npm - @tibame201020/queqiao-http - Versions diffs - 0.1.2 → 0.1.3 - Mend

@tibame201020/queqiao-http 0.1.2 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/README.md CHANGED Viewed

@@ -2,19 +2,19 @@
 [English](https://github.com/tibame201020/queqiao-http/blob/main/README.md) | [繁體中文](https://github.com/tibame201020/queqiao-http/blob/main/README.zh-TW.md)
-Official bounded HTTP extension for [Queqiao](https://github.com/tibame201020/Queqiao).
+Official curl-like HTTP extension for [Queqiao](https://github.com/tibame201020/Queqiao).
-`@tibame201020/queqiao-http` lets a Queqiao Worker call explicitly authorized HTTP/HTTPS origins through Queqiao's managed Extension runtime. It exposes one capability, `http_request`, through Queqiao's stable public `extension` proxy instead of adding a new public connector tool.
+`@tibame201020/queqiao-http` gives an attached Queqiao Worker a convenient `http_request` capability for direct HTTP/HTTPS requests. The trust decision is the extension install/attach itself: the extension does **not** maintain an origin allowlist.
-It uses `context.runtime.http.request()` directly. It does **not** invoke `curl`, a shell, `child_process`, or unrestricted global `fetch`.
+The implementation uses the Worker's native `fetch` directly. It does not invoke `curl`, a shell, or `child_process`.
 ## Status
-v0.1 baseline for Queqiao 0.9.7. The canonical npm package is `@tibame201020/queqiao-http`. Starting with v0.1.1, releases are published automatically from GitHub Releases through npm Trusted Publishing with provenance.
+v0.1.3 targets Queqiao 0.9.7. The canonical npm package is `@tibame201020/queqiao-http`.
-The current v0.1 runtime policy is intentionally narrow and has been validated end-to-end against the local Personal Asset Manager API on port `9889`.
+Starting with v0.1.1, npm publication is handled by the repository's GitHub Release workflow using npm Trusted Publishing with provenance.
-Verified acceptance chain:
+Current request path:
 ```text
 MCP client / LLM
@@ -22,22 +22,20 @@ MCP client / LLM
 → Queqiao Worker
 → stable extension proxy
 → queqiao-http
-→ Queqiao managed HTTP runtime
-→ authorized REST API
+→ direct HTTP/HTTPS request
+→ target service
 ```
 Verified behavior includes:
-- successful JSON GET requests;
-- automatic JSON response parsing;
+- JSON GET/POST requests;
+- automatic JSON request serialization and response parsing;
 - backend HTTP 4xx responses preserved as normal HTTP responses;
-- unauthorized origins rejected with `extension_network_denied`;
+- arbitrary HTTP/HTTPS origins, including localhost, WSL/private-network addresses, and internet origins;
 - no public Queqiao connector manifest expansion when the extension is installed or updated.
 ## Install
-Install from npm and attach to every Worker:
 ```bash
 queqiao extension install npm:@tibame201020/queqiao-http --attach-all
 ```
@@ -49,35 +47,35 @@ queqiao extension install npm:@tibame201020/queqiao-http
 queqiao extension attach dev.queqiao.http --worker windows
 ```
-`attach` is activation. There is no separate enable/disable state.
+`attach` is activation.
-Because Queqiao exposes extensions through the stable public `extension` proxy, installing or updating `queqiao-http` does not require rebuilding the ChatGPT / MCP connector manifest.
+## Network authority
-## Allowed origins
+There is no per-origin grant list in `queqiao-http`.
-The v0.1 package deliberately grants only these exact origins:
+Installing and attaching this extension is the explicit authorization for it to issue HTTP/HTTPS requests from the Worker. This is intentional: the extension is meant to be a convenient curl-like network capability, not a service-specific adapter.
-```text
-http://127.0.0.1:9889
-http://localhost:9889
-```
+The package manifest therefore declares no managed-runtime HTTP origins:
-Requests to any other origin are rejected by the Queqiao Worker runtime.
+```json
+{
+  "runtime": {
+    "processes": { "allow": [] },
+    "outboundHttp": { "allowOrigins": [] }
+  }
+}
+```
-This means v0.1 is a bounded HTTP extension for the current local service integration, **not** an unrestricted arbitrary-internet HTTP client. A future configurable-origin design should extend Queqiao's deployment/runtime grant model rather than bypassing it inside this extension.
