acrylblends 1.5.0 → 1.5.2

package/legacy/README.md

@@ -1,7 +1,7 @@
 # The scaffolds published acrylblends releases shipped
 
 Generated by `scripts/build-legacy-layouts.mjs`; do not edit by hand. Each folder is a template, each hash under it one distinct scaffold (deduplicated by
-content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.4.0, 45 releases)
+content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.5.1, 47 releases)
 to the layouts it shipped.
 
 `acrylblends upgrade` compares an app's scaffold files with these bytes: a file the app has not edited is brought up to date, an edited one is refused (or

package/legacy/blank/a53d41e6ef42/src/app.ts

@@ -0,0 +1,160 @@
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { Context, type Fiber } from '@deepseek-ai/cordis'
+import * as door from '../plugins/acryl-door/src/index.ts'
+import * as nodeServer from '../plugins/acryl-node-server/src/index.ts'
+import * as router from '../plugins/acryl-router/src/index.ts'
+import { extensions } from '../plugins/extensions/index.ts'
+import * as home from '../plugins/home/index.ts'
+import { type AppInstance, instance } from '../plugins/instance/index.ts'
+import {
+  appPluginNames,
+  blueprintsIn,
+  compose,
+  loadAppPlugins,
+  loadManifest,
+  type ParameterValue,
+} from '../plugins/manifest/index.ts'
+import { pluginShare } from '../plugins/plugin-share/index.ts'
+import { doorEnabled } from './door.ts'
+import { FRAME_MOUNT_PREFIX, routes } from './routes.ts'
+
+/** The plugins this app's code provides. `blend.yaml` chooses, orders and configures them, and adds the app's own plugins from `plugins/` by name. */
+export const registry = {
+  'acryl-router': router,
+  'acryl-node-server': nodeServer,
+  'acryl-door': door,
+  home,
+  extensions,
+  'plugin-share': pluginShare,
+  routes,
+}
+
+const projectRoot = fileURLToPath(new URL('..', import.meta.url))
+
+/** The manifest next to this app's source. */
+export const MANIFEST = join(projectRoot, 'blend.yaml')
+/** The app's plugins: the library copies `registry` imports, and the app's own plugins (a feature each), which `blend.yaml` mounts by their folder name. */
+const PLUGINS_DIR = join(projectRoot, 'plugins')
+
+/**
+ * The app's manifest, resolved. A Blend finds its Blueprint in `blueprints/<id>.yaml`; an app that is itself a Blueprint never looks.
+ * `createApp` and the tests read it the same way.
+ */
+export function readManifest(values?: Readonly<Record<string, ParameterValue>>) {
+  return loadManifest(MANIFEST, {
+    known: [...Object.keys(registry), ...appPluginNames(PLUGINS_DIR)],
+    getBlueprint: blueprintsIn(join(projectRoot, 'blueprints')),
+    ...(values ? { values } : {}),
+  })
+}
+
+/** The manifest without some rows: without its server (and so its door) the app is reached in process, through `root.router.request`; the door is also left out in production. */
+function without<M extends { plugins: readonly { use: string }[] }>(
+  manifest: M,
+  ...uses: string[]
+): M {
+  return {
+    ...manifest,
+    plugins: manifest.plugins.map((row) =>
+      uses.includes(row.use) ? { ...row, disabled: true } : row,
+    ),
+  }
+}
+
+export interface App {
+  readonly root: Context
+  /** The address the server listens on; empty when the app was made with `listen: false`. */
+  readonly url: string
+  stop(): Promise<void>
+}
+
+export interface AppOptions {
+  readonly values?: Readonly<Record<string, ParameterValue>>
+  /** The path the app is mounted at; absent on its own server, where it keeps the root, and {@link FRAME_MOUNT_PREFIX} in the frame. */
+  readonly prefix?: string
+  /** Start the HTTP server (default). Tests pass `false` and call `app.root.router.request(path)`: it needs no port, so it also runs where a sandbox forbids listening. */
+  readonly listen?: boolean
+}
+
+/** The rows the frame host provides: the app contributes only the plugins that are its own. */
+const HOST_ROWS = [
+  'instance',
