@nifrajs/web 2.1.0 → 2.3.0

package/dist/fonts-google.js

@@ -1,12 +1,12 @@
 /**
- * Build-time Google Fonts automation — the `next/font/google` equivalent. At **build time** (never on
+ * Build-time Google Fonts automation - the `next/font/google` equivalent. At **build time** (never on
  * the request path) it: builds the Google Fonts CSS2 URL, downloads the stylesheet, parses the
  * `@font-face` rules, downloads each `.woff2`, content-hashes it, writes it next to your assets, and
  * hands back a **self-hosted** `@font-face` stylesheet + the matching `<link rel="preload">`s. The
- * result is identical to dropping the files in yourself and calling {@link fontFace} — no runtime CDN
+ * result is identical to dropping the files in yourself and calling {@link fontFace} - no runtime CDN
  * hotlink, no layout shift, hashed filenames for immutable caching.
  *
- *   // fonts.build.ts — run once at build time (e.g. a prebuild step)
+ *   // fonts.build.ts - run once at build time (e.g. a prebuild step)
  *   import { loadGoogleFont } from "@nifrajs/web/fonts"
  *   const inter = await loadGoogleFont(
  *     { family: "Inter", weights: [400, 700], subsets: ["latin"] },
@@ -16,7 +16,7 @@
  *   // inter.preloads → spread into a root layout's `meta.link`
  *
  * Security: this fetches remote content and writes it to disk, so every input is validated and the
- * font-file host is **allowlisted to `fonts.gstatic.com` over https** — a tampered/MITM'd stylesheet
+ * font-file host is **allowlisted to `fonts.gstatic.com` over https** - a tampered/MITM'd stylesheet
  * cannot make the build fetch an arbitrary URL (SSRF) or write an attacker-chosen blob. Downloads are
  * size-capped. Filenames are derived only from validated tokens + a content hash (no path traversal).
  */
@@ -39,7 +39,7 @@ const VALID_DISPLAY = new Set([
     "fallback",
     "optional",
 ]);
-/** `true` iff `raw` is an `https://fonts.gstatic.com/…` URL — the only host we'll download from. */
+/** `true` iff `raw` is an `https://fonts.gstatic.com/…` URL - the only host we'll download from. */
 export function isAllowedFontUrl(raw) {
     let url;
     try {
@@ -63,7 +63,7 @@ function validateFamily(family) {
 function normalizeWeight(weight) {
     if (typeof weight === "number") {
         if (!Number.isInteger(weight) || weight < 1 || weight > 1000) {
-            throw new Error(`loadGoogleFont: invalid weight ${weight} (1–1000)`);
+            throw new Error(`loadGoogleFont: invalid weight ${weight} (1-1000)`);
         }
         return String(weight);
     }
@@ -134,7 +134,7 @@ function declOf(body, prop) {
     return m?.[1]?.trim();
 }
 /** Parse Google's stylesheet into structured faces, capturing the `/* subset *​/` label that precedes
- * each `@font-face`. Pure — exported so callers can run their own download/write pipeline. */
+ * each `@font-face`. Pure - exported so callers can run their own download/write pipeline. */
 export function parseGoogleFontCss(css) {
     const faces = [];
     for (const match of css.matchAll(FACE_RE)) {
@@ -165,7 +165,7 @@ export function parseGoogleFontCss(css) {
     }
     return faces;
 }
-/** First 16 hex chars of the SHA-256 of the bytes — a content hash for an immutable, cache-busting
+/** First 16 hex chars of the SHA-256 of the bytes - a content hash for an immutable, cache-busting
  * filename. Web Crypto, so it runs identically on Bun/Node/edge build hosts. `Uint8Array<ArrayBuffer>`
  * (not the generic `ArrayBufferLike`) to satisfy WebCrypto's `BufferSource` under TS 5.7+ generics. */
 async function contentHash(bytes) {
@@ -180,7 +180,7 @@ const slug = (s) => s
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-+|-+$/g, "");
-/** Host of a URL for error messages — we never echo the full untrusted URL+path. */
+/** Host of a URL for error messages - we never echo the full untrusted URL+path. */
 const hostOf = (raw) => {
     try {
         return new URL(raw).host;
@@ -229,7 +229,7 @@ export async function loadGoogleFont(options, io) {
     if (faces.length === 0) {
         throw new Error(`loadGoogleFont: Google returned no @font-face rules for ${JSON.stringify(family)}`);
     }
-    // Filter to requested named subsets — but only when not glyph-subsetting (text mode labels faces
+    // Filter to requested named subsets - but only when not glyph-subsetting (text mode labels faces
     // `[0]`, `[1]`, … which carry no subset name).
     if (wantedSubsets && wantedSubsets.length > 0 && options.text === undefined) {
         faces = faces.filter((f) => wantedSubsets.includes(f.subset));

