npm - @finesoft/front - Versions diffs - 0.5.1 → 0.5.2 - Mend

@finesoft/front 0.5.1 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (128) hide show

package/README.md +4 -4
package/dist/Outlet.svelte +39 -0
package/dist/Outlet.svelte.d.ts +7 -0
package/dist/browser-DIU6Sxl3.mjs +1237 -0
package/dist/browser-kFMjlLGT.d.mts +262 -0
package/dist/browser.d.mts +7 -2
package/dist/browser.mjs +9 -1
package/dist/controller-types-CgmJ6-le.d.mts +16 -0
package/dist/cookies-Bpf9VayB.d.mts +779 -0
package/dist/fetch-policy-BHT8RtrL.mjs +82 -0
package/dist/host-guard-DDWxLpFL.mjs +222 -0
package/dist/http-B6CJqDyf.d.mts +46 -0
package/dist/http-CaxrMD1A.d.mts +1 -0
package/dist/http-D70PL72H.mjs +257 -0
package/dist/http.d.mts +3 -0
package/dist/http.mjs +2 -0
package/dist/index-node.d.mts +15 -0
package/dist/index-node.mjs +15 -0
package/dist/index.d.mts +48 -697
package/dist/index.mjs +44 -261
package/dist/load-node.d.mts +5 -0
package/dist/load-node.mjs +10 -0
package/dist/load-portable.d.mts +5 -0
package/dist/load-portable.mjs +8 -0
package/dist/lru-map-BKoUAySU.mjs +50 -0
package/dist/messages-CAt2QdGr.mjs +140 -0
package/dist/native-contract-DuR25hYB.d.mts +14 -0
package/dist/native-contract.d.mts +2 -0
package/dist/native-contract.mjs +1 -0
package/dist/node-D9hB4dsz.d.mts +35 -0
package/dist/node.d.mts +2 -0
package/dist/node.mjs +59 -0
package/dist/path-CGFl2w7D.mjs +113 -0
package/dist/path-CXT6xGPO.d.mts +261 -0
package/dist/portable-CaxrMD1A.d.mts +1 -0
package/dist/portable.d.mts +11 -0
package/dist/portable.mjs +12 -0
package/dist/proxy-1SphZ7x7.mjs +436 -0
package/dist/proxy-2dSWO-Xw.d.mts +53 -0
package/dist/public-types-BcJM-AYc.mjs +835 -0
package/dist/react-DhwBRw01.d.mts +16 -0
package/dist/react.d.mts +3 -0
package/dist/react.mjs +29 -0
package/dist/rolldown-runtime-B4iAMlE-.mjs +35 -0
package/dist/secure-fetch-Xlht2jd7.d.mts +30 -0
package/dist/server-controller-proxy-BkVuVWVD.d.mts +38 -0
package/dist/session-DnB4ZC3x.d.mts +1279 -0
package/dist/src-Ftl_0rhu.mjs +28 -0
package/dist/src-qwx7Vw8g.mjs +3807 -0
package/dist/ssr-BEUNDvbj.d.mts +210 -0
package/dist/ssr-C8xnYXoY.mjs +357 -0
package/dist/ssr.d.mts +3 -0
package/dist/ssr.mjs +3 -0
package/dist/svelte-Dr5to3SE.d.mts +16 -0
package/dist/svelte.d.mts +3 -0
package/dist/svelte.mjs +13 -0
package/dist/typegen-C-WeJCtf.d.mts +12 -0
package/dist/typegen-cli.d.mts +1 -0
package/dist/typegen-cli.mjs +11 -0
package/dist/typegen.d.mts +3 -0
package/dist/typegen.mjs +2 -0
package/dist/types-BuaZHRG7.mjs +402 -0
package/dist/undici-CPfL25Hr.mjs +22262 -0
package/dist/vite-Cj4SPA8D.d.mts +277 -0
package/dist/vite.d.mts +4 -0
package/dist/vite.mjs +2354 -0
package/dist/vue-DGmzuKho.d.mts +32 -0
package/dist/vue.d.mts +3 -0
package/dist/vue.mjs +56 -0
package/dist/web.d.mts +6 -0
package/dist/web.mjs +8 -0
package/dist/worker.d.mts +2 -0
package/dist/worker.mjs +2 -0
package/docs/01-getting-started.md +67 -199
package/docs/02-routing-and-controllers.md +163 -241
package/docs/03-middleware.md +10 -212
package/docs/04-rendering-and-hydration.md +6 -333
package/docs/05-i18n.md +7 -237
package/docs/06-http-client.md +20 -263
package/docs/07-di-container.md +23 -257
package/docs/08-observability.md +6 -286
package/docs/09-server-and-deployment.md +59 -219
package/docs/10-features-platform-pwa.md +7 -231
package/docs/11-navigation.md +143 -288
package/docs/12-session-restoration.md +6 -214
package/docs/README.md +7 -7
