acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router-http/upstream.json

@@ -2,15 +2,15 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-router-http",
-    "commit": "11fed295161c0282d144b5ac62616988b58d8189"
+    "commit": "df79b188398b6d4f8cceda35a72b88300a10a9ce"
   },
   "vendored": [
     "src",
     "tests",
     "LICENSE"
   ],
-  "rewrittenSpecifiers": 6,
-  "digest": "sha256:6a79e85a11bf61a13604736ef9776f878a024ef19e1282481bdfe13343916bc4",
+  "rewrittenSpecifiers": 7,
+  "digest": "sha256:29ba7834cf9d29e9af2f4fac265c7e5e220e06da3346e65c29bcbae41fdfaf9e",
   "testsNotRun": {
     "tests/adapter.spec.ts": "needs @deepseek-ai/dsh-host-webserver (the DSH web server); acryl-node-server has its own tests",
     "tests/stream.spec.ts": "needs @deepseek-ai/dsh-host-webserver (the DSH web server)",

package/plugins/acryl-state/NOTICE

@@ -0,0 +1,30 @@
+acryl-state
+
+Copyright (c) 2026 WebBoxes s.r.o.
+Licensed under the MIT License (see LICENSE).
+
+The cell and derived-cell shape follows VanJS (https://vanjs.org). The code is a new implementation; the notice of that work is kept here.
+
+---
+
+VanJS
+
+Copyright (c) 2023 VanJS (Vanilla JavaScript)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/plugins/acryl-state/plugin.json

@@ -8,5 +8,5 @@
     "@deepseek-ai/cordis": "4.0.4"
   },
   "mount": "root.plugin(state); ctx.state.cell('todos.count', 0), then count.update((n) => n + 1)",
-  "omit": ["src/react.ts"]
+  "omit": ["src/react.ts", "**/*.test.*", "**/*.case.ts"]
 }

package/plugins/acryl-state/src/cell.ts

@@ -1,6 +1,6 @@
 /**
  * Observable cells: the reactive core of the state service, with no Cordis and no DOM. A cell holds one value, tells its
- * subscribers when it changes, and can be derived from other cells. The shape is a writable cell and a derived cell
+ * subscribers when it changes, and can be derived from other cells. The shape follows VanJS's `state` and `derive`
  * (spec 046, M5): small enough to read in one sitting, and the same cell serves a React hook, a terminal component and a
  * server-sent stream.
  */

package/plugins/acryl-state/src/service.ts

@@ -6,9 +6,9 @@
  */
 
 import { Context, Service } from '@deepseek-ai/cordis'
-import type { RouteContext } from '../../acryl-router/src/index.ts'
+import { App, type Context as RequestContext } from '../../acryl-router/src/index.ts'
 import { streamSSE } from '../../acryl-router/src/helpers/index.ts'
-import { loopbackOnly } from '../../acryl-router/src/middleware/index.ts'
+import { loopbackOnly, methodNotAllowed } from '../../acryl-router/src/middleware/index.ts'
 import { createCell, createDerived, type Cell, type ReadonlyCell } from './cell.ts'
 
 declare module '@deepseek-ai/cordis' {
@@ -17,6 +17,8 @@ declare module '@deepseek-ai/cordis' {
   }
 }
 
+const KEEP_ALIVE_MS = 15_000
+
 /** Stable Cordis plugin name, equal to the package name and the Loader row id. */
 export const name = 'acryl-state'
 
