@nifrajs/cli 2.9.1 → 2.11.0

package/docs/llms-full.txt

@@ -3545,23 +3545,35 @@ Deploy: `wrangler pages deploy dist` (Pages) or `wrangler deploy`
 `server.ts` to hand-write. (`create-nifra` scaffolds the conventions.)
 
 ```ts
-nifra dev      # true-HMR dev server (Vite middleware + Nifra SSR) - http://localhost:4321
+nifra dev      # true-HMR dev server (Bun native HMR + Nifra SSR) - http://localhost:4321
+nifra dev --vite   # the Vite middleware pipeline instead (automatic when vitePlugins are your ONLY transforms)
 nifra build    # full Bun deploy → dist/server.js + content-hashed dist/assets/ (default target: bun)
 nifra start    # run dist/server.js on Bun
 nifra build --target cf-pages  # also: node | deno | vercel | static; add --report for chunk sizes
 
 # dev + start share the default port 4321. Override per run: --port <n> (alias -p) or the PORT env var.
 # flags: --port <n> (dev/start) · --out <dir> (build/start) · --target <t> (build) · --poll (dev)
+#        --vite | --bun (dev/build) force the pipeline
 ```
 
 ### The conventions
 
-Four conventions at the project root. `nifra dev` runs the Vite-backed
+Four conventions at the project root. `nifra dev` runs the Bun-native
 [HMR dev server](/docs/dev); `nifra build` runs the Bun-native production
 build (content-hashed client assets plus a target-specific server); `nifra start`
 runs the default Bun output. The generated server serves assets and SSR with matched-route
 chunks preloaded and route CSS linked in each `<head>`.
 
+**One rule picks the bundler, and it is the same rule in both phases** - so a
+project can never be bundled by one toolchain in dev and the other in production. Bun runs
+everything, except an app whose _only_ transforms are `vitePlugins`: the Bun
+pipeline cannot run those, so that app gets Vite for dev and build alike, and says so.
+`--vite` / `--bun` force the choice; `--bun` is refused on a
+Vite-only app rather than dropping its transforms silently. Every `dev` and
+`build` run prints which bundler it picked and why, and `nifra check`
+answers the same question without starting a server - see
+[which pipeline runs, when](/docs/dev) for the full table.
+
 ```ts
 my-app/
   routes/            # file-based routes (index.tsx, _layout.tsx, [id].tsx, …)
@@ -3844,9 +3856,9 @@ distinct.
 
 Nifra gives you two local development loops, and the rule between them is that one
 toolchain owns a whole phase. **Both** give you React Fast Refresh with state
-preserved. Use `nifra dev` (Vite) for the plugin ecosystem, or
-`nifra dev --bun` for one bundler across dev and prod with no Vite dependency.
-Both serve your real SSR app locally, and neither mixes the two bundlers in one process.
+preserved. Bun is the default; Vite takes over automatically when your config's only
+transforms are `vitePlugins`. Both serve your real SSR app locally, and neither
+mixes the two bundlers in one process.
 
 ### Two loops, same app
 
@@ -3859,7 +3871,7 @@ use when
 
 Bun HMR + Fast Refresh (native)
 none (Bun only)
-one bundler dev+prod; no Vite dep (no CSS Modules)
+one bundler dev+prod, no Vite dep; CSS Modules included
 
 `@nifrajs/web/vite`
 
@@ -3869,6 +3881,79 @@ true HMR (Fast Refresh / framework HMR)
 
 state-preserving UI iteration
 
+### Which pipeline runs, when
+
+One rule decides the bundler, and it decides it the same way for `nifra dev` and
+`nifra build` - your dev loop and your production build are never on different
+toolchains.
+
+your config
+command
+pipeline
+why
+
+no plugins at all
+
+`nifra dev` / `nifra build`
+
+Bun
+the default: no Vite dependency, one bundler across dev and prod
+
+`clientPlugins` and/or `serverPlugins`
+
+`nifra dev` / `nifra build`
+
+Bun
+those slots are Bun.build plugins; Vite would never call them
+
+`vitePlugins` only
+
+`nifra dev` / `nifra build`
+
+Vite (automatic)
+the Bun build cannot run them, so staying on Bun would silently drop your transforms
+
+`vitePlugins` only
+
+`--bun`
+
+error
+nifra refuses rather than build an app with its compiler switched off
+
+any
+
+`--vite`
+
+Vite (forced)
+
+exact dev/prod client resolution for `conditions`, or a Vite-only plugin
+
+any
+
+`--bun`
+
+Bun (forced)
+allowed whenever no transform would be lost
+
+You never have to work this out from the table. Every `nifra dev` and
+`nifra build` run prints the answer under its banner, and
+`nifra check` and `nifra doctor` report it - with the config hazards
+below - without starting a server:
+
+```ts
+# doc-check: skip - fragment: terminal output, not source.
+$ nifra dev
+nifra dev (bun) → http://localhost:3000
+  bundler: bun (default; --vite to switch)
+
+$ nifra build
+nifra build (node, vite) → dist/server/server.js
+  bundler: vite (auto: this app's only transforms are `vitePlugins` (svelte), which the Bun build cannot run)
+
+$ nifra check
+• bundler: vite (auto: this app's only transforms are `vitePlugins` (svelte), which the Bun build cannot run)
+```
+
 ### State-preserving HMR
 
 Use `createViteDevServer` when you want component edits to update the browser
@@ -4012,10 +4097,12 @@ a component-only module swaps its markup with `useState` state intact, no reload
 boundary rule is the same as Vite's (see below). The real prize is that dev and production use
 the _same bundler_, so the dev/prod seam disappears.
 
-One gap: **CSS Modules**. Bun's dev-server bundler has no
-`*.module.css` transform (its production `Bun.build` does), so the CLI
-refuses `--bun` for a CSS-Modules app rather than serving a broken client. Plain CSS
-and Tailwind work normally.
+**CSS Modules included.** Bun's dev-server bundler has no
+`*.module.css` transform of its own, so the CLI hands it the same one the
+production `Bun.build` uses - and a class hashes to the same scoped name on every
+pipeline. Calling `createDevServer` as a library instead of through the CLI, you
+supply that plugin yourself through your own `bunfig.toml`; plain CSS and Tailwind
+need nothing either way.
 
 **
 Server functions and `*.server` modules work under `--bun`
@@ -4044,7 +4131,8 @@ source. A divergence between the loops is treated as a bug, not a caveat.
 import { createDevServer } from "@nifrajs/web/dev"
 // Bun.serve bundles + hot-reloads the client; Bun's runtime resolves SSR. An edit reloads the
 // changed module graph - with React Fast Refresh (state preserved) applied natively by Bun, no plugin.
-// CSS + the entry URL come from Bun. Plain CSS/Tailwind work; *.module.css does not (Bun's dev bundler).
+// CSS + the entry URL come from Bun. Plain CSS/Tailwind work as-is; for *.module.css as a library
+// caller, pass the production CSS Modules plugin through your own bunfig (nifra dev --bun does it for you).
 const server = await createDevServer({ routesDir, outDir, clientModule, createApp })
 ```
 
