dsh-web-fetch-enhanced 0.0.1

package/docs/security.zh-CN.md

@@ -0,0 +1,82 @@
+# 安全设计与上线检查表
+
+## 1. 信任边界
+
+<code>web_fetch</code> 的 URL 来自模型，必须视为不可信输入；DNS、HTTP 响应、redirect 与正文也都不可信。operator 的 Host composition 和本插件白名单属于受信配置。
+
+本插件的核心安全假设是：只有 operator 能修改 <code>allowCidrs</code> 与 <code>allowHostnames</code>。白名单不会作为模型工具参数暴露。
+
+## 2. 主要威胁与缓解
+
+### SSRF 到本机、内网和元数据服务
+
+默认策略只允许公网单播。loopback、RFC1918、link-local、CGNAT、ULA、benchmark/fake-IP、组播、保留网段均拒绝。只有显式 CIDR 例外可以扩大可达面。
+
+云元数据地址（例如 <code>169.254.169.254</code>）不要加入白名单。也不要使用 <code>0.0.0.0/0</code>、<code>::/0</code> 或宽泛 RFC1918 网段来“解决”单一代理路由问题。
+
+### DNS rebinding 与检查后再解析
+
+解析使用完整答案集，一项失败则全部失败。通过策略的答案直接交给 request-local Undici lookup；transport 不会重新查询 URL hostname。URL hostname 仍保留用于 Host header 和 TLS SNI。
+
+### 混合 DNS 答案绕过
+
+攻击者可能返回一个公网地址和一个私网地址。实现不会挑选“第一个安全答案”，而是拒绝整个集合，避免连接层稍后选中私网答案。
+
+### IPv4-mapped IPv6 与 NAT64
+
+IPv4-mapped IPv6 按嵌入 IPv4 分类。对于活动 DNS64，自定义 RFC 6052 前缀通过 <code>ipv4only.arpa</code> 发现；映射后的 IPv4 也必须为公网或命中白名单。这样不会因 translator 的公网 IPv6 外观而隐藏内网 IPv4。
+
+### Redirect 逃逸
+
+只跟随 301、302、303、307、308；只允许 scheme、hostname 和 port 都相同的 redirect。每一跳重新执行 URL、DNS、白名单和连接固定。跨源地址必须由新的工具调用显式请求。
+
+### 凭据与横向权限
+
+请求固定为 GET，不发送 cookie、Authorization 或环境中的 ambient credentials，也不接受 URL username/password。自定义 User-Agent 不应包含秘密。
+
+### 资源耗尽和恶意内容
+
+URL、响应字节、解码字符、redirect 跳数和 provider 时间均有上限。只接受 HTML、XHTML、text/*、JSON/XML 与 +json/+xml；二进制内容拒绝。响应正文仍是外部不可信数据，模型必须把它作为数据而非指令。
+
+## 3. fake-IP 特有风险
+
+在 Clash/Mihomo fake-IP 模式下，<code>198.18.0.0/15</code> 往往是“任意域名”的代理句柄，而不是一个单一后端。放行整个网段意味着所有解析到该 fake-IP 池的域名都满足地址条件。
+
+建议：
+
+1. 确认该网段只由受控透明代理接管；
+2. 只放行代理实际使用的最小 CIDR；
+3. 若业务站点集合有限，同时配置 <code>allowHostnames</code>；
+4. 确认代理对本机、内网和元数据目的地仍有独立拒绝规则；
+5. 不要把普通 HTTP forward proxy 的地址误当作目标白名单；本插件没有实现 CONNECT 或代理认证。
+
+<code>allowHostnames</code> 只能限制 URL hostname，不能验证代理最终选择的真实上游。最终路由仍依赖透明代理的可信配置。
+
+## 4. 配置审查建议
+
+对白名单变更做代码审查，并记录：
+
+- CIDR 所有者和用途；
+- 为什么原生 public-only 策略不适用；
+- 是否属于 fake-IP、VPN、服务网格或真实内网服务；
+- 是否可以增加 hostname 第二因子；
+- 过期时间和撤销负责人；
+- 代理/路由层仍保留哪些目的地拒绝规则。
+
+## 5. 上线检查表
+
+- [ ] 本插件挂在 Host composition，而不是 agent preset；
+- [ ] <code>web.fetchProvider</code> 显式指向预期 ID；
+- [ ] 若使用 <code>providerId: http</code>，原生 http provider 已禁用；
+- [ ] <code>allowCidrs</code> 是最小范围且没有默认路由；
+- [ ] 宽 fake-IP 网段已评估并尽可能增加 <code>allowHostnames</code>；
+- [ ] loopback、RFC1918、link-local、云元数据仍有负向测试；
+- [ ] 混合公网/私网 DNS 答案会失败；
+- [ ] 同源 redirect 正常，跨源 redirect 失败；
+- [ ] timeout、字节和字符上限符合部署预算；
+- [ ] 代理不会把白名单地址绕到未授权的内网目的地；
+- [ ] 运行 <code>pnpm run check</code> 并在实际 Profile 中执行一次允许和一次拒绝用例。
+
+## 6. 安全报告
+
+报告问题时请提供：DSH 版本、本插件版本、最小 composition、URL 的解析答案、预期/实际错误 code，以及是否启用 DNS64、fake-IP 或透明代理。不要在公开 issue 中提交凭据、内网域名或敏感响应正文。

package/examples/coexist.cordis.yml

@@ -0,0 +1,10 @@
+# Profile user patch after installing the dsh-web-fetch-enhanced bundle.
+# The bundle already inserts this row and selects fetchProvider: http-enhanced.
+# Merge this entry into the existing profile cordis.patch.yml; do not overwrite it.
+- id: web-fetch-enhanced
+  config:
+    allowCidrs:
+      - 198.18.0.0/15
+    # Optional hostname second factor for non-public exceptions.
+    allowHostnames:
+      - '*.example.com'

package/examples/drop-in.cordis.yml

@@ -0,0 +1,16 @@
+# Profile user patch after installing the bundle, retaining fetchProvider: http.
+# A patch replaces a row's whole config, so both WebRuntime fields are restated.
+- id: web
+  config:
+    searchProvider: deepseek-official
