@rsdoctor/sdk 1.5.14 → 1.5.16

package/dist/index.cjs

@@ -5695,6 +5695,19 @@ var __webpack_modules__ = {
                 return this.dataLoader.loadAPI;
             }
         }
+        let external_node_net_namespaceObject = require("node:net"), DEFAULT_ALLOWED_CORS_ORIGINS = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/, LOCAL_HOSTNAMES = /^(?:localhost|[^:]+\.localhost)$/;
+        function getHostnameFromHost(host) {
+            if (host.startsWith('[')) {
+                let endIndex = host.indexOf(']');
+                return -1 === endIndex ? '' : host.slice(1, endIndex);
+            }
+            return host.split(':')[0];
+        }
+        function isAllowedRequestHost(host) {
+            if ('string' != typeof host) return !1;
+            let hostname = getHostnameFromHost(host).toLowerCase();
+            return LOCAL_HOSTNAMES.test(hostname) || 0 !== (0, external_node_net_namespaceObject.isIP)(hostname);
+        }
         class Socket {
             constructor(options){
                 this.options = options, this.map = new Map(), this.loader = new SocketAPILoader({
@@ -5702,11 +5715,13 @@ var __webpack_modules__ = {
                 });
             }
             bootstrap() {
+                let { socketOptions } = this.options;
                 this.io = new external_socket_io_namespaceObject.Server(this.options.server, {
-                    cors: {
-                        origin: '*'
-                    },
-                    ...this.options.socketOptions
+                    ...socketOptions,
+                    allowRequest: (req, callback)=>{
+                        var url, token;
+                        isAllowedRequestHost(req.headers.host || req.headers[':authority']) && (url = req.url, token = this.options.token, url && new URL(url, 'http://localhost').searchParams.get('token') === token) ? socketOptions?.allowRequest ? socketOptions.allowRequest(req, callback) : callback(null, !0) : callback(null, !1);
+                    }
                 }), this.io.on('connection', (socket)=>{
                     this.setupSocket(socket);
                 });
@@ -6131,10 +6146,6 @@ var __webpack_modules__ = {
             plugin_ts_metadata("design:returntype", Promise)
         ], PluginAPI.prototype, "getPluginData", null);
         var external_os_ = __webpack_require__("os"), external_os_default = __webpack_require__.n(external_os_);
-        function getLocalIpAddress() {
-            for (let iface of Object.values(external_os_default().networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
-            return '127.0.0.1';
-        }
         function project_ts_decorate(decorators, target, key, desc) {
             var d, c = arguments.length, r = c < 3 ? target : null === desc ? desc = Object.getOwnPropertyDescriptor(target, key) : desc;
             if ("object" == typeof Reflect && "function" == typeof Reflect.decorate) r = Reflect.decorate(decorators, target, key, desc);
@@ -6148,7 +6159,10 @@ var __webpack_modules__ = {
             async env() {
                 let { server } = this.ctx;
                 return {
-                    ip: getLocalIpAddress(),
+                    ip: function() {
+                        for (let iface of Object.values(external_os_default().networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
+                        return '127.0.0.1';
+                    }(),
                     port: server.port
                 };
             }
@@ -6273,10 +6287,10 @@ var __webpack_modules__ = {
                 return logger_namespaceObject.logger.error('Failed to open Rsdoctor URL.'), logger_namespaceObject.logger.error(err), !1;
             }
         }
-        let server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__);
+        let external_crypto_namespaceObject = require("crypto"), server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__);
         class RsdoctorServer {
             constructor(sdk, port = build_namespaceObject.Server.defaultPort, config){
-                this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
+                this.sdk = sdk, this.disposed = !0, this._socketToken = (0, external_crypto_namespaceObject.randomBytes)(16).toString('hex'), this.get = (route, cb)=>{
                     let { app } = this;
                     return app.use(route, this.wrapNextHandleFunction('GET', cb)), app;
                 }, this.post = (route, cb)=>{
@@ -6292,13 +6306,13 @@ var __webpack_modules__ = {
                     sdk,
                     server: this,
                     apis: Object.values(apis_namespaceObject)
-                }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!common_namespaceObject.Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl;