package/docs/advanced/custom-action-handler.md +29 -229
package/docs/advanced/custom-adapter.md +7 -259
package/docs/advanced/custom-event-recorder.md +7 -312
package/docs/advanced/inline-proxy-codegen.md +6 -185
package/docs/advanced/multi-tenant-scopes.md +10 -323
package/docs/engineering/ci-release-flow.md +35 -222
package/docs/engineering/project-structure.md +34 -277
package/docs/engineering/testing.md +8 -310
package/docs/pitfalls/container-scope-leak.md +2 -214
package/docs/pitfalls/i18n-bundle-size.md +6 -176
package/docs/pitfalls/proxy-binary-payloads.md +8 -12
package/docs/pitfalls/ssr-hydration-mismatch.md +4 -160
package/docs/pitfalls/ssr-vs-csr-globals.md +9 -170
package/docs/zh/01-getting-started.md +67 -199
package/docs/zh/02-routing-and-controllers.md +166 -244
package/docs/zh/03-middleware.md +10 -212
package/docs/zh/04-rendering-and-hydration.md +6 -333
package/docs/zh/05-i18n.md +7 -237
package/docs/zh/06-http-client.md +20 -263
package/docs/zh/07-di-container.md +23 -257
package/docs/zh/08-observability.md +6 -283
package/docs/zh/09-server-and-deployment.md +59 -219
package/docs/zh/10-features-platform-pwa.md +7 -231
package/docs/zh/11-navigation.md +130 -290
package/docs/zh/12-session-restoration.md +6 -214
package/docs/zh/README.md +4 -4
package/docs/zh/advanced/custom-action-handler.md +29 -229
package/docs/zh/advanced/custom-adapter.md +7 -259
package/docs/zh/advanced/custom-event-recorder.md +7 -312
package/docs/zh/advanced/inline-proxy-codegen.md +6 -185
package/docs/zh/advanced/multi-tenant-scopes.md +10 -323
package/docs/zh/engineering/ci-release-flow.md +35 -222
package/docs/zh/engineering/project-structure.md +34 -277
package/docs/zh/engineering/testing.md +8 -310
package/docs/zh/pitfalls/container-scope-leak.md +2 -214
package/docs/zh/pitfalls/i18n-bundle-size.md +6 -176
package/docs/zh/pitfalls/proxy-binary-payloads.md +8 -12
package/docs/zh/pitfalls/ssr-hydration-mismatch.md +4 -160
package/docs/zh/pitfalls/ssr-vs-csr-globals.md +9 -170
package/package.json +118 -20
package/dist/browser-BHhVWXik.mjs +0 -2
package/dist/browser-BV2BBXm7.d.mts +0 -2811

package/dist/proxy-1SphZ7x7.mjs ADDED Viewed

@@ -0,0 +1,436 @@
+import { Bt as fetchWithRedirects, _ as SERVER_CONTROLLER_PATH, kt as getLocaleAttributes, t as parseCookieString } from "./src-qwx7Vw8g.mjs";
+import { t as LruMap } from "./lru-map-BKoUAySU.mjs";
+import "./src-Ftl_0rhu.mjs";
+//#region ../ssr/src/inject.ts
+/**
+* injectSSRContent — 将 SSR 渲染结果注入 HTML 模板
+*/
+/** SSR HTML 模板占位符常量 */
+const SSR_PLACEHOLDERS = {
+	HEAD: "<!--ssr-head-->",
+	BODY: "<!--ssr-body-->",
+	DATA: "<!--ssr-data-->"
+};
+/** 匹配所有 <!--ssr-xxx--> 占位符（含内置与自定义） */
+const PLACEHOLDER_REGEX = /<!--ssr-([a-z][a-z0-9-]*)-->/g;
+function injectSSRContent(options) {
+	const { template, head, css, html, serializedData, slots, locale } = options;
+	const replacements = {
+		head: `${head}\n${css ? `<style>${css}</style>` : ""}`,
+		body: html,
+		data: `<script data-fs-server-data type="application/json">${serializedData}<\/script>`,
+		...slots
+	};
+	let result = template.replace(PLACEHOLDER_REGEX, (_, name) => replacements[name] ?? "");
+	if (locale) result = applyLocaleToHtml(result, locale);
+	return result;
+}
+/**
+* CSR 空壳注入 — 清空所有占位符
+* 用于 renderMode === "csr" 的路由
+*
+* @param locale - 可选的 locale 属性，注入到 `<html lang="" dir="">`
+*/
+function injectCSRShell(template, locale) {
+	let result = template.replace(PLACEHOLDER_REGEX, () => "");
