@nsnanocat/preference-panes 0.2.0 → 0.3.1

package/dist/preference-panes.request.js

@@ -1295,304 +1295,6 @@
 	    });
 	}
 
-	/**
-	 * 统一请求参数。
-	 * Unified request payload.
-	 *
-	 * @typedef {object} FetchRequest
-	 * @property {string} url 请求地址 / Request URL.
-	 * @property {string} [method] 请求方法 / HTTP method.
-	 * @property {Record<string, any>} [headers] 请求头 / Request headers.
-	 * @property {string|ArrayBuffer|ArrayBufferView|object} [body] 请求体 / Request body.
-	 * @property {ArrayBuffer} [bodyBytes] 二进制请求体 / Binary request body.
-	 * @property {number|string} [timeout] 超时（秒或毫秒）/ Timeout (seconds or milliseconds).
-	 * @property {string} [policy] 指定策略 / Preferred policy.
-	 * @property {boolean} [redirection] 是否跟随重定向 / Whether to follow redirects.
-	 * @property {boolean} ["auto-redirect"] 平台重定向字段 / Platform redirect flag.
-	 * @property {boolean|number|string} ["auto-cookie"] Worker / Node.js Cookie 开关 / Worker / Node.js Cookie toggle.
-	 * @property {Record<string, any>} [opts] 平台扩展字段 / Platform extension fields.
-	 */
-
-	/**
-	 * 统一响应结构。
-	 * Unified response payload.
-	 *
-	 * @typedef {object} FetchResponse
-	 * @property {boolean} ok 请求是否成功 / Whether request is successful.
-	 * @property {number} status 状态码 / HTTP status code.
-	 * @property {number} [statusCode] 状态码别名 / Status code alias.
-	 * @property {string} [statusText] 状态文本 / HTTP status text.
-	 * @property {Record<string, any>} [headers] 响应头 / Response headers.
-	 * @property {string|ArrayBuffer} [body] 响应体 / Response body.
-	 * @property {ArrayBuffer} [bodyBytes] 二进制响应体 / Binary response body.
-	 */
-
-	/**
-	 * 跨平台 `fetch` 适配层。
-	 * Cross-platform `fetch` adapter.
-	 *
-	 * 设计目标:
-	 * Design goal:
-	 * - 仿照 Web API `fetch`（`Window.fetch`）接口设计
-	 * - Modeled after Web API `fetch` (`Window.fetch`)
-	 * - 统一 VPN App、Worker 与 Node.js 环境中的请求调用
-	 * - Unify request calls across VPN apps, Worker, and Node.js
-	 *
-	 * 功能:
-	 * Features:
-	 * - 统一 Quantumult X / Loon / Surge / Stash / Egern / Shadowrocket / Worker / Node.js 请求接口
-	 * - Normalize request APIs across Quantumult X / Loon / Surge / Stash / Egern / Shadowrocket / Worker / Node.js
-	 * - 统一返回体字段（`ok/status/statusText/body/bodyBytes`）
-	 * - Normalize response fields (`ok/status/statusText/body/bodyBytes`)
-	 *
-	 * 与 Web `fetch` 的已知差异:
-	 * Known differences from Web `fetch`:
-	 * - 支持 `policy`、`auto-redirect` 等平台扩展字段
-	 * - Supports platform extension fields like `policy` and `auto-redirect`
-	 * - Worker / Node.js 共享基于 `fetch` 的请求分支
-	 * - Worker / Node.js share the `fetch`-based request branch
-	 * - Node.js ESM 的 `auto-cookie` 由 `fetch.node.mjs` 处理，本文件只使用宿主 `fetch`
-	 * - Node.js ESM `auto-cookie` is handled by `fetch.node.mjs`; this module only uses the host `fetch`
-	 * - 非浏览器平台通过 `$httpClient/$task` 实现，不是原生 Fetch 实现
-	 * - Non-browser platforms use `$httpClient/$task` instead of native Fetch engine
-	 * - 返回结构包含 `statusCode/bodyBytes` 等兼容字段
-	 * - Response includes compatibility fields like `statusCode/bodyBytes`
-	 *
-	 * @link https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch
-	 * @link https://developer.mozilla.org/zh-CN/docs/Web/API/Window/fetch
-	 * @async
-	 * @param {FetchRequest|string} resource 请求对象或 URL / Request object or URL string.
-	 * @param {Partial<FetchRequest>} [options={}] 追加参数 / Extra options.
-	 * @returns {Promise<FetchResponse>}
-	 */
-	async function fetch(resource, options = {}) {
-		// 初始化参数。
-		// Initialize request input.
-		switch (typeof resource) {
-			case "object":
-				resource = { ...options, ...resource };
-				break;
-			case "string":
-				resource = { ...options, url: resource };
-				break;
-			case "undefined":
-			default:
-				throw new TypeError(`${Function.name}: 参数类型错误, resource 必须为对象或字符串`);
-		}
-		// 自动判断请求方法。
-		// Infer the HTTP method automatically.