@@ -70,15 +72,29 @@ export class State extends Service {
   }
 
   /**
-   * The current value of `key` as a server-sent event stream: the value now, then one event per change, until the request is aborted, the client
-   * cancels, or the router is disposed. `streamSSE` holds the request in flight until then, so the router waits for the stream.
+   * The current value of `key` as a server-sent event stream: the value now, then one event per change, until the client cancels or the router
+   * is disposed (both abort the stream). A comment line goes out every 15 seconds so proxies and browsers keep an idle stream open.
    */
-  stream(key: string, c: RouteContext): Response | undefined {
+  stream(key: string, c: RequestContext): Response | undefined {
     const cell = this.find(key)
     if (cell === undefined) return undefined
-    return streamSSE(c, stream => {
-      stream.send(cell.get(), { event: 'value' })
-      return cell.subscribe(value => { stream.send(value, { event: 'value' }) })
+    return streamSSE(c, async stream => {
+      const ended = new Promise<void>(resolve => { stream.onAbort(resolve) })
+      // Writes are asynchronous; chaining them keeps events in the order the cell changed.
+      let queue: Promise<unknown> = Promise.resolve()
+      const send = (value: unknown): void => {
+        queue = queue.then(() => stream.writeSSE({ event: 'value', data: typeof value === 'string' ? value : JSON.stringify(value) })).catch(() => {})
+      }
+      send(cell.get())
+      const unsubscribe = cell.subscribe(send)
+      const keepAlive = setInterval(() => { queue = queue.then(() => stream.write(': keepalive\n\n')).catch(() => {}) }, KEEP_ALIVE_MS)
+      keepAlive.unref()
+      try {
+        await ended
+      } finally {
+        clearInterval(keepAlive)
+        unsubscribe()
+      }
     })
   }
 }
@@ -88,13 +104,15 @@ export function apply(ctx: Context): void {
   // The same cells on the router, read-only, for any surface; present only where a router is. A request over a socket must come from this machine to this
   // app; the terminal calls the router in process and is the host's own code.
   ctx.inject(['router'], inner => {
-    const api = inner.router.group('/api/state', loopbackOnly({ inProcess: 'allow' }))
-    api.get('/', c => c.json({ keys: state.keys() }))
-    api.get('/:key', c => {
-      const cell = state.find(c.param('key') ?? '')
-      return cell === undefined ? c.json({ error: 'no such state' }, 404) : c.json({ key: cell.key, value: cell.get() })
-    })
-    api.get('/:key/events', c => state.stream(c.param('key') ?? '', c) ?? c.json({ error: 'no such state' }, 404))
+    const api = new App()
+    api.use(loopbackOnly({ inProcess: 'allow' }), methodNotAllowed({ app: api }))
+      .get('/', c => c.json({ keys: state.keys() }))
+      .get('/:key', c => {
+        const cell = state.find(c.req.param('key'))
+        return cell === undefined ? c.json({ error: 'no such state' }, 404) : c.json({ key: cell.key, value: cell.get() })
+      })
+      .get('/:key/events', c => state.stream(c.req.param('key'), c) ?? c.json({ error: 'no such state' }, 404))
+    inner.router.route('/api/state', api)
     // Over HTTP only where an adapter exists (Web and Desktop); the terminal needs none.
     inner.inject(['routerHttp'], http => { http.routerHttp.mount('/api/state') })
   })

package/plugins/acryl-state/upstream.json

@@ -2,19 +2,21 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-state",
-    "commit": "11fed295161c0282d144b5ac62616988b58d8189"
+    "commit": "df79b188398b6d4f8cceda35a72b88300a10a9ce"
   },
   "vendored": [
     "src",
     "tests",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE"
   ],
   "rewrittenSpecifiers": 4,
-  "digest": "sha256:528bdc35dbbe22dfae8822fe054cfbfccae9554b9e06089dd7e269f44e27add4",
+  "digest": "sha256:8feb067a67ea2628ff31a9fd2201361be4be5a8c217be3b7169277c0ce472b69",
   "testsNotRun": {
     "tests/react.spec.ts": "needs react and @testing-library/react, which generated apps do not install"
   },
   "notice": [
-    "LICENSE"
+    "LICENSE",
+    "NOTICE"
   ]
 }

package/plugins/builder/script.ts

@@ -18,22 +18,19 @@ const PATH = /^\/[a-z0-9/-]*$/
 
 export function routeSource(name: string, path: string, text: string): string {
   return `import type { Context } from '@deepseek-ai/cordis'
+import { App } from 'acryl-router'
 
 /** Written by the builder: answers GET ${path}, and checks that it does before the install counts. */
 export const name = '${name}'
 export const inject = ['router']
 