package/dist/fonts.d.ts

@@ -1,17 +1,17 @@
 /**
- * Font optimization primitives — generate a **CLS-safe `@font-face`** rule and the matching
+ * Font optimization primitives - generate a **CLS-safe `@font-face`** rule and the matching
  * **preload `<link>`** for a self-hosted font. The two fixes that matter most (the ones `next/font`
  * automates) are right here: `font-display: swap` (text paints immediately, no invisible-text FOIT)
  * plus a preload so the file downloads with the document, and optional metric overrides
  * (`size-adjust`/`ascent-override`/…) so swapping from the fallback to the web font doesn't shift layout.
  *
- * Self-host the file (drop a `.woff2` in your assets — never hotlink Google's CDN), then:
+ * Self-host the file (drop a `.woff2` in your assets - never hotlink Google's CDN), then:
  *
- *   // fonts.css (imported by your app — the CSS pipeline bundles + links it)
+ *   // fonts.css (imported by your app - the CSS pipeline bundles + links it)
  *   import { fontFace } from "@nifrajs/web"
  *   export default fontFace({ family: "Inter", src: [{ url: "/fonts/inter.woff2" }], weight: "100 900" })
  *
- *   // a root layout's meta — becomes a <link rel="preload" as="font"> in <head>
+ *   // a root layout's meta - becomes a <link rel="preload" as="font"> in <head>
  *   export const meta = { link: [fontPreload({ href: "/fonts/inter.woff2" })] }
  */
 import type { LinkDescriptor } from "./manifest.js";
@@ -32,7 +32,7 @@ export interface FontFace {
     readonly style?: "normal" | "italic" | "oblique";
     /** Defaults to `"swap"` (no flash of invisible text). */
     readonly display?: FontDisplay;
-    /** Restrict the glyphs this face covers, e.g. `"U+0000-00FF"` — lets the browser skip the download
+    /** Restrict the glyphs this face covers, e.g. `"U+0000-00FF"` - lets the browser skip the download
      * for pages without those characters. */
     readonly unicodeRange?: string;
     /** Metric overrides that eliminate layout shift when the fallback swaps to the web font (the
@@ -53,13 +53,13 @@ export interface FontPreloadInput {
     readonly href: string;
     /** MIME type (`font/woff2`, …). Inferred from the extension when omitted. */
     readonly type?: string;
-    /** `crossorigin` mode — defaults to `"anonymous"`. Fonts are always fetched in CORS mode, and a
+    /** `crossorigin` mode - defaults to `"anonymous"`. Fonts are always fetched in CORS mode, and a
      * preload whose `crossorigin` doesn't match the actual fetch is **wasted** (downloaded twice), so
      * this is on by default. */
     readonly crossOrigin?: "anonymous" | "use-credentials";
 }
 /**
- * Build a font preload as a `<link>` attribute set for a route/layout's `meta.link` — nifra injects it
+ * Build a font preload as a `<link>` attribute set for a route/layout's `meta.link` - nifra injects it
  * into `<head>` (`<link rel="preload" as="font" type="font/woff2" crossorigin="anonymous">`). Values are
  * escaped at injection by the head renderer. Preloading the font file removes a render-blocking round
  * trip (the browser would otherwise discover the font only after parsing the CSS).

package/dist/fonts.js

@@ -69,7 +69,7 @@ export function fontFace(face) {
     return `@font-face {\n  ${declarations.join(";\n  ")};\n}`;
 }
 /**
- * Build a font preload as a `<link>` attribute set for a route/layout's `meta.link` — nifra injects it
+ * Build a font preload as a `<link>` attribute set for a route/layout's `meta.link` - nifra injects it
  * into `<head>` (`<link rel="preload" as="font" type="font/woff2" crossorigin="anonymous">`). Values are
  * escaped at injection by the head renderer. Preloading the font file removes a render-blocking round
  * trip (the browser would otherwise discover the font only after parsing the CSS).

