@nifrajs/core 2.14.1 → 3.1.0

package/dist/single-copy.js

@@ -0,0 +1,470 @@
+/**
+ * One physical copy of an identity-sensitive package, enforced at LOAD time.
+ *
+ * ## The gap this closes
+ *
+ * `@nifrajs/web`'s build already pins react/preact/svelte to the app's copy through `onResolve`
+ * (`reactDedupePlugin` and friends), and that covers every bundled phase. It cannot cover an
+ * UNBUNDLED one: Bun's runtime plugin API delivers only the entry point and RELATIVE specifiers to
+ * `onResolve`, so a bare `import "react"` inside a linked package never reaches a resolver hook. The
+ * surfaces that run app sources unbundled - `bun test`, a preloaded script, a route imported natively
+ * - therefore keep loading a second copy no matter what the build does. `onLoad` DOES fire on the
+ * resolved file, which is the one hook that can still intervene, and it is what this module uses.
+ *
+ * It also covers a package class the build plugins never did: `@nifrajs/*` itself. Two copies of
+ * `@nifrajs/core` are two `Server` classes, and `Server` carries private members, so `.merge()` stops
+ * accepting the other's app with a type error that names neither copy.
+ *
+ * ## Why a topology needs it at all
+ *
+ * A package consumed with `link:` (or `file:`, or an `npm link`) resolves ITS OWN imports from where
+ * it physically lives. A shared component library in a sibling repository therefore loads that
+ * repository's react, while the app loads its own - same version, two paths, two module registries.
+ * React reads hooks off a dispatcher the other copy never set, and SSR dies with `Invalid hook call
+ * … resolveDispatcher() is null`, naming neither react nor the package that shadowed it.
+ *
+ * The conventional fixes both cost something real: a cross-repo `workspaces` entry makes the
+ * consumer's install the owner of the other repository's tree and writes into it, and vendoring or
+ * packing copies files that exist precisely so they are not copied. This module is the third option -
+ * leave the topology alone and make the resolution answer correctly - and it is not a workaround:
+ * these packages declare react as a `peerDependency`, which means "the consumer supplies the copy".
+ * That sentence has simply never been enforceable at runtime. Now it is.
+ *
+ * ## What it will not do
+ *
+ * Redirect across a VERSION difference. Two versions is a different defect (someone's range is wrong)
+ * and silently serving 19.2.8 to a package that asked for 19.2.7 turns a loud install problem into a
+ * quiet behavioural one. A version skew is left untouched, so `nifra check` still fails it.
+ *
+ * @example Declare it in package.json, then preload the registrar in bunfig.toml.
+ * ```json
+ * { "nifra": { "singleCopy": ["react", "react-dom", "@nifrajs/*"] } }
+ * ```
+ * ```toml
+ * preload = ["@nifrajs/core/single-copy/register"]
+ * [test]
+ * preload = ["@nifrajs/core/single-copy/register"]
+ * ```
+ */
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+/**
+ * Packages whose duplication is a defect rather than a waste. Each keeps module-scoped state that
+ * every importer must share - a hook dispatcher, a renderer's options global, a class identity - so a
+ * second physical copy breaks behaviour instead of merely costing bytes. Anything scoped `@nifrajs/`
+ * qualifies for the same reason and is matched by pattern.
+ */
+export const IDENTITY_SENSITIVE_PACKAGES = [
+    "@nifrajs/*",
+    "react",
+    "react-dom",
+    "preact",
+    "solid-js",
+    "svelte",
+    "vue",
+];
+/** Files a redirect may rewrite. Everything else in a package (json, css, wasm) loads unchanged. */
+const REDIRECTABLE = /\.(?:m|c)?[jt]sx?$/;
+/** Runaway guards. A real `node_modules` top level is hundreds of entries, a repo walk is a few. */
+const MAX_SCANNED_ENTRIES = 4_096;
+const MAX_ANCESTOR_DIRS = 16;
+const MAX_REPO_DEPTH = 8;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readJsonSync = (path) => {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return isRecord(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const realpathOrSelf = (path) => {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+};
+const inside = (root, path) => path === root || path.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
+/**
+ * The declaration, read from `package.json` - deliberately NOT from `nifra.config.ts`.
