acrylblends 0.3.0 → 0.4.1

package/plugins/acryl-router/tests/loopback-only.spec.ts

@@ -0,0 +1,80 @@
+/**
+ * `loopbackOnly`, the guard of a local app's own routes: the peer and port come from the transport, the `Host` names this app, and the
+ * `callers` rule decides whether any local program or only the app's own page may call.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { App, type ConnectionInfo } from '../src/index.ts'
+import { loopbackOnly, type LoopbackOptions } from '../src/middleware/index.ts'
+
+const PORT = 43_120
+const SELF = `http://127.0.0.1:${String(PORT)}`
+const LOCAL: ConnectionInfo = { remoteAddress: '127.0.0.1', localPort: PORT }
+
+function guarded(options: LoopbackOptions = {}): App {
+  return new App().use(loopbackOnly(options)).get('/x', c => c.text('read')).post('/x', c => c.text('changed'))
+}
+
+async function status(
+  app: App,
+  method: string,
+  headers: Record<string, string>,
+  connection: ConnectionInfo = LOCAL,
+): Promise<number> {
+  const response = await app.fetch(new Request(`${SELF}/x`, { method, headers: { host: `127.0.0.1:${String(PORT)}`, ...headers } }), { connection })
+  return response.status
+}
+
+describe('loopbackOnly, callers: local (the default)', () => {
+  const app = guarded()
+
+  it('lets a local program read and change, and a page of this app change', async () => {
+    expect(await status(app, 'GET', {})).toBe(200)
+    expect(await status(app, 'POST', {})).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF })).toBe(200)
+  })
+
+  it('refuses another origin\'s change, a foreign peer, a wrong port, a foreign Host and an in-process call', async () => {
+    expect(await status(app, 'POST', { origin: 'http://evil.test' })).toBe(403)
+    expect(await status(app, 'GET', {}, { remoteAddress: '192.168.1.5', localPort: PORT })).toBe(403)
+    expect(await status(app, 'GET', {}, { remoteAddress: '127.0.0.1', localPort: PORT + 1 })).toBe(403)
+    expect(await status(app, 'GET', { host: 'evil.test' })).toBe(403)
+    expect(await status(app, 'GET', {}, {})).toBe(403)
+  })
+
+  it('lets an in-process call through only when the host says so', async () => {
+    expect(await status(guarded({ inProcess: 'allow' }), 'GET', {}, {})).toBe(200)
+  })
+})
+
+describe('loopbackOnly, callers: own-page', () => {
+  const app = guarded({ callers: 'own-page', hostnames: ['127.0.0.1'] })
+
+  it('lets this app\'s page read and change with its exact Origin', async () => {
+    expect(await status(app, 'GET', { origin: SELF, 'sec-fetch-site': 'same-origin' })).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF, 'sec-fetch-site': 'same-origin' })).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF })).toBe(200)
+  })
+
+  it('lets a same-origin read without Origin through by its Referer, as browsers send it', async () => {
+    expect(await status(app, 'GET', { 'sec-fetch-site': 'same-origin', referer: `${SELF}/page?tab=1` })).toBe(200)
+  })
+
+  it('refuses a local program (no Origin), even for a read', async () => {
+    expect(await status(app, 'GET', {})).toBe(403)
+    expect(await status(app, 'POST', {})).toBe(403)
+  })
+
+  it('refuses a change that only has the read evidence, and Origin forms that are not exact', async () => {
+    expect(await status(app, 'POST', { 'sec-fetch-site': 'same-origin', referer: `${SELF}/` })).toBe(403)
+    expect(await status(app, 'POST', { origin: `${SELF}/` })).toBe(403)
+    expect(await status(app, 'POST', { origin: 'null' })).toBe(403)
+    expect(await status(app, 'POST', { origin: SELF, 'sec-fetch-site': 'same-site' })).toBe(403)
+  })
+
+  it('refuses another page, a Referer from elsewhere and a Host this app does not answer to', async () => {
+    expect(await status(app, 'GET', { origin: 'http://evil.test', 'sec-fetch-site': 'cross-site' })).toBe(403)
+    expect(await status(app, 'GET', { 'sec-fetch-site': 'same-origin', referer: 'http://evil.test/' })).toBe(403)
+    expect(await status(app, 'GET', { host: `localhost:${String(PORT)}`, origin: `http://localhost:${String(PORT)}` })).toBe(403)
+  })
+})