+	if (locale) result = applyLocaleToHtml(result, locale);
+	return result;
+}
+/** 将 lang/dir 注入到 <html> 标签（支持双引号 / 单引号 / 无引号属性值） */
+const HTML_LANG_PATTERN = /\s+lang=("[^"]*"|'[^']*'|[^\s>]+)/gi;
+const HTML_DIR_PATTERN = /\s+dir=("[^"]*"|'[^']*'|[^\s>]+)/gi;
+function applyLocaleToHtml(html, locale) {
+	return html.replace(/(<html)([^>]*)(>)/i, (_match, open, attrs, close) => {
+		return `${open}${attrs.replace(HTML_LANG_PATTERN, "").replace(HTML_DIR_PATTERN, "")} lang="${escapeAttribute(locale.lang)}" dir="${escapeAttribute(locale.dir)}"${close}`;
+	});
+}
+function escapeAttribute(value) {
+	return value.replace(/[&<>"']/g, (character) => {
+		switch (character) {
+			case "&": return "&amp;";
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			case "\"": return "&quot;";
+			default: return "&#39;";
+		}
+	});
+}
+//#endregion
+//#region ../server/src/internal-fetch.ts
+/**
+* createInternalFetch — SSR 内部路由回环 fetch 包装器
+*
+* 将相对路径（/api/…）请求转为 Hono app.fetch 内存调用，
+* 绝对 URL 和非字符串 input 走 globalThis.fetch（真实网络）。
+*
+* 递归深度保护采用请求头传递：每次 SSR 回环在请求头中写入深度值，
+* SSR catch-all 读取深度判断是否超限。对比闭包计数器方案：
+* - 并发安全：无共享可变状态
+* - 跨渲染准确：深度随请求在 Hono 路由链中传递
+*/
+const SSR_DEPTH_HEADER = "x-ssr-depth";
+/**
+* 创建请求级 internal fetch
+*
+* @param appFetch - Hono app.fetch（父级路由）
+* @param depth - 当前 SSR 深度（由 catch-all handler 从请求头读取后 +1 传入）
+*/
+function createInternalFetch(appFetch, depth = 1, context) {
+	return ((input, init) => {
+		if (typeof input === "string" && input.startsWith("/")) {
+			const base = context?.request.url ?? "http://localhost";
+			const target = new URL(input, base);
+			if (target.origin !== new URL(base).origin) throw new TypeError("Internal fetch must stay on the request origin");
+			const signal = context ? AbortSignal.any([context.request.signal, ...init?.signal ? [init.signal] : []]) : init?.signal;
+			const request = new Request(target, {
+				...init,
+				signal
+			});
+			request.headers.set(SSR_DEPTH_HEADER, String(depth));
+			return Promise.resolve(appFetch(request, context?.bindings));
+		}
+		const signal = context ? AbortSignal.any([
+			context.request.signal,
+			...input instanceof Request ? [input.signal] : [],
+			...init?.signal ? [init.signal] : []
+		]) : init?.signal;
+		return globalThis.fetch(input, signal ? {
+			...init,
+			signal
+		} : init);
+	});
+}
+//#endregion
+//#region ../server/src/ssr-cache.ts
+/** Shared HTML must be explicitly public and carry no request-specific response metadata. */
+function isPublicSSRResult(result, headers = new Headers(result.headers)) {
+	return result.cache === "public" && !result.redirect && !result.rewriteUrl && (result.status ?? 200) === 200 && headers.keys().next().done === true;
+}
+//#endregion
+//#region ../server/src/ssr-handler.ts
+function matchRenderModeOverride(url, renderModes) {
+	const path = url.split("?")[0];
+	if (renderModes?.[path]) return renderModes[path];
+	for (const [pattern, mode] of Object.entries(renderModes ?? {})) if (pattern.includes("*")) {
+		const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+		if (new RegExp("^" + escaped.replace(/\*/g, ".*") + "$").test(path)) return mode;
+	}
+}
+/** Standard Request/Response HTML assembly; owns no Node, Hono, filesystem or Vite state. */
+function createSSRHandler(options) {
+	const cache = options.cache ?? new LruMap(1e3);
+	const ownRenderers = options.ownRenderers ?? false;
+	const owners = /* @__PURE__ */ new Set();
+	if (ownRenderers && "render" in options) owners.add(options.render);
