@nifrajs/web 3.3.0 → 4.0.0

package/dist/zones.js

@@ -0,0 +1,365 @@
+/**
+ * `@nifrajs/web/zones` - which side of the app a source file belongs to.
+ *
+ * One classifier, used by both client builds, both dev servers and `nifra check`, so they cannot
+ * disagree about what may reach a browser. It classifies a RESOLVED file by its real path: the
+ * bundler has already applied tsconfig `paths`, aliases and package `exports`, and a workspace
+ * package linked through `node_modules` resolves to a path outside any `node_modules` directory, so
+ * it is first-party and must say which side it is on.
+ *
+ * Default-deny: a first-party file that no rule places is an error, never "probably fine".
+ */
+import { closeSync, existsSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { SERVER_FN_MODULE } from "./internal/server-boundary.js";
+const PACKAGE_ENVIRONMENTS = new Set([
+    "frontend",
+    "backend",
+    "shared",
+    "library",
+]);
+/** Zones whose code may ship to a browser. `fn` is listed because its stub is what ships. */
+export const BROWSER_ZONES = new Set([
+    "route-frontend",
+    "frontend",
+    "shared",
+    "fn",
+    "generated",
+    "library",
+]);
+const SERVER_ZONES = new Set(["route-backend", "backend", "fn"]);
+const FRONTEND_ZONES = new Set(["route-frontend", "frontend"]);
+/**
+ * Third-party packages that never belong in a browser bundle: database drivers, ORMs' server
+ * entries, mailers and server SDKs. A package reaching a `node:` builtin is caught separately; this
+ * list covers the ones that bundle "fine" and leak credentials or query code instead.
+ */
+export const SERVER_PACKAGES = [
+    "@libsql/client",
+    "@neondatabase/serverless",
+    "@planetscale/database",
+    "@prisma/client",
+    "@sendgrid/mail",
+    "@vercel/postgres",
+    "argon2",
+    "bcrypt",
+    "bcryptjs",
+    "better-sqlite3",
+    "drizzle-kit",
+    "firebase-admin",
+    "ioredis",
+    "jsonwebtoken",
+    "knex",
+    "mongodb",
+    "mongoose",
+    "mysql",
+    "mysql2",
+    "nodemailer",
+    "pg",
+    "pg-pool",
+    "postgres",
+    "prisma",
+    "redis",
+    "resend",
+    "sequelize",
+    "server-only",
+    "sqlite3",
+    "stripe",
+    "twilio",
+    "typeorm",
+];
+/** `drizzle-orm` is a browser-safe query builder until one of its driver entries is imported. */
+const SERVER_SUBPATHS = /^drizzle-orm\/(?:node-postgres|postgres-js|mysql2|better-sqlite3|libsql|bun-sqlite|neon-serverless|neon-http|vercel-postgres|planetscale-serverless|d1|pglite)(?:\/|$)/;
+/** The nifra marker a module imports to refuse the browser outright. */
+export const BACKEND_ONLY_MARKER = "@nifrajs/web/backend-only";
+const SOURCE = "(?:[cm]?[jt]sx?|svelte|vue|mdx)";
+/** A route's backend half: `x.backend.ts`. Script extensions only; JSX belongs to the frontend half. */
+export const ROUTE_BACKEND_FILE = /\.backend\.(?:[cm]?[jt]s)$/;
+const ZONE_SUFFIX = new RegExp(`\\.(frontend|backend|shared|fn)\\.${SOURCE}$`);
+const LEGACY_SERVER_SUFFIX = new RegExp(`\\.server\\.${SOURCE}$`);
+const ZONE_FOLDERS = {
+    frontend: "frontend",
+    backend: "backend",
+    shared: "shared",
+    public: "frontend",
+};
+const toPosix = (path) => path.replaceAll("\\", "/");
+// `generateServerManifest`'s first line. The manifest composes both halves of every route, so it
+// imports frontend code from wherever the build wrote it - next to the server entry, often backend/.
+const GENERATED_SERVER_MANIFEST = "// GENERATED by @nifrajs/web generateServerManifest";
+const SERVER_MANIFEST_FILE = /^server-manifest\.[cm]?[jt]s$/;
+function isGeneratedServerManifest(file) {
+    let fd;
+    try {
+        fd = openSync(file, "r");
+        const head = Buffer.alloc(GENERATED_SERVER_MANIFEST.length);
+        const read = readSync(fd, head, 0, head.length, 0);
+        return head.toString("utf8", 0, read) === GENERATED_SERVER_MANIFEST;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/** The real path of a file, or the normalized input when it does not exist on disk. */
+function realFile(path) {
+    try {
+        return toPosix(realpathSync.native(path));
+    }
+    catch {
+        // A path that does not exist yet keeps its directory's real spelling, so it still compares with
+        // the paths around it: a Windows short name or a symlinked temp dir spells one directory two ways.
