@jimhoyd/urlcode 0.3.0 → 0.4.0-alpha.2

package/dist/proxy.js

@@ -0,0 +1,44 @@
+import { EgressError, egressUrl, safeEgressHeaders } from './egress.js';
+                                                                 
+                                                                                                                                                     
+                                                                                                                                                                            
+                                                                                         
+const sensitive=new Set(['authorization','cookie','set-cookie','proxy-authorization','forwarded','x-forwarded-for','x-forwarded-host','x-forwarded-proto']);
+export function validateProxy(definition                )      {
+  if(!definition||typeof definition!=='object'||Object.keys(definition).some(key=>!['url','query','requestHeaders','responseHeaders','headers'].includes(key))) throw new EgressError('denied');
+  const parsed=egressUrl(definition.url);
+  if(/[{}]/.test(parsed.host)||(/[{}]/.test(parsed.search)||/%7[bd]/i.test(parsed.search))||/%7[bd]/i.test(parsed.host)) throw new EgressError('denied');
+  if(/%7[bd]/i.test(parsed.pathname.replace(/%7B[A-Za-z_][A-Za-z0-9_]*%7D/gi,''))) throw new EgressError('denied');
+  if(definition.url.length>8192) throw new EgressError('limit');
+  for(const list of [definition.query,definition.requestHeaders,definition.responseHeaders]) if(list&&(!Array.isArray(list)||list.length>32||list.some(value=>typeof value!=='string'||!value||value.length>128))) throw new EgressError('denied');
+  for(const name of [...definition.requestHeaders||[],...definition.responseHeaders||[]]) {if(sensitive.has(name.toLowerCase())||/^x-forwarded-/i.test(name)) throw new EgressError('denied');safeEgressHeaders({[name]:'x'});}
+  safeEgressHeaders(definition.headers||{});
+}
+export async function executeProxy(client                ,definition                ,input           )                         {
+  validateProxy(definition);
+  const url=egressUrl(definition.url); const origin=url.origin;
+  // URL serializes braces in path unchanged. Arguments can never affect origin/query.
+  url.pathname=url.pathname.replace(/%7B([A-Za-z_][A-Za-z0-9_]*)%7D/gi,(_all,name       )=> {
+    const value=input.params[name]; if(typeof value!=='string'||value==='.'||value==='..') throw new EgressError('denied'); return encodeURIComponent(value);
+  });
+  if((/[{}]/.test(url.pathname))||url.origin!==origin) throw new EgressError('denied');
+  const incoming=new URL(input.url); for(const name of definition.query||[]) for(const value of incoming.searchParams.getAll(name)) url.searchParams.append(name,value);
+  if(url.href.length>8192) throw new EgressError('limit');
+  const headers                      =Object.create(null);
+  const requestHop=new Set((input.headers.connection||'').toLowerCase().split(',').map(name=>name.trim()));
+  for(const name of definition.requestHeaders||[]) {const value=input.headers[name.toLowerCase()]; if(value!==undefined&&!requestHop.has(name.toLowerCase())) headers[name.toLowerCase()]=value;}
+  Object.assign(headers,definition.headers||{});
+  const safeHeaders=safeEgressHeaders(headers);
+  if(input.body?.byteLength){
+    const coding=(value                 )=>value?.split(',').map(part=>part.trim().toLowerCase()).join(',')||'identity';
+    const incomingCoding=coding(input.headers['content-encoding']);
+    if(incomingCoding!==coding(safeHeaders['content-encoding'])||(incomingCoding!=='identity'&&!(definition.requestHeaders||[]).some(name=>name.toLowerCase()==='content-encoding')))throw new EgressError('denied');
+  }
+  const result=await client.request({url:url.href,method:input.method,headers:safeHeaders,...(input.body?{body:input.body}:{}),...(input.signal?{signal:input.signal}:{})});
+  if(result.headers['content-encoding']&&result.headers['content-encoding']!=='identity'&&!(definition.responseHeaders||[]).some(name=>name.toLowerCase()==='content-encoding'))throw new EgressError('denied');
+  const selected                      =Object.create(null);
+  const responseHop=new Set((result.headers.connection||'').toLowerCase().split(',').map(name=>name.trim()));
+  for(const name of definition.responseHeaders||[]) {const value=result.headers[name.toLowerCase()]; if(value!==undefined&&!responseHop.has(name.toLowerCase())) selected[name.toLowerCase()]=value;}
+  if(result.headers['content-encoding']&&result.headers['content-encoding']!=='identity'&&!selected['content-encoding'])throw new EgressError('denied');
+  return {...result,headers:safeEgressHeaders(selected)};
+}