-		if (!resource.method) {
-			resource.method = "GET";
-			if (resource.body ?? resource.bodyBytes) resource.method = "POST";
-		}
-		// 移除需要由底层实现自动生成的请求头。
-		// Remove headers that should be generated by the underlying runtime.
-		delete resource.headers?.Host;
-		delete resource.headers?.[":authority"];
-		delete resource.headers?.["Content-Length"];
-		delete resource.headers?.["content-length"];
-		// 统一请求方法为小写，方便后续索引平台 API。
-		// Normalize the method to lowercase for platform API lookups.
-		const method = resource.method.toLocaleLowerCase();
-		// 默认请求超时时间为 5 秒。
-		// Default request timeout to 5 seconds.
-		if (!resource.timeout) resource.timeout = 5;
-		if (resource.timeout) {
-			resource.timeout = Number.parseInt(resource.timeout, 10);
-			// 统一先转换为秒，大于 500 视为毫秒输入。
-			// Convert to seconds first and treat values above 500 as milliseconds.
-			if (resource.timeout > 500) resource.timeout = Math.round(resource.timeout / 1000);
-		}
-		if (resource.timeout) {
-			switch ($app) {
-				case "Loon":
-				case "Quantumult X":
-				case "Worker":
-				case "Node.js":
-					// 这些平台要求毫秒，因此把秒重新换算为毫秒。
-					// These platforms expect milliseconds, so convert seconds back to milliseconds.
-					resource.timeout = resource.timeout * 1000;
-					break;
-			}
-		}
-		// 根据当前平台选择请求实现。
-		// Select the request engine for the current platform.
-		switch ($app) {
-			case "Loon":
-			case "Surge":
-			case "Stash":
-			case "Egern":
-			case "Shadowrocket":
-				// 转换通用请求参数到 `$httpClient` 语义。
-				// Map shared request fields to `$httpClient` semantics.
-				if (resource.policy) {
-					switch ($app) {
-						case "Loon":
-							resource.node = resource.policy;
-							break;
-						case "Stash":
-							Lodash.set(resource, "headers.X-Stash-Selected-Proxy", encodeURI(resource.policy));
-							break;
-						case "Shadowrocket":
-							Lodash.set(resource, "headers.X-Surge-Proxy", resource.policy);
-							break;
-					}
-				}
-				if (typeof resource.redirection === "boolean") resource["auto-redirect"] = resource.redirection;
-				// 优先把 `bodyBytes` 映射回 `$httpClient` 能接受的 `body`。
-				// Prefer mapping `bodyBytes` back to the `body` field expected by `$httpClient`.
-				if (resource.bodyBytes && !resource.body) {
-					resource.body = resource.bodyBytes;
-					resource.bodyBytes = undefined;
-				}
-				// 根据 `Accept` 推断是否需要二进制响应体。
-				// Infer whether the response should be treated as binary from `Accept`.
-				switch ((resource.headers?.Accept || resource.headers?.accept)?.split(";")?.[0]) {
-					case "application/protobuf":
-					case "application/x-protobuf":
-					case "application/vnd.google.protobuf":
-					case "application/vnd.apple.flatbuffer":
-					case "application/grpc":
-					case "application/grpc-web":
-					case "application/grpc+proto":
-					case "application/octet-stream":
-						resource["binary-mode"] = true;
-						break;
-				}
-				// 发送 `$httpClient` 请求并归一化返回结构。
-				// Send the `$httpClient` request and normalize the response payload.
-				return new Promise((resolve, reject) => {
-					globalThis.$httpClient[method](resource, (error, response, body) => {
-						if (error) reject(error);
-						else {
-							response.ok = /^2\d\d$/.test(response.status);
-							response.statusCode = response.status;
-							response.statusText = StatusTexts[response.status];
-							if (body) {
-								response.body = body;
-								if (resource["binary-mode"] == true) response.bodyBytes = body;
-							}
-							resolve(response);
-						}
-					});
-				});
-			case "Quantumult X":
-				// 转换 Quantumult X 专有请求参数。
-				// Map request fields to Quantumult X specific options.
-				if (resource.policy) Lodash.set(resource, "opts.policy", resource.policy);
-				if (typeof resource["auto-redirect"] === "boolean") Lodash.set(resource, "opts.redirection", resource["auto-redirect"]);
-				// Quantumult X 使用 `bodyBytes` 传输二进制请求体。
-				// Quantumult X uses `bodyBytes` for binary request payloads.
-				if (resource.body instanceof ArrayBuffer) {
-					resource.bodyBytes = resource.body;
-					resource.body = undefined;
-				} else if (ArrayBuffer.isView(resource.body)) {
-					resource.bodyBytes = resource.body.buffer.slice(resource.body.byteOffset, resource.body.byteLength + resource.body.byteOffset);
-					resource.body = undefined;
-				} else if (resource.body) resource.bodyBytes = undefined;
-				// 发送请求，并用 `Promise.race` 提供统一超时保护。
-				// Send the request and enforce timeout with `Promise.race`.