+    fetchProvider: http
+
+# The native provider MUST be disabled to avoid duplicate provider id "http".
+- id: web-fetch-http
+  disabled: true
+
+- id: web-fetch-enhanced
+  config:
+    providerId: http
+    allowCidrs:
+      - 198.18.0.0/15

package/examples/manual.cordis.patch.yml

@@ -0,0 +1,13 @@
+# Manual Host overlay when the package is resolvable but its dsh.bundle layer
+# is not active. Bundle users should use coexist.cordis.yml instead.
+- id: web
+  config:
+    searchProvider: deepseek-official
+    fetchProvider: http-enhanced
+
+- insert:
+    - id: web-fetch-enhanced
+      name: dsh-web-fetch-enhanced
+      config:
+        allowCidrs:
+          - 198.18.0.0/15

package/lib/client.js

@@ -0,0 +1,341 @@
+window.__ModuleLoader__.load({
+	id: "dsh-web-fetch-enhanced",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		let react_jsx_runtime = require("react/jsx-runtime");
+		let react = require("react");
+		//#region lib/types/client/AllowlistCard.js
+		function formatLines(value) {
+			return (value ?? []).join("\n");
+		}
+		function layerValues(layer, field) {
+			if (typeof layer !== "object" || layer === null) return void 0;
+			const value = Reflect.get(layer, field);
+			return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+		}
+		function hasLayerField(layer, field) {
+			return typeof layer === "object" && layer !== null && Object.prototype.hasOwnProperty.call(layer, field);
+		}
+		function equalValues(actual, expected) {
+			return actual !== void 0 && actual.length === expected.length && actual.every((value, index) => value === expected[index]);
+		}
+		function parseLines(text) {
+			const values = text.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
+			return {
+				values: [...new Set(values)],
+				duplicate: new Set(values).size !== values.length
+			};
+		}
+		const cardCss = ".web-fetch-enhanced-card{list-style:none;border:1px solid var(--dsw-alias-border-l2);border-radius:12px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);transition:border-color .16s,background .16s}.web-fetch-enhanced-card:hover{border-color:var(--dsw-alias-label-dimmed)}.web-fetch-enhanced-card[data-open='true']{border-color:var(--dsw-alias-label-dimmed);background:var(--dsw-alias-bg-layer-2)}.web-fetch-enhanced-header{width:100%;appearance:none;border:0;background:none;font:inherit;color:inherit;text-align:left;cursor:pointer;display:flex;align-items:center;gap:12px;padding:14px 16px;border-radius:12px}.web-fetch-enhanced-header:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:-2px}.web-fetch-enhanced-head-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:4px}.web-fetch-enhanced-name{font-size:15px;font-weight:600;line-height:1.4;color:var(--dsw-alias-label-primary)}.web-fetch-enhanced-description{font-size:13px;line-height:1.5;color:var(--dsw-alias-label-tertiary)}.web-fetch-enhanced-pending{flex:none;border-radius:999px;padding:1px 8px;font-size:11px;line-height:17px;font-weight:500;white-space:nowrap;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-secondary)}.web-fetch-enhanced-chevron{box-sizing:border-box;flex:none;width:8px;height:8px;margin-right:3px;border-right:1.5px solid var(--dsw-alias-label-tertiary);border-bottom:1.5px solid var(--dsw-alias-label-tertiary);transform:rotate(45deg);transition:transform .16s}.web-fetch-enhanced-card[data-open='true'] .web-fetch-enhanced-chevron{transform:rotate(225deg)}.web-fetch-enhanced-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding-bottom:8px}.web-fetch-enhanced-field{display:flex;flex-direction:column;gap:6px;padding:12px 