@finesoft/front 0.5.2 → 0.5.4

package/dist/{react-DhwBRw01.d.mts → react-C8AnI9sx.d.mts}

@@ -1,4 +1,4 @@
-import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
 import { ComponentType, ReactNode } from "react";
 declare namespace react_d_exports {
   export { NativeView, NativeViews, Outlet, ViewProps, WebAppView, useSnapshot };
@@ -13,4 +13,4 @@ declare function Outlet({ app, views }: {
 }): ReactNode;
 //#endregion
 export { useSnapshot as a, react_d_exports as i, NativeViews as n, Outlet as r, NativeView as t };
-//# sourceMappingURL=react-DhwBRw01.d.mts.map
+//# sourceMappingURL=react-C8AnI9sx.d.mts.map

package/dist/react.d.mts

@@ -1,3 +1,3 @@
-import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
-import { a as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./react-DhwBRw01.mjs";
+import { g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
+import { a as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./react-C8AnI9sx.mjs";
 export { NativeView, NativeViews, Outlet, type ViewProps, type WebAppView, useSnapshot };

package/dist/{secure-fetch-Xlht2jd7.d.mts → secure-fetch--QwYr5uJ.d.mts}

@@ -4,6 +4,8 @@ type DnsLookup = (hostname: string) => Promise<readonly string[]>;
 interface TargetGuardOptions {
   readonly validateDns?: boolean;
   readonly lookup?: DnsLookup;
+  /** Exact host-owned origins trusted without DNS checks; literal address checks still apply. */
+  readonly trustedOrigins?: readonly string[];
 }
 /** Shared target policy for HttpClient and secureFetch. */
 declare function enforceHostGuard(url: string, options?: TargetGuardOptions): Promise<void>;
@@ -16,6 +18,8 @@ interface SecureFetchOptions {
   validateDns?: boolean;
   /** Required when DNS validation is enabled for a hostname. */
   lookup?: DnsLookup;
+  /** Exact trusted origins exempt from DNS checks, not literal checks. Rechecked on redirects. */
+  trustedOrigins?: readonly string[];
   /** Host transport enforcing policy at connection time; preserves the injected fetch. */
   wrapFetch?: (baseFetch: typeof globalThis.fetch) => typeof globalThis.fetch;
 }
@@ -27,4 +31,4 @@ interface SecureFetchOptions {
 declare function secureFetch(baseFetch: typeof globalThis.fetch, options?: SecureFetchOptions): typeof globalThis.fetch;
 //#endregion
 export { enforceHostGuard as a, TargetGuardOptions as i, secureFetch as n, DnsLookup as r, SecureFetchOptions as t };
-//# sourceMappingURL=secure-fetch-Xlht2jd7.d.mts.map
+//# sourceMappingURL=secure-fetch--QwYr5uJ.d.mts.map

package/dist/{server-controller-proxy-BkVuVWVD.d.mts → server-controller-proxy-CFdU_nGs.d.mts}

@@ -1,5 +1,5 @@
-import { c as ExecutionContext } from "./path-CXT6xGPO.mjs";
-import { gt as PrefetchedIntent, it as SerializedNavigation, un as BasePage, yn as RouteParams } from "./session-DnB4ZC3x.mjs";
+import { c as ExecutionContext } from "./path-C-b1ChKq.mjs";
+import { gt as PrefetchedIntent, it as SerializedNavigation, un as BasePage, yn as RouteParams } from "./session-BR1vd3yY.mjs";
 //#region ../web/src/protocol.d.ts
 declare const FRAMEWORK_PROTOCOL_VERSION = 2;
 declare function getFrameworkBuildId(): string;
@@ -35,4 +35,4 @@ declare class ServerControllerProxy {
 }
 //#endregion
 export { WebHydration as a, decodeWireEnvelope as c, FRAMEWORK_PROTOCOL_VERSION as i, getFrameworkBuildId as l, ServerControllerProxy as n, WireDecodeResult as o, ServerControllerRequest as r, WireEnvelope as s, SERVER_CONTROLLER_PATH as t };
-//# sourceMappingURL=server-controller-proxy-BkVuVWVD.d.mts.map
+//# sourceMappingURL=server-controller-proxy-CFdU_nGs.d.mts.map