-				return Promise.race([
-					globalThis.$task.fetch(resource).then(
-						response => {
-							response.ok = /^2\d\d$/.test(response.statusCode);
-							response.status = response.statusCode;
-							response.statusText = StatusTexts[response.status];
-							switch ((response.headers?.["Content-Type"] ?? response.headers?.["content-type"])?.split(";")?.[0]) {
-								case "application/protobuf":
-								case "application/x-protobuf":
-								case "application/vnd.google.protobuf":
-								case "application/vnd.apple.flatbuffer":
-								case "application/grpc":
-								case "application/grpc-web":
-								case "application/grpc+proto":
-								case "application/octet-stream":
-									response.body = response.bodyBytes;
-									break;
-							}
-							response.bodyBytes = undefined;
-							return response;
-						},
-						reason => Promise.reject(reason.error),
-					),
-					new Promise((resolve, reject) => {
-						setTimeout(() => {
-							reject(new Error(`${Function.name}: 请求超时, 请检查网络后重试`));
-						}, resource.timeout);
-					}),
-				]);
-			case "Worker":
-			case "Node.js":
-			default: {
-				let request;
-				let timeout;
-				let shouldWrapError = false;
-				switch ($app) {
-					case "Worker":
-					case "Node.js":
-						switch (typeof globalThis.fetch) {
-							case "function":
-								break;
-							default:
-								throw new Error(`${Function.name}: 当前运行环境不支持 Fetch API`);
-						}
-						// 将通用字段映射到 Worker / Node.js Fetch 语义。
-						// Map shared fields to Worker / Node.js Fetch semantics.
-						resource.redirect = resource.redirection ? "follow" : "manual";
-						request = resource;
-						timeout = resource.timeout;
-						shouldWrapError = true;
-						break;
-					default: {
-						// 未识别宿主也可使用完整标准 Fetch API；不将能力推断为宿主类型。
-						// An unrecognized host may still use the complete standard Fetch API; capability does not imply a host type.
-						if (typeof globalThis.fetch !== "function" || typeof globalThis.Headers !== "function" || typeof globalThis.Request !== "function" || typeof globalThis.Response !== "function") {
-							throw new Error(`${Function.name}: 当前运行环境不支持 Fetch API`);
-						}
-						const { url, bodyBytes, redirection, timeout: _timeout, policy: _policy, "auto-redirect": _autoRedirect, "auto-cookie": _autoCookie, opts: _opts, ...fetchOptions } = resource;
-						if (bodyBytes !== undefined && fetchOptions.body === undefined) fetchOptions.body = bodyBytes;
-						fetchOptions.redirect = redirection ? "follow" : "manual";
-						request = { url, ...fetchOptions };
-						timeout = resource.timeout * 1000;
-						break;
-					}
-				}
-				const { url, ...options } = request;
-				// 发起请求并归一化响应头、文本与二进制响应体。
-				// Send the request and normalize headers, text, and binary response data.
-				const responsePromise = globalThis.fetch(url, options).then(async response => {
-					const bodyBytes = await response.arrayBuffer();
-					let headers;
-					try {
-						headers = response.headers.raw();
-					} catch {
-						headers = Array.from(response.headers.entries()).reduce((acc, [key, value]) => {
-							acc[key] = acc[key] ? [...acc[key], value] : [value];
-							return acc;
-						}, {});
-					}
-					return {
-						ok: response.ok ?? /^2\d\d$/.test(response.status),
-						status: response.status,
-						statusCode: response.status,
-						statusText: response.statusText,
-						body: new TextDecoder("utf-8").decode(bodyBytes),
-						bodyBytes: bodyBytes,
-						headers: Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, key.toLowerCase() !== "set-cookie" ? value.toString() : value])),
-					};
-				});
-				return Promise.race([
-					shouldWrapError ? responsePromise.catch(error => Promise.reject(error.message)) : responsePromise,
-					new Promise((_resolve, reject) => {
-						setTimeout(() => {
-							reject(new Error(`${Function.name}: 请求超时, 请检查网络后重试`));
-						}, timeout);
-					}),
-				]);
-			}
-		}
-	}
-
 	/**
 	 * 跨平台持久化存储适配器。
 	 * Cross-platform persistent storage adapter.
@@ -1878,300 +1580,195 @@
 	}
 
 	/**
-	 * 将 /api/ 后的 URL 路径转换为 util 的路径片段；非 API 路径不处理。
-	 * Convert URL segments after /api/ to util path segments; ignore non-API paths.
-	 * @param {string} url 请求完整 URL / Absolute request URL.
-	 * @returns {string[] | undefined} 键路径片段 / Key path segments.
