acrylblends 0.4.0 → 0.5.0

package/lib/cors.js

@@ -0,0 +1,106 @@
+//#region ../../plugins/acryl-router/src/core/middleware/cors/index.ts
+/**
+* CORS Middleware for Acryl.
+*
+*
+* @param {CORSOptions} [options] - The options for the CORS middleware.
+* @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
+* @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
+* @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
+* @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
+* @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
+* @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use('/api/*', cors())
+* app.use(
+*   '/api2/*',
+*   cors({
+*     origin: 'http://example.com',
+*     allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
+*     allowMethods: ['POST', 'GET', 'OPTIONS'],
+*     exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
+*     maxAge: 600,
+*     credentials: true,
+*   })
+* )
+*
+* app.all('/api/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* app.all('/api2/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* ```
+*/
+const cors = (options) => {
+	const opts = {
+		origin: "*",
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"POST",
+			"DELETE",
+			"PATCH",
+			"QUERY"
+		],
+		allowHeaders: [],
+		exposeHeaders: [],
+		...options
+	};
+	const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+	const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
+	const findAllowOrigin = ((optsOrigin) => {
+		if (typeof optsOrigin === "string") if (optsOrigin === "*") return () => optsOrigin;
+		else return (origin) => optsOrigin === origin ? origin : null;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin) ? origin : null;
+	})(opts.origin);
+	const findAllowMethods = ((optsAllowMethods) => {
+		if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
+		else if (Array.isArray(optsAllowMethods)) {
+			const methodsStr = optsAllowMethods.join(",");
+			return () => methodsStr;
+		} else return () => "";
+	})(opts.allowMethods);
+	return async function cors(c, next) {
+		function set(key, value) {
+			c.res.headers.set(key, value);
+		}
+		const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+		if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
+		if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
+		if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
+		if (c.req.method === "OPTIONS") {
+			if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
+			if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
+			const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+			if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
+			let headersStr = allowHeadersStr;
+			if (!headersStr) {
+				const requestHeaders = c.req.header("Access-Control-Request-Headers");
+				if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
+			}
+			if (headersStr) {
+				set("Access-Control-Allow-Headers", headersStr);
+				c.res.headers.append("Vary", "Access-Control-Request-Headers");
+			}
+			c.res.headers.delete("Content-Length");
+			c.res.headers.delete("Content-Type");
+			return new Response(null, {
+				headers: c.res.headers,
+				status: 204,
+				statusText: "No Content"
+			});
+		}
+		await next();
+		if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
+	};
+};
+//#endregion
+export { cors };

package/lib/csrf.d.ts

@@ -0,0 +1,75 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/csrf/index.d.ts
+type IsAllowedOriginHandler = (origin: string, context: Context) => boolean | Promise<boolean>;
+declare const secFetchSiteValues: readonly ["same-origin", "same-site", "none", "cross-site"];
+type SecFetchSite = (typeof secFetchSiteValues)[number];
+type IsAllowedSecFetchSiteHandler = (secFetchSite: SecFetchSite, context: Context) => boolean | Promise<boolean>;
+interface CSRFOptions {
+  origin?: string | string[] | IsAllowedOriginHandler;
+  secFetchSite?: SecFetchSite | SecFetchSite[] | IsAllowedSecFetchSiteHandler;
+}
+/**
+ * CSRF Protection Middleware for Acryl.
+ *
+ * Protects against Cross-Site Request Forgery attacks by validating request origins
+ * and sec-fetch-site headers. The request is allowed if either validation passes.
+ *
+ *
+ * @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+ * @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+ *   Allowed origins for requests.
+ *   - string: Single allowed origin (e.g., 'https://example.com')
+ *   - string[]: Multiple allowed origins
+ *   - function: Custom validation logic
+ *   - Default: Only same origin as the request URL
+ * @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+ *   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+ *   - string: Single allowed value (e.g., 'same-origin')
+ *   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+ *   - function: Custom validation with access to context
+ *   - Default: Only allows 'same-origin'
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * // Default: both origin and sec-fetch-site validation
+ * app.use('*', csrf())
+ *
+ * // Allow specific origins
+ * app.use('*', csrf({ origin: 'https://example.com' }))
+ * app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+ *
+ * // Allow specific sec-fetch-site values
+ * app.use('*', csrf({ secFetchSite: 'same-origin' }))
+ * app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+ *
+ * // Dynamic sec-fetch-site validation
+ * app.use('*', csrf({
+ *   secFetchSite: (secFetchSite, c) => {
+ *     // Always allow same-origin
+ *     if (secFetchSite === 'same-origin') return true
+ *     // Allow cross-site for webhook endpoints
+ *     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+ *       return true
+ *     }
+ *     return false
+ *   }
+ * }))
+ *
+ * // Dynamic origin validation
+ * app.use('*', csrf({
+ *   origin: (origin, c) => {
+ *     // Allow same origin
+ *     if (origin === new URL(c.req.url).origin) return true
+ *     // Allow specific trusted domains
+ *     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+ *   }
+ * }))
+ * ```
+ */
+declare const csrf: (options?: CSRFOptions) => MiddlewareHandler;
+//#endregion
+export { csrf };

