@drfed/web 0.0.0-stage → 0.1.0-dev.0

package/README.md

@@ -1,3 +1,144 @@
-# Temporary Holding Version
+@drfed/web
+==========
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+SolidStart frontend and embedded Node.js runtime for [DrFed].
+
+[DrFed]: https://drfed.org/
+
+
+Installed standalone frontend
+-----------------------------
+
+Install the application package to obtain the `drfed-web` command:
+
+~~~~ sh
+npm install --global @drfed/drfed
+drfed-web --backend-url http://localhost:8888 \
+  --public-origin https://drfed.example --listen localhost:3000
+~~~~
+
+The backend must already be running, and its `--login-origin` allowlist must
+include the frontend's public origin. The backend value is normalized to an
+origin; requests always use its `/graphql` endpoint. Frontend deployment
+settings are resolved at startup and do not require rebuilding the frontend.
+
+All DrFed commands read the same explicit TOML file through `--config FILE` or
+`DRFED_CONFIG`, with CLI values overriding environment values and TOML.
+`drfed-web` uses `web.public_origin`/`DRFED_PUBLIC_ORIGIN`,
+`web.backend_url`/`DRFED_BACKEND_URL` and
+`web.listen`/`DRFED_WEB_LISTEN`. Its default listen address is
+`localhost:3000`; `server.listen`/`DRFED_LISTEN` belongs to the backend.
+The common `telemetry` settings control logging. Database and mail sections are
+unused by this command. `--print-config` explains effective settings and sources
+without starting the runtime or opening log files.
+
+
+Development and builds
+----------------------
+
+Run `mise run dev` from the repository root to start both development servers.
+`mise run dev:web` starts only Vite; its GraphQL backend must already be
+running. Development uses `DRFED_BACKEND_URL` (default
+`http://drfed.localhost:8888`) and `DRFED_PUBLIC_ORIGIN` (default
+`http://localhost:3000`). Add the public origin to the backend's login
+allowlist when using a different origin.
+
+Run `mise run build:web` to build the Node adapter, shared binding, SSR bundle
+and static assets. `mise run build:web-runtime` builds just the adapter and
+binding for Vite development.
+
+
+Embedded runtime
+----------------
+
+Initialize the web runtime with a public origin and GraphQL handler:
+
+~~~~ ts
+import { createWebRuntime } from "@drfed/web";
+
+const web = await createWebRuntime({
+  publicOrigin: new URL("https://drfed.example"),
+  graphqlFetch: (request) => yoga.fetch(request),
+});
+
+const response = await web.fetch(request);
+await web.close();
+~~~~
+
+Importing the package and creating the runtime open no listening socket or
+process signal/error handlers. `fetch()` serves SolidStart SSR, server functions
+and bundled static assets. Deployment settings live in one external Node module
+shared by the adapter and Nitro bundle, rather than argv or serialized runtime
+configuration. Each server-side Relay request reads its own SolidStart request
+context and forwards only a validated session token as Bearer authorization.
+Other cookies and incoming authorization/proxy headers are not forwarded.
+
+Nitro uses process-wide state, so initialize one runtime per process. A second
+initialization is rejected, including after close. `close()` is idempotent,
+cancels active GraphQL work and waits for its response bodies to finish before
+running Nitro close hooks. An injected GraphQL handler remains caller-owned;
+a handler that ignores cancellation can delay close until the caller's deadline.
+Vite uses Nitro's in-process development runner so SSR shares the external
+binding. Frontend HMR retains it; a Vite config or environment restart installs
+a new development binding and drains the previous server's GraphQL work.
+
+The [Nitro configuration] controls the listener-free Node entry and external
+binding. [Solid's request context] supplies the request cancellation signal.
+
+[Nitro configuration]: https://nitro.build/docs/configuration
+[Solid's request context]: https://docs.solidjs.com/reference/server-utilities/get-request-event
+
+
+Request and cookie policy
+-------------------------
+
+Serve the web app only through the configured public origin's authority.
+Host-preserving reverse proxies may terminate TLS: DrFed restores the request
+URL's scheme from the public origin and strips forwarded headers. It does not
+trust forwarded host or protocol headers. A different authority receives 421;
+malformed or inconsistent URL/Host values receive 400.
+
+[Server functions] accept POST only, with an Origin matching the public origin.
+When Origin is absent, a same-origin Referer is required. Missing, opaque,
+malformed and cross-origin sources are rejected before body deserialization;
+instance subdomains are also cross-origin. The same policy runs in embedded
+and development servers, including encoded server-function path aliases.
+Regular login-link GET pages still render, while confirmation uses POST.
+
+Session cookies use HttpOnly, SameSite=Lax and path `/`, without Domain.
+Secure follows the configured public origin's HTTPS scheme, including behind
+TLS termination; forwarded headers cannot downgrade it.
+
+[Server functions]: https://docs.solidjs.com/solid-start/v2/guides/security#csrf-cross-site-request-forgery
+
+
+Verification
+------------
+
+`mise run test:web-runtime` checks SSR, static assets, binding identity,
+controlled GraphQL headers, cancellation, idempotent draining close and the
+absence of listeners or process-handler changes. `mise run test` includes this
+test after building the frontend. `mise run test:packaging` also exercises the
+runtime from local and global npm tarball installations.
+
+
+Combined serving
+----------------
+
+`drfed-server --root-origin https://drfed.example.com` serves this frontend
+and `/graphql` on its single listener. The web runtime calls Yoga directly in
+that process, using the same controlled GraphQL bridge as standalone mode.
+Use `--no-web` with explicit backend login origins when running `drfed-web`
+separately. Repository `mise run dev` uses this split mode for Vite HMR.
+
+
+Standalone backend security
+---------------------------
+
+`drfed-web` requires HTTPS for non-loopback backends because requests carry
+session tokens. HTTP is allowed for `localhost`, its subdomains, IPv4
+loopback addresses and `::1`. For a trusted internal network, explicitly use
+`--allow-insecure-backend`, `DRFED_ALLOW_INSECURE_BACKEND=true`, or
+`web.allow_insecure_backend = true` in TOML. This permits unencrypted session
+tokens and logs a warning at startup. `--no-allow-insecure-backend` overrides
+permission from the environment or configuration file.

