dorkos 0.115.0 → 0.116.0

package/dist/server/extension-child.cjs

@@ -19133,14 +19133,14 @@ var require_etag = __commonJS({
   "../../node_modules/.pnpm/etag@1.8.1/node_modules/etag/index.js"(exports2, module2) {
     "use strict";
     module2.exports = etag;
-    var crypto = require("crypto");
+    var crypto2 = require("crypto");
     var Stats = require("fs").Stats;
     var toString = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash2 = crypto.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash2 = crypto2.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash2 + '"';
     }
@@ -20202,9 +20202,9 @@ var require_once = __commonJS({
 // ../../node_modules/.pnpm/is-promise@4.0.0/node_modules/is-promise/index.js
 var require_is_promise = __commonJS({
   "../../node_modules/.pnpm/is-promise@4.0.0/node_modules/is-promise/index.js"(exports2, module2) {
-    module2.exports = isPromise;
-    module2.exports.default = isPromise;
-    function isPromise(obj) {
+    module2.exports = isPromise2;
+    module2.exports.default = isPromise2;
+    function isPromise2(obj) {
       return !!obj && (typeof obj === "object" || typeof obj === "function") && typeof obj.then === "function";
     }
   }
@@ -20583,7 +20583,7 @@ var require_dist2 = __commonJS({
 var require_layer = __commonJS({
   "../../node_modules/.pnpm/router@2.2.0/node_modules/router/lib/layer.js"(exports2, module2) {
     "use strict";
-    var isPromise = require_is_promise();
+    var isPromise2 = require_is_promise();
     var pathRegexp = require_dist2();
     var debug = require_src()("router:layer");
     var deprecate = require_depd()("router");
@@ -20649,7 +20649,7 @@ var require_layer = __commonJS({
       }
       try {
         const ret = fn(error62, req, res, next);
-        if (isPromise(ret)) {
+        if (isPromise2(ret)) {
           if (!(ret instanceof Promise)) {
             deprecate("handlers that are Promise-like are deprecated, use a native Promise instead");
           }
@@ -20668,7 +20668,7 @@ var require_layer = __commonJS({
       }
       try {
         const ret = fn(req, res, next);
-        if (isPromise(ret)) {
+        if (isPromise2(ret)) {
           if (!(ret instanceof Promise)) {
             deprecate("handlers that are Promise-like are deprecated, use a native Promise instead");
           }
@@ -20853,7 +20853,7 @@ var require_route = __commonJS({
 var require_router = __commonJS({
   "../../node_modules/.pnpm/router@2.2.0/node_modules/router/index.js"(exports2, module2) {
     "use strict";
-    var isPromise = require_is_promise();
+    var isPromise2 = require_is_promise();
     var Layer = require_layer();
     var { METHODS } = require("node:http");
     var parseUrl = require_parseurl();
@@ -21187,7 +21187,7 @@ var require_router = __commonJS({
         if (!fn) return param();
         try {
           const ret = fn(req, res, paramCallback, paramVal, key);
-          if (isPromise(ret)) {
+          if (isPromise2(ret)) {
             if (!(ret instanceof Promise)) {
               deprecate("parameters that are Promise-like are deprecated, use a native Promise instead");
             }
@@ -22569,17 +22569,17 @@ var require_content_disposition = __commonJS({
 // ../../node_modules/.pnpm/cookie-signature@1.2.2/node_modules/cookie-signature/index.js
 var require_cookie_signature = __commonJS({
   "../../node_modules/.pnpm/cookie-signature@1.2.2/node_modules/cookie-signature/index.js"(exports2) {
-    var crypto = require("crypto");
+    var crypto2 = require("crypto");
     exports2.sign = function(val, secret) {
       if ("string" != typeof val) throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto2.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports2.unsign = function(input2, secret) {
       if ("string" != typeof input2) throw new TypeError("Signed cookie string must be provided.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
       var tentativeValue = input2.slice(0, input2.lastIndexOf(".")), expectedInput = exports2.sign(tentativeValue, secret), expectedBuffer = Buffer.from(expectedInput), inputBuffer = Buffer.from(input2);
-      return expectedBuffer.length === inputBuffer.length && crypto.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      return expectedBuffer.length === inputBuffer.length && crypto2.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
