acrylblends 0.4.0 → 0.5.0

package/plugins/acryl-router/tests/docs-examples.spec.ts

@@ -6,7 +6,7 @@ import { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { afterEach, describe, expect, it } from 'vitest'
 import { createMiddleware, schemaValidator, testClient } from '../src/helpers/index.ts'
-import { App, HTTPException, apply, name } from '../src/index.ts'
+import { Acryl, HTTPException, apply, name } from '../src/index.ts'
 import { methodNotAllowed } from '../src/middleware/index.ts'
 
 const contexts: Context[] = []
@@ -30,7 +30,7 @@ describe('getting-started.md', () => {
       name: 'todo',
       inject: ['router'],
       apply(inner) {
-        const app = new App()
+        const app = new Acryl()
           .get('/', c => c.json({ ok: true }))
           .get('/todos/:id', c => c.json({ id: c.req.param('id') }))
         inner.router.route('/todo', app)
@@ -45,7 +45,7 @@ describe('getting-started.md', () => {
 
 describe('routing.md', () => {
   it('serves the routes an app had at the mount, not ones added later', async () => {
-    const app = new App().get('/a', c => c.text('a'))
+    const app = new Acryl().get('/a', c => c.text('a'))
     const ctx = await withPlugin({ name: 'late', inject: ['router'], apply(inner) { inner.router.route('/x', app) } })
     app.get('/b', c => c.text('b'))
     expect((await ctx.router.request('/x/a')).status).toBe(200)
@@ -53,9 +53,9 @@ describe('routing.md', () => {
   })
 
   it('answers a wrong method with 404, or 405 and Allow with methodNotAllowed', async () => {
-    const plain = new App().get('/item', c => c.text('item'))
+    const plain = new Acryl().get('/item', c => c.text('item'))
     expect((await plain.request('/item', { method: 'POST' })).status).toBe(404)
-    const strict = new App()
+    const strict = new Acryl()
     strict.use(methodNotAllowed({ app: strict })).get('/item', c => c.text('item'))
     const response = await strict.request('/item', { method: 'POST' })
     expect(response.status).toBe(405)
@@ -69,7 +69,7 @@ describe('routing.md', () => {
   })
 
   it('uses a mounted app\'s onError for its routes', async () => {
-    const app = new App().get('/boom', () => { throw new Error('boom') })
+    const app = new Acryl().get('/boom', () => { throw new Error('boom') })
     app.onError((_error, c) => c.json({ error: 'internal_error' }, 500))
     const ctx = await withPlugin({ name: 'errors', inject: ['router'], apply(inner) { inner.router.route('/', app) } })
     expect(await (await ctx.router.request('/boom')).json()).toEqual({ error: 'internal_error' })
@@ -82,14 +82,14 @@ describe('context.md and middleware.md', () => {
       c.set('user', { name: 'ada' })
       await next()
     })
-    const app = new App().use(withUser).get('/me', c => c.json(c.var.user))
+    const app = new Acryl().use(withUser).get('/me', c => c.json(c.var.user))
     expect(await (await app.request('/me')).json()).toEqual({ name: 'ada' })
   })
 
   it('never throws from next(): the error is already a response and is left in c.error', async () => {
     let caught = false
     let seen: unknown
-    const app = new App()
+    const app = new Acryl()
       .use(async (c, next) => {
         try {
           await next()
@@ -105,7 +105,7 @@ describe('context.md and middleware.md', () => {
   })
 
   it('turns an HTTPException into its own response', async () => {
-    const app = new App().get('/', () => { throw new HTTPException(403, { message: 'not yours' }) })
+    const app = new Acryl().get('/', () => { throw new HTTPException(403, { message: 'not yours' }) })
     const response = await app.request('/')
     expect(response.status).toBe(403)
     expect(await response.text()).toBe('not yours')
@@ -117,7 +117,7 @@ describe('validation.md', () => {
     title: z.string().required(),
     done: z.boolean().default(false),
   })
-  const app = new App().post('/todos', schemaValidator('json', NewTodo), c => c.json({ todo: c.req.valid('json') }, 201))
+  const app = new Acryl().post('/todos', schemaValidator('json', NewTodo), c => c.json({ todo: c.req.valid('json') }, 201))
   const post = (body: string, type?: string): Promise<Response> =>
     Promise.resolve(app.request('/todos', { method: 'POST', body, headers: type === undefined ? {} : { 'content-type': type } }))
 