package/dist/{session-DnB4ZC3x.d.mts → session-BR1vd3yY.d.mts}

@@ -1,5 +1,5 @@
-import { E as ParamSchema, F as Token, S as EventRecorder, T as InferOutput, _ as OperationPolicy, c as ExecutionContext, d as ExecutionHandle, j as Container, k as StandardSchemaV1, n as PathDescriptor, p as Invocation, s as AppDefinition, y as RuntimeHandle } from "./path-CXT6xGPO.mjs";
-import { t as SecureFetchOptions } from "./secure-fetch-Xlht2jd7.mjs";
+import { E as ParamSchema, F as Token, S as EventRecorder, T as InferOutput, _ as OperationPolicy, c as ExecutionContext, d as ExecutionHandle, j as Container, k as StandardSchemaV1, n as PathDescriptor, p as Invocation, s as AppDefinition, y as RuntimeHandle } from "./path-C-b1ChKq.mjs";
+import { t as SecureFetchOptions } from "./secure-fetch--QwYr5uJ.mjs";
 //#region ../core/src/intents/types.d.ts
 /**
  * A route/navigation target.  It remains a data transfer shape only: runtime
@@ -1276,4 +1276,4 @@ declare class NavigationCommitError extends Error {
 }
 //#endregion
 export { createActiveLeafCodec as $, list as $n, MiddlewareResult as $t, SessionStore as A, PlatformInfo as An, isCompoundAction as At, ControllerContext as B, ConsoleLoggerFactory as Bn, NavigationPath as Bt, SessionFailure as C, Storage as Cn, ACTION_KINDS as Ct, SessionSlice as D, LocaleInfo as Dn, ExternalUrlAction as Dt, SessionRestoreResult as E, LocaleAttributes as En, CompoundAction as Et, WebRuntime as F, ReportCallback as Fn, LeafNode as Ft, controllerContext as G, InferParams as Gn, SplitColumn as Gt, SERVER_CONTROLLER as H, Logger as Hn, NavigationSnapshot as Ht, WebRuntimeOptions as I, ReportingLogger as In, NAVIGATION_NODE_KINDS as It, resolveConfiguredMessages as J, QuerySchemaMap as Jn, StackNode as Jt, MessagesLoader as K, InferQuery as Kn, SplitNode as Kt, createWebRuntime as L, ReportingLoggerFactory as Ln, NavigationError as Lt, SessionWriteResult as M, BaseController as Mn, isFlowAction as Mt, StorageUnavailableError as N, ControllerFailure as Nn, makeExternalUrlAction as Nt, SessionSnapshot as O, TextDirection as On, FlowAction as Ot, WebConfiguration as P, ControllerInput as Pn, makeFlowAction as Pt, NavigationRouterLike as Q, isMultiValueSchema as Qn, DenyResult as Qt, PageControllerDefinition as R, ReportingLoggerOptions as Rn, NavigationNode as Rt, SessionErrorContext as S, FeatureFlagsProvider as Sn, ActionHandler as St, SessionNavigation as T, resolveMessages as Tn, ActionInvocation as Tt, SERVER_REQUEST as U, LoggerFactory as Un, ResolvedDestination as Ut, PageControllerInput as V, LogFilter as Vn, NavigationPathStep as Vt, ServerRequestState as W, ExtractParamNames as Wn, SPLIT_VISIBILITIES as Wt, FullStateCodecOptions as X, ListOptions as Xn, AfterLoadGuard as Xt, DEFAULT_NAV_PARAM as Y, StripOptional as Yn, TabsNode as Yt, NavigationCodec as Z, MultiValueSchema as Zn, BeforeLoadGuard as Zt, AsyncStorage as _, RouteInput as _n, PrefetchedIntents as _t, NavigationCommitContext as a, deny as an, SerializedSplit as at, SESSION_DEFAULT_VERSION as b, DEP_KEYS as bn, Router as bt, NavigationTransactionContext as c, rewrite as cn, SerializedTabs as ct, createWebSession as d, FINESOFT_PUBLIC as dn, serializeNavigationStable as dt, NavigationContext as en, Intent as er, createFullStateCodec as et, AppSnapshot as f, PublicProjection as fn, PageRoute as ft, WebAppView as g, markPublic as gn, PrefetchedIntent as gt, ViewProps as h, isPublicMarked as hn, route as ht, BeforeNavigateResult as i, RewriteResult as in, SerializedNavigation as it, SessionStoreOptions as j, detectPlatform as jn, isExternalUrlAction as jt, SessionStateProvider as k, Translator as kn, TreeAction as kt, WebSession as l, BASE_PAGE_FIELDS as ln, deserializeNavigation as lt, ViewEntry as m, getPublicFields as mn, RouteDefinition as mt, BeforeCommitResult as n, PostLoadContext as nn, encodeNavigationTreeParam as nt, NavigationCommitError as o, next as on, SerializedSplitColumn as ot, NavigationSummary as p, PublicValueCodec as pn, RenderMode as pt, MessagesLoaderContext as q, ParamsFor as qn, SplitVisibility as qt, BeforeNavigatePolicy as r, RedirectResult as rn, SerializedLeaf as rt, NavigationContextInput as s, redirect as sn, SerializedStack as st, BeforeCommitPolicy as t, NextResult as tn, decodeNavigationTreeParam as tt, WebSessionOptions as u, BasePage as un, serializeNavigation as ut, NavigationScopedState as v, RouteIntent as vn, RouteAddOptions as vt, SessionLoadResult as w, TranslationMessages as wn, Action as wt, SessionError as x, FeatureFlags as xn, ActionDispatcher as xt, SESSION_DEFAULT_KEY as y, RouteParams as yn, RouteMatch as yt, WebAppDefinition as z, ConsoleLogger as zn, NavigationNodeKind as zt };
-//# sourceMappingURL=session-DnB4ZC3x.d.mts.map
+//# sourceMappingURL=session-BR1vd3yY.d.mts.map