package/dist/readiness.js

@@ -13,9 +13,14 @@ import { runCompliance } from './compliance.js';
                                                                  
 
                                              
-                                                                                                        
+                                                                                                                                       
 /** One configured route as the inventory reports it: a PlanInventoryEntry with the handler kind named. */
-                                                                                               
+                                                            
+                                   
+                                                                               
+                                                                                 
+                        
+ 
 /** One request case: a generated probe or a `tests/requests.json` fixture. */
                               
                                                                                                                                      
@@ -25,14 +30,17 @@ import { runCompliance } from './compliance.js';
                                                                                                 
                                                                                               
 /** A started server as the audit and benchmark see it. structural: the real type is startServer's result in src/server.ts. */
-                                                                                                                                                                      
+                                                                                                                                              
                                                                            
                                                                                                                                         
                               
-                                                                       
+                                    
                                                                                                                        
                                                                                                                                     
                                                                                                                                                             
+                                                                               
+                                                                                        
+                                                   
  
                                                                                                                                                                                                                             
                                   
@@ -41,29 +49,43 @@ import { runCompliance } from './compliance.js';
                                                                                                                                                                                      
  
 
-const handlers = ['redirect','function','page','static','download','respond','link']                                          ;
+const handlers = ['extension','proxy','conditional','redirect','function','page','static','download','respond']                                          ;
 /** Narrows a compiled route to one that redirects, so redirectLocation can read its spec. */
 export const hasRedirect = (route               )                                                          => Boolean(route.redirect);
 const isRecord = (value         )                                   => value !== null && typeof value === 'object' && !Array.isArray(value);
 // Probes identify themselves so an agents policy that denies an empty
 // User-Agent does not fail every generated case; fixtures may override it.
 export const probeAgent = 'Mozilla/5.0 (compatible; RouteProbe/0.1)';
+// Advisory only (docs/AI-AUTHORING.md, "Deciding when a route needs sandbox: true"):
+// a route that runs project code, accepts POST with a declared request.body
+// policy, and declares neither `sandbox: true` nor `sandboxReason` looks
+// plausibly webhook/callback/third-party-input-shaped. This is a nudge to
