@nsnanocat/preference-panes 1.1.2 → 1.1.3

package/README.md

@@ -1,6 +1,6 @@
 # @nsnanocat/preference-panes
 
-PreferencePanes 提供一个由 BoxJS JSON 驱动的通用设置前端，以及一个独立的代理配置与持久化 API。业务模块只发布自己的 `/configs/{module}`；通用 `/settings/**` 前端和 `/api/**` 后端分别只需要安装一次。
+PreferencePanes 提供一个由 BoxJS JSON 驱动的通用设置前端，以及一个独立的代理持久化 API。业务模块直接将自己的 BoxJS JSON Mock 到 `/api/{module}`；通用 `/settings/**` 前端和固定存储 API 分别只需要安装一次。
 
 在 Biliverse 中，Enhanced 是唯一安装 `web.js` 的模块。Global、Redirect、ADBlock 不携带 `web.js`，它们的设置页仍由同一份通用前端读取各自 BoxJS 后渲染。
 
@@ -41,15 +41,18 @@ preferences.destroy();
 
 模块页面从 URL 或 `ModuleFrame` 的模块标记取得模块名，通过同源 `/api/{module}` 读取原始 BoxJS，然后调用 `mount(boxjs)`。页面不接受 JSON/CSS 查询参数、私有请求头或兼容资源别名，也不直接访问 `/configs/**`。
 
+业务模块模板直接处理：
+
+- `HEAD /api/{module}`：返回空正文和 `X-PreferencePanes-Version`。
+- `GET /api/{module}`：返回同版原始 BoxJS JSON。
+
 `api.js` 只处理：
 
-- `HEAD /api/{module}`：探测同源 `/configs/{module}`，透传状态与 `X-PreferencePanes-Version`。
-- `GET /api/{module}`：原样返回同源 `/configs/{module}` 的 BoxJS JSON 与版本头。
 - `POST /api/get`：读取完整 `@root.path`。
 - `POST /api/set`：写入完整 `@root.path`。
 - `POST /api/delete`：删除完整 `@root.path` 或子树。
 
-模块 API 只转发业务配置；固定存储 API 不下载或解析 BoxJS。BoxJS 字段、控件、选项、默认值与写入值都由浏览器校验。
+模块名 `get`、`set` 和 `delete` 为固定存储端点保留。模块 API 与固定存储 API 都不解析 BoxJS；BoxJS 字段、控件、选项、默认值与写入值全部由浏览器校验。
 
 ```js
 await fetch("/api/set", {

package/dist/api.js

@@ -960,201 +960,6 @@
     	}
     }
 
-    /* https://github.com/ljharb/qs */
-    /**
-     * 轻量 `qs` 查询字符串工具。
-     * Lightweight `qs` query-string utilities.
-     *
-     * 说明:
-     * Notes:
-     * - 参考 `qs` 的 `parse` / `stringify` 接口设计
-     * - Modeled after the `qs` `parse` / `stringify` API
-     * - `parse` 保持当前项目原有 `$argument` 字符串解析语义
-     * - `parse` preserves the existing `$argument` string parsing semantics
-     * - `stringify` 基于项目内 `Lodash` 路径能力展开对象
-     * - `stringify` expands objects via the in-project `Lodash` path helpers
-     *
-     * 参考:
-     * Reference:
-     * - https://github.com/ljharb/qs
-     * - https://www.npmjs.com/package/qs
-     */
-    class qs {
-    	/**
-    	 * 将查询字符串解析为对象。
-    	 * Parse a query string into an object.
-    	 *
-    	 * @param {string | Record<string, unknown> | null | undefined} [query=""] 查询字符串或对象 / Query string or object.
