@nifrajs/cli 2.11.0 → 2.12.1

package/dist/work-graph.js

@@ -0,0 +1,465 @@
+/**
+ * Static verification work graph for agents.
+ *
+ * The graph is intentionally a compact, token-only description of project structure. It connects
+ * reflected routes to schemas, capabilities, assurance evidence, source/test files, and static
+ * manifests. It never probes a running application and never persists payloads.
+ */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { existsSync } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import { reflectRoutes } from "@nifrajs/core/reflection";
+import { Glob } from "bun";
+import { digestRoute } from "./contracts.js";
+export class StaleBuildError extends Error {
+    freshness;
+    constructor(freshness) {
+        super(freshness.reason ?? "nifra work graph requires a fresh build");
+        this.freshness = freshness;
+        this.name = "StaleBuildError";
+    }
+}
+const SOURCE_GLOB = new Glob("**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json}");
+const IGNORED = /(^|\/)(node_modules|dist|build|\.nifra|\.git|\.wrangler|coverage)\//;
+const MANIFEST_NAMES = new Set([
+    "server-manifest.ts",
+    "nifra-manifest.json",
+    "nifra-manifest.ts",
+    "manifest.json",
+]);
+export function evaluateBuildFreshness(input) {
+    if (!input.hasArtifact) {
+        return {
+            ok: false,
+            ...(input.buildDir === undefined ? {} : { buildDir: input.buildDir }),
+            newestSourceMs: input.newestSourceMs,
+            newestBuildMs: input.newestBuildMs,
+            reason: "nifra work graph refused: no built artifact found; run `nifra build` first",
+        };
+    }
+    if (input.newestSourceMs >= input.newestBuildMs) {
+        return {
+            ok: false,
+            ...(input.buildDir === undefined ? {} : { buildDir: input.buildDir }),
+            newestSourceMs: input.newestSourceMs,
+            newestBuildMs: input.newestBuildMs,
+            reason: "nifra work graph refused: the build is stale; run `nifra build` before graphing",
+        };
+    }
+    return {
+        ok: true,
+        ...(input.buildDir === undefined ? {} : { buildDir: input.buildDir }),
+        newestSourceMs: input.newestSourceMs,
+        newestBuildMs: input.newestBuildMs,
+    };
+}
+export async function inspectBuildFreshness(cwd) {
+    const sourcePaths = [];
+    for (const name of ["backend.ts", "framework.ts", "nifra.config.ts"]) {
+        const path = resolve(cwd, name);
+        if (existsSync(path))
+            sourcePaths.push(path);
+    }
+    for await (const path of SOURCE_GLOB.scan({ cwd, dot: false })) {
+        if (!IGNORED.test(path) && path.startsWith("routes/"))
+            sourcePaths.push(resolve(cwd, path));
+    }
+    const sourceTimes = await fileTimes(sourcePaths);
+    for (const buildDirName of ["dist", "build"]) {
+        const buildDir = resolve(cwd, buildDirName);
+        if (!existsSync(buildDir))
+            continue;
+        const artifacts = [];
+        for await (const path of new Glob("**/*.{js,mjs,cjs}").scan({ cwd: buildDir, dot: false })) {
+            artifacts.push(resolve(buildDir, path));
+        }
+        if (artifacts.length === 0)
+            continue;
+        const buildTimes = await fileTimes(artifacts);
+        return evaluateBuildFreshness({
+            hasArtifact: true,
+            newestSourceMs: sourceTimes,
+            newestBuildMs: buildTimes,
+            buildDir: buildDirName,
+        });
+    }
+    return evaluateBuildFreshness({
+        hasArtifact: false,
+        newestSourceMs: sourceTimes,
+        newestBuildMs: 0,
+    });
+}
+export async function collectProjectWorkGraph(cwd, options = {}) {
+    const freshness = await inspectBuildFreshness(cwd);
+    if (!freshness.ok)
+        throw new StaleBuildError(freshness);
+    const backendPath = resolve(cwd, "backend.ts");
+    if (!existsSync(backendPath))
+        throw new Error(`[nifra] no backend.ts in ${cwd}`);
+    const loadedValue = await import(__rewriteRelativeImportExtension(`${backendPath}?nifra-work-graph=${Date.now()}`));
+    const loaded = recordOf(loadedValue);
+    if (loaded?.backend === undefined)
+        throw new Error(`[nifra] ${backendPath} does not export backend`);
+    const files = await collectProjectFiles(cwd);
+    return buildProjectWorkGraph({ source: loaded.backend, files, freshness }, options);
+}
+export async function buildProjectWorkGraph(input, options = {}) {
+    const freshness = input.freshness ?? { ok: true };
+    if (!freshness.ok)
+        throw new StaleBuildError(freshness);
+    const graph = await buildWorkGraph(input);
+    const impact = queryImpact(graph, options.changedFiles ?? []);
+    const plan = planProofs(graph, impact, options.minLevel ?? 1);
+    const evidence = createEvidenceBundle(graph, impact, plan);
+    return Object.freeze({ graph, impact, plan, evidence });
+}
+export async function buildWorkGraph(input) {
+    const routes = reflectRoutes(input.source);
+    const files = input.files ?? [];
+    const nodes = new Map();
+    const edges = [];
+    const addNode = (node) => {
+        if (!nodes.has(node.id))
+            nodes.set(node.id, node);
+    };
+    const addEdge = (edge) => {
+        if (!edges.some((item) => item.from === edge.from && item.to === edge.to && item.relation === edge.relation))
+            edges.push(edge);
+    };
+    for (const file of files) {
+        const kind = file.kind ??