+// look, never an inferred verdict — it never fails `audit` or changes `ready`.
+function routeAdvisories(route               )           {
+  const advisories           = [];
+  const runsCode = Boolean(route.function) || Boolean(route.middleware?.length);
+  if (runsCode && route.methods.includes('POST') && route.request?.body && !route.sandbox && !route.sandboxReason) {
+    advisories.push("This route accepts POST with a declared request.body policy but declares neither sandbox: true nor sandboxReason; consider whether this route needs sandbox: true.");
+  }
+  return advisories;
+}
 export function projectPlan(compiled                               )              {
   const routes = [...compiled.exact.values(), ...[...compiled.byLength.values()].flat(), ...compiled.mounts];
   const now = Date.now();
-  const inventory                   = routes.map(route => ({ path:route.pattern, handler:handlers.find(key => route[key]), methods:route.methods, middleware:route.middleware?.length || 0,
-    policies:route.policy ? Object.keys(route.policy.describe) : [],
+  const inventory                   = routes.map(route => { const advisories = routeAdvisories(route); return { path:route.pattern, handler:handlers.find(key => route[key]), methods:route.methods, middleware:route.middleware?.length || 0,
+    policies:[...(route.policy ? Object.keys(route.policy.describe) : []),...(route.extensionPolicyNames??[]).map(name=>`extensions.${name}`)],
     ...(route.generated ? { generated:route.generated } : {}),
-    state:route.enabled === false ? 'disabled' : route.expiresAt && now >= route.expiresAt ? 'expired' : 'active' }));
+    ...(advisories.length ? { advisories } : {}),
+    state:route.enabled === false ? 'disabled' : route.expiresAt && now >= route.expiresAt ? 'expired' : 'active' }; });
   const cases                = [];
   for (const [i,route] of routes.entries()) {
     const entry = inventory[i];
     if (!entry) continue;
     if (entry.state !== 'active') {
-      if(!route.names.length && !route.static) cases.push({path:route.pattern,method:'GET',status:entry.state==='disabled'?404:410});
+      if(!route.names.length && !route.static && !route.extension && !route.extensionPolicyNames?.length) cases.push({path:route.pattern,method:'GET',status:entry.state==='disabled'?404:410});
       continue;
     }
-    if (route.function || route.link || route.middleware?.length || route.names.length) continue;
+    if (route.extension || route.extensionPolicyNames?.length || route.proxy || route.signals?.length || route.match || route.conditional || route.function || route.middleware?.length || route.names.length) continue;
     // Required inputs need intentional fixtures; never invent business data.
     let context                ;
     try { context = contextFor(route,{},new URLSearchParams(),new Headers()); } catch { continue; }
@@ -160,9 +182,10 @@ export async function auditProject(app              , {expectRoutes,log=()=>{},c
   const counts                       ={configured:plan.inventory.length,active:0,disabled:0,expired:0,byHandler:{}};
   for(const route of plan.inventory){counts[route.state]++;const handler=String(route.handler);counts.byHandler[handler]=(counts.byHandler[handler]||0)+1;}
   const countMatches=expectRoutes===undefined || counts.configured===expectRoutes;
+  const advisories=plan.inventory.flatMap(route=>(route.advisories??[]).map(message=>({route:route.path,message})));
   // The per-route capability table: which policies apply and whether this
   // host enforces, compiles or delegates each one. Refusals never get here.
-  return {dynamicLinks:plan.dynamicLinks,elapsedMs:performance.now()-began,ready:countMatches && !failed && !uncovered.length && counts.active>0,counts,expectedRoutes:expectRoutes ?? null,countMatches,checks:cases.length,passed,failed,coveredRouteMethods:covered.size,unassertedCases,uncovered,policies:plan.policies ?? {},compliance:compliance?await runCompliance(app,compliance):null};
+  return {elapsedMs:performance.now()-began,ready:countMatches && !failed && !uncovered.length && counts.active>0,counts,expectedRoutes:expectRoutes ?? null,countMatches,checks:cases.length,passed,failed,coveredRouteMethods:covered.size,unassertedCases,uncovered,policies:plan.policies ?? {},compliance:compliance?await runCompliance(app,compliance):null,advisories};
 }
 export async function benchmarkProject(app              ,{requests=1000,concurrency=2,maxP95Ms,seconds=30,warmup=0,target}                  ={})                           {
   assert(Number.isInteger(requests)&&requests>=1&&requests<=100000,'Requests must be 1–100000');