@@ -144,7 +144,7 @@ describe('validation.md', () => {
 
 describe('helpers.md', () => {
   it('calls a chained app through the typed test client', async () => {
-    const app = new App().get('/search', c => c.json({ query: c.req.query('q') }))
+    const app = new Acryl().get('/search', c => c.json({ query: c.req.query('q') }))
     const client = testClient(app)
     const response = await client.search.$get({ query: { q: 'cordis' } })
     expect(await response.json()).toEqual({ query: 'cordis' })

package/plugins/acryl-router/tests/live-install.spec.ts

@@ -7,7 +7,7 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis'
 import { afterEach, describe, expect, it } from 'vitest'
-import { App, apply, name } from '../src/index.ts'
+import { Acryl, apply, name } from '../src/index.ts'
 
 const contexts: Context[] = []
 const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
@@ -46,7 +46,7 @@ const extension = (): object => ({
   name: 'live-ext',
   inject: ['router'],
   apply(ctx: Context): void {
-    ctx.router.route('/', new App().get('/live', c => c.json({ ok: true })))
+    ctx.router.route('/', new Acryl().get('/live', c => c.json({ ok: true })))
   },
 })
 

package/plugins/acryl-router/tests/loader.spec.ts

@@ -11,7 +11,7 @@ import { join } from 'node:path'
 import { Context, type FiberState } from '@deepseek-ai/cordis'
 import { Loader } from '@deepseek-ai/cordis-plugin-loader'
 import { afterEach, describe, expect, it } from 'vitest'
-import { App } from '../src/index.ts'
+import { Acryl } from '../src/index.ts'
 
 const ACTIVE = 2 as FiberState.ACTIVE
 const DISPOSED = 4 as FiberState.DISPOSED
@@ -46,7 +46,7 @@ describe('acryl-router through a real Loader', () => {
   it('activates from the built entry and serves a request in process', async () => {
     const { ctx, entryId } = await mount()
     expect(entryOf(ctx, entryId).fiber?.state).toBe(ACTIVE)
-    ctx.router.route('/', new App().get('/ping', c => c.json({ ok: true })))
+    ctx.router.route('/', new Acryl().get('/ping', c => c.json({ ok: true })))
     const response = await ctx.router.fetch(new Request('http://acryl.test/ping'))
     expect(await response.json()).toEqual({ ok: true })
   })
@@ -66,7 +66,7 @@ describe('acryl-router through a real Loader', () => {
     expect(ctx.router).not.toBe(first)
     expect(ctx.router.size).toBe(0)
     expect((await first.fetch(new Request('http://acryl.test/x'))).status).toBe(503)
-    ctx.router.route('/', new App().get('/again', c => c.text('ok')))
+    ctx.router.route('/', new Acryl().get('/again', c => c.text('ok')))
     expect(await (await ctx.router.fetch(new Request('http://acryl.test/again'))).text()).toBe('ok')
   })
 })