package/dist/bridge.d.mts

@@ -0,0 +1,39 @@
+import { GraphQLResponse } from "relay-runtime";
+//#region src/bridge.d.ts
+/** A GraphQL fetch handler owned by the embedding application. */
+type GraphqlFetch = (request: Request) => Response | Promise<Response>;
+/** Immutable deployment settings shared by the adapter and Nitro server. */
+interface WebRuntimeOptions {
+  readonly publicOrigin: URL;
+  readonly graphqlFetch: GraphqlFetch;
+}
+/** Install the process's single web binding before importing Nitro.
+ * @returns Runtime cancellation and shared idempotent cleanup.
+ */
+declare function installWebBinding(options: WebRuntimeOptions): {
+  signal: AbortSignal;
+  close(): Promise<void>;
+};
+/** Replace the development binding during a Vite restart.
+ * Production initialization remains limited to one runtime per process.
+ * @returns Cancellation and cleanup for this development server only.
+ */
+declare function installDevelopmentWebBinding(options: WebRuntimeOptions): {
+  signal: AbortSignal;
+  close(): Promise<void>;
+};
+/** Run a server-side Relay request through the configured GraphQL handler.
+ * @returns The parsed GraphQL response after its body has been consumed.
+ */
+declare function queryGraphql(query: string, variables: Readonly<Record<string, unknown>>, accessToken: string | undefined, sourceSignal: AbortSignal): Promise<GraphQLResponse>;
+/** The immutable public web origin used for redirects and cookie security.
+ * @returns The configured normalized web origin.
+ */
+declare function getPublicOrigin(): string;
+/** Apply the shared web authority, public scheme and server-function policy.
+ * @returns The prepared request or an early rejection.
+ */
+declare function prepareWebRequest(request: Request): Request | Response;
+//#endregion
+export { GraphqlFetch, WebRuntimeOptions, getPublicOrigin, installDevelopmentWebBinding, installWebBinding, prepareWebRequest, queryGraphql };
+//# sourceMappingURL=bridge.d.mts.map

package/dist/bridge.mjs

@@ -0,0 +1,104 @@
+import { prepareWebRequest as prepareWebRequest$1 } from "./request-policy.mjs";
+//#region src/bridge.ts
+let binding;
+let initialized = false;
+/** Install the process's single web binding before importing Nitro.
+* @returns Runtime cancellation and shared idempotent cleanup.
+*/
+function installWebBinding(options) {
+	if (initialized) throw new Error("A web runtime was already initialized in this process.");
+	const owner = createBinding(options);
+	initialized = true;
+	return owner;
+}
+/** Replace the development binding during a Vite restart.
+* Production initialization remains limited to one runtime per process.
+* @returns Cancellation and cleanup for this development server only.
+*/
+function installDevelopmentWebBinding(options) {
+	if (initialized) throw new Error("A production web runtime was already initialized.");
+	return createBinding(options);
+}
+function createBinding(options) {
+	const origin = new URL(options.publicOrigin.href);
+	if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash || typeof options.graphqlFetch !== "function") throw new TypeError("Invalid web runtime settings.");
+	const current = {
+		publicOrigin: origin.origin,
+		graphqlFetch: options.graphqlFetch,
+		abort: new AbortController(),
+		pending: /* @__PURE__ */ new Set()
+	};
+	binding = current;
+	let closing;
+	return {
+		signal: current.abort.signal,
+		close() {
+			closing ??= (async () => {
+				await Promise.resolve();
+				current.abort.abort();
+				await Promise.allSettled(current.pending);
+				if (binding === current) binding = void 0;
+			})();
+			return closing;
+		}
+	};
+}
+/** Run a server-side Relay request through the configured GraphQL handler.
+* @returns The parsed GraphQL response after its body has been consumed.
+*/
+async function queryGraphql(query, variables, accessToken, sourceSignal) {
+	const current = binding;
+	if (current === void 0 || current.abort.signal.aborted) throw new Error("Web runtime is unavailable.");
+	const signal = AbortSignal.any([sourceSignal, current.abort.signal]);
+	signal.throwIfAborted();
+	const headers = { "content-type": "application/json" };
+	if (accessToken !== void 0 && /^[A-Za-z0-9_-]{43}$/u.test(accessToken)) headers.Authorization = `Bearer ${accessToken}`;
+	const request = new Request(new URL("/graphql", current.publicOrigin), {
+		method: "POST",
+		headers,
+		body: JSON.stringify({
+			query,
+			variables
+		}),
+		signal
+	});
+	const task = (async () => {
+		await Promise.resolve();
+		const response = await current.graphqlFetch(request);
+		if (!response.ok) {
+			try {
+				await response.body?.cancel();
+			} catch {}
+			throw new Error(`GraphQL request failed (${response.status}).`);
+		}
+		const result = await response.json();
+		if (!isGraphqlResponse(result)) throw new Error("Invalid GraphQL response.");
+		return result;
+	})();
+	current.pending.add(task);
+	try {
+		return await task;
+	} finally {
+		current.pending.delete(task);
+	}
+}
+function isGraphqlResponse(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The immutable public web origin used for redirects and cookie security.
+* @returns The configured normalized web origin.
+*/
+function getPublicOrigin() {
+	if (binding === void 0 || binding.abort.signal.aborted) throw new Error("Web runtime is unavailable.");
+	return binding.publicOrigin;
+}
+/** Apply the shared web authority, public scheme and server-function policy.
+* @returns The prepared request or an early rejection.
+*/
+function prepareWebRequest(request) {
+	return prepareWebRequest$1(request, getPublicOrigin());
+}
+//#endregion
+export { getPublicOrigin, installDevelopmentWebBinding, installWebBinding, prepareWebRequest, queryGraphql };
+
+//# sourceMappingURL=bridge.mjs.map

