@rsdoctor/sdk 1.5.15 → 1.5.16

package/dist/index.cjs

@@ -5675,7 +5675,9 @@ var __webpack_modules__ = {
             return enc && (headers['Content-Encoding'] = enc), isEtag && (headers.ETag = `W/"${stats.size}-${stats.mtime.getTime()}"`), headers;
         }
         let common_namespaceObject = require("@rsdoctor/utils/common"), external_assert_namespaceObject = require("assert");
-        var external_assert_default = __webpack_require__.n(external_assert_namespaceObject), body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js"), body_parser_default = __webpack_require__.n(body_parser), external_stream_ = __webpack_require__("stream");
+        var external_assert_default = __webpack_require__.n(external_assert_namespaceObject), body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js"), body_parser_default = __webpack_require__.n(body_parser);
+        let cors_index_js_namespaceObject = require("../compiled/cors/index.js");
+        var cors_index_js_default = __webpack_require__.n(cors_index_js_namespaceObject), external_stream_ = __webpack_require__("stream");
         let external_socket_io_namespaceObject = require("socket.io");
         var external_util_ = __webpack_require__("util");
         class SocketAPILoader {
@@ -5693,6 +5695,19 @@ var __webpack_modules__ = {
                 return this.dataLoader.loadAPI;
             }
         }
+        let external_node_net_namespaceObject = require("node:net"), DEFAULT_ALLOWED_CORS_ORIGINS = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/, LOCAL_HOSTNAMES = /^(?:localhost|[^:]+\.localhost)$/;
+        function getHostnameFromHost(host) {
+            if (host.startsWith('[')) {
+                let endIndex = host.indexOf(']');
+                return -1 === endIndex ? '' : host.slice(1, endIndex);
+            }
+            return host.split(':')[0];
+        }
+        function isAllowedRequestHost(host) {
+            if ('string' != typeof host) return !1;
+            let hostname = getHostnameFromHost(host).toLowerCase();
+            return LOCAL_HOSTNAMES.test(hostname) || 0 !== (0, external_node_net_namespaceObject.isIP)(hostname);
+        }
         class Socket {
             constructor(options){
                 this.options = options, this.map = new Map(), this.loader = new SocketAPILoader({
@@ -5700,11 +5715,13 @@ var __webpack_modules__ = {
                 });
             }
             bootstrap() {
+                let { socketOptions } = this.options;
                 this.io = new external_socket_io_namespaceObject.Server(this.options.server, {
-                    cors: {
-                        origin: '*'
-                    },
-                    ...this.options.socketOptions
+                    ...socketOptions,
+                    allowRequest: (req, callback)=>{
+                        var url, token;
+                        isAllowedRequestHost(req.headers.host || req.headers[':authority']) && (url = req.url, token = this.options.token, url && new URL(url, 'http://localhost').searchParams.get('token') === token) ? socketOptions?.allowRequest ? socketOptions.allowRequest(req, callback) : callback(null, !0) : callback(null, !1);
+                    }
                 }), this.io.on('connection', (socket)=>{
                     this.setupSocket(socket);
                 });
@@ -6270,15 +6287,10 @@ var __webpack_modules__ = {
                 return logger_namespaceObject.logger.error('Failed to open Rsdoctor URL.'), logger_namespaceObject.logger.error(err), !1;
             }
         }
-        let server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__), LOCAL_HOSTNAMES = new Set([
-            'localhost',
-            '127.0.0.1',
-            '[::1]',
-            '::1'
-        ]);
+        let external_crypto_namespaceObject = require("crypto"), server_require = (0, external_module_namespaceObject.createRequire)(__rslib_import_meta_url__);
         class RsdoctorServer {
             constructor(sdk, port = build_namespaceObject.Server.defaultPort, config){
-                this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
+                this.sdk = sdk, this.disposed = !0, this._socketToken = (0, external_crypto_namespaceObject.randomBytes)(16).toString('hex'), this.get = (route, cb)=>{
                     let { app } = this;
                     return app.use(route, this.wrapNextHandleFunction('GET', cb)), app;
                 }, this.post = (route, cb)=>{
@@ -6294,7 +6306,7 @@ var __webpack_modules__ = {
                     sdk,
                     server: this,
                     apis: Object.values(apis_namespaceObject)
-                }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!common_namespaceObject.Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl;
+                }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!common_namespaceObject.Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl, this._cors = config?.cors;
             }
             get app() {
                 return this._server.app;
@@ -6308,34 +6320,13 @@ var __webpack_modules__ = {
             get socketUrl() {
                 return {
                     port: this.port,
-                    socketUrl: `ws://localhost:${this.port}`
+                    socketUrl: `ws://localhost:${this.port}?token=${this._socketToken}`,
+                    token: this._socketToken
                 };
             }
             get innerClientPath() {
                 return this._innerClientPath;
             }
-            isLocalOrigin(origin) {
-                try {
-                    let url = new URL(origin);
-                    return ('http:' === url.protocol || 'https:' === url.protocol) && LOCAL_HOSTNAMES.has(url.hostname);
-                } catch  {
-                    return !1;
-                }
-            }
-            setCorsHeaders(req, res) {
-                let origin = req.headers.origin;
-                return 'string' == typeof origin && !!this.isLocalOrigin(origin) && (res.setHeader('Access-Control-Allow-Origin', origin), res.setHeader('Vary', 'Origin'), res.setHeader('Access-Control-Allow-Headers', 'Content-Type'), res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'), !0);
-            }
-            createSecurityMiddleware() {
-                return (req, res, next)=>{
-                    let isCorsAllowed = this.setCorsHeaders(req, res);
-                    if (req.method?.toUpperCase() === 'OPTIONS') {
-                        res.statusCode = isCorsAllowed ? 204 : 403, res.end();
-                        return;
-                    }
-                    next();
-                };
-            }
             async createInnerServer() {
                 let lastError, expectedPort = this.port;
                 for(let retry = 0; retry < 10; retry++){
@@ -6352,16 +6343,53 @@ var __webpack_modules__ = {
                 }
                 throw lastError;
             }
+            resolveCorsOptions() {
+                return !1 !== this._cors && (!0 === this._cors ? {} : void 0 === this._cors ? {
+                    origin: DEFAULT_ALLOWED_CORS_ORIGINS