package/plugins/acryl-router/tests/loopback-only.spec.ts

@@ -0,0 +1,80 @@
+/**
+ * `loopbackOnly`, the guard of a local app's own routes: the peer and port come from the transport, the `Host` names this app, and the
+ * `callers` rule decides whether any local program or only the app's own page may call.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { Acryl, type ConnectionInfo } from '../src/index.ts'
+import { loopbackOnly, type LoopbackOptions } from '../src/middleware/index.ts'
+
+const PORT = 43_120
+const SELF = `http://127.0.0.1:${String(PORT)}`
+const LOCAL: ConnectionInfo = { remoteAddress: '127.0.0.1', localPort: PORT }
+
+function guarded(options: LoopbackOptions = {}): Acryl {
+  return new Acryl().use(loopbackOnly(options)).get('/x', c => c.text('read')).post('/x', c => c.text('changed'))
+}
+
+async function status(
+  app: Acryl,
+  method: string,
+  headers: Record<string, string>,
+  connection: ConnectionInfo = LOCAL,
+): Promise<number> {
+  const response = await app.fetch(new Request(`${SELF}/x`, { method, headers: { host: `127.0.0.1:${String(PORT)}`, ...headers } }), { connection })
+  return response.status
+}
+
+describe('loopbackOnly, callers: local (the default)', () => {
+  const app = guarded()
+
+  it('lets a local program read and change, and a page of this app change', async () => {
+    expect(await status(app, 'GET', {})).toBe(200)
+    expect(await status(app, 'POST', {})).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF })).toBe(200)
+  })
+
+  it('refuses another origin\'s change, a foreign peer, a wrong port, a foreign Host and an in-process call', async () => {
+    expect(await status(app, 'POST', { origin: 'http://evil.test' })).toBe(403)
+    expect(await status(app, 'GET', {}, { remoteAddress: '192.168.1.5', localPort: PORT })).toBe(403)
+    expect(await status(app, 'GET', {}, { remoteAddress: '127.0.0.1', localPort: PORT + 1 })).toBe(403)
+    expect(await status(app, 'GET', { host: 'evil.test' })).toBe(403)
+    expect(await status(app, 'GET', {}, {})).toBe(403)
+  })
+
+  it('lets an in-process call through only when the host says so', async () => {
+    expect(await status(guarded({ inProcess: 'allow' }), 'GET', {}, {})).toBe(200)
+  })
+})
+
+describe('loopbackOnly, callers: own-page', () => {
+  const app = guarded({ callers: 'own-page', hostnames: ['127.0.0.1'] })
+
+  it('lets this app\'s page read and change with its exact Origin', async () => {
+    expect(await status(app, 'GET', { origin: SELF, 'sec-fetch-site': 'same-origin' })).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF, 'sec-fetch-site': 'same-origin' })).toBe(200)
+    expect(await status(app, 'POST', { origin: SELF })).toBe(200)
+  })
+
+  it('lets a same-origin read without Origin through by its Referer, as browsers send it', async () => {
+    expect(await status(app, 'GET', { 'sec-fetch-site': 'same-origin', referer: `${SELF}/page?tab=1` })).toBe(200)
+  })
+
+  it('refuses a local program (no Origin), even for a read', async () => {
+    expect(await status(app, 'GET', {})).toBe(403)
+    expect(await status(app, 'POST', {})).toBe(403)
+  })
+
+  it('refuses a change that only has the read evidence, and Origin forms that are not exact', async () => {
+    expect(await status(app, 'POST', { 'sec-fetch-site': 'same-origin', referer: `${SELF}/` })).toBe(403)
+    expect(await status(app, 'POST', { origin: `${SELF}/` })).toBe(403)
+    expect(await status(app, 'POST', { origin: 'null' })).toBe(403)
+    expect(await status(app, 'POST', { origin: SELF, 'sec-fetch-site': 'same-site' })).toBe(403)
+  })
+
+  it('refuses another page, a Referer from elsewhere and a Host this app does not answer to', async () => {
+    expect(await status(app, 'GET', { origin: 'http://evil.test', 'sec-fetch-site': 'cross-site' })).toBe(403)
+    expect(await status(app, 'GET', { 'sec-fetch-site': 'same-origin', referer: 'http://evil.test/' })).toBe(403)
+    expect(await status(app, 'GET', { host: `localhost:${String(PORT)}`, origin: `http://localhost:${String(PORT)}` })).toBe(403)
+  })
+})

package/plugins/acryl-router/tests/no-dom/consumer.ts

@@ -0,0 +1,11 @@
+/**
+ * A Host-only consumer: Node types and no DOM library. Typechecking this against the built `lib/types` proves every public entry point's
+ * declarations stand without the DOM library, which a server plugin should not need to load.
+ */
+
+import type * as Router from '../../src/index.ts'
+import type * as Client from '../../src/client.ts'
+import type * as Helpers from '../../src/helpers/index.ts'
+import type * as Middleware from '../../src/middleware/index.ts'
+
+export type Entries = [typeof Router, typeof Client, typeof Helpers, typeof Middleware]

package/plugins/acryl-router/tests/no-dom/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "lib": ["ES2024"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "exactOptionalPropertyTypes": true,
+    "noEmit": true,
+    "types": ["node"]
+  },
+  "files": ["consumer.ts"]
+}