package/plugins/acryl-router/tests/service.spec.ts

@@ -1,13 +1,13 @@
 /**
- * The router as a Cordis service (spec 046, M1): the shared conformance suite through a real `Context`, then the
- * lifecycle mechanics the repo protocol requires: PENDING while the provider is missing, reactivation when it appears,
- * provider replacement without duplicate registrations, disposal, repeated mount and reload, and in-flight abort.
+ * The router as a Cordis service: mounts owned by the plugin that made them, and the lifecycle mechanics the repo protocol requires -
+ * PENDING while the provider is missing, reactivation when it appears, provider replacement without duplicate registrations, disposal,
+ * repeated mount and reload, in-flight abort, and streams that end with the router or with the plugin that serves them. Routing itself is covered by the core's own suite.
  */
 
 import { Context, type FiberState } from '@deepseek-ai/cordis'
 import { afterEach, describe, expect, it } from 'vitest'
-import { apply, Config, name, type Router } from '../src/index.ts'
-import { conformance, type Candidate } from './conformance.ts'
+import { streamSSE } from '../src/helpers/index.ts'
+import { apply, App, Config, connectionOf, HTTPException, name, type Router } from '../src/index.ts'
 
 const PENDING = 0 as FiberState.PENDING
 const ACTIVE = 2 as FiberState.ACTIVE
@@ -36,30 +36,93 @@ afterEach(async () => {
   while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
 })
 
-conformance('the Router service in a Cordis Context', async () => {
-  const { router } = await mountRouter()
-  const candidate: Candidate = {
-    route: (method, path, handler) => router.route(method, path, handler),
-    use: (path, middleware) => router.use(path, middleware),
-    fetch: request => router.fetch(request),
-    size: () => router.size,
-  }
-  return candidate
-})
-
-/** A consumer plugin that needs `router` and registers one route, the way the market will. */
+/** A consumer plugin that needs `router` and mounts one route, the way the Market does. */
 function consumer(path: string, label: string) {
   return {
     name: `consumer${label}`,
     inject: ['router'],
     apply(ctx: Context): void {
-      ctx.router.get(path, c => c.text(label))
+      ctx.router.route('/', new App().get(path, c => c.text(label)))
     },
   }
 }
 
 const get = (router: Router, path: string): Promise<Response> => router.fetch(new Request(`http://acryl.test${path}`))
 