+                } : {
+                    ...this._cors,
+                    origin: void 0 === this._cors.origin ? DEFAULT_ALLOWED_CORS_ORIGINS : this._cors.origin
+                });
+            }
             async bootstrap() {
                 if (!this.disposed) return;
-                let { port, server } = await this.createInnerServer();
+                let { port, server } = await this.createInnerServer(), corsOptions = this.resolveCorsOptions();
                 this.port = port, this._server = server, this._socket = new Socket({
                     sdk: this.sdk,
                     server: this._server.server,
-                    port: this.port
-                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(this.createSecurityMiddleware()), this.app.use(body_parser_default().json({
+                    port: this.port,
+                    token: this._socketToken,
+                    socketOptions: !1 === corsOptions ? void 0 : {
+                        cors: corsOptions
+                    }
+                }), await this._socket.bootstrap(), common_namespaceObject.GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger_namespaceObject.logger.debug(`Successfully wrote mcp.json for ${logger_namespaceObject.chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use((req, res, next)=>{
+                    if (!isAllowedRequestHost(req.headers.host || req.headers[':authority'])) {
+                        res.statusCode = 403, res.end();
+                        return;
+                    }
+                    next();
+                }), !1 !== corsOptions && corsOptions.origin === DEFAULT_ALLOWED_CORS_ORIGINS && this.app.use((req, res, next)=>{
+                    let host = req.headers.host || req.headers[':authority'];
+                    if (!function(origin, host) {
+                        if (void 0 === origin) return !0;
+                        if ('string' != typeof origin || 'string' != typeof host || !(void 0 === origin || 'string' == typeof origin && DEFAULT_ALLOWED_CORS_ORIGINS.test(origin))) return !1;
+                        let originHostname = function(origin) {
+                            try {
+                                let hostname = new URL(origin).hostname.toLowerCase();
+                                return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+                            } catch  {
+                                return '';
+                            }
+                        }(origin), hostHostname = getHostnameFromHost(host).toLowerCase();
+                        return !originHostname.endsWith('.localhost') || originHostname === hostHostname;
+                    }(req.headers.origin, host)) {
+                        res.statusCode = 403, res.end();
+                        return;
+                    }
+                    next();
+                }), !1 !== corsOptions && this.app.use(cors_index_js_default()(corsOptions)), this.app.use(body_parser_default().json({
                     limit: '500mb'
-                }));
+                })), await this._router.setup();
                 let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = external_path_default().resolve(clientHtmlPath, '..');
                 this.app.use(function(dir, opts = {}) {
                     dir = (0, external_node_path_.resolve)(dir || '.');
@@ -6454,7 +6482,7 @@ var __webpack_modules__ = {
                     } catch (err) {
                         res.writableEnded || (res.statusCode = 500, res.end(err.message));
                     }
-                }), await this._router.setup(), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
+                }), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
                     console.error('Unhandled promise rejection:', reason), this.dispose(1);
                 }), process.once('uncaughtException', (err, origin)=>{
                     console.error('Uncaught exception:', err), origin && console.error('Exception origin:', origin), this.dispose(1);
@@ -6662,9 +6690,12 @@ var __webpack_modules__ = {
             constructor(options){
                 super(options), this._summary = {
                     costs: []
-                }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new graph_namespaceObject.ModuleGraph(), this._chunkGraph = new graph_namespaceObject.ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map(), this.server = options.config?.noServer ? new RsdoctorFakeServer(this, void 0) : new RsdoctorServer(this, options.port, {
+                }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new graph_namespaceObject.ModuleGraph(), this._chunkGraph = new graph_namespaceObject.ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map();
+                const serverConfig = options.config?.server, port = serverConfig?.port ?? options.port;
+                this.server = options.config?.noServer ? new RsdoctorFakeServer(this, port) : new RsdoctorServer(this, port, {
                     innerClientPath: options.config?.innerClientPath || '',
-                    printServerUrl: options.config?.printLog?.serverUrls
+                    printServerUrl: options.config?.printLog?.serverUrls,
+                    cors: serverConfig?.cors
                 }), this.type = common_namespaceObject.Lodash.isNumber(options.type) ? options.type : types_namespaceObject.SDK.ToDataType.Normal, this.extraConfig = options.config, this.root = findRoot() ?? '';
             }
             async bootstrap() {
@@ -6960,8 +6991,8 @@ var __webpack_modules__ = {
             }
         }
         class RsdoctorSlaveServer extends RsdoctorServer {
-            constructor(sdk, port = build_namespaceObject.Server.defaultPort){
-                super(sdk, port), this.sdk = sdk;
+            constructor(sdk, port = build_namespaceObject.Server.defaultPort, config){
+                super(sdk, port, config), this.sdk = sdk;
             }
             async openClientPage(...args) {
                 return this.sdk.isMaster ? super.openClientPage(...args) : Promise.resolve();
@@ -6972,10 +7003,13 @@ var __webpack_modules__ = {
             constructor({ name, stage, controller, extraConfig, type }){
                 super({
                     name,
-                    root: controller.root
+                    root: controller.root,
+                    config: extraConfig
                 });
-                const lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : this.server.port;
-                this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port), this.type = type, this.setName(name), this.clearSwitch();
+                const lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : extraConfig?.server?.port ?? this.server.port;
+                this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port, {
+                    cors: extraConfig?.server?.cors
+                }), this.type = type, this.setName(name), this.clearSwitch();
             }
             clearSwitch() {
                 this.uploadPieces = new Promise((resolve)=>{

