acrylblends 0.0.0-stage → 0.3.0

package/plugins/acryl-router/tests/loader.spec.ts

@@ -0,0 +1,71 @@
+/**
+ * The router mounted the way production mounts every plugin: a real `@deepseek-ai/cordis-plugin-loader` Loader row
+ * pointing at the built `lib/index.js`. Covers what a hand-built `ctx.plugin` cannot: the row id equals the package
+ * name, the `cordis.patch.yml` insert is loadable, and disabling and enabling the row ten times leaves nothing behind.
+ * @throws if the package has not been built: run `pnpm run build` first.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Context, type FiberState } from '@deepseek-ai/cordis'
+import { Loader } from '@deepseek-ai/cordis-plugin-loader'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const ACTIVE = 2 as FiberState.ACTIVE
+const DISPOSED = 4 as FiberState.DISPOSED
+const BUILT_ENTRY = new URL('../lib/index.js', import.meta.url).href
+
+const roots: string[] = []
+const contexts: Context[] = []
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
+})
+
+async function mount(): Promise<{ ctx: Context, entryId: string }> {
+  const root = mkdtempSync(join(tmpdir(), 'acryl-router-loader-'))
+  roots.push(root)
+  writeFileSync(join(root, 'row.mjs'), `export * from ${JSON.stringify(BUILT_ENTRY)}\n`)
+  const ctx = new Context()
+  contexts.push(ctx)
+  await ctx.plugin(Loader, { baseUrl: `file://${root}/` })
+  const entryId = await ctx.loader.create({ name: './row.mjs' })
+  await ctx.loader.await()
+  return { ctx, entryId }
+}
+
+function entryOf(ctx: Context, entryId: string) {
+  const found = [...ctx.loader.entries()].find(candidate => candidate.id === entryId)
+  if (found === undefined) throw new Error('entry not found')
+  return found
+}
+
+describe('acryl-router through a real Loader', () => {
+  it('activates from the built entry and serves a request in process', async () => {
+    const { ctx, entryId } = await mount()
+    expect(entryOf(ctx, entryId).fiber?.state).toBe(ACTIVE)
+    ctx.router.get('/ping', c => c.json({ ok: true }))
+    const response = await ctx.router.fetch(new Request('http://acryl.test/ping'))
+    expect(await response.json()).toEqual({ ok: true })
+  })
+
+  it('answers 503 and drops its routes when the row is disabled, and serves again when re-enabled, ten times', async () => {
+    const { ctx, entryId } = await mount()
+    const first = ctx.router
+    for (let i = 0; i < 10; i += 1) {
+      await entryOf(ctx, entryId).update({ disabled: true })
+      await ctx.loader.await()
+      const fiber = entryOf(ctx, entryId).fiber
+      expect(fiber === undefined || fiber.state === DISPOSED).toBe(true)
+      await entryOf(ctx, entryId).update({ disabled: false })
+      await ctx.loader.await()
+      expect(entryOf(ctx, entryId).fiber?.state).toBe(ACTIVE)
+    }
+    expect(ctx.router).not.toBe(first)
+    expect(ctx.router.size).toBe(0)
+    expect((await first.fetch(new Request('http://acryl.test/x'))).status).toBe(503)
+    ctx.router.get('/again', c => c.text('ok'))
+    expect(await (await ctx.router.fetch(new Request('http://acryl.test/again'))).text()).toBe('ok')
+  })
+})