+describe('acryl-router mounts', () => {
+  it('serves a mounted app under its path, with the app\'s own routes, middleware and error handler', async () => {
+    const { router } = await mountRouter()
+    const api = new App()
+      .use(async (c, next) => { await next(); c.header('x-api', 'yes') })
+      .get('/items/:id', c => c.json({ id: c.req.param('id') }))
+      .get('/boom', () => { throw new Error('boom') })
+      .onError((error, c) => c.json({ handled: error instanceof Error ? error.message : 'unknown' }, 418))
+    router.route('/api', api)
+
+    const item = await get(router, '/api/items/a%20b')
+    expect(await item.json()).toEqual({ id: 'a b' })
+    expect(item.headers.get('x-api')).toBe('yes')
+    const boom = await get(router, '/api/boom')
+    expect(boom.status).toBe(418)
+    expect(await boom.json()).toEqual({ handled: 'boom' })
+    expect((await get(router, '/items/a')).status).toBe(404)
+  })
+
+  it('removes a mount with its remover, idempotently, and keeps the others', async () => {
+    const { router } = await mountRouter()
+    const removeA = router.route('/', new App().get('/a', c => c.text('a')))
+    router.route('/', new App().get('/b', c => c.text('b')))
+    expect((await get(router, '/a')).status).toBe(200)
+    removeA()
+    removeA()
+    expect((await get(router, '/a')).status).toBe(404)
+    expect(await (await get(router, '/b')).text()).toBe('b')
+    router.route('/', new App().get('/a', c => c.text('a2')))
+    expect(await (await get(router, '/a')).text()).toBe('a2')
+  })
+
+  it('runs mounts in the order they were made, so an earlier mount\'s middleware wraps a later mount\'s routes', async () => {
+    const { router } = await mountRouter()
+    router.route('/', new App().use('/guarded/*', async c => c.text('denied', 401)))
+    router.route('/', new App().get('/guarded/x', c => c.text('secret')).get('/open', c => c.text('open')))
+    expect((await get(router, '/guarded/x')).status).toBe(401)
+    expect(await (await get(router, '/open')).text()).toBe('open')
+  })
+
+  it('takes one router-wide error handler and one not-found handler, owned by the caller', async () => {
+    const { router } = await mountRouter()
+    router.route('/', new App().get('/boom', () => { throw new Error('boom') }).get('/teapot', () => { throw new HTTPException(418, { message: 'short' }) }))
+    expect((await get(router, '/boom')).status).toBe(500)
+    expect((await get(router, '/teapot')).status).toBe(418)
+
+    const removeError = router.onError((_error, c) => c.text('custom', 503))
+    const removeNotFound = router.notFound(c => c.text('nothing here', 404))
+    expect(() => router.onError((_error, c) => c.text('second'))).toThrow(/already registered/)
+    expect((await get(router, '/boom')).status).toBe(503)
+    expect(await (await get(router, '/missing')).text()).toBe('nothing here')
+    removeError()
+    removeNotFound()
+    expect((await get(router, '/boom')).status).toBe(500)
+  })
+
+  it('treats /a and /a/ as one path when trailingSlash is ignore', async () => {
+    const ctx = root()
+    ctx.plugin(provider, { trailingSlash: 'ignore', disposeGraceMs: 2000 })
+    await settle()
+    ctx.router.route('/', new App().get('/a', c => c.text('a')))
+    expect((await get(ctx.router, '/a/')).status).toBe(200)
+  })
+
+  it('hands the transport\'s connection info to the handler and gives an in-process call an empty one', async () => {
+    const { router } = await mountRouter()
+    router.route('/', new App().get('/who', c => c.json({ remote: connectionOf(c).remoteAddress ?? null, port: connectionOf(c).localPort ?? null })))
+    const over = await router.fetch(new Request('http://acryl.test/who'), { remoteAddress: '127.0.0.1', localPort: 4000 })
+    expect(await over.json()).toEqual({ remote: '127.0.0.1', port: 4000 })
+    const inProcess = await router.request('/who')
+    expect(await inProcess.json()).toEqual({ remote: null, port: null })
+  })
+})
+
 describe('acryl-router lifecycle through Cordis', () => {
   it('leaves a consumer PENDING while router is missing and activates it when router appears', async () => {
     const ctx = root()
@@ -74,7 +137,7 @@ describe('acryl-router lifecycle through Cordis', () => {
     expect(ctx.router.size).toBe(1)
   })
 
-  it('removes a consumer\'s routes when the consumer unloads and leaves other consumers alone', async () => {
+  it('removes a consumer\'s mounts when the consumer unloads and leaves other consumers alone', async () => {
     const { ctx, router } = await mountRouter()
     const a = ctx.plugin(consumer('/a', 'A'))
     ctx.plugin(consumer('/b', 'B'))
@@ -89,6 +152,23 @@ describe('acryl-router lifecycle through Cordis', () => {
     expect(router.size).toBe(1)
   })
 
+  it('labels a mount by its path with one child per route, so no label grows with the app (an inspector caps label length)', async () => {
+    const { ctx, router } = await mountRouter()
+    const big = new App().use('/api/*', async (_c, next) => { await next() })
+    for (let i = 0; i < 60; i += 1) big.get(`/api/a-fairly-long-resource-name-${String(i)}`, c => c.text('ok'))
+    const fiber = ctx.plugin({ name: 'big', inject: ['router'], apply: (inner: Context) => { inner.router.route('/', big) } })
+    await settle()
+    const [mount, ...rest] = fiber.getEffects()
+    expect(rest).toEqual([])
+    expect(mount?.label).toBe('acryl-router: route /')
+    expect(mount?.children).toHaveLength(61)
+    expect(mount?.children[0]?.label).toBe('acryl-router: serves ALL /api/*')
+    expect(mount?.children.every(child => child.label.length < 100 && child.children.length === 0)).toBe(true)
+    expect(router.size).toBe(1)
+    await fiber.dispose()
+    expect(router.size).toBe(0)
+  })
+
   it('replaces the provider without leaving doubled registrations: consumers re-register exactly once', async () => {
     const ctx = root()
     const first = ctx.plugin(provider, config)
@@ -110,6 +190,54 @@ describe('acryl-router lifecycle through Cordis', () => {
     expect(await (await get(ctx.router, '/c')).text()).toBe('A')
   })
 