+The empty `allowOrigins` list is intentional because v0.1.3 no longer routes requests through `context.runtime.http.request()`.
 ## Capability
-`queqiao-http` registers one capability:
-```text
-http_request
-```
+`queqiao-http` registers one capability: `http_request`.
 Input fields:
 - `workspaceId` — selected Queqiao Workspace;
-- `url` — full HTTP/HTTPS URL under an allowed origin;
+- `url` — full HTTP or HTTPS URL;
 - `method` — `GET | POST | PUT | PATCH | DELETE | HEAD`, default `GET`;
 - `headers` — optional string header map;
 - `body` — optional raw string body;
@@ -86,9 +84,7 @@ Input fields:
 When `json` is supplied, the extension serializes it and adds `content-type: application/json` unless the caller already supplied a Content-Type header.
-### Call through Queqiao's extension proxy
-A client using Queqiao's stable public `extension` tool can invoke the capability like this:
+### Example
 ```json
 {
@@ -97,80 +93,42 @@ A client using Queqiao's stable public `extension` tool can invoke the capabilit
   "extensionId": "dev.queqiao.http",
   "capability": "http_request",
   "arguments": {
-    "url": "http://127.0.0.1:9889/api/meal/types",
+    "url": "http://172.31.39.34:9889/api/meal/types",
     "method": "GET"
   }
 }
 ```
-### JSON POST
-```json
-{
-  "workspaceId": "codes",
-  "operation": "call",
-  "extensionId": "dev.queqiao.http",
-  "capability": "http_request",
-  "arguments": {
-    "url": "http://127.0.0.1:9889/api/trans/save",
-    "method": "POST",
-    "json": {
-      "type": "支出",
-      "category": "食",
-      "name": "牛肉麵",
-      "value": 180,
-      "transDate": "2026-09-07T00:00:00"
-    }
-  }
-}
-```
 ## Response contract
-Successful transport execution returns the downstream HTTP response without converting non-2xx status codes into transport failures:
+Non-2xx status codes remain ordinary downstream HTTP responses:
 ```json
 {
   "status": 200,
-  "headers": {
-    "content-type": "application/json"
-  },
+  "headers": { "content-type": "application/json" },
   "body": "{\"ok\":true}",
-  "json": {
-    "ok": true
-  }
+  "json": { "ok": true }
 }
 ```
-`json` is included only when the response body can be parsed as JSON. `body` always preserves the raw response text.
-For example, an application-level `HTTP 400` validation response remains a response with `status: 400`. Runtime policy failures such as a denied origin remain Queqiao runtime errors instead.
+`json` is included only when the response body is JSON. `body` preserves the response text.
 ## Trust boundary
-Queqiao extensions are trusted plugin code. Installing and attaching `queqiao-http` grants this extension authority to issue requests only through the managed Worker HTTP surface declared by its manifest.
-Queqiao remains authoritative for:
-- explicit package install/attach intent;
-- Extension contract validation;
-- exact-origin authorization;
-- HTTP/HTTPS scheme validation;
-- redirect denial;
-- request/response bounds;
-- timeout and cancellation handling;
-- Gateway → Worker routing and ExtensionHost lifecycle.
+Queqiao extensions are trusted plugin code. Installing and attaching `queqiao-http` grants this extension open-world HTTP/HTTPS network authority from that Worker.
-`queqiao-http` owns only the request-level adapter behavior: validating its input, serializing optional JSON, calling `context.runtime.http.request()`, and normalizing the returned response.
-The extension intentionally has:
+Queqiao remains authoritative for package installation/attachment, Extension contract validation, Gateway → Worker routing, and ExtensionHost lifecycle. The extension validates request shape, restricts the URL scheme to HTTP/HTTPS, applies the caller timeout, performs direct `fetch`, and normalizes the response.
 ```text
 process allowlist: empty
 shell access: none
 curl execution: none
 child_process: none
-unrestricted global fetch: none
+origin allowlist: none
+direct global fetch: yes
+risk: execute
+openWorldHint: true
 ```
 ## Development
@@ -181,12 +139,8 @@ npm run check
 npm pack --ignore-scripts --dry-run
 ```
-The test suite covers request mapping, JSON serialization/parsing, body/JSON exclusivity, non-2xx preservation, runtime error propagation, manifest/schema parity, bilingual package documentation, and release workflow invariants.