+ *
+ * `nifra check` holds a pre-load invariant: it never imports the app's config, because importing is
+ * executing. A dedupe claim has to be verifiable by a checker that refuses to run the app, so it lives
+ * in the one file every tool already parses. `true` means the built-in identity-sensitive set.
+ */
+export function readSingleCopyDeclaration(cwd) {
+    const pkg = readJsonSync(join(resolve(cwd), "package.json"));
+    const nifra = pkg?.nifra;
+    if (!isRecord(nifra))
+        return undefined;
+    const declared = nifra.singleCopy;
+    if (declared === true)
+        return IDENTITY_SENSITIVE_PACKAGES;
+    if (declared === false || declared === undefined)
+        return undefined;
+    if (!Array.isArray(declared))
+        return undefined;
+    const names = declared.filter((name) => typeof name === "string" && name.length > 0);
+    return names.length > 0 ? names : undefined;
+}
+/**
+ * Match a package name against a declaration entry: an exact name, or a `@scope/*` prefix.
+ *
+ * Exported because the enforcement and the CHECK must agree on it exactly. If `nifra check` decided
+ * coverage by its own rule, a package could be reported as deduplicated while the plugin walked past
+ * it - which is worse than no check at all, because it is a green light for a broken graph.
+ */
+export const matchesSingleCopyDeclaration = (declared, name) => declared.some((entry) => entry.endsWith("/*") ? name.startsWith(entry.slice(0, -1)) : entry === name);
+/** The public specifier a `bunfig.toml` preload must name to arm the runtime. */
+export const SINGLE_COPY_REGISTER_SPECIFIER = "@nifrajs/core/single-copy/register";
+/** Every `preload = [...]` assignment, tagged with the section it appears under. */
+const PRELOAD_ASSIGNMENT = /^\s*(?:\[(?<section>[^\]]+)\]|preload\s*=\s*(?<value>\[[^\]]*\]|.+))\s*$/;
+/**
+ * The exact entries of a `preload` assignment: a single-line array, or one quoted string.
+ *
+ * A substring test on the raw assignment is not proof. `preload =
+ * ["@nifrajs/core/single-copy/register-extra"]` contains the specifier and satisfies an
+ * `includes()`, while Bun loads that other module and the registrar never runs - the check then
+ * reports single-copy enforcement as armed on a process that still loads both copies. An entry only
+ * counts when it IS the specifier. Anything this cannot read as a quoted entry (a multi-line array,
+ * an interpolated value) yields nothing, so the caller reports "not registered" rather than proof.
+ */
+function preloadEntries(value) {
+    const closing = value.lastIndexOf("]");
+    const inner = value.startsWith("[") && closing !== -1 ? value.slice(1, closing) : value;
+    const entries = [];
+    for (const raw of inner.split(",")) {
+        const entry = raw.trim();
+        // A TOML string is quoted at both ends with the same quote; two characters is the shortest one.
+        if (entry.length < 2)
+            continue;
+        const quote = entry.charCodeAt(0);
+        if (quote !== 34 && quote !== 39)
+            continue;
+        if (entry.charCodeAt(entry.length - 1) !== quote)
+            continue;
+        entries.push(entry.slice(1, -1));
+    }
+    return entries;
+}
+/**
+ * Read the runtime proof out of `bunfig.toml`.
+ *
+ * Line-oriented on purpose: this runs inside `nifra check`, which must not execute or import anything
+ * from the project, and the shape being read is a literal array of strings under a known key. A full
+ * TOML parse would buy nothing here and would turn an unrelated syntax error elsewhere in the file
+ * into a failure to answer this question.