-	 * @throws {TypeError} API 路径无效或包含危险片段 / Invalid or unsafe API path.
+	 * 解析已经取得的 pathname，避免重复构造 URL。
+	 * Parse an existing pathname without constructing another URL.
+	 * @param {string} pathname 以 / 开头的 URL pathname / URL pathname beginning with /.
+	 * @returns {string[] | undefined} 解码后的路径，非 API 路径不处理 / Decoded path, or undefined outside /api/.
+	 * @throws {TypeError} 转义编码或路径片段非法 / Invalid percent encoding or path segments.
 	 */
-	function parseSettingsPath(url) {
-	  const pathname = new URL(url).pathname;
-	  if (!pathname.startsWith("/api/")) return;
-	  let parts;
-	  try {
-	    parts = pathname.slice(5).replace(/\/$/, "").split("/").map(decodeURIComponent);
-	  } catch {
-	    throw new TypeError("Invalid encoded key path");
-	  }
-	  if (!parts.every((part) => /^[a-zA-Z0-9_-]+$/.test(part) && !["__proto__", "prototype", "constructor"].includes(part)))
-	    throw new TypeError("Invalid key path");
-	  return parts;
+	function parseSettingsPathname(pathname) {
+		if (!pathname.startsWith("/api/")) return;
+		let parts;
+		try {
+			parts = pathname.slice(5).replace(/\/$/, "").split("/").map(decodeURIComponent);
+		} catch {
+			throw new TypeError("Invalid encoded key path");
+		}
+		return validatePathParts(parts);
 	}
 
 	/**
-	 * 将 BoxJS 数组、app 或订阅转换为模块字段，保留原文件为唯一字段来源。
-	 * Normalize a BoxJS array, app or subscription using the source JSON as the field authority.
-	 * @param {unknown} config BoxJS JSON / BoxJS document.
-	 * @param {string} module API 第一段模块名 / First API path segment.
-	 * @returns {import("../index.js").ModuleDefinition} 存储根和字段 / Storage root and fields.
+	 * 校验原始路径片段，不进行 URL 编码转换。
+	 * Validate raw path segments without URL encoding conversion.
+	 * @param {string[]} parts 原始路径片段 / Raw path segments.
+	 * @returns {string[]} 同一数组，不复制或修改 / The same array without copying or mutation.
+	 * @throws {TypeError} 空片段、非法字符或原型属性名 / Empty segments, invalid characters or prototype property names.
 	 */
-	function normalizeBoxJs(config, module) {
-	  parseSettingsPath(`https://example.invalid/api/${module}`);
-	  const apps = Array.isArray(config) ? [] : (config?.apps ?? [config]);
-	  if (!Array.isArray(apps)) throw new TypeError("Expected BoxJS apps array");
-	  for (const candidate of apps) {
-	    if (!candidate || typeof candidate !== "object") throw new TypeError("Expected BoxJS app object");
-	    if (candidate.settings !== undefined && !Array.isArray(candidate.settings)) throw new TypeError("Expected BoxJS settings array");
-	  }
-	  const owners = apps.filter((candidate) =>
-	    candidate.settings?.some(
-	      (entry) => typeof entry.id === "string" && entry.id.startsWith("@") && entry.id.slice(1).split(".")[1] === module,
-	    ),
-	  );
-	  const entries = Array.isArray(config) ? config : owners.flatMap((candidate) => candidate.settings);
-	  const app = owners.length === 1 ? owners[0] : undefined;
-	  if (!Array.isArray(entries)) throw new TypeError("Expected BoxJS settings array, app or subscription");
-	  let storageKey;
-	  const fields = [];
-	  for (const entry of entries) {
-	    if (typeof entry.id !== "string" || !entry.id.startsWith("@")) throw new TypeError("BoxJS settings require @root.path IDs");
-	    const [root, ...parts] = entry.id.slice(1).split(".");
-	    if (parts[0] !== module) continue;
-	    if (parts.length < 2) throw new TypeError("A BoxJS setting must be below the module root");
-	    parseSettingsPath(`https://example.invalid/api/${parts.map(encodeURIComponent).join("/")}`);
-	    if (!root || (storageKey && root !== storageKey)) throw new TypeError("A module must use one storage root");
-	    storageKey = root;
-	    const type = { boolean: "boolean", checkboxes: "array", selects: "select", text: "string", textarea: "string", number: "number" }[
-	      entry.type
-	    ];
-	    if (!type) throw new TypeError(`Unsupported BoxJS control: ${entry.type}`);
-	    const field = {
-	      key: parts.join("."),
-	      name: entry.name,
-	      type: type === "select" ? typeof entry.val : type,
-	      description: entry.desc ?? "",
-	      control: entry.type,
-	      ...(entry.placeholder === undefined ? {} : { placeholder: entry.placeholder }),
-	      ...(entry.rows === undefined ? {} : { rows: entry.rows }),
-	      ...(entry.autoGrow === undefined ? {} : { autoGrow: entry.autoGrow }),
-	    };