package/dist/index.js

@@ -14,12 +14,15 @@ import node_path, { join, normalize, resolve as external_node_path_resolve, sep
 import fs, { readdirSync, statSync } from "fs";
 import { Algorithm, Bundle, Data, GlobalConfig, Lodash, decycle } from "@rsdoctor/utils/common";
 import assert from "assert";
+import cors from "../compiled/cors/index.js";
 import { PassThrough } from "stream";
 import { Server as external_socket_io_Server } from "socket.io";
 import { isDeepStrictEqual } from "util";
+import { isIP } from "node:net";
 import os from "os";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
+import { randomBytes } from "crypto";
 import { createHash, randomUUID } from "node:crypto";
 import node_process from "node:process";
 import { AsyncSeriesHook } from "tapable";
@@ -5713,6 +5716,19 @@ class SocketAPILoader {
         return this.dataLoader.loadAPI;
     }
 }
+let DEFAULT_ALLOWED_CORS_ORIGINS = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/, LOCAL_HOSTNAMES = /^(?:localhost|[^:]+\.localhost)$/;
+function getHostnameFromHost(host) {
+    if (host.startsWith('[')) {
+        let endIndex = host.indexOf(']');
+        return -1 === endIndex ? '' : host.slice(1, endIndex);
+    }
+    return host.split(':')[0];
+}
+function isAllowedRequestHost(host) {
+    if ('string' != typeof host) return !1;
+    let hostname = getHostnameFromHost(host).toLowerCase();
+    return LOCAL_HOSTNAMES.test(hostname) || 0 !== isIP(hostname);
+}
 class Socket {
     constructor(options){
         this.options = options, this.map = new Map(), this.loader = new SocketAPILoader({
@@ -5720,11 +5736,13 @@ class Socket {
         });
     }
     bootstrap() {
+        let { socketOptions } = this.options;
         this.io = new external_socket_io_Server(this.options.server, {
-            cors: {
-                origin: '*'
-            },
-            ...this.options.socketOptions
+            ...socketOptions,
+            allowRequest: (req, callback)=>{
+                var url, token;
+                isAllowedRequestHost(req.headers.host || req.headers[':authority']) && (url = req.url, token = this.options.token, url && new URL(url, 'http://localhost').searchParams.get('token') === token) ? socketOptions?.allowRequest ? socketOptions.allowRequest(req, callback) : callback(null, !0) : callback(null, !1);
+            }
         }), this.io.on('connection', (socket)=>{
             this.setupSocket(socket);
         });
@@ -6291,15 +6309,10 @@ async function openBrowser(url, needEncodeURI = !0) {
 }
 let body_parser = __webpack_require__("../../node_modules/.pnpm/body-parser@2.2.2/node_modules/body-parser/index.js");
 var body_parser_default = __webpack_require__.n(body_parser);
-let server_require = createRequire(import.meta.url), LOCAL_HOSTNAMES = new Set([
-    'localhost',
-    '127.0.0.1',
-    '[::1]',
-    '::1'
-]);
+let server_require = createRequire(import.meta.url);
 class RsdoctorServer {
     constructor(sdk, port = Server.defaultPort, config){
-        this.sdk = sdk, this.disposed = !0, this.get = (route, cb)=>{
+        this.sdk = sdk, this.disposed = !0, this._socketToken = randomBytes(16).toString('hex'), this.get = (route, cb)=>{
             let { app } = this;
             return app.use(route, this.wrapNextHandleFunction('GET', cb)), app;
         }, this.post = (route, cb)=>{
@@ -6315,7 +6328,7 @@ class RsdoctorServer {
             sdk,
             server: this,
             apis: Object.values(apis_namespaceObject)
-        }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl;
+        }), this._innerClientPath = config?.innerClientPath || '', this._printServerUrl = !!Lodash.isUndefined(config?.printServerUrl) || config?.printServerUrl, this._cors = config?.cors;
     }
     get app() {
         return this._server.app;
@@ -6329,34 +6342,13 @@ class RsdoctorServer {
     get socketUrl() {
         return {
             port: this.port,
-            socketUrl: `ws://localhost:${this.port}`
+            socketUrl: `ws://localhost:${this.port}?token=${this._socketToken}`,