+	const active = /* @__PURE__ */ new Set();
+	let closing;
+	const respond = async (request, bindings = {}) => {
+		const parsed = new URL(request.url);
+		const url = parsed.pathname + parsed.search;
+		const depth = Number(request.headers.get("x-ssr-depth") ?? 0);
+		const remote = parsed.pathname === SERVER_CONTROLLER_PATH;
+		if (!Number.isInteger(depth) || depth < 0 || depth >= 5) return new Response("SSR recursion loop detected", { status: 508 });
+		if (remote && (request.method !== "POST" || request.headers.get("origin") !== parsed.origin || request.headers.get("x-finesoft-controller") !== "1" || request.headers.get("sec-fetch-site") === "cross-site" || request.headers.get("content-type")?.split(";")[0]?.trim() !== "application/json")) return new Response("Forbidden", {
+			status: 403,
+			headers: { "cache-control": "no-store" }
+		});
+		if (!remote && request.method !== "GET" && request.method !== "HEAD") return new Response("Method not allowed", {
+			status: 405,
+			headers: { Allow: "GET, HEAD" }
+		});
+		const requestState = {
+			request,
+			responseHeaders: new Headers(),
+			remote,
+			cookies: parseCookieString(request.headers.get("cookie") ?? "")
+		};
+		try {
+			request.signal.throwIfAborted();
+			const template = remote ? "" : typeof options.template === "string" ? options.template : await options.template(request);
+			const override = matchRenderModeOverride(url, options.renderModes);
+			const defaultLocale = options.defaultLocale ? getLocaleAttributes(options.defaultLocale) : void 0;
+			const respond = (html, status = 200, headers = new Headers()) => {
+				if (!headers.has("content-type")) headers.set("content-type", "text/html; charset=utf-8");
+				return new Response(request.method === "HEAD" || status === 204 || status === 304 ? null : html, {
+					status,
+					headers
+				});
+			};
+			if (!remote && override === "csr") return respond(injectCSRShell(template, defaultLocale));
+			const publicRequest = !request.headers.has("cookie") && !request.headers.has("authorization");
+			const module = "loadModule" in options ? await options.loadModule(request) : options;
+			if (ownRenderers) owners.add(module.render);
+			const context = {
+				request,
+				bindings,
+				requestState,
+				safeFetch: options.safeFetch,
+				fetch: options.fetch ? createInternalFetch(options.fetch, depth + 1, {
+					request,
+					bindings
+				}) : void 0
+			};
+			let result;
+			if (remote) {
+				if (!module.render.controller) return new Response("Not found", {
+					status: 404,
+					headers: { "cache-control": "no-store" }
+				});
+				const input = await readControllerRequest(request);
+				if (!input) return new Response("Invalid controller request", {
+					status: 400,
+					headers: { "cache-control": "no-store" }
+				});
+				result = await module.render.controller(input, context);
+			} else result = await module.render(url, context);
+			request.signal.throwIfAborted();
+			const headers = requestState.responseHeaders;
+			if (result.headers && result.headers !== headers) {
+				const supplied = new Headers(result.headers);
+				for (const [key, value] of supplied) if (key !== "set-cookie") headers.set(key, value);
+				for (const cookie of supplied.getSetCookie()) headers.append("set-cookie", cookie);
+			}
+			if (remote) {
+				headers.set("content-type", "application/json");
+				headers.set("cache-control", "no-store");