package/lib/csrf.js

@@ -0,0 +1,101 @@
+import { HTTPException } from "./http-exception.js";
+//#region ../../plugins/acryl-router/src/core/middleware/csrf/index.ts
+const secFetchSiteValues = [
+	"same-origin",
+	"same-site",
+	"none",
+	"cross-site"
+];
+const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
+const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
+const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+/**
+* CSRF Protection Middleware for Acryl.
+*
+* Protects against Cross-Site Request Forgery attacks by validating request origins
+* and sec-fetch-site headers. The request is allowed if either validation passes.
+*
+*
+* @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+* @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+*   Allowed origins for requests.
+*   - string: Single allowed origin (e.g., 'https://example.com')
+*   - string[]: Multiple allowed origins
+*   - function: Custom validation logic
+*   - Default: Only same origin as the request URL
+* @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+*   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+*   - string: Single allowed value (e.g., 'same-origin')
+*   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+*   - function: Custom validation with access to context
+*   - Default: Only allows 'same-origin'
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* // Default: both origin and sec-fetch-site validation
+* app.use('*', csrf())
+*
+* // Allow specific origins
+* app.use('*', csrf({ origin: 'https://example.com' }))
+* app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+*
+* // Allow specific sec-fetch-site values
+* app.use('*', csrf({ secFetchSite: 'same-origin' }))
+* app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+*
+* // Dynamic sec-fetch-site validation
+* app.use('*', csrf({
+*   secFetchSite: (secFetchSite, c) => {
+*     // Always allow same-origin
+*     if (secFetchSite === 'same-origin') return true
+*     // Allow cross-site for webhook endpoints
+*     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+*       return true
+*     }
+*     return false
+*   }
+* }))
+*
+* // Dynamic origin validation
+* app.use('*', csrf({
+*   origin: (origin, c) => {
+*     // Allow same origin
+*     if (origin === new URL(c.req.url).origin) return true
+*     // Allow specific trusted domains
+*     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+*   }
+* }))
+* ```
+*/
+const csrf = (options) => {
+	const originHandler = ((optsOrigin) => {
+		if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
+		else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin);
+	})(options?.origin);
+	const isAllowedOrigin = async (origin, c) => {
+		if (origin === void 0) return false;
+		return await originHandler(origin, c);
+	};
+	const secFetchSiteHandler = ((optsSecFetchSite) => {
+		if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
+		else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
+		else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
+		else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
+	})(options?.secFetchSite);
+	const isAllowedSecFetchSite = async (secFetchSite, c) => {
+		if (secFetchSite === void 0) return false;
+		if (!isSecFetchSite(secFetchSite)) return false;
+		return await secFetchSiteHandler(secFetchSite, c);
+	};
+	return async function csrf(c, next) {
+		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) throw new HTTPException(403, { res: new Response("Forbidden", { status: 403 }) });
+		await next();
+	};
+};
+//#endregion
+export { csrf };