package/dist/recipes.js

@@ -0,0 +1,41 @@
+import {fileURLToPath} from 'node:url';
+import {readAuthoringFile,publishAuthoringProject} from './authoring-files.js';
+import {validateDocument,parseYaml} from './config.js';
+import {readMetadata,searchMetadata} from './catalog.js';
+                                                            
+import {assert} from './errors.js';
+
+/** recipe.yaml, validated against schemas/recipe.schema.json; `name` repeats `id` and `files` is the copy list. */
+                                                                       
+                                                                                
+                                                                                                   
+                                                                                                                                     
+// This fixed local catalog is trusted package data, never an executable registry:
+// names come from here, metadata from each recipe's schema-checked recipe.yaml.
+export const recipeNames=['redirect','json-api','typescript','middleware','health-page','static-plus-api','cors-api','webhook-receiver','contact-form','authenticated-json-api','protected-download']         ;
+const recipesRoot=fileURLToPath(new URL('../recipes/',import.meta.url));
+const root=(name        )=>recipesRoot+name+'/';
+async function metadata(name        )                         {const value=await readMetadata(root(name),name,'recipe.yaml');return {name,...value};}
+export async function listRecipes()                           {
+  const result                 =[];
+  for(const name of recipeNames)result.push(await metadata(name));
+  return result;
+}
+function flatten(hits                            )                                {return hits.map(hit=>({...hit.entry,score:hit.score,matched:hit.matched}));}
+/** Matches id, description, tags and capabilities locally; no service is consulted. */
+export async function searchRecipes(text        )                              {
+  const hits=searchMetadata(await listRecipes(),text);
+  return {query:text,count:hits.length,results:flatten(hits)};
+}
+export async function showRecipe(name        )                  {
+  assert((recipeNames                     ).includes(name),'Unknown local recipe');
+  const summary=await metadata(name),content                       =Object.create(null)                         ;
+  for(const path of summary.files)content[path]=(await readAuthoringFile(root(name),path,1048576)).toString('utf8');
+  assert(content['urlcode.yaml'],'Recipe must copy urlcode.yaml');
+  validateDocument(parseYaml(content['urlcode.yaml']));
+  return {...summary,content};
+}
+export async function addRecipe(name        ,output        ,{dryRun=false}                              ={})                           {
+  const recipe=await showRecipe(name);
+  return {name,output:await publishAuthoringProject(output,new Map(Object.entries(recipe.content)),dryRun),dryRun,files:[...recipe.files]};
+}