+				if (result.rewriteUrl) headers.set("content-location", result.rewriteUrl);
+				const body = result.redirect ? JSON.stringify({ redirect: result.redirect }) : result.status && result.status >= 400 ? JSON.stringify({ rejection: {
+					status: result.status,
+					message: result.status === 401 ? "Authentication required" : result.status === 403 ? "Access denied" : result.status === 404 ? "Page not found" : "Page load failed"
+				} }) : module.serializeServerData(result.serverData);
+				return new Response(body, { headers });
+			}
+			if (result.redirect) {
+				headers.set("location", result.redirect.url);
+				return new Response(null, {
+					status: result.redirect.status,
+					headers
+				});
+			}
+			const locale = typeof result.locale === "string" ? getLocaleAttributes(result.locale) : result.locale ?? defaultLocale;
+			if (result.rewriteUrl) headers.set("content-location", result.rewriteUrl);
+			const mode = override ?? result.renderMode;
+			const eligible = mode === "prerender" && publicRequest && isPublicSSRResult(result, headers);
+			const cacheKey = JSON.stringify([
+				parsed.href,
+				locale?.lang,
+				locale?.dir
+			]);
+			const cached = eligible ? await cache.get(cacheKey) : void 0;
+			if (cached !== void 0 && cached !== null) return respond(cached, 200, new Headers(options.publicCacheHeaders));
+			const html = mode === "csr" ? injectCSRShell(template, locale) : injectSSRContent({
+				template,
+				html: result.html,
+				head: result.head,
+				css: result.css,
+				serializedData: module.serializeServerData(result.serverData),
+				slots: result.slots,
+				locale
+			});
+			if (eligible) {
+				await cache.set(cacheKey, html);
+				for (const [key, value] of Object.entries(options.publicCacheHeaders ?? {})) headers.set(key, value);
+			}
+			return respond(html, result.status, headers);
+		} catch (error) {
+			try {
+				options.onError?.(error);
+			} catch {}
+			const headers = new Headers(requestState.responseHeaders);
+			headers.set("content-type", "text/plain; charset=utf-8");
+			headers.set("cache-control", "no-store");
+			return new Response(request.signal.aborted ? "Execution cancelled" : "Internal Server Error", {
+				status: request.signal.aborted ? 499 : 500,
+				headers
+			});
+		}
+	};
+	return {
+		fetch(request, bindings) {
+			if (closing) return Promise.resolve(new Response("Application closed", { status: 503 }));
+			const work = respond(request, bindings);
+			active.add(work);
+			work.then(() => active.delete(work), () => active.delete(work));
+			return work;
+		},
+		dispose: () => closing ??= (async () => {
+			while (active.size) await Promise.allSettled(active);
+			const results = await Promise.allSettled([...owners].map(async (render) => {
+				await render.dispose?.();
+			}));
+			owners.clear();
+			const errors = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+			if (errors.length) throw new AggregateError(errors, "SSR cleanup failed");
+		})()
+	};
+}
+async function readControllerRequest(request) {
+	const reader = request.body?.getReader();
+	if (!reader) return;
+	const chunks = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > 65536) {
+				await reader.cancel();
+				return;
+			}
+			chunks.push(value);
+		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.length;
+		}
+		const value = JSON.parse(new TextDecoder().decode(bytes));
+		const record = (item) => item !== null && typeof item === "object" && !Array.isArray(item);