package/dist/forms.d.ts

@@ -1,6 +1,6 @@
 /**
- * `@nifrajs/web/forms` — a typed form ↔ backend-schema binding. The three artifacts that must agree —
- * a form's `<input name>`, the action's `formData.get`, and the typed-client payload — all key off the
+ * `@nifrajs/web/forms` - a typed form ↔ backend-schema binding. The three artifacts that must agree -
+ * a form's `<input name>`, the action's `formData.get`, and the typed-client payload - all key off the
  * ONE route body schema, derived purely from `typeof backend`. A typo'd field name, or a field the
  * schema doesn't have, becomes a COMPILE error instead of a silent runtime empty.
  *
@@ -8,14 +8,14 @@
  *   import { formFor } from "@nifrajs/web/forms"
  *
  *   const f = formFor<typeof backend, "/todos">()   // method defaults to "post"
- *   // In the component (any framework — spread the props onto an input):
+ *   // In the component (any framework - spread the props onto an input):
  *   <input {...f.field("text")} />                  // "text" ∈ the body's keys, else a compile error
  *   // In the action:
  *   const text = f.read(await request.formData(), "text")   // an orphan key won't compile
  *   await api.todos.post({ text })                  // payload already typed by nifra
  *
  * Framework-agnostic + dependency-free: no codegen, no schema is bundled into the client, and the
- * runtime is a trivial pass-through — all the work is in the types. It checks the field KEY, never the
+ * runtime is a trivial pass-through - all the work is in the types. It checks the field KEY, never the
  * MEANING (a `field("email")` collecting a phone is still valid here); that stays an app/AI concern.
  */
 import type { RouteInfo, Server } from "@nifrajs/core/server";
@@ -23,23 +23,23 @@ type FormEntry = ReturnType<FormData["get"]>;
 type FormEntries = ReturnType<FormData["getAll"]>;
 /** The route registry baked into a server's type (`typeof app`). */
 type RegistryOf<App> = App extends Server<infer R, infer _Ctx> ? R : never;
-/** Every route path the app declares — constrains `Path`, so a wrong path is itself a type error. */
+/** Every route path the app declares - constrains `Path`, so a wrong path is itself a type error. */
 export type RoutePaths<App> = keyof RegistryOf<App> & string;
 /** The body object type of `App`'s `Method Path` route (`never` when the route declares no body). */
 export type RouteBody<App, Path extends string, Method extends string> = Path extends keyof RegistryOf<App> ? Uppercase<Method> extends keyof RegistryOf<App>[Path] ? (RegistryOf<App>[Path][Uppercase<Method>] & RouteInfo)["body"] : never : never;
-/** The valid field names for that route's body — the schema's keys as a string union. */
+/** The valid field names for that route's body - the schema's keys as a string union. */
 export type FieldKey<App, Path extends string, Method extends string> = [
     RouteBody<App, Path, Method>
 ] extends [never] ? never : keyof RouteBody<App, Path, Method> & string;
 /** Extra attributes merged into the returned input props (id, type, defaultValue, placeholder, …). */
 export type FieldProps = Record<string, unknown>;
 export interface FormHandle<App, Path extends string, Method extends string> {
-    /** Input props for a schema field. `name` is constrained to the body's keys — a typo, or a field the
+    /** Input props for a schema field. `name` is constrained to the body's keys - a typo, or a field the
      * schema doesn't have, is a COMPILE error. Spread onto an element: `<input {...f.field("text")} />`. */
     field<K extends FieldKey<App, Path, Method>>(name: K, props?: FieldProps): FieldProps & {
         name: K;
     };
-    /** `formData.get`, key-constrained to the body's fields — reading an orphan key won't compile. */
+    /** `formData.get`, key-constrained to the body's fields - reading an orphan key won't compile. */
     read<K extends FieldKey<App, Path, Method>>(form: FormData, name: K): FormEntry;
     /** `formData.getAll`, key-checked the same way. */
     readAll<K extends FieldKey<App, Path, Method>>(form: FormData, name: K): FormEntries;