-interface Router {
-  get(path: string, handler: (c: { json(body: unknown, status?: number): Response }) => Response): unknown
-  request(path: string): Promise<Response>
-}
 export function apply(ctx: Context) {
-  // A route registered through this plugin's context is removed when the plugin is unloaded.
-  (ctx as unknown as { router: Router }).router.get(${JSON.stringify(path)}, (c) => c.json({ text: ${JSON.stringify(text)} }))
+  // The app is mounted through this plugin's context, so the route is removed when the plugin is unloaded.
+  ctx.router.route('/', new App().get(${JSON.stringify(path)}, (c) => c.json({ text: ${JSON.stringify(text)} })))
 }
 
 export async function check(ctx: Context) {
-  const reply = await (ctx.get('router') as Router).request(${JSON.stringify(path)})
+  const reply = await ctx.get('router')!.request(${JSON.stringify(path)})
   if (!reply.ok) throw new Error(\`GET ${path} answered \${reply.status}\`)
 }
 `

package/plugins/extensions/index.ts

@@ -32,7 +32,7 @@ import { type Context, type Fiber, Service } from '@deepseek-ai/cordis'
 import type {} from '../instance/index.ts'
 import type { Sandbox } from '../sandbox/index.ts'
 import { appendLedger, type LedgerEntry, readLedger } from './ledger.ts'
-import { resolveFromApp } from './resolve.ts'
+import { resolveFromApp, routerAliases } from './resolve.ts'
 import { hashFolder, prune, stage } from './stage.ts'
 
 /** A fiber's lifecycle state, by name (Cordis's own enum is a `const enum`, which does not exist at run time). */
@@ -221,7 +221,7 @@ export class Extensions extends Service {
     this.ledgerFile = join(home, 'extensions-ledger.jsonl')
     // Effects run their disposers newest first: settle pending operations, then dispose every mounted extension, then drop the hook.
     ctx.effect(
-      () => resolveFromApp(this.stageRoot, root),
+      () => resolveFromApp(this.stageRoot, root, routerAliases()),
       'extensions: resolve staged imports from the app',
     )
     ctx.effect(

package/plugins/extensions/resolve.ts

@@ -3,20 +3,45 @@
  * `@deepseek-ai/cordis` would not find the app's `node_modules`. This resolve hook leaves resolution alone, and only when it fails for a
  * module inside the staging folder, resolves the same name from the app's project folder. Uses Node's public `module.registerHooks`
  * (ACRYL needed the same fallback on Deno); the returned function removes the hook.
+ *
+ * The framework plugins are not packages in an app (they are source under `src/plugins/`), so `aliases` names the files a framework specifier such as
+ * `acryl-router` stands for. A staged plugin then imports the same module the app itself runs, so `App` is the very class the router mounts.
  */
-import { mkdirSync, realpathSync } from 'node:fs'
+import { existsSync, mkdirSync, realpathSync } from 'node:fs'
 import { registerHooks } from 'node:module'
 import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const isBare = (specifier: string) => !/^[./]/.test(specifier) && !specifier.includes(':')
 
-export function resolveFromApp(stageRoot: string, appRoot: string): () => void {
+/** The router's specifiers, as files of the vendored plugin that sits beside this one; empty when the app has no router. */
+export function routerAliases(): Record<string, string> {
+  const src = new URL('../acryl-router/src/', import.meta.url)
+  const files = {
+    'acryl-router': 'index.ts',
+    'acryl-router/middleware': 'middleware/index.ts',
+    'acryl-router/helpers': 'helpers/index.ts',
+  }
+  return Object.fromEntries(
+    Object.entries(files)
+      .map(([specifier, file]) => [specifier, fileURLToPath(new URL(file, src))] as const)
+      .filter(([, path]) => existsSync(path)),
+  )
+}
+
+export function resolveFromApp(
+  stageRoot: string,
+  appRoot: string,
+  aliases: Record<string, string> = {},
+): () => void {
   mkdirSync(stageRoot, { recursive: true })
   const staged = pathToFileURL(`${realpathSync(stageRoot)}/`).href
   const parentURL = pathToFileURL(join(realpathSync(appRoot), 'package.json')).href
   const hook = registerHooks({
     resolve(specifier, context, nextResolve) {
+      const alias = aliases[specifier]
+      if (alias !== undefined && context.parentURL?.startsWith(staged))
+        return nextResolve(pathToFileURL(alias).href, context)
       try {
         return nextResolve(specifier, context)
       } catch (error) {

package/plugins/openai/prompt.ts

@@ -10,26 +10,28 @@ To add a capability:
 A plugin's index.ts is TypeScript that Node runs directly (erasable syntax only: no enums, no parameter properties):
 