-    	 * @returns {Record<string, unknown>}
-    	 */
-    	static parse(query) {
-    		let result = {};
-    		switch (typeof query) {
-    			case "string": {
-    				const source = query.replace(/^\?/, "");
-    				if (!source) break;
-    				const obj = Object.fromEntries(
-    					source
-    						.split("&")
-    						.filter(Boolean)
-    						.map(item => {
-    							const [rawKey = "", rawValue = ""] = item.split("=", 2);
-    							const key = qs.#decode(rawKey).replace(/\[([^\[\]]+)\]/g, ".$1");
-    							return [key, qs.#decode(rawValue).replace(/\"/g, "")];
-    						}),
-    				);
-    				Object.keys(obj).forEach(key => Lodash.set(result, key, obj[key]));
-    				break;
-    			}
-    			case "object": {
-    				switch (query) {
-    					case null:
-    						break;
-    					default: {
-    						const obj = {};
-    						Object.keys(query).forEach(key => Lodash.set(obj, key, query[key]));
-    						result = obj;
-    						break;
-    					}
-    				}
-    				break;
-    			}
-    			case "undefined":
-    				result = {};
-    				break;
-    		}
-    		return result;
-    	}
-
-    	/**
-    	 * 将对象序列化为查询字符串。
-    	 * Serialize an object into a query string.
-    	 *
-    	 * @param {Record<string, unknown>} [object={}] 输入对象 / Input object.
-    	 * @returns {string}
-    	 */
-    	static stringify(object = {}) {
-    		if (!object || typeof object !== "object") return "";
-
-    		const entries = [];
-    		Object.keys(object).forEach(key => qs.#collect(object, key, entries));
-
-    		if (entries.length === 0) return "";
-    		return entries
-    			.map(([key, value]) => `${qs.#encode(qs.#formatPath(key))}=${qs.#encode(value)}`)
-    			.join("&");
-    	}
-
-    	/**
-    	 * 收集待序列化的键值对。
-    	 * Collect key-value pairs for stringification.
-    	 *
-    	 * @param {Record<string, unknown>} object 输入对象 / Input object.
-    	 * @param {string} path 当前路径 / Current path.
-    	 * @param {[string, string][]} entries 输出数组 / Output entries.
-    	 * @returns {void}
-    	 */
-    	static #collect(object, path, entries) {
-    		const value = Lodash.get(object, path);
-    		if (value === undefined) return;
-    		if (value === null) {
-    			entries.push([path, ""]);
-    			return;
-    		}
-    		if (Array.isArray(value)) {
-    			value.forEach((item, index) => {
-    				if (item === undefined) return;
-    				qs.#collect(object, `${path}[${index}]`, entries);
-    			});
-    			return;
-    		}
-    		if (qs.#isPlainObject(value)) {
-    			Object.keys(value).forEach(key => qs.#collect(object, `${path}.${key}`, entries));
-    			return;
-    		}
-    		entries.push([path, String(value)]);
-    	}
-
-    	/**
-    	 * 使用 `Lodash.toPath` 规范化输出路径。
-    	 * Normalize output path via `Lodash.toPath`.
-    	 *
-    	 * @param {string} path 原始路径 / Raw path.
-    	 * @returns {string}
-    	 */
-    	static #formatPath(path) {
-    		const [head, ...tail] = Lodash.toPath(path);
-    		return tail.reduce((result, segment) => (/^\d+$/.test(segment) ? `${result}[${segment}]` : `${result}.${segment}`), head);
-    	}
-
-    	/**
-    	 * 判断值是否为普通对象。
-    	 * Check whether a value is a plain object.
-    	 *
-    	 * @param {unknown} value 输入值 / Input value.
-    	 * @returns {boolean}
-    	 */
-    	static #isPlainObject(value) {
-    		if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-    		const proto = Object.getPrototypeOf(value);
-    		return proto === null || proto === Object.prototype;
-    	}
-
-    	/**
-    	 * 编码查询字符串片段。
-    	 * Encode a query-string fragment.
-    	 *
-    	 * @param {string} value 原始值 / Raw value.
-    	 * @returns {string}
-    	 */
-    	static #encode(value) {
-    		return encodeURIComponent(value);
-    	}
-
-    	/**
-    	 * 解码查询字符串片段。
-    	 * Decode a query-string fragment.
-    	 *
-    	 * @param {string} value 编码值 / Encoded value.
-    	 * @returns {string}
-    	 */
-    	static #decode(value) {
-    		return decodeURIComponent(value.replace(/\+/g, " "));
-    	}
-    }
-
-    /**
-     * 统一 `$argument` 输入格式并展开深路径。
-     * Normalize `$argument` input format and expand deep paths.
