acrylblends 1.0.4 → 1.0.6

package/lib/cordis/inspect.js

@@ -1,7 +1,7 @@
-import { t as Acryl } from "../app-BM0rTCp7.js";
-import { loopbackOnly } from "../loopback-only.js";
-import "../src-dy3Fk9tA.js";
-import "../middleware-CPQ8himN.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
+import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import "../src-BTBm4OPD.js";
+import "../middleware-BfG_fp8P.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-inspect/src/report.ts
 /**

package/lib/cordis/kv-db.d.ts

@@ -1,4 +1,4 @@
-import { KvOnDbOptions, kvOnDb } from "../kv/db.js";
+import { n as kvOnDb, t as KvOnDbOptions } from "../open-CULVJgOc.js";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/kv-db.js

@@ -1,5 +1,5 @@
 import "../src-DRFVEQQb.js";
-import { kvOnDb } from "../kv/db.js";
+import { t as kvOnDb } from "../open-But9E2rL.js";
 import z from "@deepseek-ai/schemastery";
 //#region ../../plugins/acryl-kv-db/src/index.ts
 /** Stable Cordis plugin name, equal to the package name and the Loader row id. */

package/lib/cordis/kv-json.d.ts

@@ -1,4 +1,4 @@
-import { OpenKvOptions, openKv } from "../kv/json.js";
+import { n as openKv, t as OpenKvOptions } from "../open-BqK4D2Wn.js";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/kv-json.js

@@ -1,5 +1,5 @@
 import "../src-DRFVEQQb.js";
-import { openKv } from "../kv/json.js";
+import { t as openKv } from "../open-Dp4sxspc.js";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";

package/lib/cordis/node-server.d.ts

@@ -1,6 +1,6 @@
 import { c as UpgradeHubOptions, i as testWebSocket, l as UpgradeRouter, n as TestWebSocketOptions, o as UpgradeEmitter, p as WebSocketLike, r as TestWebSocketResult, s as UpgradeHub, t as TestSocket, u as RequestError } from "../test-websocket-DyeS50Tr.js";
 import { n as UpgradeWebSocket } from "../index-C-SklY6u.js";
-import { ServeStaticOptions, serveStatic } from "../node-server/serve-static.js";
+import { n as serveStatic, t as ServeStaticOptions } from "../serve-static-B7sqnftW.js";
 import { Context, Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/node-server.js