+            (isTestFile(file.path)
+                ? "test"
+                : MANIFEST_NAMES.has(basename(file.path))
+                    ? "manifest"
+                    : "source");
+        if (kind === "source")
+            addNode(await fileNode(file, "file"));
+        if (kind === "test")
+            addNode(await fileNode(file, "test"));
+        if (kind === "manifest")
+            addNode(await fileNode(file, "manifest"));
+    }
+    const sourceFiles = files.filter((file) => (file.kind ?? "source") === "source");
+    const testFiles = files.filter((file) => (file.kind ?? "source") === "test" || isTestFile(file.path));
+    const manifestFiles = files.filter((file) => (file.kind ?? "source") === "manifest" || MANIFEST_NAMES.has(basename(file.path)));
+    for (const route of routes) {
+        const routeKey = `${route.method} ${route.path}`;
+        const routeId = `route:${routeKey}`;
+        const routeDigest = await digestRoute(route);
+        const routeFiles = filesForRoute(route, sourceFiles);
+        addNode({
+            id: routeId,
+            kind: "route",
+            label: routeKey,
+            digest: await digestJson({ route: routeKey, routeDigest }),
+            files: routeFiles,
+        });
+        for (const file of routeFiles)
+            addEdge({ from: `file:${file}`, to: routeId, relation: "implements" });
+        if (routeFiles.length === 0 && sourceFiles.some((file) => file.path === "backend.ts"))
+            addEdge({ from: "file:backend.ts", to: routeId, relation: "implements" });
+        for (const [name, schema] of Object.entries(route.schema ?? {})) {
+            if (schema === undefined || name === "errors")
+                continue;
+            const schemaId = `schema:${routeKey}:${name}`;
+            addNode({
+                id: schemaId,
+                kind: "schema",
+                label: `${routeKey} ${name}`,
+                digest: await digestJson(schema.jsonSchema ?? schema.fields ?? null),
+                files: routeFiles,
+            });
+            addEdge({ from: routeId, to: schemaId, relation: "contains" });
+        }
+        for (const capability of route.capabilities ?? []) {
+            const capabilityId = `capability:${capability}`;
+            addNode({
+                id: capabilityId,
+                kind: "capability",
+                label: capability,
+                digest: await digestJson(capability),
+                files: routeFiles,
+            });
+            addEdge({ from: routeId, to: capabilityId, relation: "declares" });
+        }
+        for (const assurance of route.assurance ?? []) {
+            const assuranceId = `assurance:${routeKey}:${assurance.id}`;
+            addNode({
+                id: assuranceId,
+                kind: "assurance",
+                label: `${routeKey} ${assurance.id}`,
+                digest: await digestJson(assurance),
+                files: routeFiles,
+            });
+            addEdge({ from: routeId, to: assuranceId, relation: "enforces" });
+        }
+        for (const file of testFiles) {
+            if (!mentionsRoute(file.content, route))
+                continue;
+            const testId = `test:${file.path}`;
+            addEdge({ from: testId, to: routeId, relation: "tests" });
+        }
+        for (const file of manifestFiles)
+            addEdge({ from: `manifest:${file.path}`, to: routeId, relation: "describes" });
+    }
+    const sortedNodes = [...nodes.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const sortedEdges = edges.sort((a, b) => `${a.from}\n${a.to}\n${a.relation}`.localeCompare(`${b.from}\n${b.to}\n${b.relation}`));
+    const digest = await digestJson({ nodes: sortedNodes, edges: sortedEdges });
+    return Object.freeze({
+        version: 1,
+        digest,
+        nodes: Object.freeze(sortedNodes),
+        edges: Object.freeze(sortedEdges),
+        freshness: input.freshness ?? { ok: true },
+    });
+}
+export function queryImpact(graph, changedFiles) {
+    const normalized = [
+        ...new Set(changedFiles.map((file) => file.replace(/^\.\//, "").replaceAll("\\", "/"))),
+    ];
+    const seeds = new Set();
+    for (const file of normalized) {
+        for (const node of graph.nodes) {
+            if ((node.kind === "file" || node.kind === "test" || node.kind === "manifest") &&
+                (node.id === `file:${file}` ||
+                    node.id === `test:${file}` ||
+                    node.id === `manifest:${file}` ||
+                    node.files.includes(file)))
+                seeds.add(node.id);
+        }
+    }
+    if (normalized.includes("backend.ts"))
+        for (const node of graph.nodes)
+            if (node.kind === "route")
+                seeds.add(node.id);
