acrylblends 0.4.0 → 0.5.0

package/lib/router/reg-exp-router.d.ts

@@ -0,0 +1,35 @@
+import { a as ParamIndexMap, c as Result, l as Router } from "../router-CvUxUTOq.js";
+
+//#region ../../plugins/acryl-router/src/core/router/reg-exp-router/matcher.d.ts
+type HandlerData<T> = [T, ParamIndexMap][];
+type StaticMap<T> = Record<string, Result<T>>;
+type Matcher<T> = [RegExp, HandlerData<T>[], StaticMap<T>];
+type MatcherMap<T> = Record<string, Matcher<T> | null>;
+declare function match<R extends Router<T>, T>(this: R, method: string, path: string): Result<T>;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/router/reg-exp-router/router.d.ts
+declare class RegExpRouter<T> implements Router<T> {
+  #private;
+  name: string;
+  constructor();
+  add(method: string, path: string, handler: T): void;
+  match: typeof match<Router<T>, T>;
+  protected buildAllMatchers(): MatcherMap<T>;
+}
+//#endregion
+//#region ../../plugins/acryl-router/src/core/router/reg-exp-router/prepared-router.d.ts
+type RelocateMap = Record<string, ([(number | string)[], ParamIndexMap] | [(number | string)[]])[]>;
+declare class PreparedRegExpRouter<T> implements Router<T> {
+  #private;
+  name: string;
+  constructor(matchers: MatcherMap<T>, relocateMap: RelocateMap);
+  add(method: string, path: string, handler: T): void;
+  protected buildAllMatchers(): MatcherMap<T>;
+  match: typeof match<Router<T>, T>;
+}
+declare const buildInitParams: (params: {
+  paths: string[];
+}) => ConstructorParameters<typeof PreparedRegExpRouter>;
+declare const serializeInitParams: (params: ConstructorParameters<typeof PreparedRegExpRouter>) => string;
+//#endregion
+export { PreparedRegExpRouter, RegExpRouter, buildInitParams, serializeInitParams };

package/lib/router/reg-exp-router.js

@@ -0,0 +1,2 @@
+import { i as RegExpRouter, n as buildInitParams, r as serializeInitParams, t as PreparedRegExpRouter } from "../reg-exp-router-DC1R3qoY.js";
+export { PreparedRegExpRouter, RegExpRouter, buildInitParams, serializeInitParams };

package/lib/router/smart-router.d.ts

@@ -0,0 +1,15 @@
+import { c as Result, l as Router } from "../router-CvUxUTOq.js";
+
+//#region ../../plugins/acryl-router/src/core/router/smart-router/router.d.ts
+declare class SmartRouter<T> implements Router<T> {
+  #private;
+  name: string;
+  constructor(init: {
+    routers: Router<T>[];
+  });
+  add(method: string, path: string, handler: T): void;
+  match(method: string, path: string): Result<T>;
+  get activeRouter(): Router<T>;
+}
+//#endregion
+export { SmartRouter };

package/lib/router/smart-router.js

@@ -0,0 +1,2 @@
+import { t as SmartRouter } from "../smart-router-C5CZ5XSM.js";
+export { SmartRouter };

package/lib/router/trie-router.d.ts

@@ -0,0 +1,11 @@
+import { c as Result, l as Router } from "../router-CvUxUTOq.js";
+
+//#region ../../plugins/acryl-router/src/core/router/trie-router/router.d.ts
+declare class TrieRouter<T> implements Router<T> {
+  #private;
+  name: string;
+  add(method: string, path: string, handler: T): void;
+  match(method: string, path: string): Result<T>;
+}
+//#endregion
+export { TrieRouter };

package/lib/router/trie-router.js

@@ -0,0 +1,2 @@
+import { t as TrieRouter } from "../trie-router-CfFbapzL.js";
+export { TrieRouter };