package/lib/etag.d.ts

@@ -0,0 +1,40 @@
+import { I as MiddlewareHandler } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/etag/index.d.ts
+type ETagOptions = {
+  retainedHeaders?: string[];
+  weak?: boolean;
+  generateDigest?: (body: Uint8Array<ArrayBuffer>) => ArrayBuffer | Promise<ArrayBuffer>;
+};
+/**
+ * Default headers to pass through on 304 responses. From the spec:
+ * > The response must not contain a body and must include the headers that
+ * > would have been sent in an equivalent 200 OK response: Cache-Control,
+ * > Content-Location, Date, ETag, Expires, and Vary.
+ */
+declare const RETAINED_304_HEADERS: string[];
+/**
+ * ETag Middleware for Acryl.
+ *
+ *
+ * @param {ETagOptions} [options] - The options for the ETag middleware.
+ * @param {boolean} [options.weak=false] - Define using or not using a weak validation. If true is set, then `W/` is added to the prefix of the value.
+ * @param {string[]} [options.retainedHeaders=RETAINED_304_HEADERS] - The headers that you want to retain in the 304 Response.
+ * @param {function(Uint8Array): ArrayBuffer | Promise<ArrayBuffer>} [options.generateDigest] -
+ * A custom digest generation function. By default, it uses 'SHA-1'
+ * This function is called with the response body as a `Uint8Array` and should return a hash as an `ArrayBuffer` or a Promise of one.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * app.use('/etag/*', etag())
+ * app.get('/etag/abc', (c) => {
+ *   return c.text('Acryl is hot')
+ * })
+ * ```
+ */
+declare const etag: (options?: ETagOptions) => MiddlewareHandler;
+//#endregion
+export { RETAINED_304_HEADERS, etag };

package/lib/etag.js

@@ -0,0 +1,135 @@
+//#region ../../plugins/acryl-router/src/core/middleware/etag/digest.ts
+const mergeBuffers = (buffer1, buffer2) => {
+	if (!buffer1) return buffer2;
+	const merged = new Uint8Array(new ArrayBuffer(buffer1.byteLength + buffer2.byteLength));
+	merged.set(new Uint8Array(buffer1), 0);
+	merged.set(buffer2, buffer1.byteLength);
+	return merged;
+};
+const CHUNK_SIZE = 256 * 1024;
+const generateDigest = async (stream, generator) => {
+	if (!stream) return null;
+	let result = void 0;
+	let chunk;
+	let chunkLength = 0;
+	const digest = async (body) => {
+		result = await generator(mergeBuffers(result, body));
+	};
+	const reader = stream.getReader();
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		let offset = 0;
+		while (offset < value.byteLength) {
+			const remaining = value.byteLength - offset;
+			if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+				await digest(value.subarray(offset, offset + CHUNK_SIZE));
+				offset += CHUNK_SIZE;
+				continue;
+			}
+			const requiredLength = chunkLength + remaining;
+			if (requiredLength < CHUNK_SIZE) {
+				if (!chunk) chunk = value.slice(offset);
+				else {
+					if (chunk.byteLength < requiredLength) {
+						const nextChunk = new Uint8Array(new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2))));
+						nextChunk.set(chunk.subarray(0, chunkLength));
+						chunk = nextChunk;
+					}
+					chunk.set(value.subarray(offset), chunkLength);
+				}
+				chunkLength = requiredLength;
+				break;
+			}
+			const length = CHUNK_SIZE - chunkLength;
+			if (chunk?.byteLength !== CHUNK_SIZE) {
+				const nextChunk = new Uint8Array(/* @__PURE__ */ new ArrayBuffer(CHUNK_SIZE));
