils/ipaddr.js +1 -237
  218. package/lib/utils/jwt.js +1 -1
  219. package/lib/utils/mime.js +1 -76
  220. package/lib/utils/stream.js +1 -87
  221. package/lib/utils/url.js +1 -196
  222. package/lib/{validator-D84mq-dO.js → validator-Btiyt5VJ.js} +3 -3
  223. package/lib/validator.js +1 -1
  224. package/lib/websocket-DsyBIKVA.js +56 -0
  225. package/lib/ws.js +1 -55
  226. package/package.json +1 -1
  227. package/plugins/acryl-door/src/cli/acryl.ts +5 -3
  228. package/plugins/acryl-door/src/host/channel.ts +36 -0
  229. package/plugins/acryl-door/src/host/chat-tools.ts +2 -0
  230. package/plugins/acryl-door/src/host/door.ts +44 -5
  231. package/plugins/acryl-door/src/host/shim.ts +23 -0
  232. package/plugins/acryl-door/src/host/verbs.ts +4 -3
  233. package/plugins/acryl-door/src/index.ts +39 -3
  234. package/plugins/acryl-door/src/page/driver/driver.ts +22 -1
  235. package/plugins/acryl-door/src/page/protocol.ts +13 -2
  236. package/plugins/acryl-node-server/src/register.ts +29 -2
  237. package/plugins/acryl-router/src/service.ts +19 -1
  238. package/plugins/agent/model.ts +6 -1
  239. package/plugins/agent/tools.ts +12 -2
  240. package/plugins/agent-panel/client/describe.ts +44 -0
  241. package/plugins/agent-panel/client/main.ts +67 -35
  242. package/plugins/agent-panel/index.ts +137 -35
  243. package/plugins/desktop/attach.ts +72 -0
  244. package/plugins/desktop/main.ts +17 -4
  245. package/plugins/extensions/index.ts +3 -4
  246. package/plugins/extensions/stage.ts +33 -5
  247. package/plugins/openai/index.ts +1 -1
  248. package/shared/DEFAULTS.md +4 -0
  249. package/templates/agent/AGENTS.md +2 -0
  250. package/templates/agent/blend.yaml +4 -1
  251. package/templates/agent/src/app.ts +2 -0
  252. package/templates/agent/src/routes.ts +1 -1
  253. package/templates/agent/template.json +1 -0
  254. package/templates/agent/test/builder.test.ts +26 -21
  255. package/lib/helpers-CvTauQT5.js +0 -5
  256. package/lib/middleware-CPQ8himN.js +0 -12
package/lib/cors.js CHANGED
@@ -1,106 +1,2 @@
1
- //#region ../../plugins/acryl-router/src/core/middleware/cors/index.ts
2
- /**
3
- * CORS Middleware for Acryl.
4
- *
5
- *
6
- * @param {CORSOptions} [options] - The options for the CORS middleware.
7
- * @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
8
- * @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
9
- * @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
10
- * @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
11
- * @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
12
- * @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
13
- * @returns {MiddlewareHandler} The middleware handler function.