package/plugins/acryl-router/tests/service.spec.ts

@@ -7,7 +7,7 @@
 import { Context, type FiberState } from '@deepseek-ai/cordis'
 import { afterEach, describe, expect, it } from 'vitest'
 import { streamSSE } from '../src/helpers/index.ts'
-import { apply, App, Config, connectionOf, HTTPException, name, type Router } from '../src/index.ts'
+import { apply, Acryl, Config, connectionOf, HTTPException, name, type Router } from '../src/index.ts'
 
 const PENDING = 0 as FiberState.PENDING
 const ACTIVE = 2 as FiberState.ACTIVE
@@ -42,7 +42,7 @@ function consumer(path: string, label: string) {
     name: `consumer${label}`,
     inject: ['router'],
     apply(ctx: Context): void {
-      ctx.router.route('/', new App().get(path, c => c.text(label)))
+      ctx.router.route('/', new Acryl().get(path, c => c.text(label)))
     },
   }
 }
@@ -52,7 +52,7 @@ const get = (router: Router, path: string): Promise<Response> => router.fetch(ne
 describe('acryl-router mounts', () => {
   it('serves a mounted app under its path, with the app\'s own routes, middleware and error handler', async () => {
     const { router } = await mountRouter()
-    const api = new App()
+    const api = new Acryl()
       .use(async (c, next) => { await next(); c.header('x-api', 'yes') })
       .get('/items/:id', c => c.json({ id: c.req.param('id') }))
       .get('/boom', () => { throw new Error('boom') })
@@ -70,28 +70,28 @@ describe('acryl-router mounts', () => {
 
   it('removes a mount with its remover, idempotently, and keeps the others', async () => {
     const { router } = await mountRouter()
-    const removeA = router.route('/', new App().get('/a', c => c.text('a')))
-    router.route('/', new App().get('/b', c => c.text('b')))
+    const removeA = router.route('/', new Acryl().get('/a', c => c.text('a')))
+    router.route('/', new Acryl().get('/b', c => c.text('b')))
     expect((await get(router, '/a')).status).toBe(200)
     removeA()
     removeA()
     expect((await get(router, '/a')).status).toBe(404)
     expect(await (await get(router, '/b')).text()).toBe('b')
-    router.route('/', new App().get('/a', c => c.text('a2')))
+    router.route('/', new Acryl().get('/a', c => c.text('a2')))
     expect(await (await get(router, '/a')).text()).toBe('a2')
   })
 
   it('runs mounts in the order they were made, so an earlier mount\'s middleware wraps a later mount\'s routes', async () => {
     const { router } = await mountRouter()
-    router.route('/', new App().use('/guarded/*', async c => c.text('denied', 401)))
-    router.route('/', new App().get('/guarded/x', c => c.text('secret')).get('/open', c => c.text('open')))
+    router.route('/', new Acryl().use('/guarded/*', async c => c.text('denied', 401)))
+    router.route('/', new Acryl().get('/guarded/x', c => c.text('secret')).get('/open', c => c.text('open')))
     expect((await get(router, '/guarded/x')).status).toBe(401)
     expect(await (await get(router, '/open')).text()).toBe('open')
   })
 
   it('takes one router-wide error handler and one not-found handler, owned by the caller', async () => {
     const { router } = await mountRouter()
-    router.route('/', new App().get('/boom', () => { throw new Error('boom') }).get('/teapot', () => { throw new HTTPException(418, { message: 'short' }) }))
+    router.route('/', new Acryl().get('/boom', () => { throw new Error('boom') }).get('/teapot', () => { throw new HTTPException(418, { message: 'short' }) }))
     expect((await get(router, '/boom')).status).toBe(500)
     expect((await get(router, '/teapot')).status).toBe(418)
 
@@ -109,13 +109,13 @@ describe('acryl-router mounts', () => {
     const ctx = root()
     ctx.plugin(provider, { trailingSlash: 'ignore', disposeGraceMs: 2000 })
     await settle()
-    ctx.router.route('/', new App().get('/a', c => c.text('a')))
+    ctx.router.route('/', new Acryl().get('/a', c => c.text('a')))
     expect((await get(ctx.router, '/a/')).status).toBe(200)
   })
 