package/plugins/acryl-router/tests/middleware.spec.ts

@@ -0,0 +1,183 @@
+/** The built-in middleware (spec 046), each through the real Cordis service and `router.request`. */
+
+import { Context } from '@deepseek-ai/cordis'
+import { afterEach, describe, expect, it } from 'vitest'
+import { apply, name, type Router } from '../src/index.ts'
+import { bodyLimit, cors, logger, loopbackOnly, requestId, secureHeaders } from '../src/middleware/index.ts'
+
+const contexts: Context[] = []
+const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+async function mount(): Promise<Router> {
+  const ctx = new Context()
+  contexts.push(ctx)
+  ctx.plugin({ name, apply })
+  await settle()
+  return ctx.router
+}
+
+describe('secureHeaders', () => {
+  it('adds the hardening headers without overriding what the handler set, and lets a default be removed', async () => {
+    const router = await mount()
+    router.use(secureHeaders({ headers: { 'x-frame-options': '' } }))
+    router.get('/a', c => c.text('a'))
+    router.get('/b', () => new Response('b', { headers: { 'referrer-policy': 'origin' } }))
+    const a = await router.request('/a')
+    expect(a.headers.get('x-content-type-options')).toBe('nosniff')
+    expect(a.headers.get('x-frame-options')).toBeNull()
+    expect((await router.request('/b')).headers.get('referrer-policy')).toBe('origin')
+  })
+
+  it('also works on an immutable response', async () => {
+    const router = await mount()
+    router.use(secureHeaders())
+    router.get('/go', () => Response.redirect('http://example.test/x', 302))
+    const response = await router.request('/go')
+    expect(response.status).toBe(302)
+    expect(response.headers.get('x-content-type-options')).toBe('nosniff')
+  })
+})
+
+describe('requestId', () => {
+  it('keeps a well-formed incoming id, replaces a bad one, and exposes it to handlers', async () => {
+    const router = await mount()
+    router.use(requestId({ generate: () => 'generated-1' }))
+    router.get('/id', c => c.text(c.get<string>('requestId') ?? ''))
+    const kept = await router.request('/id', { headers: { 'x-request-id': 'abc-123' } })
+    expect(await kept.text()).toBe('abc-123')
+    expect(kept.headers.get('x-request-id')).toBe('abc-123')
+    const replaced = await router.request('/id', { headers: { 'x-request-id': 'bad id with spaces' } })
+    expect(await replaced.text()).toBe('generated-1')
+    expect((await router.request('/id')).headers.get('x-request-id')).toBe('generated-1')
+  })
+})
+
+describe('logger', () => {
+  it('writes an in line and an out line with status and time to the sink, and reports a throw', async () => {
+    const router = await mount()
+    const lines: string[] = []
+    router.use(logger(line => lines.push(line)))
+    router.get('/ok', c => c.text('ok'))
+    router.get('/boom', () => { throw new Error('boom') })
+    await router.request('/ok')
+    await router.request('/boom')
+    expect(lines[0]).toBe('<-- GET /ok')
+    expect(lines[1]).toMatch(/^--> GET \/ok 200 \d+ms$/)
+    expect(lines[2]).toBe('<-- GET /boom')
+    expect(lines[3]).toMatch(/^--> GET \/boom threw boom \d+ms$/)
+  })
+})
+
+describe('bodyLimit', () => {
+  it('refuses a declared length over the limit and lets a smaller one through', async () => {
+    const router = await mount()
+    router.use(bodyLimit({ maxBytes: 10 }))
+    router.post('/in', async c => c.text(await c.req.text()))
+    const big = await router.request('/in', { method: 'POST', body: 'x'.repeat(50), headers: { 'content-length': '50' } })
+    expect(big.status).toBe(413)
+    expect(await big.json()).toEqual({ error: 'payload too large', maxBytes: 10 })
+    expect(await (await router.request('/in', { method: 'POST', body: 'small', headers: { 'content-length': '5' } })).text()).toBe('small')
+  })
+
+  it('uses a custom error response', async () => {
+    const router = await mount()
+    router.use(bodyLimit({ maxBytes: 1, onError: c => c.text('too big', 400) }))
+    router.post('/in', c => c.text('ok'))
+    const response = await router.request('/in', { method: 'POST', body: 'xx', headers: { 'content-length': '2' } })
+    expect(response.status).toBe(400)
+    expect(await response.text()).toBe('too big')
+  })
+})
+
+describe('cors', () => {
+  it('answers a preflight itself and adds the headers to normal responses', async () => {
+    const router = await mount()
+    router.use(cors({ origin: ['https://app.example'], allowMethods: ['GET', 'POST'], maxAge: 600, credentials: true }))
+    router.get('/x', c => c.text('x'))
+    const preflight = await router.request('/x', { method: 'OPTIONS', headers: { origin: 'https://app.example', 'access-control-request-method': 'POST', 'access-control-request-headers': 'x-a, x-b' } })
+    expect(preflight.status).toBe(204)
+    expect(preflight.headers.get('access-control-allow-origin')).toBe('https://app.example')
+    expect(preflight.headers.get('access-control-allow-methods')).toBe('GET,POST')
+    expect(preflight.headers.get('access-control-allow-headers')).toBe('x-a,x-b')
+    expect(preflight.headers.get('access-control-max-age')).toBe('600')
+    expect(preflight.headers.get('access-control-allow-credentials')).toBe('true')
+    const normal = await router.request('/x', { headers: { origin: 'https://app.example' } })
+    expect(normal.headers.get('access-control-allow-origin')).toBe('https://app.example')
+    expect(normal.headers.get('vary')).toContain('Origin')
+  })
+
+  it('does not allow an origin outside the list', async () => {
+    const router = await mount()
+    router.use(cors({ origin: 'https://app.example' }))
+    router.get('/x', c => c.text('x'))
+    const response = await router.request('/x', { headers: { origin: 'https://evil.example' } })
+    expect(response.headers.get('access-control-allow-origin')).toBeNull()
+  })
+})
+
+describe('loopbackOnly', () => {
+  const peer = { remoteAddress: '127.0.0.1', localPort: 3105 }
+  const headers = (extra: Record<string, string> = {}): Record<string, string> => ({ host: '127.0.0.1:3105', ...extra })
+
+  it('lets a loopback peer on the real port through and refuses everything else with a 403', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.get('/x', c => c.text('x'))
+    expect((await router.request('/x', { headers: headers() }, peer)).status).toBe(200)
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ host: 'evil.example:3105' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers({ 'sec-fetch-site': 'cross-site' }) }, peer)).status).toBe(403)
+    expect((await router.request('/x', { headers: headers() })).status).toBe(403)
+  })
+
+  it('accepts an IPv4-mapped loopback address and ::1', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.get('/x', c => c.text('x'))
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::ffff:127.0.0.1', localPort: 3105 })).status).toBe(200)
+    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
+  })
+
+  it('refuses a change from a foreign or null Origin, and accepts this app\'s own', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://evil.example' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'null' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://127.0.0.1:3105' }) }, peer)).status).toBe(200)
+  })
+
+  it('accepts a change with no Origin (curl) only when the Host is a loopback address with this port', async () => {
+    const router = await mount()
+    router.use(loopbackOnly())
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'localhost:3105' }) }, peer)).status).toBe(200)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '[::1]:3105' }) }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
+    // DNS rebinding: the page's own domain arrives as the Host, so a foreign Host is refused with or without an Origin.
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'rebind.example:3105' }) }, peer)).status).toBe(403)
+    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
+  })
+
+  it('refuses an in-process call by default and lets it through when told the caller is the host', async () => {
+    const router = await mount()
+    router.get('/guarded', loopbackOnly(), c => c.text('x'))
+    router.get('/host', loopbackOnly({ inProcess: 'allow' }), c => c.text('x'))
+    expect((await router.request('/guarded')).status).toBe(403)
+    expect((await router.request('/host')).status).toBe(200)
+    // A request with any connection facts is checked in full, even when inProcess is allowed.
+    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
+    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '127.0.0.1' })).status).toBe(403)
+  })
+
+  it('can check only the peer when mutations are none', async () => {
+    const router = await mount()
+    router.use(loopbackOnly({ mutations: 'none' }))
+    router.post('/do', c => c.text('done'))
+    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
+  })
+})