+ */
+export function readSingleCopyRegistration(cwd) {
+    const config = join(resolve(cwd), "bunfig.toml");
+    let text;
+    try {
+        text = readFileSync(config, "utf8");
+    }
+    catch {
+        return { run: false, test: false };
+    }
+    let section = "";
+    let run = false;
+    let test = false;
+    for (const line of text.split(/\r?\n/)) {
+        const match = PRELOAD_ASSIGNMENT.exec(line);
+        if (match?.groups === undefined)
+            continue;
+        const { section: heading, value } = match.groups;
+        if (heading !== undefined) {
+            section = heading.trim();
+            continue;
+        }
+        if (value === undefined || !preloadEntries(value).includes(SINGLE_COPY_REGISTER_SPECIFIER))
+            continue;
+        if (section === "test")
+            test = true;
+        else if (section === "")
+            run = true;
+    }
+    return { run, test, config };
+}
+/** The repository a linked checkout resolves its own dependencies from: its nearest `.git` ancestor.
+ * A path that lands inside a `node_modules` is a package-manager store copy rather than a checkout,
+ * and everything above it belongs to whoever owns that store - clamp to the copy itself. */
+const repoBoundary = (packageRoot) => {
+    if (packageRoot.split(sep).includes("node_modules"))
+        return packageRoot;
+    let dir = packageRoot;
+    for (let depth = 0; depth < MAX_REPO_DEPTH; depth++) {
+        if (existsSync(join(dir, ".git")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return packageRoot;
+};
+/** Walk up from `start` for `node_modules/<name>/package.json`, stopping after `boundary`. */
+const installedCopy = (start, name, boundary) => {
+    const parts = name.split("/");
+    for (let dir = start;; dir = dirname(dir)) {
+        const packageRoot = join(dir, "node_modules", ...parts);
+        const meta = readJsonSync(join(packageRoot, "package.json"));
+        if (meta !== undefined) {
+            return {
+                root: realpathOrSelf(packageRoot),
+                version: typeof meta.version === "string" ? meta.version : "unknown",
+            };
+        }
+        if (dir === boundary)
+            return undefined;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+    }
+};
+/** Every `node_modules` from the app root up to (and including) its repository root. */
+const nodeModulesDirs = (root) => {
+    const boundary = repoBoundary(root);
+    const dirs = [];
+    let dir = root;
+    for (let depth = 0; depth < MAX_ANCESTOR_DIRS; depth++) {
+        const candidate = join(dir, "node_modules");
+        if (existsSync(candidate))
+            dirs.push(candidate);
+        if (dir === boundary)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return dirs;
+};
+/**
+ * Package directories that are symlinked OUT of this repository - the `link:` / `file:` / `npm link`
+ * consumers whose own imports resolve somewhere this install does not own. Those are the only
+ * importers that can introduce a second copy; a normally-installed dependency resolves inside the
+ * tree that just installed it.
+ */
+const linkedPackageDirs = (root) => {
+    const repo = realpathOrSelf(repoBoundary(root));
+    const found = new Set();
+    let scanned = 0;
+    for (const nodeModules of nodeModulesDirs(root)) {
+        let entries;
+        try {
+            entries = readdirSync(nodeModules);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (scanned++ >= MAX_SCANNED_ENTRIES)
+                return [...found];
+            if (entry === ".bin" || entry === ".cache")
+                continue;
+            const path = join(nodeModules, entry);
+            // A scope directory is not a package; its children are.