@@ -4161,6 +4249,105 @@ own stylesheet. Pass `manifest.routeStyles` to `createWebApp` alongside
 `styles`, and Nifra links the matched route's CSS during SSR. In
 **dev**, Vite injects per-module CSS.
 
+### Gotchas
+
+The rule "one toolchain owns a whole phase" is what keeps the two loops honest, and most of
+what follows is a consequence of it. None of these are things you have to memorise before you
+start - they are the edges you can hit later, collected in one place.
+
+#### Keep the adapter out of your config file
+
+Split `framework.ts` (the adapter, imported by your server and edge entries) from
+`nifra.config.ts` (the CLI's config, where the Vite plugins and SFC compilers live).
+If your server entry reaches the adapter _through_ the config, everything the config
+imports is bundled into your production server - the Vite plugin, the framework compiler, and
+their native bindings. It builds without complaint and then fails at startup with a missing
+native binding, which reads like a broken install rather than a config-shape problem.
+
+```ts
+// doc-check: skip - fragment: two files from one app, shown together.
+// framework.ts - imported by your SERVER and edge entries. Adapter only, nothing else.
+import { svelteAdapter } from "@nifrajs/web-svelte"
+export const adapter = svelteAdapter
+
+// nifra.config.ts - imported ONLY by the CLI, which runs on Bun. Compilers and Vite plugins
+// belong here. Re-export the adapter; never define it here, or the dev toolchain it pulls in
+// (Vite, the SFC compiler, their native bindings) is bundled into your production server.
+import { svelte } from "@sveltejs/vite-plugin-svelte"
+export { adapter } from "./framework"
+export const clientModule = "@nifrajs/web-svelte/client"
+export const vitePlugins = [svelte()]
+```
+
+#### Plugins go in the slot that matches the pipeline
+
+`vitePlugins` run on the Vite pipeline; `clientPlugins` and
+`serverPlugins` run on the Bun one. A plugin in the wrong slot is not an error, it
+is a _no-op_ - your transform silently does not run. Nifra classifies each plugin by its
+hook shape and refuses a mismatch rather than letting the build succeed without it. The same
+check is why `--bun` throws for an app whose only transforms are
+`vitePlugins`, instead of building without them.
+
+#### `conditions` does not reach the Bun dev client bundle
+
+On the Bun pipeline, `conditions` governs SSR - `nifra dev` passes them
+to the runtime when it re-execs - and it governs the production client bundle. It cannot govern
+the client bundle the dev server serves: Bun's dev-server bundler accepts no resolve
+conditions, and there is no `bunfig.toml` key for them either (a top-level
+`conditions`, or one under `[run]`, `[serve.static]` or
+`[bundle]`, parses and is ignored). So a package with an `exports` map
+can resolve to one file in dev and another in `nifra build`. Nifra says so once at
+startup rather than letting you find out in production. If your app depends on exact dev/prod
+client resolution, run `nifra dev --vite`.
+
+Related, if you ever pass the flag to `bun` yourself: it takes
+**one condition per flag**. The comma form is accepted and matches nothing,
+because Bun reads the whole string as a single condition name.
+
+```ts
+# Resolve conditions on the Bun dev pipeline.
+# SSR honours `conditions` - nifra passes them to the runtime when it re-execs.
+# The CLIENT bundle does not: Bun's dev-server bundler takes no resolve conditions,
+# from bunfig.toml or anywhere else. nifra warns once at startup when it matters.
+nifra dev --vite            # exact dev/prod client resolution, if your app needs it
+
+# If you invoke bun yourself: ONE FLAG PER CONDITION.
+bun --conditions=browser --conditions=development ./app.ts   # correct
+bun --conditions=browser,development ./app.ts                # ONE condition named "browser,development"
+```
+
+#### Editing a non-route file updates SSR too
+
+On the Bun pipeline the dev server tracks the module graph your routes import, so editing a