package/dist/bridge.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.mjs","names":["applyRequestPolicy"],"sources":["../src/bridge.ts"],"sourcesContent":["// DrFed: A web-based platform for developing and debugging ActivityPub apps\n// Copyright (C) 2026 DrFed team\n//\n// This program is free software: you can redistribute it and/or modify\n// it under the terms of the GNU Affero General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// This program is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n// GNU Affero General Public License for more details.\n//\n// You should have received a copy of the GNU Affero General Public License\n// along with this program.  If not, see <https://www.gnu.org/licenses/>.\n\nimport type { GraphQLResponse } from \"relay-runtime\";\n\nimport { prepareWebRequest as applyRequestPolicy } from \"./request-policy.ts\";\n\n/** A GraphQL fetch handler owned by the embedding application. */\nexport type GraphqlFetch = (request: Request) => Response | Promise<Response>;\n\n/** Immutable deployment settings shared by the adapter and Nitro server. */\nexport interface WebRuntimeOptions {\n  readonly publicOrigin: URL;\n  readonly graphqlFetch: GraphqlFetch;\n}\n\ninterface Binding {\n  readonly publicOrigin: string;\n  readonly graphqlFetch: GraphqlFetch;\n  readonly abort: AbortController;\n  readonly pending: Set<Promise<unknown>>;\n}\n\nlet binding: Binding | undefined;\nlet initialized = false;\n\n/** Install the process's single web binding before importing Nitro.\n * @returns Runtime cancellation and shared idempotent cleanup.\n */\nexport function installWebBinding(options: WebRuntimeOptions) {\n  if (initialized) {\n    throw new Error(\"A web runtime was already initialized in this process.\");\n  }\n  const owner = createBinding(options);\n  initialized = true;\n  return owner;\n}\n\n/** Replace the development binding during a Vite restart.\n * Production initialization remains limited to one runtime per process.\n * @returns Cancellation and cleanup for this development server only.\n */\nexport function installDevelopmentWebBinding(options: WebRuntimeOptions) {\n  if (initialized) {\n    throw new Error(\"A production web runtime was already initialized.\");\n  }\n  return createBinding(options);\n}\n\nfunction createBinding(options: WebRuntimeOptions) {\n  const origin = new URL(options.publicOrigin.href);\n  if (\n    ![\"http:\", \"https:\"].includes(origin.protocol) ||\n    origin.username ||\n    origin.password ||\n    origin.pathname !== \"/\" ||\n    origin.search ||\n    origin.hash ||\n    typeof options.graphqlFetch !== \"function\"\n  ) {\n    throw new TypeError(\"Invalid web runtime settings.\");\n  }\n  const current: Binding = {\n    publicOrigin: origin.origin,\n    graphqlFetch: options.graphqlFetch,\n    abort: new AbortController(),\n    pending: new Set(),\n  };\n  binding = current;\n  let closing: Promise<void> | undefined;\n  return {\n    signal: current.abort.signal,\n    // oxlint-disable-next-line typescript/promise-function-async\n    close(): Promise<void> {\n      closing ??= (async () => {\n        // Yield before cancellation can invoke callbacks, preserving identity.\n        await Promise.resolve();\n        current.abort.abort();\n        await Promise.allSettled(current.pending);\n        if (binding === current) binding = undefined;\n      })();\n      return closing;\n    },\n  };\n}\n\n/** Run a server-side Relay request through the configured GraphQL handler.\n * @returns The parsed GraphQL response after its body has been consumed.\n */\nexport async function queryGraphql(\n  query: string,\n  variables: Readonly<Record<string, unknown>>,\n  accessToken: string | undefined,\n  sourceSignal: AbortSignal,\n): Promise<GraphQLResponse> {\n  const current = binding;\n  if (current === undefined || current.abort.signal.aborted) {\n    throw new Error(\"Web runtime is unavailable.\");\n  }\n  const signal = AbortSignal.any([sourceSignal, current.abort.signal]);\n  signal.throwIfAborted();\n  const headers: Record<string, string> = {\n    \"content-type\": \"application/json\",\n  };\n  if (accessToken !== undefined && /^[A-Za-z0-9_-]{43}$/u.test(accessToken)) {\n    headers.Authorization = `Bearer ${accessToken}`;\n  }\n  const request = new Request(new URL(\"/graphql\", current.publicOrigin), {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify({ query, variables }),\n    signal,\n  });\n  const task = (async () => {\n    // Register before the supplied handler can request shutdown.\n    await Promise.resolve();\n    const response = await current.graphqlFetch(request);\n    if (!response.ok) {\n      try {\n        await response.body?.cancel();\n      } catch {\n        // Settled cancellation must not expose a handler's raw error.\n      }\n      throw new Error(`GraphQL request failed (${response.status}).`);\n    }\n    const result: unknown = await response.json();\n    if (!isGraphqlResponse(result)) {\n      throw new Error(\"Invalid GraphQL response.\");\n    }\n    return result;\n  })();\n  current.pending.add(task);\n  try {\n    return await task;\n  } finally {\n    current.pending.delete(task);\n  }\n}\n\nfunction isGraphqlResponse(value: unknown): value is GraphQLResponse {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** The immutable public web origin used for redirects and cookie security.\n * @returns The configured normalized web origin.\n */\nexport function getPublicOrigin(): string {\n  if (binding === undefined || binding.abort.signal.aborted) {\n    throw new Error(\"Web runtime is unavailable.\");\n  }\n  return binding.publicOrigin;\n}\n\n/** Apply the shared web authority, public scheme and server-function policy.\n * @returns The prepared request or an early rejection.\n */\nexport function prepareWebRequest(request: Request): Request | Response {\n  return applyRequestPolicy(request, getPublicOrigin());\n}\n"],"mappings":";;AAoCA,IAAI;AACJ,IAAI,cAAc;;;;AAKlB,SAAgB,kBAAkB,SAA4B;CAC5D,IAAI,aACF,MAAM,IAAI,MAAM,wDAAwD;CAE1E,MAAM,QAAQ,cAAc,OAAO;CACnC,cAAc;CACd,OAAO;AACT;;;;;AAMA,SAAgB,6BAA6B,SAA4B;CACvE,IAAI,aACF,MAAM,IAAI,MAAM,mDAAmD;CAErE,OAAO,cAAc,OAAO;AAC9B;AAEA,SAAS,cAAc,SAA4B;CACjD,MAAM,SAAS,IAAI,IAAI,QAAQ,aAAa,IAAI;CAChD,IACE,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO,QAAQ,KAC7C,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,QACP,OAAO,QAAQ,iBAAiB,YAEhC,MAAM,IAAI,UAAU,+BAA+B;CAErD,MAAM,UAAmB;EACvB,cAAc,OAAO;EACrB,cAAc,QAAQ;EACtB,OAAO,IAAI,gBAAgB;EAC3B,yBAAS,IAAI,IAAI;CACnB;CACA,UAAU;CACV,IAAI;CACJ,OAAO;EACL,QAAQ,QAAQ,MAAM;EAEtB,QAAuB;GACrB,aAAa,YAAY;IAEvB,MAAM,QAAQ,QAAQ;IACtB,QAAQ,MAAM,MAAM;IACpB,MAAM,QAAQ,WAAW,QAAQ,OAAO;IACxC,IAAI,YAAY,SAAS,UAAU,KAAA;GACrC,EAAA,CAAG;GACH,OAAO;EACT;CACF;AACF;;;;AAKA,eAAsB,aACpB,OACA,WACA,aACA,cAC0B;CAC1B,MAAM,UAAU;CAChB,IAAI,YAAY,KAAA,KAAa,QAAQ,MAAM,OAAO,SAChD,MAAM,IAAI,MAAM,6BAA6B;CAE/C,MAAM,SAAS,YAAY,IAAI,CAAC,cAAc,QAAQ,MAAM,MAAM,CAAC;CACnE,OAAO,eAAe;CACtB,MAAM,UAAkC,EACtC,gBAAgB,mBAClB;CACA,IAAI,gBAAgB,KAAA,KAAa,uBAAuB,KAAK,WAAW,GACtE,QAAQ,gBAAgB,UAAU;CAEpC,MAAM,UAAU,IAAI,QAAQ,IAAI,IAAI,YAAY,QAAQ,YAAY,GAAG;EACrE,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GAAE;GAAO;EAAU,CAAC;EACzC;CACF,CAAC;CACD,MAAM,QAAQ,YAAY;EAExB,MAAM,QAAQ,QAAQ;EACtB,MAAM,WAAW,MAAM,QAAQ,aAAa,OAAO;EACnD,IAAI,CAAC,SAAS,IAAI;GAChB,IAAI;IACF,MAAM,SAAS,MAAM,OAAO;GAC9B,QAAQ,CAER;GACA,MAAM,IAAI,MAAM,2BAA2B,SAAS,OAAO,GAAG;EAChE;EACA,MAAM,SAAkB,MAAM,SAAS,KAAK;EAC5C,IAAI,CAAC,kBAAkB,MAAM,GAC3B,MAAM,IAAI,MAAM,2BAA2B;EAE7C,OAAO;CACT,EAAA,CAAG;CACH,QAAQ,QAAQ,IAAI,IAAI;CACxB,IAAI;EACF,OAAO,MAAM;CACf,UAAU;EACR,QAAQ,QAAQ,OAAO,IAAI;CAC7B;AACF;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;AAKA,SAAgB,kBAA0B;CACxC,IAAI,YAAY,KAAA,KAAa,QAAQ,MAAM,OAAO,SAChD,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO,QAAQ;AACjB;;;;AAKA,SAAgB,kBAAkB,SAAsC;CACtE,OAAOA,oBAAmB,SAAS,gBAAgB,CAAC;AACtD"}