package/plugins/acryl-router/tests/service.spec.ts

@@ -0,0 +1,211 @@
+/**
+ * The router as a Cordis service (spec 046, M1): the shared conformance suite through a real `Context`, then the
+ * lifecycle mechanics the repo protocol requires: PENDING while the provider is missing, reactivation when it appears,
+ * provider replacement without duplicate registrations, disposal, repeated mount and reload, and in-flight abort.
+ */
+
+import { Context, type FiberState } from '@deepseek-ai/cordis'
+import { afterEach, describe, expect, it } from 'vitest'
+import { apply, Config, name, type Router } from '../src/index.ts'
+import { conformance, type Candidate } from './conformance.ts'
+
+const PENDING = 0 as FiberState.PENDING
+const ACTIVE = 2 as FiberState.ACTIVE
+const DISPOSED = 4 as FiberState.DISPOSED
+
+const contexts: Context[] = []
+const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
+
+function root(): Context {
+  const ctx = new Context()
+  contexts.push(ctx)
+  return ctx
+}
+
+const provider = { name, apply }
+const config: Config = { trailingSlash: 'strict', disposeGraceMs: 2000 }
+
+async function mountRouter(): Promise<{ ctx: Context, router: Router }> {
+  const ctx = root()
+  ctx.plugin(provider, config)
+  await settle()
+  return { ctx, router: ctx.router }
+}
+
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+conformance('the Router service in a Cordis Context', async () => {
+  const { router } = await mountRouter()
+  const candidate: Candidate = {
+    route: (method, path, handler) => router.route(method, path, handler),
+    use: (path, middleware) => router.use(path, middleware),
+    fetch: request => router.fetch(request),
+    size: () => router.size,
+  }
+  return candidate
+})
+
+/** A consumer plugin that needs `router` and registers one route, the way the market will. */
+function consumer(path: string, label: string) {
+  return {
+    name: `consumer${label}`,
+    inject: ['router'],
+    apply(ctx: Context): void {
+      ctx.router.get(path, c => c.text(label))
+    },
+  }
+}
+
+const get = (router: Router, path: string): Promise<Response> => router.fetch(new Request(`http://acryl.test${path}`))
+
+describe('acryl-router lifecycle through Cordis', () => {
+  it('leaves a consumer PENDING while router is missing and activates it when router appears', async () => {
+    const ctx = root()
+    const fiber = ctx.plugin(consumer('/c', 'A'))
+    await settle()
+    expect(fiber.state).toBe(PENDING)
+
+    ctx.plugin(provider, config)
+    await settle()
+    expect(fiber.state).toBe(ACTIVE)
+    expect(await (await get(ctx.router, '/c')).text()).toBe('A')
+    expect(ctx.router.size).toBe(1)
+  })
+
+  it('removes a consumer\'s routes when the consumer unloads and leaves other consumers alone', async () => {
+    const { ctx, router } = await mountRouter()
+    const a = ctx.plugin(consumer('/a', 'A'))
+    ctx.plugin(consumer('/b', 'B'))
+    await settle()
+    expect(router.size).toBe(2)
+
+    await a.dispose()
+    await settle()
+    expect(a.state).toBe(DISPOSED)
+    expect((await get(router, '/a')).status).toBe(404)
+    expect(await (await get(router, '/b')).text()).toBe('B')
+    expect(router.size).toBe(1)
+  })
+
+  it('replaces the provider without leaving doubled registrations: consumers re-register exactly once', async () => {
+    const ctx = root()
+    const first = ctx.plugin(provider, config)
+    const fiber = ctx.plugin(consumer('/c', 'A'))
+    await settle()
+    const oldRouter = ctx.router
+    expect(fiber.state).toBe(ACTIVE)
+
+    await first.dispose()
+    await settle()
+    expect(fiber.state).toBe(PENDING)
+    expect(oldRouter.size).toBe(0)
+
+    ctx.plugin(provider, config)
+    await settle()
+    expect(fiber.state).toBe(ACTIVE)
+    expect(ctx.router).not.toBe(oldRouter)
+    expect(ctx.router.size).toBe(1)
+    expect(await (await get(ctx.router, '/c')).text()).toBe('A')
+  })
+
+  it('returns to its baseline after fifty consumer mount and unload cycles', async () => {
+    const { ctx, router } = await mountRouter()
+    ctx.plugin(consumer('/stay', 'S'))