+				if (chunk) nextChunk.set(chunk.subarray(0, chunkLength));
+				chunk = nextChunk;
+			}
+			chunk.set(value.subarray(offset, offset + length), chunkLength);
+			await digest(chunk);
+			chunkLength = 0;
+			offset += length;
+		}
+	}
+	if (chunk && chunkLength > 0) await digest(chunk.subarray(0, chunkLength));
+	if (!result) return null;
+	return Array.prototype.map.call(new Uint8Array(result), (x) => x.toString(16).padStart(2, "0")).join("");
+};
+//#endregion
+//#region ../../plugins/acryl-router/src/core/middleware/etag/index.ts
+/**
+* Default headers to pass through on 304 responses. From the spec:
+* > The response must not contain a body and must include the headers that
+* > would have been sent in an equivalent 200 OK response: Cache-Control,
+* > Content-Location, Date, ETag, Expires, and Vary.
+*/
+const RETAINED_304_HEADERS = [
+	"cache-control",
+	"content-location",
+	"date",
+	"etag",
+	"expires",
+	"vary"
+];
+const stripWeak = (tag) => tag.replace(/^W\//, "");
+function etagMatches(etag, ifNoneMatch) {
+	return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag));
+}
+function initializeGenerator(generator) {
+	if (!generator) {
+		if (crypto && crypto.subtle) generator = (body) => crypto.subtle.digest({ name: "SHA-1" }, body);
+	}
+	return generator;
+}
+/**
+* ETag Middleware for Acryl.
+*
+*
+* @param {ETagOptions} [options] - The options for the ETag middleware.
+* @param {boolean} [options.weak=false] - Define using or not using a weak validation. If true is set, then `W/` is added to the prefix of the value.
+* @param {string[]} [options.retainedHeaders=RETAINED_304_HEADERS] - The headers that you want to retain in the 304 Response.
+* @param {function(Uint8Array): ArrayBuffer | Promise<ArrayBuffer>} [options.generateDigest] -
+* A custom digest generation function. By default, it uses 'SHA-1'
+* This function is called with the response body as a `Uint8Array` and should return a hash as an `ArrayBuffer` or a Promise of one.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use('/etag/*', etag())
+* app.get('/etag/abc', (c) => {
+*   return c.text('Acryl is hot')
+* })
+* ```
+*/
+const etag = (options) => {
+	const retainedHeaders = new Set((options?.retainedHeaders ?? RETAINED_304_HEADERS).map((header) => header.toLowerCase()));
+	const weak = options?.weak ?? false;
+	const generator = initializeGenerator(options?.generateDigest);
+	return async function etag(c, next) {
+		const ifNoneMatch = c.req.header("If-None-Match") ?? null;
+		await next();
+		if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) return;
+		const res = c.res;
+		let etag = res.headers.get("ETag");
+		if (!etag) {
+			if (!generator) return;
+			const hash = await generateDigest(res.clone().body, generator);
+			if (hash === null) return;
+			etag = weak ? `W/"${hash}"` : `"${hash}"`;
+		}
+		if (ifNoneMatch === "*" || etagMatches(etag, ifNoneMatch)) {
+			c.res = new Response(null, {
+				status: 304,
+				statusText: "Not Modified",
+				headers: { ETag: etag }
+			});
+			for (const key of Array.from(c.res.headers.keys())) if (!retainedHeaders.has(key.toLowerCase())) c.res.headers.delete(key);
+		} else c.res.headers.set("ETag", etag);
+	};
+};
+//#endregion
+export { RETAINED_304_HEADERS, etag };