14
- *
15
- * @example
16
- * ```ts
17
- * const app = new Acryl()
18
- *
19
- * app.use('/api/*', cors())
20
- * app.use(
21
- * '/api2/*',
22
- * cors({
23
- * origin: 'http://example.com',
24
- * allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
25
- * allowMethods: ['POST', 'GET', 'OPTIONS'],
26
- * exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
27
- * maxAge: 600,
28
- * credentials: true,
29
- * })
30
- * )
31
- *
32
- * app.all('/api/abc', (c) => {
33
- * return c.json({ success: true })
34
- * })
35
- * app.all('/api2/abc', (c) => {
36
- * return c.json({ success: true })
37
- * })
38
- * ```
39
- */
40
- const cors = (options) => {
41
- const opts = {
42
- origin: "*",
43
- allowMethods: [
44
- "GET",
45
- "HEAD",
46
- "PUT",
47
- "POST",
48
- "DELETE",
49
- "PATCH",
50
- "QUERY"
51
- ],
52
- allowHeaders: [],
53
- exposeHeaders: [],
54
- ...options
55
- };
56
- const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
57
- const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
58
- const findAllowOrigin = ((optsOrigin) => {
59
- if (typeof optsOrigin === "string") if (optsOrigin === "*") return () => optsOrigin;
60
- else return (origin) => optsOrigin === origin ? origin : null;
61
- else if (typeof optsOrigin === "function") return optsOrigin;
62
- else return (origin) => optsOrigin.includes(origin) ? origin : null;
63
- })(opts.origin);
64
- const findAllowMethods = ((optsAllowMethods) => {
65
- if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
66
- else if (Array.isArray(optsAllowMethods)) {
67
- const methodsStr = optsAllowMethods.join(",");
68
- return () => methodsStr;
69
- } else return () => "";
70
- })(opts.allowMethods);
71
- return async function cors(c, next) {
72
- function set(key, value) {
73
- c.res.headers.set(key, value);
74
- }
75
- const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
76
- if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
77
- if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
78
- if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
79
- if (c.req.method === "OPTIONS") {
80
- if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
81
- if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
82
- const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
83
- if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
84
- let headersStr = allowHeadersStr;
85
- if (!headersStr) {
86
- const requestHeaders = c.req.header("Access-Control-Request-Headers");
87
- if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
88
- }
89
- if (headersStr) {
90
- set("Access-Control-Allow-Headers", headersStr);
91
- c.res.headers.append("Vary", "Access-Control-Request-Headers");
92
- }
93
- c.res.headers.delete("Content-Length");
94
- c.res.headers.delete("Content-Type");
95
- return new Response(null, {
96
- headers: c.res.headers,
97
- status: 204,
98
- statusText: "No Content"
99
- });
100
- }
101
- await next();
102
- if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
103
- };
104
- };
105
- //#endregion
1
+ import { t as cors } from "./cors-CbAQ-8qU.js";
106
2
  export { cors };
@@ -0,0 +1,34 @@
1
+ //#region ../../plugins/acryl-router/src/core/utils/crypto.ts
2
+ const sha256 = async (data) => {
3
+ return await createHash(data, {
4
+ name: "SHA-256",
5
+ alias: "sha256"
6
+ });
7
+ };
8
+ const sha1 = async (data) => {
9
+ return await createHash(data, {
10
+ name: "SHA-1",
11
+ alias: "sha1"
12
+ });
13
+ };
14
+ const md5 = async (data) => {
15
+ return await createHash(data, {
16
+ name: "MD5",
17
+ alias: "md5"
18
+ });
19
+ };
20
+ const createHash = async (data, algorithm) => {
21
+ let sourceBuffer;
22
+ if (ArrayBuffer.isView(data) || data instanceof ArrayBuffer) sourceBuffer = data;
23
+ else {
24
+ if (typeof data === "object") data = JSON.stringify(data);
25
+ sourceBuffer = new TextEncoder().encode(String(data));
26
+ }
27
+ if (crypto && crypto.subtle) {
28
+ const buffer = await crypto.subtle.digest({ name: algorithm.name }, sourceBuffer);
29
+ return Array.prototype.map.call(new Uint8Array(buffer), (x) => ("00" + x.toString(16)).slice(-2)).join("");
30
+ }
31
+ return null;
32
+ };
33
+ //#endregion
34
+ export { sha256 as i, md5 as n, sha1 as r, createHash as t };
@@ -0,0 +1,101 @@
1
+ import { t as HTTPException } from "./http-exception-MjWkT89V.js";
2
+ //#region ../../plugins/acryl-router/src/core/middleware/csrf/index.ts
3
+ const secFetchSiteValues = [
4
+ "same-origin",
5
+ "same-site",
6
+ "none",
7
+ "cross-site"
8
+ ];
9
+ const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
10
+ const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
11
+ const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
12
+ /**
13
+ * CSRF Protection Middleware for Acryl.
14
+ *
15
+ * Protects against Cross-Site Request Forgery attacks by validating request origins
16
+ * and sec-fetch-site headers. The request is allowed if either validation passes.
17
+ *
18
+ *
19
+ * @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
20
+ * @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
21
+ * Allowed origins for requests.
22
+ * - string: Single allowed origin (e.g., 'https://example.com')
23
+ * - string[]: Multiple allowed origins
24
+ * - function: Custom validation logic
25
+ * - Default: Only same origin as the request URL
26
+ * @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
27
+ * Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
28
+ * - string: Single allowed value (e.g., 'same-origin')
29
+ * - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
30
+ * - function: Custom validation with access to context
31
+ * - Default: Only allows 'same-origin'
32
+ * @returns {MiddlewareHandler} The middleware handler function.