package/dist/{src-qwx7Vw8g.mjs → src-D_Bzbr80.mjs}

@@ -1,4 +1,4 @@
-import { i as HttpError, n as classifyUrl, r as HostGuardError } from "./host-guard-DDWxLpFL.mjs";
+import { i as HttpError, n as classifyUrl, r as HostGuardError } from "./host-guard-DX4e3-45.mjs";
 import { n as ExecutionError, r as executionErrorFromHttp, t as compilePath } from "./path-CGFl2w7D.mjs";
 import { t as LruMap } from "./lru-map-BKoUAySU.mjs";
 import { t as DEP_KEYS } from "./src-Ftl_0rhu.mjs";
@@ -346,6 +346,7 @@ async function enforceHostGuard(url, options = {}) {
 	}
 	const verdict = classifyUrl(parsed.href);
 	if (!verdict.ok) throw new HostGuardError(url, verdict.reason);
+	if (options.trustedOrigins?.includes(parsed.origin)) return;
 	if (options.validateDns === false || parsed.hostname.includes(":") || /^[0-9.]+$/.test(parsed.hostname)) return;
 	if (!options.lookup) throw new HostGuardError(url, "DNS lookup capability is required");
 	let addresses;
@@ -1088,13 +1089,17 @@ function createRuntime(options) {
 						return output;
 					}
 					const cacheValue = cachePolicy.key ? cachePolicy.key(validated) : validated;
+					const partition = cachePolicy.partition?.(context);
+					if (cachePolicy.partition && typeof partition !== "string") configuration("Cache partition must be a string");
 					const key = encodeCacheIdentity([
 						operation.id,
 						invocation.identity ?? null,
 						invocation.locale ?? null,
+						partition,
 						cacheValue
 					]);
-					const selectedCache = cachePolicy.scope === "execution" ? scopeCache : cache;
+					const invocationBound = Reflect.ownKeys(context.bindings).length > 0 || invocation.fetch !== void 0;
+					const selectedCache = cachePolicy.scope === "execution" || invocationBound && !cachePolicy.partition ? scopeCache : cache;
 					const cached = selectedCache.get(key);
 					if (cached && cached.expires > Date.now()) {
 						complete(true);
@@ -1537,6 +1542,24 @@ var PrefetchedIntents = class PrefetchedIntents {
 	}
 };
 //#endregion
+//#region ../web/src/hydration-digest.ts
+/** @internal A versioned DOM change detector, not a security or authenticity check. */
+function createHydrationDigest() {
+	let first = 2166136261;
+	let second = 2654435769;
+	const update = (value) => {
+		first = Math.imul(first ^ value, 16777619);
+		second = Math.imul(second ^ value, 2246822507);
+	};
+	return {
+		write(value) {
+			update(value.length);
+			for (let index = 0; index < value.length; index++) update(value.charCodeAt(index));
+		},
+		value: () => `v1:${(first >>> 0).toString(16)}:${(second >>> 0).toString(16)}`
+	};
+}
+//#endregion
 //#region ../web/src/bootstrap/define-routes.ts
 /**
 * 构造一条强类型路由定义。
@@ -2871,6 +2894,7 @@ function createWebSession(options) {
 		const destinations = [];
 		const resolvedLeaves = /* @__PURE__ */ new Map();
 		let redirect;
+		let pageDenial;
 		try {
 			if (admission) for (const policy of beforeNavigate) {
 				check();
@@ -2928,6 +2952,7 @@ function createWebSession(options) {
 					url: result.rewriteUrl
 				} : result.target);
 				if (result.kind === "redirect") redirect ??= result;
+				if (result.kind === "deny") pageDenial ??= result;
 				destinations.push({
 					...result.kind === "page" && result.match?.cache ? { cache: result.match.cache } : {},
 					...result.kind === "page" ? {
@@ -2957,7 +2982,7 @@ function createWebSession(options) {
 					status: redirect.status
 				}
 			};
-			if (destinations.some((dest) => dest.status !== void 0)) return { snapshot: candidate };
+			if (pageDenial) return reject(pageDenial, candidate);
 			for (const policy of beforeCommit) {
 				check();
 				const result = await policy({
@@ -3077,15 +3102,17 @@ function createWebSession(options) {
 			if (closed || ownGeneration !== actions.generation) throw new ExecutionError("cancelled");
 			if (candidate !== snapshot) {
 				let result = candidate;
-				if (candidate.rejection) {
-					const { status, message } = candidate.rejection;
+				const failed = candidate.destinations.find((entry) => entry.status !== void 0);
+				if (candidate.rejection || failed) {
+					const status = candidate.rejection?.status ?? failed.status;
+					const page = candidate.rejection ? getErrorPage(status, candidate.rejection.message) : failed.page;
 					const error = leaf("@finesoft/error");
 					result = {
 						tree: stack(error),
 						destinations: [{
 							...error,
 							resourceKey: resourceKey(error.intent, error.params),
-							page: getErrorPage(status, message),
+							page,
 							status
 						}]
 					};
@@ -3802,6 +3829,6 @@ function parseCookieString(str) {
 	return map;
 }
 //#endregion