package/lib/factory.d.ts

@@ -0,0 +1,35 @@
+import { A as Input, I as MiddlewareHandler, M as IntersectNonAnyTypes, T as H, _ as Env, et as AcrylOptions, k as HandlerResponse } from "./context-Bm7rI-oK.js";
+import { t as Acryl } from "./app-CmAYW1Al.js";
+
+//#region ../../plugins/acryl-router/src/core/helper/factory/index.d.ts
+type InitApp<E extends Env = Env> = (app: Acryl<E>) => void;
+interface CreateHandlersInterface<E extends Env, P extends string> {
+  <I extends Input = {}, R extends HandlerResponse<any> = any, E2 extends Env = E>(handler1: H<E2, P, I, R>): [H<E2, P, I, R>];
+  <I extends Input = {}, I2 extends Input = I, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>): [H<E2, P, I, R>, H<E3, P, I2, R2>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>, H<E6, P, I5, R5>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, I6 extends Input = I & I2 & I3 & I4 & I5, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, R6 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>, E7 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>, handler6: H<E7, P, I6, R6>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>, H<E6, P, I5, R5>, H<E7, P, I6, R6>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, I6 extends Input = I & I2 & I3 & I4 & I5, I7 extends Input = I & I2 & I3 & I4 & I5 & I6, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, R6 extends HandlerResponse<any> = any, R7 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>, E7 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6]>, E8 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>, handler6: H<E7, P, I6, R6>, handler7: H<E8, P, I7, R7>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>, H<E6, P, I5, R5>, H<E7, P, I6, R6>, H<E8, P, I7, R7>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, I6 extends Input = I & I2 & I3 & I4 & I5, I7 extends Input = I & I2 & I3 & I4 & I5 & I6, I8 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, R6 extends HandlerResponse<any> = any, R7 extends HandlerResponse<any> = any, R8 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>, E7 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6]>, E8 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7]>, E9 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>, handler6: H<E7, P, I6, R6>, handler7: H<E8, P, I7, R7>, handler8: H<E9, P, I8, R8>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>, H<E6, P, I5, R5>, H<E7, P, I6, R6>, H<E8, P, I7, R7>, H<E9, P, I8, R8>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, I6 extends Input = I & I2 & I3 & I4 & I5, I7 extends Input = I & I2 & I3 & I4 & I5 & I6, I8 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7, I9 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7 & I8, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, R6 extends HandlerResponse<any> = any, R7 extends HandlerResponse<any> = any, R8 extends HandlerResponse<any> = any, R9 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>, E7 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6]>, E8 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7]>, E9 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8]>, E10 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8, E9]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>, handler6: H<E7, P, I6, R6>, handler7: H<E8, P, I7, R7>, handler8: H<E9, P, I8, R8>, handler9: H<E10, P, I9, R9>): [H<E2, P, I, R>, H<E3, P, I2, R>, H<E4, P, I3, R>, H<E5, P, I4, R>, H<E6, P, I5, R>, H<E7, P, I6, R>, H<E8, P, I7, R>, H<E9, P, I8, R>, H<E10, P, I9, R>];
+  <I extends Input = {}, I2 extends Input = I, I3 extends Input = I & I2, I4 extends Input = I & I2 & I3, I5 extends Input = I & I2 & I3 & I4, I6 extends Input = I & I2 & I3 & I4 & I5, I7 extends Input = I & I2 & I3 & I4 & I5 & I6, I8 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7, I9 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7 & I8, I10 extends Input = I & I2 & I3 & I4 & I5 & I6 & I7 & I8 & I9, R extends HandlerResponse<any> = any, R2 extends HandlerResponse<any> = any, R3 extends HandlerResponse<any> = any, R4 extends HandlerResponse<any> = any, R5 extends HandlerResponse<any> = any, R6 extends HandlerResponse<any> = any, R7 extends HandlerResponse<any> = any, R8 extends HandlerResponse<any> = any, R9 extends HandlerResponse<any> = any, R10 extends HandlerResponse<any> = any, E2 extends Env = E, E3 extends Env = IntersectNonAnyTypes<[E, E2]>, E4 extends Env = IntersectNonAnyTypes<[E, E2, E3]>, E5 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4]>, E6 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5]>, E7 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6]>, E8 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7]>, E9 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8]>, E10 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8, E9]>, E11 extends Env = IntersectNonAnyTypes<[E, E2, E3, E4, E5, E6, E7, E8, E9, E10]>>(handler1: H<E2, P, I, R>, handler2: H<E3, P, I2, R2>, handler3: H<E4, P, I3, R3>, handler4: H<E5, P, I4, R4>, handler5: H<E6, P, I5, R5>, handler6: H<E7, P, I6, R6>, handler7: H<E8, P, I7, R7>, handler8: H<E9, P, I8, R8>, handler9: H<E10, P, I9, R9>, handler10: H<E11, P, I10, R10>): [H<E2, P, I, R>, H<E3, P, I2, R2>, H<E4, P, I3, R3>, H<E5, P, I4, R4>, H<E6, P, I5, R5>, H<E7, P, I6, R6>, H<E8, P, I7, R7>, H<E9, P, I8, R8>, H<E10, P, I9, R9>, H<E11, P, I10, R10>];
+}
+declare class Factory<E extends Env = Env, P extends string = string> {
+  #private;
+  private initApp?;
+  constructor(init?: {
+    initApp?: InitApp<E>;
+    defaultAppOptions?: AcrylOptions<E>;
+  });
+  createApp: (options?: AcrylOptions<E>) => Acryl<E>;
+  createMiddleware: <I extends Input = {}, R extends HandlerResponse<any> | void = void>(middleware: MiddlewareHandler<E, P, I, R extends void ? Response : R>) => MiddlewareHandler<E, P, I, R extends void ? Response : R>;
+  createHandlers: CreateHandlersInterface<E, P>;
+}
+declare const createFactory: <E extends Env = Env, P extends string = string>(init?: {
+  initApp?: InitApp<E>;
+  defaultAppOptions?: AcrylOptions<E>;
+}) => Factory<E, P>;
+declare const createMiddleware: <E extends Env = any, P extends string = string, I extends Input = {}, R extends HandlerResponse<any> | void = void>(middleware: MiddlewareHandler<E, P, I, R extends void ? Response : R>) => MiddlewareHandler<E, P, I, R extends void ? Response : R>;
+//#endregion
+export { CreateHandlersInterface, Factory, createFactory, createMiddleware };