33
+ *
34
+ * @example
35
+ * ```ts
36
+ * const app = new Acryl()
37
+ *
38
+ * // Default: both origin and sec-fetch-site validation
39
+ * app.use('*', csrf())
40
+ *
41
+ * // Allow specific origins
42
+ * app.use('*', csrf({ origin: 'https://example.com' }))
43
+ * app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
44
+ *
45
+ * // Allow specific sec-fetch-site values
46
+ * app.use('*', csrf({ secFetchSite: 'same-origin' }))
47
+ * app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
48
+ *
49
+ * // Dynamic sec-fetch-site validation
50
+ * app.use('*', csrf({
51
+ * secFetchSite: (secFetchSite, c) => {
52
+ * // Always allow same-origin
53
+ * if (secFetchSite === 'same-origin') return true
54
+ * // Allow cross-site for webhook endpoints
55
+ * if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
56
+ * return true
57
+ * }
58
+ * return false
59
+ * }
60
+ * }))
61
+ *
62
+ * // Dynamic origin validation
63
+ * app.use('*', csrf({
64
+ * origin: (origin, c) => {
65
+ * // Allow same origin
66
+ * if (origin === new URL(c.req.url).origin) return true
67
+ * // Allow specific trusted domains
68
+ * return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
69
+ * }
70
+ * }))
71
+ * ```
72
+ */
73
+ const csrf = (options) => {
74
+ const originHandler = ((optsOrigin) => {
75
+ if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
76
+ else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
77
+ else if (typeof optsOrigin === "function") return optsOrigin;
78
+ else return (origin) => optsOrigin.includes(origin);
79
+ })(options?.origin);
80
+ const isAllowedOrigin = async (origin, c) => {
81
+ if (origin === void 0) return false;
82
+ return await originHandler(origin, c);
83
+ };
84
+ const secFetchSiteHandler = ((optsSecFetchSite) => {
85
+ if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
86
+ else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
87
+ else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
88
+ else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
89
+ })(options?.secFetchSite);
90
+ const isAllowedSecFetchSite = async (secFetchSite, c) => {
91
+ if (secFetchSite === void 0) return false;
92
+ if (!isSecFetchSite(secFetchSite)) return false;
93
+ return await secFetchSiteHandler(secFetchSite, c);
94
+ };
95
+ return async function csrf(c, next) {
96
+ if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) throw new HTTPException(403, { res: new Response("Forbidden", { status: 403 }) });
97
+ await next();
98
+ };
99
+ };
100
+ //#endregion
101
+ export { csrf as t };
package/lib/csrf.js CHANGED
@@ -1,101 +1,2 @@
1
- import { HTTPException } from "./http-exception.js";
2
- //#region ../../plugins/acryl-router/src/core/middleware/csrf/index.ts
3
- const secFetchSiteValues = [
4
- "same-origin",
5
- "same-site",
6
- "none",
7
- "cross-site"
8
- ];
9
- const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
10
- const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
11
- const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
12
- /**
13
- * CSRF Protection Middleware for Acryl.
14
- *
15
- * Protects against Cross-Site Request Forgery attacks by validating request origins
16
- * and sec-fetch-site headers. The request is allowed if either validation passes.
17
- *
18
- *
19
- * @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
20
- * @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
21
- * Allowed origins for requests.
22
- * - string: Single allowed origin (e.g., 'https://example.com')
23
- * - string[]: Multiple allowed origins
24
- * - function: Custom validation logic
25
- * - Default: Only same origin as the request URL
26
- * @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
27
- * Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
28
- * - string: Single allowed value (e.g., 'same-origin')
29
- * - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
30
- * - function: Custom validation with access to context
31
- * - Default: Only allows 'same-origin'
32
- * @returns {MiddlewareHandler} The middleware handler function.
