acrylblends 0.8.1 → 0.9.0

package/lib/open-CMhnJODn.js

@@ -0,0 +1,197 @@
+import { i as applyMigrations, n as MIGRATIONS_TABLE, r as readMigrationFiles } from "./src-MWcsMS8i.js";
+import { mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+//#region ../../plugins/acryl-db-sqlite/src/facade/node.ts
+const DEFAULT_WAL_AUTO_CHECKPOINT_PAGES = 1e3;
+const DEFAULT_BUSY_TIMEOUT_MS = 5e3;
+const ignore = () => {};
+/**
+* Runs operations in call order. An operation starts immediately when nothing is running or waiting;
+* otherwise it waits for everything before it. An asynchronous operation holds the queue until it settles.
+*/
+var SerialOperationQueue = class {
+	tail = Promise.resolve();
+	pending = 0;
+	run(operation) {
+		if (this.pending > 0) return this.enqueue(operation);
+		try {
+			return Promise.resolve(operation());
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	}
+	runAsync(operation) {
+		if (this.pending > 0) return this.enqueue(operation);
+		this.pending++;
+		const { promise: barrier, resolve: releaseBarrier } = Promise.withResolvers();
+		this.tail = barrier;
+		let started;
+		try {
+			started = operation();
+		} catch (error) {
+			started = Promise.reject(error);
+		}
+		return started.finally(() => {
+			this.pending--;
+			releaseBarrier();
+		});
+	}
+	enqueue(operation) {
+		this.pending++;
+		return this.release(this.tail.then(operation));
+	}
+	release(operation) {
+		const settled = operation.finally(() => {
+			this.pending--;
+		});
+		this.tail = settled.then(ignore, ignore);
+		return settled;
+	}
+};
+/**
+* Executes SQL on one connection. Prepared statements are cached per connection by SQL text, so the
+* database and its transaction handles share them across transactions.
+*/
+var NodeSqliteExecutor = class {
+	database;
+	statements;
+	constructor(database, statements) {
+		this.database = database;
+		this.statements = statements;
+	}
+	exec(sql) {
+		return this.runOperation(() => {
+			this.database.exec(sql);
+		});
+	}
+	run(sql, ...params) {
+		return this.runOperation(() => ({ changes: Number(this.statement(sql).run(...params).changes) }));
+	}
+	get(sql, ...params) {
+		return this.runOperation(() => this.statement(sql).get(...params));
+	}
+	all(sql, ...params) {
+		return this.runOperation(() => this.statement(sql).all(...params));
+	}
+	statement(sql) {
+		let statement = this.statements.get(sql);
+		if (statement === void 0) {
+			statement = this.database.prepare(sql);
+			this.statements.set(sql, statement);
+		}
+		return statement;
+	}
+};
+var NodeSqliteTransaction = class extends NodeSqliteExecutor {
+	scope;
+	constructor(database, statements, scope) {
+		super(database, statements);
+		this.scope = scope;
+	}
+	async runOperation(operation) {
+		if (!this.scope.active) throw new Error("SQLite transaction handle is no longer active");
+		return operation();
+	}
+};
+/** `Db` adapter backed by Node's built-in `node:sqlite`. */
+var NodeSqliteDatabase = class extends NodeSqliteExecutor {
+	access = new SerialOperationQueue();
+	closed = false;
+	constructor(database) {
+		super(database, /* @__PURE__ */ new Map());
+	}
+	transaction(callback) {
+		return this.access.runAsync(async () => {
+			this.database.exec("BEGIN IMMEDIATE");
+			const scope = { active: true };
+			try {
+				const result = await callback(new NodeSqliteTransaction(this.database, this.statements, scope));
+				scope.active = false;
+				this.database.exec("COMMIT");
+				return result;
+			} catch (error) {
+				scope.active = false;
+				try {
+					this.database.exec("ROLLBACK");
+				} catch (rollbackError) {