+            const children = entry.startsWith("@")
+                ? readdirSync(path, { withFileTypes: true }).map((child) => join(path, child.name))
+                : [path];
+            for (const candidate of children) {
+                if (scanned++ >= MAX_SCANNED_ENTRIES)
+                    return [...found];
+                let link;
+                try {
+                    link = lstatSync(candidate);
+                }
+                catch {
+                    continue;
+                }
+                if (!link.isSymbolicLink())
+                    continue;
+                const target = realpathOrSelf(candidate);
+                if (inside(repo, target))
+                    continue;
+                found.add(target);
+            }
+        }
+    }
+    return [...found];
+};
+/** Concrete package names a declaration covers, taken from what is actually installed for the app. */
+const declaredNames = (root, declared) => {
+    const names = new Set();
+    for (const entry of declared) {
+        if (!entry.endsWith("/*")) {
+            names.add(entry);
+            continue;
+        }
+        const scope = entry.slice(0, -2);
+        for (const nodeModules of nodeModulesDirs(root)) {
+            const scopeDir = join(nodeModules, ...scope.split("/"));
+            try {
+                for (const child of readdirSync(scopeDir))
+                    names.add(`${scope}/${child}`);
+            }
+            catch {
+                // No such scope installed here - the pattern simply matches nothing in this tree.
+            }
+        }
+    }
+    return [...names].sort();
+};
+/**
+ * Work out which foreign copies exist and which of them may be redirected.
+ *
+ * Pure discovery: it reads `package.json` files and symlink targets, never application source, and
+ * never mutates anything. Both the plugin and `nifra check`'s verification are built on it, so the
+ * enforcement and the report cannot drift apart.
+ */
+export function planSingleCopy(options = {}) {
+    const root = realpathOrSelf(resolve(options.cwd ?? process.cwd()));
+    const declared = options.packages ?? readSingleCopyDeclaration(root) ?? [];
+    if (declared.length === 0)
+        return { root, declared, redirects: [], skipped: [] };
+    const names = declaredNames(root, declared);
+    const redirects = [];
+    const skipped = [];
+    const rootBoundary = repoBoundary(root);
+    for (const linked of linkedPackageDirs(root)) {
+        const boundary = repoBoundary(linked);
+        for (const name of names) {
+            if (!matchesSingleCopyDeclaration(declared, name))
+                continue;
+            const theirs = installedCopy(linked, name, boundary);
+            if (theirs === undefined)
+                continue;
+            const ours = installedCopy(root, name, rootBoundary);
+            if (ours === undefined || ours.root === theirs.root)
+                continue;
+            if (ours.version !== theirs.version) {
+                skipped.push({
+                    package: name,
+                    from: theirs.root,
+                    reason: "version-skew",
+                    detail: `${theirs.version} there, ${ours.version} here - redirecting would serve a version that copy did not ask for`,
+                });
+                continue;
+            }
+            if (redirects.some((redirect) => redirect.from === theirs.root))
+                continue;
+            redirects.push({ package: name, from: theirs.root, to: ours.root, version: ours.version });
+        }
+    }
+    redirects.sort((a, b) => a.from.localeCompare(b.from));
+    skipped.sort((a, b) => a.from.localeCompare(b.from));
+    return { root, declared, redirects, skipped };
+}
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * The module a foreign file should become: the same relative file inside the winning copy.
+ *
+ * Mapping FILE to FILE rather than file to export subpath is what makes this safe on a package with a
+ * rich exports map. Guessing that `dist/server.js` is the `./server` subpath is guesswork that fails
+ * on the first package whose map is not one-to-one; the counterpart path is a fact, and the two trees
+ * hold the same version, so the layout matches by construction. When it does not, the file loads
+ * untouched.
+ */
+const counterpart = (redirect, path) => {
+    const rel = relative(redirect.from, path);
+    if (rel === "" || rel.startsWith(`..${sep}`))
+        return undefined;
+    const target = join(redirect.to, rel);
+    try {
+        return statSync(target).isFile() ? target : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * A re-export of the winning file, written so both module systems keep working.
+ *
+ * `export *` forwards the named bindings, including the ones Bun synthesizes for a CommonJS target,
+ * and the explicit default covers `module.exports` (react is CommonJS, and its consumers `require` it
+ * as often as they import it). Static imports keep the module SYNCHRONOUS, which matters more than it
+ * looks: an `await import()` here would make the module async, and a CommonJS `require` of an async
+ * module fails outright with `require() async module … is unsupported`.