33
- *
34
- * @example
35
- * ```ts
36
- * const app = new Acryl()
37
- *
38
- * // Default: both origin and sec-fetch-site validation
39
- * app.use('*', csrf())
40
- *
41
- * // Allow specific origins
42
- * app.use('*', csrf({ origin: 'https://example.com' }))
43
- * app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
44
- *
45
- * // Allow specific sec-fetch-site values
46
- * app.use('*', csrf({ secFetchSite: 'same-origin' }))
47
- * app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
48
- *
49
- * // Dynamic sec-fetch-site validation
50
- * app.use('*', csrf({
51
- * secFetchSite: (secFetchSite, c) => {
52
- * // Always allow same-origin
53
- * if (secFetchSite === 'same-origin') return true
54
- * // Allow cross-site for webhook endpoints
55
- * if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
56
- * return true
57
- * }
58
- * return false
59
- * }
60
- * }))
61
- *
62
- * // Dynamic origin validation
63
- * app.use('*', csrf({
64
- * origin: (origin, c) => {
65
- * // Allow same origin
66
- * if (origin === new URL(c.req.url).origin) return true
67
- * // Allow specific trusted domains
68
- * return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
69
- * }
70
- * }))
71
- * ```
72
- */
73
- const csrf = (options) => {
74
- const originHandler = ((optsOrigin) => {
75
- if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
76
- else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
77
- else if (typeof optsOrigin === "function") return optsOrigin;
78
- else return (origin) => optsOrigin.includes(origin);
79
- })(options?.origin);
80
- const isAllowedOrigin = async (origin, c) => {
81
- if (origin === void 0) return false;
82
- return await originHandler(origin, c);
83
- };
84
- const secFetchSiteHandler = ((optsSecFetchSite) => {
85
- if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
86
- else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
87
- else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
88
- else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
89
- })(options?.secFetchSite);
90
- const isAllowedSecFetchSite = async (secFetchSite, c) => {
91
- if (secFetchSite === void 0) return false;
92
- if (!isSecFetchSite(secFetchSite)) return false;
93
- return await secFetchSiteHandler(secFetchSite, c);
94
- };
95
- return async function csrf(c, next) {
96
- if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) throw new HTTPException(403, { res: new Response("Forbidden", { status: 403 }) });
97
- await next();
98
- };
99
- };
100
- //#endregion
1
+ import { t as csrf } from "./csrf-DqqOZtgy.js";
101
2
  export { csrf };
@@ -0,0 +1,134 @@
1
+ import { n as escapeToBuffer, r as raw } from "./html-DGExBFNg.js";
2
+ import { i as DOM_RENDERER } from "./constants-BR9jM9BC.js";
3
+ import { c as CLASS_NAME, d as SELECTOR, f as SELECTORS, g as keyframesCommon, h as cxCommon, l as DEFAULT_STYLE_ID, m as cssCommon, p as STYLE_STRING, r as createCssJsxDomObjects, v as viewTransitionCommon } from "./css-D2jb7X8b.js";
4
+ //#region ../../plugins/acryl-router/src/core/helper/css/index.ts
5
+ /**
6
+ * @module
7
+ * css Helper for Acryl.
8
+ */
9
+ /**
10
+ * @experimental
11
+ * `createCssContext` is an experimental feature.
12
+ * The API might be changed.
13
+ *
14
+ * @param options.id - The ID for the style element
15
+ * @param options.classNameSlug - Optional function to customize generated CSS class names
16
+ * @param options.onInvalidSlug - Optional callback function called when an invalid slug is returned from ClassNameSlug
17
+ */
18
+ const createCssContext = ({ id, classNameSlug, onInvalidSlug }) => {
19
+ const [cssJsxDomObject, StyleRenderToDom] = createCssJsxDomObjects({ id });
20
+ const contextMap = /* @__PURE__ */ new WeakMap();
21
+ const nonceMap = /* @__PURE__ */ new WeakMap();
22
+ const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`, "s");
23
+ const newCssClassNameObject = (cssClassName) => {
24
+ const appendStyle = ({ buffer, context }) => {