+    const impacted = new Set(seeds);
+    const queue = [...seeds];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        for (const edge of graph.edges) {
+            if (edge.from !== current || impacted.has(edge.to))
+                continue;
+            impacted.add(edge.to);
+            queue.push(edge.to);
+        }
+    }
+    const impactedRoutes = graph.nodes
+        .filter((node) => node.kind === "route" && impacted.has(node.id))
+        .map((node) => node.label)
+        .sort();
+    return Object.freeze({
+        changedFiles: Object.freeze(normalized.sort()),
+        impactedNodes: Object.freeze([...impacted].sort()),
+        impactedRoutes: Object.freeze(impactedRoutes),
+    });
+}
+export function planProofs(graph, impact, targetLevel = 1) {
+    if (!Number.isInteger(targetLevel) || targetLevel < 0 || targetLevel > 4)
+        throw new RangeError("work graph: targetLevel must be an integer from 0 to 4");
+    const nodeIds = impact.impactedNodes;
+    const routeIds = graph.nodes
+        .filter((node) => node.kind === "route" && nodeIds.includes(node.id))
+        .map((node) => node.id);
+    const steps = [];
+    if (nodeIds.length > 0) {
+        steps.push({
+            id: "proof:typecheck",
+            kind: "typecheck",
+            level: 0,
+            cost: 1,
+            command: "nifra check --lints-only",
+            nodeIds,
+        });
+        steps.push({
+            id: "proof:contract",
+            kind: "contract",
+            level: 1,
+            cost: 2,
+            command: "nifra contracts check --json",
+            nodeIds: routeIds,
+        });
+        steps.push({
+            id: "proof:assurance",
+            kind: "assurance",
+            level: 2,
+            cost: 3,
+            command: "nifra assure --json --strict",
+            nodeIds: routeIds,
+        });
+        steps.push({
+            id: "proof:suite",
+            kind: "suite",
+            level: 3,
+            cost: 4,
+            command: "nifra test",
+            nodeIds,
+        });
+    }
+    return Object.freeze({
+        steps: Object.freeze(steps.filter((step) => step.level <= Math.max(targetLevel, 0) || targetLevel > 3)),
+        targetLevel,
+    });
+}
+export function createEvidenceBundle(graph, impact, plan, proofs = []) {
+    const evidence = [...proofs].sort((a, b) => a.id.localeCompare(b.id));
+    // Levels are not cumulative (assure does not typecheck), so every planned step needs its own
+    // passing proof; a higher-level pass never subsumes a lower one.
+    const done = impact.impactedNodes.length === 0 ||
+        plan.steps.every((step) => evidence.some((item) => item.id === step.id && item.status === "pass"));
+    const missing = done
+        ? []
+        : plan.steps
+            .filter((step) => !evidence.some((item) => item.id === step.id && item.status === "pass"))
+            .map((step) => step.command);
+    const next = done
+        ? undefined
+        : plan.steps.find((step) => !evidence.some((item) => item.id === step.id && item.status === "pass"));
+    return Object.freeze({
+        version: 1,
+        graphDigest: graph.digest,
+        changedFiles: impact.changedFiles,
+        targetLevel: plan.targetLevel,
+        plan,
+        proofs: Object.freeze(evidence),
+        stop: Object.freeze({
+            done,
+            missing: Object.freeze(missing),
+            ...(next === undefined ? {} : { next }),
+        }),
+    });
+}
+export function recordProof(bundle, proof) {
+    const graph = {
+        version: 1,
+        digest: bundle.graphDigest,
+        nodes: [],
+        edges: [],
+        freshness: { ok: true },
+    };
+    const impact = {
+        changedFiles: bundle.changedFiles,
+        impactedNodes: bundle.stop.done ? [] : ["pending"],
+        impactedRoutes: [],
+    };
+    return createEvidenceBundle(graph, impact, bundle.plan, [
+        ...bundle.proofs.filter((item) => item.id !== proof.id),
+        proof,
+    ]);
+}
+export function renderWorkGraphJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+export async function runWorkGraph(cwd, options = {}) {
+    const result = await collectProjectWorkGraph(cwd, options);
+    console.log(options.json === false ? renderWorkGraphText(result) : renderWorkGraphJson(result));
+    return result.evidence.stop.done;
+}
+export function renderWorkGraphText(result) {
+    const lines = [
+        `work graph ${result.graph.digest.slice(0, 12)} (${result.graph.nodes.length} nodes, ${result.graph.edges.length} edges)`,
+        `changed: ${result.impact.changedFiles.length === 0 ? "none" : result.impact.changedFiles.join(", ")}`,
+        `impacted routes: ${result.impact.impactedRoutes.length === 0 ? "none" : result.impact.impactedRoutes.join(", ")}`,