+					throw new AggregateError([error, rollbackError], "SQLite transaction failed and rollback failed");
+				}
+				throw error;
+			}
+		});
+	}
+	close() {
+		return this.access.run(() => {
+			if (this.closed) return;
+			this.closed = true;
+			this.statements.clear();
+			try {
+				this.database.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+			} finally {
+				this.database.close();
+			}
+		});
+	}
+	runOperation(operation) {
+		return this.access.run(operation);
+	}
+};
+/** Open and configure a Node-backed SQLite database facade. */
+async function openNodeSqliteDatabase(path, options = {}) {
+	const checkpointPages = options.walAutoCheckpointPages ?? DEFAULT_WAL_AUTO_CHECKPOINT_PAGES;
+	const timeout = options.busyTimeoutMs ?? DEFAULT_BUSY_TIMEOUT_MS;
+	if (path !== ":memory:") await mkdir(dirname(path), { recursive: true });
+	const adapter = new NodeSqliteDatabase(new DatabaseSync(path, { timeout }));
+	try {
+		await adapter.exec("PRAGMA journal_mode = WAL");
+		await adapter.exec("PRAGMA synchronous = NORMAL");
+		await adapter.exec(`PRAGMA wal_autocheckpoint = ${checkpointPages}`);
+		return adapter;
+	} catch (error) {
+		try {
+			await adapter.close();
+		} catch {}
+		throw error;
+	}
+}
+//#endregion
+//#region ../../plugins/acryl-db-sqlite/src/open.ts
+/**
+* The plain way to open the SQLite provider, for code without Cordis (an acrylblends app): `openDb({ path, migrations })` opens one
+* `node:sqlite` file with the ported facade's settings (WAL, `synchronous = NORMAL`, a busy timeout) and foreign keys enforced, applies the
+* numbered migrations, and resolves the `db` port with the function that closes it. The Cordis plugin is a thin wrapper over this, so both
+* run one code path.
+* This entry imports nothing from Cordis.
+*/
+/**
+* Open, configure and migrate a SQLite database.
+* @throws when the migration files are misnamed or misnumbered, or a migration fails (the file is closed, and unchanged), or the
+*   database's schema is newer than the migrations.
+*/
+async function openDb(options) {
+	const migrations = options.migrations === void 0 ? [] : await readMigrationFiles(options.migrations);
+	const database = await openNodeSqliteDatabase(options.path, {
+		...options.busyTimeoutMs === void 0 ? {} : { busyTimeoutMs: options.busyTimeoutMs },
+		...options.walAutoCheckpointPages === void 0 ? {} : { walAutoCheckpointPages: options.walAutoCheckpointPages }
+	});
+	try {
+		await database.exec("PRAGMA foreign_keys = ON");
+		await applyMigrations(database, migrations, { table: MIGRATIONS_TABLE });
+	} catch (error) {
+		await database.close();
+		throw error;
+	}
+	return {
+		db: {
+			exec: (sql) => database.exec(sql),
+			run: (sql, ...params) => database.run(sql, ...params),
+			get: (sql, ...params) => database.get(sql, ...params),
+			all: (sql, ...params) => database.all(sql, ...params),
+			transaction: (work) => database.transaction(work)
+		},
+		close: () => database.close()
+	};
+}
+//#endregion
+export { NodeSqliteDatabase as n, openNodeSqliteDatabase as r, openDb as t };

package/lib/protocol-BizVt4J6.d.ts

@@ -0,0 +1,144 @@
+//#region ../../plugins/acryl-door/src/page/protocol.d.ts
+/**
+ * The one shape of a door call, shared by the Host and the in-page driver (moved from `acryl-agent-control`, spec 041).
+ *
+ * The Host turns a verb's arguments into a {@link UiRequest}, sends it to the page over the channel, and gets a {@link UiResult} back.
+ * Everything crossing the channel is validated here once, so neither side trusts the other's JSON. The page imports this file too, so it
+ * lives with the page code and has no Node imports.
