acrylblends 1.0.3 → 1.0.5

package/lib/cordis/door.js

@@ -1,12 +1,13 @@
-import { t as Acryl } from "../app-BM0rTCp7.js";
-import { n as clientModules } from "../client-modules-CLvWOjbd.js";
-import { MAX_SNAPSHOT_NODES, MAX_WAIT_MS, UiControlError, parseUiRequest } from "../door/protocol.js";
-import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-DmE0YfeZ.js";
-import "../src-2Z4mJg0x.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
+import { n as clientModules } from "../client-modules-drj4mjhj.js";
+import { a as MAX_WAIT_MS, l as UiControlError, p as parseUiRequest, r as MAX_SNAPSHOT_NODES } from "../protocol-Dt0AZBOz.js";
+import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-Bbx43mN0.js";
+import "../src-BTBm4OPD.js";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
 //#region ../../plugins/acryl-door/src/host/verbs.ts
 /**
 * The one verb list (spec 049 slice 13). Every face of the door reads it: the operator client (`acryl <verb>`, its `verbs` and `brief`),
@@ -56,8 +57,8 @@ const VERB_SPECS = {
 		}
 	},
 	"act": {
-		usage: "act click|type|select|press|scroll|wait ...: do one thing on the page (refs from the latest look)",
-		description: "Do one thing on the page: click, type, select, press a key, scroll, or wait for text or a control. Look again before the next act.",
+		usage: "act click|type|select|press|scroll|wait|reload|navigate ...: do one thing on the page (refs from the latest look)",
+		description: "Do one thing on the page: click, type, select, press a key, scroll, wait for text or a control, reload the page, or navigate to another path of the app. Look again before the next act.",
 		arguments: {
 			type: "object",
 			properties: {
@@ -69,9 +70,15 @@ const VERB_SPECS = {
 						"select",
 						"press",
 						"scroll",
-						"wait"
+						"wait",
+						"reload",
+						"navigate"
 					]
 				},
+				path: {
+					type: "string",
+					description: "navigate: a path of this app, e.g. /demo (the page must load the door script to be controlled afterwards)"
+				},
 				ref: {
 					type: "string",
 					description: "a ref from the latest look, e.g. 3.12"
@@ -211,6 +218,8 @@ const SELF_KNOWLEDGE = [
 	"docs",
 	"plugins"
 ];
+/** How long a reload or a move may take before the new page has connected to the door again. */
+const PAGE_BACK_MS = 15e3;
 var Door = class {
 	deps;
 	constructor(deps) {
@@ -235,7 +244,7 @@ var Door = class {
 					text: `done${result.target === void 0 ? "" : `: ${result.target.role} "${result.target.name}"`}${result.detail === void 0 ? "" : ` (${result.detail})`}; look again before the next act`
 				};
 			}
-			case "plugin-list": return this.plugin((extensions) => extensions.list());
+			case "plugin-list": return this.plugin((extensions) => extensions.list(), false);
 			case "plugin-add": return this.plugin((extensions) => extensions.install(this.insideApp(input.folder)));
 			case "plugin-remove": {
 				const name = input.name;
@@ -286,9 +295,45 @@ var Door = class {
 		});
 		return this.callPage("look", request, signal);
 	}
-	act(input, signal) {
+	async act(input, signal) {
 		if (input.op === "snapshot") throw new DoorError("invalid", "use look to see the page");
-		return this.callPage(`act ${String(input.op)}`, this.parse(input), signal);
+		const request = this.parse(input);
+		if (request.op !== "reload" && request.op !== "navigate") return await this.callPage(`act ${String(input.op)}`, request, signal);
+		const back = this.deps.channel.expectAttach(this.deps.pageBackMs ?? PAGE_BACK_MS);
+		let answer;
+		try {
+			answer = await this.callPage(`act ${request.op}`, request, signal);
+		} catch (cause) {
+			if (!(cause instanceof UiControlError && cause.code === "disconnected")) throw cause;
+			answer = {
+				ok: true,
+				detail: request.op === "reload" ? "reloading" : `going to ${request.path}`
+			};
+		}
+		if (!await back) throw new UiControlError("timeout", request.op === "reload" ? "the page did not come back after the reload" : `the page did not come back after going to ${request.path}: is there a page at that path, and does it load the door's script?`);
+		const landed = request.op === "navigate" ? await this.statusAt(request.path) : void 0;