+                }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!common_namespaceObject.Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl, this._cors = config?.cors;
             }
             get app() {
                 return this._server.app;
             }
             get host() {
-                return getLocalIpAddress();
+                return build_namespaceObject.Server.defaultHost;
             }
             get origin() {
                 return `http://${this.host}:${this.port}`;
@@ -6306,22 +6320,76 @@ var __webpack_modules__ = {
             get socketUrl() {
                 return {
                     port: this.port,
-                    socketUrl: `ws://localhost:${this.port}`
+                    socketUrl: `ws://localhost:${this.port}?token=${this._socketToken}`,
+                    token: this._socketToken
                 };
             }
             get innerClientPath() {
                 return this._innerClientPath;
             }
+            async createInnerServer() {
+                let lastError, expectedPort = this.port;
+                for(let retry = 0; retry < 10; retry++){
+                    let port = build_namespaceObject.Server.getPortSync(expectedPort, this.host);
+                    try {
+                        return {
+                            port,
+                            server: await build_namespaceObject.Server.createServer(port, this.host)
+                        };
+                    } catch (error) {
+                        if ('EADDRINUSE' !== error.code) throw error;
+                        lastError = error, expectedPort = port + 1;
+                    }
+                }
+                throw lastError;
+            }
+            resolveCorsOptions() {
+                return !1 !== this._cors && (!0 === this._cors ? {} : void 0 === this._cors ? {
+                    origin: DEFAULT_ALLOWED_CORS_ORIGINS
+                } : {
+                    ...this._cors,
+                    origin: void 0 === this._cors.origin ? DEFAULT_ALLOWED_CORS_ORIGINS : this._cors.origin
+                });
+            }
             async bootstrap() {
                 if (!this.disposed) return;
-                let port = build_namespaceObject.Server.getPortSync(this.port);
-                this.port = port, this._server = await build_namespaceObject.Server.createServer(port), this._socket = new Socket({
+                let { port, server } = await this.createInnerServer(), corsOptions = this.resolveCorsOptions();
+                this.port = port, this._server = server, this._socket = new Socket({
                     sdk: this.sdk,
                     server: this._server.server,
-                    port: this.port
-                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(cors_index_js_default()()), this.app.use(body_parser_default().json({
+                    port: this.port,
+                    token: this._socketToken,
+                    socketOptions: !1 === corsOptions ? void 0 : {
+                        cors: corsOptions
+                    }
+                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use((req, res, next)=>{
+                    if (!isAllowedRequestHost(req.headers.host || req.headers[':authority'])) {
+                        res.statusCode = 403, res.end();
+                        return;
+                    }
+                    next();
+                }), !1 !== corsOptions && corsOptions.origin === DEFAULT_ALLOWED_CORS_ORIGINS && this.app.use((req, res, next)=>{
+                    let host = req.headers.host || req.headers[':authority'];
+                    if (!function(origin, host) {
+                        if (void 0 === origin) return !0;
+                        if ('string' != typeof origin || 'string' != typeof host || !(void 0 === origin || 'string' == typeof origin && DEFAULT_ALLOWED_CORS_ORIGINS.test(origin))) return !1;
+                        let originHostname = function(origin) {
+                            try {
+                                let hostname = new URL(origin).hostname.toLowerCase();
+                                return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+                            } catch  {
+                                return '';
+                            }
+                        }(origin), hostHostname = getHostnameFromHost(host).toLowerCase();
+                        return !originHostname.endsWith('.localhost') || originHostname === hostHostname;
+                    }(req.headers.origin, host)) {
+                        res.statusCode = 403, res.end();
+                        return;
+                    }
+                    next();
+                }), !1 !== corsOptions && this.app.use(cors_index_js_default()(corsOptions)), this.app.use(body_parser_default().json({