     };
   }
 });
@@ -44341,7 +44341,9 @@ __export(server_extension_api_exports, {
   InboxLimitError: () => InboxLimitError,
   InboxLinkError: () => InboxLinkError,
   StartWorkError: () => StartWorkError,
+  checkPerson: () => checkPerson,
   readRegisterResult: () => readRegisterResult,
+  requirePerson: () => requirePerson,
   serverEntryRegister: () => serverEntryRegister
 });
 
@@ -44367,7 +44369,7 @@ function serverEntryRegister(exported) {
   const candidate = exported && typeof exported === "object" && "default" in exported ? exported.default : exported;
   if (typeof candidate === "function") return candidate;
   if (hasFetch(candidate)) {
-    return () => ({ fetch: (request) => candidate.fetch(request) });
+    return () => ({ fetch: (request, caller) => candidate.fetch(request, caller) });
   }
   return null;
 }
@@ -44383,12 +44385,42 @@ function readRegisterResult(result) {
   }
   return {
     cleanup: cleanup ? () => cleanup.call(result) : null,
-    fetch: fetch ? (request) => fetch.call(result, request) : null
+    fetch: fetch ? (request, caller) => fetch.call(result, request, caller) : null
   };
 }
 function hasFetch(value) {
   return !!value && typeof value === "object" && typeof value.fetch === "function";
 }
+var UNKNOWN_CALLER = {
+  ok: false,
+  status: 403,
+  body: {
+    error: "Only a person can do this.",
+    code: "extension_person_required",
+    message: "DorkOS changed nothing. Only a person can do this. Ask them to do it in DorkOS."
+  }
+};
+function checkPerson(caller) {
+  const person = caller?.person;
+  const check2 = isPersonCheck(person) ? person : UNKNOWN_CALLER;
+  if (check2.ok) return null;
+  return Response.json(check2.body, { status: check2.status });
+}
+function requirePerson() {
+  return async (c, next) => {
+    const refused = checkPerson(c.env);
+    if (refused) return refused;
+    await next();
+  };
+}
+function isPersonCheck(value) {
+  if (!value || typeof value !== "object") return false;
+  const check2 = value;
+  if (check2.ok === true) return true;
+  if (check2.ok !== false) return false;
+  const body = check2.body;
+  return typeof check2.status === "number" && Number.isInteger(check2.status) && check2.status >= 400 && check2.status <= 599 && !!body && typeof body === "object" && typeof body.error === "string" && typeof body.code === "string" && typeof body.message === "string";
+}
 
 // ../extension-api/src/server-extension-api.ts
 var InboxLimitError = class extends Error {
@@ -44488,7 +44520,7 @@ var ISOLATION_LIMITS = {
 var NET_DENIED_CODE = "ERR_EXTENSION_NET_DENIED";
 var SYNC_RUN_REFUSAL = "Isolated extensions can't run programs synchronously; use the async form.";
 function bundleDependencyRefusal(name) {
-  return `Isolated extensions must bundle their dependencies: ${name}`;
+  return `Extensions must bundle their dependencies: ${name}`;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -45097,7 +45129,7 @@ function createProxyCtx(deps) {
     scheduled.add(cancel);
     return cancel;
   };
-  const requirePerson = (req, res, next) => {
+  const requirePerson2 = (req, res, next) => {
     const verdict = parsePersonVerdict(req.headers[PERSON_VERDICT_HEADER]);
     if (verdict?.ok === true) {
       next();
@@ -45112,7 +45144,7 @@ function createProxyCtx(deps) {
     dorkHome: init.ctx.dorkHome,
     filesDir: init.ctx.filesDir
   };
-  const locals = { schedule, requirePerson };
+  const locals = { schedule, requirePerson: requirePerson2 };
   const build = (members2, prefix) => {
     const out = {};
     for (const name of Object.keys(members2)) {
@@ -45284,6 +45316,641 @@ function createTrackedSend(raw) {
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_stream3 = require("node:stream");
 
+// ../../node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.12/node_modules/@hono/node-server/dist/index.mjs
+var import_http2 = require("http2");
+var import_http22 = require("http2");
+var import_stream = require("stream");
+var import_crypto = __toESM(require("crypto"), 1);
+var RequestError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "RequestError";
+  }
+};
+var toRequestError = (e) => {
+  if (e instanceof RequestError) {
+    return e;
+  }
+  return new RequestError(e.message, { cause: e });
+};
+var GlobalRequest = global.Request;
+var Request2 = class extends GlobalRequest {