-     *
-     * 平台差异:
-     * Platform differences:
-     * - Surge / Stash / Egern 常见为字符串参数: `a=1&b=2`
-     * - Surge / Stash / Egern usually pass string args: `a=1&b=2`
-     * - Loon 支持字符串和对象两种形态
-     * - Loon supports both string and object forms
-     * - Quantumult X / Shadowrocket 一般不提供 `$argument`
-     * - Quantumult X / Shadowrocket usually do not expose `$argument`
-     *
-     * 执行时机:
-     * Execution timing:
-     * - 该模块为即时执行模块，`import` 时立即处理全局 `$argument`
-     * - This module executes immediately and mutates global `$argument` on import
-     *
-     * 归一化规则补充:
-     * Normalization details:
-     * - 使用 `globalThis.$argument` 读写，避免运行环境下未声明变量引用问题
-     * - Read/write via `globalThis.$argument` to avoid undeclared variable access
-     * - 当 `$argument` 为 `null` 或 `undefined` 时，会重置为 `{}`
-     * - When `$argument` is `null` or `undefined`, it is normalized to `{}`
-     */
-    (() => {
-    	Console.debug("☑️ $argument");
-    	globalThis.$argument = qs.parse(globalThis.$argument);
-    	if (globalThis.$argument.LogLevel) Console.logLevel = globalThis.$argument.LogLevel;
-    	Console.debug("✅ $argument", `$argument: ${JSON.stringify(globalThis.$argument)}`);
-    })();
-
     /**
      * HTTP 状态码文本映射表。
      * HTTP status code to status text map.
@@ -1327,304 +1132,6 @@
     	}
     }
 
-    /**
-     * 统一请求参数。
-     * Unified request payload.
-     *
-     * @typedef {object} FetchRequest
-     * @property {string} url 请求地址 / Request URL.
-     * @property {string} [method] 请求方法 / HTTP method.
-     * @property {Record<string, any>} [headers] 请求头 / Request headers.
-     * @property {string|ArrayBuffer|ArrayBufferView|object} [body] 请求体 / Request body.
-     * @property {ArrayBuffer} [bodyBytes] 二进制请求体 / Binary request body.
-     * @property {number|string} [timeout] 超时（秒或毫秒）/ Timeout (seconds or milliseconds).
-     * @property {string} [policy] 指定策略 / Preferred policy.
-     * @property {boolean} [redirection] 是否跟随重定向 / Whether to follow redirects.
-     * @property {boolean} ["auto-redirect"] 平台重定向字段 / Platform redirect flag.
-     * @property {boolean|number|string} ["auto-cookie"] Worker / Node.js Cookie 开关 / Worker / Node.js Cookie toggle.
-     * @property {Record<string, any>} [opts] 平台扩展字段 / Platform extension fields.
-     */
-
-    /**
-     * 统一响应结构。
-     * Unified response payload.
-     *
-     * @typedef {object} FetchResponse
-     * @property {boolean} ok 请求是否成功 / Whether request is successful.
-     * @property {number} status 状态码 / HTTP status code.
-     * @property {number} [statusCode] 状态码别名 / Status code alias.
-     * @property {string} [statusText] 状态文本 / HTTP status text.
-     * @property {Record<string, any>} [headers] 响应头 / Response headers.
-     * @property {string|ArrayBuffer} [body] 响应体 / Response body.
-     * @property {ArrayBuffer} [bodyBytes] 二进制响应体 / Binary response body.
-     */
-
-    /**
-     * 跨平台 `fetch` 适配层。
-     * Cross-platform `fetch` adapter.