-export { isLeafNode as $, createActiveLeafCodec as A, getTextDirection as At, findNode as B, fetchWithRedirects as Bt, runBeforeLoadGuards as C, defineModule as Ct, SERVER_REQUEST as D, SimpleTranslator as Dt, SERVER_CONTROLLER as E, implementOperation as Et, serializeNavigation as F, interpolate as Ft, push as G, ConsoleLogger as Gt, pop as H, stableStringify as Ht, serializeNavigationStable as I, resolvePluralKey as It, selectColumn as J, CompositeLoggerFactory as Jt, replaceTop as K, ConsoleLoggerFactory as Kt, collectAllLeaves as L, generateUuid as Lt, decodeNavigationTreeParam as M, makeLocaleInfo as Mt, encodeNavigationTreeParam as N, resolveLocaleFromUrl as Nt, controllerContext as O, resolveMessages as Ot, deserializeNavigation as P, englishPlural as Pt, resourceKey as Q, collectVisibleDestinations as R, detectPlatform as Rt, runAfterLoadGuards as S, defineApp as St, getWebPlan as T, implementController as Tt, popTo as U, ReportingLogger as Ut, mapNavigationLeaves as V, enforceHostGuard as Vt, popToRoot as W, ReportingLoggerFactory as Wt, setVisibility as X, list as Xt, selectTab as Y, isMultiValueSchema as Yt, visibleSplitColumns as Z, Container as Zt, SERVER_CONTROLLER_PATH as _, isFlowAction as _t, createSessionStore as a, stack as at, decodeWireEnvelope as b, provide as bt, decodeSnapshot as c, NavigationError as ct, createWebSession as d, PrefetchedIntents as dt, isSplitNode as et, SESSION_DEFAULT_KEY as f, Router as ft, loadPage as g, isExternalUrlAction as gt, StorageUnavailableError as h, isCompoundAction as ht, createWebRuntime as i, split as it, createFullStateCodec as j, isRtl as jt, DEFAULT_NAV_PARAM as k, getLocaleAttributes as kt, encodeSnapshot as l, SPLIT_VISIBILITIES as lt, SessionError as m, ACTION_KINDS as mt, definePage as n, isTabsNode as nt, collectLeafKeys as o, tabs as ot, SESSION_DEFAULT_VERSION as p, ActionDispatcher as pt, resolveActivePath as q, CompositeLogger as qt, resolveInitialNavigation as r, leaf as rt, createNavigationScopedState as s, NAVIGATION_NODE_KINDS as st, parseCookieString as t, isStackNode as tt, NavigationCommitError as u, route as ut, ServerControllerProxy as v, makeExternalUrlAction as vt, defineWebApp as w, defineOperation as wt, getFrameworkBuildId as x, createRuntime as xt, FRAMEWORK_PROTOCOL_VERSION as y, makeFlowAction as yt, findNearestStack as z, secureFetch as zt };
+export { isLeafNode as $, createActiveLeafCodec as A, getLocaleAttributes as At, findNode as B, secureFetch as Bt, runBeforeLoadGuards as C, defineApp as Ct, SERVER_REQUEST as D, implementOperation as Dt, SERVER_CONTROLLER as E, implementController as Et, serializeNavigation as F, englishPlural as Ft, push as G, ReportingLoggerFactory as Gt, pop as H, enforceHostGuard as Ht, serializeNavigationStable as I, interpolate as It, selectColumn as J, CompositeLogger as Jt, replaceTop as K, ConsoleLogger as Kt, collectAllLeaves as L, resolvePluralKey as Lt, decodeNavigationTreeParam as M, isRtl as Mt, encodeNavigationTreeParam as N, makeLocaleInfo as Nt, controllerContext as O, SimpleTranslator as Ot, deserializeNavigation as P, resolveLocaleFromUrl as Pt, resourceKey as Q, Container as Qt, collectVisibleDestinations as R, generateUuid as Rt, runAfterLoadGuards as S, createRuntime as St, getWebPlan as T, defineOperation as Tt, popTo as U, stableStringify as Ut, mapNavigationLeaves as V, fetchWithRedirects as Vt, popToRoot as W, ReportingLogger as Wt, setVisibility as X, isMultiValueSchema as Xt, selectTab as Y, CompositeLoggerFactory as Yt, visibleSplitColumns as Z, list as Zt, SERVER_CONTROLLER_PATH as _, isExternalUrlAction as _t, createSessionStore as a, stack as at, decodeWireEnvelope as b, makeFlowAction as bt, decodeSnapshot as c, NavigationError as ct, createWebSession as d, createHydrationDigest as dt, isSplitNode as et, SESSION_DEFAULT_KEY as f, PrefetchedIntents as ft, loadPage as g, isCompoundAction as gt, StorageUnavailableError as h, ACTION_KINDS as ht, createWebRuntime as i, split as it, createFullStateCodec as j, getTextDirection as jt, DEFAULT_NAV_PARAM as k, resolveMessages as kt, encodeSnapshot as l, SPLIT_VISIBILITIES as lt, SessionError as m, ActionDispatcher as mt, definePage as n, isTabsNode as nt, collectLeafKeys as o, tabs as ot, SESSION_DEFAULT_VERSION as p, Router as pt, resolveActivePath as q, ConsoleLoggerFactory as qt, resolveInitialNavigation as r, leaf as rt, createNavigationScopedState as s, NAVIGATION_NODE_KINDS as st, parseCookieString as t, isStackNode as tt, NavigationCommitError as u, route as ut, ServerControllerProxy as v, isFlowAction as vt, defineWebApp as w, defineModule as wt, getFrameworkBuildId as x, provide as xt, FRAMEWORK_PROTOCOL_VERSION as y, makeExternalUrlAction as yt, findNearestStack as z, detectPlatform as zt };
 