 ## Releasing
-Releases are tag-driven after the initial npm bootstrap:
 ```text
 main CI passes
 → tag v<package-version>

package/README.zh-TW.md CHANGED Viewed

@@ -2,19 +2,19 @@
 [English](https://github.com/tibame201020/queqiao-http/blob/main/README.md) | [繁體中文](https://github.com/tibame201020/queqiao-http/blob/main/README.zh-TW.md)
-[Queqiao](https://github.com/tibame201020/Queqiao) 的官方 bounded HTTP extension。
+[Queqiao](https://github.com/tibame201020/Queqiao) 的官方 curl-like HTTP extension。
-`@tibame201020/queqiao-http` 讓 Queqiao Worker 能透過 Queqiao 管理的 Extension runtime，呼叫 manifest 明確授權的 HTTP/HTTPS origin。它只註冊一個 `http_request` capability，並透過 Queqiao 穩定的公開 `extension` proxy 使用，而不是為 HTTP 能力新增一個固定的 public connector tool。
+`@tibame201020/queqiao-http` 讓已 attach 的 Queqiao Worker 取得方便的 `http_request` 能力，可直接發送 HTTP/HTTPS request。**安裝／attach extension 本身就是信任決策**；extension 不再維護 origin allowlist。
-底層直接使用 `context.runtime.http.request()`；**不會**執行 `curl`、shell、`child_process`，也不使用 unrestricted global `fetch`。
+底層直接使用 Worker 執行環境的 native `fetch`，不執行 `curl`、shell 或 `child_process`。
 ## 狀態
-v0.1 baseline 對應 Queqiao 0.9.7。Canonical npm package 為 `@tibame201020/queqiao-http`。自 v0.1.1 起，release 會在 GitHub Release 發布後，透過 npm Trusted Publishing + provenance 自動發布。
+v0.1.3 對應 Queqiao 0.9.7。Canonical npm package 為 `@tibame201020/queqiao-http`。
-目前 v0.1 runtime policy 刻意維持狹窄，並已對本機 `9889` port 的 Personal Asset Manager API 完成端到端驗證。
+自 v0.1.1 起，npm 發布由 GitHub Release workflow 透過 npm Trusted Publishing + provenance 自動處理。
-已驗證的 acceptance chain：
+目前 request path：
 ```text
 MCP client / LLM
@@ -22,22 +22,20 @@ MCP client / LLM
 → Queqiao Worker
 → stable extension proxy
 → queqiao-http
-→ Queqiao managed HTTP runtime
-→ authorized REST API
+→ direct HTTP/HTTPS request
+→ target service
 ```
 已驗證行為包括：
-- JSON GET request 成功；
-- JSON response 自動解析；
+- JSON GET/POST request；
+- JSON request 自動 serialize、JSON response 自動 parse；
 - backend HTTP 4xx 保留為正常 HTTP response；
-- 未授權 origin 會被 `extension_network_denied` 拒絕；
+- 可呼叫任意 HTTP/HTTPS origin，包括 localhost、WSL/private-network IP 與網際網路 origin；
 - 安裝或更新 extension 不會擴張 Queqiao 公開 connector manifest。
 ## 安裝
-從 npm 安裝並 attach 到所有 Worker：
 ```bash
 queqiao extension install npm:@tibame201020/queqiao-http --attach-all
 ```
@@ -49,46 +47,44 @@ queqiao extension install npm:@tibame201020/queqiao-http
 queqiao extension attach dev.queqiao.http --worker windows
 ```
-`attach` 即為 activation，沒有另外的 enable/disable 狀態。
+`attach` 即 activation。
-因為 Queqiao 使用固定的公開 `extension` proxy 暴露 extension，安裝或更新 `queqiao-http` 不需要重建 ChatGPT / MCP connector manifest。
+## Network authority
-## 允許的 origins
+`queqiao-http` 不再有 per-origin grant list。
-v0.1 package 只明確授權以下 exact origins：
+安裝並 attach 此 extension，即明確授權它從 Worker 發送 HTTP/HTTPS request。這是刻意設計：此 extension 的定位是方便的 curl-like network capability，而不是綁定某個服務的 adapter。
-```text
-http://127.0.0.1:9889
-http://localhost:9889
-```
+Package manifest 因此不宣告 managed-runtime HTTP origin：
-任何其他 origin 都會由 Queqiao Worker runtime 拒絕。
+```json
+{
+  "runtime": {
+    "processes": { "allow": [] },
+    "outboundHttp": { "allowOrigins": [] }
+  }
+}
+```
-因此 v0.1 是針對目前本機服務整合的 bounded HTTP extension，**不是** unrestricted arbitrary-internet HTTP client。未來若要支援可配置 origin，應擴充 Queqiao 的 deployment/runtime grant model，而不是在 extension 內繞過安全邊界。
+`allowOrigins` 為空是刻意的，因為 v0.1.3 已不再透過 `context.runtime.http.request()` 發送 request。
 ## Capability
-`queqiao-http` 只註冊一個 capability：
-```text
-http_request
-```
+`queqiao-http` 只註冊一個 capability：`http_request`。
 輸入欄位：
 - `workspaceId` — 選定的 Queqiao Workspace；
-- `url` — 位於允許 origin 下的完整 HTTP/HTTPS URL；
+- `url` — 完整 HTTP 或 HTTPS URL；