   it('hands the transport\'s connection info to the handler and gives an in-process call an empty one', async () => {
     const { router } = await mountRouter()
-    router.route('/', new App().get('/who', c => c.json({ remote: connectionOf(c).remoteAddress ?? null, port: connectionOf(c).localPort ?? null })))
+    router.route('/', new Acryl().get('/who', c => c.json({ remote: connectionOf(c).remoteAddress ?? null, port: connectionOf(c).localPort ?? null })))
     const over = await router.fetch(new Request('http://acryl.test/who'), { remoteAddress: '127.0.0.1', localPort: 4000 })
     expect(await over.json()).toEqual({ remote: '127.0.0.1', port: 4000 })
     const inProcess = await router.request('/who')
@@ -152,6 +152,23 @@ describe('acryl-router lifecycle through Cordis', () => {
     expect(router.size).toBe(1)
   })
 
+  it('labels a mount by its path with one child per route, so no label grows with the app (an inspector caps label length)', async () => {
+    const { ctx, router } = await mountRouter()
+    const big = new Acryl().use('/api/*', async (_c, next) => { await next() })
+    for (let i = 0; i < 60; i += 1) big.get(`/api/a-fairly-long-resource-name-${String(i)}`, c => c.text('ok'))
+    const fiber = ctx.plugin({ name: 'big', inject: ['router'], apply: (inner: Context) => { inner.router.route('/', big) } })
+    await settle()
+    const [mount, ...rest] = fiber.getEffects()
+    expect(rest).toEqual([])
+    expect(mount?.label).toBe('acryl-router: route /')
+    expect(mount?.children).toHaveLength(61)
+    expect(mount?.children[0]?.label).toBe('acryl-router: serves ALL /api/*')
+    expect(mount?.children.every(child => child.label.length < 100 && child.children.length === 0)).toBe(true)
+    expect(router.size).toBe(1)
+    await fiber.dispose()
+    expect(router.size).toBe(0)
+  })
+
   it('replaces the provider without leaving doubled registrations: consumers re-register exactly once', async () => {
     const ctx = root()
     const first = ctx.plugin(provider, config)
@@ -175,7 +192,7 @@ describe('acryl-router lifecycle through Cordis', () => {
 