+        const parent = dirname(path);
+        if (parent === path)
+            return toPosix(path);
+        const real = realFile(parent);
+        return `${real.endsWith("/") ? real : `${real}/`}${basename(path)}`;
+    }
+}
+const isInside = (child, parent) => child === parent || child.startsWith(parent.endsWith("/") ? parent : `${parent}/`);
+/** `@scope/name` or `name` from the LAST `node_modules/` segment of a path. */
+function nodeModulesPackage(path) {
+    const at = path.lastIndexOf("/node_modules/");
+    if (at === -1)
+        return undefined;
+    const parts = path.slice(at + "/node_modules/".length).split("/");
+    const first = parts[0];
+    if (first === undefined || first === "")
+        return undefined;
+    return first.startsWith("@") && parts[1] !== undefined ? `${first}/${parts[1]}` : first;
+}
+/**
+ * Create a classifier for one app. Cheap to create; it caches per file and per package directory,
+ * so build plugins and dev servers keep one for the life of a build or a session.
+ */
+export function createZoneClassifier(options) {
+    const appRoot = realFile(resolve(options.appRoot));
+    const routesDir = realFile(resolve(options.routesDir ?? join(options.appRoot, "routes")));
+    const generated = new Set((options.generatedFiles ?? []).map((file) => realFile(resolve(file))));
+    const cache = new Map();
+    const packages = new Map();
+    /** The nearest `package.json` at or above `dir`, cached by directory. */
+    const packageFor = (dir) => {
+        const seen = [];
+        let current = dir;
+        for (;;) {
+            const cached = packages.get(current);
+            if (cached !== undefined) {
+                for (const visited of seen)
+                    packages.set(visited, cached);
+                return cached ?? undefined;
+            }
+            seen.push(current);
+            const manifest = join(current, "package.json");
+            if (existsSync(manifest)) {
+                let parsed = {};
+                try {
+                    parsed = JSON.parse(readFileSync(manifest, "utf8"));
+                }
+                catch {
+                    // An unreadable manifest declares nothing; the caller reports the missing declaration.
+                }
+                const info = {
+                    dir: current,
+                    name: typeof parsed.name === "string" ? parsed.name : undefined,
+                    environment: typeof parsed.nifra?.environment === "string" ? parsed.nifra.environment : undefined,
+                };
+                for (const visited of seen)
+                    packages.set(visited, info);
+                return info;
+            }
+            const parent = toPosix(dirname(current));
+            if (parent === current) {
+                for (const visited of seen)
+                    packages.set(visited, null);
+                return undefined;
+            }
+            current = parent;
+        }
+    };
+    const classifyUncached = (file) => {
+        if (generated.has(file))
+            return { zone: "generated" };
+        const thirdParty = nodeModulesPackage(file);
+        if (thirdParty !== undefined) {
+            const info = packageFor(toPosix(dirname(file)));
+            const declared = info?.environment !== undefined && PACKAGE_ENVIRONMENTS.has(info.environment)
+                ? info.environment
+                : undefined;
+            return {
+                zone: "library",
+                packageName: thirdParty,
+                modulePath: file.slice(file.lastIndexOf("/node_modules/") + "/node_modules/".length),
+                ...(declared ? { declared } : {}),
+            };
+        }
+        const base = file.slice(file.lastIndexOf("/") + 1);
+        if (isInside(file, appRoot)) {
+            if (SERVER_MANIFEST_FILE.test(base) && isGeneratedServerManifest(file)) {
+                return { zone: "generated" };
+            }
+            if (LEGACY_SERVER_SUFFIX.test(base)) {
+                return {
+                    zone: "error",
+                    reason: `"${relativeTo(appRoot, file)}" uses the retired ".server" suffix. Rename it to ".backend" (or move it under backend/); nifra no longer empties .server modules in the browser build`,
+                };
+            }
+            const rel = relativeTo(appRoot, file);
+            const top = rel.split("/")[0] ?? "";
+            if (top.startsWith(".nifra"))
+                return { zone: "generated" };
+            const suffix = ZONE_SUFFIX.exec(base)?.[1];
+            // Only a script module is replaced by the calls a browser makes; any other ".fn" file would
+            // ship to the browser exactly as written.