-	    if (type === "select" && !["string", "number", "boolean"].includes(field.type))
-	      throw new TypeError(`Select requires a scalar val: ${entry.id}`);
-	    if (entry.items) field.options = entry.items.map((item) => ({ key: item.key, label: item.label }));
-	    if (Object.hasOwn(entry, "val")) field.defaultValue = normalizeStoredValue(field, entry.val);
-	    if (
-	      typeof field.name !== "string" ||
-	      (field.placeholder !== undefined && typeof field.placeholder !== "string") ||
-	      (field.rows !== undefined && (!Number.isInteger(field.rows) || field.rows < 1)) ||
-	      (field.autoGrow !== undefined && typeof field.autoGrow !== "boolean") ||
-	      fields.some((other) => other.key === field.key || other.key.startsWith(`${field.key}.`) || field.key.startsWith(`${other.key}.`))
-	    )
-	      throw new TypeError(`Invalid or overlapping BoxJS field: ${entry.id}`);
-	    if (
-	      field.options &&
-	      (new Set(field.options.map((item) => item.key)).size !== field.options.length ||
-	        field.options.some((item) => !scalar(item.key) || typeof item.label !== "string"))
-	    )
-	      throw new TypeError(`Invalid options: ${entry.id}`);
-	    if (Object.hasOwn(field, "defaultValue") && !validValue(field, field.defaultValue))
-	      throw new TypeError(`Invalid BoxJS val: ${entry.id}`);
-	    fields.push(field);
-	  }
-	  if (!fields.length) throw new TypeError(`No BoxJS settings for module: ${module}`);
-	  const common = fields[0].key.split(".").slice(0, -1);
-	  for (const field of fields) while (!field.key.startsWith(`${common.join(".")}.`)) common.pop();
-	  const metadata = {};
-	  if (app) {
-	    for (const key of ["id", "name", "author", "repo", "script", "icon", "description", "desc"]) {
-	      if (app[key] === undefined) continue;
-	      if (typeof app[key] !== "string") throw new TypeError(`Invalid BoxJS app ${key}`);
-	      metadata[key] = app[key];
-	    }
-	    for (const key of ["icons", "descs"]) {
-	      if (app[key] === undefined) continue;
-	      if (!Array.isArray(app[key]) || app[key].some((item) => typeof item !== "string")) throw new TypeError(`Invalid BoxJS app ${key}`);
-	      metadata[key] = [...app[key]];
-	    }
-	  }
-	  return {
-	    module,
-	    storageKey,
-	    fields,
-	    settingsPath: common,
-	    ...(Object.keys(metadata).length ? { metadata } : {}),
-	  };
+	function validatePathParts(parts) {
+		if (!parts.every(part => typeof part === "string" && /^[a-zA-Z0-9_-]+$/.test(part) && !["__proto__", "prototype", "constructor"].includes(part))) throw new TypeError("Invalid key path");
+		return parts;
 	}
 
 	/**
-	 * 归一化 BoxJS 的字符串存储值，不改变普通文本内容。
-	 * Normalize BoxJS string persistence without changing free-text values.
-	 * @param {import("../index.js").SettingsField} field 字段 / Field.
-	 * @param {unknown} value 存储值 / Stored value.
-	 * @returns {unknown} 控件值 / Control value.
+	 * 按插件声明的根和模块桥接持久化存储，不下载或解析 BoxJS。
+	 * Bridge persistence within the installed root and module without downloading or parsing BoxJS.
 	 */
-	function normalizeStoredValue(field, value) {
-	  if (field.type === "boolean" && (value === "true" || value === "false")) return value === "true";
-	  if (field.type === "number" && typeof value === "string" && value.trim() !== "") return Number(value);
-	  if (field.type === "array" && typeof value === "string") value = value === "" || value === "[]" ? [] : value.split(",");
-	  if (field.options) {
-	    const match = (item) => field.options.find((option) => String(option.key) === String(item))?.key ?? item;
-	    return field.type === "array" && Array.isArray(value) ? value.map(match) : match(value);
-	  }
-	  return value;
-	}
+	class SettingsHandler {
+		/** @type {string} 接管来源 / Handled origin. */
+		#origin;
+		/** @type {string} 安装配置中的存储根 / Storage root from installation config. */
+		#storageKey;
+		/** @type {string} 安装配置中的模块 / Module from installation config. */
+		#module;
+		/** @type {string} 页面标记头 / Page marker header. */
+		#requestHeader;
 
-	function scalar(value) {
-	  return (
-	    typeof value === "boolean" ||
-	    (typeof value === "string" && value.length <= 2048) ||
-	    (typeof value === "number" && Number.isFinite(value))
-	  );
-	}
+		/**
+		 * 固定来源、存储根和模块，构造时不访问网络或存储。
+		 * Fix the origin, storage root and module without network or storage access at construction.