+ */
+/** The operations the driver performs on the page. */
+declare const UI_OPS: readonly ["snapshot", "click", "type", "select", "press", "scroll", "wait"];
+type UiOp = (typeof UI_OPS)[number];
+/** Operations that change the page, so each call needs approval. `snapshot`, `scroll` and `wait` only look. */
+declare const MUTATING_OPS: readonly UiOp[];
+declare const MAX_TEXT_LENGTH = 10000;
+declare const MAX_WAIT_MS = 10000;
+declare const MAX_SNAPSHOT_NODES = 1000;
+declare const DEFAULT_SNAPSHOT_NODES = 300;
+/** Why a call did not do what was asked. Every failure is one of these, never a silent wrong action. */
+type UiErrorCode = 'no-window' | 'stale-ref' | 'unknown-ref' | 'sensitive' | 'protected' | 'not-actionable' | 'not-found' | 'killed' | 'timeout' | 'aborted' | 'unloaded' | 'disconnected' | 'invalid';
+declare class UiControlError extends Error {
+  readonly code: UiErrorCode;
+  constructor(code: UiErrorCode, message: string);
+}
+/** One element in a snapshot. */
+interface UiNode {
+  /** `<generation>.<n>`; valid only until the next snapshot. */
+  readonly ref: string;
+  readonly role: string;
+  readonly name: string;
+  readonly depth: number;
+  /** Short state words: `disabled`, `checked`, `expanded`, `selected`, `focused`, `protected`, ... */
+  readonly states: readonly string[];
+  /** The text of an editable field, when it is not sensitive. */
+  readonly value?: string;
+  /** Heading level, when it is a heading. */
+  readonly level?: number;
+}
+interface UiSnapshot {
+  readonly generation: number;
+  readonly title: string;
+  readonly nodes: readonly UiNode[];
+  /** How many elements matched in all; more than `nodes.length` when the page was cut. */
+  readonly total: number;
+  /** Pass to the next snapshot call to continue, or absent when this is everything. */
+  readonly nextCursor?: number;
+}
+type UiRequest = {
+  readonly op: 'snapshot';
+  readonly cursor?: number;
+  readonly maxNodes?: number;
+} | {
+  readonly op: 'click';
+  readonly ref: string;
+} | {
+  readonly op: 'type';
+  readonly ref: string;
+  readonly text: string;
+  readonly submit?: boolean;
+  readonly clear?: boolean;
+} | {
+  readonly op: 'select';
+  readonly ref: string;
+  readonly option: string;
+} | {
+  readonly op: 'press';
+  readonly key: string;
+  readonly ref?: string;
+} | {
+  readonly op: 'scroll';
+  readonly direction: 'up' | 'down' | 'left' | 'right';
+  readonly ref?: string;
+  readonly amount?: number;
+} | {
+  readonly op: 'wait';
+  readonly text?: string;
+  readonly role?: string;
+  readonly name?: string;
+  readonly gone?: boolean;
+  readonly timeoutMs?: number;
+};
+/** What the page did, and to which control (for the audit log and the approval prompt). */
+interface UiActionResult {
+  readonly ok: true;
+  readonly target?: {
+    readonly role: string;
+    readonly name: string;
+  };
+  readonly detail?: string;
+}
+type UiResult = UiSnapshot | UiActionResult;
+/**
+ * Messages the page and the Host exchange over the channel. The Host sends calls down the page's event stream (`event: call`); the page
+ * opens that stream with its window id and focus, and sends everything else up by POST, naming its window id.
+ */
+type ChannelToPage = {
+  readonly t: 'call';
+  readonly id: number;
+  readonly request: UiRequest;
+};
+type ChannelToHost = {
+  readonly t: 'focus';
+  readonly focused: boolean;
+} | {
+  readonly t: 'result';
+  readonly id: number;
+  readonly value: UiResult;
+} | {
+  readonly t: 'error';
+  readonly id: number;
+  readonly code: UiErrorCode;
+  readonly message: string;
+};
+/** @param value - untrusted JSON. @throws UiControlError `invalid`. */
+declare function parseUiRequest(value: unknown): UiRequest;
+/** @param text - one `call` event's data from the Host. @throws when it is not a well-formed call. */
+declare function parseChannelToPage(text: string): ChannelToPage;
+/** Every code a {@link UiControlError} can carry, so a code read off the wire is validated, not cast. */
+declare const UI_ERROR_CODES: readonly UiErrorCode[];
+/** A window id the page chose: short, printable, so it can travel in a query string and a log line. */
+declare const WINDOW_ID: RegExp;
+/** @param value - one parsed message from the page; null when it is not a well-formed message. */
+declare function parseChannelToHost(value: unknown): ChannelToHost | null;
+/** One line of the audit log: what the agent did, never what it typed. */
+interface AuditEntry {
+  /** ISO time of the call. */
+  readonly at: string;
+  readonly tool: string;
+  /** The control touched, when the call had one. */
+  readonly target?: {
+    readonly role: string;
+    readonly name: string;
+  };
+  readonly outcome: 'ok' | 'refused' | 'failed';
+  /** The error code for a refusal or failure, or a short note for a success. */
+  readonly detail?: string;
+  /**
+   * Whether the user was asked first (`asked`), approval was switched off (`none`), the call needed no
+   * approval (`not-needed`), or it came from an operator holding this run's secret (`token`, spec 041 TB30): authorized by the secret,
+   * which only the OS user who started the app can read, and watched by the person at the page through the indicator and its kill switch.