package/dist/request-policy.d.mts

@@ -0,0 +1,8 @@
+//#region src/request-policy.d.ts
+/** Validate authority and cookie-bearing server functions before body parsing.
+ * @returns A request with its public URL restored, or an early rejection.
+ */
+declare function prepareWebRequest(request: Request, publicOrigin: string): Request | Response;
+//#endregion
+export { prepareWebRequest };
+//# sourceMappingURL=request-policy.d.mts.map

package/dist/request-policy.mjs

@@ -0,0 +1,94 @@
+//#region src/request-policy.ts
+/** Validate authority and cookie-bearing server functions before body parsing.
+* @returns A request with its public URL restored, or an early rejection.
+*/
+function prepareWebRequest(request, publicOrigin) {
+	const origin = new URL(publicOrigin);
+	let validated;
+	try {
+		validated = validateAuthority(request, origin);
+	} catch {
+		return new Response("Invalid request authority.", { status: 400 });
+	}
+	if (validated instanceof Response) return validated;
+	const incoming = validated;
+	let serverFunction;
+	try {
+		serverFunction = isServerFunctionPath(incoming.pathname, origin);
+	} catch {
+		return new Response("Invalid request path.", { status: 400 });
+	}
+	if (serverFunction) {
+		if (request.method !== "POST") return new Response("Method not allowed.", {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		if (!sameOriginSource(request.headers, origin)) return new Response("Forbidden server function request.", { status: 403 });
+	}
+	const target = new URL(incoming.href);
+	target.protocol = origin.protocol;
+	target.host = origin.host;
+	const headers = new Headers(request.headers);
+	headers.set("host", origin.host);
+	for (const name of [
+		"forwarded",
+		"x-forwarded-host",
+		"x-forwarded-proto",
+		"x-forwarded-port",
+		"x-forwarded-for"
+	]) headers.delete(name);
+	const init = {
+		method: request.method,
+		headers,
+		signal: request.signal,
+		duplex: "half"
+	};
+	if (request.method !== "GET" && request.method !== "HEAD") init.body = request.body;
+	return new Request(target, init);
+}
+function validateAuthority(request, origin) {
+	const incoming = new URL(request.url);
+	if (!["http:", "https:"].includes(incoming.protocol) || incoming.username || incoming.password) throw new TypeError("Invalid request URL.");
+	const host = request.headers.get("host");
+	if (host !== null && authority(host, incoming.protocol) !== authority(incoming.host, incoming.protocol)) throw new TypeError("Inconsistent request authority.");
+	if (authority(host ?? incoming.host, origin.protocol) !== authority(origin.host, origin.protocol)) return new Response("Misdirected request.", { status: 421 });
+	return incoming;
+}
+function isServerFunctionPath(value, origin) {
+	let path = value;
+	let serverFunction = path.startsWith("/_server");
+	for (let depth = 0; depth < 5; depth += 1) {
+		const decoded = decodeURIComponent(path).replaceAll("\\", "/");
+		if (decoded === path) break;
+		path = decoded;
+		serverFunction ||= path.startsWith("/_server");
+		if (depth === 4) throw new TypeError("Ambiguous encoded path.");
+	}
+	return serverFunction || new URL(`/${path.replace(/^\/+/u, "")}`, origin).pathname.startsWith("/_server");
+}
+function sameOriginSource(headers, origin) {
+	const source = headers.get("origin");
+	try {
+		if (source === null) {
+			const referer = headers.get("referer");
+			if (referer === null) return false;
+			const candidate = new URL(referer);
+			return candidate.origin === origin.origin && !candidate.username && !candidate.password;
+		}
+		const candidate = new URL(source);
+		return candidate.origin === origin.origin && candidate.href === `${candidate.origin}/` && !candidate.username && !candidate.password;
+	} catch {
+		return false;
+	}
+}
+function authority(value, protocol) {
+	if (value === "" || /[\s/\\?#@,%]/u.test(value)) throw new TypeError("Invalid authority.");
+	const url = new URL(`${protocol}//${value}/`);
+	if (url.username || url.password || url.pathname !== "/" || !url.hostname) throw new TypeError("Invalid authority.");
+	url.hostname = url.hostname.replace(/\.$/u, "");
+	return url.host;
+}
+//#endregion
+export { prepareWebRequest };
+
+//# sourceMappingURL=request-policy.mjs.map