                     limit: '500mb'
-                }));
+                })), await this._router.setup();
                 let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = external_path_default().resolve(clientHtmlPath, '..');
                 this.app.use(function(dir, opts = {}) {
                     dir = (0, external_node_path_.resolve)(dir || '.');
@@ -6414,7 +6482,7 @@ var __webpack_modules__ = {
                     } catch (err) {
                         res.writableEnded || (res.statusCode = 500, res.end(err.message));
                     }
-                }), await this._router.setup(), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
+                }), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
                     console.error('Unhandled promise rejection:', reason), this.dispose(1);
                 }), process.once('uncaughtException', (err, origin)=>{
                     console.error('Uncaught exception:', err), origin && console.error('Exception origin:', origin), this.dispose(1);
@@ -6425,7 +6493,7 @@ var __webpack_modules__ = {
                     if (req.method?.toUpperCase() === method) {
                         try {
                             let body = await cb(req, res, next);
-                            if (res.setHeader('Access-Control-Allow-Origin', '*'), res.setHeader('Access-Control-Allow-Credentials', 'true'), res.statusCode = 200, Buffer.isBuffer(body)) {
+                            if (res.statusCode = 200, Buffer.isBuffer(body)) {
                                 res.setHeader('Content-Length', body.byteLength);
                                 let ps = new external_stream_.PassThrough();
                                 ps.write(body), ps.end(), ps.pipe(res);
@@ -6622,9 +6690,12 @@ var __webpack_modules__ = {
             constructor(options){
                 super(options), this._summary = {
                     costs: []
-                }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new graph_namespaceObject.ModuleGraph(), this._chunkGraph = new graph_namespaceObject.ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map(), this.server = options.config?.noServer ? new RsdoctorFakeServer(this, void 0) : new RsdoctorServer(this, options.port, {
+                }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new graph_namespaceObject.ModuleGraph(), this._chunkGraph = new graph_namespaceObject.ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map();
+                const serverConfig = options.config?.server, port = serverConfig?.port ?? options.port;
+                this.server = options.config?.noServer ? new RsdoctorFakeServer(this, port) : new RsdoctorServer(this, port, {
                     innerClientPath: options.config?.innerClientPath || '',
-                    printServerUrl: options.config?.printLog?.serverUrls
+                    printServerUrl: options.config?.printLog?.serverUrls,
+                    cors: serverConfig?.cors
                 }), this.type = common_namespaceObject.Lodash.isNumber(options.type) ? options.type : types_namespaceObject.SDK.ToDataType.Normal, this.extraConfig = options.config, this.root = findRoot() ?? '';
             }
             async bootstrap() {
@@ -6920,8 +6991,8 @@ var __webpack_modules__ = {
             }
         }
         class RsdoctorSlaveServer extends RsdoctorServer {
-            constructor(sdk, port = build_namespaceObject.Server.defaultPort){
-                super(sdk, port), this.sdk = sdk;
+            constructor(sdk, port = build_namespaceObject.Server.defaultPort, config){
+                super(sdk, port, config), this.sdk = sdk;
             }
             async openClientPage(...args) {
                 return this.sdk.isMaster ? super.openClientPage(...args) : Promise.resolve();
@@ -6932,10 +7003,13 @@ var __webpack_modules__ = {
             constructor({ name, stage, controller, extraConfig, type }){
                 super({
                     name,
-                    root: controller.root
+                    root: controller.root,
+                    config: extraConfig
                 });
-                const lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : this.server.port;
-                this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port), this.type = type, this.setName(name), this.clearSwitch();
+                const lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : extraConfig?.server?.port ?? this.server.port;
+                this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port, {
+                    cors: extraConfig?.server?.cors
+                }), this.type = type, this.setName(name), this.clearSwitch();
             }
             clearSwitch() {
                 this.uploadPieces = new Promise((resolve)=>{