+ */
+const reexport = (target) => {
+    const from = JSON.stringify(target);
+    return (`export * from ${from};\n` +
+        `import * as __singleCopy from ${from};\n` +
+        `export default __singleCopy.default ?? __singleCopy;\n`);
+};
+/**
+ * Pin every declared package to the app's copy.
+ *
+ * Two hooks, because the two phases resolve differently. `onResolve` is the direct statement of the
+ * rule and it is what a BUNDLER honours - it sees every bare specifier. The runtime does not deliver
+ * bare specifiers to it at all, so the `onLoad` arm intercepts the foreign file itself and hands back
+ * a re-export of the counterpart in the winning copy. The importer gets the same function objects and
+ * therefore the same module state, which is the entire requirement.
+ */
+export function singleCopyPlugin(options = {}) {
+    const plan = planSingleCopy(options);
+    const declared = plan.declared;
+    return {
+        name: "nifra-single-copy",
+        plan,
+        setup(build) {
+            if (declared.length > 0) {
+                const exact = declared.filter((entry) => !entry.endsWith("/*")).map(escapeRegExp);
+                const scopes = declared
+                    .filter((entry) => entry.endsWith("/*"))
+                    .map((entry) => `${escapeRegExp(entry.slice(0, -1))}[^/]+`);
+                const alternatives = [...exact.map((name) => `${name}(?:/.*)?`), ...scopes];
+                if (alternatives.length > 0) {
+                    const filter = new RegExp(`^(?:${alternatives.join("|")})$`);
+                    build.onResolve({ filter }, (args) => {
+                        try {
+                            return { path: Bun.resolveSync(args.path, plan.root) };
+                        }
+                        catch {
+                            // Not installed for the app, so there is nothing to dedupe TO. Forcing a resolution here
+                            // would turn a working import into a build failure.
+                            return undefined;
+                        }
+                    });
+                }
+            }
+            if (plan.redirects.length === 0)
+                return;
+            const roots = plan.redirects.map((redirect) => escapeRegExp(redirect.from)).join("|");
+            // Anchored at the foreign roots so the winning copy can never match itself. It must not: this
+            // hook has to return contents for everything it matches, and re-emitting a CommonJS entry as an
+            // ES module is how `Export named 'useEffect' not found` happens.
+            const filter = new RegExp(`^(?:${roots})[/\\\\].*${REDIRECTABLE.source}`);
+            build.onLoad({ filter }, (args) => {
+                for (const redirect of plan.redirects) {
+                    const target = counterpart(redirect, args.path);
+                    if (target === undefined)
+                        continue;
+                    return { contents: reexport(target), loader: "js" };
+                }
+                // A runtime `onLoad` must always return an object - returning nothing fails the load rather
+                // than falling through to the default. Hand back the file as it was, at its own path, so its
+                // relative imports keep resolving exactly as they would have.
+                return { contents: readFileSync(args.path, "utf8"), loader: "js" };
+            });
+        },
+    };
+}
+/** Set once the runtime plugin is installed, so a checker can tell "one copy" from "deduplicated". */
+export const SINGLE_COPY_ACTIVE = Symbol.for("nifra.single-copy.active");
+/**
+ * Install the plugin into the Bun RUNTIME. Import `@nifrajs/core/single-copy/register` from a
+ * `bunfig.toml` preload rather than calling this from application code: a resolver installed from
+ * inside a module cannot affect the imports that module already resolved.