   it('serves the routes an app had when it was mounted, whatever else changes later', async () => {
     const { ctx, router } = await mountRouter()
-    const app = new App().get('/early', c => c.text('early'))
+    const app = new Acryl().get('/early', c => c.text('early'))
     router.route('/', app)
     app.get('/late', c => c.text('late'))
     expect((await get(router, '/early')).status).toBe(200)
@@ -206,7 +223,7 @@ describe('acryl-router lifecycle through Cordis', () => {
       name: 'counting',
       inject: ['router'],
       apply(inner: Context): void {
-        inner.router.route('/', new App().use(async (_c, next) => { calls += 1; await next() }).get('/count', c => c.text(String(calls))))
+        inner.router.route('/', new Acryl().use(async (_c, next) => { calls += 1; await next() }).get('/count', c => c.text(String(calls))))
       },
     }
     for (let round = 0; round < 10; round += 1) {
@@ -244,7 +261,7 @@ describe('acryl-router lifecycle through Cordis', () => {
     await settle()
     const router = ctx.router
     let aborted = false
-    router.route('/', new App().get('/slow', async c => {
+    router.route('/', new Acryl().get('/slow', async c => {
       await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { aborted = true; reject(new Error('aborted')) }, { once: true }) })
       return c.text('late')
     }))
@@ -261,7 +278,7 @@ describe('acryl-router lifecycle through Cordis', () => {
   it('forwards the caller\'s own abort to the handler signal', async () => {
     const { router } = await mountRouter()
     let seen = false
-    router.route('/', new App().get('/slow', async c => {
+    router.route('/', new Acryl().get('/slow', async c => {
       await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { seen = true; reject(new Error('aborted')) }, { once: true }) })
       return c.text('x')
     }))
@@ -278,7 +295,7 @@ describe('acryl-router lifecycle through Cordis', () => {
     const fiber = ctx.plugin(provider, config)
     await settle()
     let cleaned = false
-    ctx.router.route('/', new App().get('/events', c => streamSSE(c, async stream => {
+    ctx.router.route('/', new Acryl().get('/events', c => streamSSE(c, async stream => {
       stream.onAbort(() => { cleaned = true })
       await stream.writeSSE({ data: 'first' })
       while (!stream.aborted) await stream.sleep(10)
@@ -302,7 +319,7 @@ describe('acryl-router lifecycle through Cordis', () => {
       name: 'streaming',
       inject: ['router'],
       apply(inner: Context): void {
-        inner.router.route('/', new App().get('/events', c => streamSSE(c, async stream => {
+        inner.router.route('/', new Acryl().get('/events', c => streamSSE(c, async stream => {
           stream.onAbort(() => { cleaned = true })
           await stream.writeSSE({ data: 'first' })
           while (!stream.aborted) await stream.sleep(10)
@@ -313,7 +330,7 @@ describe('acryl-router lifecycle through Cordis', () => {
       name: 'other',
       inject: ['router'],
       apply(inner: Context): void {
-        inner.router.route('/', new App().get('/slow', async c => {
+        inner.router.route('/', new Acryl().get('/slow', async c => {
           c.req.raw.signal.addEventListener('abort', () => { otherAborted = true }, { once: true })
           await new Promise<void>(resolve => { release = resolve })
           return c.text('done')
@@ -344,7 +361,7 @@ describe('acryl-router lifecycle through Cordis', () => {
       name: 'guard',
       inject: ['router'],
       apply(inner: Context): void {
-        inner.router.route('/', new App()
+        inner.router.route('/', new Acryl()
           .use('/held/*', async (c, next) => {
             c.req.raw.signal.addEventListener('abort', () => { guardAborted = true }, { once: true })
             await new Promise<void>((_resolve, reject) => { c.req.raw.signal.addEventListener('abort', () => { reject(new Error('aborted')) }, { once: true }) })
@@ -357,7 +374,7 @@ describe('acryl-router lifecycle through Cordis', () => {
       name: 'handler',
       inject: ['router'],
       apply(inner: Context): void {
-        inner.router.route('/', new App()
+        inner.router.route('/', new Acryl()
           .get('/held/x', c => c.text('held'))
           .get('/passed/x', c => streamSSE(c, async stream => {
             stream.onAbort(() => { handlerAborted = true })
@@ -385,7 +402,7 @@ describe('acryl-router lifecycle through Cordis', () => {
     const fiber = ctx.plugin(provider, config)
     await settle()
     let finished = false
-    ctx.router.route('/', new App().get('/later', c => {
+    ctx.router.route('/', new Acryl().get('/later', c => {
       c.executionCtx.waitUntil(new Promise<void>(resolve => { setTimeout(() => { finished = true; resolve() }, 30) }))
       return c.text('now')
     }))
@@ -399,7 +416,7 @@ describe('acryl-router lifecycle through Cordis', () => {
     const ctx = root()
     const fiber = ctx.plugin(provider, { trailingSlash: 'strict', disposeGraceMs: 30 })
     await settle()
-    ctx.router.route('/', new App().get('/stuck', c => { c.executionCtx.waitUntil(new Promise(() => undefined)); return c.text('x') }))
+    ctx.router.route('/', new Acryl().get('/stuck', c => { c.executionCtx.waitUntil(new Promise(() => undefined)); return c.text('x') }))
     await get(ctx.router, '/stuck')
     const started = Date.now()
     await fiber.dispose()

package/plugins/acryl-router/upstream.json

@@ -2,15 +2,15 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-router",
-    "commit": "df79b188398b6d4f8cceda35a72b88300a10a9ce"
+    "commit": "f5151e7f0c4de3b81bddb5cc686b5ef329e48e1c"
   },
   "vendored": [
     "src",
     "tests",
     "LICENSE"
   ],
-  "rewrittenSpecifiers": 0,
-  "digest": "sha256:6e15f8ce0499b94c95649342f6fe984bc9b2aec0f5a142e8853a5badcc3b85f5",
+  "rewrittenSpecifiers": 4,
+  "digest": "sha256:543a5ca99518eea1fe2e319b7708d62af34a6c24ab3daeb17dde48d67d319d6a",
   "testsNotRun": {
     "tests/loader.spec.ts": "loads the built lib/ entry through the real Loader; the library ships source and has no build"
   },

package/plugins/acryl-router-http/tests/adapter.spec.ts

@@ -8,7 +8,7 @@ import { Context, type FiberState } from '@deepseek-ai/cordis'
 import WebServer from '@deepseek-ai/dsh-host-webserver'
 import { apply as routerApply, name as routerName } from '../../acryl-router/src/index.ts'
 import { afterEach, describe, expect, it } from 'vitest'
-import { App, connectionOf, type RouterHttpService } from '../../acryl-router/src/index.ts'
+import { Acryl, connectionOf, type RouterHttpService } from '../../acryl-router/src/index.ts'
 import { methodNotAllowed } from '../../acryl-router/src/middleware/index.ts'
 import { apply, inject, name } from '../src/index.ts'
 