package/dist/route-diff.js

@@ -0,0 +1,106 @@
+// Route-inventory diff: compares two `urlcode routes` reports and reports what
+// was added, removed or changed. Pure and generic: it knows nothing about
+// pull requests; the GitHub action renders its Markdown into a PR comment.
+import { ConfigError } from './errors.js';
+                                                                 
+
+/** One route as the diff sees it: the inventory entry plus its policy description from the `policies` map. */
+                                                                                            
+/** The parts of a `urlcode routes` report the diff reads. */
+                                                                                                                                  
+                                                                                      
+                                                                                                   
+
+const states                        = ['active','disabled','expired'];
+const isRecord = (value         )                                   => value !== null && typeof value === 'object' && !Array.isArray(value);
+const isStrings = (value         )                    => Array.isArray(value) && value.every(item => typeof item === 'string');
+function entry(value         , index        )                     {
+  const fail = (what        )        => { throw new ConfigError(`Route report inventory[${index}] ${what}`); };
+  if (!isRecord(value)) return fail('is not an object');
+  const { path, handler, methods, middleware, policies, generated, state } = value;
+  if (typeof path !== 'string' || !path) return fail('needs a path');
+  if (handler !== undefined && typeof handler !== 'string') return fail('has an invalid handler');
+  if (!isStrings(methods)) return fail('needs methods');
+  if (typeof middleware !== 'number' || !Number.isInteger(middleware) || middleware < 0) return fail('needs a middleware count');
+  if (!isStrings(policies)) return fail('needs policies');
+  if (generated !== undefined && typeof generated !== 'string') return fail('has an invalid generated marker');
+  if (typeof state !== 'string' || !states.includes(state              )) return fail('needs a state');
+  return { path, handler, methods, middleware, policies, ...(generated !== undefined ? { generated } : {}), state:state               };
+}
+/** Validates a parsed `urlcode routes` JSON report (a child-process or file boundary) into a snapshot. */
+export function parseRouteSnapshot(value         )                {
+  if (!isRecord(value) || !Array.isArray(value.inventory)) throw new ConfigError('Route report needs an inventory array');
+  const inventory = value.inventory.map(entry);
+  const policies                                          = {};
+  if (value.policies !== undefined) {
+    if (!isRecord(value.policies)) throw new ConfigError('Route report policies must be an object');
+    for (const [path, description] of Object.entries(value.policies)) {
+      if (!isRecord(description)) throw new ConfigError(`Route report policies[${path}] must be an object`);
+      policies[path] = description;
+    }
+  }
+  return { inventory, policies };
+}
+// Key order in a report is not a change: compare canonical JSON.
+function canonical(value         )         {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (isRecord(value)) return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+  return JSON.stringify(value) ?? 'null';
+}
+function records(snapshot               )                           {
+  const map = new Map                     ();
+  for (const item of snapshot.inventory) {
+    if (map.has(item.path)) throw new ConfigError(`Route report lists ${item.path} twice`);
+    const policy = snapshot.policies?.[item.path];
+    map.set(item.path, policy ? { ...item, policy } : { ...item });
+  }
+  return map;
+}
+/** Compares two route reports. Paths are sorted; an entry changes when any inventory field or its policy description differs. */
+export function diffRoutes(before               , after               )            {
+  const previous = records(before), current = records(after);
+  const paths = [...new Set([...previous.keys(), ...current.keys()])].sort();
+  const diff            = { added:[], removed:[], changed:[] };
+  for (const path of paths) {
+    const old = previous.get(path), now = current.get(path);
+    if (old && !now) diff.removed.push(old);
+    else if (now && !old) diff.added.push(now);
+    else if (old && now && canonical(old) !== canonical(now)) diff.changed.push({ path, before:old, after:now });
+  }
+  return diff;
+}
+export const hasRouteChanges = (diff           )          => diff.added.length + diff.removed.length + diff.changed.length > 0;
+
+const fields = ['handler','methods','state','middleware','policies','generated','policy']         ;
+                                   
+const cell = (value         )         => {
+  const text = value === undefined ? '' : Array.isArray(value) && value.every(item => typeof item === 'string') ? value.join(', ') : typeof value === 'string' ? value : canonical(value);
+  // Backslashes first, so an escape this adds is never itself re-escaped.
+  return text.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/\r?\n/g, ' ') || '-';
+};
+const code = (value        )         => `\`${value.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\|/g, '\\|')}\``;
+function table(headers          , rows            )           {
+  return [`| ${headers.join(' | ')} |`, `|${headers.map(() => '---').join('|')}|`, ...rows.map(row => `| ${row.join(' | ')} |`)];
+}
+const routeRow = (record             )           => [code(record.path), cell(record.handler), cell(record.methods), cell(record.state), String(record.middleware), cell(record.policies), cell(record.generated)];
+/** Renders a diff as Markdown: one table per nonempty section, or "No route changes". */
+export function renderRouteDiff(diff           )         {
+  if (!hasRouteChanges(diff)) return 'No route changes\n';
+  const lines           = [];
+  const routeHeaders = ['Route','Handler','Methods','State','Middleware','Policies','Generated'];
+  const section = (title        , list               ) => {
+    if (!list.length) return;
+    lines.push(`### ${title} (${list.length})`, '', ...table(routeHeaders, list.map(routeRow)), '');
+  };
+  section('Added routes', diff.added);
+  section('Removed routes', diff.removed);
+  if (diff.changed.length) {
+    const rows             = [];
+    for (const change of diff.changed) {
+      const differing = fields.filter((field       ) => canonical(change.before[field]) !== canonical(change.after[field]));
+      for (const field of differing) rows.push([code(change.path), field, cell(change.before[field]), cell(change.after[field])]);
+    }
+    lines.push(`### Changed routes (${diff.changed.length})`, '', ...table(['Route','Field','Before','After'], rows), '');
+  }
+  return lines.join('\n');
+}