+   */
+  readonly approval: 'asked' | 'none' | 'not-needed' | 'token';
+}
+//#endregion
+export { parseUiRequest as S, UiResult as _, MAX_SNAPSHOT_NODES as a, parseChannelToHost as b, MUTATING_OPS as c, UiActionResult as d, UiControlError as f, UiRequest as g, UiOp as h, DEFAULT_SNAPSHOT_NODES as i, UI_ERROR_CODES as l, UiNode as m, ChannelToHost as n, MAX_TEXT_LENGTH as o, UiErrorCode as p, ChannelToPage as r, MAX_WAIT_MS as s, AuditEntry as t, UI_OPS as u, UiSnapshot as v, parseChannelToPage as x, WINDOW_ID as y };

package/lib/request-id-CKVvHOO1.js

@@ -0,0 +1,34 @@
+//#region ../../plugins/acryl-router/src/core/middleware/request-id/request-id.ts
+/**
+* Request ID Middleware for Acryl.
+*
+* @param {object} options - Options for Request ID middleware.
+* @param {number} [options.limitLength=255] - The maximum length of request id.
+* @param {string} [options.headerName=X-Request-Id] - The header name used in request id.
+* @param {generator} [options.generator=() => crypto.randomUUID()] - The request id generation function.
+*
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* type Variables = RequestIdVariables
+* const app = new Acryl<{Variables: Variables}>()
+*
+* app.use(requestId())
+* app.get('/', (c) => {
+*   console.log(c.get('requestId')) // Debug
+*   return c.text('Hello World!')
+* })
+* ```
+*/
+const requestId = ({ limitLength = 255, headerName = "X-Request-Id", generator = () => crypto.randomUUID() } = {}) => {
+	return async function requestId(c, next) {
+		let reqId = headerName ? c.req.header(headerName) : void 0;
+		if (!reqId || reqId.length > limitLength || /[^\w\-=]/.test(reqId)) reqId = generator(c);
+		c.set("requestId", reqId);
+		if (headerName) c.header(headerName, reqId);
+		await next();
+	};
+};
+//#endregion
+export { requestId as t };

package/lib/request-id.js

@@ -1,34 +1,2 @@
-//#region ../../plugins/acryl-router/src/core/middleware/request-id/request-id.ts
-/**
-* Request ID Middleware for Acryl.
-*
-* @param {object} options - Options for Request ID middleware.
-* @param {number} [options.limitLength=255] - The maximum length of request id.
-* @param {string} [options.headerName=X-Request-Id] - The header name used in request id.
-* @param {generator} [options.generator=() => crypto.randomUUID()] - The request id generation function.
-*
-* @returns {MiddlewareHandler} The middleware handler function.
-*
-* @example
-* ```ts
-* type Variables = RequestIdVariables
-* const app = new Acryl<{Variables: Variables}>()
-*
-* app.use(requestId())
-* app.get('/', (c) => {
-*   console.log(c.get('requestId')) // Debug
-*   return c.text('Hello World!')