@@ -40,13 +40,13 @@ async function stack(): Promise<{ ctx: Context, base: () => string }> {
   return { ctx, base: () => `http://127.0.0.1:${String((ctx as unknown as { webServer: { port: number } }).webServer.port)}` }
 }
 
-function demo(prefix: string, extra?: (app: App) => void) {
+function demo(prefix: string, extra?: (app: Acryl) => void) {
   return {
     name: `demo${prefix.replaceAll('/', '-')}`,
     inject: ['router', 'routerHttp'],
     apply(ctx: Context): void {
       ctx.routerHttp.mount(prefix)
-      const app = new App()
+      const app = new Acryl()
       app.use(methodNotAllowed({ app }))
       app.get('/hello/:who', c => c.json({ hello: c.req.param('who'), q: c.req.query('q') ?? null, host: c.req.header('host') !== undefined }))
       app.post('/echo', async c => c.json({ got: await c.req.text(), type: c.req.header('content-type') ?? null }, 201))

package/plugins/acryl-router-http/tests/surfaces.spec.ts

@@ -7,7 +7,7 @@
 
 import { Context } from '@deepseek-ai/cordis'
 import WebServer from '@deepseek-ai/dsh-host-webserver'
-import { App, apply as routerApply, name as routerName } from '../../acryl-router/src/index.ts'
+import { Acryl, apply as routerApply, name as routerName } from '../../acryl-router/src/index.ts'
 import { afterEach, describe, expect, it } from 'vitest'
 import { apply as httpApply, inject as httpInject, name as httpName } from '../src/index.ts'
 
@@ -28,7 +28,7 @@ const notes = {
   inject: ['router'],
   apply(ctx: Context): void {
     const store = new Map<string, string>()
-    const app = new App()
+    const app = new Acryl()
       .post('/:id', async c => {
         const text = await c.req.text()
         store.set(c.req.param('id'), text)

package/plugins/acryl-router-http/upstream.json

@@ -2,7 +2,7 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-router-http",
-    "commit": "df79b188398b6d4f8cceda35a72b88300a10a9ce"
+    "commit": "f5151e7f0c4de3b81bddb5cc686b5ef329e48e1c"
   },
   "vendored": [
     "src",
@@ -10,7 +10,7 @@
     "LICENSE"
   ],
   "rewrittenSpecifiers": 7,
-  "digest": "sha256:29ba7834cf9d29e9af2f4fac265c7e5e220e06da3346e65c29bcbae41fdfaf9e",
+  "digest": "sha256:394994528a104c8f788e2d911f8f940ff9f74e9c5a72835ea3ea751651aa9fbd",
   "testsNotRun": {
     "tests/adapter.spec.ts": "needs @deepseek-ai/dsh-host-webserver (the DSH web server); acryl-node-server has its own tests",
     "tests/stream.spec.ts": "needs @deepseek-ai/dsh-host-webserver (the DSH web server)",

package/plugins/acryl-state/src/service.ts

@@ -6,7 +6,7 @@
  */
 
 import { Context, Service } from '@deepseek-ai/cordis'
-import { App, type Context as RequestContext } from '../../acryl-router/src/index.ts'
+import { Acryl, type Context as RequestContext } from '../../acryl-router/src/index.ts'
 import { streamSSE } from '../../acryl-router/src/helpers/index.ts'
 import { loopbackOnly, methodNotAllowed } from '../../acryl-router/src/middleware/index.ts'
 import { createCell, createDerived, type Cell, type ReadonlyCell } from './cell.ts'
@@ -104,7 +104,7 @@ export function apply(ctx: Context): void {
   // The same cells on the router, read-only, for any surface; present only where a router is. A request over a socket must come from this machine to this
   // app; the terminal calls the router in process and is the host's own code.
   ctx.inject(['router'], inner => {
-    const api = new App()
+    const api = new Acryl()
     api.use(loopbackOnly({ inProcess: 'allow' }), methodNotAllowed({ app: api }))
       .get('/', c => c.json({ keys: state.keys() }))
       .get('/:key', c => {