+  constructor(input2, options) {
+    if (typeof input2 === "object" && getRequestCache in input2) {
+      input2 = input2[getRequestCache]();
+    }
+    if (typeof options?.body?.getReader !== "undefined") {
+      ;
+      options.duplex ??= "half";
+    }
+    super(input2, options);
+  }
+};
+var newHeadersFromIncoming = (incoming) => {
+  const headerRecord = [];
+  const rawHeaders = incoming.rawHeaders;
+  for (let i = 0; i < rawHeaders.length; i += 2) {
+    const { [i]: key, [i + 1]: value } = rawHeaders;
+    if (key.charCodeAt(0) !== /*:*/
+    58) {
+      headerRecord.push([key, value]);
+    }
+  }
+  return new Headers(headerRecord);
+};
+var wrapBodyStream = /* @__PURE__ */ Symbol("wrapBodyStream");
+var newRequestFromIncoming = (method, url2, headers, incoming, abortController) => {
+  const init = {
+    method,
+    headers,
+    signal: abortController.signal
+  };
+  if (method === "TRACE") {
+    init.method = "GET";
+    const req = new Request2(url2, init);
+    Object.defineProperty(req, "method", {
+      get() {
+        return "TRACE";
+      }
+    });
+    return req;
+  }
+  if (!(method === "GET" || method === "HEAD")) {
+    if ("rawBody" in incoming && incoming.rawBody instanceof Buffer) {
+      init.body = new ReadableStream({
+        start(controller) {
+          controller.enqueue(incoming.rawBody);
+          controller.close();
+        }
+      });
+    } else if (incoming[wrapBodyStream]) {
+      let reader;
+      init.body = new ReadableStream({
+        async pull(controller) {
+          try {
+            reader ||= import_stream.Readable.toWeb(incoming).getReader();
+            const { done, value } = await reader.read();
+            if (done) {
+              controller.close();
+            } else {
+              controller.enqueue(value);
+            }
+          } catch (error62) {
+            controller.error(error62);
+          }
+        }
+      });
+    } else {
+      init.body = import_stream.Readable.toWeb(incoming);
+    }
+  }
+  return new Request2(url2, init);
+};
+var getRequestCache = /* @__PURE__ */ Symbol("getRequestCache");
+var requestCache = /* @__PURE__ */ Symbol("requestCache");
+var incomingKey = /* @__PURE__ */ Symbol("incomingKey");
+var urlKey = /* @__PURE__ */ Symbol("urlKey");
+var headersKey = /* @__PURE__ */ Symbol("headersKey");
+var abortControllerKey = /* @__PURE__ */ Symbol("abortControllerKey");
+var getAbortController = /* @__PURE__ */ Symbol("getAbortController");
+var requestPrototype = {
+  get method() {
+    return this[incomingKey].method || "GET";
+  },
+  get url() {
+    return this[urlKey];
+  },
+  get headers() {
+    return this[headersKey] ||= newHeadersFromIncoming(this[incomingKey]);
+  },
+  [getAbortController]() {
+    this[getRequestCache]();
+    return this[abortControllerKey];
+  },
+  [getRequestCache]() {
+    this[abortControllerKey] ||= new AbortController();
+    return this[requestCache] ||= newRequestFromIncoming(
+      this.method,
+      this[urlKey],
+      this.headers,
+      this[incomingKey],
+      this[abortControllerKey]
+    );
+  }
+};
+[
+  "body",
+  "bodyUsed",
+  "cache",
+  "credentials",
+  "destination",
+  "integrity",
+  "mode",
+  "redirect",
+  "referrer",
+  "referrerPolicy",
+  "signal",
+  "keepalive"
+].forEach((k) => {
+  Object.defineProperty(requestPrototype, k, {
+    get() {
+      return this[getRequestCache]()[k];
+    }
+  });
+});
+["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
+  Object.defineProperty(requestPrototype, k, {
+    value: function() {
+      return this[getRequestCache]()[k]();
+    }
+  });
+});
+Object.defineProperty(requestPrototype, /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom"), {
+  value: function(depth, options, inspectFn) {
+    const props = {
+      method: this.method,
+      url: this.url,
+      headers: this.headers,
+      nativeRequest: this[requestCache]
+    };
+    return `Request (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
+  }
+});
+Object.setPrototypeOf(requestPrototype, Request2.prototype);
+var newRequest = (incoming, defaultHostname) => {
+  const req = Object.create(requestPrototype);
+  req[incomingKey] = incoming;
+  const incomingUrl = incoming.url || "";
+  if (incomingUrl[0] !== "/" && // short-circuit for performance. most requests are relative URL.