   import type { Context } from '@deepseek-ai/cordis'
+  import { App } from 'acryl-router'
   export const name = 'hello'            // must equal the folder name
   export const inject = ['router']        // services it needs; it waits (pending) until they exist
-  interface Router { get(path: string, handler: (c: { json(body: unknown, status?: number): Response }) => Response): unknown; request(path: string): Promise<Response> }
   export function apply(ctx: Context) {
-    ;(ctx as unknown as { router: Router }).router.get('/hello', (c) => c.json({ text: 'Hello' }))   // removed when the plugin is unloaded
+    ctx.router.route('/', new App().get('/hello', (c) => c.json({ text: 'Hello' })))   // removed when the plugin is unloaded
   }
   export async function check(ctx: Context) {   // optional: must pass, or the install is rolled back
-    const reply = await (ctx.get('router') as Router).request('/hello')
+    const reply = await ctx.get('router')!.request('/hello')
     if (!reply.ok) throw new Error('GET /hello failed')
   }
 
-The router: router.get/post/put/delete(path, handler), a path parameter is :id and is read with c.param('id'), c.json(body, status)
-answers JSON, c.text(...) answers text, c.req.json() reads a JSON body, and router.request('/path', { method: 'POST', body: ... }) calls a route in
-process (use it in check). Every registration made from a plugin's own context goes away when the plugin is unloaded.
+The router: build an App (import { App } from 'acryl-router'), register routes on it with app.get/post/put/patch/delete(path, handler) and mount it with
+ctx.router.route(prefix, app). A path parameter is :id and is read with c.req.param('id'); c.json(body, status) answers JSON, c.text(...) answers text,
+await c.req.json() reads a JSON body, throw new HTTPException(404, { message }) (also from 'acryl-router') answers an error. Routes added to an app
+after route() are not served: build the whole app first. ctx.get('router')!.request('/path', { method: 'POST', body: ... }) calls a route in process (use it in
+check). The mount goes away when the plugin is unloaded.
 
 For a capability that is a pure function of data (parse, convert, compute), write a sandboxed TOOL instead of a plugin. It cannot touch the
 host: it runs in a separate process that can read only its own folder. Files: index.ts exporting  run(input)  and  tool.json:
   { "description": "what it does and its input", "examples": [ { "input": {...}, "output": {...} } ] }
 The examples are run in the sandbox at install and must match exactly, or the install is refused. Use write_plugin and install_plugin for tools too.
 
-Rules: import only relative files, node: built-ins and @deepseek-ai/cordis. Provide services with ctx.provide(name, value) and
+Rules: import only relative files, node: built-ins, @deepseek-ai/cordis and acryl-router. Provide services with ctx.provide(name, value) and
 use others with ctx.get(name). Put timers, listeners and routes inside ctx.effect(() => cleanup). Use list_plugins and
 read_plugin to see what exists. When you are done, answer in one or two plain sentences saying what you built.`

package/plugins/tsconfig.json

@@ -1,12 +1,10 @@
 {
   "compilerOptions": {
-    "target": "ES2023",
-    "lib": ["ES2023"],
+    "target": "ES2024",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
     "noImplicitOverride": true,
     "verbatimModuleSyntax": true,
     "erasableSyntaxOnly": true,
@@ -17,6 +15,9 @@
   },
   "include": ["*/**/*.ts"],
   "exclude": [
+    "acryl-*/src/**/*.test.ts",
+    "acryl-*/src/**/*.case.ts",
+    "acryl-node-server/tests/adapter",
     "acryl-router/tests/loader.spec.ts",
     "acryl-state/src/react.ts",
     "acryl-state/tests/react.spec.ts",