+ */
+export function registerSingleCopy(options = {}) {
+    const plugin = singleCopyPlugin(options);
+    if (plugin.plan.declared.length > 0)
+        Bun.plugin(plugin);
+    globalThis[SINGLE_COPY_ACTIVE] = plugin.plan;
+    return plugin.plan;
+}
+//# sourceMappingURL=single-copy.js.map

package/dist/single-copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-copy.js","sourceRoot":"","sources":["../src/single-copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAGjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,YAAY;IACZ,OAAO;IACP,WAAW;IACX,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,KAAK;CACN,CAAA;AAED,oGAAoG;AACpG,MAAM,YAAY,GAAG,oBAAoB,CAAA;AACzC,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,KAAK,CAAA;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,cAAc,GAAG,CAAC,CAAA;AAsCxB,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAuC,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;IAC9C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CACrD,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAA;IACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAA;IACjC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAA;IACzD,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAC3B,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,QAA2B,EAAE,IAAY,EAAW,EAAE,CACjG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAC5E,CAAA;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAA;AAalF,oFAAoF;AACpF,MAAM,kBAAkB,GACtB,0EAA0E,CAAA;AAE5E;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvF,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACxB,gGAAgG;QAChG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK;YAAE,SAAQ;QAC1D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAA;IAChD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS;YAAE,SAAQ;QACzC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,MAAM,CAAA;QAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;YACxB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACxF,SAAQ;QACV,IAAI,OAAO,KAAK,MAAM;YAAE,IAAI,GAAG,IAAI,CAAA;aAC9B,IAAI,OAAO,KAAK,EAAE;YAAE,GAAG,GAAG,IAAI,CAAA;IACrC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC;AAED;;4FAE4F;AAC5F,MAAM,YAAY,GAAG,CAAC,WAAmB,EAAU,EAAE;IACnD,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,WAAW,CAAA;IACvE,IAAI,GAAG,GAAG,WAAW,CAAA;IACrB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC,CAAA;AAED,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CACpB,KAAa,EACb,IAAY,EACZ,QAAgB,EACiD,EAAE;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,CAAA;QACvD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;gBACjC,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aACrE,CAAA;QACH,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;IACtC,CAAC;AACH,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,eAAe,GAAG,CAAC,IAAY,EAAqB,EAAE;IAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,iBAAiB,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAK;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAqB,EAAE;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,OAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,EAAE,IAAI,mBAAmB;gBAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;YACvD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YACrC,wDAAwD;YACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBACpC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACV,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACjC,IAAI,OAAO,EAAE,IAAI,mBAAmB;oBAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;gBACvD,IAAI,IAAkC,CAAA;gBACtC,IAAI,CAAC;oBACH,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,SAAQ;gBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;gBACxC,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;oBAAE,SAAQ;gBAClC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,QAA2B,EAAqB,EAAE;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAChC,KAAK,MAAM,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACvD,IAAI,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,kFAAkF;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,UAA6B,EAAE;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAEhF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAEvC,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAAE,SAAQ;YAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpD,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAQ;YAClC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;YACpD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,SAAQ;YAC7D,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC,OAAO,qEAAqE;iBACtH,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AAE5F;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,CAAC,QAA4B,EAAE,IAAY,EAAsB,EAAE;IACrF,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