@aphexcms/cms-core 9.8.1 → 9.10.0

package/dist/utils/fetch-remote-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-remote-file.d.ts","sourceRoot":"","sources":["../../src/lib/utils/fetch-remote-file.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AA6EtD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;sBAGsB;AACtB,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAuEtE"}
+{"version":3,"file":"fetch-remote-file.d.ts","sourceRoot":"","sources":["../../src/lib/utils/fetch-remote-file.ts"],"names":[],"mappings":"AA8CA,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AA6EtD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;sBAGsB;AACtB,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0EtE"}

package/dist/utils/fetch-remote-file.js

@@ -11,7 +11,35 @@
 // that gets validated and the address that gets connected to must be the exact same one.
 import { lookup } from 'node:dns/promises';
 import net from 'node:net';
-import { Agent, fetch as undiciFetch } from 'undici';
+// Loading `undici` is deferred, and Node's own dispatcher is forced into place first. That
+// ordering is the whole point of this function, and getting it wrong breaks something far away:
+//
+// Node's built-in fetch and the userland `undici` package share one slot —
+// `globalThis[Symbol.for('undici.globalDispatcher.1')]` — and whoever writes it first wins.
+// Importing `undici` claims that slot if it's still empty, and on Node 24+ the *built-in* fetch
+// then routes through this bundled userland copy (as a `Dispatcher1Wrapper`). Its stricter
+// `processHeader` rejects an explicit `content-length`, which the S3 client sets on every PUT — so
+// merely importing this module killed every S3/R2 upload in the process with "invalid
+// content-length header".
+//
+// The slot is non-configurable once set, and Node caches its wrapper internally, so this can't be
+// undone after the fact: writing the symbol back (even to `undefined`) leaves fetch broken. The
+// only fix is to not lose the race. A `data:` fetch resolves entirely in-process — no socket, no
+// DNS — and is enough to make Node install its dispatcher, after which undici's import leaves the
+// slot alone and both work.
+//
+// This module hangs off the `/server` barrel (server/index.ts → mcp/tools → here), so with a
+// static `import` every Aphex app broke its own uploads at boot. It only showed in production:
+// `vite dev` loads SSR modules lazily, so a real request usually primed Node's dispatcher first,
+// while a production build imports the graph eagerly at startup and undici gets there first.
+let undiciPromise;
+function loadUndici() {
+    undiciPromise ??= (async () => {
+        await fetch('data:text/plain,0').catch(() => undefined);
+        return import('undici');
+    })();
+    return undiciPromise;
+}
 export const MAX_REMOTE_FILE_BYTES = 10 * 1024 * 1024; // matches the API's global JSON body cap
 const FETCH_TIMEOUT_MS = 10_000;
 const MAX_REDIRECTS = 5;
@@ -79,7 +107,7 @@ async function resolvePinnedHost(hostname) {
  * whatever hostname undici asks it to resolve, it hands back this exact IP, so the socket that
  * actually opens is guaranteed to be the one that passed `isPrivateOrReservedIp`. The hostname
  * itself still flows through normally for the Host header and TLS SNI/cert validation. */
-function pinnedDispatcher(host) {
+function pinnedDispatcher(Agent, host) {
     return new Agent({
         connect: {
             lookup: (_hostname, options, callback) => {
@@ -94,6 +122,7 @@ function pinnedDispatcher(host) {
  * hop), a request timeout, and a streamed size cap (not just a Content-Length check, since that
  * header can lie). */
 export async function fetchRemoteFile(url) {
+    const { Agent, fetch: undiciFetch } = await loadUndici();
     let current = url;
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
         const parsed = new URL(current);
@@ -112,7 +141,7 @@ export async function fetchRemoteFile(url) {
                 res = await undiciFetch(current, {
                     redirect: 'manual',
                     signal: controller.signal,
-                    dispatcher: pinnedDispatcher(pinnedHost),
+                    dispatcher: pinnedDispatcher(Agent, pinnedHost),
                     headers: REQUEST_HEADERS
                 });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aphexcms/cms-core",
-  "version": "9.8.1",
+  "version": "9.10.0",
   "description": "Aphex CMS Core - A Sanity-style CMS with ports and adapters architecture",
   "publishConfig": {
     "access": "public",
@@ -82,7 +82,7 @@
     "svelte": "^5.44.0",
     "tailwind-merge": "^3.4.0",
     "tailwind-variants": "^3.2.2",
-    "@aphexcms/ui": "^0.8.3"
+    "@aphexcms/ui": "^0.8.5"
   },
   "peerDependenciesMeta": {
     "graphql": {
@@ -115,10 +115,10 @@
     "dayjs": "^1.11.19",
     "dompurify": "^3.4.12",
     "esbuild": "^0.27.0",
-    "hono": "^4.12.15",
+    "hono": "^4.12.34",
     "marked": "^18.0.7",
     "picocolors": "^1.1.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "svelte-sonner": "^1.0.7",
     "tsx": "^4.20.6",
     "undici": "^8.9.0",
@@ -129,7 +129,7 @@
     "@eslint/js": "^9.39.1",
     "@internationalized/date": "^3.10.0",
     "@sveltejs/adapter-auto": "^7.0.0",
-    "@sveltejs/kit": "^2.59.1",
+    "@sveltejs/kit": "^2.70.2",
     "@sveltejs/package": "^2.5.6",
     "@sveltejs/vite-plugin-svelte": "^7.0.0",
     "@tailwindcss/vite": "^4.3.0",
@@ -147,7 +147,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.0",
     "vite": "^8.1.5",
-    "vitest": "^4.0.14"
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "build": "svelte-package && tsc && node ../../scripts/fix-imports.js ./dist",