+  'acryl-router',
+  'acryl-node-server',
+  'acryl-web-server',
+  'acryl-page',
+  'manifest',
+  'save',
+  'acryl-door',
+]
+
+/**
+ * The app's rows, composed into `ctx`: the app's own server calls this from `createApp`, and the generated frame layer mounts it as one row, so the frame
+ * runs the app exactly as the app's own server does (same rows, same order, same config). `host: true` leaves the infrastructure rows to the frame host,
+ * which is where the door lives too, and mounts the app at {@link FRAME_MOUNT_PREFIX}.
+ */
+export async function composeInto(
+  ctx: Context,
+  chosen: AppInstance,
+  options: AppOptions & { readonly host?: boolean } = {},
+): Promise<Fiber[]> {
+  const read = readManifest(options.values)
+  const own = options.host !== true && options.listen !== false
+  // The frame host mounts the app under its own prefix; the app's own server keeps the root.
+  const prefix = options.prefix ?? (options.host === true ? FRAME_MOUNT_PREFIX : undefined)
+  // Rows left out: the server (and the door, which needs it) when the app is reached in process or inside the frame host; the door when it is switched
+  // off.
+  const leaveOut = new Set<string>(options.host === true ? HOST_ROWS : [])
+  if (!own) leaveOut.add('acryl-node-server').add('acryl-door')
+  if (!doorEnabled()) leaveOut.add('acryl-door')
+  // A pull runs a stranger's code and a publish leaves the machine: development only, like the door.
+  if (process.env.NODE_ENV === 'production') leaveOut.add('plugin-share')
+  const manifest = without(read, ...leaveOut)
+  // The rows that name one of the app's own plugin folders (a feature: plugins/<name>/ and its row) rather than a registry import. Each one that runs
+  // is imported here; all of them, off or on, belong to their row, so the extensions row never starts them a second time.
+  const ownRows = [
+    ...new Set(read.plugins.map((row) => row.use).filter((use) => !Object.hasOwn(registry, use))),
+  ]
+  const ownPlugins = await loadAppPlugins(
+    PLUGINS_DIR,
+    ownRows.filter((use) => manifest.plugins.some((row) => row.use === use && !row.disabled)),
+  )
+  return compose(
+    ctx,
+    manifest,
+    { ...registry, ...ownPlugins },
+    {
+      // The routes row mounts the pages (and the client modules) at the prefix the frame host chose.
+      routes: { ...(prefix === undefined ? {} : { prefix }) },
+      // The app's own plugins live in plugins/, next to the plugins copied from the library (plugins/library.json lists those, so they are not installed twice).
+      // In production they start read-only from where they are deployed: the app keeps its features, and nothing can be installed while it runs.
+      extensions: {
+        ...(process.env.NODE_ENV === 'production' ? { readOnly: true } : {}),
+        sources: [{ dir: PLUGINS_DIR, trust: 'install' }],
+        rows: ownRows,
+        // Messages name a route as the plugin wrote it, not under the frame's canvas prefix.
+        ...(prefix === undefined ? {} : { routePrefix: prefix }),
+      },
+      // Pulled plugins go where the extensions row installs from.
+      'plugin-share': { dir: PLUGINS_DIR },
+      // Only the app's own server listens; the frame host owns the server and its port.
+      ...(own ? { server: { port: chosen.port.start, scan: chosen.port.scan ? 20 : 0 } } : {}),
+    },
+  )
+}
+
+/** The app: `instance` first (where it lives, chosen at run time), then the manifest's rows in order. */
+export async function createApp(chosen: AppInstance, options: AppOptions = {}): Promise<App> {
+  const root = new Context()
+  const first = root.plugin(instance, chosen)
+  await first.await()
+  const fibers: Fiber[] = [first, ...(await composeInto(root, chosen, options))]
+  return {
+    root,
+    url: options.listen === false ? '' : root.nodeServer.url,
+    async stop() {
+      for (const fiber of [...fibers].reverse()) await fiber.dispose()
+    },
+  }
+}