+  it('serves the routes an app had when it was mounted, whatever else changes later', async () => {
+    const { ctx, router } = await mountRouter()
+    const app = new App().get('/early', c => c.text('early'))
+    router.route('/', app)
+    app.get('/late', c => c.text('late'))
+    expect((await get(router, '/early')).status).toBe(200)
+    expect((await get(router, '/late')).status).toBe(404)
+    // Another plugin's mount recomposes the router; the late route still is not served.
+    ctx.plugin(consumer('/other', 'other'))
+    await settle()
+    expect((await get(router, '/other')).status).toBe(200)
+    expect((await get(router, '/late')).status).toBe(404)
+  })
+
+  it('serves two plugins on the same path in mount order, and hands the path to the other when the first unloads', async () => {
+    const { ctx, router } = await mountRouter()
+    const first = ctx.plugin(consumer('/same', 'first'))
+    await settle()
+    ctx.plugin(consumer('/same', 'second'))
+    await settle()
+    expect(await (await get(router, '/same')).text()).toBe('first')
+    await first.dispose()
+    await settle()
+    expect(await (await get(router, '/same')).text()).toBe('second')
+  })
+
+  it('runs a reloaded plugin\'s handler once per request: reloading leaves no duplicate route behind, ten times', async () => {
+    const { ctx, router } = await mountRouter()
+    let calls = 0
+    const counting = {
+      name: 'counting',
+      inject: ['router'],
+      apply(inner: Context): void {
+        inner.router.route('/', new App().use(async (_c, next) => { calls += 1; await next() }).get('/count', c => c.text(String(calls))))
+      },
+    }
+    for (let round = 0; round < 10; round += 1) {
+      const fiber = ctx.plugin(counting)
+      await settle()
+      expect(router.size).toBe(1)
+      calls = 0
+      expect(await (await get(router, '/count')).text()).toBe('1')
+      await fiber.dispose()
+      await settle()
+      expect(router.size).toBe(0)
+    }
+  })
+
   it('returns to its baseline after fifty consumer mount and unload cycles', async () => {
     const { ctx, router } = await mountRouter()
     ctx.plugin(consumer('/stay', 'S'))
@@ -119,10 +247,12 @@ describe('acryl-router lifecycle through Cordis', () => {
       const fiber = ctx.plugin(consumer(`/cycle/${String(i)}`, `C${String(i)}`))
       await settle()
       expect(router.size).toBe(baseline + 1)
+      expect(await (await get(router, `/cycle/${String(i)}`)).text()).toBe(`C${String(i)}`)
       await fiber.dispose()
       await settle()
     }
     expect(router.size).toBe(baseline)
+    expect((await get(router, '/cycle/0')).status).toBe(404)
   })
 
   it('aborts an in-flight request and waits for it when the router is disposed, then answers 503', async () => {
@@ -131,81 +261,166 @@ describe('acryl-router lifecycle through Cordis', () => {
     await settle()
     const router = ctx.router
     let aborted = false
-    router.get('/slow', async c => {
-      await new Promise<void>((_resolve, reject) => { c.signal.addEventListener('abort', () => { aborted = true; reject(new Error('aborted')) }, { once: true }) })
+    router.route('/', new App().get('/slow', async c => {
+      await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { aborted = true; reject(new Error('aborted')) }, { once: true }) })
       return c.text('late')
-    })
-    const pending = router.fetch(new Request('http://acryl.test/slow'))
+    }))
+    const pending = get(router, '/slow')
     await settle()
 
     await fiber.dispose()
     await settle()
     expect(aborted).toBe(true)
     expect((await pending).status).toBe(499)
-    expect((await router.fetch(new Request('http://acryl.test/slow'))).status).toBe(503)
+    expect((await get(router, '/slow')).status).toBe(503)
   })
 