+		return {
+			...answer,
+			detail: `${answer.detail ?? "done"}${landed === void 0 ? "" : `; ${landed}`}; the page is back: look again`
+		};
+	}
+	/**
+	* What the app answers at a path the page was sent to, so an agent that mistyped one is told ("404 at /nope") and not left to find out from a page it did not expect.
+	* A second GET of the same path (a page is read-only); nothing when the app has no address or does not answer in time.
+	*/
+	async statusAt(path) {
+		const base = this.deps.app.url;
+		if (base === void 0) return void 0;
+		try {
+			const response = await fetch(new URL(path, base), {
+				headers: { accept: "text/html" },
+				signal: AbortSignal.timeout(3e3)
+			});
+			await response.body?.cancel();
+			return response.ok ? `${response.status} at ${path}` : `${response.status} at ${path}: the app serves no page there, look at what is shown and navigate to a path it does`;
+		} catch {
+			return;
+		}
 	}
 	parse(input) {
 		try {
@@ -335,10 +380,12 @@ var Door = class {
 			throw cause;
 		}
 	}
-	async plugin(run) {
+	async plugin(run, mutates = true) {
 		const extensions = this.deps.extensions();
 		if (extensions === void 0) throw new DoorError("unavailable", "this app has no extensions plugin, so plugins cannot be installed while it runs");
 		const value = await run(extensions);
+		const unchanged = typeof value === "object" && value !== null && value.action === "unchanged";
+		if (mutates && !unchanged && this.deps.reloadOnChange !== false) await this.deps.channel.reloadAll();
 		return {
 			value,
 			text: JSON.stringify(value, null, 2)
@@ -398,6 +445,7 @@ function registerChatTools(tools, door) {
 	try {
 		for (const verb of VERBS) removers.push(tools.register(chatToolName(verb), {
 			description: VERB_SPECS[verb].description,
+			parameters: VERB_SPECS[verb].arguments,
 			run: async (input) => {
 				try {
 					return (await door.run(verb, input ?? {}, running.signal)).text;
@@ -631,6 +679,34 @@ function operatorRoutes(prefix, secret, door, reportError) {
 		}
 	});
 }
+/** The oldest Node the client runs on (the framework's own floor). */
+const MIN_NODE = [22, 19];
+/**
+* A real Node for the command, when the app runs inside Electron: Electron can run the client as Node, but on macOS every such call prints a code-signing complaint on stderr,
+* which lands in an agent's transcript. A `node` on the PATH that is new enough is used instead; without one, Electron runs the client. `find` is replaceable for tests.
+*/
+function realNode(find = findNodeOnPath) {
+	const found = find();
+	if (found === void 0) return void 0;
+	const [major = 0, minor = 0] = found.version.replace(/^v/u, "").split(".").map(Number);
+	return major > MIN_NODE[0] || major === MIN_NODE[0] && minor >= MIN_NODE[1] ? found.path : void 0;
+}
+function findNodeOnPath() {
+	const located = spawnSync(process.platform === "win32" ? "where" : "which", ["node"], {
+		encoding: "utf8",
+		env: {
+			...process.env,
+			ELECTRON_RUN_AS_NODE: void 0
+		}
+	});
+	const path = located.status === 0 ? located.stdout.split(/\r?\n/u).find((line) => line.trim() !== "")?.trim() : void 0;
+	if (path === void 0) return void 0;
+	const asked = spawnSync(path, ["--version"], { encoding: "utf8" });
+	return asked.status === 0 ? {
+		path,
+		version: asked.stdout.trim()
+	} : void 0;
+}
 /** A word for `sh`: single-quoted, with each `'` closed, escaped and reopened. */
 function shWord(value) {
 	return `'${value.replaceAll("'", "'\\''")}'`;
@@ -698,6 +774,7 @@ const inject = [
 ];
 const Config = z.object({
 	allowInProduction: z.boolean().default(false).description("Run in production too (NODE_ENV=production); ACRYL_DOOR=off still turns it off."),
+	reloadOnChange: z.boolean().default(true).description("Reload the open pages after a plugin was added, removed or reloaded while the app runs."),
 	tools: z.object({ expose: z.array(z.string().pattern(/^(?!door_)[A-Za-z][A-Za-z0-9_-]{0,63}$/u)).description("App tools (from the tools registry) the door offers; none by default.") })
 });
 /** The page module, served compiled from source by the app's own TypeScript. */