package/legacy/blank/a53d41e6ef42/src/routes.ts

@@ -0,0 +1,79 @@
+import type { Context } from '@deepseek-ai/cordis'
+import { Acryl } from '../plugins/acryl-router/src/index.ts'
+import { type Home, renderWidgets } from '../plugins/home/index.ts'
+import { aboutPage } from './about.tsx'
+import { FIRST_PAGE_MARKER } from './first-page.ts'
+
+export const APP_NAME = '__APP_NAME__'
+
+/**
+ * The only place the app's mount prefix is named. On its own server (production, `npm start`) the app mounts at the root and
+ * its public URLs are `/`, `/about`, `/health`; when the ACRYL frame hosts it (`npm run dev`) the routes mount here, and the
+ * frame opens its tile at `/app` (`/app/` answers too). Every page link and asset URL this template writes is derived from the prefix it is
+ * mounted at, so the same source serves both.
+ */
+export const FRAME_MOUNT_PREFIX = '/app'
+
+/** The scaffold's name comes from the folder, so the first screen escapes it like any other user text. */
+const escapeHtml = (text: string): string =>
+  text
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+
+/**
+ * The first screen: the page a browser gets at the root, which is what the ACRYL frame's first tile shows. A blank app whose root answered JSON to
+ * every client gave the tile Chrome's JSON viewer, nearly invisible in the frame's dark surface (owner review, 2026-11-02); the root now answers a page
+ * to a browser and the JSON hello to everything else, the way the agent template does. The About link is relative, so it works under the frame's /app
+ * mount and on the app's own server alike.
+ */
+const homePage = (name: string, widgets: string): string => `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>${escapeHtml(name)}</title>
+    <style>:root{color-scheme:light dark;background:Canvas;color:CanvasText}body{margin:2rem auto;max-width:44rem;padding:0 1rem;font:15px/1.55 system-ui,-apple-system,"Segoe UI",sans-serif}h1{font-size:1.6rem;margin:0 0 .5rem}a{color:#5468ff}code{font:.9em ui-monospace,"SF Mono",Menlo,monospace}</style>
+  </head>
+  <body>
+    <main>
+      <h1>${escapeHtml(name)}</h1>
+      <p>Your app is running. ${FIRST_PAGE_MARKER}; edit <code>src/routes.ts</code> to change it.</p>
+      <p><a href="./about">About</a></p>
+      ${widgets}
+    </main>
+  </body>
+</html>`
+
+/**
+ * The app's own pages and routes, mountable at any prefix: the standalone server mounts it at the root, the frame host at {@link FRAME_MOUNT_PREFIX}.
+ * The first screen shows the widgets of the app's plugins (`ctx.home`), read at each request, so a plugin switched on or off shows at the next load.
+ */
+export function makeApp(home: Home, name: () => string = () => APP_NAME): Acryl {
+  return (
+    new Acryl()
+      // A browser gets the first screen; an API client gets the JSON hello.
+      .get('/', async (c) =>
+        (c.req.header('accept') ?? '').includes('text/html')
+          ? c.html(homePage(name(), await renderWidgets(home)))
+          : c.json({ app: name(), ok: true }),
+      )
+      .get('/health', (c) => c.json({ ok: true }))
+      .get('/about', (c) => c.html(aboutPage()))
+  )
+}
+
+/** The app's own routes: an `App` mounted on the router at `options.prefix` (empty or absent: the root). The mount is removed when this plugin is disposed. */
+export const routes = {
+  name: 'routes',
+  inject: ['router', 'home'],
+  apply(ctx: Context, options: { readonly prefix?: string } = {}) {
+    const prefix = options.prefix ?? ''
+    // The name the app has now (Settings > App renames it), else the one the scaffold was made with.
+    ctx.router.route(
+      prefix === '' ? '/' : prefix,
+      makeApp(ctx.home, () => ctx.get('appInstance')?.name ?? APP_NAME),
+    )
+  },
+}