+		 * @param {import("./index.js").SettingsHandlerOptions} options 插件安装配置 / Plugin installation config.
+		 * @throws {TypeError} 安装配置无效 / Invalid installation config.
+		 */
+		constructor({ origin, storageKey, module, requestHeader = "X-Settings-Client" }) {
+			const target = new URL(origin);
+			if (target.protocol !== "https:" || target.pathname !== "/" || target.search || target.hash || target.username || target.password) throw new TypeError("origin must be an HTTPS origin");
+			if (typeof storageKey !== "string" || !storageKey || storageKey.startsWith("@")) throw new TypeError("storageKey must be a literal root key");
+			validatePathParts([module]);
+			if (!/^[a-z][a-z0-9-]*$/i.test(requestHeader)) throw new TypeError("Invalid requestHeader");
+			this.#origin = target.origin;
+			this.#storageKey = storageKey;
+			this.#module = module;
+			this.#requestHeader = requestHeader;
+		}
 
-	function validValue(field, value) {
-	  if (field.type === "array") {
-	    if (!Array.isArray(value) || value.some((item) => !scalar(item)) || new Set(value).size !== value.length) return false;
-	  } else if (typeof value !== field.type || !scalar(value)) return false;
-	  return !field.options || (field.type === "array" ? value : [value]).every((item) => field.options.some((option) => option.key === item));
+		/**
+		 * GET 返回指定值，POST 替换指定值，DELETE 删除指定键或整个模块。
+		 * GET returns a value, POST replaces it, and DELETE removes a key or the entire module.
+		 * @param {import("./index.js").SettingsRequest} request 代理请求 / Proxy request.
+		 * @returns {Promise<import("./index.js").SettingsResponse | undefined>} 响应或非接管请求 / Response, or undefined for an unhandled request.
+		 */
+		async handle(request) {
+			const url = new URL(request.url);
+			if (url.origin !== this.#origin || !url.pathname.startsWith("/api/")) return;
+			const headers = { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" };
+			const reply = (status, data) => ({ status, headers, body: request.method === "HEAD" ? "" : JSON.stringify(data) });
+			let parts;
+			try {
+				parts = parseSettingsPathname(url.pathname);
+			} catch (error) {
+				return reply(400, { error: error.message });
+			}
+			if (parts[0] !== this.#module) return reply(404, { error: "Module is not handled" });
+			const requestHeaders = Object.fromEntries(Object.entries(request.headers ?? {}).map(([key, value]) => [key.toLowerCase(), value]));
+			if (requestHeaders[this.#requestHeader.toLowerCase()] !== "1" || (requestHeaders.origin && requestHeaders.origin !== this.#origin)) return reply(403, { error: "Forbidden settings client" });
+			let value;
+			switch (request.method) {
+				case "HEAD":
+					return reply(200, undefined);
+				case "GET":
+				case "DELETE":
+					break;
+				case "POST":
+					if (requestHeaders["content-type"]?.split(";")[0].trim().toLowerCase() !== "application/json") return reply(415, { error: "Expected application/json" });
+					if (typeof request.body !== "string") return reply(400, { error: "Expected a JSON string body" });
+					if (request.body.length > 65536) return reply(413, { error: "Body exceeds 65536 UTF-16 code units" });
+					try {
+						value = JSON.parse(request.body);
+					} catch {
+						return reply(400, { error: "Invalid JSON" });
+					}
+					break;
+				default:
+					return { ...reply(405, { error: "Method not allowed" }), headers: { ...headers, Allow: "HEAD, GET, POST, DELETE" } };
+			}
+			try {
+				const root = Storage.getItem(this.#storageKey, {});
+				if (!isRecord(root)) throw new TypeError("stored root must be an object");
+				const parent = storageParent(root, parts, request.method === "POST");
+				const key = parts.at(-1);
+				switch (request.method) {
+					case "GET": {
+						const result = parent ? Lodash.get(parent, [key]) : undefined;
+						return result === undefined ? reply(404, { error: "Stored path does not exist" }) : reply(200, result);
+					}
+					case "POST":
+						Lodash.set(parent, [key], value);
+						break;
+					case "DELETE":
+						if (parent) Lodash.unset(parent, [key]);
+						break;
+				}
+				if (!Storage.setItem(this.#storageKey, root)) throw new Error("Storage write failed");
+				return reply(200, request.method === "POST" ? { saved: true } : { deleted: true });
+			} catch (error) {
+				return reply(500, { error: error.message });
+			}
+		}
 	}
 
 	/**
-	 * 使用 util 下载 BoxJS、校验字段并读写持久化存储。
-	 * Download BoxJS through util, validate fields and handle persistent storage.
+	 * 判断根节点是否为普通对象。
+	 * Determine whether a root node is a plain object.