+            token: this._socketToken
         };
     }
     get innerClientPath() {
         return this._innerClientPath;
     }
-    isLocalOrigin(origin) {
-        try {
-            let url = new URL(origin);
-            return ('http:' === url.protocol || 'https:' === url.protocol) && LOCAL_HOSTNAMES.has(url.hostname);
-        } catch  {
-            return !1;
-        }
-    }
-    setCorsHeaders(req, res) {
-        let origin = req.headers.origin;
-        return 'string' == typeof origin && !!this.isLocalOrigin(origin) && (res.setHeader('Access-Control-Allow-Origin', origin), res.setHeader('Vary', 'Origin'), res.setHeader('Access-Control-Allow-Headers', 'Content-Type'), res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'), !0);
-    }
-    createSecurityMiddleware() {
-        return (req, res, next)=>{
-            let isCorsAllowed = this.setCorsHeaders(req, res);
-            if (req.method?.toUpperCase() === 'OPTIONS') {
-                res.statusCode = isCorsAllowed ? 204 : 403, res.end();
-                return;
-            }
-            next();
-        };
-    }
     async createInnerServer() {
         let lastError, expectedPort = this.port;
         for(let retry = 0; retry < 10; retry++){
@@ -6373,16 +6365,53 @@ class RsdoctorServer {
         }
         throw lastError;
     }
+    resolveCorsOptions() {
+        return !1 !== this._cors && (!0 === this._cors ? {} : void 0 === this._cors ? {
+            origin: DEFAULT_ALLOWED_CORS_ORIGINS
+        } : {
+            ...this._cors,
+            origin: void 0 === this._cors.origin ? DEFAULT_ALLOWED_CORS_ORIGINS : this._cors.origin
+        });
+    }
     async bootstrap() {
         if (!this.disposed) return;
-        let { port, server } = await this.createInnerServer();
+        let { port, server } = await this.createInnerServer(), corsOptions = this.resolveCorsOptions();
         this.port = port, this._server = server, this._socket = new Socket({
             sdk: this.sdk,
             server: this._server.server,
-            port: this.port
-        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use(this.createSecurityMiddleware()), this.app.use(body_parser_default().json({
+            port: this.port,
+            token: this._socketToken,
+            socketOptions: !1 === corsOptions ? void 0 : {
+                cors: corsOptions
+            }
+        }), await this._socket.bootstrap(), GlobalConfig.writeMcpPort(this.port, this.sdk.name), logger.debug(`Successfully wrote mcp.json for ${chalk.cyan(this.sdk.name)} builder`), this.disposed = !1, this.app.use((req, res, next)=>{
+            if (!isAllowedRequestHost(req.headers.host || req.headers[':authority'])) {
+                res.statusCode = 403, res.end();
+                return;
+            }
+            next();
+        }), !1 !== corsOptions && corsOptions.origin === DEFAULT_ALLOWED_CORS_ORIGINS && this.app.use((req, res, next)=>{
+            let host = req.headers.host || req.headers[':authority'];
+            if (!function(origin, host) {
+                if (void 0 === origin) return !0;
+                if ('string' != typeof origin || 'string' != typeof host || !(void 0 === origin || 'string' == typeof origin && DEFAULT_ALLOWED_CORS_ORIGINS.test(origin))) return !1;
+                let originHostname = function(origin) {
+                    try {
+                        let hostname = new URL(origin).hostname.toLowerCase();
+                        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+                    } catch  {
+                        return '';
+                    }
+                }(origin), hostHostname = getHostnameFromHost(host).toLowerCase();
+                return !originHostname.endsWith('.localhost') || originHostname === hostHostname;
+            }(req.headers.origin, host)) {
+                res.statusCode = 403, res.end();
+                return;
+            }
+            next();