+        `stop: ${result.evidence.stop.done ? "done" : "pending"}`,
+    ];
+    if (!result.evidence.stop.done)
+        lines.push(`next: ${result.evidence.stop.next?.command ?? "no proof available"}`);
+    return lines.join("\n");
+}
+async function collectProjectFiles(cwd) {
+    const files = [];
+    for await (const path of SOURCE_GLOB.scan({ cwd, dot: false })) {
+        if (IGNORED.test(path))
+            continue;
+        const full = resolve(cwd, path);
+        try {
+            const content = await readFile(full, "utf8");
+            files.push({
+                path,
+                content,
+                ...(isTestFile(path)
+                    ? { kind: "test" }
+                    : MANIFEST_NAMES.has(basename(path))
+                        ? { kind: "manifest" }
+                        : {}),
+            });
+        }
+        catch {
+            // A file can disappear while an agent is editing. The next graph run sees the settled tree.
+        }
+    }
+    return files;
+}
+async function fileTimes(paths) {
+    let newest = 0;
+    for (const path of paths) {
+        try {
+            newest = Math.max(newest, (await stat(path)).mtimeMs);
+        }
+        catch {
+            // Missing source files are simply absent from the timestamp scan.
+        }
+    }
+    return newest;
+}
+async function fileNode(file, kind) {
+    return {
+        id: `${kind}:${file.path}`,
+        kind,
+        label: file.path,
+        digest: await digestJson(file.content),
+        files: [file.path],
+    };
+}
+function filesForRoute(route, files) {
+    const matches = files
+        .filter((file) => file.path === "backend.ts" ||
+        (file.path.startsWith("routes/") && file.content.includes(route.path)))
+        .map((file) => file.path);
+    return [...new Set(matches)].sort();
+}
+/**
+ * A missing edge silently drops a test from the proof plan, so matching is recall-first: a literal
+ * path mention, or the static prefix of a parameterised path (tests call "/orders/123", not
+ * "/orders/:id"). Bare method words are never a signal on their own - "get" appears everywhere.
+ */
+function mentionsRoute(content, route) {
+    if (route.path === "/")
+        return /["'`]\/["'`]/.test(content);
+    if (content.includes(route.path))
+        return true;
+    const prefix = staticPathPrefix(route.path);
+    return prefix !== undefined && content.includes(prefix);
+}
+function staticPathPrefix(path) {
+    const staticSegments = [];
+    for (const segment of path.split("/")) {
+        if (segment.startsWith(":") || segment.startsWith("*"))
+            break;
+        if (segment !== "")
+            staticSegments.push(segment);
+    }
+    return staticSegments.length === 0 ? undefined : `/${staticSegments.join("/")}/`;
+}
+function isTestFile(path) {
+    return /(^|\/)(test|tests|__tests__)(\/|$)|\.(test|spec)\.[^.]+$/.test(path);
+}
+function recordOf(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? Object.fromEntries(Object.entries(value))
+        : undefined;
+}
+async function digestJson(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(value));
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    return [...digest].map((item) => item.toString(16).padStart(2, "0")).join("");
+}
+//# sourceMappingURL=work-graph.js.map

package/dist/work-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-graph.js","sourceRoot":"","sources":["../src/work-graph.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAuB,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAqD5C,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,SAAyB;QAC5C,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,yCAAyC,CAAC,CAAA;QADjD,cAAS,GAAT,SAAS,CAAgB;QAE5C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAyDD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,2CAA2C,CAAC,CAAA;AACzE,MAAM,OAAO,GAAG,qEAAqE,CAAA;AACrF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,eAAe;CAChB,CAAC,CAAA;AAEF,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,4EAA4E;SACrF,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,iFAAiF;SAC1F,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAA;IAChD,KAAK,MAAM,YAAY,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACnC,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3F,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QACpC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7C,OAAO,sBAAsB,CAAC;YAC5B,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,WAAW;YAC3B,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,WAAW;QAC3B,aAAa,EAAE,CAAC;KACjB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,UAAqF,EAAE;IAEvF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,SAAS,CAAC,CAAA;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAC9C