@@ -1,117 +1,4 @@
-import { c as Request, i as createAdaptorServer, l as RequestError, n as UpgradeEmitter, r as UpgradeHub, t as testWebSocket } from "../test-websocket-D8WWqE5G.js";
-import { t as serveStatic } from "../serve-static-3uo_9rjF.js";
-import { Service } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
-//#region ../../plugins/acryl-node-server/src/index.ts
-/** Stable Cordis plugin name, equal to the package name and the Loader row id. */
-const name = "acryl-node-server";
-const inject = ["router"];
-/** Every field has a default, so a caller passes only what it changes: `ctx.plugin(plugin, { ... })` takes the partial shape. */
-const Config = z.object({
-	hostname: z.string().default("127.0.0.1").description("Address to bind. Loopback by default; binding elsewhere exposes the app to the network."),
-	port: z.number().min(0).max(65535).default(0).description("Port to listen on; 0 lets the system choose. A taken port is followed by the next free one."),
-	scan: z.number().min(0).default(20).description("How many further ports to try when the configured one is taken."),
-	websocket: z.object({
-		maxPayload: z.number().min(1).default(1024 * 1024).description("The largest WebSocket frame accepted, in bytes; a bigger one closes the socket with 1009."),
-		heartbeat: z.number().min(0).default(3e4).description("Milliseconds between pings; a peer that did not answer the last one is terminated. 0 turns it off."),
-		grace: z.number().min(0).default(2e3).description("Milliseconds a closing socket gets before it is terminated when its plugin unloads.")
-	}).default({})
-});
-var NodeServer = class extends Service {
-	hostname;
-	config;
-	server;
-	hub;
-	bound = 0;
-	constructor(ctx, config) {
-		super(ctx, "nodeServer");
-		this.config = config;
-		this.hostname = config.hostname;
-		const router = ctx.router;
-		this.server = createAdaptorServer({
-			fetch: (request, { incoming }) => router.fetch(new Request(request), {
-				remoteAddress: incoming.socket.remoteAddress,
-				localPort: incoming.socket.localPort
-			}),
-			hostname: config.hostname,
-			overrideGlobalObjects: false
-		});
-		ctx.effect(() => async () => {
-			await this.hub?.close();
-			this.server.closeAllConnections();
-			if (this.server.listening) await new Promise((resolve) => {
-				this.server.close(() => {
-					resolve();
-				});
-			});
-		}, "acryl-node-server: close listener and open connections");
-	}
-	/**
-	* `upgradeWebSocket` for the plugin that asks (call it once, in `apply`): `app.get('/ws', upgrade((c) => ({ onMessage(event, ws) { ... } })))`. Checks go in ordinary middleware on the
-	* route, and a handler that returns a `Response` refuses the upgrade with that status before any handshake. Every socket it accepts belongs to the calling plugin: when the plugin
-	* unloads they are closed with 1001 within `websocket.grace` and the handler sees `close` once. Pass `{ textOnly: true }` to drop binary frames. Needs the `ws` package.
-	*/
-	upgrades() {
-		if (!this.hub) {
-			this.hub = new UpgradeHub(this.config.websocket);
-			this.hub.attach(this.server, this.ctx.router);
-		}
-		return this.hub.upgradeWebSocketFor(this.ctx);
-	}
-	/** How many WebSocket connections are open now. */
-	get sockets() {
-		return this.hub?.size ?? 0;
-	}
-	/** The port in use, 0 before the server listens. */
-	get port() {
-		return this.bound;
-	}
-	/** The address clients use. */
-	get url() {
-		return `http://${this.hostname.includes(":") ? `[${this.hostname}]` : this.hostname}:${String(this.bound)}`;
-	}
-	/** Bind, scanning past taken ports. */
-	async listen() {
-		const { port, scan, hostname } = this.config;
-		const last = port === 0 ? 0 : Math.min(65535, port + scan);
-		for (let candidate = port; candidate <= last; candidate += 1) try {
-			await new Promise((resolve, reject) => {
-				const onError = (error) => {
-					reject(error);
-				};
-				this.server.once("error", onError);
-				this.server.listen(candidate, hostname, () => {
-					this.server.off("error", onError);
-					resolve();
-				});
-			});
-			this.bound = this.server.address().port;
-			return;
-		} catch (error) {
-			if (!isPortUnavailable(error)) throw error;
-		}
-		throw new Error(`acryl-node-server: no free port from ${String(port)} to ${String(last)} on ${hostname}`);
-	}
-};
-/**
-* Whether a failed bind means "this port, try the next one". A port another socket holds answers `EADDRINUSE` everywhere. On Windows a port
-* inside a range the system reserves (Hyper-V, WSL and Docker exclude ranges, `netsh interface ipv4 show excludedportrange`) answers
-* `EACCES`, which is a property of that port too; elsewhere `EACCES` means the process may not bind low ports at all, so moving on would
-* only hide the reason.
-*/
-function isPortUnavailable(error, platform = process.platform) {
-	const code = error?.code;
-	return code === "EADDRINUSE" || platform === "win32" && code === "EACCES";
-}
-/** Loads once the server listens, so a plugin that injects `nodeServer` can rely on `url`. A failure to bind fails the plugin. */
-async function apply(ctx, config = {}) {
-	await new NodeServer(ctx, {
-		hostname: "127.0.0.1",
-		port: 0,
-		scan: 20,
-		websocket: {},
-		...config
-	}).listen();
-}
-//#endregion
+import { l as RequestError, n as UpgradeEmitter, r as UpgradeHub, t as testWebSocket } from "../test-websocket-BLeEvybj.js";
+import { t as serveStatic } from "../serve-static-C1Nkj_xB.js";
+import { a as isPortUnavailable, i as inject, n as NodeServer, o as name, r as apply, t as Config } from "../src-LX0E4ec4.js";
 export { Config, NodeServer, RequestError, UpgradeEmitter, UpgradeHub, apply, inject, isPortUnavailable, name, serveStatic, testWebSocket };