+  (incomingUrl.startsWith("http://") || incomingUrl.startsWith("https://"))) {
+    if (incoming instanceof import_http22.Http2ServerRequest) {
+      throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
+    }
+    try {
+      const url22 = new URL(incomingUrl);
+      req[urlKey] = url22.href;
+    } catch (e) {
+      throw new RequestError("Invalid absolute URL", { cause: e });
+    }
+    return req;
+  }
+  const host = (incoming instanceof import_http22.Http2ServerRequest ? incoming.authority : incoming.headers.host) || defaultHostname;
+  if (!host) {
+    throw new RequestError("Missing host header");
+  }
+  let scheme;
+  if (incoming instanceof import_http22.Http2ServerRequest) {
+    scheme = incoming.scheme;
+    if (!(scheme === "http" || scheme === "https")) {
+      throw new RequestError("Unsupported scheme");
+    }
+  } else {
+    scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
+  }
+  const url2 = new URL(`${scheme}://${host}${incomingUrl}`);
+  if (url2.hostname.length !== host.length && url2.hostname !== host.replace(/:\d+$/, "")) {
+    throw new RequestError("Invalid host header");
+  }
+  req[urlKey] = url2.href;
+  return req;
+};
+var responseCache = /* @__PURE__ */ Symbol("responseCache");
+var getResponseCache = /* @__PURE__ */ Symbol("getResponseCache");
+var cacheKey = /* @__PURE__ */ Symbol("cache");
+var GlobalResponse = global.Response;
+var Response2 = class _Response {
+  #body;
+  #init;
+  [getResponseCache]() {
+    delete this[cacheKey];
+    return this[responseCache] ||= new GlobalResponse(this.#body, this.#init);
+  }
+  constructor(body, init) {
+    let headers;
+    this.#body = body;
+    if (init instanceof _Response) {
+      const cachedGlobalResponse = init[responseCache];
+      if (cachedGlobalResponse) {
+        this.#init = cachedGlobalResponse;
+        this[getResponseCache]();
+        return;
+      } else {
+        this.#init = init.#init;
+        headers = new Headers(init.#init.headers);
+      }
+    } else {
+      this.#init = init;
+    }
+    if (typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) {
+      ;
+      this[cacheKey] = [init?.status || 200, body, headers || init?.headers];
+    }
+  }
+  get headers() {
+    const cache = this[cacheKey];
+    if (cache) {
+      if (!(cache[2] instanceof Headers)) {
+        cache[2] = new Headers(
+          cache[2] || { "content-type": "text/plain; charset=UTF-8" }
+        );
+      }
+      return cache[2];
+    }
+    return this[getResponseCache]().headers;
+  }
+  get status() {
+    return this[cacheKey]?.[0] ?? this[getResponseCache]().status;
+  }
+  get ok() {
+    const status = this.status;
+    return status >= 200 && status < 300;
+  }
+};
+["body", "bodyUsed", "redirected", "statusText", "trailers", "type", "url"].forEach((k) => {
+  Object.defineProperty(Response2.prototype, k, {
+    get() {
+      return this[getResponseCache]()[k];
+    }
+  });
+});
+["arrayBuffer", "blob", "clone", "formData", "json", "text"].forEach((k) => {
+  Object.defineProperty(Response2.prototype, k, {
+    value: function() {
+      return this[getResponseCache]()[k]();
+    }
+  });
+});
+Object.defineProperty(Response2.prototype, /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom"), {
+  value: function(depth, options, inspectFn) {
+    const props = {
+      status: this.status,
+      headers: this.headers,
+      ok: this.ok,
+      nativeResponse: this[responseCache]
+    };
+    return `Response (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
+  }
+});
+Object.setPrototypeOf(Response2, GlobalResponse);
+Object.setPrototypeOf(Response2.prototype, GlobalResponse.prototype);
+async function readWithoutBlocking(readPromise) {
+  return Promise.race([readPromise, Promise.resolve().then(() => Promise.resolve(void 0))]);
+}
+function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromise) {
+  const cancel = (error62) => {
+    reader.cancel(error62).catch(() => {
+    });
+  };
+  writable.on("close", cancel);
+  writable.on("error", cancel);
+  (currentReadPromise ?? reader.read()).then(flow, handleStreamError);
+  return reader.closed.finally(() => {