package/lib/router-CvUxUTOq.d.ts

@@ -0,0 +1,99 @@
+//#region ../../plugins/acryl-router/src/core/router.d.ts
+/**
+ * @module
+ * This module provides types definitions and variables for the routers.
+ */
+/**
+ * Constant representing all HTTP methods in uppercase.
+ */
+declare const METHOD_NAME_ALL: "ALL";
+/**
+ * Constant representing all HTTP methods in lowercase.
+ */
+declare const METHOD_NAME_ALL_LOWERCASE: "all";
+/**
+ * Array of supported HTTP methods.
+ */
+declare const METHODS: readonly ["get", "post", "put", "delete", "options", "patch", "query"];
+/**
+ * Error message indicating that a route cannot be added because the matcher is already built.
+ */
+declare const MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is already built.";
+/**
+ * Interface representing a router.
+ *
+ * @template T - The type of the handler.
+ */
+interface Router<T> {
+  /**
+   * The name of the router.
+   */
+  name: string;
+  /**
+   * Adds a route to the router.
+   *
+   * @param method - The HTTP method (e.g., 'get', 'post').
+   * @param path - The path for the route.
+   * @param handler - The handler for the route.
+   */
+  add(method: string, path: string, handler: T): void;
+  /**
+   * Matches a route based on the given method and path.
+   *
+   * @param method - The HTTP method (e.g., 'get', 'post').
+   * @param path - The path to match.
+   * @returns The result of the match.
+   */
+  match(method: string, path: string): Result<T>;
+}
+/**
+ * Type representing a map of parameter indices.
+ */
+type ParamIndexMap = Record<string, number>;
+/**
+ * Type representing a stash of parameters.
+ */
+type ParamStash = string[];
+/**
+ * Type representing a map of parameters.
+ */
+type Params = Record<string, string>;
+/**
+ * Type representing the result of a route match.
+ *
+ * The result can be in one of two formats:
+ * 1. An array of handlers with their corresponding parameter index maps, followed by a parameter stash.
+ * 2. An array of handlers with their corresponding parameter maps.
+ *
+ * Example:
+ *
+ * [[handler, paramIndexMap][], paramArray]
+ * ```typescript
+ * [
+ *   [
+ *     [middlewareA, {}],                     // '*'
+ *     [funcA,       {'id': 0}],              // '/user/:id/*'
+ *     [funcB,       {'id': 0, 'action': 1}], // '/user/:id/:action'
+ *   ],
+ *   ['123', 'abc']
+ * ]
+ * ```
+ *
+ * [[handler, params][]]
+ * ```typescript
+ * [
+ *   [
+ *     [middlewareA, {}],                             // '*'
+ *     [funcA,       {'id': '123'}],                  // '/user/:id/*'
+ *     [funcB,       {'id': '123', 'action': 'abc'}], // '/user/:id/:action'
+ *   ]
+ * ]
+ * ```
+ */
+type Result<T> = [[T, ParamIndexMap][], ParamStash] | [[T, Params][]];
+/**
+ * Error class representing an unsupported path error.
+ */
+declare class UnsupportedPathError extends Error {}
+//#endregion
+export { ParamIndexMap as a, Result as c, METHOD_NAME_ALL_LOWERCASE as i, Router as l, METHODS as n, ParamStash as o, METHOD_NAME_ALL as r, Params as s, MESSAGE_MATCHER_IS_ALREADY_BUILT as t, UnsupportedPathError as u };

package/lib/router.d.ts

@@ -0,0 +1,2 @@
+import { a as ParamIndexMap, c as Result, i as METHOD_NAME_ALL_LOWERCASE, l as Router, n as METHODS, o as ParamStash, r as METHOD_NAME_ALL, s as Params, t as MESSAGE_MATCHER_IS_ALREADY_BUILT, u as UnsupportedPathError } from "./router-CvUxUTOq.js";
+export { MESSAGE_MATCHER_IS_ALREADY_BUILT, METHODS, METHOD_NAME_ALL, METHOD_NAME_ALL_LOWERCASE, ParamIndexMap, ParamStash, Params, Result, Router, UnsupportedPathError };