+        }), !1 !== corsOptions && this.app.use(cors(corsOptions)), this.app.use(body_parser_default().json({
             limit: '500mb'
-        }));
+        })), await this._router.setup();
         let clientHtmlPath = this._innerClientPath ? this._innerClientPath : server_require.resolve('@rsdoctor/client'), clientDistPath = path_0.resolve(clientHtmlPath, '..');
         this.app.use(function(dir, opts = {}) {
             dir = external_node_path_resolve(dir || '.');
@@ -6474,7 +6503,7 @@ class RsdoctorServer {
             } catch (err) {
                 res.writableEnded || (res.statusCode = 500, res.end(err.message));
             }
-        }), await this._router.setup(), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
+        }), process.once('exit', ()=>this.dispose()), process.once('SIGINT', ()=>this.dispose(0)), process.once('SIGTERM', ()=>this.dispose(0)), process.once('unhandledRejection', (reason)=>{
             console.error('Unhandled promise rejection:', reason), this.dispose(1);
         }), process.once('uncaughtException', (err, origin)=>{
             console.error('Uncaught exception:', err), origin && console.error('Exception origin:', origin), this.dispose(1);
@@ -6679,9 +6708,12 @@ class RsdoctorSDK extends SDKCore {
     constructor(options){
         super(options), this._summary = {
             costs: []
-        }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new ModuleGraph(), this._chunkGraph = new ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map(), this.server = options.config?.noServer ? new RsdoctorFakeServer(this, void 0) : new RsdoctorServer(this, options.port, {
+        }, this._configs = [], this._errors = [], this._loader = [], this._loaderStart = [], this._resolver = [], this._plugin = {}, this._moduleGraph = new ModuleGraph(), this._chunkGraph = new ChunkGraph(), this._rawSourceMapCache = new Map(), this._sourceMap = new Map();
+        let serverConfig = options.config?.server, port = serverConfig?.port ?? options.port;
+        this.server = options.config?.noServer ? new RsdoctorFakeServer(this, port) : new RsdoctorServer(this, port, {
             innerClientPath: options.config?.innerClientPath || '',
-            printServerUrl: options.config?.printLog?.serverUrls
+            printServerUrl: options.config?.printLog?.serverUrls,
+            cors: serverConfig?.cors
         }), this.type = Lodash.isNumber(options.type) ? options.type : SDK.ToDataType.Normal, this.extraConfig = options.config, this.root = findRoot() ?? '';
     }
     async bootstrap() {
@@ -6977,8 +7009,8 @@ class RsdoctorSDK extends SDKCore {
     }
 }
 class RsdoctorSlaveServer extends RsdoctorServer {
-    constructor(sdk, port = Server.defaultPort){
-        super(sdk, port), this.sdk = sdk;
+    constructor(sdk, port = Server.defaultPort, config){
+        super(sdk, port, config), this.sdk = sdk;
     }
     async openClientPage(...args) {
         return this.sdk.isMaster ? super.openClientPage(...args) : Promise.resolve();
@@ -6989,10 +7021,13 @@ class RsdoctorPrimarySDK extends RsdoctorSDK {
     constructor({ name, stage, controller, extraConfig, type }){
         super({
             name,
-            root: controller.root
+            root: controller.root,
+            config: extraConfig
         });
-        let lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : this.server.port;
-        this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port), this.type = type, this.setName(name), this.clearSwitch();
+        let lastSdk = controller.getLastSdk(), port = lastSdk ? lastSdk.server.port + 1 : extraConfig?.server?.port ?? this.server.port;
+        this.id = primary_id++, this.stage = 'number' == typeof stage ? stage : 1, this.extraConfig = extraConfig, this.parent = controller, this.server = new RsdoctorSlaveServer(this, port, {
+            cors: extraConfig?.server?.cors
+        }), this.type = type, this.setName(name), this.clearSwitch();
     }
     clearSwitch() {
         this.uploadPieces = new Promise((resolve)=>{