package/plugins/acryl-state/upstream.json

@@ -2,7 +2,7 @@
   "source": {
     "repo": "acryldev/acryl",
     "path": "plugins/acryl-state",
-    "commit": "df79b188398b6d4f8cceda35a72b88300a10a9ce"
+    "commit": "f5151e7f0c4de3b81bddb5cc686b5ef329e48e1c"
   },
   "vendored": [
     "src",
@@ -11,7 +11,7 @@
     "NOTICE"
   ],
   "rewrittenSpecifiers": 4,
-  "digest": "sha256:8feb067a67ea2628ff31a9fd2201361be4be5a8c217be3b7169277c0ce472b69",
+  "digest": "sha256:18df69d338a1928fc0f7497c14c245afb98f0c39d4fe6a24bda62bb845d96030",
   "testsNotRun": {
     "tests/react.spec.ts": "needs react and @testing-library/react, which generated apps do not install"
   },

package/plugins/builder/script.ts

@@ -18,7 +18,7 @@ const PATH = /^\/[a-z0-9/-]*$/
 
 export function routeSource(name: string, path: string, text: string): string {
   return `import type { Context } from '@deepseek-ai/cordis'
-import { App } from 'acryl-router'
+import { Acryl } from 'acrylblends'
 
 /** Written by the builder: answers GET ${path}, and checks that it does before the install counts. */
 export const name = '${name}'
@@ -26,11 +26,11 @@ export const inject = ['router']
 
 export function apply(ctx: Context) {
   // The app is mounted through this plugin's context, so the route is removed when the plugin is unloaded.
-  ctx.router.route('/', new App().get(${JSON.stringify(path)}, (c) => c.json({ text: ${JSON.stringify(text)} })))
+  ctx.router.route('/', new Acryl().get(${JSON.stringify(path)}, (c) => c.json({ text: ${JSON.stringify(text)} })))
 }
 
 export async function check(ctx: Context) {
-  const reply = await ctx.get('router')!.request(${JSON.stringify(path)})
+  const reply = await ctx.router.request(${JSON.stringify(path)})
   if (!reply.ok) throw new Error(\`GET ${path} answered \${reply.status}\`)
 }
 `

package/plugins/extensions/index.ts

@@ -109,7 +109,7 @@ interface PluginModule {
   readonly name?: unknown
   readonly inject?: unknown
   readonly apply: (...args: unknown[]) => unknown
-  /** Optional self-check, run after the plugin starts: it throws (or rejects) when the plugin does not work. */
+  /** Optional self-check, run after the plugin starts with the plugin's own context (so `ctx.router` reads as in `apply`): it throws (or rejects) when the plugin does not work. */
   readonly check?: (ctx: Context) => unknown
 }
 
@@ -507,6 +507,7 @@ export class Extensions extends Service {
   /** Run the extension's own `check`, if it has one, with a time limit. Returns the failure, or `undefined` when it passes. */
   private async verify(
     module: PluginModule,
+    ctx: Context,
   ): Promise<{ stage: 'verify'; error: string } | undefined> {
     if (typeof module.check !== 'function') return undefined
     let timer: ReturnType<typeof setTimeout> | undefined
@@ -517,7 +518,7 @@ export class Extensions extends Service {
           CHECK_TIMEOUT_MS,
         )
       })
-      await Promise.race([Promise.resolve(module.check(this.ctx)), limit])
+      await Promise.race([Promise.resolve(module.check(ctx)), limit])
       return undefined
     } catch (error) {
       return { stage: 'verify', error: `its check failed: ${message(error)}` }
@@ -615,7 +616,7 @@ export class Extensions extends Service {
             error: message(mounted.error ?? 'the plugin failed to start'),
           }
         : state === 'active'
-          ? await this.verify(module)
+          ? await this.verify(module, mounted.fiber.ctx)
           : undefined
     if (failure) {
       await mounted.fiber.dispose().catch(() => undefined)