CACL,iBAAiB,IAAI,KAAK;QAC1B,iCAAiC,IAAI,KAAK;QAC1C,wDAAwD,CACzD,CAAA;AACH,CAAC,CAAA;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA6B,EAAE;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;IAC9B,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,IAAI;QACJ,KAAK,CAAC,KAAK;YACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBACjF,MAAM,MAAM,GAAG,QAAQ;qBACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;qBACvC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;gBAC7D,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;gBAC3E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAC5D,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;wBACnC,IAAI,CAAC;4BACH,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;wBACxD,CAAC;wBAAC,MAAM,CAAC;4BACP,yFAAyF;4BACzF,oDAAoD;4BACpD,OAAO,SAAS,CAAA;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACrF,8FAA8F;YAC9F,gGAAgG;YAChG,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,EAAE,CAAC,CAAA;YACzE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC/C,IAAI,MAAM,KAAK,SAAS;wBAAE,SAAQ;oBAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;gBACrD,CAAC;gBACD,4FAA4F;gBAC5F,6FAA6F;gBAC7F,8DAA8D;gBAC9D,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;YACpE,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;AAExE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CACtD;IAAC,UAAsC,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/core",
-  "version": "2.14.1",
+  "version": "3.1.0",
   "description": "Bun-native, contract-first HTTP framework - the router, server, and route descriptor.",
   "keywords": [
     "bun",
@@ -37,6 +37,11 @@
       "types": "./dist/ws.d.ts",
       "default": "./dist/ws.js"
     },
+    "./edge-kit": {
+      "bun": "./src/edge-kit.ts",
+      "types": "./dist/edge-kit.d.ts",
+      "default": "./dist/edge-kit.js"
+    },
     "./wire": {
       "bun": "./src/wire.ts",
       "types": "./dist/wire.d.ts",
@@ -237,6 +242,11 @@
       "types": "./dist/server/response-contract-lane.d.ts",
       "default": "./dist/server/response-contract-lane.js"
     },
+    "./response-observer": {
+      "bun": "./src/response-observer.ts",
+      "types": "./dist/response-observer.d.ts",
+      "default": "./dist/response-observer.js"
+    },
     "./tool-contract": {
       "bun": "./src/tool-contract.ts",
       "types": "./dist/tool-contract.d.ts",
@@ -251,6 +261,16 @@
       "bun": "./src/execution-policy.ts",
       "types": "./dist/execution-policy.d.ts",
       "default": "./dist/execution-policy.js"
+    },
+    "./single-copy": {
+      "bun": "./src/single-copy.ts",
+      "types": "./dist/single-copy.d.ts",
+      "default": "./dist/single-copy.js"
+    },
+    "./single-copy/register": {
+      "bun": "./src/single-copy-register.ts",
+      "types": "./dist/single-copy-register.d.ts",
+      "default": "./dist/single-copy-register.js"
     }
   },
   "files": [
@@ -265,7 +285,9 @@
     "./src/node-direct.ts",
     "./dist/node-direct.js",
     "./src/mcp-runtime.ts",
-    "./dist/mcp-runtime.js"
+    "./dist/mcp-runtime.js",
+    "./src/single-copy-register.ts",
+    "./dist/single-copy-register.js"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json && bun run ../../scripts/fix-dts.ts dist"

package/src/assurance.ts

@@ -36,6 +36,11 @@ import type { NifraManifestSigner } from "./manifest.ts"
 import { type ReflectedRoute, reflectRoutes } from "./reflection.ts"
 import type { Method } from "./router/router.ts"
 
+export {
+  type SecurityBaselineLevel,
+  type SecurityBaselineOptions,
+  securityBaseline,
+} from "./security/baseline.ts"
 export type { AssuranceAttachment, AssuranceDeclaration, AssuranceEvidence, AssuranceScope }
 export { withRouteAssurance }
 
@@ -135,6 +140,20 @@ export interface AssuranceRouteSelector {
   readonly zone?: CapabilityZone
   /** Match routes whose response classification is at least this sensitivity. */
   readonly classificationAtLeast?: DataClassification
+  /**
+   * Match routes by whether they declare a request-body schema. `true` selects routes that parse a
+   * body (the buffered-read surface F-001 is about); `false` selects bodyless routes. Reflection
+   * already carries `schema.body`, so this reads what the route declared, not where it lives.
+   */
+  readonly hasBody?: boolean
+  /**
+   * Match routes by their effective transport body policy. `"unlimited"` is the explicit
+   * streaming/upload exemption; `"bounded"` is any finite cap (an explicit number or the inherited
+   * server default); `"unset"` is a route that declared no `bodyLimit` at all. Lets a baseline say
+   * "a body-schema route may never be unlimited" as a first-class, movable invariant rather than a
+   * path list. A route with no schema reports `"unset"` unless it names a limit.
