acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/src/core/utils/cookie.ts

@@ -0,0 +1,281 @@
+/**
+ * @module
+ * Cookie utility.
+ */
+
+import { tryDecodeURIComponent } from './url.ts'
+import type { BufferSource } from './types.ts'
+
+export type Cookie = Record<string, string>
+export type SignedCookie = Record<string, string | false>
+
+type PartitionedCookieConstraint =
+  | { partitioned: true; secure: true }
+  | { partitioned?: boolean; secure?: boolean } // reset to default
+type SecureCookieConstraint = { secure: true }
+type HostCookieConstraint = { secure: true; path: '/'; domain?: undefined }
+
+export type CookieOptions = {
+  domain?: string
+  expires?: Date
+  httpOnly?: boolean
+  maxAge?: number
+  path?: string
+  secure?: boolean
+  sameSite?: 'Strict' | 'Lax' | 'None' | 'strict' | 'lax' | 'none'
+  partitioned?: boolean
+  priority?: 'Low' | 'Medium' | 'High' | 'low' | 'medium' | 'high'
+  prefix?: CookiePrefixOptions
+} & PartitionedCookieConstraint
+export type CookiePrefixOptions = 'host' | 'secure'
+
+export type CookieConstraint<Name> = Name extends `__Secure-${string}`
+  ? CookieOptions & SecureCookieConstraint
+  : Name extends `__Host-${string}`
+    ? CookieOptions & HostCookieConstraint
+    : CookieOptions
+
+const algorithm = { name: 'HMAC', hash: 'SHA-256' }
+
+const getCryptoKey = async (secret: string | BufferSource): Promise<CryptoKey> => {
+  const secretBuf = typeof secret === 'string' ? new TextEncoder().encode(secret) : secret
+  return await crypto.subtle.importKey('raw', secretBuf, algorithm, false, ['sign', 'verify'])
+}
+
+const makeSignature = async (value: string, secret: string | BufferSource): Promise<string> => {
+  const key = await getCryptoKey(secret)
+  const signature = await crypto.subtle.sign(algorithm.name, key, new TextEncoder().encode(value))
+  // the returned base64 encoded signature will always be 44 characters long and end with one or two equal signs
+  return btoa(String.fromCharCode(...new Uint8Array(signature)))
+}
+
+const verifySignature = async (
+  base64Signature: string,
+  value: string,
+  secret: CryptoKey
+): Promise<boolean> => {
+  try {
+    const signatureBinStr = atob(base64Signature)
+    const signature = new Uint8Array(signatureBinStr.length)
+    for (let i = 0, len = signatureBinStr.length; i < len; i++) {
+      signature[i] = signatureBinStr.charCodeAt(i)
+    }
+    return await crypto.subtle.verify(algorithm, secret, signature, new TextEncoder().encode(value))
+  } catch {
+    return false
+  }
+}
+
+// all alphanumeric chars and all of _!#$%&'*.^`|~+-
+// (see: https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1)
+// used only when producing cookies via serialize(); parsing uses the relaxed regex below
+const validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/
+
+// all ASCII chars 33-126 except 34, 59, 61, and 92 (i.e. "!" to "~" but not double quote, semicolon, equals, or backslash)
+// the strict RFC 6265 token rule above is a requirement for cookie producers; when consuming
+// the Cookie header we accept the names other producers emit in the wild, e.g. "paraglide:lang"
+// (see: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.6)
+const relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/
+
+// all ASCII chars 32-126 except 34, 59, and 92 (i.e. space to tilde but not double quote, semicolon, or backslash)
+// (see: https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1)
+//
+// note: the spec also prohibits comma and space, but we allow both since they are very common in the real world
+// (see: https://github.com/golang/go/issues/7243)
+const validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/
+
+const trimCookieWhitespace = (value: string): string => {
+  let start = 0
+  let end = value.length
+
+  while (start < end) {
+    const charCode = value.charCodeAt(start)
+    if (charCode !== 0x20 && charCode !== 0x09) {
+      break
+    }
+    start++
+  }
+
+  while (end > start) {
+    const charCode = value.charCodeAt(end - 1)
+    if (charCode !== 0x20 && charCode !== 0x09) {
+      break
+    }
+    end--
+  }
+
+  return start === 0 && end === value.length ? value : value.slice(start, end)
+}
+
+export const parse = (cookie: string, name?: string): Cookie => {
+  if (name && cookie.indexOf(name) === -1) {
+    // Fast-path: return immediately if the demanded-key is not in the cookie string
+    return {}
+  }
+  const pairs = cookie.split(';')
+  const parsedCookie: Cookie = Object.create(null)
+  for (const pairStr of pairs) {
+    const valueStartPos = pairStr.indexOf('=')