@@ -707,11 +784,13 @@ const CLIENT = import.meta.url.endsWith(".ts") ? join(import.meta.dirname, "cli"
 /** How the folder's `.acryl/bin/acryl` starts the client: with the Node that runs the app, and its type-stripping flag when run from source. */
 function shimTarget() {
 	const fromSource = CLIENT.endsWith(".ts");
+	const inElectron = process.versions.electron !== void 0;
+	const node = inElectron ? realNode() : void 0;
 	return {
-		node: process.execPath,
+		node: node ?? process.execPath,
 		nodeOptions: fromSource ? process.execArgv.filter((option) => /^--experimental-(strip|transform)-types$/u.test(option)) : [],
 		client: CLIENT,
-		electron: process.versions.electron !== void 0
+		electron: inElectron && node === void 0
 	};
 }
 /** A listening address as one the operator reaches: an any-address bind is reached on loopback. */
@@ -720,6 +799,11 @@ function loopbackUrl(url) {
 	if (parsed.hostname === "0.0.0.0" || parsed.hostname === "[::]") parsed.hostname = "127.0.0.1";
 	return parsed.origin;
 }
+const escapeHtml = (text) => text.replace(/[&<>"']/gu, (char) => `&#${char.charCodeAt(0)};`);
+/** The page of a path the app does not serve, development only: what is missing, a way back, and the door's script. */
+function notFoundPage(path, scriptTag) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>404 Not Found</title></head><body><main><h1>404 Not Found</h1><p>This app has no page at <code>${escapeHtml(path)}</code>.</p><p><a href="/">Back to the app</a></p></main>${scriptTag}</body></html>`;
+}
 function apply(ctx, rawConfig = {}) {
 	const config = Config(rawConfig);
 	if (process.env.ACRYL_DOOR === "off" || process.env.NODE_ENV === "production" && config.allowInProduction !== true) return;
@@ -741,12 +825,35 @@ function apply(ctx, rawConfig = {}) {
 		},
 		extensions: () => ctx.get("extensions"),
 		tools: () => ctx.get("tools"),
-		expose: config.tools?.expose ?? []
+		expose: config.tools?.expose ?? [],
+		reloadOnChange: config.reloadOnChange !== false
 	});
 	ctx.effect(() => () => {
 		channel.close();
 	}, "acryl-door: page channel");
 	const pageModule = new Acryl().get(`${DOOR_PREFIX}/page.js`, (c) => c.body(`import '${DOOR_PREFIX}/page/main.ts'\n`, 200, { "content-type": "text/javascript; charset=utf-8" })).route(`${DOOR_PREFIX}/page`, clientModules({ root: PAGE_DIR }));
+	const tag = `<script type="module" src="${DOOR_PREFIX}/page.js"><\/script>`;
+	const addScript = async (c, next) => {
+		await next();
+		if (!(c.res.headers.get("content-type") ?? "").includes("text/html")) {
+			if (c.res.status === 404 && (c.req.header("accept") ?? "").includes("text/html") && !(c.res.headers.get("content-type") ?? "").includes("json")) c.res = new Response(notFoundPage(c.req.path, tag), {
+				status: 404,
+				headers: { "content-type": "text/html; charset=utf-8" }
+			});
+			return;
+		}
+		const html = await c.res.text();
+		const headers = new Headers(c.res.headers);
+		headers.delete("content-length");
+		const carries = html.includes(`${DOOR_PREFIX}/page.js`);
+		c.res = new Response(carries ? html : html.includes("</body>") ? html.replace("</body>", `${tag}</body>`) : html + tag, {
+			status: c.res.status,
+			headers
+		});
+	};
+	const router = ctx.router;
+	if (typeof router.wrap === "function") router.wrap(addScript);
+	else ctx.router.route("/", new Acryl().use("*", addScript));
 	ctx.router.route("/", privateApi(DOOR_PREFIX, pageModule, pageChannelRoutes(channel, { prefix: DOOR_PREFIX }), operatorRoutes(DOOR_PREFIX, secret, door, reportError), mcpRoutes(DOOR_PREFIX, secret, door, reportError)));
 	ctx.inject(["tools"], (inner) => {
 		inner.effect(() => registerChatTools(inner.get("tools"), door), "acryl-door: the verbs in the tools registry");
@@ -761,4 +868,4 @@ function apply(ctx, rawConfig = {}) {
 	}, "acryl-door: the door service, .acryl/door.json and .acryl/bin/acryl");
 }
 //#endregion
-export { Config, DOOR_PREFIX, Door, DoorError, STATE_DIR, VERBS, VERB_SPECS, apply, chatToolName, doorFilePath, inject, mcpTools, name, readDoorFile };
+export { Config, DOOR_PREFIX, Door, DoorError, STATE_DIR, VERBS, VERB_SPECS, apply, chatToolName, doorFilePath, inject, mcpTools, name, notFoundPage, readDoorFile };