package/legacy/layouts.json

@@ -441,6 +441,28 @@
         "notes": "fb43a1c5f3b4",
         "todo": "164274ffcf7f"
       }
+    },
+    {
+      "version": "1.5.0",
+      "layouts": {
+        "agent": "46c6eadf9230",
+        "blank": "a53d41e6ef42",
+        "chat": "d4464dfb3b04",
+        "nodejs": "a6a340b4d3a6",
+        "notes": "fb43a1c5f3b4",
+        "todo": "164274ffcf7f"
+      }
+    },
+    {
+      "version": "1.5.1",
+      "layouts": {
+        "agent": "46c6eadf9230",
+        "blank": "a53d41e6ef42",
+        "chat": "d4464dfb3b04",
+        "nodejs": "a6a340b4d3a6",
+        "notes": "fb43a1c5f3b4",
+        "todo": "164274ffcf7f"
+      }
     }
   ],
   "templates": {
@@ -534,6 +556,10 @@
       "a7e8f539ffee": [
         "src/app.ts",
         "src/routes.ts"
+      ],
+      "a53d41e6ef42": [
+        "src/app.ts",
+        "src/routes.ts"
       ]
     },
     "chat": {

package/lib/cordis/door.js

@@ -1,12 +1,12 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
 import { r as streamSSE } from "../streaming-BlDaph8U.js";
-import { r as loopbackAuthority } from "../loopback-only-BbasoF7R.js";
+import { o as pageAuthority } from "../loopback-only-BoBCuDv7.js";
 import "../helpers-BEjcdbgw.js";
 import { n as clientModules } from "../client-modules-C5qiVroz.js";
 import { a as MAX_WAIT_MS, d as parseChannelToHost, l as UiControlError, p as parseUiRequest, r as MAX_SNAPSHOT_NODES, u as WINDOW_ID } from "../protocol-CQ_if7Dg.js";
-import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-CXTnjxGx.js";
+import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-B9PWQoX6.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
@@ -1355,9 +1355,9 @@ function operatorRoutes(prefix, secret, door, reportError) {
 		}
 	});
 }
-/** The upgrade request comes from this app's own page: a loopback peer on this port, and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
+/** The upgrade request comes from this app's own page: a loopback peer on this port (or the hosted app's trusted front), and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
 const ownOrigin = async (c, next) => {
-	const authority = loopbackAuthority(c);
+	const authority = pageAuthority(c);
 	const origin = c.req.header("origin");
 	const site = c.req.header("sec-fetch-site");
 	if (authority === void 0 || origin === void 0 || origin !== authority.origin || site !== void 0 && site !== "same-origin") return c.json(error("only this app's own page may open the channel"), 403);

package/lib/cordis/inspect.js

@@ -1,7 +1,7 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
-import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import { a as loopbackOnly } from "../loopback-only-BoBCuDv7.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-inspect/src/report.ts
 /**

package/lib/cordis/state.js

@@ -1,10 +1,10 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
 import { t as methodNotAllowed } from "../method-not-allowed-TO2_hnfl.js";
 import { r as streamSSE } from "../streaming-BlDaph8U.js";
-import { i as loopbackOnly, r as loopbackAuthority } from "../loopback-only-BbasoF7R.js";
+import { a as loopbackOnly, o as pageAuthority } from "../loopback-only-BoBCuDv7.js";
 import "../helpers-BEjcdbgw.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-state/src/cell.ts
 /** A writable cell. `report` receives anything a listener throws; one failing listener never blocks the others. */
@@ -305,7 +305,7 @@ export function watch(key, onValue, onError) {
 `;
 /** A refusal (403) unless the upgrade comes from this machine to this app, and from its own page when it comes from a page at all. */
 function refuseStranger(c) {
-	const authority = loopbackAuthority(c);
+	const authority = pageAuthority(c);
 	if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
 	const origin = c.req.header("origin");
 	const site = c.req.header("sec-fetch-site");