+    if (valueStartPos === -1) {
+      continue
+    }
+
+    const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos))
+    if (
+      (name && name !== cookieName) ||
+      !relaxedCookieNameRegEx.test(cookieName) ||
+      cookieName in parsedCookie
+    ) {
+      continue
+    }
+
+    let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1))
+    if (cookieValue.startsWith('"') && cookieValue.endsWith('"')) {
+      cookieValue = cookieValue.slice(1, -1)
+    }
+    if (validCookieValueRegEx.test(cookieValue)) {
+      parsedCookie[cookieName] = tryDecodeURIComponent(cookieValue)
+      if (name) {
+        // Fast-path: return only the demanded-key immediately. Other keys are not needed.
+        break
+      }
+    }
+  }
+  return parsedCookie
+}
+
+export const parseSigned = async (
+  cookie: string,
+  secret: string | BufferSource,
+  name?: string
+): Promise<SignedCookie> => {
+  const parsedCookie: SignedCookie = Object.create(null)
+  const secretKey = await getCryptoKey(secret)
+
+  for (const [key, value] of Object.entries(parse(cookie, name))) {
+    const signatureStartPos = value.lastIndexOf('.')
+    if (signatureStartPos < 0) {
+      continue
+    }
+
+    const signedValue = value.substring(0, signatureStartPos)
+    const signature = value.substring(signatureStartPos + 1)
+    if (signature.length !== 44 || !signature.endsWith('=')) {
+      continue
+    }
+
+    const isVerified = await verifySignature(signature, signedValue, secretKey)
+    parsedCookie[key] = isVerified ? signedValue : false
+  }
+
+  return parsedCookie
+}
+
+const _serialize = (name: string, value: string, opt: CookieOptions = {}): string => {
+  if (!validCookieNameRegEx.test(name)) {
+    throw new Error('Invalid cookie name')
+  }
+
+  let cookie = `${name}=${value}`
+
+  if (name.startsWith('__Secure-') && !opt.secure) {
+    // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-4.1.3.1
+    throw new Error('__Secure- Cookie must have Secure attributes')
+  }
+
+  if (name.startsWith('__Host-')) {
+    // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-4.1.3.2
+    if (!opt.secure) {
+      throw new Error('__Host- Cookie must have Secure attributes')
+    }
+
+    if (opt.path !== '/') {
+      throw new Error('__Host- Cookie must have Path attributes with "/"')
+    }
+
+    if (opt.domain) {
+      throw new Error('__Host- Cookie must not have Domain attributes')
+    }
+  }
+
+  for (const key of ['domain', 'path', 'sameSite', 'priority'] as (keyof CookieOptions)[]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key] as string)) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`)
+    }
+  }
+
+  if (opt && typeof opt.maxAge === 'number' && opt.maxAge >= 0) {
+    if (opt.maxAge > 34560000) {
+      // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.6.2
+      throw new Error(
+        'Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.'
+      )
+    }
+    cookie += `; Max-Age=${opt.maxAge | 0}`
+  }
+
+  if (opt.domain && opt.prefix !== 'host') {
+    cookie += `; Domain=${opt.domain}`
+  }
+
+  if (opt.path) {
+    cookie += `; Path=${opt.path}`
+  }
+
+  if (opt.expires) {
+    if (opt.expires.getTime() - Date.now() > 34560000_000) {
+      // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.5
+      throw new Error(
+        'Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.'
+      )
+    }
+    cookie += `; Expires=${opt.expires.toUTCString()}`
+  }
+
+  if (opt.httpOnly) {
+    cookie += '; HttpOnly'
+  }
+
+  if (opt.secure) {
+    cookie += '; Secure'
+  }
+
+  if (opt.sameSite) {
+    cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`
+  }
+
+  if (opt.priority) {
+    cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`
+  }
+
+  if (opt.partitioned) {
+    // https://www.ietf.org/archive/id/draft-cutler-httpbis-partitioned-cookies-01.html#section-2.1
+    if (!opt.secure) {
+      throw new Error('Partitioned Cookie must have Secure attributes')
+    }
+    cookie += '; Partitioned'
+  }
+
+  return cookie
+}
+
+export const serialize = <Name extends string>(
+  name: Name,
+  value: string,
+  opt?: CookieConstraint<Name>
+): string => {
+  value = encodeURIComponent(value)
+  return _serialize(name, value, opt)
+}
+
+export const serializeSigned = async (
+  name: string,
+  value: string,
+  secret: string | BufferSource,
+  opt: CookieOptions = {}
+): Promise<string> => {
+  const signature = await makeSignature(value, secret)
+  value = `${value}.${signature}`
+  value = encodeURIComponent(value)
+  return _serialize(name, value, opt)
+}