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAA;IAChF,MAAM,WAAW,GAAY,MAAM,MAAM,kCAAC,GAAG,WAAW,qBAAqB,IAAI,CAAC,GAAG,EAAE,EAAE,EAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;IACpC,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS;QAC/B,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,0BAA0B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,UAAqF,EAAE;IAEvF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,SAAS,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,MAAM,KAAK,GAAoB,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAQ,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAQ,EAAE;QAC5C,IACE,CAAC,KAAK,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAC5F;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GACR,IAAI,CAAC,IAAI;YACT,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvC,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,QAAQ,CAAC,CAAA;QACjB,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CACtE,CAAA;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC5F,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;QAChD,MAAM,OAAO,GAAG,SAAS,QAAQ,EAAE,CAAA;QACnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;QACpD,OAAO,CAAC;YACN,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC1D,KAAK,EAAE,UAAU;SAClB,CAAC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,UAAU;YAC3B,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;YACnF,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YACvD,MAAM,QAAQ,GAAG,UAAU,QAAQ,IAAI,IAAI,EAAE,CAAA;YAC7C,OAAO,CAAC;gBACN,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE;gBAC5B,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;gBACpE,KAAK,EAAE,UAAU;aAClB,CAAC,CAAA;YACF,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;QAChE,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,cAAc,UAAU,EAAE,CAAA;YAC/C,OAAO,CAAC;gBACN,EAAE,EAAE,YAAY;gBAChB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,MAAM,UAAU,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,UAAU;aAClB,CAAC,CAAA;YACF,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;QACpE,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,aAAa,QAAQ,IAAI,SAAS,CAAC,EAAE,EAAE,CAAA;YAC3D,OAAO,CAAC;gBACN,EAAE,EAAE,WAAW;gBACf,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,GAAG,QAAQ,IAAI,SAAS,CAAC,EAAE,EAAE;gBACpC,MAAM,EAAE,MAAM,UAAU,CAAC,SAAS,CAAC;gBACnC,KAAK,EAAE,UAAU;aAClB,CAAC,CAAA;YACF,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;gBAAE,SAAQ;YACjD,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAA;YAClC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,aAAa;YAC9B,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAChF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CACvF,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC;QACV,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,YAA+B;IAC3E,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;KACxF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IACE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC1E,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE;oBACzB,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE;oBAC1B,IAAI,CAAC,EAAE,KAAK,YAAY,IAAI,EAAE;oBAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAE5B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;IACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAQ;YAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;SACzB,IAAI,EAAE,CAAA;IACT,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;KAC9C,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,MAAoB,EAAE,WAAW,GAAG,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC;QACtE,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAA;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzB,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,0BAA0B;YACnC,OAAO;SACR,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,YAAY;YACrB,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAClF;QACD,WAAW;KACZ,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,MAAoB,EACpB,IAAe,EACf,SAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACrE,6FAA6F;IAC7F,iEAAiE;IACjE,MAAM,IAAI,GACR,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CACvE,CAAA;IACH,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,KAAK;aACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;aACzF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAClF,CAAA;IACL,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAsB,EAAE,KAAoB;IACtE,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,WAAW;QAC1B,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACxB,CAAA;IACD,MAAM,MAAM,GAAiB;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,cAAc,EAAE,EAAE;KACnB,CAAA;IACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACtD,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACvD,KAAK;KACN,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA8B;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,UAII,EAAE;IAEN,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA8B;IAChE,MAAM,KAAK,GAAG;QACZ,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS;QACzH,YAAY,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtG,oBAAoB,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAClH,SAAS,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE;KAC1D,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI;QAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,KAAK,GAA0B,EAAE,CAAA;IACvC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC5C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI;gBACJ,OAAO;gBACP,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;oBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE;oBAC3B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE;wBAC/B,CAAC,CAAC,EAAE,CAAC;aACV,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAwB;IAC/C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAyB,EACzB,IAAkC;IAElC,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE;QAC1B,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KACnB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqB,EACrB,KAAqC;IAErC,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACzE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAqB;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAK;QAC7D,IAAI,OAAO,KAAK,EAAE;YAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAc;IACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC/E,CAAC"}

package/docs/examples.json

@@ -129,7 +129,7 @@
     "name": "REUSABLE_ROUTER",
     "topic": "Nifra - Framework contract",
     "slug": "contract",
-    "code": "// A PUBLISHABLE router - contract-first, so its types survive `.d.ts` emit for consumers.\nimport { client } from \"@nifrajs/client\"\nimport { defineContract, implement } from \"@nifrajs/core/contract\"\nimport { server } from \"@nifrajs/core/server\"\nimport { t } from \"@nifrajs/schema\"\n\n// --- in the package (say @your-org/billing) ---\n// 1. The CONTRACT is ONE plain declared object - methods, paths, schemas, no handlers.\n//    Export it: it is the single type the package publishes, and a consumer's typed client is\n//    built from THIS value (not from `typeof app`), so no internal server type crosses the seam.\nexport const billingContract = defineContract({\n  getPlan:   { method: \"GET\",  path: \"/billing/plan\" },\n  subscribe: { method: \"POST\", path: \"/billing/subscribe\", body: t.object({ plan: t.string() }) },\n})\n\n// 2. A FACTORY closes over the host's dependencies and returns a real, mountable router.\n//    `implement` binds handlers to the contract; each handler's context is typed from the contract\n//    alone (`c.body` is { plan: string } below) - no per-route `AddRoute` inference accreting.\nexport interface BillingDeps {\n  charge(plan: string): Promise<{ id: string }>\n}\nexport function createBillingRouter(deps: BillingDeps) {\n  return implement(billingContract, {\n    getPlan:   () => ({ plan: \"pro\" }),\n    subscribe: (c) => deps.charge(c.body.plan),\n  })\n}\n\n// --- in the consuming app ---\n// 3. Mount the router with ONE `.merge()` - no per-route `.get()/.post()` chain to re-infer.\nconst app = server().merge(createBillingRouter({ charge: async (plan) => ({ id: plan }) }))\n\n// 4. Build the client from the EXPORTED contract value - decoupled, no `typeof app` import needed.\nconst api = client(billingContract, \"https://api.example.com\")\nconst { data } = await api.billing.plan.get()          // GET  /billing/plan\nawait api.billing.subscribe.post({ plan: \"pro\" })      // POST /billing/subscribe, body typed"
+    "code": "// A PUBLISHABLE router - contract-first, so its types survive `.d.ts` emit for consumers.\nimport { client } from \"@nifrajs/client\"\nimport { defineContract, implement } from \"@nifrajs/core/contract\"\nimport { server } from \"@nifrajs/core/server\"\nimport { t } from \"@nifrajs/schema\"\n\n// --- in the package (say @your-org/billing) ---\n// 1. The CONTRACT is ONE plain declared object - methods, paths, schemas, no handlers.\n//    Export it: it is the single type the package publishes, and a consumer's typed client is\n//    built from THIS value (not from `typeof app`), so no internal server type crosses the seam.\nexport const billingContract = defineContract({\n  getPlan:   { method: \"GET\",  path: \"/billing/plan\" },\n  subscribe: { method: \"POST\", path: \"/billing/subscribe\", body: t.object({ plan: t.string() }) },\n})\n\n// 2. A FACTORY closes over the host's dependencies and returns a real, mountable router.\n//    `implement` binds handlers to the contract; each handler's context is typed from the contract\n//    alone (`c.body` is { plan: string } below) - no per-route `AddRoute` inference accreting.