+component, a helper, or a server module several levels down is reflected in the next SSR
+render - not just in the browser bundle. Modules you did _not_ touch keep their
+identity, so a module-level singleton stays single across the reload. Two limits are
+deliberate: files under `node_modules` are not tracked (they are dependencies, not
+your source), and a specifier only participates if it is relative and written literally - a
+computed or aliased specifier is invisible to a static graph. A third-party Bun plugin that
+rewrites imports needs to call `rewriteSsrImports` for its output to stay tracked.
+
+#### An adapter with a compiled asset needs the dev server's loader
+
+This one matters only if you are writing a render adapter. On the Vite pipeline Vite owns SSR
+resolution, which is what lets `resolve.dedupe` reach the server and keeps your app
+on one copy of the framework. Adapter packages themselves stay external to that graph, because
+the adapter's context object has to be the one instance your app imported. If such an adapter
+must load a _compiled_ asset on the server - Svelte's chain component is one - a plain
+`import` reaches a runtime with no compiler for it, and registering a second
+compiler in the runtime is worse: the tree then holds two copies of the framework runtime, and
+context written by one half is invisible to the other. Load it through
+`ssrModuleLoader()` instead, and take the framework's _server renderer_ from
+there as well - a component compiled by one toolchain has to render through the renderer that
+toolchain resolved.
+
+#### Scoped class names are identical across pipelines
+
+A CSS Modules class hashes to the same scoped name whichever pipeline produced it, and across
+machines - the hash is keyed on the class name plus the module's _package-relative_
+path, never an absolute one. A selector written against a generated name behaves the same under
+`nifra dev`, `nifra dev --bun`, and `nifra build`.
+
 ## Nifra - Troubleshooting
 
 > Fixes keyed on the literal error strings Nifra prints: `reached the client bundle` (a node:/native import in the browser bundle), `server-only module reached the client bundle` (the server-only marker), and `resolveDispatcher` / `Invalid hook call` (duplicate React).
@@ -6680,6 +6867,9 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 Session primitives for nifra - signed-cookie + server-store sessions, CSRF, and route guards. Bring your own identity (Better Auth / Lucia / OAuth); nifra owns the session.
 
+`Authorizer`/`requireAuthorization` provide a small public policy seam. The application or data layer
+must decide ownership and permissions; Nifra stores no policy, tenant, or subject data.
+
 Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework - one core, five UI libraries, every runtime. Scaffold a new app with `bun create nifra`.
 
 ## Install
@@ -6874,7 +7064,7 @@ The `nifra` CLI - zero-config dev/build/start for a nifra app, plus the agent su
 `routes/`).
 
 ```
-nifra dev     [--port <n>] [--poll]       True-HMR dev server (Vite + nifra SSR).
+nifra dev     [--port <n>] [--poll]       True-HMR dev server (Bun + nifra SSR; Vite for a Vite-only app).
 nifra build   [--out <dir>] [--target <t>]  Complete deploy directory; target defaults to Bun.
 nifra start   [--port <n>] [--out <dir>]   Run the generated Bun server at <out>/server.js.
 nifra context                             Print this project's API + page routes + conventions.
@@ -6884,6 +7074,7 @@ nifra assure  [--config <file>] [--json]  Gate reflected routes against enforcem
 nifra capabilities check [--json]        Gate effect provenance + the reviewed capability lockfile.
 nifra manifest emit [--sign <key-ref>]   Emit the hash-verified route trust artifact after assurance.
 nifra manifest diff <before> <after>      Block promotion on contract/governance regressions.
+nifra sdk     --lang <python|go>         Generate a deterministic non-TypeScript SDK from `backend.ts`.
 nifra doctor  [--json] [--auto-fix]       Catch undeclared imports and duplicate Nifra/React installs.
 ```
 