package/lib/cordis/inspect.js

@@ -1,7 +1,7 @@
-import { t as Acryl } from "../app-BM0rTCp7.js";
-import { loopbackOnly } from "../loopback-only.js";
-import "../src-2Z4mJg0x.js";
-import "../middleware-CPQ8himN.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
+import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import "../src-BTBm4OPD.js";
+import "../middleware-BfG_fp8P.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-inspect/src/report.ts
 /**

package/lib/cordis/kv-db.d.ts

@@ -1,4 +1,4 @@
-import { KvOnDbOptions, kvOnDb } from "../kv/db.js";
+import { n as kvOnDb, t as KvOnDbOptions } from "../open-CULVJgOc.js";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/kv-db.js

@@ -1,5 +1,5 @@
 import "../src-DRFVEQQb.js";
-import { kvOnDb } from "../kv/db.js";
+import { t as kvOnDb } from "../open-But9E2rL.js";
 import z from "@deepseek-ai/schemastery";
 //#region ../../plugins/acryl-kv-db/src/index.ts
 /** Stable Cordis plugin name, equal to the package name and the Loader row id. */

package/lib/cordis/kv-json.d.ts

@@ -1,4 +1,4 @@
-import { OpenKvOptions, openKv } from "../kv/json.js";
+import { n as openKv, t as OpenKvOptions } from "../open-BqK4D2Wn.js";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/kv-json.js

@@ -1,5 +1,5 @@
 import "../src-DRFVEQQb.js";
-import { openKv } from "../kv/json.js";
+import { t as openKv } from "../open-Dp4sxspc.js";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";

package/lib/cordis/node-server.d.ts

@@ -1,6 +1,6 @@
 import { c as UpgradeHubOptions, i as testWebSocket, l as UpgradeRouter, n as TestWebSocketOptions, o as UpgradeEmitter, p as WebSocketLike, r as TestWebSocketResult, s as UpgradeHub, t as TestSocket, u as RequestError } from "../test-websocket-DyeS50Tr.js";
 import { n as UpgradeWebSocket } from "../index-C-SklY6u.js";
-import { ServeStaticOptions, serveStatic } from "../node-server/serve-static.js";
+import { n as serveStatic, t as ServeStaticOptions } from "../serve-static-B7sqnftW.js";
 import { Context, Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 