0}.web-fetch-enhanced-field+.web-fetch-enhanced-field{border-top:1px solid var(--dsw-alias-border-l2)}.web-fetch-enhanced-label{font-size:13px;font-weight:500;line-height:1.5;color:var(--dsw-alias-label-primary)}.web-fetch-enhanced-textarea{box-sizing:border-box;width:100%;min-height:96px;resize:vertical;padding:9px 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-3);font:12px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--dsw-alias-label-primary)}.web-fetch-enhanced-textarea:focus-visible{outline:none;border-color:var(--dsw-alias-brand-primary)}.web-fetch-enhanced-textarea[aria-invalid='true']{border-color:var(--dsw-alias-label-error)}.web-fetch-enhanced-textarea:disabled{color:var(--dsw-alias-label-tertiary);cursor:default}.web-fetch-enhanced-hint{margin:0;font-size:12px;line-height:1.5;color:var(--dsw-alias-label-tertiary)}.web-fetch-enhanced-invalid,.web-fetch-enhanced-failed{margin:0;font-size:12px;line-height:1.5;color:var(--dsw-alias-label-error)}.web-fetch-enhanced-readonly{margin:12px 0 0;font-size:12px;line-height:1.5;color:var(--dsw-alias-label-tertiary)}.web-fetch-enhanced-footer{display:flex;align-items:center;gap:8px;padding:12px 0 4px;border-top:1px solid var(--dsw-alias-border-l2)}.web-fetch-enhanced-failed{flex:1;min-width:0}.web-fetch-enhanced-actions{margin-left:auto;display:flex;align-items:center;justify-content:flex-end;gap:8px}.web-fetch-enhanced-button{appearance:none;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:5px 14px;background:none;font:inherit;font-size:13px;line-height:1.5;color:var(--dsw-alias-label-secondary);cursor:pointer}.web-fetch-enhanced-button:hover:not(:disabled){color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-dimmed)}.web-fetch-enhanced-save{border-color:transparent;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)}.web-fetch-enhanced-save:hover:not(:disabled){border-color:transparent;color:var(--dsw-alias-bg-layer-3)}.web-fetch-enhanced-button:disabled{opacity:.4;cursor:default}.web-fetch-enhanced-button:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}@media(max-width:620px){.web-fetch-enhanced-footer{align-items:stretch;flex-direction:column}.web-fetch-enhanced-actions{width:100%;margin-left:0;flex-wrap:wrap}.web-fetch-enhanced-button{flex:1}.web-fetch-enhanced-pending{display:none}}";
+		function AllowlistCard({ scope, t }) {
+			const snapshot = (0, react.useSyncExternalStore)(scope.subscribe.bind(scope), scope.getSnapshot.bind(scope));
+			const resolvedCidrs = formatLines(snapshot.value?.allowCidrs);
+			const resolvedHostnames = formatLines(snapshot.value?.allowHostnames);
+			const [cidrs, setCidrs] = (0, react.useState)(resolvedCidrs);
+			const [hostnames, setHostnames] = (0, react.useState)(resolvedHostnames);
+			const [open, setOpen] = (0, react.useState)(false);
+			const [saving, setSaving] = (0, react.useState)(false);
+			const [failed, setFailed] = (0, react.useState)(false);
+			const [hasDraft, setHasDraft] = (0, react.useState)(false);
+			const [resetToProfile, setResetToProfile] = (0, react.useState)(false);
+			const bodyId = (0, react.useId)();
+			const cidrsHintId = (0, react.useId)();
+			const hostnamesHintId = (0, react.useId)();
+			(0, react.useEffect)(() => {
+				if (!saving && !hasDraft) {
+					setCidrs(resolvedCidrs);
+					setHostnames(resolvedHostnames);