package/lib/factory.js

@@ -0,0 +1,30 @@
+import { t as Acryl } from "./app-BM0rTCp7.js";
+//#region ../../plugins/acryl-router/src/core/helper/factory/index.ts
+/**
+* @module
+* Factory Helper for Acryl.
+*/
+var Factory = class {
+	initApp;
+	#defaultAppOptions;
+	constructor(init) {
+		this.initApp = init?.initApp;
+		this.#defaultAppOptions = init?.defaultAppOptions;
+	}
+	createApp = (options) => {
+		const app = new Acryl(options && this.#defaultAppOptions ? {
+			...this.#defaultAppOptions,
+			...options
+		} : options ?? this.#defaultAppOptions);
+		if (this.initApp) this.initApp(app);
+		return app;
+	};
+	createMiddleware = (middleware) => middleware;
+	createHandlers = (...handlers) => {
+		return handlers.filter((handler) => handler !== void 0);
+	};
+};
+const createFactory = (init) => new Factory(init);
+const createMiddleware = (middleware) => middleware;
+//#endregion
+export { Factory, createFactory, createMiddleware };

package/lib/headers-tu2YYN8T.d.ts

@@ -0,0 +1,11 @@
+//#region ../../plugins/acryl-router/src/core/utils/headers.d.ts
+/**
+ * @module
+ * HTTP Headers utility.
+ */
+type RequestHeader = 'A-IM' | 'Accept' | 'Accept-Additions' | 'Accept-CH' | 'Accept-Charset' | 'Accept-Datetime' | 'Accept-Encoding' | 'Accept-Features' | 'Accept-Language' | 'Accept-Patch' | 'Accept-Post' | 'Accept-Query' | 'Accept-Ranges' | 'Accept-Signature' | 'Access-Control' | 'Access-Control-Allow-Credentials' | 'Access-Control-Allow-Headers' | 'Access-Control-Allow-Methods' | 'Access-Control-Allow-Origin' | 'Access-Control-Expose-Headers' | 'Access-Control-Max-Age' | 'Access-Control-Request-Headers' | 'Access-Control-Request-Method' | 'Activate-Storage-Access' | 'Age' | 'Allow' | 'ALPN' | 'Alt-Svc' | 'Alt-Used' | 'Alternates' | 'AMP-Cache-Transform' | 'Apply-To-Redirect-Ref' | 'Authentication-Control' | 'Authentication-Info' | 'Authorization' | 'Available-Dictionary' | 'C-Ext' | 'C-Man' | 'C-Opt' | 'C-PEP' | 'C-PEP-Info' | 'Cache-Control' | 'Cache-Group-Invalidation' | 'Cache-Groups' | 'Cache-Status' | 'Cal-Managed-ID' | 'CalDAV-Timezones' | 'Capsule-Protocol' | 'CDN-Cache-Control' | 'CDN-Loop' | 'Cert-Not-After' | 'Cert-Not-Before' | 'Clear-Site-Data' | 'Client-Cert' | 'Client-Cert-Chain' | 'Close' | 'CMCD-Object' | 'CMCD-Request' | 'CMCD-Session' | 'CMCD-Status' | 'CMSD-Dynamic' | 'CMSD-Static' | 'Concealed-Auth-Export' | 'Configuration-Context' | 'Connection' | 'Content-Base' | 'Content-Digest' | 'Content-Disposition' | 'Content-Encoding' | 'Content-ID' | 'Content-Language' | 'Content-Length' | 'Content-Location' | 'Content-MD5' | 'Content-Range' | 'Content-Script-Type' | 'Content-Security-Policy' | 'Content-Security-Policy-Report-Only' | 'Content-Style-Type' | 'Content-Type' | 'Content-Version' | 'Cookie' | 'Cookie2' | 'Cross-Origin-Embedder-Policy' | 'Cross-Origin-Embedder-Policy-Report-Only' | 'Cross-Origin-Opener-Policy' | 'Cross-Origin-Opener-Policy-Report-Only' | 'Cross-Origin-Resource-Policy' | 'CTA-Common-Access-Token' | 'DASL' | 'Date' | 'DAV' | 'Default-Style' | 'Delta-Base' | 'Deprecation' | 'Depth' | 'Derived-From' | 'Destination' | 'Detached-JWS' | 'Differential-ID' | 'Dictionary-ID' | 'Digest' | 'DPoP' | 'DPoP-Nonce' | 'Early-Data' | 'EDIINT-Features' | 'ETag' | 'Expect' | 'Expect-CT' | 'Expires' | 'Ext' | 'Forwarded' | 'From' | 'GetProfile' | 'Hobareg' | 'Host' | 'HTTP2-Settings' | 'If' | 'If-Match' | 'If-Modified-Since' | 'If-None-Match' | 'If-Range' | 'If-Schedule-Tag-Match' | 'If-Unmodified-Since' | 'IM' | 'Include-Referred-Token-Binding-ID' | 'Incremental' | 'Isolation' | 'Keep-Alive' | 'Label' | 'Last-Event-ID' | 'Last-Modified' | 'Link' | 'Link-Template' | 'Location' | 'Lock-Token' | 'Man' | 'Max-Forwards' | 'Memento-Datetime' | 'Meter' | 'Method-Check' | 'Method-Check-Expires' | 'MIME-Version' | 'Negotiate' | 'NEL' | 'OData-EntityId' | 'OData-Isolation' | 'OData-MaxVersion' | 