package/dist/request-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-policy.mjs","names":[],"sources":["../src/request-policy.ts"],"sourcesContent":["// DrFed: A web-based platform for developing and debugging ActivityPub apps\n// Copyright (C) 2026 DrFed team\n//\n// This program is free software: you can redistribute it and/or modify\n// it under the terms of the GNU Affero General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// This program is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n// GNU Affero General Public License for more details.\n//\n// You should have received a copy of the GNU Affero General Public License\n// along with this program.  If not, see <https://www.gnu.org/licenses/>.\n\n/** Validate authority and cookie-bearing server functions before body parsing.\n * @returns A request with its public URL restored, or an early rejection.\n */\nexport function prepareWebRequest(\n  request: Request,\n  publicOrigin: string,\n): Request | Response {\n  const origin = new URL(publicOrigin);\n  let validated: URL | Response;\n  try {\n    validated = validateAuthority(request, origin);\n  } catch {\n    return new Response(\"Invalid request authority.\", { status: 400 });\n  }\n  if (validated instanceof Response) return validated;\n  const incoming = validated;\n  let serverFunction: boolean;\n  try {\n    serverFunction = isServerFunctionPath(incoming.pathname, origin);\n  } catch {\n    return new Response(\"Invalid request path.\", { status: 400 });\n  }\n  // SolidStart dispatches every pathname beginning with this prefix.\n  if (serverFunction) {\n    if (request.method !== \"POST\") {\n      return new Response(\"Method not allowed.\", {\n        status: 405,\n        headers: { allow: \"POST\" },\n      });\n    }\n    if (!sameOriginSource(request.headers, origin)) {\n      return new Response(\"Forbidden server function request.\", {\n        status: 403,\n      });\n    }\n  }\n  const target = new URL(incoming.href);\n  target.protocol = origin.protocol;\n  target.host = origin.host;\n  const headers = new Headers(request.headers);\n  headers.set(\"host\", origin.host);\n  for (const name of [\n    \"forwarded\",\n    \"x-forwarded-host\",\n    \"x-forwarded-proto\",\n    \"x-forwarded-port\",\n    \"x-forwarded-for\",\n  ]) {\n    headers.delete(name);\n  }\n  const init: RequestInit & { duplex: \"half\" } = {\n    method: request.method,\n    headers,\n    signal: request.signal,\n    duplex: \"half\",\n  };\n  if (request.method !== \"GET\" && request.method !== \"HEAD\") {\n    init.body = request.body;\n  }\n  return new Request(target, init);\n}\n\nfunction validateAuthority(request: Request, origin: URL): URL | Response {\n  const incoming = new URL(request.url);\n  if (\n    ![\"http:\", \"https:\"].includes(incoming.protocol) ||\n    incoming.username ||\n    incoming.password\n  ) {\n    throw new TypeError(\"Invalid request URL.\");\n  }\n  const host = request.headers.get(\"host\");\n  if (\n    host !== null &&\n    authority(host, incoming.protocol) !==\n      authority(incoming.host, incoming.protocol)\n  ) {\n    throw new TypeError(\"Inconsistent request authority.\");\n  }\n  if (\n    authority(host ?? incoming.host, origin.protocol) !==\n    authority(origin.host, origin.protocol)\n  ) {\n    return new Response(\"Misdirected request.\", { status: 421 });\n  }\n  return incoming;\n}\n\nfunction isServerFunctionPath(value: string, origin: URL): boolean {\n  let path = value;\n  let serverFunction = path.startsWith(\"/_server\");\n  for (let depth = 0; depth < 5; depth += 1) {\n    const decoded = decodeURIComponent(path).replaceAll(\"\\\\\", \"/\");\n    if (decoded === path) break;\n    path = decoded;\n    serverFunction ||= path.startsWith(\"/_server\");\n    if (depth === 4) throw new TypeError(\"Ambiguous encoded path.