package/lib/cordis/router-http.js

@@ -1,5 +1,5 @@
-import { n as UpgradeEmitter, r as UpgradeHub } from "../test-websocket-D8WWqE5G.js";
-import "./node-server.js";
+import { n as UpgradeEmitter, r as UpgradeHub } from "../test-websocket-BLeEvybj.js";
+import "../src-LX0E4ec4.js";
 import { Readable } from "node:stream";
 import { Service } from "@deepseek-ai/cordis";
 import { pipeline } from "node:stream/promises";

package/lib/cordis/router.js

@@ -1,6 +1,6 @@
-import { HTTPException } from "../http-exception.js";
-import { t as Context } from "../context-DDO0cfuP.js";
-import { t as Acryl } from "../app-BM0rTCp7.js";
+import { t as HTTPException } from "../http-exception-MjWkT89V.js";
+import { t as Context } from "../context-CkOh7Ygv.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
 import { n as getConnInfo, t as connectionOf } from "../connection-C7xgP1hP.js";
-import { i as name, n as Router, r as apply, t as Config } from "../src-dy3Fk9tA.js";
+import { i as name, n as Router, r as apply, t as Config } from "../src-BTBm4OPD.js";
 export { Acryl, Config, Context, HTTPException, Router, apply, connectionOf, getConnInfo, name };

package/lib/cordis/state.js

@@ -1,10 +1,10 @@
-import { t as Acryl } from "../app-BM0rTCp7.js";
-import { methodNotAllowed } from "../method-not-allowed.js";
-import { r as streamSSE } from "../streaming-DHST3Scg.js";
-import { loopbackOnly } from "../loopback-only.js";
-import "../helpers-CvTauQT5.js";
-import "../src-dy3Fk9tA.js";
-import "../middleware-CPQ8himN.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
+import { t as methodNotAllowed } from "../method-not-allowed-TO2_hnfl.js";
+import { r as streamSSE } from "../streaming-BlDaph8U.js";
+import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import "../helpers-BEjcdbgw.js";
+import "../src-BTBm4OPD.js";
+import "../middleware-BfG_fp8P.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-state/src/cell.ts
 /** A writable cell. `report` receives anything a listener throws; one failing listener never blocks the others. */

package/lib/{core-CaY8XDZ6.js → core-BOu1jYua.js}

@@ -1,4 +1,4 @@
-import "./app-BM0rTCp7.js";
+import "./app-CQcGWjrk.js";
 //#region ../../plugins/acryl-router/src/core/index.ts
 /**
 * @module

package/lib/cors-CbAQ-8qU.js

@@ -0,0 +1,106 @@
+//#region ../../plugins/acryl-router/src/core/middleware/cors/index.ts
+/**
+* CORS Middleware for Acryl.
+*
+*
+* @param {CORSOptions} [options] - The options for the CORS middleware.
+* @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
+* @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
+* @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
+* @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
+* @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
+* @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use('/api/*', cors())
+* app.use(
+*   '/api2/*',
+*   cors({
+*     origin: 'http://example.com',
+*     allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
+*     allowMethods: ['POST', 'GET', 'OPTIONS'],
+*     exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
+*     maxAge: 600,
+*     credentials: true,
+*   })
+* )
+*
+* app.all('/api/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* app.all('/api2/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* ```
+*/
+const cors = (options) => {
+	const opts = {
+		origin: "*",
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"POST",
+			"DELETE",
+			"PATCH",
+			"QUERY"
+		],
+		allowHeaders: [],
+		exposeHeaders: [],
+		...options
+	};
+	const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+	const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
+	const findAllowOrigin = ((optsOrigin) => {
+		if (typeof optsOrigin === "string") if (optsOrigin === "*") return () => optsOrigin;
+		else return (origin) => optsOrigin === origin ? origin : null;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin) ? origin : null;
+	})(opts.origin);
+	const findAllowMethods = ((optsAllowMethods) => {
+		if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
+		else if (Array.isArray(optsAllowMethods)) {
+			const methodsStr = optsAllowMethods.join(",");
+			return () => methodsStr;
+		} else return () => "";
+	})(opts.allowMethods);
+	return async function cors(c, next) {
+		function set(key, value) {
+			c.res.headers.set(key, value);
+		}
+		const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+		if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
+		if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
+		if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
+		if (c.req.method === "OPTIONS") {
+			if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
+			if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
+			const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+			if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
+			let headersStr = allowHeadersStr;
+			if (!headersStr) {
+				const requestHeaders = c.req.header("Access-Control-Request-Headers");
+				if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
+			}
+			if (headersStr) {
+				set("Access-Control-Allow-Headers", headersStr);
+				c.res.headers.append("Vary", "Access-Control-Request-Headers");
+			}
+			c.res.headers.delete("Content-Length");
+			c.res.headers.delete("Content-Type");
+			return new Response(null, {
+				headers: c.res.headers,
+				status: 204,
+				statusText: "No Content"
+			});
+		}
+		await next();
+		if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
+	};
+};
+//#endregion
+export { cors as t };