@@ -7094,6 +7285,11 @@ The Bun-native, contract-first HTTP framework at the heart of [nifra](../../READ
 a radix router, a fully type-inferred server, versionable contracts, lifecycle
 middleware, and production hardening.
 
+The Web-standard app can be wrapped for Vercel Edge with `toVercelHandler`, Netlify Functions with
+`toNetlifyHandler`, or API Gateway v1/v2 with `toLambdaHandler` from `@nifrajs/core/server`. These are
+thin event-envelope adapters; application policy, persistence, and platform credentials stay outside
+the core.
+
 ```sh
 bun add @nifrajs/core
 ```
@@ -7116,6 +7312,8 @@ available only from their explicit subpaths, so an ordinary HTTP server never ev
 import { defineContract, implement } from "@nifrajs/core/contract"
 import { startCausality } from "@nifrajs/core/causality"
 import { defineAssurancePolicy } from "@nifrajs/core/assurance"
+import { createDataPort, defineDataContract, diffDataContract } from "@nifrajs/core/data"
+import { defineChannel, memoryChannelHub } from "@nifrajs/core/channel"
 ```
 
 - **Inline or contract-first.** Write routes inline (types inferred from the
@@ -7165,6 +7363,16 @@ import { defineAssurancePolicy } from "@nifrajs/core/assurance"
   bounded HTTP representations and supplies the same frame/loader adapters for WebSockets and
   deferred data. Import `richWireCodec()` from `@nifrajs/core/transport-codec-rich`; the separate
   subpath keeps rich-wire code out of plain JSON bundles.
+- **Typed data seam (opt in).** `@nifrajs/core/data` defines token-only operation contracts,
+  `db.read`/`db.write` capability names, an opaque request-local `RlsScope`, typed adapter requests,
+  drift snapshots, and `createDataPort(contract, adapter, { beacon: useCapability })`, which emits the
+  operation's capability evidence - derived from the contract, never from the request - before the
+  private adapter runs. It contains no database driver, tenant identity, policy, row values, or durable
+  store; those belong in the adapter layer.
+- **Typed channels (opt in).** `@nifrajs/core/channel` defines typed message contracts, bounded
+  subscriptions, cancellation, per-channel resume cursors, bounded local replay, and a process-local
+  in-memory hub for tests. Durable replay, presence, rooms, and multi-instance fan-out remain adapter
+  concerns.
 
 ```ts
 import { defineAssurancePolicy, evaluateRouteAssurance, NIFRA_ASSURANCE } from "@nifrajs/core/assurance"
@@ -7454,10 +7662,21 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 ## @nifrajs/image
 
-Image optimization for nifra - a CLS-safe responsive <Image> + pluggable loaders (CDN or self-hosted) + pure-JS dimension reading. Zero-dependency core; optional Bun.Image-backed resize endpoint at @nifrajs/image/server.
+Image optimization for nifra - a CLS-safe responsive <Image> + pluggable loaders (CDN or self-hosted) + pure-JS dimension reading. The zero-dependency core also includes safe, cacheable Open Graph SVG generation at `@nifrajs/image/og` - useful where you control the consumer, but no major crawler renders SVG for `og:image`, so a social card needs an injected PNG/JPEG rasterizer. The optional Bun.Image-backed resize endpoint lives at `@nifrajs/image/server`.
 
 Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework - one core, five UI libraries, every runtime. Scaffold a new app with `bun create nifra`.
 