25
+ const [toAdd, added] = contextMap.get(context);
26
+ const names = Object.keys(toAdd);
27
+ if (!names.length) return;
28
+ let stylesStr = "";
29
+ names.forEach((className) => {
30
+ added[className] = true;
31
+ stylesStr += className.startsWith(":-acryl-global") ? toAdd[className] : `${className[0] === "@" ? "" : "."}${className}{${toAdd[className]}}`;
32
+ });
33
+ contextMap.set(context, [{}, added]);
34
+ if (buffer && replaceStyleRe.test(buffer[0])) {
35
+ buffer[0] = buffer[0].replace(replaceStyleRe, (_, pre, post) => `${pre}${stylesStr}${post}`);
36
+ return;
37
+ }
38
+ const nonce = nonceMap.get(context);
39
+ const appendStyleScript = `<script${nonce ? ` nonce="${nonce}"` : ""}>document.querySelector('#${id}').textContent+=${JSON.stringify(stylesStr)}<\/script>`;
40
+ if (buffer) {
41
+ buffer[0] = `${appendStyleScript}${buffer[0]}`;
42
+ return;
43
+ }
44
+ return Promise.resolve(appendStyleScript);
45
+ };
46
+ const addClassNameToContext = ({ context }) => {
47
+ if (!contextMap.has(context)) contextMap.set(context, [{}, {}]);
48
+ const [toAdd, added] = contextMap.get(context);
49
+ let allAdded = true;
50
+ if (!added[cssClassName[SELECTOR]]) {
51
+ allAdded = false;
52
+ toAdd[cssClassName[SELECTOR]] = cssClassName[STYLE_STRING];
53
+ }
54
+ cssClassName[SELECTORS].forEach(({ [CLASS_NAME]: className, [STYLE_STRING]: styleString }) => {
55
+ if (!added[className]) {
56
+ allAdded = false;
57
+ toAdd[className] = styleString;
58
+ }
59
+ });
60
+ if (allAdded) return;
61
+ return Promise.resolve(raw("", [appendStyle]));
62
+ };
63
+ const rawClassName = cssClassName[CLASS_NAME];
64
+ let escapedClassName = rawClassName;
65
+ if (/[&<>'"]/.test(rawClassName)) {
66
+ const escapedBuffer = [""];
67
+ escapeToBuffer(rawClassName, escapedBuffer);
68
+ escapedClassName = escapedBuffer[0];
69
+ }
70
+ const className = new String(escapedClassName);
71
+ Object.assign(className, cssClassName);
72
+ className.isEscaped = true;
73
+ className.callbacks = [addClassNameToContext];
74
+ const promise = Promise.resolve(className);
75
+ Object.assign(promise, cssClassName);
76
+ promise.toString = cssJsxDomObject.toString;
77
+ return promise;
78
+ };
79
+ const css = (strings, ...values) => {
80
+ return newCssClassNameObject(cssCommon(strings, values, classNameSlug, onInvalidSlug));
81
+ };
82
+ const cx = (...args) => {
83
+ args = cxCommon(args);
84
+ return css(Array(args.length).fill(""), ...args);
85
+ };
86
+ const keyframes = (strings, ...values) => keyframesCommon(strings, values, classNameSlug, onInvalidSlug);
87
+ const viewTransition = ((strings, ...values) => {
88
+ return newCssClassNameObject(viewTransitionCommon(strings, values, classNameSlug, onInvalidSlug));
89
+ });
90
+ const Style = ({ children, nonce } = {}) => raw(`<style id="${id}"${nonce ? ` nonce="${nonce}"` : ""}>${children ? children[STYLE_STRING] : ""}</style>`, [({ context }) => {
91
+ nonceMap.set(context, nonce);
92
+ }]);
93
+ Style[DOM_RENDERER] = StyleRenderToDom;
94
+ return {
95
+ css,
96
+ cx,
97
+ keyframes,
98
+ viewTransition,
99
+ Style
100
+ };
101
+ };
102
+ const defaultContext = createCssContext({ id: DEFAULT_STYLE_ID });
103
+ /**
104
+ * @experimental
105
+ * `css` is an experimental feature.
106
+ * The API might be changed.
107
+ */
108
+ const css = defaultContext.css;
109
+ /**
110
+ * @experimental
111
+ * `cx` is an experimental feature.
112
+ * The API might be changed.
113
+ */
114
+ const cx = defaultContext.cx;
115
+ /**
116
+ * @experimental
117
+ * `keyframes` is an experimental feature.
118
+ * The API might be changed.
119
+ */
120
+ const keyframes = defaultContext.keyframes;
121
+ /**
122
+ * @experimental
123
+ * `viewTransition` is an experimental feature.
124
+ * The API might be changed.
125
+ */
126
+ const viewTransition = defaultContext.viewTransition;
127
+ /**
128
+ * @experimental
129
+ * `Style` is an experimental feature.
130
+ * The API might be changed.