package/lib/router.js

@@ -0,0 +1,35 @@
+//#region ../../plugins/acryl-router/src/core/router.ts
+/**
+* @module
+* This module provides types definitions and variables for the routers.
+*/
+/**
+* Constant representing all HTTP methods in uppercase.
+*/
+const METHOD_NAME_ALL = "ALL";
+/**
+* Constant representing all HTTP methods in lowercase.
+*/
+const METHOD_NAME_ALL_LOWERCASE = "all";
+/**
+* Array of supported HTTP methods.
+*/
+const METHODS = [
+	"get",
+	"post",
+	"put",
+	"delete",
+	"options",
+	"patch",
+	"query"
+];
+/**
+* Error message indicating that a route cannot be added because the matcher is already built.
+*/
+const MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is already built.";
+/**
+* Error class representing an unsupported path error.
+*/
+var UnsupportedPathError = class extends Error {};
+//#endregion
+export { MESSAGE_MATCHER_IS_ALREADY_BUILT, METHODS, METHOD_NAME_ALL, METHOD_NAME_ALL_LOWERCASE, UnsupportedPathError };

package/lib/schema-validator.d.ts

@@ -0,0 +1,28 @@
+import { I as MiddlewareHandler, Z as ValidationTargets, _ as Env } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/helpers/schema-validator.d.ts
+/** The slice of the Standard Schema interface this needs; Schemastery (what Cordis uses), Zod and Valibot all implement it. */
+interface StandardSchema<T = unknown> {
+  readonly '~standard': {
+    validate(value: unknown): StandardResult<T> | Promise<StandardResult<T>>;
+  };
+}
+type StandardResult<T> = {
+  readonly value: T;
+  readonly issues?: undefined;
+} | {
+  readonly issues: readonly {
+    readonly message: string;
+    readonly path?: readonly unknown[] | undefined;
+  }[];
+};
+/**
+ * The core `validator` driven by a Standard Schema. A failure answers 400 with `{ error, issues }`; success makes the parsed value the
+ * handler's `c.req.valid(target)`, typed by the schema.
+ */
+declare function schemaValidator<Target extends keyof ValidationTargets, Out, E extends Env = Env, P extends string = string>(target: Target, schema: StandardSchema<Out>): MiddlewareHandler<E, P, {
+  in: { [K in Target]: Out };
+  out: { [K in Target]: Out };
+}>;
+//#endregion
+export { StandardSchema, schemaValidator };

package/lib/schema-validator.js

@@ -0,0 +1,22 @@
+import { t as validator } from "./validator-D84mq-dO.js";
+//#region ../../plugins/acryl-router/src/helpers/schema-validator.ts
+const pathOf = (path) => (path ?? []).map((part) => String(typeof part === "object" && part !== null && "key" in part ? part.key : part)).join(".");
+/**
+* The core `validator` driven by a Standard Schema. A failure answers 400 with `{ error, issues }`; success makes the parsed value the
+* handler's `c.req.valid(target)`, typed by the schema.
+*/
+function schemaValidator(target, schema) {
+	return validator(target, async (value, c) => {
+		const result = await schema["~standard"].validate(value);
+		if (result.issues !== void 0) return c.json({
+			error: `invalid ${target}`,
+			issues: result.issues.map((issue) => ({
+				message: issue.message,
+				path: pathOf(issue.path)
+			}))
+		}, 400);
+		return result.value;
+	});
+}
+//#endregion
+export { schemaValidator };