-//# sourceMappingURL=src-qwx7Vw8g.mjs.map
+//# sourceMappingURL=src-D_Bzbr80.mjs.map

package/dist/{ssr-C8xnYXoY.mjs → ssr-DqwPGqOd.mjs}

@@ -1,8 +1,8 @@
-import { D as SERVER_REQUEST, E as SERVER_CONTROLLER, F as serializeNavigation, P as deserializeNavigation, T as getWebPlan, at as stack, d as createWebSession, i as createWebRuntime, r as resolveInitialNavigation, rt as leaf, t as parseCookieString, x as getFrameworkBuildId } from "./src-qwx7Vw8g.mjs";
+import { D as SERVER_REQUEST, E as SERVER_CONTROLLER, F as serializeNavigation, P as deserializeNavigation, T as getWebPlan, at as stack, d as createWebSession, i as createWebRuntime, r as resolveInitialNavigation, rt as leaf, t as parseCookieString, x as getFrameworkBuildId } from "./src-D_Bzbr80.mjs";
 import { n as ExecutionError } from "./path-CGFl2w7D.mjs";
 import { i as getPublicFields, n as BASE_PAGE_FIELDS, s as BaseController, t as resolveConfiguredMessages } from "./messages-CAt2QdGr.mjs";
 import "./src-Ftl_0rhu.mjs";
-import "./proxy-1SphZ7x7.mjs";
+import "./proxy-BkKVP3Ha.mjs";
 //#region ../ssr/src/server-data.ts
 const MATERIALIZED = Symbol("materialized-public-data");
 /** Copy declared public data now; never keep request-backed objects/getters in a response. */
@@ -354,4 +354,4 @@ var BaseServerController = class extends BaseController {
 //#endregion
 export { serializeServerData as a, materializeServerData as i, createServerContext as n, createSSRRender as r, BaseServerController as t };
 