package/dist/sdk/multiple/server.d.cts

@@ -1,7 +1,7 @@
-import { RsdoctorServer } from '../server';
+import { RsdoctorServer, type RsdoctorServerOptions } from '../server';
 import type { RsdoctorPrimarySDK } from './primary';
 export declare class RsdoctorSlaveServer extends RsdoctorServer {
     protected sdk: RsdoctorPrimarySDK;
-    constructor(sdk: RsdoctorPrimarySDK, port?: number);
+    constructor(sdk: RsdoctorPrimarySDK, port?: number, config?: RsdoctorServerOptions);
     openClientPage(...args: unknown[]): Promise<void>;
 }

package/dist/sdk/multiple/server.d.ts

@@ -1,7 +1,7 @@
-import { RsdoctorServer } from '../server/index.js';
+import { RsdoctorServer, type RsdoctorServerOptions } from '../server/index.js';
 import type { RsdoctorPrimarySDK } from './primary.js';
 export declare class RsdoctorSlaveServer extends RsdoctorServer {
     protected sdk: RsdoctorPrimarySDK;
-    constructor(sdk: RsdoctorPrimarySDK, port?: number);
+    constructor(sdk: RsdoctorPrimarySDK, port?: number, config?: RsdoctorServerOptions);
     openClientPage(...args: unknown[]): Promise<void>;
 }

package/dist/sdk/server/index.d.cts

@@ -3,6 +3,12 @@ export * from './utils';
 export type ISocketType = {
     port: number;
     socketUrl: string;
+    token: string;
+};
+export type RsdoctorServerOptions = {
+    innerClientPath?: string;
+    printServerUrl?: boolean;
+    cors?: SDK.RsdoctorServerConfig['cors'];
 };
 export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     protected sdk: SDK.RsdoctorBuilderSDKInstance;
@@ -13,19 +19,16 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     private _router;
     private _innerClientPath;
     private _printServerUrl;
-    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: {
-        innerClientPath?: string;
-        printServerUrl?: boolean;
-    });
+    private _cors;
+    private _socketToken;
+    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: RsdoctorServerOptions);
     get app(): SDK.RsdoctorServerInstance['app'];
     get host(): string;
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
-    private isLocalOrigin;
-    private setCorsHeaders;
-    private createSecurityMiddleware;
     private createInnerServer;
+    private resolveCorsOptions;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/dist/sdk/server/index.d.ts