+		if (!record(value) || typeof value.intent !== "string" || !value.intent || typeof value.url !== "string" || !record(value.params) || !record(value.query)) return;
+		if (value.url && (!value.url.startsWith("/") || new URL(value.url, request.url).origin !== new URL(request.url).origin)) return;
+		return {
+			intent: value.intent,
+			params: value.params,
+			query: value.query,
+			url: value.url
+		};
+	} catch {
+		return;
+	} finally {
+		reader.releaseLock();
+	}
+}
+//#endregion
+//#region ../server/src/proxy.ts
+/**
+* 框架级声明式代理路由
+*
+* 将代理路由从业务层手写 Hono 路由，改为框架级配置。
+* 框架统一执行路径校验（SSRF 防护）、Host 限制、错误处理、响应头控制。
+*/
+/** 代理路径最大长度 */
+const MAX_PROXY_PATH_LENGTH = 2048;
+/** 代理响应最大体积（10 MB） */
+const MAX_RESPONSE_SIZE = 10485760;
+/**
+* 校验代理路径，防止 SSRF（协议相对 URL 绕过、编码绕过）。
+* 返回规范化的路径，或 null 表示非法。
+*
+* 策略保守：拒绝任何含编码字符的路径，避免上游对 %2F 等解码差异导致绕过。
+* 副作用：合法的 %20、%E4%B8%AD（Unicode）也会被拒。
+* 如需放宽，应在上层路由前自行 decode，或为该代理单独提供 sanitizer 选项。
+*/
+function sanitizeProxyPath(raw) {
+	if (raw.length > MAX_PROXY_PATH_LENGTH) return null;
+	try {
+		if (decodeURIComponent(raw) !== raw) return null;
+	} catch {
+		return null;
+	}
+	if (raw.startsWith("//")) return null;
+	if (!/^[/\w.\-~%:@!$&'()*+,;=]*$/.test(raw)) return null;
+	return raw.startsWith("/") ? raw : `/${raw}`;
+}
+/**
+* 校验代理配置合法性。
+* 在注册时（启动阶段）调用，非法配置直接抛错阻止启动。
+*/
+function validateConfig(config) {
+	if (!config.prefix.startsWith("/")) throw new Error(`[proxy] prefix must start with "/": "${config.prefix}"`);
+	const isHttps = config.target.startsWith("https://");
+	const isHttp = config.target.startsWith("http://");
+	if (!isHttps && !isHttp) throw new Error(`[proxy] target must start with "https://" or "http://": "${config.target}"`);
+	if (isHttp) console.warn(`[proxy] ⚠ target "${config.target}" uses plain HTTP — traffic will not be encrypted. Use HTTPS in production to prevent data interception.`);
+}
+/**
+* 注册声明式代理路由到 Hono app（运行时使用：Vite dev / preview / generated hosts）
+*/
+function registerProxyRoutes(app, configs) {
+	for (const config of configs) {
+		validateConfig(config);
+		const methods = config.methods ?? ["all"];
+		const pattern = `${config.prefix}/*`;
+		const handler = createProxyHandler(config);
+		for (const method of methods) app[method](pattern, handler);
+	}
+}
+function createProxyHandler(config) {
+	return async (c) => {
+		const subPath = sanitizeProxyPath(c.req.path.replace(config.prefix, ""));
+		if (!subPath) return c.text("Invalid path", 400);
+		const targetUrl = new URL(subPath, config.target);
+		const expectedOrigin = new URL(config.target).origin;
+		if (targetUrl.origin !== expectedOrigin) return c.text("Invalid proxy target", 400);
+		new URL(c.req.url).searchParams.forEach((v, k) => targetUrl.searchParams.set(k, v));
+		const headers = { ...config.headers };
+		if (config.auth) {
+			const token = globalThis.process?.env?.[config.auth.envKey];
+			if (!token) console.warn(`[Proxy ${config.prefix}] Auth env var "${config.auth.envKey}" is not set`);
+			else headers.Authorization = config.auth.type === "bearer" ? `Bearer ${token}` : `Basic ${token}`;
+		}
+		try {
+			const resp = await fetchWithRedirects(fetch, targetUrl.toString(), {
+				headers,
+				redirect: config.followRedirects ? "follow" : "manual"
+			}, (url) => {
+				if (new URL(url).origin !== expectedOrigin) throw new TypeError("Invalid proxy redirect target");
+			});
+			const contentLength = resp.headers.get("Content-Length");