+    await settle()
+    const baseline = router.size
+    for (let i = 0; i < 50; i += 1) {
+      const fiber = ctx.plugin(consumer(`/cycle/${String(i)}`, `C${String(i)}`))
+      await settle()
+      expect(router.size).toBe(baseline + 1)
+      await fiber.dispose()
+      await settle()
+    }
+    expect(router.size).toBe(baseline)
+  })
+
+  it('aborts an in-flight request and waits for it when the router is disposed, then answers 503', async () => {
+    const ctx = root()
+    const fiber = ctx.plugin(provider, config)
+    await settle()
+    const router = ctx.router
+    let aborted = false
+    router.get('/slow', async c => {
+      await new Promise<void>((_resolve, reject) => { c.signal.addEventListener('abort', () => { aborted = true; reject(new Error('aborted')) }, { once: true }) })
+      return c.text('late')
+    })
+    const pending = router.fetch(new Request('http://acryl.test/slow'))
+    await settle()
+
+    await fiber.dispose()
+    await settle()
+    expect(aborted).toBe(true)
+    expect((await pending).status).toBe(499)
+    expect((await router.fetch(new Request('http://acryl.test/slow'))).status).toBe(503)
+  })
+
+  it('hands the transport\'s connection info to the handler and gives an in-process call an empty one', async () => {
+    const { router } = await mountRouter()
+    router.get('/who', c => c.json({ remote: c.connection.remoteAddress ?? null }))
+    const over = await router.fetch(new Request('http://acryl.test/who'), { remoteAddress: '127.0.0.1' })
+    expect(await over.json()).toEqual({ remote: '127.0.0.1' })
+    const inProcess = await router.fetch(new Request('http://acryl.test/who'))
+    expect(await inProcess.json()).toEqual({ remote: null })
+  })
+
+  it('keeps a streaming request in flight through waitUntil: disposal aborts it and waits until it has ended', async () => {
+    const ctx = root()
+    const fiber = ctx.plugin(provider, config)
+    await settle()
+    const router = ctx.router
+    let ended = false
+    router.get('/stream', c => {
+      const body = new ReadableStream<Uint8Array>({
+        start(controller) {
+          const done = new Promise<void>(resolve => {
+            c.signal.addEventListener('abort', () => { ended = true; controller.close(); resolve() }, { once: true })
+          })
+          c.waitUntil(done)
+          controller.enqueue(new TextEncoder().encode('first'))
+        },
+      })
+      return new Response(body)
+    })
+    const response = await router.fetch(new Request('http://acryl.test/stream'))
+    expect(response.status).toBe(200)
+    const reader = response.body!.getReader()
+    expect(new TextDecoder().decode((await reader.read()).value)).toBe('first')
+
+    await fiber.dispose()
+    expect(ended).toBe(true)
+    await expect(reader.read()).resolves.toMatchObject({ done: true })
+  })
+
+  it('gives up on a request that ignores the abort after the grace period instead of hanging disposal', async () => {
+    const ctx = root()
+    const fiber = ctx.plugin(provider, { trailingSlash: 'strict', disposeGraceMs: 30 })
+    await settle()
+    ctx.router.get('/stuck', c => { c.waitUntil(new Promise(() => undefined)); return c.text('x') })
+    await ctx.router.fetch(new Request('http://acryl.test/stuck'))
+    const started = Date.now()
+    await fiber.dispose()
+    expect(Date.now() - started).toBeLessThan(1000)
+    expect(fiber.state).toBe(DISPOSED)
+  })
+
+  it('forwards the caller\'s own abort to the handler signal', async () => {
+    const { router } = await mountRouter()
+    let seen = false
+    router.get('/slow', async c => {
+      await new Promise<void>((_resolve, reject) => { c.signal.addEventListener('abort', () => { seen = true; reject(new Error('aborted')) }, { once: true }) })
+      return c.text('x')
+    })
+    const controller = new AbortController()
+    const pending = router.fetch(new Request('http://acryl.test/slow', { signal: controller.signal }))
+    await settle()
+    controller.abort()
+    expect((await pending).status).toBe(499)
+    expect(seen).toBe(true)
+  })
+})