package/lib/secure-headers.d.ts

@@ -0,0 +1,125 @@
+import { I as MiddlewareHandler, t as Context } from "./context-Bm7rI-oK.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/secure-headers/permissions-policy.d.ts
+type PermissionsPolicyDirective = StandardizedFeatures | ProposedFeatures | ExperimentalFeatures;
+/**
+ * These features have been declared in a published version of the respective specification.
+ */
+type StandardizedFeatures = 'accelerometer' | 'ambientLightSensor' | 'attributionReporting' | 'autoplay' | 'battery' | 'bluetooth' | 'camera' | 'chUa' | 'chUaArch' | 'chUaBitness' | 'chUaFullVersion' | 'chUaFullVersionList' | 'chUaHighEntropyValues' | 'chUaMobile' | 'chUaModel' | 'chUaPlatform' | 'chUaPlatformVersion' | 'chUaWow64' | 'computePressure' | 'crossOriginIsolated' | 'directSockets' | 'displayCapture' | 'encryptedMedia' | 'executionWhileNotRendered' | 'executionWhileOutOfViewport' | 'fullscreen' | 'geolocation' | 'gyroscope' | 'hid' | 'identityCredentialsGet' | 'idleDetection' | 'keyboardMap' | 'magnetometer' | 'mediasession' | 'microphone' | 'midi' | 'navigationOverride' | 'otpCredentials' | 'payment' | 'pictureInPicture' | 'publickeyCredentialsGet' | 'screenWakeLock' | 'serial' | 'storageAccess' | 'syncXhr' | 'tools' | 'usb' | 'webShare' | 'windowManagement' | 'xrSpatialTracking';
+/**
+ * These features have been proposed, but the definitions have not yet been integrated into their respective specs.
+ */
+type ProposedFeatures = 'autofill' | 'clipboardRead' | 'clipboardWrite' | 'deferredFetch' | 'gamepad' | 'languageDetector' | 'languageModel' | 'manualText' | 'rewriter' | 'sharedAutofill' | 'speakerSelection' | 'summarizer' | 'translator' | 'writer';
+/**
+ * These features generally have an explainer only, but may be available for experimentation by web developers.
+ */
+type ExperimentalFeatures = 'allScreensCapture' | 'browsingTopics' | 'capturedSurfaceControl' | 'conversionMeasurement' | 'digitalCredentialsCreate' | 'digitalCredentialsGet' | 'focusWithoutUserActivation' | 'joinAdInterestGroup' | 'localFonts' | 'monetization' | 'runAdAuction' | 'smartCard' | 'syncScript' | 'trustTokenRedemption' | 'unload' | 'verticalScroll';
+//#endregion
+//#region ../../plugins/acryl-router/src/core/middleware/secure-headers/secure-headers.d.ts
+type SecureHeadersVariables = {
+  secureHeadersNonce?: string;
+};
+type ContentSecurityPolicyOptionHandler = (ctx: Context, directive: string) => string;
+type ContentSecurityPolicyOptionValue = (string | ContentSecurityPolicyOptionHandler)[];
+interface ContentSecurityPolicyOptions {
+  defaultSrc?: ContentSecurityPolicyOptionValue;
+  baseUri?: ContentSecurityPolicyOptionValue;
+  childSrc?: ContentSecurityPolicyOptionValue;
+  connectSrc?: ContentSecurityPolicyOptionValue;
+  fontSrc?: ContentSecurityPolicyOptionValue;
+  formAction?: ContentSecurityPolicyOptionValue;
+  frameAncestors?: ContentSecurityPolicyOptionValue;
+  frameSrc?: ContentSecurityPolicyOptionValue;
+  imgSrc?: ContentSecurityPolicyOptionValue;
+  manifestSrc?: ContentSecurityPolicyOptionValue;
+  mediaSrc?: ContentSecurityPolicyOptionValue;
+  objectSrc?: ContentSecurityPolicyOptionValue;
+  reportTo?: string;
+  reportUri?: string | string[];
+  sandbox?: ContentSecurityPolicyOptionValue;
+  scriptSrc?: ContentSecurityPolicyOptionValue;
+  scriptSrcAttr?: ContentSecurityPolicyOptionValue;
+  scriptSrcElem?: ContentSecurityPolicyOptionValue;
+  styleSrc?: ContentSecurityPolicyOptionValue;
+  styleSrcAttr?: ContentSecurityPolicyOptionValue;
+  styleSrcElem?: ContentSecurityPolicyOptionValue;
+  upgradeInsecureRequests?: ContentSecurityPolicyOptionValue;
+  workerSrc?: ContentSecurityPolicyOptionValue;
+  requireTrustedTypesFor?: ContentSecurityPolicyOptionValue;
+  trustedTypes?: ContentSecurityPolicyOptionValue;
+}
+interface ReportToOptions {
+  group: string;
+  max_age: number;
+  endpoints: ReportToEndpoint[];
+}
+interface ReportToEndpoint {
+  url: string;
+}
+interface ReportingEndpointOptions {