-  it('hands the transport\'s connection info to the handler and gives an in-process call an empty one', async () => {
+  it('forwards the caller\'s own abort to the handler signal', async () => {
     const { router } = await mountRouter()
-    router.get('/who', c => c.json({ remote: c.connection.remoteAddress ?? null }))
-    const over = await router.fetch(new Request('http://acryl.test/who'), { remoteAddress: '127.0.0.1' })
-    expect(await over.json()).toEqual({ remote: '127.0.0.1' })
-    const inProcess = await router.fetch(new Request('http://acryl.test/who'))
-    expect(await inProcess.json()).toEqual({ remote: null })
+    let seen = false
+    router.route('/', new App().get('/slow', async c => {
+      await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { seen = true; reject(new Error('aborted')) }, { once: true }) })
+      return c.text('x')
+    }))
+    const controller = new AbortController()
+    const pending = router.fetch(new Request('http://acryl.test/slow', { signal: controller.signal }))
+    await settle()
+    controller.abort()
+    expect((await pending).status).toBe(499)
+    expect(seen).toBe(true)
   })
 
-  it('keeps a streaming request in flight through waitUntil: disposal aborts it and waits until it has ended', async () => {
+  it('ends a server-sent-event stream when the router is disposed: the stream\'s abort cleanup runs and the reader sees the end', async () => {
     const ctx = root()
     const fiber = ctx.plugin(provider, config)
     await settle()
-    const router = ctx.router
-    let ended = false
-    router.get('/stream', c => {
-      const body = new ReadableStream<Uint8Array>({
-        start(controller) {
-          const done = new Promise<void>(resolve => {
-            c.signal.addEventListener('abort', () => { ended = true; controller.close(); resolve() }, { once: true })
-          })
-          c.waitUntil(done)
-          controller.enqueue(new TextEncoder().encode('first'))
-        },
-      })
-      return new Response(body)
-    })
-    const response = await router.fetch(new Request('http://acryl.test/stream'))
-    expect(response.status).toBe(200)
+    let cleaned = false
+    ctx.router.route('/', new App().get('/events', c => streamSSE(c, async stream => {
+      stream.onAbort(() => { cleaned = true })
+      await stream.writeSSE({ data: 'first' })
+      while (!stream.aborted) await stream.sleep(10)
+    })))
+    const response = await get(ctx.router, '/events')
+    expect(response.headers.get('content-type')).toBe('text/event-stream')
     const reader = response.body!.getReader()
-    expect(new TextDecoder().decode((await reader.read()).value)).toBe('first')
+    expect(new TextDecoder().decode((await reader.read()).value)).toBe('data: first\n\n')
 