package/lib/cors.js

@@ -1,106 +1,2 @@
-//#region ../../plugins/acryl-router/src/core/middleware/cors/index.ts
-/**
-* CORS Middleware for Acryl.
-*
-*
-* @param {CORSOptions} [options] - The options for the CORS middleware.
-* @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
-* @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
-* @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
-* @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
-* @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
-* @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
-* @returns {MiddlewareHandler} The middleware handler function.
-*
-* @example
-* ```ts
-* const app = new Acryl()
-*
-* app.use('/api/*', cors())
-* app.use(
-*   '/api2/*',
-*   cors({
-*     origin: 'http://example.com',
-*     allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
-*     allowMethods: ['POST', 'GET', 'OPTIONS'],
-*     exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
-*     maxAge: 600,
-*     credentials: true,
-*   })
-* )
-*
-* app.all('/api/abc', (c) => {
-*   return c.json({ success: true })
-* })
-* app.all('/api2/abc', (c) => {
-*   return c.json({ success: true })
-* })
-* ```
-*/
-const cors = (options) => {
-	const opts = {
-		origin: "*",
-		allowMethods: [
-			"GET",
-			"HEAD",
-			"PUT",
-			"POST",
-			"DELETE",
-			"PATCH",
-			"QUERY"
-		],
-		allowHeaders: [],
-		exposeHeaders: [],
-		...options
-	};
-	const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
-	const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
-	const findAllowOrigin = ((optsOrigin) => {
-		if (typeof optsOrigin === "string") if (optsOrigin === "*") return () => optsOrigin;
-		else return (origin) => optsOrigin === origin ? origin : null;
-		else if (typeof optsOrigin === "function") return optsOrigin;
-		else return (origin) => optsOrigin.includes(origin) ? origin : null;
-	})(opts.origin);
-	const findAllowMethods = ((optsAllowMethods) => {
-		if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
-		else if (Array.isArray(optsAllowMethods)) {
-			const methodsStr = optsAllowMethods.join(",");
-			return () => methodsStr;
-		} else return () => "";
-	})(opts.allowMethods);
-	return async function cors(c, next) {
-		function set(key, value) {
-			c.res.headers.set(key, value);
-		}
-		const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
-		if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
-		if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
-		if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
-		if (c.req.method === "OPTIONS") {
-			if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
-			if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
-			const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-			if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
-			let headersStr = allowHeadersStr;
-			if (!headersStr) {
-				const requestHeaders = c.req.header("Access-Control-Request-Headers");
-				if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
-			}
-			if (headersStr) {
-				set("Access-Control-Allow-Headers", headersStr);
-				c.res.headers.append("Vary", "Access-Control-Request-Headers");
-			}
-			c.res.headers.delete("Content-Length");
-			c.res.headers.delete("Content-Type");
-			return new Response(null, {
-				headers: c.res.headers,
-				status: 204,
-				statusText: "No Content"
-			});
-		}
-		await next();
-		if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
-	};
-};
-//#endregion
+import { t as cors } from "./cors-CbAQ-8qU.js";
 export { cors };