-     *
-     * 设计目标:
-     * Design goal:
-     * - 仿照 Web API `fetch`（`Window.fetch`）接口设计
-     * - Modeled after Web API `fetch` (`Window.fetch`)
-     * - 统一 VPN App、Worker 与 Node.js 环境中的请求调用
-     * - Unify request calls across VPN apps, Worker, and Node.js
-     *
-     * 功能:
-     * Features:
-     * - 统一 Quantumult X / Loon / Surge / Stash / Egern / Shadowrocket / Worker / Node.js 请求接口
-     * - Normalize request APIs across Quantumult X / Loon / Surge / Stash / Egern / Shadowrocket / Worker / Node.js
-     * - 统一返回体字段（`ok/status/statusText/body/bodyBytes`）
-     * - Normalize response fields (`ok/status/statusText/body/bodyBytes`)
-     *
-     * 与 Web `fetch` 的已知差异:
-     * Known differences from Web `fetch`:
-     * - 支持 `policy`、`auto-redirect` 等平台扩展字段
-     * - Supports platform extension fields like `policy` and `auto-redirect`
-     * - Worker / Node.js 共享基于 `fetch` 的请求分支
-     * - Worker / Node.js share the `fetch`-based request branch
-     * - Node.js ESM 的 `auto-cookie` 由 `fetch.node.mjs` 处理，本文件只使用宿主 `fetch`
-     * - Node.js ESM `auto-cookie` is handled by `fetch.node.mjs`; this module only uses the host `fetch`
-     * - 非浏览器平台通过 `$httpClient/$task` 实现，不是原生 Fetch 实现
-     * - Non-browser platforms use `$httpClient/$task` instead of native Fetch engine
-     * - 返回结构包含 `statusCode/bodyBytes` 等兼容字段
-     * - Response includes compatibility fields like `statusCode/bodyBytes`
-     *
-     * @link https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch
-     * @link https://developer.mozilla.org/zh-CN/docs/Web/API/Window/fetch
-     * @async
-     * @param {FetchRequest|string} resource 请求对象或 URL / Request object or URL string.
-     * @param {Partial<FetchRequest>} [options={}] 追加参数 / Extra options.
-     * @returns {Promise<FetchResponse>}
-     */
-    async function fetch(resource, options = {}) {
-    	// 初始化参数。
-    	// Initialize request input.
-    	switch (typeof resource) {
-    		case "object":
-    			resource = { ...options, ...resource };
-    			break;
-    		case "string":
-    			resource = { ...options, url: resource };
-    			break;
-    		case "undefined":
-    		default:
-    			throw new TypeError(`${Function.name}: 参数类型错误, resource 必须为对象或字符串`);
-    	}
-    	// 自动判断请求方法。
-    	// Infer the HTTP method automatically.
-    	if (!resource.method) {
-    		resource.method = "GET";
-    		if (resource.body ?? resource.bodyBytes) resource.method = "POST";
-    	}
-    	// 移除需要由底层实现自动生成的请求头。
-    	// Remove headers that should be generated by the underlying runtime.
-    	delete resource.headers?.Host;
-    	delete resource.headers?.[":authority"];
-    	delete resource.headers?.["Content-Length"];
-    	delete resource.headers?.["content-length"];
-    	// 统一请求方法为小写，方便后续索引平台 API。
-    	// Normalize the method to lowercase for platform API lookups.
-    	const method = resource.method.toLocaleLowerCase();
-    	// 默认请求超时时间为 5 秒。
-    	// Default request timeout to 5 seconds.
-    	if (!resource.timeout) resource.timeout = 5;
-    	if (resource.timeout) {
-    		resource.timeout = Number.parseInt(resource.timeout, 10);
-    		// 统一先转换为秒，大于 500 视为毫秒输入。
-    		// Convert to seconds first and treat values above 500 as milliseconds.
-    		if (resource.timeout > 500) resource.timeout = Math.round(resource.timeout / 1000);
-    	}
-    	if (resource.timeout) {
-    		switch ($app) {
-    			case "Loon":
-    			case "Quantumult X":
-    			case "Worker":
-    			case "Node.js":
-    				// 这些平台要求毫秒，因此把秒重新换算为毫秒。
-    				// These platforms expect milliseconds, so convert seconds back to milliseconds.
-    				resource.timeout = resource.timeout * 1000;
-    				break;
-    		}
-    	}
-    	// 根据当前平台选择请求实现。
-    	// Select the request engine for the current platform.
-    	switch ($app) {
-    		case "Loon":
-    		case "Surge":
-    		case "Stash":
-    		case "Egern":
-    		case "Shadowrocket":
-    			// 转换通用请求参数到 `$httpClient` 语义。
-    			// Map shared request fields to `$httpClient` semantics.