     await fiber.dispose()
-    expect(ended).toBe(true)
+    expect(cleaned).toBe(true)
+    await expect(reader.read()).resolves.toMatchObject({ done: true })
+  })
+
+  it('ends the stream a plugin opened when that plugin unloads, and leaves another plugin\'s request running', async () => {
+    const { ctx, router } = await mountRouter()
+    let cleaned = false
+    let otherAborted = false
+    let release!: () => void
+    const streaming = ctx.plugin({
+      name: 'streaming',
+      inject: ['router'],
+      apply(inner: Context): void {
+        inner.router.route('/', new App().get('/events', c => streamSSE(c, async stream => {
+          stream.onAbort(() => { cleaned = true })
+          await stream.writeSSE({ data: 'first' })
+          while (!stream.aborted) await stream.sleep(10)
+        })))
+      },
+    })
+    ctx.plugin({
+      name: 'other',
+      inject: ['router'],
+      apply(inner: Context): void {
+        inner.router.route('/', new App().get('/slow', async c => {
+          c.req.raw.signal.addEventListener('abort', () => { otherAborted = true }, { once: true })
+          await new Promise<void>(resolve => { release = resolve })
+          return c.text('done')
+        }))
+      },
+    })
+    await settle()
+    const response = await get(router, '/events')
+    const reader = response.body!.getReader()
+    expect(new TextDecoder().decode((await reader.read()).value)).toBe('data: first\n\n')
+    const slow = get(router, '/slow')
+    await settle()
+
+    await streaming.dispose()
+    expect(cleaned).toBe(true)
+    await expect(reader.read()).resolves.toMatchObject({ done: true })
+    expect(otherAborted).toBe(false)
+    release()
+    expect(await (await slow).text()).toBe('done')
+  })
+
+  it('aborts a request still inside an unloading plugin\'s middleware, but not one that middleware already passed on', async () => {
+    const { ctx, router } = await mountRouter()
+    let guardAborted = false
+    let handlerAborted = false
+    let release!: () => void
+    const guard = ctx.plugin({
+      name: 'guard',
+      inject: ['router'],
+      apply(inner: Context): void {
+        inner.router.route('/', new App()
+          .use('/held/*', async (c, next) => {
+            c.req.raw.signal.addEventListener('abort', () => { guardAborted = true }, { once: true })
+            await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { reject(new Error('aborted')) }, { once: true }) })
+            await next()
+          })
+          .use('/passed/*', async (_c, next) => { await next() }))
+      },
+    })
+    ctx.plugin({
+      name: 'handler',
+      inject: ['router'],
+      apply(inner: Context): void {
+        inner.router.route('/', new App()
+          .get('/held/x', c => c.text('held'))
+          .get('/passed/x', c => streamSSE(c, async stream => {
+            stream.onAbort(() => { handlerAborted = true })
+            await stream.writeSSE({ data: 'open' })
+            await new Promise<void>(resolve => { release = resolve })
+          })))
+      },
+    })
+    await settle()
+    const held = get(router, '/held/x')
+    const passed = await get(router, '/passed/x')
+    const reader = passed.body!.getReader()
+    await reader.read()
+
+    await guard.dispose()
+    expect(guardAborted).toBe(true)
+    expect((await held).status).toBe(499)
+    expect(handlerAborted).toBe(false)
+    release()
     await expect(reader.read()).resolves.toMatchObject({ done: true })
   })
 
+  it('keeps a request in flight through waitUntil until its task settles', async () => {
+    const ctx = root()
+    const fiber = ctx.plugin(provider, config)
+    await settle()
+    let finished = false
+    ctx.router.route('/', new App().get('/later', c => {
+      c.executionCtx.waitUntil(new Promise<void>(resolve => { setTimeout(() => { finished = true; resolve() }, 30) }))
+      return c.text('now')
+    }))
+    expect(await (await get(ctx.router, '/later')).text()).toBe('now')
+    expect(finished).toBe(false)
+    await fiber.dispose()
+    expect(finished).toBe(true)
+  })
+
   it('gives up on a request that ignores the abort after the grace period instead of hanging disposal', async () => {
     const ctx = root()
     const fiber = ctx.plugin(provider, { trailingSlash: 'strict', disposeGraceMs: 30 })
     await settle()
-    ctx.router.get('/stuck', c => { c.waitUntil(new Promise(() => undefined)); return c.text('x') })
-    await ctx.router.fetch(new Request('http://acryl.test/stuck'))
+    ctx.router.route('/', new App().get('/stuck', c => { c.executionCtx.waitUntil(new Promise(() => undefined)); return c.text('x') }))
+    await get(ctx.router, '/stuck')
     const started = Date.now()
     await fiber.dispose()
     expect(Date.now() - started).toBeLessThan(1000)
     expect(fiber.state).toBe(DISPOSED)
   })
-
-  it('forwards the caller\'s own abort to the handler signal', async () => {
-    const { router } = await mountRouter()
-    let seen = false
-    router.get('/slow', async c => {
-      await new Promise<void>((_resolve, reject) => { c.signal.addEventListener('abort', () => { seen = true; reject(new Error('aborted')) }, { once: true }) })
-      return c.text('x')
-    })
-    const controller = new AbortController()
-    const pending = router.fetch(new Request('http://acryl.test/slow', { signal: controller.signal }))
-    await settle()
-    controller.abort()
-    expect((await pending).status).toBe(499)
-    expect(seen).toBe(true)
-  })
 })