+	 * @param {unknown} value 待检查值 / Value to inspect.
+	 * @returns {boolean} 是否为普通对象 / Whether this is a plain object.
 	 */
-	class SettingsHandler {
-	  #origin;
-	  #configURL;
-	  #requestHeader;
-	  #resolveSettings;
-
-	  /** @param {import("./index.js").SettingsHandlerOptions} options 来源、配置地址与 GET 解析器 / Origin, config source and GET resolver. */
-	  constructor({ origin, configURL, requestHeader = "X-Settings-Client", resolveSettings }) {
-	    const target = new URL(origin);
-	    if (target.protocol !== "https:" || target.pathname !== "/" || target.search || target.hash || target.username || target.password)
-	      throw new TypeError("origin must be an HTTPS origin");
-	    const source = new URL(configURL);
-	    if (source.protocol !== "https:" || source.username || source.password || source.hash)
-	      throw new TypeError("configURL must be an HTTPS URL without credentials or fragment");
-	    if (!/^[a-z][a-z0-9-]*$/i.test(requestHeader)) throw new TypeError("Invalid requestHeader");
-	    this.#origin = target.origin;
-	    this.#configURL = source.href;
-	    this.#requestHeader = requestHeader;
-	    this.#resolveSettings = resolveSettings;
-	  }
-
-	  async #loadConfig(module) {
-	    const response = await fetch({ url: this.#configURL, method: "GET", headers: { "Cache-Control": "no-cache" }, timeout: 5000 });
-	    if (response.status !== 200) throw new Error(`BoxJS source HTTP ${response.status}`);
-	    return normalizeBoxJs(JSON.parse(response.body), module);
-	  }
-
-	  /**
-	   * @param {import("./index.js").SettingsRequest} request 代理请求 / Proxy request.
-	   * @returns {Promise<import("./index.js").SettingsResponse | undefined>} API 响应，非本来源 API 则不处理 / API response, or undefined outside the configured API origin.
-	   */
-	  async handle(request) {
-	    const url = new URL(request.url);
-	    if (url.origin !== this.#origin || !url.pathname.startsWith("/api/")) return;
-	    const headers = { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" };
-	    const reply = (status, data) => ({ status, headers, body: request.method === "HEAD" ? "" : JSON.stringify(data) });
-	    let parts;
-	    try {
-	      parts = parseSettingsPath(request.url);
-	    } catch (error) {
-	      return reply(400, { error: error.message });
-	    }
-	    const requestHeaders = Object.fromEntries(Object.entries(request.headers ?? {}).map(([key, value]) => [key.toLowerCase(), value]));
-	    if (requestHeaders[this.#requestHeader.toLowerCase()] !== "1" || (requestHeaders.origin && requestHeaders.origin !== this.#origin))
-	      return reply(403, { error: "Forbidden settings client" });
-	    if (!["HEAD", "GET", "POST", "DELETE"].includes(request.method))
-	      return { ...reply(405, { error: "Method not allowed" }), headers: { ...headers, Allow: "HEAD, GET, POST, DELETE" } };
-	    let definition;
-	    try {
-	      definition = await this.#loadConfig(parts[0]);
-	    } catch (error) {
-	      return reply(502, { error: `Module configuration unavailable: ${error.message}` });
-	    }
-	    const key = parts.join(".");
-	    const field = definition.fields.find((field) => field.key === key);
-	    const descendants = definition.fields.filter((field) => field.key.startsWith(`${key}.`));
-	    if (!field && !descendants.length) return reply(404, { error: `Unknown setting path: ${key}` });
-	    if (request.method === "HEAD") return reply(200, undefined);
-	    if (request.method === "GET") {
-	      const stored = Storage.getItem(definition.storageKey, {});
-	      const effective = this.#resolveSettings ? this.#resolveSettings(stored, definition) : stored;
-	      if (!isRecord(effective)) throw new TypeError("resolved settings must be a synchronous object");
-	      if (field) {
-	        const value = pathValue(effective, parts);
-	        return value === undefined ? reply(404, { error: `Setting has no stored value: ${key}` }) : reply(200, value);
-	      }
-	      const subtree = {};
-	      // 只返回配置文件公开的字段；默认值由浏览器用 BoxJS val 生成。
-	      // Expose only declared fields; the browser renders defaults from BoxJS val.