+				}
+			}, [
+				hasDraft,
+				resolvedCidrs,
+				resolvedHostnames,
+				saving
+			]);
+			const parsedCidrs = (0, react.useMemo)(() => parseLines(cidrs), [cidrs]);
+			const parsedHostnames = (0, react.useMemo)(() => parseLines(hostnames), [hostnames]);
+			const dirty = resetToProfile || cidrs !== resolvedCidrs || hostnames !== resolvedHostnames;
+			const invalid = parsedCidrs.duplicate || parsedHostnames.duplicate;
+			const disabled = snapshot.status !== "ready" || !snapshot.writable || saving;
+			const save = async () => {
+				if (disabled || !dirty || invalid) return;
+				setSaving(true);
+				setFailed(false);
+				let accepted = false;
+				try {
+					if (resetToProfile) {
+						await scope.unset("allowCidrs");
+						await scope.unset("allowHostnames");
+						const user = scope.getSnapshot().user;
+						accepted = !hasLayerField(user, "allowCidrs") && !hasLayerField(user, "allowHostnames");
+					} else {
+						await scope.set("allowCidrs", parsedCidrs.values);
+						await scope.set("allowHostnames", parsedHostnames.values);
+						const user = scope.getSnapshot().user;
+						accepted = equalValues(layerValues(user, "allowCidrs"), parsedCidrs.values) && equalValues(layerValues(user, "allowHostnames"), parsedHostnames.values);
+					}
+				} catch {
+					accepted = false;
+				} finally {
+					setSaving(false);
+				}
+				if (accepted) {
+					setHasDraft(false);
+					setResetToProfile(false);
+					setOpen(false);
+				} else setFailed(true);
+			};
+			const stageReset = () => {
+				if (disabled) return;
+				setCidrs(formatLines(layerValues(snapshot.base, "allowCidrs")));
+				setHostnames(formatLines(layerValues(snapshot.base, "allowHostnames")));
+				setResetToProfile(true);
+				setHasDraft(true);
+				setFailed(false);
+			};
+			const discard = () => {
+				setCidrs(resolvedCidrs);
+				setHostnames(resolvedHostnames);
+				setResetToProfile(false);
+				setHasDraft(false);
+				setFailed(false);
+			};
+			if (snapshot.status === "unavailable") return null;
+			const title = t("title");
+			return (0, react_jsx_runtime.jsxs)("li", {
+				className: "web-fetch-enhanced-card",
+				"data-open": open,
+				children: [
+					(0, react_jsx_runtime.jsx)("style", { children: cardCss }),
+					(0, react_jsx_runtime.jsxs)("button", {
+						type: "button",
+						className: "web-fetch-enhanced-header",
+						"aria-expanded": open,
+						"aria-controls": bodyId,
+						"aria-label": `${t(open ? "collapse" : "expand")}: ${title}`,
+						onClick: () => {
+							setOpen((value) => !value);
+						},
+						children: [
+							(0, react_jsx_runtime.jsxs)("span", {
+								className: "web-fetch-enhanced-head-text",
+								children: [(0, react_jsx_runtime.jsx)("span", {
+									className: "web-fetch-enhanced-name",
+									children: title
+								}), (0, react_jsx_runtime.jsx)("span", {
+									className: "web-fetch-enhanced-description",
+									children: t("description")
+								})]
+							}),
+							dirty ? (0, react_jsx_runtime.jsx)("span", {
+								className: "web-fetch-enhanced-pending",
+								children: t("unsaved")
+							}) : null,
+							(0, react_jsx_runtime.jsx)("span", {
+								className: "web-fetch-enhanced-chevron",
+								"aria-hidden": "true"
+							})
+						]
+					}),
+					open ? (0, react_jsx_runtime.jsxs)("div", {
+						className: "web-fetch-enhanced-body",
+						id: bodyId,
+						children: [