+   */
+  readonly bodyLimit?: "bounded" | "unlimited" | "unset"
 }
 
 /** Extra inputs an assurance evaluation needs beyond the routes themselves. */
@@ -337,6 +356,8 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
           "capabilities",
           ...CLASS_SELECTOR_KEYS,
           "classificationAtLeast",
+          "hasBody",
+          "bodyLimit",
         ].includes(key),
     )
     if (unknown.length > 0) {
@@ -351,6 +372,21 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         `route assurance: rule ${JSON.stringify(name)} tools selector must be boolean`,
       )
     }
+    if (rule.match.hasBody !== undefined && typeof rule.match.hasBody !== "boolean") {
+      throw new Error(
+        `route assurance: rule ${JSON.stringify(name)} hasBody selector must be boolean`,
+      )
+    }
+    if (
+      rule.match.bodyLimit !== undefined &&
+      rule.match.bodyLimit !== "bounded" &&
+      rule.match.bodyLimit !== "unlimited" &&
+      rule.match.bodyLimit !== "unset"
+    ) {
+      throw new Error(
+        `route assurance: rule ${JSON.stringify(name)} bodyLimit selector must be "bounded", "unlimited", or "unset"`,
+      )
+    }
     const methods = rule.match.methods?.map((method) => method.toUpperCase())
     for (const method of methods ?? []) {
       if (!validMethod(method)) {
@@ -431,6 +467,8 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         ...(rule.match.classificationAtLeast !== undefined
           ? { classificationAtLeast: rule.match.classificationAtLeast }
           : {}),
+        ...(rule.match.hasBody !== undefined ? { hasBody: rule.match.hasBody } : {}),
+        ...(rule.match.bodyLimit !== undefined ? { bodyLimit: rule.match.bodyLimit } : {}),
       }),
       require: required,
       forbid: forbidden,
@@ -558,16 +596,35 @@ export function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig
  * reflection alone. A caller that omits it while the selector needs it gets no match, so callers that
  * accept user policy must reject that combination up front - `defineAssuranceConfig` does.
  */
+/**
+ * The effective transport body policy a `bodyLimit` selector matches on. A route that named no limit
+ * reports `"unset"` (it inherits the server default, which a policy that cares about explicit caps
+ * should treat distinctly); a finite number is `"bounded"`; the streaming/upload exemption is
+ * `"unlimited"`. Kept total so a future `bodyLimit` shape cannot fall through to a silent match.
+ */
+function effectiveBodyLimit(schema: ReflectedRoute["schema"]): "bounded" | "unlimited" | "unset" {
+  const limit = schema?.bodyLimit
+  if (limit === "unlimited") return "unlimited"
+  if (typeof limit === "number") return "bounded"
+  return "unset"
+}
+
 export function matchesAssuranceSelector(
-  route: Pick<ReflectedRoute, "method" | "path" | "tool" | "capabilities" | "classification">,
+  route: Pick<
+    ReflectedRoute,
+    "method" | "path" | "tool" | "capabilities" | "classification" | "schema"
+  >,
   selector: AssuranceRouteSelector,
   definitions?: ReadonlyMap<string, CapabilityDefinition>,
 ): boolean {
   const { methods, paths, tools, capabilities, access, zone, classificationAtLeast } = selector
+  const { hasBody, bodyLimit } = selector
   if (methods !== undefined && !methods.includes(route.method as Method)) return false
   if (paths !== undefined && !paths.some((pattern) => routeGlob(pattern).test(route.path)))
     return false
   if (tools !== undefined && (route.tool !== undefined) !== tools) return false
+  if (hasBody !== undefined && (route.schema?.body !== undefined) !== hasBody) return false
+  if (bodyLimit !== undefined && effectiveBodyLimit(route.schema) !== bodyLimit) return false
   if (
     classificationAtLeast !== undefined &&
     (route.classification === undefined ||