\");\n  }\n  return (\n    serverFunction ||\n    new URL(`/${path.replace(/^\\/+/u, \"\")}`, origin).pathname.startsWith(\n      \"/_server\",\n    )\n  );\n}\n\nfunction sameOriginSource(headers: Headers, origin: URL): boolean {\n  const source = headers.get(\"origin\");\n  try {\n    if (source === null) {\n      const referer = headers.get(\"referer\");\n      if (referer === null) return false;\n      const candidate = new URL(referer);\n      return (\n        candidate.origin === origin.origin &&\n        !candidate.username &&\n        !candidate.password\n      );\n    }\n    const candidate = new URL(source);\n    return (\n      candidate.origin === origin.origin &&\n      candidate.href === `${candidate.origin}/` &&\n      !candidate.username &&\n      !candidate.password\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction authority(value: string, protocol: string): string {\n  if (value === \"\" || /[\\s/\\\\?#@,%]/u.test(value)) {\n    throw new TypeError(\"Invalid authority.\");\n  }\n  const url = new URL(`${protocol}//${value}/`);\n  if (url.username || url.password || url.pathname !== \"/\" || !url.hostname) {\n    throw new TypeError(\"Invalid authority.\");\n  }\n  url.hostname = url.hostname.replace(/\\.$/u, \"\");\n  return url.host;\n}\n"],"mappings":";;;;AAmBA,SAAgB,kBACd,SACA,cACoB;CACpB,MAAM,SAAS,IAAI,IAAI,YAAY;CACnC,IAAI;CACJ,IAAI;EACF,YAAY,kBAAkB,SAAS,MAAM;CAC/C,QAAQ;EACN,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;CACnE;CACA,IAAI,qBAAqB,UAAU,OAAO;CAC1C,MAAM,WAAW;CACjB,IAAI;CACJ,IAAI;EACF,iBAAiB,qBAAqB,SAAS,UAAU,MAAM;CACjE,QAAQ;EACN,OAAO,IAAI,SAAS,yBAAyB,EAAE,QAAQ,IAAI,CAAC;CAC9D;CAEA,IAAI,gBAAgB;EAClB,IAAI,QAAQ,WAAW,QACrB,OAAO,IAAI,SAAS,uBAAuB;GACzC,QAAQ;GACR,SAAS,EAAE,OAAO,OAAO;EAC3B,CAAC;EAEH,IAAI,CAAC,iBAAiB,QAAQ,SAAS,MAAM,GAC3C,OAAO,IAAI,SAAS,sCAAsC,EACxD,QAAQ,IACV,CAAC;CAEL;CACA,MAAM,SAAS,IAAI,IAAI,SAAS,IAAI;CACpC,OAAO,WAAW,OAAO;CACzB,OAAO,OAAO,OAAO;CACrB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;CAC3C,QAAQ,IAAI,QAAQ,OAAO,IAAI;CAC/B,KAAK,MAAM,QAAQ;EACjB;EACA;EACA;EACA;EACA;CACF,GACE,QAAQ,OAAO,IAAI;CAErB,MAAM,OAAyC;EAC7C,QAAQ,QAAQ;EAChB;EACA,QAAQ,QAAQ;EAChB,QAAQ;CACV;CACA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,QACjD,KAAK,OAAO,QAAQ;CAEtB,OAAO,IAAI,QAAQ,QAAQ,IAAI;AACjC;AAEA,SAAS,kBAAkB,SAAkB,QAA6B;CACxE,MAAM,WAAW,IAAI,IAAI,QAAQ,GAAG;CACpC,IACE,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,SAAS,SAAS,QAAQ,KAC/C,SAAS,YACT,SAAS,UAET,MAAM,IAAI,UAAU,sBAAsB;CAE5C,MAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM;CACvC,IACE,SAAS,QACT,UAAU,MAAM,SAAS,QAAQ,MAC/B,UAAU,SAAS,MAAM,SAAS,QAAQ,GAE5C,MAAM,IAAI,UAAU,iCAAiC;CAEvD,IACE,UAAU,QAAQ,SAAS,MAAM,OAAO,QAAQ,MAChD,UAAU,OAAO,MAAM,OAAO,QAAQ,GAEtC,OAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,IAAI,CAAC;CAE7D,OAAO;AACT;AAEA,SAAS,qBAAqB,OAAe,QAAsB;CACjE,IAAI,OAAO;CACX,IAAI,iBAAiB,KAAK,WAAW,UAAU;CAC/C,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;EACzC,MAAM,UAAU,mBAAmB,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;EAC7D,IAAI,YAAY,MAAM;EACtB,OAAO;EACP,mBAAmB,KAAK,WAAW,UAAU;EAC7C,IAAI,UAAU,GAAG,MAAM,IAAI,UAAU,yBAAyB;CAChE;CACA,OACE,kBACA,IAAI,IAAI,IAAI,KAAK,QAAQ,SAAS,EAAE,KAAK,MAAM,CAAC,CAAC,SAAS,WACxD,UACF;AAEJ;AAEA,SAAS,iBAAiB,SAAkB,QAAsB;CAChE,MAAM,SAAS,QAAQ,IAAI,QAAQ;CACnC,IAAI;EACF,IAAI,WAAW,MAAM;GACnB,MAAM,UAAU,QAAQ,IAAI,SAAS;GACrC,IAAI,YAAY,MAAM,OAAO;GAC7B,MAAM,YAAY,IAAI,IAAI,OAAO;GACjC,OACE,UAAU,WAAW,OAAO,UAC5B,CAAC,UAAU,YACX,CAAC,UAAU;EAEf;EACA,MAAM,YAAY,IAAI,IAAI,MAAM;EAChC,OACE,UAAU,WAAW,OAAO,UAC5B,UAAU,SAAS,GAAG,UAAU,OAAO,MACvC,CAAC,UAAU,YACX,CAAC,UAAU;CAEf,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,UAAU,OAAe,UAA0B;CAC1D,IAAI,UAAU,MAAM,gBAAgB,KAAK,KAAK,GAC5C,MAAM,IAAI,UAAU,oBAAoB;CAE1C,MAAM,MAAM,IAAI,IAAI,GAAG,SAAS,IAAI,MAAM,EAAE;CAC5C,IAAI,IAAI,YAAY,IAAI,YAAY,IAAI,aAAa,OAAO,CAAC,IAAI,UAC/D,MAAM,IAAI,UAAU,oBAAoB;CAE1C,IAAI,WAAW,IAAI,SAAS,QAAQ,QAAQ,EAAE;CAC9C,OAAO,IAAI;AACb"}