package/dist/router.js

@@ -1,3 +1,10 @@
+import { effectiveExtensionPolicies, isSensitiveExtensionPolicy } from './extensions.js';
+                                                        
+import { validateProxy } from './proxy.js';
+import { validateSignal } from './signals.js';
+                                                
+import { normalizeMatch, assertDisjointMatches } from './conditions.js';
+import { effectivePolicies } from './policies.js';
 import { setImmediate as yieldTurn } from 'node:timers/promises';
 import { compileHttp } from './http-policy.js';
 import Ajv from 'ajv/dist/2020.js';
@@ -51,7 +58,7 @@ function compiledRedirect(redirect                )                   {
   const { pass: _pass, ...query } = redirect.query;
   return { ...redirect, query };
 }
-export async function compileRoutes(loaded                , bindings                                    , permissions                     = {}, projectSha256         )                              {
+export async function compileRoutes(loaded                , bindings                                    , permissions                     = {}, projectSha256         , extensions                                                            )                              {
   const deadline=performance.now()+10000;
   let processed=0;
   const exact = new Map                       (), dynamic                  = [], mounts                  = [], modules = new Map              ();
@@ -63,7 +70,7 @@ export async function compileRoutes(loaded                , bindings
     const parts = segments(pattern);
     assert(!pattern.startsWith('/_urlcode'), 'The /_urlcode prefix is reserved for runtime operations');
     const names = parts.map(parameterName).filter((name)                 => Boolean(name));
-    assert(!pattern.includes('*') || (config.static && pattern.endsWith('/*') && parts.filter(p => p.includes('*')).length === 1 && parts.at(-1) === '*' && !names.length), 'Only static routes support a terminal /* wildcard');
+    assert(!pattern.includes('*') || ((config.static || config.extension) && pattern.endsWith('/*') && parts.filter(p => p.includes('*')).length === 1 && parts.at(-1) === '*' && !names.length), 'Only static or extension routes support a terminal /* wildcard');
     assert(!config.static || pattern.endsWith('/*'), 'Static routes require a terminal /* wildcard');
     if (config.page || config.download || config.static) assert((config.methods || methodsDefault).every(m => methodsDefault.includes(m)), 'Asset routes support only GET and HEAD');
     assert(new Set(names).size === names.length, 'Duplicate path parameter');
@@ -72,6 +79,29 @@ export async function compileRoutes(loaded                , bindings
     const route                = { ...declared, pattern, parts, names, specificity: parts.length - names.length,
       methods: config.methods || methodsDefault, parameters: [], env: dict(), secrets: dict(), responseHeaders: [], middleware: [] };
     compileHttp(route);
+    if (config.match) route.match = normalizeMatch(config.match);
+    if(config.extension){assert(!config.middleware?.length&&!config.parameters?.length&&!config.env&&!config.secrets,'Extension handlers cannot declare guest middleware, parameters or bindings');assert(pattern.endsWith('/*')&&!names.length&&pattern!=='/*','Extension handler requires a non-root literal /* mount');}
+    const extensionPolicyNames = Object.keys(effectiveExtensionPolicies(loaded.document,config));
+    if (config.match || config.conditional || config.extension || isSensitiveExtensionPolicy(extensionPolicyNames,extensions)) {
+      const cache = effectivePolicies(loaded.document,config).cache;
+      assert(!cache || cache.strategy === 'no-store', `${pattern}: conditional routing requires cache disabled or no-store`);
+      assert(!route.responseHeaders.some(([name,value]) => ['cache-control','cdn-cache-control','vercel-cdn-cache-control','surrogate-control'].includes(name.toLowerCase()) && value !== 'no-store'), 'Conditional responses require no-store');
+    }
+    if (config.conditional) {
+      const matches = config.conditional.cases.map(item => normalizeMatch(item.match));
+      assertDisjointMatches(matches);
+      const compileBranch = async (branch                                                                                 ) => {
+        const entry = { ...branch, ...(config.parameters ? { parameters: config.parameters } : {}), ...(config.methods ? { methods: config.methods } : {}) };
+        const table = await compileRoutes({ ...loaded, routes: { [pattern]: entry } }, {}, {});
+        return table.exact.get(pattern) ?? [...table.byLength.values()].flat()[0] ;
+      };
+      route.conditionalRoutes = { cases: [] };
+      for (const [index,item] of config.conditional.cases.entries()) {