package/plugins/acryl-router/src/core/utils/crypto.test.ts

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto'
+import { md5, sha1, sha256 } from './crypto.ts'
+
+describe('crypto', () => {
+  it('sha256', async () => {
+    expect(await sha256('acryl')).toBe(
+      '1722bce316636434b7346179cda6e5918d1265e875548d8393d897d0e8056490'
+    )
+    expect(await sha256('炎')).toBe(
+      '1fddc5a562ee1fbeb4fc6def7d4be4911fcdae4273b02ae3a507b170ba0ea169'
+    )
+    expect(await sha256('abcdedf')).not.toBe('abcdef')
+  })
+
+  it('sha1', async () => {
+    expect(await sha1('acryl')).toBe('a0d04d622e8eee4b96ec3e768158f79849e4feaa')
+    expect(await sha1('炎')).toBe('d56e09ae2421b2b8a0b5ee5fdceaed663c8c9472')
+    expect(await sha1('abcdedf')).not.toBe('abcdef')
+  })
+
+  // MD5 is not part of the WebCrypto standard.
+  // Node.js' Web Crypto API does not support it (But Cloudflare Workers supports it).
+  // We should skip this test in a Node.js environment.
+  it.skip('md5', async () => {
+    expect(await md5('acryl')).toBe('6d6de29f8c2b6b8741b0d549b556de5c')
+    expect(await md5('炎')).toBe('f620d89a5a782c22b4420acb39121be3')
+    expect(await md5('abcdedf')).not.toBe('abcdef')
+  })
+
+  it('Should not be the same values - compare difference objects', async () => {
+    expect(await sha256({ foo: 'bar' })).not.toEqual(
+      await sha256({
+        bar: 'foo',
+      })
+    )
+  })
+
+  it('Should create hash for Buffer', async () => {
+    const hash = createHash('sha256').update(new Uint8Array(1)).digest('hex')
+    expect(await sha256(new Uint8Array(1))).toBe(hash)
+    expect(await sha256(new Uint8Array(1))).not.toEqual(await sha256(new Uint8Array(2)))
+  })
+})