 - `method` — `GET | POST | PUT | PATCH | DELETE | HEAD`，預設 `GET`；
 - `headers` — optional string header map；
 - `body` — optional raw string body；
 - `json` — optional JSON value，與 `body` 互斥；
 - `timeoutMs` — `100` 到 `120000`，預設 `30000`。
-提供 `json` 時，extension 會自動 serialize，且在 caller 未提供 Content-Type 時補上 `content-type: application/json`。
-### 透過 Queqiao extension proxy 呼叫
+提供 `json` 時，extension 會自動 serialize，且 caller 未提供 Content-Type 時會補上 `content-type: application/json`。
-使用 Queqiao 穩定公開 `extension` tool 的 client，可以這樣呼叫：
+### 範例
 ```json
 {
@@ -97,80 +93,42 @@ http_request
   "extensionId": "dev.queqiao.http",
   "capability": "http_request",
   "arguments": {
-    "url": "http://127.0.0.1:9889/api/meal/types",
+    "url": "http://172.31.39.34:9889/api/meal/types",
     "method": "GET"
   }
 }
 ```
-### JSON POST
-```json
-{
-  "workspaceId": "codes",
-  "operation": "call",
-  "extensionId": "dev.queqiao.http",
-  "capability": "http_request",
-  "arguments": {
-    "url": "http://127.0.0.1:9889/api/trans/save",
-    "method": "POST",
-    "json": {
-      "type": "支出",
-      "category": "食",
-      "name": "牛肉麵",
-      "value": 180,
-      "transDate": "2026-09-07T00:00:00"
-    }
-  }
-}
-```
 ## Response contract
-Transport 成功執行後會回傳 downstream HTTP response；非 2xx status 不會被轉成 transport failure：
+非 2xx status 會保留為普通 downstream HTTP response：
 ```json
 {
   "status": 200,
-  "headers": {
-    "content-type": "application/json"
-  },
+  "headers": { "content-type": "application/json" },
   "body": "{\"ok\":true}",
-  "json": {
-    "ok": true
-  }
+  "json": { "ok": true }
 }
 ```
-只有 response body 可成功 parse 為 JSON 時才會提供 `json`；`body` 永遠保留原始 response text。
-例如 application validation 的 `HTTP 400` 仍會以 `status: 400` response 回傳。相對地，origin 未授權這類 runtime policy failure，會維持 Queqiao runtime error。
+只有 response body 能成功 parse 為 JSON 時才提供 `json`；`body` 保留文字 response。
 ## 信任邊界
-Queqiao extension 屬於 trusted plugin code。安裝並 attach `queqiao-http`，代表允許 extension 在自己的 manifest runtime policy 範圍內，透過 Worker managed HTTP surface 發出 request。
-Queqiao 仍負責：
-- 明確的 package install/attach intent；
-- Extension contract validation；
-- exact-origin authorization；
-- HTTP/HTTPS scheme validation；
-- redirect denial；
-- request/response bounds；
-- timeout 與 cancellation；
-- Gateway → Worker routing 與 ExtensionHost lifecycle。
+Queqiao extension 屬於 trusted plugin code。安裝並 attach `queqiao-http`，代表授權此 extension 從該 Worker 對外發送 open-world HTTP/HTTPS request。
-`queqiao-http` 只負責 request-level adapter：驗證 input、serialize optional JSON、呼叫 `context.runtime.http.request()`，以及 normalize response。
-Extension 刻意不具備：
+Queqiao 仍負責 package install/attach、Extension contract validation、Gateway → Worker routing 與 ExtensionHost lifecycle。Extension 本身負責 request schema、限制 URL scheme 為 HTTP/HTTPS、timeout、直接 `fetch` 與 response normalize。
 ```text
 process allowlist: empty
 shell access: none
 curl execution: none
 child_process: none
-unrestricted global fetch: none
+origin allowlist: none
+direct global fetch: yes
+risk: execute
+openWorldHint: true
 ```
 ## 開發
@@ -181,12 +139,8 @@ npm run check
 npm pack --ignore-scripts --dry-run
 ```
-Test suite 會驗證 request mapping、JSON serialization/parsing、body/JSON 互斥、non-2xx preservation、runtime error propagation、manifest/schema parity、中英文 package documentation，以及 release workflow invariants。
 ## 發布
-首次 npm bootstrap 完成後，release 採 tag-driven：
 ```text
 main CI passes
 → tag v<package-version>