package/lib/cordis/node-server.js

@@ -1,117 +1,4 @@
-import { c as Request, i as createAdaptorServer, l as RequestError, n as UpgradeEmitter, r as UpgradeHub, t as testWebSocket } from "../test-websocket-D8WWqE5G.js";
-import { t as serveStatic } from "../serve-static-3uo_9rjF.js";
-import { Service } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
-//#region ../../plugins/acryl-node-server/src/index.ts
-/** Stable Cordis plugin name, equal to the package name and the Loader row id. */
-const name = "acryl-node-server";
-const inject = ["router"];
-/** Every field has a default, so a caller passes only what it changes: `ctx.plugin(plugin, { ... })` takes the partial shape. */
-const Config = z.object({
-	hostname: z.string().default("127.0.0.1").description("Address to bind. Loopback by default; binding elsewhere exposes the app to the network."),
-	port: z.number().min(0).max(65535).default(0).description("Port to listen on; 0 lets the system choose. A taken port is followed by the next free one."),
-	scan: z.number().min(0).default(20).description("How many further ports to try when the configured one is taken."),
-	websocket: z.object({
-		maxPayload: z.number().min(1).default(1024 * 1024).description("The largest WebSocket frame accepted, in bytes; a bigger one closes the socket with 1009."),
-		heartbeat: z.number().min(0).default(3e4).description("Milliseconds between pings; a peer that did not answer the last one is terminated. 0 turns it off."),
-		grace: z.number().min(0).default(2e3).description("Milliseconds a closing socket gets before it is terminated when its plugin unloads.")
-	}).default({})
-});
-var NodeServer = class extends Service {
-	hostname;
-	config;
-	server;
-	hub;
-	bound = 0;
-	constructor(ctx, config) {
-		super(ctx, "nodeServer");
-		this.config = config;
-		this.hostname = config.hostname;
-		const router = ctx.router;
-		this.server = createAdaptorServer({
-			fetch: (request, { incoming }) => router.fetch(new Request(request), {
-				remoteAddress: incoming.socket.remoteAddress,
-				localPort: incoming.socket.localPort
-			}),
-			hostname: config.hostname,
-			overrideGlobalObjects: false
-		});
-		ctx.effect(() => async () => {
-			await this.hub?.close();
-			this.server.closeAllConnections();
-			if (this.server.listening) await new Promise((resolve) => {
-				this.server.close(() => {
-					resolve();
-				});
-			});
-		}, "acryl-node-server: close listener and open connections");
-	}
-	/**
-	* `upgradeWebSocket` for the plugin that asks (call it once, in `apply`): `app.get('/ws', upgrade((c) => ({ onMessage(event, ws) { ... } })))`. Checks go in ordinary middleware on the
-	* route, and a handler that returns a `Response` refuses the upgrade with that status before any handshake. Every socket it accepts belongs to the calling plugin: when the plugin
-	* unloads they are closed with 1001 within `websocket.grace` and the handler sees `close` once. Pass `{ textOnly: true }` to drop binary frames. Needs the `ws` package.
-	*/
-	upgrades() {
-		if (!this.hub) {
-			this.hub = new UpgradeHub(this.config.websocket);
-			this.hub.attach(this.server, this.ctx.router);
-		}
-		return this.hub.upgradeWebSocketFor(this.ctx);
-	}
-	/** How many WebSocket connections are open now. */
-	get sockets() {
-		return this.hub?.size ?? 0;
-	}
-	/** The port in use, 0 before the server listens. */
-	get port() {
-		return this.bound;
-	}
-	/** The address clients use. */
-	get url() {
-		return `http://${this.hostname.includes(":") ? `[${this.hostname}]` : this.hostname}:${String(this.bound)}`;
-	}
-	/** Bind, scanning past taken ports. */
-	async listen() {
-		const { port, scan, hostname } = this.config;
-		const last = port === 0 ? 0 : Math.min(65535, port + scan);
-		for (let candidate = port; candidate <= last; candidate += 1) try {
-			await new Promise((resolve, reject) => {
-				const onError = (error) => {
-					reject(error);
-				};
-				this.server.once("error", onError);
-				this.server.listen(candidate, hostname, () => {
-					this.server.off("error", onError);
-					resolve();
-				});
-			});
-			this.bound = this.server.address().port;
-			return;
-		} catch (error) {
-			if (!isPortUnavailable(error)) throw error;
-		}
-		throw new Error(`acryl-node-server: no free port from ${String(port)} to ${String(last)} on ${hostname}`);
-	}
-};
-/**
-* Whether a failed bind means "this port, try the next one". A port another socket holds answers `EADDRINUSE` everywhere. On Windows a port
-* inside a range the system reserves (Hyper-V, WSL and Docker exclude ranges, `netsh interface ipv4 show excludedportrange`) answers
-* `EACCES`, which is a property of that port too; elsewhere `EACCES` means the process may not bind low ports at all, so moving on would
-* only hide the reason.
-*/
-function isPortUnavailable(error, platform = process.platform) {
-	const code = error?.code;
-	return code === "EADDRINUSE" || platform === "win32" && code === "EACCES";
-}
-/** Loads once the server listens, so a plugin that injects `nodeServer` can rely on `url`. A failure to bind fails the plugin. */
-async function apply(ctx, config = {}) {
-	await new NodeServer(ctx, {
-		hostname: "127.0.0.1",
-		port: 0,
-		scan: 20,
-		websocket: {},
-		...config
-	}).listen();
-}
-//#endregion
+import { l as RequestError, n as UpgradeEmitter, r as UpgradeHub, t as testWebSocket } from "../test-websocket-BLeEvybj.js";
+import { t as serveStatic } from "../serve-static-C1Nkj_xB.js";
+import { a as isPortUnavailable, i as inject, n as NodeServer, o as name, r as apply, t as Config } from "../src-LX0E4ec4.js";
 export { Config, NodeServer, RequestError, UpgradeEmitter, UpgradeHub, apply, inject, isPortUnavailable, name, serveStatic, testWebSocket };