-    			if (resource.policy) {
-    				switch ($app) {
-    					case "Loon":
-    						resource.node = resource.policy;
-    						break;
-    					case "Stash":
-    						Lodash.set(resource, "headers.X-Stash-Selected-Proxy", encodeURI(resource.policy));
-    						break;
-    					case "Shadowrocket":
-    						Lodash.set(resource, "headers.X-Surge-Proxy", resource.policy);
-    						break;
-    				}
-    			}
-    			if (typeof resource.redirection === "boolean") resource["auto-redirect"] = resource.redirection;
-    			// 优先把 `bodyBytes` 映射回 `$httpClient` 能接受的 `body`。
-    			// Prefer mapping `bodyBytes` back to the `body` field expected by `$httpClient`.
-    			if (resource.bodyBytes && !resource.body) {
-    				resource.body = resource.bodyBytes;
-    				resource.bodyBytes = undefined;
-    			}
-    			// 根据 `Accept` 推断是否需要二进制响应体。
-    			// Infer whether the response should be treated as binary from `Accept`.
-    			switch ((resource.headers?.Accept || resource.headers?.accept)?.split(";")?.[0]) {
-    				case "application/protobuf":
-    				case "application/x-protobuf":
-    				case "application/vnd.google.protobuf":
-    				case "application/vnd.apple.flatbuffer":
-    				case "application/grpc":
-    				case "application/grpc-web":
-    				case "application/grpc+proto":
-    				case "application/octet-stream":
-    					resource["binary-mode"] = true;
-    					break;
-    			}
-    			// 发送 `$httpClient` 请求并归一化返回结构。
-    			// Send the `$httpClient` request and normalize the response payload.
-    			return new Promise((resolve, reject) => {
-    				globalThis.$httpClient[method](resource, (error, response, body) => {
-    					if (error) reject(error);
-    					else {
-    						response.ok = /^2\d\d$/.test(response.status);
-    						response.statusCode = response.status;
-    						response.statusText = StatusTexts[response.status];
-    						if (body) {
-    							response.body = body;
-    							if (resource["binary-mode"] == true) response.bodyBytes = body;
-    						}
-    						resolve(response);
-    					}
-    				});
-    			});
-    		case "Quantumult X":
-    			// 转换 Quantumult X 专有请求参数。
-    			// Map request fields to Quantumult X specific options.
-    			if (resource.policy) Lodash.set(resource, "opts.policy", resource.policy);
-    			if (typeof resource["auto-redirect"] === "boolean") Lodash.set(resource, "opts.redirection", resource["auto-redirect"]);
-    			// Quantumult X 使用 `bodyBytes` 传输二进制请求体。
-    			// Quantumult X uses `bodyBytes` for binary request payloads.
-    			if (resource.body instanceof ArrayBuffer) {
-    				resource.bodyBytes = resource.body;
-    				resource.body = undefined;
-    			} else if (ArrayBuffer.isView(resource.body)) {
-    				resource.bodyBytes = resource.body.buffer.slice(resource.body.byteOffset, resource.body.byteLength + resource.body.byteOffset);
-    				resource.body = undefined;
-    			} else if (resource.body) resource.bodyBytes = undefined;
-    			// 发送请求，并用 `Promise.race` 提供统一超时保护。
-    			// Send the request and enforce timeout with `Promise.race`.
-    			return Promise.race([
-    				globalThis.$task.fetch(resource).then(
-    					response => {
-    						response.ok = /^2\d\d$/.test(response.statusCode);
-    						response.status = response.statusCode;
-    						response.statusText = StatusTexts[response.status];
-    						switch ((response.headers?.["Content-Type"] ?? response.headers?.["content-type"])?.split(";")?.[0]) {
-    							case "application/protobuf":
-    							case "application/x-protobuf":
-    							case "application/vnd.google.protobuf":
-    							case "application/vnd.apple.flatbuffer":
-    							case "application/grpc":
-    							case "application/grpc-web":
-    							case "application/grpc+proto":
-    							case "application/octet-stream":
-    								response.body = response.bodyBytes;
-    								break;
-    						}
-    						response.bodyBytes = undefined;
-    						return response;
-    					},
-    					reason => Promise.reject(reason.error),
-    				),
-    				new Promise((resolve, reject) => {
-    					setTimeout(() => {
-    						reject(new Error(`${Function.name}: 请求超时, 请检查网络后重试`));
-    					}, resource.timeout);
-    				}),
-    			]);
-    		case "Worker":
-    		case "Node.js":
-    		default: {
-    			let request;
-    			let timeout;
-    			let shouldWrapError = false;
-    			switch ($app) {
-    				case "Worker":
-    				case "Node.js":
-    					switch (typeof globalThis.fetch) {
-    						case "function":
-    							break;
-    						default:
-    							throw new Error(`${Function.name}: 当前运行环境不支持 Fetch API`);
-    					}
-    					// 将通用字段映射到 Worker / Node.js Fetch 语义。
-    					// Map shared fields to Worker / Node.js Fetch semantics.