-//# sourceMappingURL=ssr-C8xnYXoY.mjs.map
+//# sourceMappingURL=ssr-DqwPGqOd.mjs.map

package/dist/{ssr-BEUNDvbj.d.mts → ssr-lzuGJ2ux.d.mts}

@@ -1,8 +1,8 @@
-import { E as ParamSchema, c as ExecutionContext, j as Container } from "./path-CXT6xGPO.mjs";
-import { B as ControllerContext, En as LocaleAttributes, H as SERVER_CONTROLLER, Jn as QuerySchemaMap, Mn as BaseController, P as WebConfiguration, Pn as ControllerInput, W as ServerRequestState, en as NavigationContext, g as WebAppView, mt as RouteDefinition, vn as RouteIntent, z as WebAppDefinition } from "./session-DnB4ZC3x.mjs";
-import { t as SecureFetchOptions } from "./secure-fetch-Xlht2jd7.mjs";
-import { a as WebHydration, r as ServerControllerRequest } from "./server-controller-proxy-BkVuVWVD.mjs";
-import { r as HttpHandler } from "./http-B6CJqDyf.mjs";
+import { E as ParamSchema, c as ExecutionContext, j as Container } from "./path-C-b1ChKq.mjs";
+import { B as ControllerContext, En as LocaleAttributes, H as SERVER_CONTROLLER, Jn as QuerySchemaMap, Mn as BaseController, P as WebConfiguration, Pn as ControllerInput, W as ServerRequestState, en as NavigationContext, g as WebAppView, mt as RouteDefinition, vn as RouteIntent, z as WebAppDefinition } from "./session-BR1vd3yY.mjs";
+import { t as SecureFetchOptions } from "./secure-fetch--QwYr5uJ.mjs";
+import { a as WebHydration, r as ServerControllerRequest } from "./server-controller-proxy-CFdU_nGs.mjs";
+import { r as HttpHandler } from "./http-B8r7MWao.mjs";
 //#region ../ssr/src/render.d.ts
 interface SSRContext {
   identity?: string;
@@ -56,9 +56,6 @@ declare function createSSRRender<Definition extends WebAppDefinition>(config: SS
 };
 //#endregion
 //#region ../ssr/src/inject.d.ts
-/**
- * injectSSRContent — 将 SSR 渲染结果注入 HTML 模板
- */
 /** SSR HTML 模板占位符常量 */
 declare const SSR_PLACEHOLDERS: {
   readonly HEAD: "<!--ssr-head-->";
@@ -207,4 +204,4 @@ interface SSRHandler extends HttpHandler {
 declare function createSSRHandler<TData = unknown>(options: SSRHandlerOptions<TData>): SSRHandler;
 //#endregion
 export { createSSRRender as C, SSRRenderResult as E, SSRRenderConfig as S, SSRContext as T, serializeServerData as _, SSRRequestContext as a, injectCSRShell as b, matchRenderModeOverride as c, ServerControllerContext as d, ServerControllerInput as f, materializeServerData as g, SerializeServerDataOptions as h, SSRModule as i, BaseServerController as l, createServerContext as m, SSRHandler as n, SSRResponseResult as o, ServerContextOptions as p, SSRHandlerOptions as r, createSSRHandler as s, SSRCache as t, CookieOptions as u, InjectSSROptions as v, SSRAppResult as w, injectSSRContent as x, SSR_PLACEHOLDERS as y };
-//# sourceMappingURL=ssr-BEUNDvbj.d.mts.map
+//# sourceMappingURL=ssr-lzuGJ2ux.d.mts.map

package/dist/ssr.d.mts

@@ -1,3 +1,3 @@
-import { C as createSSRRender, E as SSRRenderResult, S as SSRRenderConfig, T as SSRContext, _ as serializeServerData, a as SSRRequestContext, b as injectCSRShell, c as matchRenderModeOverride, d as ServerControllerContext, f as ServerControllerInput, g as materializeServerData, h as SerializeServerDataOptions, i as SSRModule, l as BaseServerController, m as createServerContext, n as SSRHandler, o as SSRResponseResult, p as ServerContextOptions, r as SSRHandlerOptions, s as createSSRHandler, t as SSRCache, u as CookieOptions, v as InjectSSROptions, w as SSRAppResult, x as injectSSRContent, y as SSR_PLACEHOLDERS } from "./ssr-BEUNDvbj.mjs";
+import { C as createSSRRender, E as SSRRenderResult, S as SSRRenderConfig, T as SSRContext, _ as serializeServerData, a as SSRRequestContext, b as injectCSRShell, c as matchRenderModeOverride, d as ServerControllerContext, f as ServerControllerInput, g as materializeServerData, h as SerializeServerDataOptions, i as SSRModule, l as BaseServerController, m as createServerContext, n as SSRHandler, o as SSRResponseResult, p as ServerContextOptions, r as SSRHandlerOptions, s as createSSRHandler, t as SSRCache, u as CookieOptions, v as InjectSSROptions, w as SSRAppResult, x as injectSSRContent, y as SSR_PLACEHOLDERS } from "./ssr-lzuGJ2ux.mjs";
 import { a as registerProxyRoutes, n as ProxyRouteConfig, r as ProxyRouter, t as ProxyAuthConfig } from "./proxy-2dSWO-Xw.mjs";
 export { BaseServerController, type CookieOptions, type InjectSSROptions, type ProxyAuthConfig, type ProxyRouteConfig, type ProxyRouter, type SSRAppResult, SSRCache, type SSRContext, SSRHandler, SSRHandlerOptions, SSRModule, type SSRRenderConfig, type SSRRenderResult, SSRRequestContext, SSRResponseResult, SSR_PLACEHOLDERS, type SerializeServerDataOptions, type ServerContextOptions, type ServerControllerContext, type ServerControllerInput, createSSRHandler, createSSRRender, createServerContext, injectCSRShell, injectSSRContent, matchRenderModeOverride, materializeServerData, registerProxyRoutes, serializeServerData };