'OData-Version' | 'Opt' | 'Optional-WWW-Authenticate' | 'Ordering-Type' | 'Origin' | 'Origin-Agent-Cluster' | 'OSCORE' | 'OSLC-Core-Version' | 'Overwrite' | 'P3P' | 'PEP' | 'PEP-Info' | 'Permissions-Policy' | 'PICS-Label' | 'Ping-From' | 'Ping-To' | 'Position' | 'Pragma' | 'Prefer' | 'Preference-Applied' | 'Priority' | 'ProfileObject' | 'Protocol' | 'Protocol-Info' | 'Protocol-Query' | 'Protocol-Request' | 'Proxy-Authenticate' | 'Proxy-Authentication-Info' | 'Proxy-Authorization' | 'Proxy-Features' | 'Proxy-Instruction' | 'Proxy-Status' | 'Public' | 'Public-Key-Pins' | 'Public-Key-Pins-Report-Only' | 'Range' | 'Redirect-Ref' | 'Referer' | 'Referer-Root' | 'Referrer-Policy' | 'Refresh' | 'Repeatability-Client-ID' | 'Repeatability-First-Sent' | 'Repeatability-Request-ID' | 'Repeatability-Result' | 'Replay-Nonce' | 'Reporting-Endpoints' | 'Repr-Digest' | 'Retry-After' | 'Safe' | 'Schedule-Reply' | 'Schedule-Tag' | 'Sec-Fetch-Dest' | 'Sec-Fetch-Mode' | 'Sec-Fetch-Site' | 'Sec-Fetch-Storage-Access' | 'Sec-Fetch-User' | 'Sec-GPC' | 'Sec-Purpose' | 'Sec-Token-Binding' | 'Sec-WebSocket-Accept' | 'Sec-WebSocket-Extensions' | 'Sec-WebSocket-Key' | 'Sec-WebSocket-Protocol' | 'Sec-WebSocket-Version' | 'Security-Scheme' | 'Server' | 'Server-Timing' | 'Set-Cookie' | 'Set-Cookie2' | 'Set-Txn' | 'SetProfile' | 'Signature' | 'Signature-Input' | 'SLUG' | 'SoapAction' | 'Status-URI' | 'Strict-Transport-Security' | 'Sunset' | 'Surrogate-Capability' | 'Surrogate-Control' | 'TCN' | 'TE' | 'Timeout' | 'Timing-Allow-Origin' | 'Topic' | 'Traceparent' | 'Tracestate' | 'Trailer' | 'Transfer-Encoding' | 'TTL' | 'Unencoded-Digest' | 'Upgrade' | 'Urgency' | 'URI' | 'Use-As-Dictionary' | 'User-Agent' | 'Variant-Vary' | 'Vary' | 'Via' | 'Want-Content-Digest' | 'Want-Digest' | 'Want-Repr-Digest' | 'Want-Unencoded-Digest' | 'Warning' | 'WWW-Authenticate' | 'X-Content-Type-Options' | 'X-Frame-Options';
+type ResponseHeader = 'Accept-Query' | 'Access-Control-Allow-Credentials' | 'Access-Control-Allow-Headers' | 'Access-Control-Allow-Methods' | 'Access-Control-Allow-Origin' | 'Access-Control-Expose-Headers' | 'Access-Control-Max-Age' | 'Activate-Storage-Access' | 'Age' | 'Allow' | 'Cache-Control' | 'Cache-Group-Invalidation' | 'Cache-Groups' | 'Clear-Site-Data' | 'Content-Disposition' | 'Content-Encoding' | 'Content-Language' | 'Content-Length' | 'Content-Location' | 'Content-Range' | 'Content-Security-Policy' | 'Content-Security-Policy-Report-Only' | 'Content-Type' | 'Cookie' | 'Cross-Origin-Embedder-Policy' | 'Cross-Origin-Opener-Policy' | 'Cross-Origin-Resource-Policy' | 'Date' | 'ETag' | 'Expires' | 'Incremental' | 'Last-Modified' | 'Location' | 'Permissions-Policy' | 'Pragma' | 'Retry-After' | 'Save-Data' | 'Sec-CH-Prefers-Color-Scheme' | 'Sec-CH-Prefers-Reduced-Motion' | 'Sec-CH-UA' | 'Sec-CH-UA-Arch' | 'Sec-CH-UA-Bitness' | 'Sec-CH-UA-Form-Factor' | 'Sec-CH-UA-Full-Version' | 'Sec-CH-UA-Full-Version-List' | 'Sec-CH-UA-Mobile' | 'Sec-CH-UA-Model' | 'Sec-CH-UA-Platform' | 'Sec-CH-UA-Platform-Version' | 'Sec-CH-UA-WoW64' | 'Sec-Fetch-Dest' | 'Sec-Fetch-Mode' | 'Sec-Fetch-Site' | 'Sec-Fetch-User' | 'Sec-GPC' | 'Server' | 'Server-Timing' | 'Service-Worker-Navigation-Preload' | 'Set-Cookie' | 'Set-Txn' | 'Strict-Transport-Security' | 'Timing-Allow-Origin' | 'Trailer' | 'Transfer-Encoding' | 'Unencoded-Digest' | 'Upgrade' | 'Vary' | 'Want-Unencoded-Digest' | 'Warning' | 'WWW-Authenticate' | 'X-Content-Type-Options' | 'X-DNS-Prefetch-Control' | 'X-Frame-Options' | 'X-Permitted-Cross-Domain-Policies' | 'X-Powered-By' | 'X-Robots-Tag' | 'X-XSS-Protection';
+type AcceptHeader = 'Accept' | 'Accept-Charset' | 'Accept-Encoding' | 'Accept-Language' | 'Accept-Patch' | 'Accept-Post' | 'Accept-Ranges';
+type CustomHeader = string & {};
+//#endregion
+export { ResponseHeader as i, CustomHeader as n, RequestHeader as r, AcceptHeader as t };