+For crawler-compatible cards, adapt the renderer you choose to the public PNG seam:
+
+```ts
+import { createResvgRasterizer } from "@nifrajs/image/og-png"
+import { Resvg } from "@resvg/resvg-js"
+
+const rasterizer = createResvgRasterizer(Resvg)
+```
+
+The codec remains an application dependency; the package's default stays explicit SVG output.
+
 ## Install
 
 ```sh
@@ -7720,6 +7939,7 @@ import {
   bodyLimit,
   cors,
   MemoryStore,
+  problemDetails,
   rateLimit,
   securityHeaders,
   timing,
@@ -7727,6 +7947,7 @@ import {
 
 const app = server()
   .use(securityHeaders())
+  .use(problemDetails())
   .use(cors({ origin: ["https://app.example.com"], credentials: true }))
   .use(bodyLimit({ maxBytes: 1_000_000 }))
   .use(rateLimit({
@@ -7766,6 +7987,14 @@ const app = server()
   store, `Vary`-aware keys, `Age`, byte caps, and `Cache-Control` / `Set-Cookie` safety defaults.
   `MemoryResponseCache` is dev/single-instance only unless explicitly allowed in production.
 - **`timing()`** - `Server-Timing` plus typed `c.timing.metric/mark/measure` controls.
+- **`problemDetails()`** - opt-in RFC 9457 `application/problem+json` responses for framework
+  errors. The default `{ ok: false, error }` envelope remains unchanged unless installed; validation
+  issues are preserved, and `includeInstance` includes only the request pathname.
+- **`rangeResponse()` / `parseByteRange()`** - bounded byte-range responses with 206/416,
+  `If-Range`, multipart ranges, and conditional validators.
+- **`conditionalResponse()`** - reusable ETag/Last-Modified handling that emits a bodyless 304.
+- **`negotiateContentType()`** - RFC-style `Accept` matching with q-values, wildcards, and q=0.
+- **`multipartResponse()`** - cancellable streaming multipart output without buffering all parts.
 - **`prettyJson()`** - capped, JSON-only pretty printing for debugging and developer-facing APIs.
 - **`methodOverride()`** - header/query method tunneling for clients that can only send `POST`.
   Header override is on by default; query override is opt-in.
@@ -8801,7 +9030,7 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 ## @nifrajs/auth
 
-`createSessions`, `csrf`, `CsrfOptions`, `GuardOptions`, `KVNamespaceLike`, `KVSessionStore`, `MemorySessionStore`, `MemorySessionStoreOptions`, `requireSession`, `requireUser`, `Session`, `SessionContext`, `SessionCookieOptions`, `SessionManager`, `SessionOptions`, `SessionRecord`, `SessionStore`
+`AuthorizationRequest`, `Authorizer`, `createSessions`, `csrf`, `CsrfOptions`, `GuardOptions`, `isAuthorized`, `KVNamespaceLike`, `KVSessionStore`, `MemorySessionStore`, `MemorySessionStoreOptions`, `requireAuthorization`, `requireSession`, `requireUser`, `Session`, `SessionContext`, `SessionCookieOptions`, `SessionManager`, `SessionOptions`, `SessionRecord`, `SessionStore`
 
 ## @nifrajs/better-auth
 
@@ -8849,7 +9078,7 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 ## @nifrajs/image
 
-`cloudflareLoader`, `CloudflareLoaderOptions`, `HtmlImageAttrs`, `identityLoader`, `imageDimensions`, `ImageFormat`, `ImageInfo`, `ImageLoader`, `ImageProps`, `readImageDimensions`, `ResolvedImage`, `resolveImage`, `selfHostedLoader`, `SelfHostedLoaderOptions`, `signImageUrl`, `SignImageUrlOptions`, `toHtmlAttrs`
+`cloudflareLoader`, `CloudflareLoaderOptions`, `createPngRasterizer`, `createResvgRasterizer`, `HtmlImageAttrs`, `identityLoader`, `imageDimensions`, `ImageFormat`, `ImageInfo`, `ImageLoader`, `ImageProps`, `OgImageOptions`, `OgImageRasterized`, `OgImageRasterizer`, `ogImageResponse`, `PngRenderer`, `readImageDimensions`, `renderOgImage`, `ResolvedImage`, `resolveImage`, `ResvgConstructor`, `ResvgRenderer`, `selfHostedLoader`, `SelfHostedLoaderOptions`, `signImageUrl`, `SignImageUrlOptions`, `toHtmlAttrs`
 