131
+ */
132
+ const Style = defaultContext.Style;
133
+ //#endregion
134
+ export { keyframes as a, cx as i, createCssContext as n, viewTransition as o, css as r, Style as t };
package/lib/css.js CHANGED
@@ -1,134 +1,3 @@
1
- import { escapeToBuffer, raw } from "./utils/html.js";
2
- import { i as DOM_RENDERER } from "./constants-BR9jM9BC.js";
3
- import { _ as rawCssString, c as CLASS_NAME, d as SELECTOR, f as SELECTORS, g as keyframesCommon, h as cxCommon, l as DEFAULT_STYLE_ID, m as cssCommon, p as STYLE_STRING, r as createCssJsxDomObjects, v as viewTransitionCommon } from "./css-D2jb7X8b.js";
4
- //#region ../../plugins/acryl-router/src/core/helper/css/index.ts
5
- /**
6
- * @module
7
- * css Helper for Acryl.
8
- */
9
- /**
10
- * @experimental
11
- * `createCssContext` is an experimental feature.
12
- * The API might be changed.
13
- *
14
- * @param options.id - The ID for the style element
15
- * @param options.classNameSlug - Optional function to customize generated CSS class names
16
- * @param options.onInvalidSlug - Optional callback function called when an invalid slug is returned from ClassNameSlug
17
- */
18
- const createCssContext = ({ id, classNameSlug, onInvalidSlug }) => {
19
- const [cssJsxDomObject, StyleRenderToDom] = createCssJsxDomObjects({ id });
20
- const contextMap = /* @__PURE__ */ new WeakMap();
21
- const nonceMap = /* @__PURE__ */ new WeakMap();
22
- const replaceStyleRe = new RegExp(`(<style id="${id}"(?: nonce="[^"]*")?>.*?)(</style>)`, "s");
23
- const newCssClassNameObject = (cssClassName) => {
24
- const appendStyle = ({ buffer, context }) => {
25
- const [toAdd, added] = contextMap.get(context);
26
- const names = Object.keys(toAdd);
27
- if (!names.length) return;
28
- let stylesStr = "";
29
- names.forEach((className) => {
30
- added[className] = true;
31
- stylesStr += className.startsWith(":-acryl-global") ? toAdd[className] : `${className[0] === "@" ? "" : "."}${className}{${toAdd[className]}}`;
32
- });
33
- contextMap.set(context, [{}, added]);
34
- if (buffer && replaceStyleRe.test(buffer[0])) {
35
- buffer[0] = buffer[0].replace(replaceStyleRe, (_, pre, post) => `${pre}${stylesStr}${post}`);
36
- return;
37
- }
38
- const nonce = nonceMap.get(context);
39
- const appendStyleScript = `<script${nonce ? ` nonce="${nonce}"` : ""}>document.querySelector('#${id}').textContent+=${JSON.stringify(stylesStr)}<\/script>`;
40
- if (buffer) {
41
- buffer[0] = `${appendStyleScript}${buffer[0]}`;
42
- return;
43
- }
44
- return Promise.resolve(appendStyleScript);
45
- };
46
- const addClassNameToContext = ({ context }) => {
47
- if (!contextMap.has(context)) contextMap.set(context, [{}, {}]);
48
- const [toAdd, added] = contextMap.get(context);
49
- let allAdded = true;
50
- if (!added[cssClassName[SELECTOR]]) {
51
- allAdded = false;
52
- toAdd[cssClassName[SELECTOR]] = cssClassName[STYLE_STRING];
53
- }
54
- cssClassName[SELECTORS].forEach(({ [CLASS_NAME]: className, [STYLE_STRING]: styleString }) => {
55
- if (!added[className]) {
56
- allAdded = false;
57
- toAdd[className] = styleString;
58
- }
59
- });
60
- if (allAdded) return;
61
- return Promise.resolve(raw("", [appendStyle]));
62
- };
63
- const rawClassName = cssClassName[CLASS_NAME];
64
- let escapedClassName = rawClassName;
65
- if (/[&<>'"]/.test(rawClassName)) {
66
- const escapedBuffer = [""];
67
- escapeToBuffer(rawClassName, escapedBuffer);
68
- escapedClassName = escapedBuffer[0];
69
- }
70
- const className = new String(escapedClassName);
71
- Object.assign(className, cssClassName);
72
- className.isEscaped = true;
73
- className.callbacks = [addClassNameToContext];
74
- const promise = Promise.resolve(className);
75
- Object.assign(promise, cssClassName);
76
- promise.toString = cssJsxDomObject.toString;