+    writable.off("close", cancel);
+    writable.off("error", cancel);
+  });
+  function handleStreamError(error62) {
+    if (error62) {
+      writable.destroy(error62);
+    }
+  }
+  function onDrain() {
+    reader.read().then(flow, handleStreamError);
+  }
+  function flow({ done, value }) {
+    try {
+      if (done) {
+        writable.end();
+      } else if (!writable.write(value)) {
+        writable.once("drain", onDrain);
+      } else {
+        return reader.read().then(flow, handleStreamError);
+      }
+    } catch (e) {
+      handleStreamError(e);
+    }
+  }
+}
+function writeFromReadableStream(stream, writable) {
+  if (stream.locked) {
+    throw new TypeError("ReadableStream is locked.");
+  } else if (writable.destroyed) {
+    return;
+  }
+  return writeFromReadableStreamDefaultReader(stream.getReader(), writable);
+}
+var buildOutgoingHttpHeaders = (headers) => {
+  const res = {};
+  if (!(headers instanceof Headers)) {
+    headers = new Headers(headers ?? void 0);
+  }
+  const cookies = [];
+  for (const [k, v] of headers) {
+    if (k === "set-cookie") {
+      cookies.push(v);
+    } else {
+      res[k] = v;
+    }
+  }
+  if (cookies.length > 0) {
+    res["set-cookie"] = cookies;
+  }
+  res["content-type"] ??= "text/plain; charset=UTF-8";
+  return res;
+};
+var X_ALREADY_SENT = "x-hono-already-sent";
+if (typeof global.crypto === "undefined") {
+  global.crypto = import_crypto.default;
+}
+var outgoingEnded = /* @__PURE__ */ Symbol("outgoingEnded");
+var incomingDraining = /* @__PURE__ */ Symbol("incomingDraining");
+var DRAIN_TIMEOUT_MS = 500;
+var MAX_DRAIN_BYTES = 64 * 1024 * 1024;
+var drainIncoming = (incoming) => {
+  const incomingWithDrainState = incoming;
+  if (incoming.destroyed || incomingWithDrainState[incomingDraining]) {
+    return;
+  }
+  incomingWithDrainState[incomingDraining] = true;
+  if (incoming instanceof import_http2.Http2ServerRequest) {
+    try {
+      ;
+      incoming.stream?.close?.(import_http2.constants.NGHTTP2_NO_ERROR);
+    } catch {
+    }
+    return;
+  }
+  let bytesRead = 0;
+  const cleanup = () => {
+    clearTimeout(timer);
+    incoming.off("data", onData);
+    incoming.off("end", cleanup);
+    incoming.off("error", cleanup);
+  };
+  const forceClose = () => {
+    cleanup();
+    const socket = incoming.socket;
+    if (socket && !socket.destroyed) {
+      socket.destroySoon();
+    }
+  };
+  const timer = setTimeout(forceClose, DRAIN_TIMEOUT_MS);
+  timer.unref?.();
+  const onData = (chunk) => {
+    bytesRead += chunk.length;
+    if (bytesRead > MAX_DRAIN_BYTES) {
+      forceClose();
+    }
+  };
+  incoming.on("data", onData);
+  incoming.on("end", cleanup);
+  incoming.on("error", cleanup);
+  incoming.resume();
+};
+var handleRequestError = () => new Response(null, {
+  status: 400
+});
+var handleFetchError = (e) => new Response(null, {
+  status: e instanceof Error && (e.name === "TimeoutError" || e.constructor.name === "TimeoutError") ? 504 : 500
+});
+var handleResponseError = (e, outgoing) => {
+  const err = e instanceof Error ? e : new Error("unknown error", { cause: e });
+  if (err.code === "ERR_STREAM_PREMATURE_CLOSE") {
+    console.info("The user aborted a request.");
+  } else {
+    console.error(e);
+    if (!outgoing.headersSent) {
+      outgoing.writeHead(500, { "Content-Type": "text/plain" });
+    }
+    outgoing.end(`Error: ${err.message}`);
+    outgoing.destroy(err);
+  }
+};
+var flushHeaders = (outgoing) => {
+  if ("flushHeaders" in outgoing && outgoing.writable) {
+    outgoing.flushHeaders();
+  }
+};
+var responseViaCache = async (res, outgoing) => {
+  let [status, body, header] = res[cacheKey];
+  let hasContentLength = false;
+  if (!header) {
+    header = { "content-type": "text/plain; charset=UTF-8" };
+  } else if (header instanceof Headers) {
+    hasContentLength = header.has("content-length");
+    header = buildOutgoingHttpHeaders(header);
+  } else if (Array.isArray(header)) {
+    const headerObj = new Headers(header);
+    hasContentLength = headerObj.has("content-length");
+    header = buildOutgoingHttpHeaders(headerObj);
+  } else {
+    for (const key in header) {