package/lib/cordis/router-http.d.ts

@@ -1,5 +1,5 @@
 import { n as UpgradeWebSocket } from "../index-C-SklY6u.js";
-import { i as RouterHttpService } from "../index-D4nVR3wu.js";
+import { i as RouterHttpService } from "../index-DMOtA-NJ.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
 import { Context, Service } from "@deepseek-ai/cordis";

package/lib/cordis/router-http.js

@@ -1,5 +1,5 @@
-import { n as UpgradeEmitter, r as UpgradeHub } from "../test-websocket-D8WWqE5G.js";
-import "./node-server.js";
+import { n as UpgradeEmitter, r as UpgradeHub } from "../test-websocket-BLeEvybj.js";
+import "../src-LX0E4ec4.js";
 import { Readable } from "node:stream";
 import { Service } from "@deepseek-ai/cordis";
 import { pipeline } from "node:stream/promises";

package/lib/cordis/router.d.ts

@@ -2,6 +2,6 @@ import { B as NotFoundHandler, L as MiddlewareHandler, O as Handler, Q as Valida
 import { c as StatusCode, n as ContentfulStatusCode } from "../http-status-DaAwGAFL.js";
 import { a as getConnInfo, i as connectionOf, n as RouterBindings, r as RouterEnv, t as ConnectionInfo } from "../connection-ZLEso7XL.js";
 import { t as Acryl } from "../app-D8riatvv.js";
-import { a as TrailingSlash, i as RouterHttpService, n as MountableApp, o as apply, r as Router, s as name, t as Config } from "../index-D4nVR3wu.js";
+import { a as TrailingSlash, i as RouterHttpService, n as MountableApp, o as apply, r as Router, s as name, t as Config } from "../index-DMOtA-NJ.js";
 import { t as HTTPException } from "../http-exception-kpGJkmpi.js";
 export { Acryl, type AcrylRequest, Config, type ConnectionInfo, type ContentfulStatusCode, Context, type ContextRenderer, type ContextVariableMap, type Env, type ErrorHandler, type ExecutionContext, HTTPException, type Handler, type Input, type MiddlewareHandler, type MountableApp, type Next, type NotFoundHandler, type NotFoundResponse, Router, type RouterBindings, type RouterEnv, type RouterHttpService, type Schema, type StatusCode, type ToSchema, type TrailingSlash, type TypedResponse, type ValidationTargets, apply, connectionOf, getConnInfo, name };

package/lib/cordis/router.js

@@ -1,6 +1,6 @@
-import { HTTPException } from "../http-exception.js";
-import { t as Context } from "../context-DDO0cfuP.js";
-import { t as Acryl } from "../app-BM0rTCp7.js";
+import { t as HTTPException } from "../http-exception-MjWkT89V.js";
+import { t as Context } from "../context-CkOh7Ygv.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
 import { n as getConnInfo, t as connectionOf } from "../connection-C7xgP1hP.js";
-import { i as name, n as Router, r as apply, t as Config } from "../src-2Z4mJg0x.js";
+import { i as name, n as Router, r as apply, t as Config } from "../src-BTBm4OPD.js";
 export { Acryl, Config, Context, HTTPException, Router, apply, connectionOf, getConnInfo, name };