package/templates/agent/src/routes.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis'
-import { readJson } from './plugins/acryl-router/src/helpers/index.ts'
-import type {} from './plugins/acryl-router/src/index.ts'
+import { App } from './plugins/acryl-router/src/index.ts'
+import { bodyLimit } from './plugins/acryl-router/src/middleware/index.ts'
 import type {} from './plugins/agent/index.ts'
 import type {} from './plugins/extensions/index.ts'
 import type {} from './plugins/tasks/index.ts'
@@ -10,44 +10,54 @@ export const APP_NAME = '__APP_NAME__'
 /**
  * The app's own routes on the router: `POST /ask` for the agent; `GET /extensions` and `GET /tasks` to observe what it did (every run is a
  * durable task owning one task per tool call); `POST /tasks/cancel`. What changes is also streamed: `GET /api/state/tasks/events` and
- * `GET /api/state/extensions/events`. A route registered from this plugin's context is removed when the plugin is disposed.
+ * `GET /api/state/extensions/events`. The mount is removed when the plugin is disposed.
  */
 export const routes = {
   name: 'routes',
   inject: ['router', 'agent', 'extensions', 'tasks'],
   apply(ctx: Context) {
-    const { router } = ctx
-    router.get('/', (c) => c.json({ app: APP_NAME, ok: true }))
-    router.get('/health', (c) => c.json({ ok: true }))
-    router.get('/extensions', (c) =>
-      c.json({
-        installed: ctx.extensions.list(),
-        notInstalled: ctx.extensions.pending(),
-        waitingForApproval: ctx.extensions.approvals(),
-      }),
-    )
+    // A body here is a name, an id or a question; anything bigger is refused before it is read.
+    const json = async (c: {
+      req: { json(): Promise<unknown> }
+    }): Promise<Record<string, unknown>> => {
+      const body = await c.req.json().catch(() => undefined)
+      return typeof body === 'object' && body !== null ? (body as Record<string, unknown>) : {}
+    }
+    const app = new App()
+      .use(bodyLimit({ maxSize: 64 * 1024 }))
+      .get('/', (c) => c.json({ app: APP_NAME, ok: true }))
+      .get('/health', (c) => c.json({ ok: true }))
+      .get('/extensions', (c) =>
+        c.json({
+          installed: ctx.extensions.list(),
+          notInstalled: ctx.extensions.pending(),
+          waitingForApproval: ctx.extensions.approvals(),
+        }),
+      )
     // The owner's decision on an install that is waiting (the `approval` parameter in blend.yaml).
     for (const [path, decide] of [
       ['/extensions/approve', (name: string) => ctx.extensions.approve(name)],
       ['/extensions/deny', (name: string) => ctx.extensions.deny(name)],
     ] as const) {
-      router.post(path, async (c) => {
-        const name = ((await readJson(c)) as { name?: unknown } | undefined)?.name
+      app.post(path, async (c) => {
+        const { name } = await json(c)
         if (typeof name !== 'string') return c.json({ error: 'name must be a string' }, 400)
         return c.json(await decide(name))
       })
     }
-    router.get('/tasks', (c) => c.json(ctx.tasks.list().slice(0, 100)))
-    router.post('/tasks/cancel', async (c) => {
-      const id = ((await readJson(c)) as { id?: unknown } | undefined)?.id
-      if (typeof id !== 'string' || !ctx.tasks.get(id))
-        return c.json({ error: 'no such task' }, 404)
-      return c.json({ cancelled: ctx.tasks.cancel(id) })
-    })
-    router.post('/ask', async (c) => {
-      const question = ((await readJson(c)) as { question?: unknown } | undefined)?.question
-      if (typeof question !== 'string') return c.json({ error: 'question must be a string' }, 400)
-      return c.json(await ctx.agent.run(question))
-    })
+    app
+      .get('/tasks', (c) => c.json(ctx.tasks.list().slice(0, 100)))
+      .post('/tasks/cancel', async (c) => {
+        const { id } = await json(c)
+        if (typeof id !== 'string' || !ctx.tasks.get(id))
+          return c.json({ error: 'no such task' }, 404)
+        return c.json({ cancelled: ctx.tasks.cancel(id) })
+      })
+      .post('/ask', async (c) => {
+        const { question } = await json(c)
+        if (typeof question !== 'string') return c.json({ error: 'question must be a string' }, 400)
+        return c.json(await ctx.agent.run(question))
+      })
+    ctx.router.route('/', app)
   },
 }

package/templates/agent/test/model.test.ts

@@ -10,11 +10,12 @@ import { pinnedInstance, withPort } from '../src/plugins/instance/index.ts'
 