+        const { match: _match, ...branch } = item;
+        route.conditionalRoutes.cases.push({ match: matches[index] , route: await compileBranch(branch) });
+      }
+      if (config.conditional.fallback) route.conditionalRoutes.fallback = await compileBranch(config.conditional.fallback);
+    }
     const seen = new Set        ();
     for (const param of config.parameters || []) {
       const schema = param.schema, name = param.in === 'header' ? param.name.toLowerCase() : param.name;
@@ -101,6 +131,17 @@ export async function compileRoutes(loaded                , bindings
       assert(typeof value === 'string' && value.length, 'Missing required secret binding');
       route.secrets[alias] = value;
     }
+    const resolveHeaders=(headers                        )                       => Object.fromEntries(Object.entries(headers||{}).map(([key,value])=>{if(typeof value==='string')return [key,value];assert(own(route.secrets,value.secret),'Unknown egress secret alias');return [key,route.secrets[value.secret] ];}));
+    if(config.proxy){
+      assert(!config.middleware?.length,'Proxy middleware is not supported; authorize requests with host policy before egress');
+      const cache=effectivePolicies(loaded.document,config).cache;
+      assert(!cache||cache.strategy==='no-store','Proxy routes require cache disabled or no-store');
+      assert(!route.responseHeaders.some(([name,value])=>['cache-control','cdn-cache-control','vercel-cdn-cache-control','surrogate-control'].includes(name.toLowerCase())&&value!=='no-store'),'Proxy response caching must be no-store');
+      route.compiledProxy={...config.proxy,headers:resolveHeaders(config.proxy.headers)};validateProxy(route.compiledProxy);
+      for(const match of config.proxy.url.matchAll(/(?:\{|%7B)([A-Za-z_][A-Za-z0-9_]*)(?:\}|%7D)/gi))assert(names.includes(match[1] ), 'Proxy placeholder requires a declared path parameter');
+      assert(!Object.keys(config.response?.headers||{}).some(name=>name.toLowerCase()==='content-encoding'),'Proxy content encoding cannot be overridden');
+    }
+    if(config.signals){route.compiledSignals=config.signals.map(signal=>({...signal,headers:resolveHeaders(signal.headers)}));for(const signal of route.compiledSignals)validateSignal(signal);}
     if (config.expires) {
       assert(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(config.expires) && Number.isFinite(Date.parse(config.expires)), 'Expiry must be a UTC ISO timestamp');
       route.expiresAt = Date.parse(config.expires);
@@ -126,10 +167,6 @@ export async function compileRoutes(loaded                , bindings
       for (const key of query.pass || []) assert(!reserved.has(key), 'Query passthrough conflicts with destination or mapping');
       route.redirect = compiledRedirect(declaredRedirect);
     }
-    if (config.link) {
-      assert(route.methods.every(method => methodsDefault.includes(method)), 'Stored links support only GET and HEAD');
-      referenceCheck(config.link.code,route);
-    }
     for (const item of config.middleware || []) {
       const source = await functionFile(loaded.root,item.source);
       modules.set(source,true);
@@ -141,7 +178,7 @@ export async function compileRoutes(loaded                , bindings
       route.function = { ...declaredFunction, source, export: declaredFunction.export || 'default' };
       for (const ref of Object.values(declaredFunction.args || {})) referenceCheck(ref, route, true);
     }
-    if (config.static) { route.prefix = pattern.slice(0, -1); mounts.push(route); }
+    if (config.static || config.extension) { route.prefix = pattern.slice(0, -1); mounts.push(route); }
     else if (!names.length) exact.set(pattern, route);
     else {
       assert(dynamic.length < 1000, 'Maximum 1000 parameterized routes per snapshot');
@@ -160,6 +197,7 @@ export async function compileRoutes(loaded                , bindings
     if (!byLength.has(route.parts.length)) byLength.set(route.parts.length, []);
     byLength.get(route.parts.length) .push(route);
   }
+  for(const mount of mounts.filter(route=>route.extension)){const base=mount.parts.slice(0,-1);for(const candidate of [...exact.values(),...dynamic,...mounts]){if(candidate===mount)continue;const parts=candidate.parts;const shared=Math.min(base.length,parts.length-(candidate.prefix?1:0));const compatible=base.slice(0,shared).every((part,index)=>part===parts[index]||parameterName(parts[index] ));assert(!compatible||(!candidate.prefix&&parts.length<base.length),'Extension mount overlaps another route');}}
   mounts.sort((a,b) => b.prefix .length - a.prefix .length);
   assert(performance.now()<deadline, 'Route compilation deadline exceeded');
   return { exact, byLength, mounts, modules: [...modules.keys()], count: exact.size + dynamic.length + mounts.length };