package/dist/runtime.d.mts

@@ -0,0 +1,14 @@
+import { GraphqlFetch, WebRuntimeOptions } from "./bridge.mjs";
+//#region src/runtime.d.ts
+/** One embedded SolidStart server, without a listening socket. */
+interface WebRuntime {
+  readonly fetch: (request: Request) => Promise<Response>;
+  readonly close: () => Promise<void>;
+}
+/** Initialize the process's single embedded web server.
+ * @returns The shared embedded handler and idempotent cleanup.
+ */
+declare function createWebRuntime(options: WebRuntimeOptions): Promise<WebRuntime>;
+//#endregion
+export { type GraphqlFetch, WebRuntime, type WebRuntimeOptions, createWebRuntime };
+//# sourceMappingURL=runtime.d.mts.map

package/dist/runtime.mjs

@@ -0,0 +1,44 @@
+import { installWebBinding, prepareWebRequest } from "./bridge.mjs";
+//#region src/runtime.ts
+/** Initialize the process's single embedded web server.
+* @returns The shared embedded handler and idempotent cleanup.
+*/
+async function createWebRuntime(options) {
+	const owner = installWebBinding(options);
+	let nitro;
+	try {
+		const loaded = await import(new URL("../.output/server/index.mjs", import.meta.url).href);
+		if (!isNitroRuntime(loaded)) throw new Error("Invalid bundled web runtime.");
+		nitro = loaded;
+	} catch (error) {
+		await owner.close();
+		throw error;
+	}
+	let closing;
+	return {
+		async fetch(request) {
+			if (owner.signal.aborted) return new Response("Web runtime is closed.", { status: 503 });
+			const prepared = prepareWebRequest(request);
+			if (prepared instanceof Response) return prepared;
+			return nitro.fetch(new Request(prepared, { signal: AbortSignal.any([request.signal, owner.signal]) }));
+		},
+		close() {
+			closing ??= (async () => {
+				await Promise.resolve();
+				try {
+					await owner.close();
+				} finally {
+					await nitro.close();
+				}
+			})();
+			return closing;
+		}
+	};
+}
+function isNitroRuntime(value) {
+	return typeof value === "object" && value !== null && "fetch" in value && typeof value.fetch === "function" && "close" in value && typeof value.close === "function";
+}
+//#endregion
+export { createWebRuntime };
+
+//# sourceMappingURL=runtime.mjs.map