 /** A plugin no scripted command knows: the model writes it from scratch. */
 const COUNTER = `import type { Context } from '@deepseek-ai/cordis'
+import { App } from 'acryl-router'
 export const name = 'counter'
 export const inject = ['router']
 export function apply(ctx: Context) {
   let count = 0
-  ctx.router.get('/count', (c) => c.json({ count: ++count }))
+  ctx.router.route('/', new App().get('/count', (c) => c.json({ count: ++count })))
 }
 `
 

package/templates/agent/tsconfig.json

@@ -1,19 +1,22 @@
 {
   "compilerOptions": {
-    "target": "ES2023",
-    "lib": ["ES2023"],
+    "target": "ES2024",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
     "noImplicitOverride": true,
     "verbatimModuleSyntax": true,
     "erasableSyntaxOnly": true,
     "allowImportingTsExtensions": true,
     "noEmit": true,
     "skipLibCheck": true,
-    "types": ["node"]
+    "types": ["node"],
+    "paths": {
+      "acryl-router": ["./src/plugins/acryl-router/src/index.ts"],
+      "acryl-router/middleware": ["./src/plugins/acryl-router/src/middleware/index.ts"],
+      "acryl-router/helpers": ["./src/plugins/acryl-router/src/helpers/index.ts"]
+    }
   },
   "include": ["src", "test", "extensions"]
 }

package/templates/blank/src/routes.ts

@@ -1,14 +1,16 @@
 import type { Context } from '@deepseek-ai/cordis'
-import type {} from './plugins/acryl-router/src/index.ts'
+import { App } from './plugins/acryl-router/src/index.ts'
 
 export const APP_NAME = '__APP_NAME__'
 
-/** The app's own routes on the router. A route registered from this plugin's context is removed when the plugin is disposed. */
+/** The app's own routes: an `App` mounted on the router. The mount is removed when this plugin is disposed. */
 export const routes = {
   name: 'routes',
   inject: ['router'],
   apply(ctx: Context) {
-    ctx.router.get('/', (c) => c.json({ app: APP_NAME, ok: true }))
-    ctx.router.get('/health', (c) => c.json({ ok: true }))
+    const app = new App()
+      .get('/', (c) => c.json({ app: APP_NAME, ok: true }))
+      .get('/health', (c) => c.json({ ok: true }))
+    ctx.router.route('/', app)
   },
 }

package/templates/blank/tsconfig.json

@@ -1,12 +1,10 @@
 {
   "compilerOptions": {
-    "target": "ES2023",
-    "lib": ["ES2023"],
+    "target": "ES2024",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
     "noImplicitOverride": true,
     "verbatimModuleSyntax": true,
     "erasableSyntaxOnly": true,

package/templates/todo/src/page.ts

@@ -1,7 +1,7 @@
 /** The page: plain HTML and a few lines of script; it follows the list through the server-sent event stream. */
 export const PAGE = `<!doctype html>
 <meta charset="utf-8"><title>Todo</title>
-<style>body{font:16px system-ui;max-width:32rem;margin:2rem auto}li{display:flex;gap:.5rem;padding:.25rem 0}.done span{text-decoration:line-through;opacity:.6}</style>
+<style>body{font:16px system-ui;max-width:32rem;margin:2rem auto}ul{list-style:none;padding:0}li{display:flex;gap:.5rem;padding:.25rem 0}.done span{text-decoration:line-through;opacity:.6}</style>
 <h1>Todo</h1>
 <form id="add"><input id="title" placeholder="What needs doing?" autofocus> <button>Add</button></form>
 <ul id="list"></ul>

package/templates/todo/src/todo.ts

@@ -6,9 +6,9 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import type { Context } from '@deepseek-ai/cordis'
-import { HttpError } from './plugins/acryl-router/src/index.ts'
-import { loopbackOnly } from './plugins/acryl-router/src/middleware/index.ts'
-import { readJson, streamSSE, valid, validate, type StandardSchema } from './plugins/acryl-router/src/helpers/index.ts'
+import { App, HTTPException } from './plugins/acryl-router/src/index.ts'
+import { bodyLimit, loopbackOnly } from './plugins/acryl-router/src/middleware/index.ts'
+import { schemaValidator, streamSSE, type StandardSchema } from './plugins/acryl-router/src/helpers/index.ts'
 import type {} from './plugins/acryl-state/src/index.ts'
 import { PAGE } from './page.ts'
 