package/dist/fs.d.ts

@@ -1,9 +1,22 @@
 import { type Manifest } from "./manifest.js";
 /** Options for {@link discoverRoutes}. */
 export interface DiscoverRoutesOptions {
-    /** Appended (as `?<importQuery>`) to each route's dynamic import — the dev server sets a
-     * changing value to bust Bun's module cache so SSR picks up edited route files. */
+    /** Appended (as `?<importQuery>`) to each route's dynamic import - the dev server sets a
+     * changing value to bust Bun's module cache so SSR picks up edited route files. Ignored when
+     * {@link load} is supplied, which does its own cache handling. */
     readonly importQuery?: string;
+    /**
+     * Load a route module by its absolute path, instead of a bare dynamic `import()`.
+     *
+     * This is what lets a pipeline own SSR resolution. A bare `import()` always resolves through the
+     * RUNTIME - Bun - so the Vite dev server ended up serving the client while Bun resolved the server,
+     * two resolvers disagreeing about one specifier in a single process. That is the dual-React bug and
+     * the reason `resolve.dedupe` never reached SSR: the alias governs Vite, and SSR never asked Vite.
+     *
+     * Pass `vite.ssrLoadModule` here and the Vite pipeline resolves both halves. Omit it and Bun does,
+     * which is correct for the Bun pipeline. Either way one toolchain owns the phase.
+     */
+    readonly load?: (absolutePath: string) => Promise<unknown>;
 }
 /** Scan a `routes/` directory (recursively) and build the route manifest. */
 export declare function discoverRoutes(dir: string, options?: DiscoverRoutesOptions): Manifest;

package/dist/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiB,KAAK,QAAQ,EAAoB,MAAM,eAAe,CAAA;AAE9E,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;uFACmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,QAAQ,CASzF"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiB,KAAK,QAAQ,EAAoB,MAAM,eAAe,CAAA;AAE9E,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;sEAEkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3D;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,QAAQ,CAczF"}

package/dist/fs.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 /**
- * @nifrajs/web/fs — filesystem route discovery. Separated from the main entry so `app.fetch`
+ * @nifrajs/web/fs - filesystem route discovery. Separated from the main entry so `app.fetch`
  * (and the rest of @nifrajs/web) stays fs-free + edge-portable: this runs at build/startup
  * only. It scans a routes dir and feeds the pure `buildManifest`.
  */
@@ -19,6 +19,12 @@ export function discoverRoutes(dir, options = {}) {
         .map((file) => file.replaceAll("\\", "/")) // normalize Windows separators
         .filter((file) => /\.(tsx|jsx|svelte|vue|mdx)$/.test(file));
     const query = options.importQuery ? `?${options.importQuery}` : "";
-    return buildManifest(files, (file) => () => import(__rewriteRelativeImportExtension(`${dir}/${file}${query}`)));
+    const load = options.load;
+    return buildManifest(files, (file) => load === undefined
+        ? () => import(__rewriteRelativeImportExtension(`${dir}/${file}${query}`))
+        : // No `importQuery` here: an injected loader owns its own invalidation (Vite's module graph
+            // re-evaluates on change), and appending a cache-buster would defeat it by minting a new
+            // module id per request.
+            () => load(`${dir}/${file}`));
 }
 //# sourceMappingURL=fs.js.map

package/dist/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,aAAa,EAAmC,MAAM,eAAe,CAAA;AAS9E,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,UAAiC,EAAE;IAC7E,MAAM,KAAK,GAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,+BAA+B;SACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,OAAO,aAAa,CAClB,KAAK,EACL,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,kCAAC,GAAG,GAAG,IAAI,IAAI,GAAG,KAAK,EAAE,EAAyB,CACzE,CAAA;AACH,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,aAAa,EAAmC,MAAM,eAAe,CAAA;AAsB9E,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,UAAiC,EAAE;IAC7E,MAAM,KAAK,GAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,+BAA+B;SACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACnC,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,kCAAC,GAAG,GAAG,IAAI,IAAI,GAAG,KAAK,EAAE,EAAyB;QAChE,CAAC,CAAC,2FAA2F;YAC3F,yFAAyF;YACzF,yBAAyB;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAyB,CACzD,CAAA;AACH,CAAC"}