-	      for (const descendant of descendants) {
-	        const fullPath = descendant.key.split(".");
-	        const value = pathValue(effective, fullPath);
-	        if (value !== undefined) Lodash.set(subtree, fullPath.slice(parts.length), value);
-	      }
-	      return reply(200, subtree);
-	    }
-	    if (!field) return reply(405, { error: "Only individual declared keys can be modified" });
-	    let value;
-	    if (request.method === "POST") {
-	      if (requestHeaders["content-type"]?.split(";")[0].trim().toLowerCase() !== "application/json")
-	        return reply(415, { error: "Expected application/json" });
-	      if (typeof request.body !== "string") return reply(400, { error: "Expected a JSON string body" });
-	      if (request.body.length > 65536) return reply(413, { error: "Body exceeds 65536 UTF-16 code units" });
-	      try {
-	        value = JSON.parse(request.body);
-	      } catch {
-	        return reply(400, { error: "Invalid JSON" });
-	      }
-	      if (!validValue(field, value)) return reply(400, { error: `Invalid setting value: ${key}` });
-	    }
-	    const saved = Storage.getItem(definition.storageKey, {});
-	    if (!isRecord(saved)) throw new TypeError("stored settings must be an object");
-	    const parent = settingsParent(saved, parts, request.method === "POST");
-	    if (parent) {
-	      if (request.method === "DELETE") Lodash.unset(parent, [parts.at(-1)]);
-	      else Lodash.set(parent, [parts.at(-1)], value);
-	    }
-	    if (!Storage.setItem(definition.storageKey, saved)) return reply(500, { error: "Settings storage write failed" });
-	    return reply(200, request.method === "DELETE" ? { deleted: true } : { saved: true });
-	  }
-	}
-
 	function isRecord(value) {
-	  return value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
-	}
-
-	function pathValue(root, parts) {
-	  const parent = settingsParent(root, parts, false);
-	  return parent ? Lodash.get(parent, [parts.at(-1)]) : undefined;
+		return value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
 	}
 
-	// util 的 @root.path 允许序列化中间对象；统一解码并保留相邻键。
-	// Decode util-serialized intermediate objects while retaining sibling keys.
-	function settingsParent(root, parts, create) {
-	  let parent = root;
-	  for (const part of parts.slice(0, -1)) {
-	    let next = Lodash.get(parent, [part]);
-	    if (next === undefined) {
-	      if (!create) return;
-	      next = {};
-	    } else if (typeof next === "string") next = JSON.parse(next);
-	    if (!isRecord(next)) throw new TypeError(`Stored path is not an object: ${part}`);
-	    Lodash.set(parent, [part], next);
-	    parent = next;
-	  }
-	  return parent;
+	/**
+	 * 遍历父路径，兼容旧存储中 JSON 字符串形式的中间节点。
+	 * Traverse parents, supporting legacy intermediate nodes serialized as JSON strings.
+	 * @param {Record<string, unknown>} root 存储根 / Storage root.
+	 * @param {string[]} parts 完整路径 / Complete path.
+	 * @param {boolean} create 是否创建缺失节点 / Whether to create missing parents.
+	 * @returns {object | undefined} 父节点，缺失且不创建时为 undefined / Parent, or undefined when absent and not creating.
+	 * @throws {TypeError} 无法继续遍历标量节点 / A scalar node cannot be traversed.
+	 */
+	function storageParent(root, parts, create) {
+		let parent = root;
+		for (const part of parts.slice(0, -1)) {
+			let next = Lodash.get(parent, [part]);
+			switch (typeof next) {
+				case "undefined":
+					if (!create) return;
+					next = {};
+					break;
+				case "string":
+					next = JSON.parse(next);
+					break;
+			}
+			if (!isRecord(next) && !Array.isArray(next)) throw new TypeError("Stored parent is not an object or array");
+			Lodash.set(parent, [part], next);
+			parent = next;
+		}
+		return parent;
 	}
 
+	/**
+	 * 读取代理参数、执行处理器并将响应交给宿主 done。
+	 * Read proxy arguments, execute the handler and pass the response to the host's done function.
+	 * @returns {Promise<void>} 代理脚本执行结束 / Proxy script execution completion.
+	 */
 	(async () => {
-	  let response;
-	  try {
-	    const { origin, configURL } = qs.parse(globalThis.$argument);
-	    const handler = new SettingsHandler({ origin, configURL });
-	    response = await handler.handle(globalThis.$request);
-	  } catch (error) {
-	    console.error(`PreferencePanes: ${error.message}`);
-	    response = {
-	      status: 500,
-	      headers: { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" },
-	      body: globalThis.$request.method === "HEAD" ? "" : JSON.stringify({ error: "Settings execution failed" }),
-	    };
-	  }
-	  done(response ? ($app === "Quantumult X" ? response : { response }) : {});
+		let response;
+		try {
+			const { origin, storageKey, module } = qs.parse(globalThis.$argument);
+			const handler = new SettingsHandler({ origin, storageKey, module });
+			response = await handler.handle(globalThis.$request);
+		} catch (error) {
+			console.error(`PreferencePanes: ${error.message}`);
+			response = {
+				status: 500,
+				headers: { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" },
+				body: globalThis.$request.method === "HEAD" ? "" : JSON.stringify({ error: "Settings execution failed" }),
+			};
+		}
+		if (!response) {
+			done({});
+			return;
+		}
+		done($app === "Quantumult X" ? response : { response });
 	})();
 
 })();