package/lib/door/host.js

@@ -1,2 +1,2 @@
-import { d as AuditLog, f as auditPath, n as HEARTBEAT_MS, p as UiChannel, r as pageChannelRoutes, t as renderSnapshot } from "../snapshot-text-CXTnjxGx.js";
+import { d as AuditLog, f as auditPath, n as HEARTBEAT_MS, p as UiChannel, r as pageChannelRoutes, t as renderSnapshot } from "../snapshot-text-B9PWQoX6.js";
 export { AuditLog, HEARTBEAT_MS, UiChannel, auditPath, pageChannelRoutes, renderSnapshot };

package/lib/{loopback-only-BbasoF7R.js → loopback-only-BoBCuDv7.js}

@@ -23,7 +23,7 @@ function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
 	const { remoteAddress, localPort } = connectionOf(c);
 	const host = c.req.header("host");
 	if (remoteAddress === void 0 || localPort === void 0 || host === void 0) return void 0;
-	const address = (remoteAddress.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
+	const address = peerAddress(remoteAddress);
 	const family = isIP(address);
 	if (family === 0 || !loopback.check(address, family === 4 ? "ipv4" : "ipv6")) return void 0;
 	let authority;
@@ -35,13 +35,54 @@ function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
 	if (authority.protocol !== "http:" || Number(authority.port || "80") !== localPort || !hostnames.includes(authority.hostname) || c.req.header("sec-fetch-site") === "cross-site") return void 0;
 	return authority;
 }
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+function trustedFrontFromEnv(env = process.env) {
+	const origin = env.ACRYL_PUBLIC_ORIGIN?.trim();
+	const proxies = (env.ACRYL_TRUSTED_PROXY ?? "").split(",").map((peer) => peerAddress(peer.trim())).filter((peer) => peer !== "");
+	if (origin === void 0 || origin === "" || proxies.length === 0) return void 0;
+	if (originOf(origin) !== origin || !/^https?:$/u.test(new URL(origin).protocol)) return void 0;
+	if (proxies.some((peer) => isIP(peer) === 0)) return void 0;
+	return Object.freeze({
+		origin,
+		proxies: Object.freeze(proxies)
+	});
+}
+let configuredFront = null;
+/** The front of this process, read from the environment once. */
+function trustedFront() {
+	if (configuredFront === null) configuredFront = trustedFrontFromEnv();
+	return configuredFront;
+}
+function peerAddress(address) {
+	return (address.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
+}
+/**
+* The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+* public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+* header, so a page on another box cannot claim to be the front.
+*/
+function frontAuthority(c, front = trustedFront()) {
+	if (front === void 0) return void 0;
+	const { remoteAddress } = connectionOf(c);
+	if (remoteAddress === void 0 || !front.proxies.includes(peerAddress(remoteAddress))) return void 0;
+	const publicOrigin = new URL(front.origin);
+	if (c.req.header("host") !== publicOrigin.host || c.req.header("sec-fetch-site") === "cross-site") return void 0;
+	return publicOrigin;
+}
+/**
+* The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+* operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+*/
+function pageAuthority(c, hostnames = LOOPBACK_HOSTNAMES, front = trustedFront()) {
+	return loopbackAuthority(c, hostnames) ?? frontAuthority(c, front);
+}
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 function sameOrigin(c, authority) {
 	const origin = c.req.header("origin");
 	if (origin === void 0) return true;
 	try {
 		const parsed = new URL(origin);
-		return parsed.protocol === "http:" && parsed.host === authority.host && parsed.pathname === "/";
+		return parsed.origin === authority.origin && parsed.pathname === "/" && parsed.search === "";
 	} catch {
 		return false;
 	}
@@ -75,7 +116,7 @@ function loopbackOnly(options = {}) {
 			await next();
 			return;
 		}
-		const authority = loopbackAuthority(c, options.hostnames);
+		const authority = pageAuthority(c, options.hostnames, "front" in options ? options.front : trustedFront());
 		if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
 		if (ownPage) {
 			if (!fromOwnPage(c, authority)) return c.json({ error: "only this app's own page may call this" }, 403);
@@ -87,4 +128,4 @@ function loopbackOnly(options = {}) {
 	};
 }
 //#endregion
-export { sameOrigin as a, loopbackOnly as i, fromOwnPage as n, loopbackAuthority as r, LOOPBACK_HOSTNAMES as t };
+export { loopbackOnly as a, trustedFront as c, loopbackAuthority as i, trustedFrontFromEnv as l, fromOwnPage as n, pageAuthority as o, frontAuthority as r, sameOrigin as s, LOOPBACK_HOSTNAMES as t };