@@ -3,6 +3,12 @@ export * from './utils.js';
 export type ISocketType = {
     port: number;
     socketUrl: string;
+    token: string;
+};
+export type RsdoctorServerOptions = {
+    innerClientPath?: string;
+    printServerUrl?: boolean;
+    cors?: SDK.RsdoctorServerConfig['cors'];
 };
 export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     protected sdk: SDK.RsdoctorBuilderSDKInstance;
@@ -13,19 +19,16 @@ export declare class RsdoctorServer implements SDK.RsdoctorServerInstance {
     private _router;
     private _innerClientPath;
     private _printServerUrl;
-    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: {
-        innerClientPath?: string;
-        printServerUrl?: boolean;
-    });
+    private _cors;
+    private _socketToken;
+    constructor(sdk: SDK.RsdoctorBuilderSDKInstance, port?: number, config?: RsdoctorServerOptions);
     get app(): SDK.RsdoctorServerInstance['app'];
     get host(): string;
     get origin(): string;
     get socketUrl(): ISocketType;
     get innerClientPath(): string;
-    private isLocalOrigin;
-    private setCorsHeaders;
-    private createSecurityMiddleware;
     private createInnerServer;
+    private resolveCorsOptions;
     bootstrap(): Promise<void>;
     protected wrapNextHandleFunction(method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): Thirdparty.connect.NextHandleFunction;
     proxy(api: SDK.ServerAPI.API, method: 'GET' | 'POST', cb: (...args: Parameters<Thirdparty.connect.NextHandleFunction>) => Common.PlainObject | string): void;

package/dist/sdk/server/security.d.cts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_ALLOWED_CORS_ORIGINS: RegExp;
+export declare function isAllowedRequestOrigin(origin: string | string[] | undefined): boolean;
+export declare function isAllowedRequestHost(host: string | string[] | undefined): boolean;
+export declare function isAllowedCorsRequest(origin: string | string[] | undefined, host: string | string[] | undefined): boolean;

package/dist/sdk/server/security.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_ALLOWED_CORS_ORIGINS: RegExp;
+export declare function isAllowedRequestOrigin(origin: string | string[] | undefined): boolean;
+export declare function isAllowedRequestHost(host: string | string[] | undefined): boolean;
+export declare function isAllowedCorsRequest(origin: string | string[] | undefined, host: string | string[] | undefined): boolean;

package/dist/sdk/server/socket/index.d.cts

@@ -6,7 +6,8 @@ interface SocketOptions {
     sdk: SDK.RsdoctorBuilderSDKInstance;
     server: Server;
     port: number;
-    socketOptions?: SocketServerOptions;
+    token: string;
+    socketOptions?: Partial<SocketServerOptions>;
 }
 export declare class Socket {
     protected options: SocketOptions;

package/dist/sdk/server/socket/index.d.ts

@@ -6,7 +6,8 @@ interface SocketOptions {
     sdk: SDK.RsdoctorBuilderSDKInstance;
     server: Server;
     port: number;
-    socketOptions?: SocketServerOptions;
+    token: string;
+    socketOptions?: Partial<SocketServerOptions>;
 }
 export declare class Socket {
     protected options: SocketOptions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsdoctor/sdk",
-  "version": "1.5.15",
+  "version": "1.5.16",
   "repository": {
     "type": "git",
     "url": "https://github.com/web-infra-dev/rsdoctor",
@@ -32,10 +32,10 @@
     "safer-buffer": "2.1.2",
     "socket.io": "4.8.1",
     "tapable": "2.3.3",
-    "@rsdoctor/client": "1.5.15",
-    "@rsdoctor/types": "1.5.15",
-    "@rsdoctor/utils": "1.5.15",
-    "@rsdoctor/graph": "1.5.15"
+    "@rsdoctor/graph": "1.5.16",
+    "@rsdoctor/types": "1.5.16",
+    "@rsdoctor/client": "1.5.16",
+    "@rsdoctor/utils": "1.5.16"
   },
   "devDependencies": {
     "@types/body-parser": "1.19.6",