package/dist/index.js

@@ -18,9 +18,11 @@ import cors from "../compiled/cors/index.js";
 import { PassThrough } from "stream";
 import { Server as external_socket_io_Server } from "socket.io";
 import { isDeepStrictEqual } from "util";
+import { isIP } from "node:net";
 import os from "os";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
+import { randomBytes } from "crypto";
 import { createHash, randomUUID } from "node:crypto";
 import node_process from "node:process";
 import { AsyncSeriesHook } from "tapable";
@@ -5714,6 +5716,19 @@ class SocketAPILoader {
         return this.dataLoader.loadAPI;
     }
 }
+let DEFAULT_ALLOWED_CORS_ORIGINS = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/, LOCAL_HOSTNAMES = /^(?:localhost|[^:]+\.localhost)$/;
+function getHostnameFromHost(host) {
+    if (host.startsWith('[')) {
+        let endIndex = host.indexOf(']');
+        return -1 === endIndex ? '' : host.slice(1, endIndex);
+    }
+    return host.split(':')[0];
+}
+function isAllowedRequestHost(host) {
+    if ('string' != typeof host) return !1;
+    let hostname = getHostnameFromHost(host).toLowerCase();
+    return LOCAL_HOSTNAMES.test(hostname) || 0 !== isIP(hostname);
+}
 class Socket {
     constructor(options){
         this.options = options, this.map = new Map(), this.loader = new SocketAPILoader({
@@ -5721,11 +5736,13 @@ class Socket {
         });
     }
     bootstrap() {
+        let { socketOptions } = this.options;
         this.io = new external_socket_io_Server(this.options.server, {
-            cors: {
-                origin: '*'
-            },
-            ...this.options.socketOptions
+            ...socketOptions,
+            allowRequest: (req, callback)=>{
+                var url, token;
+                isAllowedRequestHost(req.headers.host || req.headers[':authority']) && (url = req.url, token = this.options.token, url && new URL(url, 'http://localhost').searchParams.get('token') === token) ? socketOptions?.allowRequest ? socketOptions.allowRequest(req, callback) : callback(null, !0) : callback(null, !1);
+            }
         }), this.io.on('connection', (socket)=>{
             this.setupSocket(socket);
         });
@@ -6138,10 +6155,6 @@ class PluginAPI extends BaseAPI {
         });
     }
 }
-function getLocalIpAddress() {
-    for (let iface of Object.values(os.networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
-    return '127.0.0.1';
-}
 function project_ts_decorate(decorators, target, key, desc) {
     var d, c = arguments.length, r = c < 3 ? target : null === desc ? desc = Object.getOwnPropertyDescriptor(target, key) : desc;
     if ("object" == typeof Reflect && "function" == typeof Reflect.decorate) r = Reflect.decorate(decorators, target, key, desc);
@@ -6166,7 +6179,10 @@ class ProjectAPI extends BaseAPI {
     async env() {
         let { server } = this.ctx;
         return {
-            ip: getLocalIpAddress(),
+            ip: function() {
+                for (let iface of Object.values(os.networkInterfaces()))for (let alias of iface)if ('IPv4' === alias.family && !alias.internal) return alias.address;
+                return '127.0.0.1';
+            }(),
             port: server.port
         };
     }
@@ -6296,7 +6312,7 @@ var body_parser_default = __webpack_require__.n(body_parser);
 let server_require = createRequire(import.meta.url);
 class RsdoctorServer {
     constructor(sdk, port = Server.defaultPort, config){
-        this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
+        this.sdk = sdk, this.disposed = !0, this._socketToken = randomBytes(16).toString('hex'), this.get = (route, cb)=>{
             let { app } = this;
             return app.use(route, this.wrapNextHandleFunction('GET', cb)), app;
         }, this.post = (route, cb)=>{
@@ -6312,13 +6328,13 @@ class RsdoctorServer {
             sdk,
             server: this,
             apis: Object.values(apis_namespaceObject)
-        }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl;
+        }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl, this._cors = config?.cors;
     }
     get app() {
         return this._server.app;
     }
     get host() {
-        return getLocalIpAddress();
+        return Server.defaultHost;
     }
     get origin() {
         return `http://${this.host}:${this.port}`;
@@ -6326,22 +6342,76 @@ class RsdoctorServer {
     get socketUrl() {
         return {
             port: this.port,
-            socketUrl: `ws://localhost:${this.port}`
+            socketUrl: `ws://localhost:${this.port}?token=${this._socketToken}`,
+            token: this._socketToken
         };
     }
     get innerClientPath() {
         return this._innerClientPath;
     }
+    async createInnerServer() {
+        let lastError, expectedPort = this.port;
+        for(let retry = 0; retry < 10; retry++){
+            let port = Server.getPortSync(expectedPort, this.host);
+            try {
+                return {
+                    port,
+                    server: await Server.createServer(port, this.host)
+                };
+            } catch (error) {
+                if ('EADDRINUSE' !== error.code) throw error;
+                lastError = error, expectedPort = port + 1;
+            }
+        }
+        throw lastError;
+    }
+    resolveCorsOptions() {
+        return !1 !== this._cors && (!0 === this._cors ? {} : void 0 === this._cors ? {
+            origin: DEFAULT_ALLOWED_CORS_ORIGINS
+        } : {
+            ...this._cors,
+            origin: void 0 === this._cors.origin ? DEFAULT_ALLOWED_CORS_ORIGINS : this._cors.origin
+        });
+    }
     async bootstrap() {
         if (!this.disposed) return;
-        let port = Server.getPortSync(this.port);
-        this.port = port, this._server = await Server.createServer(port), this._socket = new Socket({
+        let { port, server } = await this.createInnerServer(), corsOptions = this.resolveCorsOptions();
+        this.port = port, this._server = server, this._socket = new Socket({
             sdk: this.sdk,