-    					resource.redirect = resource.redirection ? "follow" : "manual";
-    					request = resource;
-    					timeout = resource.timeout;
-    					shouldWrapError = true;
-    					break;
-    				default: {
-    					// 未识别宿主也可使用完整标准 Fetch API；不将能力推断为宿主类型。
-    					// An unrecognized host may still use the complete standard Fetch API; capability does not imply a host type.
-    					if (typeof globalThis.fetch !== "function" || typeof globalThis.Headers !== "function" || typeof globalThis.Request !== "function" || typeof globalThis.Response !== "function") {
-    						throw new Error(`${Function.name}: 当前运行环境不支持 Fetch API`);
-    					}
-    					const { url, bodyBytes, redirection, timeout: _timeout, policy: _policy, "auto-redirect": _autoRedirect, "auto-cookie": _autoCookie, opts: _opts, ...fetchOptions } = resource;
-    					if (bodyBytes !== undefined && fetchOptions.body === undefined) fetchOptions.body = bodyBytes;
-    					fetchOptions.redirect = redirection ? "follow" : "manual";
-    					request = { url, ...fetchOptions };
-    					timeout = resource.timeout * 1000;
-    					break;
-    				}
-    			}
-    			const { url, ...options } = request;
-    			// 发起请求并归一化响应头、文本与二进制响应体。
-    			// Send the request and normalize headers, text, and binary response data.
-    			const responsePromise = globalThis.fetch(url, options).then(async response => {
-    				const bodyBytes = await response.arrayBuffer();
-    				let headers;
-    				try {
-    					headers = response.headers.raw();
-    				} catch {
-    					headers = Array.from(response.headers.entries()).reduce((acc, [key, value]) => {
-    						acc[key] = acc[key] ? [...acc[key], value] : [value];
-    						return acc;
-    					}, {});
-    				}
-    				return {
-    					ok: response.ok ?? /^2\d\d$/.test(response.status),
-    					status: response.status,
-    					statusCode: response.status,
-    					statusText: response.statusText,
-    					body: new TextDecoder("utf-8").decode(bodyBytes),
-    					bodyBytes: bodyBytes,
-    					headers: Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, key.toLowerCase() !== "set-cookie" ? value.toString() : value])),
-    				};
-    			});
-    			return Promise.race([
-    				shouldWrapError ? responsePromise.catch(error => Promise.reject(error.message)) : responsePromise,
-    				new Promise((_resolve, reject) => {
-    					setTimeout(() => {
-    						reject(new Error(`${Function.name}: 请求超时, 请检查网络后重试`));
-    					}, timeout);
-    				}),
-    			]);
-    		}
-    	}
-    }
-
     /**
      * 跨平台持久化存储适配器。
      * Cross-platform persistent storage adapter.
@@ -1922,8 +1429,8 @@
     }
 
     /**
-     * PreferencePanes 后端 API，只转发模块配置并提供通用持久化操作。
-     * PreferencePanes backend API only relaying module configurations and providing generic persistence operations.
+     * PreferencePanes 后端 API，只提供通用持久化操作。
+     * PreferencePanes backend API providing generic persistence operations only.
      */
     class API {
         /**
@@ -1945,42 +1452,16 @@
         }
 
         /**
-         * 处理模块配置 API 与固定存储动作，不接管页面或静态资源。
-         * Handle module configuration APIs and fixed storage actions without intercepting pages or static assets.
+         * 处理固定存储动作，不接管模块配置、页面或静态资源。
+         * Handle fixed storage actions without intercepting module configurations, pages, or static assets.
          * @param {import("./index.js").SettingsRequest} request 代理请求 / Proxy request.
          * @returns {Promise<import("./index.js").SettingsResponse | undefined>} API 响应或未接管 / API response or pass-through.