+  name: string;
+  url: string;
+}
+type PermissionsPolicyValue = '*' | 'self' | 'src' | 'none' | string;
+type PermissionsPolicyOptions = Partial<Record<PermissionsPolicyDirective, PermissionsPolicyValue[] | boolean>>;
+type overridableHeader = boolean | string;
+interface SecureHeadersOptions {
+  contentSecurityPolicy?: ContentSecurityPolicyOptions;
+  contentSecurityPolicyReportOnly?: ContentSecurityPolicyOptions;
+  crossOriginEmbedderPolicy?: overridableHeader;
+  crossOriginResourcePolicy?: overridableHeader;
+  crossOriginOpenerPolicy?: overridableHeader;
+  originAgentCluster?: overridableHeader;
+  referrerPolicy?: overridableHeader;
+  reportingEndpoints?: ReportingEndpointOptions[];
+  reportTo?: ReportToOptions[];
+  strictTransportSecurity?: overridableHeader;
+  xContentTypeOptions?: overridableHeader;
+  xDnsPrefetchControl?: overridableHeader;
+  xDownloadOptions?: overridableHeader;
+  xFrameOptions?: overridableHeader;
+  xPermittedCrossDomainPolicies?: overridableHeader;
+  xXssProtection?: overridableHeader;
+  removePoweredBy?: boolean;
+  permissionsPolicy?: PermissionsPolicyOptions;
+}
+declare const NONCE: ContentSecurityPolicyOptionHandler;
+/**
+ * Secure Headers Middleware for Acryl.
+ *
+ *
+ * @param {Partial<SecureHeadersOptions>} [customOptions] - The options for the secure headers middleware.
+ * @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicy] - Settings for the Content-Security-Policy header.
+ * @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicyReportOnly] - Settings for the Content-Security-Policy-Report-Only header.
+ * @param {overridableHeader} [customOptions.crossOriginEmbedderPolicy=false] - Settings for the Cross-Origin-Embedder-Policy header.
+ * @param {overridableHeader} [customOptions.crossOriginResourcePolicy=true] - Settings for the Cross-Origin-Resource-Policy header.
+ * @param {overridableHeader} [customOptions.crossOriginOpenerPolicy=true] - Settings for the Cross-Origin-Opener-Policy header.
+ * @param {overridableHeader} [customOptions.originAgentCluster=true] - Settings for the Origin-Agent-Cluster header.
+ * @param {overridableHeader} [customOptions.referrerPolicy=true] - Settings for the Referrer-Policy header.
+ * @param {ReportingEndpointOptions[]} [customOptions.reportingEndpoints] - Settings for the Reporting-Endpoints header.
+ * @param {ReportToOptions[]} [customOptions.reportTo] - Settings for the Report-To header.
+ * @param {overridableHeader} [customOptions.strictTransportSecurity=true] - Settings for the Strict-Transport-Security header.
+ * @param {overridableHeader} [customOptions.xContentTypeOptions=true] - Settings for the X-Content-Type-Options header.
+ * @param {overridableHeader} [customOptions.xDnsPrefetchControl=true] - Settings for the X-DNS-Prefetch-Control header.
+ * @param {overridableHeader} [customOptions.xDownloadOptions=true] - Settings for the X-Download-Options header.
+ * @param {overridableHeader} [customOptions.xFrameOptions=true] - Settings for the X-Frame-Options header.
+ * @param {overridableHeader} [customOptions.xPermittedCrossDomainPolicies=true] - Settings for the X-Permitted-Cross-Domain-Policies header.
+ * @param {overridableHeader} [customOptions.xXssProtection=true] - Settings for the X-XSS-Protection header.
+ * @param {boolean} [customOptions.removePoweredBy=true] - Settings for remove X-Powered-By header.
+ * @param {PermissionsPolicyOptions} [customOptions.permissionsPolicy] - Settings for the Permissions-Policy header.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ * app.use(secureHeaders())
+ * ```
+ */
+declare const secureHeaders: (customOptions?: SecureHeadersOptions) => MiddlewareHandler;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/middleware/secure-headers/index.d.ts
+declare module '../../context.ts' {
+  interface ContextVariableMap extends SecureHeadersVariables {}
+}
+//#endregion
+export { type ContentSecurityPolicyOptionHandler, NONCE, type SecureHeadersVariables, secureHeaders };