package/lib/cordis/state.js

@@ -1,10 +1,10 @@
-import { t as Acryl } from "../app-BM0rTCp7.js";
-import { methodNotAllowed } from "../method-not-allowed.js";
-import { r as streamSSE } from "../streaming-DHST3Scg.js";
-import { loopbackOnly } from "../loopback-only.js";
-import "../helpers-CvTauQT5.js";
-import "../src-2Z4mJg0x.js";
-import "../middleware-CPQ8himN.js";
+import { t as Acryl } from "../app-CQcGWjrk.js";
+import { t as methodNotAllowed } from "../method-not-allowed-TO2_hnfl.js";
+import { r as streamSSE } from "../streaming-BlDaph8U.js";
+import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import "../helpers-BEjcdbgw.js";
+import "../src-BTBm4OPD.js";
+import "../middleware-BfG_fp8P.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-state/src/cell.ts
 /** A writable cell. `report` receives anything a listener throws; one failing listener never blocks the others. */

package/lib/{core-CaY8XDZ6.js → core-BOu1jYua.js}

@@ -1,4 +1,4 @@
-import "./app-BM0rTCp7.js";
+import "./app-CQcGWjrk.js";
 //#region ../../plugins/acryl-router/src/core/index.ts
 /**
 * @module

package/lib/cors-CbAQ-8qU.js

@@ -0,0 +1,106 @@
+//#region ../../plugins/acryl-router/src/core/middleware/cors/index.ts
+/**
+* CORS Middleware for Acryl.
+*
+*
+* @param {CORSOptions} [options] - The options for the CORS middleware.
+* @param {string | string[] | ((origin: string, c: Context) => Promise<string | undefined | null> | string | undefined | null)} [options.origin='*'] - The value of "Access-Control-Allow-Origin" CORS header.
+* @param {string[] | ((origin: string, c: Context) => Promise<string[]> | string[])} [options.allowMethods=['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']] - The value of "Access-Control-Allow-Methods" CORS header.
+* @param {string[]} [options.allowHeaders=[]] - The value of "Access-Control-Allow-Headers" CORS header.
+* @param {number} [options.maxAge] - The value of "Access-Control-Max-Age" CORS header.
+* @param {boolean} [options.credentials] - The value of "Access-Control-Allow-Credentials" CORS header.
+* @param {string[]} [options.exposeHeaders=[]] - The value of "Access-Control-Expose-Headers" CORS header.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use('/api/*', cors())
+* app.use(
+*   '/api2/*',
+*   cors({
+*     origin: 'http://example.com',
+*     allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
+*     allowMethods: ['POST', 'GET', 'OPTIONS'],
+*     exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
+*     maxAge: 600,
+*     credentials: true,
+*   })
+* )
+*
+* app.all('/api/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* app.all('/api2/abc', (c) => {
+*   return c.json({ success: true })
+* })
+* ```
+*/
+const cors = (options) => {
+	const opts = {
+		origin: "*",
+		allowMethods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"POST",
+			"DELETE",
+			"PATCH",
+			"QUERY"
+		],
+		allowHeaders: [],
+		exposeHeaders: [],
+		...options
+	};
+	const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+	const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
+	const findAllowOrigin = ((optsOrigin) => {
+		if (typeof optsOrigin === "string") if (optsOrigin === "*") return () => optsOrigin;
+		else return (origin) => optsOrigin === origin ? origin : null;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin) ? origin : null;
+	})(opts.origin);
+	const findAllowMethods = ((optsAllowMethods) => {
+		if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
+		else if (Array.isArray(optsAllowMethods)) {
+			const methodsStr = optsAllowMethods.join(",");
+			return () => methodsStr;
+		} else return () => "";
+	})(opts.allowMethods);
+	return async function cors(c, next) {
+		function set(key, value) {
+			c.res.headers.set(key, value);
+		}
+		const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+		if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
+		if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
+		if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
+		if (c.req.method === "OPTIONS") {
+			if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
+			if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
+			const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+			if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
+			let headersStr = allowHeadersStr;
+			if (!headersStr) {
+				const requestHeaders = c.req.header("Access-Control-Request-Headers");
+				if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
+			}
+			if (headersStr) {
+				set("Access-Control-Allow-Headers", headersStr);
+				c.res.headers.append("Vary", "Access-Control-Request-Headers");
+			}
+			c.res.headers.delete("Content-Length");
+			c.res.headers.delete("Content-Type");
+			return new Response(null, {
+				headers: c.res.headers,
+				status: 204,
+				statusText: "No Content"
+			});
+		}
+		await next();
+		if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
+	};
+};
+//#endregion
+export { cors as t };