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAEV,cAAc,EACd,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AAQzC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAYpC,CAAC;~~AA0BH~~,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,~~CA0C1E~~,CAAC;AAEF,QAAA,MAAM,SAAS;;;;;;;;CAUqC,CAAC;eAEtC,SAAS"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAEV,cAAc,EACd,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AAQzC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAYpC,CAAC;AAkCH,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAmD1E,CAAC;AAEF,QAAA,MAAM,SAAS;;;;;;;;CAUqC,CAAC;eAEtC,SAAS"}

package/dist/index.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { z } from "zod";
 const EXTENSION_ID = "dev.queqiao.http";
-const EXTENSION_VERSION = "0.1.0";
+const EXTENSION_VERSION = "0.1.3";
 const DEFAULT_TIMEOUT_MS = 30_000;
 const headersSchema = z.record(z.string().min(1).max(256), z.string().max(8192));
 export const HTTP_REQUEST_INPUT_SCHEMA = z.object({
@@ -38,10 +38,17 @@ function maybeParseJson(body, headers) {
         return undefined;
     }
 }
+function validateHttpUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("url must use http or https");
+    }
+    return url;
+}
 export const HTTP_REQUEST_DEFINITION = {
     name: "http_request",
     title: "HTTP request",
-    description: "Send one bounded HTTP request to an origin explicitly granted by this extension manifest.",
+    description: "Send one direct HTTP/HTTPS request from the trusted Worker extension without an origin allowlist.",
     inputSchema: HTTP_REQUEST_INPUT_SCHEMA,
     requiredCapabilities: [],
     risk: "execute",
@@ -51,8 +58,9 @@ export const HTTP_REQUEST_DEFINITION = {
         openWorldHint: true,
         idempotentHint: false,
     },
-    async execute(input, context) {
+    async execute(input) {
         const parsed = HTTP_REQUEST_INPUT_SCHEMA.parse(input);
+        validateHttpUrl(parsed.url);
         const headers = parsed.headers ? { ...parsed.headers } : undefined;
         let body = parsed.body;
         if (parsed.json !== undefined) {
@@ -66,17 +74,24 @@ export const HTTP_REQUEST_DEFINITION = {
             ? { "content-type": "application/json" }
             : headers;
         const request = {
-            url: parsed.url,
             method: parsed.method,
-            timeoutMs: parsed.timeoutMs,
+            signal: AbortSignal.timeout(parsed.timeoutMs),
+            redirect: "follow",
         };
         if (requestHeaders !== undefined)
             request.headers = requestHeaders;
         if (body !== undefined)
             request.body = body;
-        const response = await context.runtime.http.request(request);
-        const json = maybeParseJson(response.body, response.headers);
-        return json === undefined ? response : { ...response, json };
+        const response = await fetch(parsed.url, request);
+        const responseHeaders = Object.fromEntries(response.headers.entries());
+        const responseBody = parsed.method === "HEAD" ? "" : await response.text();
+        const json = maybeParseJson(responseBody, responseHeaders);
+        const normalized = {
+            status: response.status,
+            headers: responseHeaders,
+            body: responseBody,
+        };
+        return json === undefined ? normalized : { ...normalized, json };
     },
 };
 const extension = {