package/lib/secure-headers.js

@@ -0,0 +1,163 @@
+import { encodeBase64 } from "./utils/encode.js";
+//#region ../../plugins/acryl-router/src/core/middleware/secure-headers/secure-headers.ts
+const HEADERS_MAP = {
+	crossOriginEmbedderPolicy: ["Cross-Origin-Embedder-Policy", "require-corp"],
+	crossOriginResourcePolicy: ["Cross-Origin-Resource-Policy", "same-origin"],
+	crossOriginOpenerPolicy: ["Cross-Origin-Opener-Policy", "same-origin"],
+	originAgentCluster: ["Origin-Agent-Cluster", "?1"],
+	referrerPolicy: ["Referrer-Policy", "no-referrer"],
+	strictTransportSecurity: ["Strict-Transport-Security", "max-age=15552000; includeSubDomains"],
+	xContentTypeOptions: ["X-Content-Type-Options", "nosniff"],
+	xDnsPrefetchControl: ["X-DNS-Prefetch-Control", "off"],
+	xDownloadOptions: ["X-Download-Options", "noopen"],
+	xFrameOptions: ["X-Frame-Options", "SAMEORIGIN"],
+	xPermittedCrossDomainPolicies: ["X-Permitted-Cross-Domain-Policies", "none"],
+	xXssProtection: ["X-XSS-Protection", "0"]
+};
+const DEFAULT_OPTIONS = {
+	crossOriginEmbedderPolicy: false,
+	crossOriginResourcePolicy: true,
+	crossOriginOpenerPolicy: true,
+	originAgentCluster: true,
+	referrerPolicy: true,
+	strictTransportSecurity: true,
+	xContentTypeOptions: true,
+	xDnsPrefetchControl: true,
+	xDownloadOptions: true,
+	xFrameOptions: true,
+	xPermittedCrossDomainPolicies: true,
+	xXssProtection: true,
+	removePoweredBy: true,
+	permissionsPolicy: {}
+};
+const generateNonce = () => {
+	const arrayBuffer = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(arrayBuffer);
+	return encodeBase64(arrayBuffer.buffer);
+};
+const NONCE = (ctx) => {
+	const key = "secureHeadersNonce";
+	const init = ctx.get(key);
+	const nonce = init || generateNonce();
+	if (init == null) ctx.set(key, nonce);
+	return `'nonce-${nonce}'`;
+};
+/**
+* Secure Headers Middleware for Acryl.
+*
+*
+* @param {Partial<SecureHeadersOptions>} [customOptions] - The options for the secure headers middleware.
+* @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicy] - Settings for the Content-Security-Policy header.
+* @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicyReportOnly] - Settings for the Content-Security-Policy-Report-Only header.
+* @param {overridableHeader} [customOptions.crossOriginEmbedderPolicy=false] - Settings for the Cross-Origin-Embedder-Policy header.
+* @param {overridableHeader} [customOptions.crossOriginResourcePolicy=true] - Settings for the Cross-Origin-Resource-Policy header.
+* @param {overridableHeader} [customOptions.crossOriginOpenerPolicy=true] - Settings for the Cross-Origin-Opener-Policy header.
+* @param {overridableHeader} [customOptions.originAgentCluster=true] - Settings for the Origin-Agent-Cluster header.
+* @param {overridableHeader} [customOptions.referrerPolicy=true] - Settings for the Referrer-Policy header.
+* @param {ReportingEndpointOptions[]} [customOptions.reportingEndpoints] - Settings for the Reporting-Endpoints header.
+* @param {ReportToOptions[]} [customOptions.reportTo] - Settings for the Report-To header.
+* @param {overridableHeader} [customOptions.strictTransportSecurity=true] - Settings for the Strict-Transport-Security header.
+* @param {overridableHeader} [customOptions.xContentTypeOptions=true] - Settings for the X-Content-Type-Options header.
+* @param {overridableHeader} [customOptions.xDnsPrefetchControl=true] - Settings for the X-DNS-Prefetch-Control header.
+* @param {overridableHeader} [customOptions.xDownloadOptions=true] - Settings for the X-Download-Options header.
+* @param {overridableHeader} [customOptions.xFrameOptions=true] - Settings for the X-Frame-Options header.
+* @param {overridableHeader} [customOptions.xPermittedCrossDomainPolicies=true] - Settings for the X-Permitted-Cross-Domain-Policies header.
+* @param {overridableHeader} [customOptions.xXssProtection=true] - Settings for the X-XSS-Protection header.
+* @param {boolean} [customOptions.removePoweredBy=true] - Settings for remove X-Powered-By header.