          */
         async handle(request) {
             const url = new URL(request.url);
-            const action = /^\/api\/(get|set|delete)\/?$/.exec(url.pathname)?.[1];
+            const action = /^\/api\/(get|set|delete)$/.exec(url.pathname)?.[1];
             if (action) return this.#store(request, action);
-            const module = /^\/api\/([a-zA-Z0-9_-]+)\/?$/.exec(url.pathname)?.[1];
-            if (!module) return;
-            if (!["HEAD", "GET"].includes(request.method)) return this.#response(request, 405, { error: "Use GET or HEAD for module configuration" });
-            return this.#configuration(request, `${url.origin}/configs/${module}`);
-        }
-
-        /**
-         * 从同源业务配置响应模块探测或原始 BoxJS JSON。
-         * Respond to a module probe or raw BoxJS JSON from the same-origin business configuration.
-         * @param {import("./index.js").SettingsRequest} request 代理请求 / Proxy request.
-         * @param {string} configuration 同源配置地址 / Same-origin configuration URL.
-         * @returns {Promise<import("./index.js").SettingsResponse>} 配置响应 / Configuration response.
-         */
-        async #configuration(request, configuration) {
-            let result;
-            try {
-                result = await fetch({ url: configuration, method: request.method, timeout: 5000, headers: { Accept: "application/json" } });
-            } catch (error) {
-                return this.#response(request, 502, { error: error.message });
-            }
-            const version = this.#header(result.headers, "x-preferencepanes-version");
-            const contentType = this.#header(result.headers, "content-type") ?? "application/json; charset=utf-8";
-            return {
-                status: result.statusCode ?? result.status,
-                headers: { "Content-Type": contentType, "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", ...(version ? { "X-PreferencePanes-Version": version } : {}) },
-                body: request.method === "HEAD" ? "" : typeof result.body === "string" ? result.body : new TextDecoder().decode(result.body),
-            };
+            return;
         }
 
         /**
@@ -2049,11 +1530,6 @@
                 body: request.method === "HEAD" ? "" : JSON.stringify(body),
             };
         }
-
-        #header(headers, name) {
-            const entry = Object.entries(headers ?? {}).find(([key]) => key.toLowerCase() === name);
-            return entry?.[1] === undefined ? undefined : String(entry[1]).trim();
-        }
     }
 
     /**

package/dist/module/index.html

@@ -9,6 +9,6 @@
     </head>
     <body>
         <main id="preferences"></main>
-        <script type="module" src="/settings/assets/index.mjs?v=1.1.2"></script>
+        <script type="module" src="/settings/assets/index.mjs?v=1.1.3"></script>
     </body>
 </html>

package/dist/module/index.mjs

@@ -35,6 +35,7 @@ function normalizeBoxJs(config, module) {
             if (!storageKey || storageKey.startsWith("@") || parts.length < 2) throw new TypeError("A BoxJS setting must be below a literal storage root and module");
             validatePathParts(parts);
             const name = parts[0];
+            if (["get", "set", "delete"].includes(name)) throw new TypeError(`Reserved API module name: ${name}`);
             let target = modules.get(name);
             if (!target) {
                 target = { module: name, storageKey, entries: [], owners: new Set() };

package/dist/module/navigation.mjs

@@ -331,7 +331,7 @@ class ModuleStatus extends EventTarget {
             const response = await probeModule(url, { ...options, signal: controller.signal });
             if (controller !== this.#controller) return response;
             const version = response.status === 200 ? response.headers.get("X-PreferencePanes-Version")?.trim() || null : null;
-            this.#render(response.status === 200 ? "installed" : "missing", version);
+            this.#render(version ? "installed" : "missing", version);
             return response;
         } catch (error) {
             if (controller !== this.#controller) return;

package/dist/preference-panes.mjs

@@ -35,6 +35,7 @@ function normalizeBoxJs(config, module) {
             if (!storageKey || storageKey.startsWith("@") || parts.length < 2) throw new TypeError("A BoxJS setting must be below a literal storage root and module");
             validatePathParts(parts);
             const name = parts[0];
+            if (["get", "set", "delete"].includes(name)) throw new TypeError(`Reserved API module name: ${name}`);
             let target = modules.get(name);
             if (!target) {
                 target = { module: name, storageKey, entries: [], owners: new Set() };