package/dist/ssr.mjs

@@ -1,3 +1,3 @@
-import { a as serializeServerData, i as materializeServerData, n as createServerContext, r as createSSRRender, t as BaseServerController } from "./ssr-C8xnYXoY.mjs";
-import { c as injectSSRContent, i as matchRenderModeOverride, n as registerProxyRoutes, o as SSR_PLACEHOLDERS, r as createSSRHandler, s as injectCSRShell } from "./proxy-1SphZ7x7.mjs";
+import { a as serializeServerData, i as materializeServerData, n as createServerContext, r as createSSRRender, t as BaseServerController } from "./ssr-DqwPGqOd.mjs";
+import { c as injectSSRContent, i as matchRenderModeOverride, n as registerProxyRoutes, o as SSR_PLACEHOLDERS, r as createSSRHandler, s as injectCSRShell } from "./proxy-BkKVP3Ha.mjs";
 export { BaseServerController, SSR_PLACEHOLDERS, createSSRHandler, createSSRRender, createServerContext, injectCSRShell, injectSSRContent, matchRenderModeOverride, materializeServerData, registerProxyRoutes, serializeServerData };

package/dist/{svelte-Dr5to3SE.d.mts → svelte-CMFFDLBi.d.mts}

@@ -1,4 +1,4 @@
-import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import { g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
 import Outlet from "./Outlet.svelte";
 import { Component } from "svelte";
 declare namespace svelte_d_exports {
@@ -13,4 +13,4 @@ declare function useSnapshot(app: WebAppView): {
 };
 //#endregion
 export { useSnapshot as a, svelte_d_exports as i, NativeViews as n, Outlet as r, NativeView as t };
-//# sourceMappingURL=svelte-Dr5to3SE.d.mts.map
+//# sourceMappingURL=svelte-CMFFDLBi.d.mts.map

package/dist/svelte.d.mts

@@ -1,3 +1,3 @@
-import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
-import { a as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./svelte-Dr5to3SE.mjs";
+import { g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
+import { a as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./svelte-CMFFDLBi.mjs";
 export { NativeView, NativeViews, Outlet, type ViewProps, type WebAppView, useSnapshot };

package/dist/{types-BuaZHRG7.mjs → types-DD09OkGZ.mjs}

@@ -1,5 +1,5 @@
-import { Yt as isMultiValueSchema, zt as secureFetch } from "./src-qwx7Vw8g.mjs";
-import { i as HttpError } from "./host-guard-DDWxLpFL.mjs";
+import { Bt as secureFetch, Xt as isMultiValueSchema } from "./src-D_Bzbr80.mjs";
+import { i as HttpError } from "./host-guard-DX4e3-45.mjs";
 //#region ../core/src/schema/standard.ts
 /** 工厂：从一个 validate 函数构造实现了 ~standard 的 codec */
 function makeSchema(validate) {
@@ -399,4 +399,4 @@ function deny(status = 403, message = "Forbidden") {
 //#endregion
 export { bool as C, str as D, oneOf as E, uuid as O, withDefault as S, num as T, mapEach as _, safeErrorPage as a, HttpClient as b, ConsoleEventRecorder as c, getBaseUrl as d, removeHost as f, isSome as g, isNone as h, rewrite as i, makeSchema as k, CompositeEventRecorder as l, removeScheme as m, next as n, WithFieldsRecorder as o, removeQueryParams as p, redirect as r, VoidEventRecorder as s, deny as t, buildUrl as u, pipe as v, int as w, optional as x, pipeAsync as y };
 