+* @param {PermissionsPolicyOptions} [customOptions.permissionsPolicy] - Settings for the Permissions-Policy header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+* app.use(secureHeaders())
+* ```
+*/
+const secureHeaders = (customOptions) => {
+	const options = {
+		...DEFAULT_OPTIONS,
+		...customOptions
+	};
+	const headersToSet = getFilteredHeaders(options);
+	const callbacks = [];
+	if (options.contentSecurityPolicy) {
+		const [callback, value] = getCSPDirectives(options.contentSecurityPolicy, "Content-Security-Policy");
+		if (callback) callbacks.push(callback);
+		headersToSet.push(["Content-Security-Policy", value]);
+	}
+	if (options.contentSecurityPolicyReportOnly) {
+		const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly, "Content-Security-Policy-Report-Only");
+		if (callback) callbacks.push(callback);
+		headersToSet.push(["Content-Security-Policy-Report-Only", value]);
+	}
+	if (options.permissionsPolicy && Object.keys(options.permissionsPolicy).length > 0) headersToSet.push(["Permissions-Policy", getPermissionsPolicyDirectives(options.permissionsPolicy)]);
+	if (options.reportingEndpoints) headersToSet.push(["Reporting-Endpoints", getReportingEndpoints(options.reportingEndpoints)]);
+	if (options.reportTo) headersToSet.push(["Report-To", getReportToOptions(options.reportTo)]);
+	return async function secureHeaders(ctx, next) {
+		const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
+		await next();
+		setHeaders(ctx, headersToSetForReq);
+		if (options?.removePoweredBy) ctx.res.headers.delete("X-Powered-By");
+	};
+};
+function getFilteredHeaders(options) {
+	return Object.entries(HEADERS_MAP).filter(([key]) => options[key]).map(([key, defaultValue]) => {
+		const overrideValue = options[key];
+		return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
+	});
+}
+function getCSPDirectives(contentSecurityPolicy, headerName) {
+	const callbacks = [];
+	const resultValues = [];
+	for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
+		const valueArray = Array.isArray(value) ? value : [value];
+		valueArray.forEach((value, i) => {
+			if (typeof value === "function") {
+				const index = i * 2 + 2 + resultValues.length;
+				callbacks.push((ctx, values) => {
+					values[index] = value(ctx, directive);
+				});
+			}
+		});
+		resultValues.push(directive.replace(/[A-Z]+(?![a-z])|[A-Z]/g, (match, offset) => offset ? "-" + match.toLowerCase() : match.toLowerCase()), ...valueArray.flatMap((value) => [" ", value]), "; ");
+	}
+	resultValues.pop();
+	return callbacks.length === 0 ? [void 0, resultValues.join("")] : [(ctx, headersToSet) => headersToSet.map((values) => {
+		if (values[0] === headerName) {
+			const clone = values[1].slice();
+			callbacks.forEach((cb) => {
+				cb(ctx, clone);
+			});
+			return [values[0], clone.join("")];
+		} else return values;
+	}), resultValues];
+}
+function getPermissionsPolicyDirectives(policy) {
+	return Object.entries(policy).map(([directive, value]) => {
+		const kebabDirective = camelToKebab(directive);
+		if (typeof value === "boolean") return `${kebabDirective}=${value ? "*" : "()"}`;
+		if (Array.isArray(value)) {
+			if (value.length === 0) return `${kebabDirective}=()`;
+			if (value.length === 1 && value[0] === "*") return `${kebabDirective}=*`;
+			if (value.length === 1 && value[0] === "none") return `${kebabDirective}=()`;
+			return `${kebabDirective}=(${value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`).join(" ")})`;
+		}
+		return "";
+	}).filter(Boolean).join(", ");
+}
+function camelToKebab(str) {
+	return str.replace(/([a-z\d])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function getReportingEndpoints(reportingEndpoints = []) {
+	return reportingEndpoints.map((endpoint) => `${endpoint.name}="${endpoint.url}"`).join(", ");
+}
+function getReportToOptions(reportTo = []) {
+	return reportTo.map((option) => JSON.stringify(option)).join(", ");
+}
+function setHeaders(ctx, headersToSet) {
+	headersToSet.forEach(([header, value]) => {
+		ctx.res.headers.set(header, value);
+	});
+}
+//#endregion
+export { NONCE, secureHeaders };