package/lib/loopback-only.d.ts

@@ -24,6 +24,8 @@ interface LoopbackOptions {
    * same-origin` and a `Referer` from this authority. `mutations` is not consulted: every request is held to that rule.
    */
   readonly callers?: 'local' | 'own-page';
+  /** The hosted app's trusted front; default: the one the environment configures ({@link trustedFront}), usually none. Tests pass one. */
+  readonly front?: TrustedFront | undefined;
 }
 /**
  * The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
@@ -32,6 +34,32 @@ interface LoopbackOptions {
  */
 declare const LOOPBACK_HOSTNAMES: readonly string[];
 declare function loopbackAuthority(c: Context, hostnames?: readonly string[]): URL | undefined;
+/**
+ * A hosted app's one trusted front (spec 049 M9, design `m9-hosted-workspace.md` C): the reverse proxy that serves this app's page under a public
+ * origin, for example `https://a1b2.213-47-80-26.sslip.io`. Only the hosting template sets it, through `ACRYL_PUBLIC_ORIGIN` and
+ * `ACRYL_TRUSTED_PROXY` (the proxy's exact peer addresses, comma separated). Unset, nothing changes: an app accepts its own page on loopback only.
+ */
+interface TrustedFront {
+  /** The public origin the front serves this app's page from: a scheme and a host, no path. */
+  readonly origin: string;
+  /** The exact peer addresses the front connects from; no ranges, so another box on the same network is never the front. */
+  readonly proxies: readonly string[];
+}
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+declare function trustedFrontFromEnv(env?: NodeJS.ProcessEnv): TrustedFront | undefined;
+/** The front of this process, read from the environment once. */
+declare function trustedFront(): TrustedFront | undefined;
+/**
+ * The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+ * public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+ * header, so a page on another box cannot claim to be the front.
+ */
+declare function frontAuthority(c: Context, front?: TrustedFront | undefined): URL | undefined;
+/**
+ * The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+ * operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+ */
+declare function pageAuthority(c: Context, hostnames?: readonly string[], front?: TrustedFront | undefined): URL | undefined;
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 declare function sameOrigin(c: Context, authority: URL): boolean;
 /** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
@@ -42,4 +70,4 @@ declare function fromOwnPage(c: Context, authority: URL): boolean;
  */
 declare function loopbackOnly(options?: LoopbackOptions): MiddlewareHandler;
 //#endregion
-export { LOOPBACK_HOSTNAMES, LoopbackOptions, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };
+export { LOOPBACK_HOSTNAMES, LoopbackOptions, TrustedFront, fromOwnPage, frontAuthority, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv };

package/lib/loopback-only.js

@@ -1,2 +1,2 @@
-import { a as sameOrigin, i as loopbackOnly, n as fromOwnPage, r as loopbackAuthority, t as LOOPBACK_HOSTNAMES } from "./loopback-only-BbasoF7R.js";
-export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };
+import { a as loopbackOnly, c as trustedFront, i as loopbackAuthority, l as trustedFrontFromEnv, n as fromOwnPage, o as pageAuthority, r as frontAuthority, s as sameOrigin, t as LOOPBACK_HOSTNAMES } from "./loopback-only-BoBCuDv7.js";
+export { LOOPBACK_HOSTNAMES, fromOwnPage, frontAuthority, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv };

package/lib/{middleware-BfG_fp8P.js → middleware-Do9XNe0Y.js}

@@ -8,5 +8,5 @@ import "./jwt-lyS4Q3mT.js";
 import "./method-not-allowed-TO2_hnfl.js";
 import "./serve-static-EiJf1zkO.js";
 import "./timeout-FeqZ9A-0.js";
-import "./loopback-only-BbasoF7R.js";
+import "./loopback-only-BoBCuDv7.js";
 export {};

package/lib/{snapshot-text-CXTnjxGx.js → snapshot-text-B9PWQoX6.js}

@@ -2,11 +2,11 @@ import { t as Acryl } from "./app-CQcGWjrk.js";
 import { t as bodyLimit } from "./body-limit-WmIjWRLt.js";
 import { t as methodNotAllowed } from "./method-not-allowed-TO2_hnfl.js";
 import { r as streamSSE } from "./streaming-BlDaph8U.js";
-import { i as loopbackOnly, r as loopbackAuthority } from "./loopback-only-BbasoF7R.js";
+import { a as loopbackOnly, i as loopbackAuthority } from "./loopback-only-BoBCuDv7.js";
 import "./helpers-BEjcdbgw.js";
 import { d as parseChannelToHost, l as UiControlError, u as WINDOW_ID } from "./protocol-CQ_if7Dg.js";
 import "./src-iBJ2ysV9.js";
-import "./middleware-BfG_fp8P.js";
+import "./middleware-Do9XNe0Y.js";
 import { dirname, join } from "node:path";
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
 import { timingSafeEqual } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acrylblends",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "The Acryl web framework (import { Acryl } from \"acrylblends\") and the acrylblends command that scaffolds Cordis apps.",
   "license": "MIT",
   "type": "module",

package/plugins/acryl-door/src/host/page-socket.ts

@@ -10,7 +10,7 @@
 
 import { Acryl, type MiddlewareHandler } from 'acryl-router'
 import type { UpgradeWebSocket, WSEvents } from 'acryl-router/helpers'
-import { loopbackAuthority } from 'acryl-router/middleware'
+import { pageAuthority } from 'acryl-router/middleware'
 import { parseChannelToHost, WINDOW_ID } from '../page/protocol.ts'
 import type { UiChannel } from './channel.ts'
 import { error } from './http.ts'
@@ -25,9 +25,9 @@ export interface PageSocketOptions {
   readonly heartbeatMs?: number
 }
 
-/** The upgrade request comes from this app's own page: a loopback peer on this port, and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
+/** The upgrade request comes from this app's own page: a loopback peer on this port (or the hosted app's trusted front), and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
 export const ownOrigin: MiddlewareHandler = async (c, next) => {
-  const authority = loopbackAuthority(c)
+  const authority = pageAuthority(c)
   const origin = c.req.header('origin')
   const site = c.req.header('sec-fetch-site')
   if (authority === undefined || origin === undefined || origin !== authority.origin || (site !== undefined && site !== 'same-origin')) {

package/plugins/acryl-router/src/middleware/index.ts

@@ -25,4 +25,4 @@ export { NONCE, secureHeaders, type SecureHeadersVariables } from '../core/middl
 export { timeout } from '../core/middleware/timeout/index.ts'
 export { endTime, setMetric, startTime, timing, wrapTime, type TimingVariables } from '../core/middleware/timing/index.ts'
 export { appendTrailingSlash, trimTrailingSlash } from '../core/middleware/trailing-slash/index.ts'
-export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin, type LoopbackOptions } from './loopback-only.ts'
+export { LOOPBACK_HOSTNAMES, frontAuthority, fromOwnPage, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv, type LoopbackOptions, type TrustedFront } from './loopback-only.ts'