package/lib/crypto-iVP-N-tS.js

@@ -0,0 +1,34 @@
+//#region ../../plugins/acryl-router/src/core/utils/crypto.ts
+const sha256 = async (data) => {
+	return await createHash(data, {
+		name: "SHA-256",
+		alias: "sha256"
+	});
+};
+const sha1 = async (data) => {
+	return await createHash(data, {
+		name: "SHA-1",
+		alias: "sha1"
+	});
+};
+const md5 = async (data) => {
+	return await createHash(data, {
+		name: "MD5",
+		alias: "md5"
+	});
+};
+const createHash = async (data, algorithm) => {
+	let sourceBuffer;
+	if (ArrayBuffer.isView(data) || data instanceof ArrayBuffer) sourceBuffer = data;
+	else {
+		if (typeof data === "object") data = JSON.stringify(data);
+		sourceBuffer = new TextEncoder().encode(String(data));
+	}
+	if (crypto && crypto.subtle) {
+		const buffer = await crypto.subtle.digest({ name: algorithm.name }, sourceBuffer);
+		return Array.prototype.map.call(new Uint8Array(buffer), (x) => ("00" + x.toString(16)).slice(-2)).join("");
+	}
+	return null;
+};
+//#endregion
+export { sha256 as i, md5 as n, sha1 as r, createHash as t };

package/lib/csrf-DqqOZtgy.js

@@ -0,0 +1,101 @@
+import { t as HTTPException } from "./http-exception-MjWkT89V.js";
+//#region ../../plugins/acryl-router/src/core/middleware/csrf/index.ts
+const secFetchSiteValues = [
+	"same-origin",
+	"same-site",
+	"none",
+	"cross-site"
+];
+const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
+const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
+const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+/**
+* CSRF Protection Middleware for Acryl.
+*
+* Protects against Cross-Site Request Forgery attacks by validating request origins
+* and sec-fetch-site headers. The request is allowed if either validation passes.
+*
+*
+* @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+* @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+*   Allowed origins for requests.
+*   - string: Single allowed origin (e.g., 'https://example.com')
+*   - string[]: Multiple allowed origins
+*   - function: Custom validation logic
+*   - Default: Only same origin as the request URL
+* @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+*   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+*   - string: Single allowed value (e.g., 'same-origin')
+*   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+*   - function: Custom validation with access to context
+*   - Default: Only allows 'same-origin'
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* // Default: both origin and sec-fetch-site validation
+* app.use('*', csrf())
+*
+* // Allow specific origins
+* app.use('*', csrf({ origin: 'https://example.com' }))
+* app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+*
+* // Allow specific sec-fetch-site values
+* app.use('*', csrf({ secFetchSite: 'same-origin' }))
+* app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+*
+* // Dynamic sec-fetch-site validation
+* app.use('*', csrf({
+*   secFetchSite: (secFetchSite, c) => {
+*     // Always allow same-origin
+*     if (secFetchSite === 'same-origin') return true
+*     // Allow cross-site for webhook endpoints
+*     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+*       return true
+*     }
+*     return false
+*   }
+* }))
+*
+* // Dynamic origin validation
+* app.use('*', csrf({
+*   origin: (origin, c) => {
+*     // Allow same origin
+*     if (origin === new URL(c.req.url).origin) return true
+*     // Allow specific trusted domains
+*     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+*   }
+* }))
+* ```
+*/
+const csrf = (options) => {
+	const originHandler = ((optsOrigin) => {
+		if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
+		else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin);
+	})(options?.origin);
+	const isAllowedOrigin = async (origin, c) => {
+		if (origin === void 0) return false;
+		return await originHandler(origin, c);
+	};
+	const secFetchSiteHandler = ((optsSecFetchSite) => {
+		if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
+		else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
+		else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
+		else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
+	})(options?.secFetchSite);
+	const isAllowedSecFetchSite = async (secFetchSite, c) => {
+		if (secFetchSite === void 0) return false;
+		if (!isSecFetchSite(secFetchSite)) return false;
+		return await secFetchSiteHandler(secFetchSite, c);
+	};
+	return async function csrf(c, next) {
+		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) throw new HTTPException(403, { res: new Response("Forbidden", { status: 403 }) });
+		await next();
+	};
+};
+//#endregion
+export { csrf as t };