 ## @nifrajs/islets
 
@@ -8869,7 +9098,7 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 ## @nifrajs/middleware
 
-`AdmissionControllerHandle`, `AdmissionEvidence`, `AdmissionOptions`, `AdmissionPolicy`, `AdmissionSnapshot`, `apiKey`, `ApiKeyStaticOptions`, `ApiKeyVerifyOptions`, `appendTrailingSlash`, `AuthPlugin`, `basicAuth`, `BasicAuthPlugin`, `BasicAuthStaticOptions`, `BasicAuthVerifyOptions`, `bearer`, `BearerOptions`, `bodyLimit`, `BodyLimitOptions`, `buildOpenApiDocument`, `cache`, `cacheControl`, `CacheControlOptions`, `CachedResponse`, `CacheOptions`, `combine`, `Composable`, `compression`, `CompressionOptions`, `cors`, `CorsOptions`, `createAdmissionController`, `createCsrfToken`, `createEventLoopLagSampler`, `csrf`, `CsrfOptions`, `durableCommand`, `DurableCommandOptions`, `etag`, `ETagOptions`, `healthcheck`, `HealthcheckOptions`, `idempotency`, `IdempotencyClaim`, `IdempotencyOptions`, `IdempotencyRecord`, `IdempotencyStore`, `IpMatcher`, `ipRestriction`, `IpRestrictionOptions`, `jwk`, `JwkKey`, `jwks`, `JwksOptions`, `jwt`, `JwtAlgorithm`, `JwtClaims`, `JwtHeader`, `JwtKeyResolver`, `JwtOptions`, `JwtPlugin`, `JwtVerificationKey`, `language`, `LanguageMatch`, `LanguageOptions`, `logger`, `LoggerOptions`, `LoopDelayHistogram`, `LoopDelayMonitor`, `MemoryIdempotencyStore`, `MemoryIdempotencyStoreOptions`, `MemoryResponseCache`, `MemoryResponseCacheOptions`, `MemoryStore`, `MemoryStoreOptions`, `methodOverride`, `MethodOverrideOptions`, `namedCombine`, `openapi`, `OpenApiInfo`, `OpenApiOptions`, `OpenApiServer`, `OpenApiTag`, `OpenApiUiOptions`, `pickLanguage`, `poweredBy`, `PoweredByOptions`, `prettyJson`, `PrettyJsonOptions`, `rateLimit`, `RateLimitOptions`, `RateLimitResult`, `RateLimitStore`, `requestId`, `RequestIdOptions`, `RequestLogFields`, `responseCache`, `ResponseCacheStore`, `RouteLike`, `securityHeaders`, `SecurityHeadersOptions`, `SecurityRequirement`, `ShedReason`, `timing`, `TimingControls`, `TimingMetric`, `TimingOptions`, `TrailingSlashOptions`, `trimTrailingSlash`, `tryVerifyJwt`, `VerifiedJwt`, `verifyCsrfToken`, `verifyJwt`, `VerifyJwtOptions`, `VerifyJwtResult`
+`AdmissionControllerHandle`, `AdmissionEvidence`, `AdmissionOptions`, `AdmissionPolicy`, `AdmissionSnapshot`, `apiKey`, `ApiKeyStaticOptions`, `ApiKeyVerifyOptions`, `appendTrailingSlash`, `AuthPlugin`, `basicAuth`, `BasicAuthPlugin`, `BasicAuthStaticOptions`, `BasicAuthVerifyOptions`, `bearer`, `BearerOptions`, `bodyLimit`, `BodyLimitOptions`, `buildOpenApiDocument`, `ByteRange`, `ByteRangeResult`, `cache`, `cacheControl`, `CacheControlOptions`, `CachedResponse`, `CacheOptions`, `combine`, `Composable`, `compression`, `CompressionOptions`, `conditionalResponse`, `ConditionalResponseOptions`, `ContentPreference`, `cors`, `CorsOptions`, `createAdmissionController`, `createCsrfToken`, `createEventLoopLagSampler`, `csrf`, `CsrfOptions`, `durableCommand`, `DurableCommandOptions`, `etag`, `ETagOptions`, `healthcheck`, `HealthcheckOptions`, `idempotency`, `IdempotencyClaim`, `IdempotencyOptions`, `IdempotencyRecord`, `IdempotencyStore`, `IpMatcher`, `ipRestriction`, `IpRestrictionOptions`, `jwk`, `JwkKey`, `jwks`, `JwksOptions`, `jwt`, `JwtAlgorithm`, `JwtClaims`, `JwtHeader`, `JwtKeyResolver`, `JwtOptions`, `JwtPlugin`, `JwtVerificationKey`, `language`, `LanguageMatch`, `LanguageOptions`, `logger`, `LoggerOptions`, `LoopDelayHistogram`, `LoopDelayMonitor`, `MemoryIdempotencyStore`, `MemoryIdempotencyStoreOptions`, `MemoryResponseCache`, `MemoryResponseCacheOptions`, `MemoryStore`, `MemoryStoreOptions`, `methodOverride`, `MethodOverrideOptions`, `MultipartBody`, `MultipartHeadersInit`, `MultipartPart`, `multipartResponse`, `MultipartResponseOptions`, `namedCombine`, `negotiateContentType`, `openapi`, `OpenApiInfo`, `OpenApiOptions`, `OpenApiServer`, `OpenApiTag`, `OpenApiUiOptions`, `parseAcceptHeader`, `parseByteRange`, `pickLanguage`, `poweredBy`, `PoweredByOptions`, `prettyJson`, `PrettyJsonOptions`, `problemDetails`, `ProblemDetailsOptions`, `rangeResponse`, `RangeResponseOptions`, `rateLimit`, `RateLimitOptions`, `RateLimitResult`, `RateLimitStore`, `requestId`, `RequestIdOptions`, `RequestLogFields`, `responseCache`, `ResponseCacheStore`, `RouteLike`, `securityHeaders`, `SecurityHeadersOptions`, `SecurityRequirement`, `ShedReason`, `timing`, `TimingControls`, `TimingMetric`, `TimingOptions`, `TrailingSlashOptions`, `trimTrailingSlash`, `tryVerifyJwt`, `VerifiedJwt`, `verifyCsrfToken`, `verifyJwt`, `VerifyJwtOptions`, `VerifyJwtResult`
 
 ## @nifrajs/mock
 
@@ -8913,7 +9142,7 @@ done-gate, or `nifra mcp` to give the agent live project tools.
 
 ## @nifrajs/web
 
-`Action`, `ACTION_GLOBAL`, `apiKey`, `assertRenderAdapterConformance`, `Blocker`, `BlockerController`, `BlockerFunction`, `BlockerLocation`, `BlockerState`, `BrowserNavigate`, `buildManifest`, `CachedResponse`, `CacheStore`, `canonical`, `clientEntry`, `ClientRouter`, `ClientRouterOptions`, `createClientRouter`, `createMatcher`, `createMutation`, `createQueryClient`, `createWebApp`, `CreateWebAppOptions`, `DATA_GLOBAL`, `DATA_HEADER`, `DEFAULT_DEV_PORT`, `defer`, `Deferred`, `DehydratedState`, `disableDraft`, `DRAFT_COOKIE`, `DraftCookieControls`, `enableDraft`, `EnableDraftOptions`, `enumerateStaticRoutes`, `Fetcher`, `FetcherState`, `FetchRouteData`, `filePathToPattern`, `filePathToPatterns`, `FontDisplay`, `fontFace`, `FontFace`, `fontPreload`, `FontPreloadInput`, `FontSource`, `gate`, `generateClientEntry`, `GenerateClientEntryOptions`, `generateRouteSearchTypes`, `GenerateRouteSearchTypesOptions`, `generateServerManifest`, `GenerateServerManifestOptions`, `getBrowserNavigate`, `GetStaticPaths`, `gone`, `hashQueryKey`, `IDLE_BLOCKER`, `InertScriptType`, `InfiniteData`, `InfiniteQueryHandle`, `InfiniteQueryOptions`, `isDraftEnabled`, `ISR_REVALIDATE_HEADER`, `ISR_STATUS_HEADER`, `ISRApp`, `ISROptions`, `ISRPlatform`, `jsonLd`, `KVCacheStore`, `KVCacheStoreOptions`, `KVNamespaceLike`, `LAYOUT_DATA_GLOBAL`, `LayoutEntry`, `LinkDescriptor`, `Loader`, `LoaderContext`, `manifest`, `Manifest`, `MemoryCacheStore`, `MemoryCacheStoreOptions`, `mergeHeads`, `meta`, `Meta`, `MetaArgs`, `MetaInput`, `MountRouterOptions`, `MutationCallbacks`, `MutationHandle`, `MutationState`, `MutationStatus`, `NAV_FROM_HEADER`, `NavigateFunction`, `NavigateOptions`, `NavigateSearchOf`, `NavigateTargetInput`, `notFound`, `openGraph`, `OpenGraphInput`, `PRE_HYDRATION_GUARD`, `previewEndpoint`, `PreviewEndpointOptions`, `PublicDirCache`, `QueryClient`, `QueryClientOptions`, `QueryHandle`, `QueryOptions`, `QueryState`, `QueryStatus`, `redirect`, `REDIRECT_HEADER`, `RedirectOptions`, `registerBlocker`, `RenderAdapter`, `RenderAdapterConformanceError`, `RenderAdapterConformanceFixture`, `RenderAssemblyCache`, `RenderedPage`, `renderPage`, `RenderPageInput`, `RenderPageOptions`, `renderPageResult`, `RenderProps`, `resolveMeta`, `resolveNavigate`, `resolvePublicPath`, `RETAIN_HEADER`, `revalidate`, `REVALIDATE_HEADER`, `revalidateEndpoint`, `RevalidateEndpointOptions`, `RevalidateResult`, `ROOT_ATTRIBUTE`, `ROUTE_GLOBAL`, `RouteEntry`, `RouteMatch`, `RouteModule`, `RoutePattern`, `RouterState`, `RouteSearch`, `routeStyles`, `ScriptDescriptor`, `searchOf`, `SearchOf`, `searchOfChain`, `serializeData`, `serializeSearch`, `servePublicDir`, `ServePublicDirOptions`, `SERVER_FN_MODULE`, `SERVER_ONLY_MODULE`, `ServerOnly`, `setBlockerController`, `setBrowserNavigate`, `StaticPath`, `StaticPaths`, `StaticRoutes`, `STATUS_HEADER`, `statusPage`, `StatusPageOptions`, `styles`, `Submission`, `SubmitOptions`, `unsafeInlineScript`, `UnsafeScriptDescriptor`, `withISR`