package/plugins/acryl-router/src/core/utils/crypto.ts

@@ -0,0 +1,58 @@
+/**
+ * @module
+ * Crypto utility.
+ */
+
+import type { JSONValue } from './types.ts'
+
+type Algorithm = {
+  name: string
+  alias: string
+}
+
+type Data = string | boolean | number | JSONValue | ArrayBufferView | ArrayBuffer
+
+export const sha256 = async (data: Data): Promise<string | null> => {
+  const algorithm: Algorithm = { name: 'SHA-256', alias: 'sha256' }
+  const hash = await createHash(data, algorithm)
+  return hash
+}
+
+export const sha1 = async (data: Data): Promise<string | null> => {
+  const algorithm: Algorithm = { name: 'SHA-1', alias: 'sha1' }
+  const hash = await createHash(data, algorithm)
+  return hash
+}
+
+export const md5 = async (data: Data): Promise<string | null> => {
+  const algorithm: Algorithm = { name: 'MD5', alias: 'md5' }
+  const hash = await createHash(data, algorithm)
+  return hash
+}
+
+export const createHash = async (data: Data, algorithm: Algorithm): Promise<string | null> => {
+  let sourceBuffer: ArrayBufferView | ArrayBuffer
+
+  if (ArrayBuffer.isView(data) || data instanceof ArrayBuffer) {
+    sourceBuffer = data
+  } else {
+    if (typeof data === 'object') {
+      data = JSON.stringify(data)
+    }
+    sourceBuffer = new TextEncoder().encode(String(data))
+  }
+
+  if (crypto && crypto.subtle) {
+    const buffer = await crypto.subtle.digest(
+      {
+        name: algorithm.name,
+      },
+      sourceBuffer as ArrayBuffer
+    )
+    const hash = Array.prototype.map
+      .call(new Uint8Array(buffer), (x) => ('00' + x.toString(16)).slice(-2))
+      .join('')
+    return hash
+  }
+  return null
+}

package/plugins/acryl-router/src/core/utils/encode.test.ts

@@ -0,0 +1,61 @@
+import { decodeBase64Url, encodeBase64Url } from './encode.ts'
+
+const toURLBase64 = (base64String: string): string =>
+  base64String.replace(/\+|\//g, (m) => ({ '+': '-', '/': '_' })[m] ?? m)
+
+const str2UInt8Array = (s: string): Uint8Array<ArrayBuffer> => {
+  const buffer = new Uint8Array<ArrayBuffer>(new ArrayBuffer(s.length))
+  for (let i = 0, len = buffer.byteLength; i < len; i++) {
+    buffer[i] = s.charCodeAt(i)
+  }
+  return buffer
+}
+
+describe('base64', () => {
+  const utf8Encoder = new TextEncoder()
+  describe.each([
+    // basic
+    [utf8Encoder.encode('Hello, 世界'), 'SGVsbG8sIOS4lueVjA=='],
+    [utf8Encoder.encode('炎'), '54KO'],
+    [utf8Encoder.encode('🔥'), '8J+UpQ=='],
+    [
+      utf8Encoder.encode('http://github.com/acryldev/acryl'),
+      'aHR0cDovL2dpdGh1Yi5jb20vYWNyeWxkZXYvYWNyeWw=',
+    ],
+
+    // RFC 3548 examples
+    [str2UInt8Array('\x14\xfb\x9c\x03\xd9\x7e'), 'FPucA9l+'],
+    [str2UInt8Array('\x14\xfb\x9c\x03\xd9'), 'FPucA9k='],
+    [str2UInt8Array('\x14\xfb\x9c\x03'), 'FPucAw=='],
+
+    // RFC 4648 examples
+    [str2UInt8Array(''), ''],
+    [str2UInt8Array('f'), 'Zg=='],
+    [str2UInt8Array('fo'), 'Zm8='],
+    [str2UInt8Array('foo'), 'Zm9v'],
+    [str2UInt8Array('foob'), 'Zm9vYg=='],
+    [str2UInt8Array('fooba'), 'Zm9vYmE='],
+    [str2UInt8Array('foobar'), 'Zm9vYmFy'],
+
+    // Wikipedia examples
+    [str2UInt8Array('sure.'), 'c3VyZS4='],
+    [str2UInt8Array('sure'), 'c3VyZQ=='],
+    [str2UInt8Array('sur'), 'c3Vy'],
+    [str2UInt8Array('su'), 'c3U='],
+    [str2UInt8Array('leasure.'), 'bGVhc3VyZS4='],
+    [str2UInt8Array('easure.'), 'ZWFzdXJlLg=='],
+    [str2UInt8Array('asure.'), 'YXN1cmUu'],
+    [str2UInt8Array('sure.'), 'c3VyZS4='],
+  ])('%s, %s', (stdDecoded, stdEncoded) => {
+    it('encode', () => {
+      const got = encodeBase64Url(stdDecoded.buffer)
+      const want = toURLBase64(stdEncoded)
+      expect(got).toStrictEqual(want)
+    })
+    it('decode', () => {
+      const got = decodeBase64Url(toURLBase64(stdEncoded))
+      const want = stdDecoded
+      expect(got).toStrictEqual(want)
+    })
+  })
+})