\nexport interface BillingDeps {\n  charge(plan: string): Promise<{ id: string }>\n}\nexport function createBillingRouter(deps: BillingDeps) {\n  return implement(billingContract, {\n    getPlan:   () => ({ plan: \"pro\" }),\n    subscribe: (c) => deps.charge(c.body.plan),\n  })\n}\n\n// --- in the consuming app ---\n// 3. Mount the router with ONE `.merge()` - no per-route `.get()/.post()` chain to re-infer.\nconst app = server().merge(createBillingRouter({ charge: async (plan) => ({ id: plan }) }))\n\n// 4. Build the client from the EXPORTED contract value - decoupled, no `typeof app` import needed.\nconst api = client(billingContract, \"https://api.example.com\")\nconst { data } = await api.billing.plan.get()          // GET  /billing/plan\n// \"subscribe\" is a reserved client word (the SSE subscriber), so this segment is reached by\n// CALLING the parent node with the segment name - same request, same typed body.\nawait api.billing(\"subscribe\").post({ plan: \"pro\" })   // POST /billing/subscribe, body typed"
   },
   {
     "name": "SEO_EXAMPLE",
@@ -167,6 +167,12 @@
     "slug": "deployment",
     "code": "// _worker.ts - the edge SSR entry\nimport { toFetchHandler } from \"@nifrajs/core/server\"\nimport { createWebApp } from \"@nifrajs/web\"\nimport { reactAdapter } from \"@nifrajs/web-react\"\nimport { clientEntry, manifest } from \"./server-manifest\"  // generated by buildServer\n\nconst app = createWebApp({ adapter: reactAdapter, manifest, clientEntry })\nexport default toFetchHandler(app)   // a Workers/Pages fetch handler\n\n// build.ts - buildClient (→ /assets) + buildServer (edge conditions → _worker.js)\nimport { buildClient, buildServer } from \"@nifrajs/web/build\""
   },
+  {
+    "name": "LAMBDA",
+    "topic": "Nifra - Deployment",
+    "slug": "deployment",
+    "code": "// handler.ts - one app per container, built at module scope\nimport { handle, streamHandle, type LambdaEnv } from \"@nifrajs/aws-lambda\"\nimport { server } from \"@nifrajs/core\"\n\nconst app = server<LambdaEnv>()\n  .get(\"/\", (c) => c.json({ ip: c.clientIp, requestId: c.env.context?.awsRequestId }))\n\nexport const handler = handle(app) // API Gateway HTTP API (v2) + Function URLs\n// or, on a Function URL with InvokeMode: RESPONSE_STREAM:\n// export const handler = streamHandle(app)"
+  },
   {
     "name": "SW",
     "topic": "Nifra - Deployment",
@@ -215,11 +221,17 @@
     "slug": "frameworks",
     "code": "// Server - pick an adapter. Everything else is identical across all five frameworks:\n// the same routes, loaders, actions, streaming, <Await>, fetchers, query cache.\nimport { createWebApp } from \"@nifrajs/web\"\nimport { reactAdapter } from \"@nifrajs/web-react\"   // ← or web-solid · web-vue · web-preact · web-svelte\nimport { clientEntry, manifest } from \"./server-manifest\" // generated by buildServer\n\nconst app = createWebApp({\n  adapter: reactAdapter,   // the one line that changes per framework\n  manifest,\n  clientEntry,             // the built client bundle (from buildClient's manifest)\n})"
   },
+  {
+    "name": "DETECTOR",
+    "topic": "Nifra - i18n",
+    "slug": "i18n",
+    "code": "// Or as a server plugin: c.locale on every handler, Content-Language on every response.\nimport { server } from \"@nifrajs/core\"\nimport { localeDetector } from \"@nifrajs/i18n/detector\"\n\nconst app = server().use(localeDetector({\n  locales: [\"en\", \"fr\", \"de\"],\n  defaultLocale: \"en\",\n  queryParam: \"lang\",\n  cookie: \"locale\",\n  persist: true,        // pin an explicit ?lang= choice into the cookie\n})).get(\"/\", (c) => c.json({ locale: c.locale, via: c.localeSource }))"
+  },
   {
     "name": "NEGOTIATE",
     "topic": "Nifra - i18n",
     "slug": "i18n",
-    "code": "// In a loader: resolve the locale + return only that catalog's messages.\nimport { negotiateLocale } from \"@nifrajs/i18n\"\nimport { catalogs, locales } from \"../catalogs\"\n\nexport async function loader({ request }: { request: Request }) {\n  const q = new URL(request.url).searchParams.get(\"lang\")\n  const locale = q && locales.includes(q) ? q : negotiateLocale(request, { locales, defaultLocale: \"en\", cookie: \"lang\" })\n  return { locale, messages: catalogs[locale] }   // cookie → Accept-Language → default\n}"
+    "code": "// In a loader: resolve the locale + return only that catalog's messages.\nimport { negotiateLocale } from \"@nifrajs/i18n\"\nimport { catalogs, locales } from \"../catalogs\"\n\nexport async function loader({ request }: { request: Request }) {\n  const locale = negotiateLocale(request, { locales, defaultLocale: \"en\", queryParam: \"lang\", cookie: \"lang\" })\n  return { locale, messages: catalogs[locale] }   // ?lang= → cookie → Accept-Language → default\n}"
   },
   {