-//# sourceMappingURL=types-BuaZHRG7.mjs.map
+//# sourceMappingURL=types-DD09OkGZ.mjs.map

package/dist/{vite-Cj4SPA8D.d.mts → vite-BjWtbemg.d.mts}

@@ -76,6 +76,8 @@ interface AdapterContext {
 interface GenerateSSREntryOptions {
   /** Host capability for protected outbound requests. */
   dnsPolicy?: "node" | "hostname";
+  /** Explicit trusted origins for hosts without connection-time DNS enforcement. */
+  trustedOrigins?: readonly string[];
   /** 平台特定的导入语句（如 `import { handle } from "hono/vercel";`） */
   platformImport: string;
   /** 平台特定的导出语句（如 `export default handle(app);`） */
@@ -138,7 +140,7 @@ interface FinesoftFrontViteOptions {
   /**
    * 声明式代理路由配置。
    * 框架统一执行路径校验（SSRF 防护）、Host 限制、错误处理、响应头控制。
-   * 代理路由在 setup 之前注册，优先级高于自定义路由。
+   * 代理路由在 setup 之后注册，受 setup 中先注册的鉴权中间件保护。
    */
   proxies?: ProxyRouteConfig[];
   /**
@@ -250,7 +252,11 @@ declare function finesoftFrontViteConfig(options?: FinesoftFrontViteOptions): {
 declare function autoAdapter(): Adapter;
 //#endregion
 //#region ../server/src/adapters/cloudflare.d.ts
-declare function cloudflareAdapter(): Adapter;
+interface CloudflareAdapterOptions {
+  /** Trusted API origins; other hostnames fail closed because this host supplies no DNS policy. */
+  trustedOrigins?: readonly string[];
+}
+declare function cloudflareAdapter(options?: CloudflareAdapterOptions): Adapter;
 //#endregion
 //#region ../server/src/adapters/netlify.d.ts
 declare function netlifyAdapter(): Adapter;
@@ -273,5 +279,5 @@ declare function vercelAdapter(): Adapter;
 //#region ../server/src/adapters/resolve.d.ts
 declare function resolveAdapter(value: string | Adapter): Adapter;
 //#endregion
-export { netlifyAdapter as a, FinesoftFrontViteOptions as c, AdapterContext as d, nodeAdapter as i, finesoftFrontViteConfig as l, vercelAdapter as n, cloudflareAdapter as o, staticAdapter as r, autoAdapter as s, resolveAdapter as t, Adapter as u };
-//# sourceMappingURL=vite-Cj4SPA8D.d.mts.map
+export { netlifyAdapter as a, autoAdapter as c, Adapter as d, AdapterContext as f, nodeAdapter as i, FinesoftFrontViteOptions as l, vercelAdapter as n, CloudflareAdapterOptions as o, staticAdapter as r, cloudflareAdapter as s, resolveAdapter as t, finesoftFrontViteConfig as u };
+//# sourceMappingURL=vite-BjWtbemg.d.mts.map

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
 import { i as generateProxyCode, n as ProxyRouteConfig, t as ProxyAuthConfig } from "./proxy-2dSWO-Xw.mjs";
-import { a as netlifyAdapter, c as FinesoftFrontViteOptions, d as AdapterContext, i as nodeAdapter, l as finesoftFrontViteConfig, n as vercelAdapter, o as cloudflareAdapter, r as staticAdapter, s as autoAdapter, t as resolveAdapter, u as Adapter } from "./vite-Cj4SPA8D.mjs";
+import { a as netlifyAdapter, c as autoAdapter, d as Adapter, f as AdapterContext, i as nodeAdapter, l as FinesoftFrontViteOptions, n as vercelAdapter, o as CloudflareAdapterOptions, r as staticAdapter, s as cloudflareAdapter, t as resolveAdapter, u as finesoftFrontViteConfig } from "./vite-BjWtbemg.mjs";
 import { n as ControllerTypeResult, r as generateControllerTypes, t as ControllerTypeOptions } from "./controller-types-CgmJ6-le.mjs";
-export { type Adapter, type AdapterContext, type ControllerTypeOptions, type ControllerTypeResult, type FinesoftFrontViteOptions, type ProxyAuthConfig, type ProxyRouteConfig, autoAdapter, cloudflareAdapter, finesoftFrontViteConfig, generateControllerTypes, generateProxyCode, netlifyAdapter, nodeAdapter, resolveAdapter, staticAdapter, vercelAdapter };
+export { type Adapter, type AdapterContext, type CloudflareAdapterOptions, type ControllerTypeOptions, type ControllerTypeResult, type FinesoftFrontViteOptions, type ProxyAuthConfig, type ProxyRouteConfig, autoAdapter, cloudflareAdapter, finesoftFrontViteConfig, generateControllerTypes, generateProxyCode, netlifyAdapter, nodeAdapter, resolveAdapter, staticAdapter, vercelAdapter };