77
- return promise;
78
- };
79
- const css = (strings, ...values) => {
80
- return newCssClassNameObject(cssCommon(strings, values, classNameSlug, onInvalidSlug));
81
- };
82
- const cx = (...args) => {
83
- args = cxCommon(args);
84
- return css(Array(args.length).fill(""), ...args);
85
- };
86
- const keyframes = (strings, ...values) => keyframesCommon(strings, values, classNameSlug, onInvalidSlug);
87
- const viewTransition = ((strings, ...values) => {
88
- return newCssClassNameObject(viewTransitionCommon(strings, values, classNameSlug, onInvalidSlug));
89
- });
90
- const Style = ({ children, nonce } = {}) => raw(`<style id="${id}"${nonce ? ` nonce="${nonce}"` : ""}>${children ? children[STYLE_STRING] : ""}</style>`, [({ context }) => {
91
- nonceMap.set(context, nonce);
92
- }]);
93
- Style[DOM_RENDERER] = StyleRenderToDom;
94
- return {
95
- css,
96
- cx,
97
- keyframes,
98
- viewTransition,
99
- Style
100
- };
101
- };
102
- const defaultContext = createCssContext({ id: DEFAULT_STYLE_ID });
103
- /**
104
- * @experimental
105
- * `css` is an experimental feature.
106
- * The API might be changed.
107
- */
108
- const css = defaultContext.css;
109
- /**
110
- * @experimental
111
- * `cx` is an experimental feature.
112
- * The API might be changed.
113
- */
114
- const cx = defaultContext.cx;
115
- /**
116
- * @experimental
117
- * `keyframes` is an experimental feature.
118
- * The API might be changed.
119
- */
120
- const keyframes = defaultContext.keyframes;
121
- /**
122
- * @experimental
123
- * `viewTransition` is an experimental feature.
124
- * The API might be changed.
125
- */
126
- const viewTransition = defaultContext.viewTransition;
127
- /**
128
- * @experimental
129
- * `Style` is an experimental feature.
130
- * The API might be changed.
131
- */
132
- const Style = defaultContext.Style;
133
- //#endregion
1
+ import { _ as rawCssString } from "./css-D2jb7X8b.js";
2
+ import { a as keyframes, i as cx, n as createCssContext, o as viewTransition, r as css, t as Style } from "./css-C5CPVMvM.js";
134
3
  export { Style, createCssContext, css, cx, keyframes, rawCssString, viewTransition };
@@ -1,27 +1,3 @@
1
1
  import { n as DbExecutor, r as SqlValue, t as Db } from "../database-DBHdwefi.js";
2
-
3
- //#region ../../plugins/acryl-db-sqlite/src/open.d.ts
4
- interface OpenDbOptions {
5
- /** The database file, its folder created if missing; `:memory:` for a database that lives until `close`. */
6
- readonly path: string;
7
- /** A folder of `NNN-name.sql` files numbered from 1, as a path or a file URL, applied in order before `openDb` resolves. */
8
- readonly migrations?: string | URL;
9
- /** How long SQLite waits for a competing file lock, in milliseconds. Defaults to 5000. */
10
- readonly busyTimeoutMs?: number;
11
- /** The WAL auto-checkpoint threshold in pages; 0 disables it. Defaults to 1000. */
12
- readonly walAutoCheckpointPages?: number;
13
- }
14
- /** An open database: the port, and the one function that closes it. */
15
- interface OpenDb {
16
- readonly db: Db;
17
- /** Waits for running operations and transactions, checkpoints the WAL and releases the file. Calling it again does nothing. */
18
- close(): Promise<void>;
19
- }
20
- /**
21
- * Open, configure and migrate a SQLite database.
22
- * @throws when the migration files are misnamed or misnumbered, or a migration fails (the file is closed, and unchanged), or the
23
- * database's schema is newer than the migrations.
24
- */
25
- declare function openDb(options: OpenDbOptions): Promise<OpenDb>;
26
- //#endregion
2
+ import { n as OpenDbOptions, r as openDb, t as OpenDb } from "../open-T7kgbO2O.js";
27
3
  export { type Db, type DbExecutor, OpenDb, OpenDbOptions, type SqlValue, openDb };