     "name": "DIMENSIONS",
@@ -251,6 +263,12 @@
     "slug": "index",
     "code": "import { server } from \"@nifrajs/core/server\"\n\nserver()\n  .get(\"/\", () => ({ hello: \"world\" }))\n  .get(\"/users/:id\", (c) => ({ id: c.params.id }))\n  .listen(3000)"
   },
+  {
+    "name": "HONO",
+    "topic": "Nifra - Migrate route by route",
+    "slug": "migrate-route-by-route",
+    "code": "import { Hono } from \"hono\"\nimport { server } from \"@nifrajs/core/server\"\nimport { t } from \"@nifrajs/schema\"\n\nconst legacy = new Hono()\nlegacy.get(\"/users\", (c) => c.json({ source: \"hono\", users: [] }))\nlegacy.post(\"/users\", async (c) => c.json(await c.req.json()))\n\nexport const app = server()\n  // The wildcard is a literal mount prefix, not a typed Nifra route.\n  .mountFetch(\"/legacy/*\", legacy.fetch, { stripPrefix: true })\n  // Typed routes take precedence, so move one route out of Hono at a time.\n  .get(\"/legacy/users/:id\", (c) => ({ id: c.params.id, source: \"nifra\" }))\n  .post(\n    \"/users\",\n    { body: t.object({ name: t.string() }) },\n    (c) => ({ id: crypto.randomUUID(), name: c.body.name }),\n  )"
+  },
   {
     "name": "CACHING",
     "topic": "Nifra - Plugins & middleware",
@@ -341,12 +359,24 @@
     "slug": "security",
     "code": "import { server, jsonLogger, commonSecretPatterns } from \"@nifrajs/core/server\"\n\n// Key-name redaction is always on; valuePatterns adds opt-in value + message scanning.\nconst app = server({\n  logger: jsonLogger(undefined, { valuePatterns: commonSecretPatterns }),\n})\n\n// logger.error(\"auth failed for user@example.com with Bearer abc.def\")\n//   → { ...,\"message\":\"auth failed for [REDACTED] with [REDACTED]\" }\n// Add your own: { valuePatterns: [...commonSecretPatterns, /\\bord_[a-z0-9]+/g] }"
   },
+  {
+    "name": "PROTO",
+    "topic": "Nifra - security & hardening",
+    "slug": "security",
+    "code": "import { server } from \"@nifrajs/core/server\"\n\n// Default is \"reject\". A JSON body with an own `__proto__` key - or a `constructor`\n// carrying a `prototype` - is the exact shape that turns a later innocent { ...body }\n// merge or Object.assign into prototype pollution. It answers the SAME flat 400 as\n// malformed JSON, so an attacker learns nothing from the response.\nconst app = server({ protoPoisoning: \"reject\" }) // \"strip\" | \"ignore\" also available\n\napp.post(\"/profile\", async (c) => {\n  const body = await c.boundedJson<{ name: string }>() // and the schema-route path\n  // Reached only for a clean payload. Under \"strip\" the offending keys are deleted and\n  // the handler sees the cleaned object; under \"ignore\" the body passes through as-is.\n  return { name: body.name }\n})"
+  },
   {
     "name": "RESPONSE_CONTRACT",
     "topic": "Nifra - security & hardening",
     "slug": "security",
     "code": "import { server } from \"@nifrajs/core/server\"\nimport { responseContract } from \"@nifrajs/core/response-contract\"\nimport { t } from \"@nifrajs/schema\"\n\nconst PublicUser = t.object({ id: t.string(), name: t.string() })\n\n// \"warn\" logs and changes nothing; \"enforce\" makes the contract the upper bound too.\n// Not installing the plugin is \"off\" - and keeps the lane out of your bundle entirely.\nexport const app = server().use(responseContract(\"enforce\")).get(\n  \"/me\",\n  { response: PublicUser },\n  async () => {\n    // Every column, including the ones the contract never declared.\n    const user = { id: \"u1\", name: \"Ada\", email: \"a@b.c\", passwordHash: \"...\" }\n    return user\n  },\n)\n\n// off      -> {\"id\":\"u1\",\"name\":\"Ada\",\"email\":\"a@b.c\",\"passwordHash\":\"...\"}\n// enforce  -> {\"id\":\"u1\",\"name\":\"Ada\"}"
   },
+  {
+    "name": "SECURITY_HEADERS",
+    "topic": "Nifra - security & hardening",
+    "slug": "security",
+    "code": "import { server } from \"@nifrajs/core/server\"\nimport { securityHeaders } from \"@nifrajs/middleware\"\n\n// Always on (covering errors and 404s too): X-Content-Type-Options: nosniff,\n// X-Frame-Options: DENY, Referrer-Policy: no-referrer. The rest are opt-in - each is a\n// deliberate cross-origin decision, so nifra never turns them on behind your back:\nconst app = server().use(securityHeaders({\n  crossOriginOpenerPolicy: \"same-origin\",      // isolate the browsing-context group\n  crossOriginResourcePolicy: \"same-origin\",    // block cross-origin embedding of your responses\n  crossOriginEmbedderPolicy: \"require-corp\",   // enable crossOriginIsolated (SharedArrayBuffer, …)\n  permissionsPolicy: \"camera=(), geolocation=()\",\n  contentSecurityPolicy: \"default-src 'self'\",\n  hsts: { maxAge: 63072000, includeSubDomains: true, preload: true }, // opt in once HTTPS-only\n}))"
+  },
   {
     "name": "DECLARE",
     "topic": "Nifra - Server functions",