package/plugins/acryl-router/tests/shadow-state.spec.ts

@@ -0,0 +1,79 @@
+/**
+ * What a Service's fields look like to the plugins that call it. A plugin reaches a service through its own shadow of the instance
+ * (`ctx.counter` in plugin A and in plugin B are two different objects over one service), but reads and writes of fields pass through to
+ * the one instance: a field assigned in a method is seen by every caller, as is state kept in an object that is only mutated. What the
+ * shadow does change is `this.ctx` inside a method, which `live-install.spec.ts` covers.
+ */
+import { Context, Service } from '@deepseek-ai/cordis'
+import { afterEach, describe, expect, it } from 'vitest'
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    counter: Counter
+  }
+}
+
+const contexts: Context[] = []
+const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
+afterEach(async () => {
+  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
+})
+
+class Counter extends Service {
+  /** Reassigned by `assign`. */
+  assigned = 0
+  /** Created once, only mutated. */
+  private readonly state = { count: 0 }
+
+  constructor(ctx: Context) {
+    super(ctx, 'counter')
+  }
+
+  assign(): void {
+    this.assigned += 1
+  }
+
+  mutate(): void {
+    this.state.count += 1
+  }
+
+  get count(): number {
+    return this.state.count
+  }
+}
+
+async function twoCallers(): Promise<{ a: Context, b: Context }> {
+  const root = new Context()
+  contexts.push(root)
+  root.plugin({ name: 'counter', apply: (ctx: Context) => { new Counter(ctx) } })
+  const callers: Context[] = []
+  for (const name of ['a', 'b']) root.plugin({ name, inject: ['counter'], apply: (ctx: Context) => { callers.push(ctx) } })
+  await settle()
+  const [a, b] = callers
+  if (a === undefined || b === undefined) throw new Error('both callers should be active')
+  return { a, b }
+}
+
+describe('service state and the shadow context', () => {
+  it('shows a field assigned in a method through one caller to every caller', async () => {
+    const { a, b } = await twoCallers()
+    a.counter.assign()
+    b.counter.assign()
+    expect(a.counter.assigned).toBe(2)
+    expect(b.counter.assigned).toBe(2)
+  })
+
+  it('shows a field assigned from outside through one caller to every caller', async () => {
+    const { a, b } = await twoCallers()
+    a.counter.assigned = 5
+    expect(b.counter.assigned).toBe(5)
+  })
+
+  it('shares state kept in one object that is only mutated', async () => {
+    const { a, b } = await twoCallers()
+    a.counter.mutate()
+    b.counter.mutate()
+    expect(a.counter.count).toBe(2)
+    expect(b.counter.count).toBe(2)
+  })
+})

package/plugins/acryl-router/upstream.json

@@ -2,7 +2,7 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-router",
-    "commit": "11fed295161c0282d144b5ac62616988b58d8189"
+    "commit": "64e7c9d2e787f74b2da82492644fbbb46a601074"
   },
   "vendored": [
     "src",
@@ -10,7 +10,7 @@
     "LICENSE"
   ],
   "rewrittenSpecifiers": 0,
-  "digest": "sha256:3873e59cdc36ab606be983680dc2f338141563ebafb13b36215c6b7de7c80d42",
+  "digest": "sha256:9ad75d259a74b2a07fe1d8a269e7c83c30061acc90f8a1630e6049b68ba10aa3",
   "testsNotRun": {
     "tests/loader.spec.ts": "loads the built lib/ entry through the real Loader; the library ships source and has no build"
   },

package/plugins/acryl-router-http/plugin.json

@@ -7,5 +7,6 @@
   "dependencies": {
     "@deepseek-ai/cordis": "4.0.4"
   },
-  "mount": "not mounted: it is the library behind acryl-node-server"
+  "mount": "not mounted: it is the library behind acryl-node-server",
+  "omit": ["**/*.test.*", "**/*.case.ts"]
 }

package/plugins/acryl-router-http/src/bridge.ts

@@ -25,7 +25,9 @@ export function toRequest(req: IncomingMessage, signal: AbortSignal): Request {
   }
   const method = (req.method ?? 'GET').toUpperCase()
   if (method === 'GET' || method === 'HEAD') return new Request(url, { method, headers, signal })
-  return new Request(url, { method, headers, signal, body: Readable.toWeb(req) as ReadableStream, duplex: 'half' })
+  // Node's fetch requires `duplex: 'half'` for a streamed body; the DOM lib's `RequestInit` does not declare the field yet.
+  const init: RequestInit & { duplex: 'half' } = { method, headers, signal, body: Readable.toWeb(req) as ReadableStream, duplex: 'half' }
+  return new Request(url, init)
 }
 
 /**