+      if (key.length === 14 && key.toLowerCase() === "content-length") {
+        hasContentLength = true;
+        break;
+      }
+    }
+  }
+  if (!hasContentLength) {
+    if (typeof body === "string") {
+      header["Content-Length"] = Buffer.byteLength(body);
+    } else if (body instanceof Uint8Array) {
+      header["Content-Length"] = body.byteLength;
+    } else if (body instanceof Blob) {
+      header["Content-Length"] = body.size;
+    }
+  }
+  outgoing.writeHead(status, header);
+  if (typeof body === "string" || body instanceof Uint8Array) {
+    outgoing.end(body);
+  } else if (body instanceof Blob) {
+    outgoing.end(new Uint8Array(await body.arrayBuffer()));
+  } else {
+    flushHeaders(outgoing);
+    await writeFromReadableStream(body, outgoing)?.catch(
+      (e) => handleResponseError(e, outgoing)
+    );
+  }
+  ;
+  outgoing[outgoingEnded]?.();
+};
+var isPromise = (res) => typeof res.then === "function";
+var responseViaResponseObject = async (res, outgoing, options = {}) => {
+  if (isPromise(res)) {
+    if (options.errorHandler) {
+      try {
+        res = await res;
+      } catch (err) {
+        const errRes = await options.errorHandler(err);
+        if (!errRes) {
+          return;
+        }
+        res = errRes;
+      }
+    } else {
+      res = await res.catch(handleFetchError);
+    }
+  }
+  if (cacheKey in res) {
+    return responseViaCache(res, outgoing);
+  }
+  const resHeaderRecord = buildOutgoingHttpHeaders(res.headers);
+  if (res.body) {
+    const reader = res.body.getReader();
+    const values = [];
+    let done = false;
+    let currentReadPromise = void 0;
+    if (resHeaderRecord["transfer-encoding"] !== "chunked") {
+      let maxReadCount = 2;
+      for (let i = 0; i < maxReadCount; i++) {
+        currentReadPromise ||= reader.read();
+        const chunk = await readWithoutBlocking(currentReadPromise).catch((e) => {
+          console.error(e);
+          done = true;
+        });
+        if (!chunk) {
+          if (i === 1) {
+            await new Promise((resolve) => setTimeout(resolve));
+            maxReadCount = 3;
+            continue;
+          }
+          break;
+        }
+        currentReadPromise = void 0;
+        if (chunk.value) {
+          values.push(chunk.value);
+        }
+        if (chunk.done) {
+          done = true;
+          break;
+        }
+      }
+      if (done && !("content-length" in resHeaderRecord)) {
+        resHeaderRecord["content-length"] = values.reduce((acc, value) => acc + value.length, 0);
+      }
+    }
+    outgoing.writeHead(res.status, resHeaderRecord);
+    values.forEach((value) => {
+      ;
+      outgoing.write(value);
+    });
+    if (done) {
+      outgoing.end();
+    } else {
+      if (values.length === 0) {
+        flushHeaders(outgoing);
+      }
+      await writeFromReadableStreamDefaultReader(reader, outgoing, currentReadPromise);
+    }
+  } else if (resHeaderRecord[X_ALREADY_SENT]) {
+  } else {
+    outgoing.writeHead(res.status, resHeaderRecord);
+    outgoing.end();
+  }
+  ;
+  outgoing[outgoingEnded]?.();
+};
+var getRequestListener = (fetchCallback, options = {}) => {
+  const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
+  if (options.overrideGlobalObjects !== false && global.Request !== Request2) {
+    Object.defineProperty(global, "Request", {
+      value: Request2
+    });
+    Object.defineProperty(global, "Response", {
+      value: Response2
+    });
+  }
+  return async (incoming, outgoing) => {
+    let res, req;
+    try {
+      req = newRequest(incoming, options.hostname);
+      let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+      if (!incomingEnded) {
+        ;
+        incoming[wrapBodyStream] = true;
+        incoming.on("end", () => {
+          incomingEnded = true;
+        });
+        if (incoming instanceof import_http2.Http2ServerRequest) {
+          ;
+          outgoing[outgoingEnded] = () => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                if (!incomingEnded) {
+                  setTimeout(() => {
+                    drainIncoming(incoming);
+                  });
+                }
+              });
+            }
+          };
+        }
+        outgoing.on("finish", () => {
+          if (!incomingEnded) {
+            drainIncoming(incoming);
+          }
+        });
+      }
+      outgoing.on("close", () => {
+        const abortController = req[abortControllerKey];
+        if (abortController) {
+          if (incoming.errored) {
+            req[abortControllerKey].abort(incoming.errored.toString());
+          } else if (!outgoing.writableFinished) {
+            req[abortControllerKey].abort("Client connection prematurely closed.");
+          }
+        }
+        if (!incomingEnded) {
+          setTimeout(() => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                drainIncoming(incoming);
+              });
+            }
+          });
+        }
+      });
+      res = fetchCallback(req, { incoming, outgoing });
+      if (cacheKey in res) {
+        return responseViaCache(res, outgoing);
+      }
+    } catch (e) {
+      if (!res) {
+        if (options.errorHandler) {
+          res = await options.errorHandler(req ? e : toRequestError(e));
+          if (!res) {
+            return;
+          }
+        } else if (!req) {
+          res = handleRequestError();
+        } else {
+          res = handleFetchError(e);
+        }
+      } else {
+        return handleResponseError(e, outgoing);
+      }
+    }
+    try {
+      return await responseViaResponseObject(res, outgoing, options);
+    } catch (e) {
+      return handleResponseError(e, outgoing);
+    }
+  };
+};
+
+// ../../apps/server/src/services/extensions/http/reply-headers.ts
+function mountedLocation(value, handlerUrl, mount) {
+  if (value.includes("\\")) return null;
+  let target;
+  try {
+    target = new URL(value, handlerUrl);
+  } catch {
+    return null;
+  }
+  if (target.origin !== new URL(handlerUrl).origin) return value;
+  const inMount = target.pathname === mount || target.pathname.startsWith(`${mount}/`);
+  return `${inMount ? "" : mount}${target.pathname}${target.search}${target.hash}`;
+}
+
 // ../../apps/server/src/services/extensions/isolation/virtual-socket.ts
 var import_node_stream2 = require("node:stream");
 var VirtualSocket = class extends import_node_stream2.Duplex {
@@ -45445,10 +46112,19 @@ var VirtualSocket = class extends import_node_stream2.Duplex {
 
 // ../../apps/server/src/services/extensions/isolation/child/virtual-server.ts
 var BODILESS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-async function answerWithFetch(handler, req, res) {
+function callerFrom(raw, refusal) {
+  const verdict = parsePersonVerdict(raw) ?? { ok: false, status: 403, body: refusal };
+  return Object.freeze({ person: Object.freeze(verdict) });
+}
+function belowMount(pathname, mount) {
+  if (pathname === mount) return "/";
+  return pathname.startsWith(`${mount}/`) ? pathname.slice(mount.length) : null;
+}
+async function answerWithFetch(handler, req, res, refusal, mount) {
+  const caller = callerFrom(req.headers[PERSON_VERDICT_HEADER], refusal);
   const headers = new Headers();
   for (const [name, value] of Object.entries(req.headers)) {
-    if (value === void 0) continue;
+    if (value === void 0 || name === PERSON_VERDICT_HEADER) continue;
     for (const one of Array.isArray(value) ? value : [value]) headers.append(name, one);
   }
   let body = null;
@@ -45464,18 +46140,18 @@ async function answerWithFetch(handler, req, res) {
   res.once("close", () => {
     if (!res.writableFinished) abort.abort();
   });
-  const answer = await handler(
-    new Request(`http://${req.headers.host ?? "localhost"}${req.url}`, {
-      method: req.method,
-      headers,
-      body,
-      signal: abort.signal,
-      duplex: "half"
-    })
-  );
-  if (!(answer instanceof Response)) {
+  const request = new Request(`http://${req.headers.host ?? "localhost"}${req.url}`, {
+    method: req.method,
+    headers,
+    body,
+    signal: abort.signal,
+    duplex: "half"
+  });
+  const answered = await handler(request, caller);
+  if (!(answered instanceof Response)) {
     throw new Error("The fetch handler answered with something that is not a Response.");
   }
+  const answer = withMountedLocation(answered, request.url, mount);