-* })
-* ```
-*/
-const requestId = ({ limitLength = 255, headerName = "X-Request-Id", generator = () => crypto.randomUUID() } = {}) => {
-	return async function requestId(c, next) {
-		let reqId = headerName ? c.req.header(headerName) : void 0;
-		if (!reqId || reqId.length > limitLength || /[^\w\-=]/.test(reqId)) reqId = generator(c);
-		c.set("requestId", reqId);
-		if (headerName) c.header(headerName, reqId);
-		await next();
-	};
-};
-//#endregion
+import { t as requestId } from "./request-id-CKVvHOO1.js";
 export { requestId };

package/lib/secure-headers-mP3j6Hm6.js

@@ -0,0 +1,163 @@
+import { encodeBase64 } from "./utils/encode.js";
+//#region ../../plugins/acryl-router/src/core/middleware/secure-headers/secure-headers.ts
+const HEADERS_MAP = {
+	crossOriginEmbedderPolicy: ["Cross-Origin-Embedder-Policy", "require-corp"],
+	crossOriginResourcePolicy: ["Cross-Origin-Resource-Policy", "same-origin"],
+	crossOriginOpenerPolicy: ["Cross-Origin-Opener-Policy", "same-origin"],
+	originAgentCluster: ["Origin-Agent-Cluster", "?1"],
+	referrerPolicy: ["Referrer-Policy", "no-referrer"],
+	strictTransportSecurity: ["Strict-Transport-Security", "max-age=15552000; includeSubDomains"],
+	xContentTypeOptions: ["X-Content-Type-Options", "nosniff"],
+	xDnsPrefetchControl: ["X-DNS-Prefetch-Control", "off"],
+	xDownloadOptions: ["X-Download-Options", "noopen"],
+	xFrameOptions: ["X-Frame-Options", "SAMEORIGIN"],
+	xPermittedCrossDomainPolicies: ["X-Permitted-Cross-Domain-Policies", "none"],
+	xXssProtection: ["X-XSS-Protection", "0"]
+};
+const DEFAULT_OPTIONS = {
+	crossOriginEmbedderPolicy: false,
+	crossOriginResourcePolicy: true,
+	crossOriginOpenerPolicy: true,
+	originAgentCluster: true,
+	referrerPolicy: true,
+	strictTransportSecurity: true,
+	xContentTypeOptions: true,
+	xDnsPrefetchControl: true,
+	xDownloadOptions: true,
+	xFrameOptions: true,
+	xPermittedCrossDomainPolicies: true,
+	xXssProtection: true,
+	removePoweredBy: true,
+	permissionsPolicy: {}
+};
+const generateNonce = () => {
+	const arrayBuffer = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(arrayBuffer);
+	return encodeBase64(arrayBuffer.buffer);
+};
+const NONCE = (ctx) => {
+	const key = "secureHeadersNonce";
+	const init = ctx.get(key);
+	const nonce = init || generateNonce();
+	if (init == null) ctx.set(key, nonce);
+	return `'nonce-${nonce}'`;
+};
+/**
+* Secure Headers Middleware for Acryl.
+*
+*
+* @param {Partial<SecureHeadersOptions>} [customOptions] - The options for the secure headers middleware.
+* @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicy] - Settings for the Content-Security-Policy header.
+* @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicyReportOnly] - Settings for the Content-Security-Policy-Report-Only header.
+* @param {overridableHeader} [customOptions.crossOriginEmbedderPolicy=false] - Settings for the Cross-Origin-Embedder-Policy header.
+* @param {overridableHeader} [customOptions.crossOriginResourcePolicy=true] - Settings for the Cross-Origin-Resource-Policy header.
+* @param {overridableHeader} [customOptions.crossOriginOpenerPolicy=true] - Settings for the Cross-Origin-Opener-Policy header.
+* @param {overridableHeader} [customOptions.originAgentCluster=true] - Settings for the Origin-Agent-Cluster header.
+* @param {overridableHeader} [customOptions.referrerPolicy=true] - Settings for the Referrer-Policy header.
+* @param {ReportingEndpointOptions[]} [customOptions.reportingEndpoints] - Settings for the Reporting-Endpoints header.
+* @param {ReportToOptions[]} [customOptions.reportTo] - Settings for the Report-To header.
+* @param {overridableHeader} [customOptions.strictTransportSecurity=true] - Settings for the Strict-Transport-Security header.
+* @param {overridableHeader} [customOptions.xContentTypeOptions=true] - Settings for the X-Content-Type-Options header.
+* @param {overridableHeader} [customOptions.xDnsPrefetchControl=true] - Settings for the X-DNS-Prefetch-Control header.
+* @param {overridableHeader} [customOptions.xDownloadOptions=true] - Settings for the X-Download-Options header.
+* @param {overridableHeader} [customOptions.xFrameOptions=true] - Settings for the X-Frame-Options header.
+* @param {overridableHeader} [customOptions.xPermittedCrossDomainPolicies=true] - Settings for the X-Permitted-Cross-Domain-Policies header.
+* @param {overridableHeader} [customOptions.xXssProtection=true] - Settings for the X-XSS-Protection header.
+* @param {boolean} [customOptions.removePoweredBy=true] - Settings for remove X-Powered-By header.