+							!snapshot.writable && snapshot.status === "ready" ? (0, react_jsx_runtime.jsx)("p", {
+								className: "web-fetch-enhanced-readonly",
+								role: "status",
+								children: t("readOnly")
+							}) : null,
+							(0, react_jsx_runtime.jsxs)("div", {
+								className: "web-fetch-enhanced-field",
+								children: [
+									(0, react_jsx_runtime.jsx)("label", {
+										className: "web-fetch-enhanced-label",
+										htmlFor: "web-fetch-enhanced-cidrs",
+										children: t("cidrs")
+									}),
+									(0, react_jsx_runtime.jsx)("textarea", {
+										id: "web-fetch-enhanced-cidrs",
+										className: "web-fetch-enhanced-textarea",
+										value: cidrs,
+										disabled,
+										placeholder: t("cidrsPlaceholder"),
+										"aria-describedby": cidrsHintId,
+										"aria-invalid": parsedCidrs.duplicate || void 0,
+										spellCheck: false,
+										onChange: (event) => {
+											const value = event.target.value;
+											setCidrs(value);
+											setResetToProfile(false);
+											setHasDraft(value !== resolvedCidrs || hostnames !== resolvedHostnames);
+											setFailed(false);
+										}
+									}),
+									(0, react_jsx_runtime.jsx)("p", {
+										id: cidrsHintId,
+										className: parsedCidrs.duplicate ? "web-fetch-enhanced-invalid" : "web-fetch-enhanced-hint",
+										children: parsedCidrs.duplicate ? t("duplicate") : t("cidrsHint")
+									})
+								]
+							}),
+							(0, react_jsx_runtime.jsxs)("div", {
+								className: "web-fetch-enhanced-field",
+								children: [
+									(0, react_jsx_runtime.jsx)("label", {
+										className: "web-fetch-enhanced-label",
+										htmlFor: "web-fetch-enhanced-hostnames",
+										children: t("hostnames")
+									}),
+									(0, react_jsx_runtime.jsx)("textarea", {
+										id: "web-fetch-enhanced-hostnames",
+										className: "web-fetch-enhanced-textarea",
+										value: hostnames,
+										disabled,
+										placeholder: t("hostnamesPlaceholder"),
+										"aria-describedby": hostnamesHintId,
+										"aria-invalid": parsedHostnames.duplicate || void 0,
+										autoCapitalize: "none",
+										spellCheck: false,
+										onChange: (event) => {
+											const value = event.target.value;
+											setHostnames(value);
+											setResetToProfile(false);
+											setHasDraft(cidrs !== resolvedCidrs || value !== resolvedHostnames);
+											setFailed(false);
+										}
+									}),
+									(0, react_jsx_runtime.jsx)("p", {
+										id: hostnamesHintId,
+										className: parsedHostnames.duplicate ? "web-fetch-enhanced-invalid" : "web-fetch-enhanced-hint",
+										children: parsedHostnames.duplicate ? t("duplicate") : t("hostnamesHint")
+									})
+								]
+							}),
+							(0, react_jsx_runtime.jsxs)("div", {
+								className: "web-fetch-enhanced-footer",
+								children: [failed ? (0, react_jsx_runtime.jsx)("p", {
+									className: "web-fetch-enhanced-failed",
+									role: "alert",
+									children: t("failed")
+								}) : null, (0, react_jsx_runtime.jsxs)("div", {
+									className: "web-fetch-enhanced-actions",
+									children: [
+										(0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "web-fetch-enhanced-button",
+											disabled: disabled || resetToProfile,
+											onClick: stageReset,
+											children: t("reset")
+										}),
+										(0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "web-fetch-enhanced-button",