+`Action`, `ACTION_GLOBAL`, `apiKey`, `assertRenderAdapterConformance`, `Blocker`, `BlockerController`, `BlockerFunction`, `BlockerLocation`, `BlockerState`, `BrowserNavigate`, `buildManifest`, `CachedResponse`, `CacheStore`, `canonical`, `clientEntry`, `ClientRouter`, `ClientRouterOptions`, `createClientRouter`, `createMatcher`, `createMutation`, `createQueryClient`, `createWebApp`, `CreateWebAppOptions`, `DATA_GLOBAL`, `DATA_HEADER`, `DEFAULT_DEV_PORT`, `defer`, `Deferred`, `DehydratedState`, `disableDraft`, `DRAFT_COOKIE`, `DraftCookieControls`, `enableDraft`, `EnableDraftOptions`, `enumerateStaticRoutes`, `Fetcher`, `FetcherState`, `FetchRouteData`, `filePathToPattern`, `filePathToPatterns`, `FontDisplay`, `fontFace`, `FontFace`, `fontPreload`, `FontPreloadInput`, `FontSource`, `gate`, `generateClientEntry`, `GenerateClientEntryOptions`, `generateRouteSearchTypes`, `GenerateRouteSearchTypesOptions`, `generateServerManifest`, `GenerateServerManifestOptions`, `getBrowserNavigate`, `GetStaticPaths`, `gone`, `hashQueryKey`, `IDLE_BLOCKER`, `InertScriptType`, `InfiniteData`, `InfiniteQueryHandle`, `InfiniteQueryOptions`, `isDraftEnabled`, `ISR_REVALIDATE_HEADER`, `ISR_REVALIDATE_TAGS_HEADER`, `ISR_STATUS_HEADER`, `ISRApp`, `ISROptions`, `ISRPlatform`, `jsonLd`, `KVCacheStore`, `KVCacheStoreOptions`, `KVNamespaceLike`, `LAYOUT_DATA_GLOBAL`, `LayoutEntry`, `LinkDescriptor`, `Loader`, `LoaderContext`, `manifest`, `Manifest`, `MemoryCacheStore`, `MemoryCacheStoreOptions`, `mergeHeads`, `meta`, `Meta`, `MetaArgs`, `MetaInput`, `MountRouterOptions`, `MutationCallbacks`, `MutationHandle`, `MutationState`, `MutationStatus`, `NAV_FROM_HEADER`, `NavigateFunction`, `NavigateOptions`, `NavigateSearchOf`, `NavigateTargetInput`, `notFound`, `openGraph`, `OpenGraphInput`, `PRE_HYDRATION_GUARD`, `previewEndpoint`, `PreviewEndpointOptions`, `PublicDirCache`, `QueryClient`, `QueryClientOptions`, `QueryHandle`, `QueryOptions`, `QueryState`, `QueryStatus`, `redirect`, `REDIRECT_HEADER`, `RedirectOptions`, `registerBlocker`, `RenderAdapter`, `RenderAdapterConformanceError`, `RenderAdapterConformanceFixture`, `RenderAssemblyCache`, `RenderedPage`, `renderPage`, `RenderPageInput`, `RenderPageOptions`, `renderPageResult`, `RenderProps`, `resolveMeta`, `resolveNavigate`, `resolvePublicPath`, `RETAIN_HEADER`, `revalidate`, `REVALIDATE_HEADER`, `revalidateEndpoint`, `RevalidateEndpointOptions`, `RevalidateResult`, `ROOT_ATTRIBUTE`, `ROUTE_GLOBAL`, `RouteEntry`, `RouteMatch`, `RouteModule`, `RoutePattern`, `RouterState`, `RouteSearch`, `routeStyles`, `ScriptDescriptor`, `searchOf`, `SearchOf`, `searchOfChain`, `serializeData`, `serializeSearch`, `servePublicDir`, `ServePublicDirOptions`, `SERVER_FN_MODULE`, `SERVER_ONLY_MODULE`, `ServerOnly`, `setBlockerController`, `setBrowserNavigate`, `setSsrModuleLoader`, `ssrModuleLoader`, `SsrModuleLoader`, `StaticPath`, `StaticPaths`, `StaticRoutes`, `STATUS_HEADER`, `statusPage`, `StatusPageOptions`, `styles`, `Submission`, `SubmitOptions`, `unsafeInlineScript`, `UnsafeScriptDescriptor`, `withISR`
 
 ## @nifrajs/web-preact