package/plugins/acryl-router/src/core/utils/encode.ts

@@ -0,0 +1,34 @@
+/**
+ * @module
+ * Encode utility.
+ */
+
+export const decodeBase64Url = (str: string): Uint8Array<ArrayBuffer> => {
+  return decodeBase64(str.replace(/_|-/g, (m) => ({ _: '/', '-': '+' })[m] ?? m))
+}
+
+export const encodeBase64Url = (buf: ArrayBufferLike): string =>
+  encodeBase64(buf).replace(/\/|\+/g, (m) => ({ '/': '_', '+': '-' })[m] ?? m)
+
+// This approach is written in MDN.
+// btoa does not support utf-8 characters. So we need a little bit hack.
+export const encodeBase64 = (buf: ArrayBufferLike): string => {
+  let binary = ''
+  const bytes = new Uint8Array(buf)
+  for (let i = 0, len = bytes.length; i < len; i++) {
+    binary += String.fromCharCode(bytes[i])
+  }
+  return btoa(binary)
+}
+
+// atob does not support utf-8 characters. So we need a little bit hack.
+export const decodeBase64 = (str: string): Uint8Array<ArrayBuffer> => {
+  const binary = atob(str)
+  const bytes = new Uint8Array<ArrayBuffer>(new ArrayBuffer(binary.length))
+  const half = binary.length / 2
+  for (let i = 0, j = binary.length - 1; i <= half; i++, j--) {
+    bytes[i] = binary.charCodeAt(i)
+    bytes[j] = binary.charCodeAt(j)
+  }
+  return bytes
+}