package/lib/html.d.ts

@@ -0,0 +1,6 @@
+import { HtmlEscapedString, raw } from "./utils/html.js";
+
+//#region ../../plugins/acryl-router/src/core/helper/html/index.d.ts
+declare const html: (strings: TemplateStringsArray, ...values: unknown[]) => HtmlEscapedString | Promise<HtmlEscapedString>;
+//#endregion
+export { html, raw };

package/lib/html.js

@@ -0,0 +1,31 @@
+import { escapeToBuffer, raw, resolveCallbackSync, stringBufferToString } from "./utils/html.js";
+//#region ../../plugins/acryl-router/src/core/helper/html/index.ts
+/**
+* @module
+* html Helper for Acryl.
+*/
+const html = (strings, ...values) => {
+	const buffer = [""];
+	for (let i = 0, len = strings.length - 1; i < len; i++) {
+		buffer[0] += strings[i];
+		const children = Array.isArray(values[i]) ? values[i].flat(Infinity) : [values[i]];
+		for (let i = 0, len = children.length; i < len; i++) {
+			const child = children[i];
+			if (typeof child === "string") escapeToBuffer(child, buffer);
+			else if (typeof child === "number") buffer[0] += child;
+			else if (typeof child === "boolean" || child === null || child === void 0) continue;
+			else if (typeof child === "object" && child.isEscaped) if (child.callbacks) buffer.unshift("", child);
+			else {
+				const tmp = child.toString();
+				if (tmp instanceof Promise) buffer.unshift("", tmp);
+				else buffer[0] += tmp;
+			}
+			else if (child instanceof Promise) buffer.unshift("", child);
+			else escapeToBuffer(child.toString(), buffer);
+		}
+	}
+	buffer[0] += strings.at(-1);
+	return buffer.length === 1 ? "callbacks" in buffer ? raw(resolveCallbackSync(raw(buffer[0], buffer.callbacks))) : raw(buffer[0]) : stringBufferToString(buffer, buffer.callbacks);
+};
+//#endregion
+export { html, raw };