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChF,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC9E,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,SAAS,SAAS,CAAC,OAAyC,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyC;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAyC;IAC7E,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,cAAc;IACrB,WAAW,EAAE,~~2FAA2F~~;~~IACxG~~,WAAW,EAAE,yBAAyB;IACtC,oBAAoB,EAAE,EAAE;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE;QACX,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,KAAK;KACtB;IACD,KAAK,CAAC,OAAO,CAAC,KAAK~~,EAAE,OAAO~~;~~QAC1B~~,MAAM,MAAM,GAAqB,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACxF,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO;YAC1D,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACxC,CAAC,CAAC,OAAO,CAAC;QAEZ,MAAM,OAAO,~~GAAwE~~;~~YACnF~~,~~GAAG~~,EAAE,MAAM,CAAC,~~GAAG~~;~~YACf~~,MAAM,EAAE,~~MAAM~~,CAAC,~~MAAM;YACrB~~,~~SAAS~~,~~EAAE,~~MAAM,CAAC,SAAS;~~SAC5B~~,CAAC;QACF,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,~~OAAO~~,CAAC,OAAO,CAAC,~~IAAI~~,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;~~QAE7D~~,MAAM,~~IAAI~~,GAAG,~~cAAc~~,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,~~CAAC~~,CAAC;~~QAC7D~~,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,~~QAAQ~~,CAAC,CAAC,CAAC,EAAE,GAAG,~~QAAQ~~,EAAE,IAAI,EAAE,CAAC;~~IAC/D~~,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,QAAQ,EAAE;QACR,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,cAAc;QAC3B,qBAAqB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC;KACtD;IACD,QAAQ,CAAC,GAAG;QACV,GAAG,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;CACiD,CAAC;AAErD,eAAe,SAAS,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChF,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAC9E,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,SAAS,SAAS,CAAC,OAAyC,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyC;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAyC;IAC7E,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,cAAc;IACrB,WAAW,EAAE,mGAAmG;IAChH,WAAW,EAAE,yBAAyB;IACtC,oBAAoB,EAAE,EAAE;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE;QACX,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,KAAK;KACtB;IACD,KAAK,CAAC,OAAO,CAAC,KAAK;QACjB,MAAM,MAAM,GAAqB,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACxF,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO;YAC1D,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACxC,CAAC,CAAC,OAAO,CAAC;QAEZ,MAAM,OAAO,GAAgB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,QAAQ,EAAE;QACR,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,cAAc;QAC3B,qBAAqB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC;KACtD;IACD,QAAQ,CAAC,GAAG;QACV,GAAG,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;CACiD,CAAC;AAErD,eAAe,SAAS,CAAC"}

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@tibame201020/queqiao-http",
-  "version": "0.1.2",
-  "description": "Bounded outbound HTTP extension for Queqiao",
+  "version": "0.1.3",
+  "description": "Trusted curl-like HTTP extension for Queqiao",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -43,7 +43,7 @@
     "module": "./dist/index.js",
     "manifest": {
       "id": "dev.queqiao.http",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "displayName": "Queqiao HTTP",
       "host": {
         "kind": "worker"
@@ -58,10 +58,7 @@
           "allow": []
         },
         "outboundHttp": {
-          "allowOrigins": [
-            "http://127.0.0.1:9889",
-            "http://localhost:9889"
-          ]
+          "allowOrigins": []
         }
       },
       "contributions": [
@@ -70,7 +67,7 @@
           "tool": "http_request",
           "visibility": "public",
           "title": "HTTP request",
-          "description": "Send one bounded HTTP request to an origin explicitly granted by this extension manifest.",
+          "description": "Send one direct HTTP/HTTPS request from the trusted Worker extension without an origin allowlist.",
           "inputSchema": {
             "$schema": "https://json-schema.org/draft/2020-12/schema",
             "type": "object",