             server: this._server.server,
-            port: this.port
-        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(cors()), this.app.use(body_parser_default().json({
+            port: this.port,
+            token: this._socketToken,
+            socketOptions: !1 === corsOptions ? void 0 : {
+                cors: corsOptions
+            }
+        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use((req, res, next)=>{
+            if (!isAllowedRequestHost(req.headers.host || req.headers[':authority'])) {
+                res.statusCode = 403, res.end();
+                return;
+            }
+            next();
+        }), !1 !== corsOptions && corsOptions.origin === DEFAULT_ALLOWED_CORS_ORIGINS && this.app.use((req, res, next)=>{
+            let host = req.headers.host || req.headers[':authority'];
+            if (!function(origin, host) {
+                if (void 0 === origin) return !0;
+                if ('string' != typeof origin || 'string' != typeof host || !(void 0 === origin || 'string' == typeof origin && DEFAULT_ALLOWED_CORS_ORIGINS.test(origin))) return !1;
+                let originHostname = function(origin) {
+                    try {
+                        let hostname = new URL(origin).hostname.toLowerCase();
+                        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+                    } catch  {
+                        return '';
+                    }
+                }(origin), hostHostname = getHostnameFromHost(host).toLowerCase();
+                return !originHostname.endsWith('.localhost') || originHostname === hostHostname;
+            }(req.headers.origin, host)) {
+                res.statusCode = 403, res.end();
+                return;
+            }
+            next();
+        }), !1 !== corsOptions && this.app.use(cors(corsOptions)), this.app.use(body_parser_default().json({
             limit: '500mb'
-        }));
+        })), await this._router.setup();
         let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = path_0.resolve(clientHtmlPath, '..');
         this.app.use(function(dir, opts = {}) {
             dir = external_node_path_resolve(dir || '.');
@@ -6433,7 +6503,7 @@ class RsdoctorServer {
             } catch (err) {
                 res.writableEnded || (res.statusCode = 500, res.end(err.message));
             }
-        }), await this._router.setup(), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
+        }), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
             console.error('Unhandled promise rejection:', reason), this.dispose(1);
         }), process.once('uncaughtException', (err, origin)=>{
             console.error('Uncaught exception:', err), origin && console.error('Exception origin:', origin), this.dispose(1);
@@ -6444,7 +6514,7 @@ class RsdoctorServer {
             if (req.method?.toUpperCase() === method) {
                 try {
                     let body = await cb(req, res, next);
-                    if (res.setHeader('Access-Control-Allow-Origin', '*'), res.setHeader('Access-Control-Allow-Credentials', 'true'), res.statusCode = 200, Buffer.isBuffer(body)) {
+                    if (res.statusCode = 200, Buffer.isBuffer(body)) {
                         res.setHeader('Content-Length', body.byteLength);
                         let ps = new PassThrough();
                         ps.write(body), ps.end(), ps.pipe(res);
@@ -6638,9 +6708,12 @@ class RsdoctorSDK extends SDKCore {
     constructor(options){
         super(options), this._summary = {
             costs: []
-        }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new ModuleGraph(), this._chunkGraph = new ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map(), this.server = options.config?.noServer ? new RsdoctorFakeServer(this, void 0) : new RsdoctorServer(this, options.port, {
+        }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new ModuleGraph(), this._chunkGraph = new ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map();
+        let serverConfig = options.config?.server, port = serverConfig?.port ?? options.port;
+        this.server = options.config?.noServer ? new RsdoctorFakeServer(this, port) : new RsdoctorServer(this, port, {
             innerClientPath: options.config?.innerClientPath || '',
-            printServerUrl: options.config?.printLog?.serverUrls
+            printServerUrl: options.config?.printLog?.serverUrls,
+            cors: serverConfig?.cors
         }), this.type = Lodash.isNumber(options.type) ? options.type : SDK.ToDataType.Normal, this.extraConfig = options.config, this.root = findRoot() ?? '';
     }
     async bootstrap() {
@@ -6936,8 +7009,8 @@ class RsdoctorSDK extends SDKCore {
     }
 }
 class RsdoctorSlaveServer extends RsdoctorServer {
-    constructor(sdk, port = Server.defaultPort){
-        super(sdk, port), this.sdk = sdk;
+    constructor(sdk, port = Server.defaultPort, config){
+        super(sdk, port, config), this.sdk = sdk;
     }
     async openClientPage(...args) {
         return this.sdk.isMaster ? super.openClientPage(...args) : Promise.resolve();
@@ -6948,10 +7021,13 @@ class RsdoctorPrimarySDK extends RsdoctorSDK {
     constructor({ name, stage, controller, extraConfig, type }){
         super({
             name,
-            root: controller.root
+            root: controller.root,
+            config: extraConfig
         });
-        let lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : this.server.port;
-        this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port), this.type = type, this.setName(name), this.clearSwitch();
+        let lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : extraConfig?.server?.port ?? this.server.port;
+        this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port, {
+            cors: extraConfig?.server?.cors
+        }), this.type = type, this.setName(name), this.clearSwitch();
     }
     clearSwitch() {
         this.uploadPieces = new Promise((resolve)=>{