@@ -31,6 +31,19 @@ const NewTodo: StandardSchema<{ title: string }> = {
   },
 }
 
+/** Standard Schema for a change to a todo. */
+const TodoChange: StandardSchema<{ done: boolean }> = {
+  '~standard': {
+    validate: value => {
+      const done = (value as { done?: unknown } | null)?.done
+      return typeof done === 'boolean' ? { value: { done } } : { issues: [{ message: 'done must be true or false', path: ['done'] }] }
+    },
+  },
+}
+
+/** A todo body is small; anything bigger is refused before it is read. */
+const MAX_BODY_BYTES = 16 * 1024
+
 /** A missing file is a new list. Any other failure (unreadable, corrupt, half-written) refuses to start: starting empty would overwrite the user's real list on the first save. */
 function load(file: string | undefined): Todo[] {
   if (file === undefined) return []
@@ -65,32 +78,46 @@ export function apply(ctx: Context, config: Config = {}): void {
   }
   const nextId = (): number => todos.get().reduce((max, todo) => Math.max(max, todo.id), 0) + 1
 
-  const api = ctx.router.group('/todo', loopbackOnly({ inProcess: 'allow' }))
-  api.get('/', c => c.html(PAGE))
-  api.get('/api', c => c.json(todos.get()))
-  api.post('/api', validate('json', NewTodo), c => {
-    const todo: Todo = { id: nextId(), title: valid<{ title: string }>(c, 'json').title, done: false }
-    todos.update(list => [...list, todo])
-    return c.json(todo, 201)
-  })
-  api.patch('/api/:id', async c => {
-    const id = Number(c.param('id'))
-    const change = await readJson(c) as { done?: unknown }
-    if (!todos.get().some(todo => todo.id === id)) throw new HttpError(404, { message: 'no such todo' })
-    if (typeof change.done !== 'boolean') throw new HttpError(400, { message: 'done must be true or false' })
-    todos.update(list => list.map(todo => todo.id === id ? { ...todo, done: change.done as boolean } : todo))
-    return c.json(todos.get().find(todo => todo.id === id))
-  })
-  api.delete('/api/:id', c => {
-    const id = Number(c.param('id'))
-    if (!todos.get().some(todo => todo.id === id)) throw new HttpError(404, { message: 'no such todo' })
-    todos.update(list => list.filter(todo => todo.id !== id))
-    return c.body(null, 204)
-  })
-  api.get('/events', c => streamSSE(c, stream => {
-    stream.send(todos.get())
-    return todos.subscribe(list => { stream.send(list) })
-  }))
+  const find = (id: number): Todo => {
+    const todo = todos.get().find(item => item.id === id)
+    if (todo === undefined) throw new HTTPException(404, { message: 'no such todo' })
+    return todo
+  }
+
+  const api = new App()
+    .use(loopbackOnly({ inProcess: 'allow' }), bodyLimit({ maxSize: MAX_BODY_BYTES }))
+    .get('/', c => c.html(PAGE))
+    .get('/api', c => c.json(todos.get()))
+    .post('/api', schemaValidator('json', NewTodo), c => {
+      const todo: Todo = { id: nextId(), title: c.req.valid('json').title, done: false }
+      todos.update(list => [...list, todo])
+      return c.json(todo, 201)
+    })
+    .patch('/api/:id', schemaValidator('json', TodoChange), c => {
+      const { id } = find(Number(c.req.param('id')))
+      const { done } = c.req.valid('json')
+      todos.update(list => list.map(todo => todo.id === id ? { ...todo, done } : todo))
+      return c.json(find(id))
+    })
+    .delete('/api/:id', c => {
+      const { id } = find(Number(c.req.param('id')))
+      todos.update(list => list.filter(todo => todo.id !== id))
+      return c.body(null, 204)
+    })
+    .get('/events', c => streamSSE(c, async stream => {
+      const ended = new Promise<void>(resolve => { stream.onAbort(resolve) })
+      // Writes are asynchronous; chaining them keeps events in the order the list changed.
+      let queue: Promise<unknown> = Promise.resolve()
+      const send = (list: readonly Todo[]): void => { queue = queue.then(() => stream.writeSSE({ data: JSON.stringify(list) })).catch(() => {}) }
+      send(todos.get())
+      const unsubscribe = todos.subscribe(send)
+      try {
+        await ended
+      } finally {
+        unsubscribe()
+      }
+    }))
+  ctx.router.route('/todo', api)
 
   ctx.inject(['routerHttp'], inner => { inner.routerHttp.mount('/todo') })
 }