package/plugins/acryl-router/tests/table.spec.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest'
+import { RouteTable } from '../src/table.ts'
+import { conformance, type Candidate } from './conformance.ts'
+
+function tableCandidate(trailingSlash: 'strict' | 'ignore' = 'strict', onError?: (e: unknown) => void): Candidate & { table: RouteTable } {
+  const table = new RouteTable({ trailingSlash, ...(onError === undefined ? {} : { onError }) })
+  return {
+    table,
+    route: (method, path, handler) => table.add(method, path, handler),
+    use: (path, middleware) => table.use(path, middleware),
+    fetch: request => table.dispatch(request, new AbortController().signal),
+    size: () => table.size,
+  }
+}
+
+conformance('RouteTable (the pure core)', () => tableCandidate())
+
+describe('RouteTable specifics', () => {
+  it('keeps /a and /a/ distinct under strict and joins them under ignore', async () => {
+    const strict = tableCandidate('strict')
+    strict.route('GET', '/a', c => c.text('a'))
+    expect((await strict.fetch(new Request('http://t/a/'))).status).toBe(404)
+    const loose = tableCandidate('ignore')
+    loose.route('GET', '/a', c => c.text('a'))
+    expect((await loose.fetch(new Request('http://t/a/'))).status).toBe(200)
+  })
+
+  it('reports handler errors to onError and still answers 500', async () => {
+    const seen: unknown[] = []
+    const c = tableCandidate('strict', e => seen.push(e))
+    c.route('GET', '/x', () => { throw new Error('nope') })
+    expect((await c.fetch(new Request('http://t/x'))).status).toBe(500)
+    expect(seen).toHaveLength(1)
+  })
+
+  it('answers 499 instead of 500 when the request was aborted', async () => {
+    const c = tableCandidate()
+    const controller = new AbortController()
+    c.route('GET', '/slow', async ctx => {
+      await new Promise((_resolve, reject) => { ctx.signal.addEventListener('abort', () => reject(new Error('aborted')), { once: true }) })
+      return ctx.text('never')
+    })
+    const pending = c.table.dispatch(new Request('http://t/slow'), controller.signal)
+    controller.abort()
+    expect((await pending).status).toBe(499)
+  })
+})