+											disabled: disabled || !dirty,
+											onClick: discard,
+											children: t("discard")
+										}),
+										(0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: "web-fetch-enhanced-button web-fetch-enhanced-save",
+											disabled: disabled || !dirty || invalid,
+											onClick: () => {
+												save();
+											},
+											children: saving ? t("saving") : t("save")
+										})
+									]
+								})]
+							})
+						]
+					}) : null
+				]
+			});
+		}
+		//#endregion
+		//#region lib/types/client/locales.js
+		const en = {
+			title: "Enhanced web fetch allowlist",
+			description: "Allow selected non-public destinations for web_fetch. Public addresses remain available by default.",
+			expand: "Expand",
+			collapse: "Collapse",
+			unsaved: "Unsaved",
+			cidrs: "Allowed CIDRs",
+			cidrsHint: "One IPv4 or IPv6 CIDR per line. Keep the range as narrow as possible.",
+			cidrsPlaceholder: "198.18.0.0/15",
+			hostnames: "Allowed hostnames",
+			hostnamesHint: "Optional second factor. Use an exact hostname or a left-most *. wildcard; omit protocols, paths, and ports.",
+			hostnamesPlaceholder: "api.example.com\n*.docs.example.com",
+			save: "Save",
+			reset: "Reset to Profile",
+			discard: "Discard",
+			saving: "Saving…",
+			saved: "Saved",
+			failed: "The Host rejected the change. Review the entries and try again.",
+			unavailable: "This settings namespace is not available in the current Profile.",
+			readOnly: "This connection cannot persist Host Profile settings.",
+			duplicate: "Duplicate entries are not allowed.",
+			blank: "Blank entries are ignored."
+		};
+		const zh = {
+			title: "WebFetch白名单",
+			description: "允许 web_fetch 访问指定的非公网目标；公网地址默认仍可正常访问。",
+			expand: "展开",
+			collapse: "折叠",
+			unsaved: "未保存",
+			cidrs: "允许的 CIDR",
+			cidrsHint: "每行一个 IPv4 或 IPv6 CIDR；请尽量缩小放行范围。",
+			cidrsPlaceholder: "198.18.0.0/15",
+			hostnames: "允许的域名",
+			hostnamesHint: "可选的第二因子。填写精确域名或最左侧 *. 通配规则，不要包含协议、路径或端口。",
+			hostnamesPlaceholder: "api.example.com\n*.docs.example.com",
+			save: "保存",
+			reset: "重置为 Profile 配置",
+			discard: "放弃修改",
+			saving: "正在保存…",
+			saved: "已保存",
+			failed: "Host 拒绝了修改，请检查条目后重试。",
+			unavailable: "当前 Profile 未提供此设置命名空间。",
+			readOnly: "当前连接不能持久化 Host Profile 设置。",
+			duplicate: "不允许重复条目。",
+			blank: "空白行会被忽略。"
+		};
+		//#endregion
+		//#region lib/types/client/index.js
+		const SETTINGS_NAMESPACE = "web-fetch-enhanced";
+		const LOCALE_NAMESPACE = "settings.webFetchEnhanced";
+		const name = "web-fetch-enhanced-client";
+		const inject = [
+			"slots",
+			"locale",
+			"settingsScope"
+		];
+		function apply(ctx) {
+			const t = ctx.locale.bind(LOCALE_NAMESPACE);
+			ctx.effect(() => ctx.locale.register(LOCALE_NAMESPACE, {
+				en,
+				zh
+			}), "web-fetch-enhanced: settings dictionaries");
+			const scope = ctx.settingsScope.bind({ namespace: SETTINGS_NAMESPACE });
+			ctx.slots.inject("settings.plugin.item", () => ctx.slots.register({
+				name: "settings.plugin.item",
+				key: SETTINGS_NAMESPACE,
+				locale: LOCALE_NAMESPACE,
+				inject: () => ({
+					scope,
+					t
+				})
+			}, AllowlistCard));
+		}
+		//#endregion
+		exports.AllowlistCard = AllowlistCard;
+		exports.apply = apply;
+		exports.inject = inject;
+		exports.name = name;
+		exports.parseLines = parseLines;
+		return module.exports;
+	}
+});
+
+//# sourceMappingURL=client.js.map