package/dist/runtime.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/runtime.ts"],"sourcesContent":["// DrFed: A web-based platform for developing and debugging ActivityPub apps\n// Copyright (C) 2026 DrFed team\n//\n// This program is free software: you can redistribute it and/or modify\n// it under the terms of the GNU Affero General Public License as published by\n// the Free Software Foundation, either version 3 of the License, or\n// (at your option) any later version.\n//\n// This program is distributed in the hope that it will be useful,\n// but WITHOUT ANY WARRANTY; without even the implied warranty of\n// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n// GNU Affero General Public License for more details.\n//\n// You should have received a copy of the GNU Affero General Public License\n// along with this program.  If not, see <https://www.gnu.org/licenses/>.\n\nimport {\n  type WebRuntimeOptions,\n  installWebBinding,\n  prepareWebRequest,\n} from \"./bridge.ts\";\n\nexport type { GraphqlFetch, WebRuntimeOptions } from \"./bridge.ts\";\n\n/** One embedded SolidStart server, without a listening socket. */\nexport interface WebRuntime {\n  readonly fetch: (request: Request) => Promise<Response>;\n  readonly close: () => Promise<void>;\n}\n\ninterface NitroRuntime {\n  fetch: (request: Request) => Response | Promise<Response>;\n  close: () => Promise<void>;\n}\n\n/** Initialize the process's single embedded web server.\n * @returns The shared embedded handler and idempotent cleanup.\n */\nexport async function createWebRuntime(\n  options: WebRuntimeOptions,\n): Promise<WebRuntime> {\n  const owner = installWebBinding(options);\n  let nitro: NitroRuntime;\n  try {\n    const loaded: unknown = await import(\n      new URL(\"../.output/server/index.mjs\", import.meta.url).href\n    );\n    if (!isNitroRuntime(loaded)) {\n      throw new Error(\"Invalid bundled web runtime.\");\n    }\n    nitro = loaded;\n  } catch (error) {\n    await owner.close();\n    throw error;\n  }\n  let closing: Promise<void> | undefined;\n  return {\n    async fetch(request) {\n      if (owner.signal.aborted) {\n        return new Response(\"Web runtime is closed.\", { status: 503 });\n      }\n      const prepared = prepareWebRequest(request);\n      if (prepared instanceof Response) return prepared;\n      return nitro.fetch(\n        new Request(prepared, {\n          signal: AbortSignal.any([request.signal, owner.signal]),\n        }),\n      );\n    },\n    // oxlint-disable-next-line typescript/promise-function-async\n    close(): Promise<void> {\n      closing ??= (async () => {\n        await Promise.resolve();\n        try {\n          await owner.close();\n        } finally {\n          await nitro.close();\n        }\n      })();\n      return closing;\n    },\n  };\n}\n\nfunction isNitroRuntime(value: unknown): value is NitroRuntime {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"fetch\" in value &&\n    typeof value.fetch === \"function\" &&\n    \"close\" in value &&\n    typeof value.close === \"function\"\n  );\n}\n"],"mappings":";;;;;AAsCA,eAAsB,iBACpB,SACqB;CACrB,MAAM,QAAQ,kBAAkB,OAAO;CACvC,IAAI;CACJ,IAAI;EACF,MAAM,SAAkB,MAAM,OAC5B,IAAI,IAAI,+BAA+B,OAAO,KAAK,GAAG,CAAC,CAAC;EAE1D,IAAI,CAAC,eAAe,MAAM,GACxB,MAAM,IAAI,MAAM,8BAA8B;EAEhD,QAAQ;CACV,SAAS,OAAO;EACd,MAAM,MAAM,MAAM;EAClB,MAAM;CACR;CACA,IAAI;CACJ,OAAO;EACL,MAAM,MAAM,SAAS;GACnB,IAAI,MAAM,OAAO,SACf,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;GAE/D,MAAM,WAAW,kBAAkB,OAAO;GAC1C,IAAI,oBAAoB,UAAU,OAAO;GACzC,OAAO,MAAM,MACX,IAAI,QAAQ,UAAU,EACpB,QAAQ,YAAY,IAAI,CAAC,QAAQ,QAAQ,MAAM,MAAM,CAAC,EACxD,CAAC,CACH;EACF;EAEA,QAAuB;GACrB,aAAa,YAAY;IACvB,MAAM,QAAQ,QAAQ;IACtB,IAAI;KACF,MAAM,MAAM,MAAM;IACpB,UAAU;KACR,MAAM,MAAM,MAAM;IACpB;GACF,EAAA,CAAG;GACH,OAAO;EACT;CACF;AACF;AAEA,SAAS,eAAe,OAAuC;CAC7D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAO,MAAM,UAAU,cACvB,WAAW,SACX,OAAO,MAAM,UAAU;AAE3B"}

package/package.json

@@ -1,6 +1,114 @@
 {
   "name": "@drfed/web",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0-dev.0",
+  "description": "A SolidStart frontend for DrFed.",
+  "keywords": [
+    "ActivityPub",
+    "fediverse",
+    "federation",
+    "debugger"
+  ],
+  "author": {
+    "name": "DrFed team",
+    "url": "https://drfed.org/"
+  },
+  "maintainers": [
+    {
+      "name": "ChanHaeng Lee",
+      "email": "2chanhaeng@gmail.com",
+      "url": "https://chomu.dev/"
+    },
+    {
+      "name": "Hong Minhee",
+      "email": "hong@minhee.org",
+      "url": "https://hongminhee.org/"
+    },
+    {
+      "name": "Hyeonseo Kim",
+      "email": "dodok8@gmail.com",
+      "url": "https://hackers.pub/@gaebalgom"
+    },
+    {
+      "name": "Jiwon Kwon",
+      "email": "work@kwonjiwon.org",
+      "url": "https://kwonjiwon.org/"
+    }
+  ],
+  "license": "AGPL-3.0-only",
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "type": "module",
+  "dependencies": {
+    "@faker-js/faker": "^10.5.0",
+    "@formisch/solid": "1.0.0",
+    "@kobalte/core": "^0.13.13",
+    "@solidjs/meta": "^0.29.4",
+    "@solidjs/router": "^1.0.0",
+    "@solidjs/start": "^2.0.0",
+    "nitro": "3.0.260610-beta",
+    "relay-runtime": "^21.0.1",
+    "seroval": "1.6.3",
+    "shiki": "4.4.1",
+    "solid-js": "^1.9.5",
+    "solid-relay": "1.0.0-beta.29",
+    "valibot": "1.4.2",
+    "vite": "^8.2.0",
+    "@types/relay-runtime": "^20.1.1"
+  },
+  "devDependencies": {
+    "eslint-plugin-solid": "^0.14.5",
+    "relay-compiler": "^21.0.1",
+    "typescript": "^7.0.2",
+    "vite-plugin-cjs-interop": "^4.0.3",
+    "vite-plugin-relay-lite": "^0.12.0",
+    "tsdown": "^0.22.14",
+    "@types/node": "^26.0.0"
+  },
+  "files": [
+    "dist/",
+    ".output/",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/runtime.mjs",
+  "types": "dist/runtime.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/runtime.d.mts",
+      "default": "./dist/runtime.mjs"
+    },
+    "./bridge": {
+      "types": "./dist/bridge.d.mts",
+      "default": "./dist/bridge.mjs"
+    },
+    "./request-policy": {
+      "types": "./dist/request-policy.d.mts",
+      "default": "./dist/request-policy.mjs"
+    }
+  },
+  "tsdown": {
+    "entry": [
+      "src/runtime.ts",
+      "src/bridge.ts",
+      "src/request-policy.ts"
+    ],
+    "dts": {
+      "tsconfig": "tsconfig.runtime.json"
+    },
+    "sourcemap": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/fedify-dev/drfed.git",
+    "directory": "packages/web"
+  },
+  "scripts": {
+    "dev": "vite dev",
+    "build": "tsdown && vite build",
+    "preview": "vite preview",
+    "test": "node --test"
+  }
 }