package/plugins/acryl-router/upstream.json

@@ -0,0 +1,20 @@
+{
+  "source": {
+    "repo": "acryldev/acryl",
+    "path": "plugins/acryl-router",
+    "commit": "11fed295161c0282d144b5ac62616988b58d8189"
+  },
+  "vendored": [
+    "src",
+    "tests",
+    "LICENSE"
+  ],
+  "rewrittenSpecifiers": 0,
+  "digest": "sha256:3873e59cdc36ab606be983680dc2f338141563ebafb13b36215c6b7de7c80d42",
+  "testsNotRun": {
+    "tests/loader.spec.ts": "loads the built lib/ entry through the real Loader; the library ships source and has no build"
+  },
+  "notice": [
+    "LICENSE"
+  ]
+}

package/plugins/acryl-router-http/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WebBoxes s.r.o.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/plugins/acryl-router-http/plugin.json

@@ -0,0 +1,11 @@
+{
+  "name": "acryl-router-http",
+  "description": "The serve() and request bridge that acryl-node-server uses to put the router on node:http. Mounting it as a plugin needs the DSH web server, which a generated app does not have. Vendored from ACRYL.",
+  "requires": ["acryl-router"],
+  "inject": ["router"],
+  "provides": [],
+  "dependencies": {
+    "@deepseek-ai/cordis": "4.0.4"
+  },
+  "mount": "not mounted: it is the library behind acryl-node-server"
+}

package/plugins/acryl-router-http/src/bridge.ts

@@ -0,0 +1,52 @@
+/**
+ * The two conversions between `node:http` and Web-standard fetch objects. Pure functions, no Cordis, so the adapter's
+ * behavior is testable without a server.
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { Readable } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
+
+const FALLBACK_ORIGIN = 'http://localhost'
+
+/** Build the Web `Request` for an incoming message. The body, when the method has one, is streamed, not buffered. */
+export function toRequest(req: IncomingMessage, signal: AbortSignal): Request {
+  let url: URL
+  try {
+    url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`)
+  } catch {
+    url = new URL(req.url ?? '/', FALLBACK_ORIGIN)
+  }
+  const headers = new Headers()
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === undefined) continue
+    if (Array.isArray(value)) for (const item of value) headers.append(key, item)
+    else headers.set(key, value)
+  }
+  const method = (req.method ?? 'GET').toUpperCase()
+  if (method === 'GET' || method === 'HEAD') return new Request(url, { method, headers, signal })
+  return new Request(url, { method, headers, signal, body: Readable.toWeb(req) as ReadableStream, duplex: 'half' })
+}
+
+/**
+ * Write a Web `Response` to the node response: status, headers (repeated `set-cookie` kept separate) and the streamed body.
+ * A client that disconnects mid-stream ends the copy quietly; the caller's abort signal is what stops the handler.
+ */
+export async function sendResponse(res: ServerResponse, response: Response, method: string): Promise<void> {
+  const headers: Record<string, string | string[]> = {}
+  response.headers.forEach((value, key) => { if (key !== 'set-cookie') headers[key] = value })
+  const cookies = response.headers.getSetCookie()
+  if (cookies.length > 0) headers['set-cookie'] = cookies
+  res.writeHead(response.status, headers)
+  // A stream may stay silent for a while; the status line and headers must reach the client now, not with the first chunk.
+  res.flushHeaders()
+  if (response.body === null || method === 'HEAD') {
+    res.end()
+    return
+  }
+  try {
+    await pipeline(Readable.fromWeb(response.body as import('node:stream/web').ReadableStream), res)
+  } catch {
+    if (!res.writableEnded) res.destroy()
+  }
+}