package/dist/sdk/multiple/server.d.cts

@@ -1,7 +1,7 @@
-import { RsdoctorServer } from '../server';
+import { RsdoctorServer, type RsdoctorServerOptions } from '../server';
 import type { RsdoctorPrimarySDK } from './primary';
 export declare class RsdoctorSlaveServer extends RsdoctorServer {
     protected sdk: RsdoctorPrimarySDK;
-    constructor(sdk: RsdoctorPrimarySDK, port?: number);
+    constructor(sdk: RsdoctorPrimarySDK, port?: number, config?: RsdoctorServerOptions);
     openClientPage(...args: unknown[]): Promise<void>;
 }

package/dist/sdk/multiple/server.d.ts

@@ -1,7 +1,7 @@
-import { RsdoctorServer } from '../server/index.js';
+import { RsdoctorServer, type RsdoctorServerOptions } from '../server/index.js';
 import type { RsdoctorPrimarySDK } from './primary.js';
 export declare class RsdoctorSlaveServer extends RsdoctorServer {
     protected sdk: RsdoctorPrimarySDK;
-    constructor(sdk: RsdoctorPrimarySDK, port?: number);
+    constructor(sdk: RsdoctorPrimarySDK, port?: number, config?: RsdoctorServerOptions);
     openClientPage(...args: unknown[]): Promise<void>;
 }