package/plugins/acryl-router/src/core/utils/filepath.test.ts

@@ -0,0 +1,78 @@
+import { getFilePath, getFilePathWithoutDefaultDocument } from './filepath.ts'
+
+describe('getFilePathWithoutDefaultDocument', () => {
+  it('Should return file path correctly', async () => {
+    expect(getFilePathWithoutDefaultDocument({ filename: 'foo.txt' })).toBe('foo.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: 'foo.txt', root: 'bar' })).toBe(
+      'bar/foo.txt'
+    )
+
+    expect(getFilePathWithoutDefaultDocument({ filename: '../foo' })).toBeUndefined()
+    expect(getFilePathWithoutDefaultDocument({ filename: '/../foo' })).toBeUndefined()
+    expect(getFilePathWithoutDefaultDocument({ filename: './../foo' })).toBeUndefined()
+    expect(getFilePathWithoutDefaultDocument({ filename: 'foo..bar.txt' })).toBe('foo..bar.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: '/foo..bar.txt' })).toBe('foo..bar.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: './foo..bar.txt' })).toBe('foo..bar.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: './..foo/bar.txt' })).toBe('..foo/bar.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: './foo../bar.txt' })).toBe('foo../bar.txt')
+    expect(getFilePathWithoutDefaultDocument({ filename: './..foo../bar.txt' })).toBe(
+      '..foo../bar.txt'
+    )
+
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('/../foo') })
+    ).toBeUndefined()
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./../foo') })
+    ).toBeUndefined()
+    expect(getFilePathWithoutDefaultDocument({ filename: slashToBackslash('foo..bar.txt') })).toBe(
+      'foo..bar.txt'
+    )
+    expect(getFilePathWithoutDefaultDocument({ filename: slashToBackslash('/foo..bar.txt') })).toBe(
+      'foo..bar.txt'
+    )
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./foo..bar.txt') })
+    ).toBe('foo..bar.txt')
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./..foo/bar.txt') })
+    ).toBe('..foo/bar.txt')
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./foo../bar.txt') })
+    ).toBe('foo../bar.txt')
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./..foo../bar.txt') })
+    ).toBe('..foo../bar.txt')
+
+    // Multiple path segments: every backslash must be normalized, not just the first
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('foo/bar/baz.txt') })
+    ).toBe('foo/bar/baz.txt')
+    expect(
+      getFilePathWithoutDefaultDocument({
+        filename: slashToBackslash('foo/bar/baz.txt'),
+        root: 'assets',
+      })
+    ).toBe('assets/foo/bar/baz.txt')
+  })
+})
+
+describe('getFilePath', () => {
+  it('Should return file path correctly', async () => {
+    expect(getFilePath({ filename: 'foo' })).toBe('foo/index.html')
+
+    expect(getFilePath({ filename: 'foo', root: 'bar' })).toBe('bar/foo/index.html')
+
+    expect(getFilePath({ filename: 'foo', defaultDocument: 'index.txt' })).toBe('foo/index.txt')
+    expect(getFilePath({ filename: 'foo', root: 'bar', defaultDocument: 'index.txt' })).toBe(
+      'bar/foo/index.txt'
+    )
+
+    expect(getFilePath({ filename: 'filename.suffix_index' })).toBe('filename.suffix_index')
+    expect(getFilePath({ filename: 'filename.suffix-index' })).toBe('filename.suffix-index')
+  })
+})
+
+function slashToBackslash(filename: string) {
+  return filename.split('/').join('\\')
+}

package/plugins/acryl-router/src/core/utils/filepath.ts

@@ -0,0 +1,60 @@
+/**
+ * @module
+ * FilePath utility.
+ */
+
+type FilePathOptions = {
+  filename: string
+  root?: string
+  defaultDocument?: string
+}
+
+export const getFilePath = (options: FilePathOptions): string | undefined => {
+  let filename = options.filename
+  const defaultDocument = options.defaultDocument || 'index.html'
+
+  if (filename.endsWith('/')) {
+    // /top/ => /top/index.html
+    filename = filename.concat(defaultDocument)
+  } else if (!filename.match(/\.[a-zA-Z0-9_-]+$/)) {
+    // /top => /top/index.html
+    filename = filename.concat('/' + defaultDocument)
+  }
+
+  const path = getFilePathWithoutDefaultDocument({
+    root: options.root,
+    filename,
+  })
+
+  return path
+}
+
+export const getFilePathWithoutDefaultDocument = (
+  options: Omit<FilePathOptions, 'defaultDocument'>
+): string | undefined => {
+  let root = options.root || ''
+  let filename = options.filename
+
+  if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
+    return
+  }
+
+  // /foo.html => foo.html
+  filename = filename.replace(/^\.?[\/\\]/, '')
+
+  // foo\bar.txt => foo/bar.txt
+  filename = filename.replace(/\\/g, '/')
+
+  // assets/ => assets
+  root = root.replace(/\/$/, '')
+
+  // ./assets/foo.html => assets/foo.html
+  let path = root ? root + '/' + filename : filename
+  path = path.replace(/^\.?\//, '')
+
+  if (root[0] !== '/' && path[0] === '/') {
+    return
+  }
+
+  return path
+}

package/plugins/acryl-router/src/core/utils/handler.ts

@@ -0,0 +1,15 @@
+/**
+ * @module
+ * Handler utility.
+ */
+
+import { COMPOSED_HANDLER } from './constants.ts'
+
+export const isMiddleware = (handler: Function) => handler.length > 1
+export const findTargetHandler = (handler: Function): Function => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return (handler as any)[COMPOSED_HANDLER]
+    ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      findTargetHandler((handler as any)[COMPOSED_HANDLER])
+    : handler
+}