   res.status(answer.status);
   answer.headers.forEach((value, name) => {
     if (name !== "set-cookie") res.setHeader(name, value);
@@ -45486,18 +46162,69 @@ async function answerWithFetch(handler, req, res) {
   }
   import_node_stream3.Readable.fromWeb(answer.body).on("error", () => res.destroy()).pipe(res);
 }
+function withMountedLocation(answer, handlerUrl, mount) {
+  const location = answer.headers.get("location");
+  if (location === null) return answer;
+  const headers = new Headers(answer.headers);
+  const mounted = mountedLocation(location, handlerUrl, mount);
+  if (mounted === null) headers.delete("location");
+  else headers.set("location", mounted);
+  return new Response(answer.body, {
+    status: answer.status,
+    statusText: answer.statusText,
+    headers
+  });
+}
+function errorAnswer(status, error62) {
+  return Response.json({ error: error62 }, { status });
+}
 function createVirtualServer(deps) {
+  const mount = `/api/ext/${deps.extensionId}`;
+  let fetchHandler = null;
+  const notFound = (path2) => errorAnswer(404, `Extension '${deps.extensionId}' has no route for ${path2}`);
+  const serveFetchOnly = getRequestListener(
+    async (incoming) => {
+      const sent = new URL(incoming.url);
+      const below = belowMount(sent.pathname, mount);
+      if (below === null) return notFound(sent.pathname);
+      const handler = fetchHandler;
+      if (!handler) return notFound(below);
+      const url2 = new URL(sent.origin);
+      url2.pathname = below;
+      url2.search = sent.search;
+      const caller = callerFrom(incoming.headers.get(PERSON_VERDICT_HEADER), deps.personRefusal);
+      const headers = new Headers(incoming.headers);
+      headers.delete(PERSON_VERDICT_HEADER);
+      const request = new Request(url2, {
+        method: incoming.method,
+        headers,
+        body: BODILESS.has(incoming.method) ? null : incoming.body,
+        signal: incoming.signal,
+        duplex: "half"
+      });
+      try {
+        const answer = await handler(request, caller);
+        if (!(answer instanceof Response)) {
+          throw new Error("The fetch handler answered with something that is not a Response.");
+        }
+        return withMountedLocation(answer, request.url, mount);
+      } catch (err) {
+        console.error("Route error:", err);
+        return errorAnswer(500, err instanceof Error ? err.message : "Internal error");
+      }
+    },
+    { overrideGlobalObjects: false }
+  );
   const app = deps.express();
   app.disable("x-powered-by");
   app.use(deps.express.json({ limit: "1mb" }));
-  app.use(`/api/ext/${deps.extensionId}`, deps.router);
-  let fetchHandler = null;
-  app.use(`/api/ext/${deps.extensionId}`, (req, res, next) => {
+  app.use(mount, deps.router);
+  app.use(mount, (req, res, next) => {
     if (!fetchHandler) {
       next();
       return;
     }
-    answerWithFetch(fetchHandler, req, res).catch(next);
+    answerWithFetch(fetchHandler, req, res, deps.personRefusal, mount).catch(next);
   });
   app.use((req, res) => {
     res.status(404).json({ error: `Extension '${deps.extensionId}' has no route for ${req.path}` });
@@ -45512,7 +46239,10 @@ function createVirtualServer(deps) {
       res.status(500).json({ error: err instanceof Error ? err.message : "Internal error" });
     }
   );
-  const server = import_node_http.default.createServer(app);
+  const server = import_node_http.default.createServer((req, res) => {
+    if (deps.router.stack.length > 0) app(req, res);
+    else void serveFetchOnly(req, res);
+  });
   server.requestTimeout = 0;
   server.headersTimeout = 0;
   server.keepAliveTimeout = 0;
@@ -46414,7 +47144,13 @@ function main() {
       return;
     }
     const router = import_express.default.Router();
-    const served = createVirtualServer({ extensionId: init.extensionId, express: import_express.default, router, send });
+    const served = createVirtualServer({
+      extensionId: init.extensionId,
+      express: import_express.default,
+      router,
+      send,
+      personRefusal: init.personRefusal
+    });
     virtual = served;
     const ctx = proxy.ctx;
     const proxied = proxy;