+			if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {
+				resp.body?.cancel().catch(() => {});
+				return c.text("Proxy response too large", 502);
+			}
+			const body = await readProxyBody(resp);
+			if (!body) return c.text("Proxy response too large", 502);
+			const respHeaders = { "Content-Type": resp.headers.get("Content-Type") ?? "application/json" };
+			if (config.cache) respHeaders["Cache-Control"] = config.cache;
+			return c.newResponse(body, resp.status, respHeaders);
+		} catch (e) {
+			console.error(`[Proxy ${config.prefix}]`, e);
+			return c.json({ error: "Proxy request failed" }, 502);
+		}
+	};
+}
+/** Bound allocation while preserving binary bytes, even without Content-Length. */
+async function readProxyBody(response) {
+	if (!response.body) return /* @__PURE__ */ new ArrayBuffer(0);
+	const reader = response.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > MAX_RESPONSE_SIZE) {
+				reader.cancel().catch(() => {});
+				return;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return body.buffer;
+}
+/**
+* 生成代理路由注册代码（用于 serverless/edge 入口）。
+* 生成的入口从公开 SSR 边界导入 registerProxyRoutes，因此安全策略只有一个运行时实现。
+*/
+function generateProxyCode(configs) {
+	if (!configs || configs.length === 0) return "";
+	for (const config of configs) validateConfig(config);
+	return `// ─── 框架声明式代理路由 ───\nregisterProxyRoutes(app, ${JSON.stringify(configs)});`;
+}
+//#endregion
+export { isPublicSSRResult as a, injectSSRContent as c, matchRenderModeOverride as i, registerProxyRoutes as n, SSR_PLACEHOLDERS as o, createSSRHandler as r, injectCSRShell as s, generateProxyCode as t };
+//# sourceMappingURL=proxy-1SphZ7x7.mjs.map

package/dist/proxy-2dSWO-Xw.d.mts ADDED Viewed

@@ -0,0 +1,53 @@
+//#region ../server/src/proxy.d.ts
+/**
+ * 框架级声明式代理路由
+ *
+ * 将代理路由从业务层手写 Hono 路由，改为框架级配置。
+ * 框架统一执行路径校验（SSRF 防护）、Host 限制、错误处理、响应头控制。
+ */
+/** 代理路由认证配置 */
+interface ProxyAuthConfig {
+  /** 认证类型 */
+  type: "bearer" | "basic";
+  /** 环境变量名称（运行时从 process.env 读取） */
+  envKey: string;
+}
+/** 声明式代理路由配置 */
+interface ProxyRouteConfig {
+  /** URL 前缀，如 "/api/apple"（必须以 "/" 开头） */
+  prefix: string;
+  /** 代理目标地址（以 "https://" 或 "http://" 开头，推荐 HTTPS） */
+  target: string;
+  /** HTTP 方法（默认 ["all"]） */
+  methods?: ("all" | "get" | "post" | "put" | "delete" | "patch")[];
+  /** 附加到代理请求的头部 */
+  headers?: Record<string, string>;
+  /** 认证配置 */
+  auth?: ProxyAuthConfig;
+  /** Cache-Control 响应头 */
+  cache?: string;
+  /** 是否跟随同源重定向（默认 false）；跨源重定向始终拒绝。 */
+  followRedirects?: boolean;
+}
+type ProxyRouteRegistrar = (path: string, handler: (context: any) => Promise<Response>) => unknown;
+/** The registration surface used by Hono; portable SSR declarations need no Hono peer. */
+interface ProxyRouter {
+  all: ProxyRouteRegistrar;
+  get: ProxyRouteRegistrar;
+  post: ProxyRouteRegistrar;
+  put: ProxyRouteRegistrar;
+  delete: ProxyRouteRegistrar;
+  patch: ProxyRouteRegistrar;
+}
+/**
+ * 注册声明式代理路由到 Hono app（运行时使用：Vite dev / preview / generated hosts）
+ */
+declare function registerProxyRoutes(app: ProxyRouter, configs: ProxyRouteConfig[]): void;
+/**
+ * 生成代理路由注册代码（用于 serverless/edge 入口）。
+ * 生成的入口从公开 SSR 边界导入 registerProxyRoutes，因此安全策略只有一个运行时实现。
+ */
+declare function generateProxyCode(configs: ProxyRouteConfig[]): string;
+//#endregion
+export { registerProxyRoutes as a, generateProxyCode as i, ProxyRouteConfig as n, ProxyRouter as r, ProxyAuthConfig as t };
+//# sourceMappingURL=proxy-2dSWO-Xw.d.mts.map