+* @param {PermissionsPolicyOptions} [customOptions.permissionsPolicy] - Settings for the Permissions-Policy header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+* app.use(secureHeaders())
+* ```
+*/
+const secureHeaders = (customOptions) => {
+	const options = {
+		...DEFAULT_OPTIONS,
+		...customOptions
+	};
+	const headersToSet = getFilteredHeaders(options);
+	const callbacks = [];
+	if (options.contentSecurityPolicy) {
+		const [callback, value] = getCSPDirectives(options.contentSecurityPolicy, "Content-Security-Policy");
+		if (callback) callbacks.push(callback);
+		headersToSet.push(["Content-Security-Policy", value]);
+	}
+	if (options.contentSecurityPolicyReportOnly) {
+		const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly, "Content-Security-Policy-Report-Only");
+		if (callback) callbacks.push(callback);
+		headersToSet.push(["Content-Security-Policy-Report-Only", value]);
+	}
+	if (options.permissionsPolicy && Object.keys(options.permissionsPolicy).length > 0) headersToSet.push(["Permissions-Policy", getPermissionsPolicyDirectives(options.permissionsPolicy)]);
+	if (options.reportingEndpoints) headersToSet.push(["Reporting-Endpoints", getReportingEndpoints(options.reportingEndpoints)]);
+	if (options.reportTo) headersToSet.push(["Report-To", getReportToOptions(options.reportTo)]);
+	return async function secureHeaders(ctx, next) {
+		const headersToSetForReq = callbacks.length === 0 ? headersToSet : callbacks.reduce((acc, cb) => cb(ctx, acc), headersToSet);
+		await next();
+		setHeaders(ctx, headersToSetForReq);
+		if (options?.removePoweredBy) ctx.res.headers.delete("X-Powered-By");
+	};
+};
+function getFilteredHeaders(options) {
+	return Object.entries(HEADERS_MAP).filter(([key]) => options[key]).map(([key, defaultValue]) => {
+		const overrideValue = options[key];
+		return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
+	});
+}
+function getCSPDirectives(contentSecurityPolicy, headerName) {
+	const callbacks = [];
+	const resultValues = [];
+	for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
+		const valueArray = Array.isArray(value) ? value : [value];
+		valueArray.forEach((value, i) => {
+			if (typeof value === "function") {
+				const index = i * 2 + 2 + resultValues.length;
+				callbacks.push((ctx, values) => {
+					values[index] = value(ctx, directive);
+				});
+			}
+		});
+		resultValues.push(directive.replace(/[A-Z]+(?![a-z])|[A-Z]/g, (match, offset) => offset ? "-" + match.toLowerCase() : match.toLowerCase()), ...valueArray.flatMap((value) => [" ", value]), "; ");
+	}
+	resultValues.pop();
+	return callbacks.length === 0 ? [void 0, resultValues.join("")] : [(ctx, headersToSet) => headersToSet.map((values) => {
+		if (values[0] === headerName) {
+			const clone = values[1].slice();
+			callbacks.forEach((cb) => {
+				cb(ctx, clone);
+			});
+			return [values[0], clone.join("")];
+		} else return values;
+	}), resultValues];
+}
+function getPermissionsPolicyDirectives(policy) {
+	return Object.entries(policy).map(([directive, value]) => {
+		const kebabDirective = camelToKebab(directive);
+		if (typeof value === "boolean") return `${kebabDirective}=${value ? "*" : "()"}`;
+		if (Array.isArray(value)) {
+			if (value.length === 0) return `${kebabDirective}=()`;
+			if (value.length === 1 && value[0] === "*") return `${kebabDirective}=*`;
+			if (value.length === 1 && value[0] === "none") return `${kebabDirective}=()`;
+			return `${kebabDirective}=(${value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`).join(" ")})`;
+		}
+		return "";
+	}).filter(Boolean).join(", ");
+}
+function camelToKebab(str) {
+	return str.replace(/([a-z\d])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function getReportingEndpoints(reportingEndpoints = []) {
+	return reportingEndpoints.map((endpoint) => `${endpoint.name}="${endpoint.url}"`).join(", ");
+}
+function getReportToOptions(reportTo = []) {
+	return reportTo.map((option) => JSON.stringify(option)).join(", ");
+}
+function setHeaders(ctx, headersToSet) {
+	headersToSet.forEach(([header, value]) => {
+		ctx.res.headers.set(header, value);
+	});
+}
+//#endregion
+export { secureHeaders as n, NONCE as t };