package/dist/sdk/server/index.d.cts

@@ -3,6 +3,12 @@ export * from './utils';
 export type ISocketType = {
     port: number;
     socketUrl: string;
+    token: string;
+};
+export type RsdoctorServerOptions = {
+    innerClientPath?: string;
+    printServerUrl?: boolean;
+    cors?: SDK.RsdoctorServerConfig['cors'];
 };
 export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     protected sdk: SDK.RsdoctorBuilderSDKInstance;
@@ -13,15 +19,16 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     private _router;
     private _innerClientPath;
     private _printServerUrl;
-    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: {
-        innerClientPath?: string;
-        printServerUrl?: boolean;
-    });
+    private _cors;
+    private _socketToken;
+    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: RsdoctorServerOptions);
     get app(): SDK.RsdoctorServerInstance['app'];
     get host(): string;
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
+    private createInnerServer;
+    private resolveCorsOptions;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/dist/sdk/server/index.d.ts

@@ -3,6 +3,12 @@ export * from './utils.js';
 export type ISocketType = {
     port: number;
     socketUrl: string;
+    token: string;
+};
+export type RsdoctorServerOptions = {
+    innerClientPath?: string;
+    printServerUrl?: boolean;
+    cors?: SDK.RsdoctorServerConfig['cors'];
 };
 export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     protected sdk: SDK.RsdoctorBuilderSDKInstance;
@@ -13,15 +19,16 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     private _router;
     private _innerClientPath;
     private _printServerUrl;
-    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: {
-        innerClientPath?: string;
-        printServerUrl?: boolean;
-    });
+    private _cors;
+    private _socketToken;
+    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: RsdoctorServerOptions);
     get app(): SDK.RsdoctorServerInstance['app'];
     get host(): string;
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
+    private createInnerServer;
+    private resolveCorsOptions;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/dist/sdk/server/security.d.cts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_ALLOWED_CORS_ORIGINS: RegExp;
+export declare function isAllowedRequestOrigin(origin: string | string[] | undefined): boolean;
+export declare function isAllowedRequestHost(host: string | string[] | undefined): boolean;
+export declare function isAllowedCorsRequest(origin: string | string[] | undefined, host: string | string[] | undefined): boolean;

package/dist/sdk/server/security.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_ALLOWED_CORS_ORIGINS: RegExp;
+export declare function isAllowedRequestOrigin(origin: string | string[] | undefined): boolean;
+export declare function isAllowedRequestHost(host: string | string[] | undefined): boolean;
+export declare function isAllowedCorsRequest(origin: string | string[] | undefined, host: string | string[] | undefined): boolean;

package/dist/sdk/server/socket/index.d.cts

@@ -6,7 +6,8 @@ interface SocketOptions {
     sdk: SDK.RsdoctorBuilderSDKInstance;
     server: Server;
     port: number;
-    socketOptions?: SocketServerOptions;
+    token: string;
+    socketOptions?: Partial<SocketServerOptions>;
 }
 export declare class Socket {
     protected options: SocketOptions;

package/dist/sdk/server/socket/index.d.ts

@@ -6,7 +6,8 @@ interface SocketOptions {
     sdk: SDK.RsdoctorBuilderSDKInstance;
     server: Server;
     port: number;
-    socketOptions?: SocketServerOptions;
+    token: string;
+    socketOptions?: Partial<SocketServerOptions>;
 }
 export declare class Socket {
     protected options: SocketOptions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsdoctor/sdk",
-  "version": "1.5.14",
+  "version": "1.5.16",
   "repository": {
     "type": "git",
     "url": "https://github.com/web-infra-dev/rsdoctor",
@@ -32,10 +32,10 @@
     "safer-buffer": "2.1.2",
     "socket.io": "4.8.1",
     "tapable": "2.3.3",
-    "@rsdoctor/client": "1.5.14",
-    "@rsdoctor/graph": "1.5.14",
-    "@rsdoctor/types": "1.5.14",
-    "@rsdoctor/utils": "1.5.14"
+    "@rsdoctor/graph": "1.5.16",
+    "@rsdoctor/types": "1.5.16",
+    "@rsdoctor/client": "1.5.16",
+    "@rsdoctor/utils": "1.5.16"
   },
   "devDependencies": {
     "@types/body-parser": "1.19.6",