Merge branch 'master' into v2

Brings the upstream device registry and CORS fixes into the v2 branch:

  - Seeed Wio Tracker L2 Pro (hwModel 137, esp32-s3, 16MB) added to the
    device hardware registry -- 114 devices to 115.
  - src/index.ts returns "" instead of throwing for a disallowed CORS
    origin, which had been turning every non-whitelisted request into a
    500. Affects only the legacy tinyhttp server; the Worker path uses the
    static wildcard in worker/src/cors.ts and was never exposed to it.

One adaptation was required. tests/worker/router.test.ts asserted the
deviceHardware payload was exactly 38536 bytes, so the new entry broke the
four "serves the same bytes" cases. That test is about the router resolving
all four path spellings to one handler -- the byte count was incidental, and
would break again on every future device addition. It now compares against
DEVICE_HARDWARE.body from the generated module, which checks the actual
bytes rather than just their count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: thebentern

src/index.ts

@@ -53,7 +53,16 @@ app
         if (whitelist.indexOf(req.headers.origin) !== -1) {
           return req.headers.origin;
         }
-        throw new Error("Origin not allowed by CORS");
+
+        // Not allowed: return no origin rather than throwing. @tinyhttp/cors
+        // passes this return value straight to res.setHeader and does not catch,
+        // so throwing here escaped the middleware and turned every request from a
+        // non-whitelisted origin into a 500 -- including the OPTIONS preflight.
+        // An empty value is the same denial the no-origin branch above already
+        // returns: the browser sees no matching Access-Control-Allow-Origin and
+        // blocks the read, which is where that decision belongs. Credentials are
+        // enabled, so a wildcard is not an option.
+        return "";
       },
     }),
   )

src/lib/resource.ts

@@ -1381,4 +1381,16 @@ export const deviceHardwareList: DeviceHardware[] = [
     images: ["rak3401.svg"],
     requiresDfu: true,
   },
+  {
+    hwModel: 137,
+    hwModelSlug: "SEEED_WIO_TRACKER_L2",
+    platformioTarget: "seeed-wio-tracker-l2",
+    architecture: "esp32-s3",
+    activelySupported: false,
+    supportLevel: 1,
+    displayName: "Seeed Wio Tracker L2 Pro",
+    tags: ["Seeed"],
+    requiresDfu: true,
+    partitionScheme: "16MB",
+  },
 ];

tests/worker/router.test.ts

@@ -4,6 +4,7 @@ import {
   waitOnExecutionContext,
 } from "cloudflare:test";
 import { beforeAll, describe, expect, it } from "vitest";
+import { DEVICE_HARDWARE } from "../../worker/src/generated/documents.js";
 import worker from "../../worker/src/index.js";
 import { FLASH_TTL } from "../../worker/src/respond.js";
 import { seed } from "./seed.js";
@@ -31,7 +32,10 @@ describe("path matching reproduces regexparam", () => {
   ])("%s serves the same bytes", async (p) => {
     const res = await call(p);
     expect(res.status).toBe(200);
-    expect((await res.text()).length).toBe(38536);
+    // Compare against the generated document rather than a hard-coded length: this test is
+    // about the router resolving all four spellings to one handler, and a byte count turns
+    // every device-registry addition into an unrelated failure here.
+    expect(await res.text()).toBe(DEVICE_HARDWARE.body);
   });
 
   it.each(["//resource/deviceHardware", "/resource//deviceHardware"])(