+            if (suffix === "fn" && !SERVER_FN_MODULE.test(base)) {
+                return {
+                    zone: "error",
+                    reason: `"${rel}" is named as a server function, but only a script module (.ts, .js) can be one - the browser build would ship this file as it is. Rename it`,
+                };
+            }
+            if (isInside(file, routesDir)) {
+                if (ROUTE_BACKEND_FILE.test(base))
+                    return { zone: "route-backend" };
+                if (suffix === "fn")
+                    return { zone: "fn" };
+                if (suffix === "backend")
+                    return { zone: "route-backend" };
+                if (suffix === "shared")
+                    return { zone: "shared" };
+                return { zone: "route-frontend" };
+            }
+            const folder = ZONE_FOLDERS[top];
+            if (folder !== undefined) {
+                if (suffix === undefined || suffix === folder)
+                    return { zone: folder };
+                if (suffix === "fn" && folder === "backend")
+                    return { zone: "fn" };
+                return {
+                    zone: "error",
+                    reason: `"${rel}" sits in ${top}/ but its ".${suffix}" suffix says otherwise. A file belongs to one side: move it, or drop the suffix`,
+                };
+            }
+            if (suffix !== undefined)
+                return { zone: suffix === "fn" ? "fn" : suffix };
+            return { zone: "error", reason: unzonedReason(rel) };
+        }
+        // First-party code outside the app: a workspace package, or a relative import out of the app.
+        const info = packageFor(toPosix(dirname(file)));
+        const environment = info?.environment;
+        if (environment !== undefined && PACKAGE_ENVIRONMENTS.has(environment)) {
+            return environment === "library"
+                ? {
+                    zone: "library",
+                    ...(info?.name ? { packageName: info.name } : {}),
+                    declared: "library",
+                }
+                : { zone: environment };
+        }
+        const where = info?.name ?? info?.dir ?? dirname(file);
+        return {
+            zone: "error",
+            reason: `"${file}" is first-party code outside the app (${where}) and declares no side. Add "nifra": { "environment": "frontend" | "backend" | "shared" | "library" } to ${info === undefined ? "its package.json" : `${info.dir}/package.json`}`,
+        };
+    };
+    return {
+        appRoot,
+        classify(input) {
+            const absolute = isAbsolute(input) ? input : resolve(appRoot, input);
+            const file = realFile(absolute);
+            const cached = cache.get(file);
+            if (cached !== undefined)
+                return cached;
+            const result = classifyUncached(file);
+            cache.set(file, result);
+            return result;
+        },
+    };
+}
+function relativeTo(root, file) {
+    return toPosix(relative(root, file)).split(sep).join("/");
+}
+const RETIRED_ROOT_FILES = {
+    "backend.ts": "backend/app.ts",
+    "framework.ts": "backend/framework.ts",
+};
+function unzonedReason(rel) {
+    const moved = RETIRED_ROOT_FILES[rel];
+    if (moved !== undefined) {
+        return `"${rel}" moved: it lives at ${moved} now (run \`nifra migrate layout\`)`;
+    }
+    return `"${rel}" is in no zone. Every file a build loads lives under routes/, frontend/, backend/ or shared/, or carries a .frontend/.backend/.shared suffix`;
+}
+/** The package name a bare specifier names, or `undefined` for a relative path, a builtin, a
+ * subpath import (`#x`) or a bundler-virtual id. */
+export function specifierPackage(specifier) {
+    if (/^(?:\.|\/|#|\0|[a-z]+:)/i.test(specifier))
+        return undefined;
+    if (specifier.startsWith("@") && !/^@[^/]+\/[^/]/.test(specifier))
+        return undefined;
+    const parts = specifier.split("/");
+    return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+/**
+ * Why a classified file may not ship to a browser, or `undefined` when it may. A `drizzle-orm` driver
+ * entry is recognized by the import as written (`specifier`) or by the file's path in the package.
+ */
+export function browserDenial(classification, specifier) {
+    if (classification.zone === "error")
+        return classification.reason;
+    if (!BROWSER_ZONES.has(classification.zone)) {
+        return classification.zone === "route-backend"
+            ? "it is a route's backend half, which runs on the server only"
+            : "it is backend code";
+    }
+    if (classification.zone !== "library")
+        return undefined;
+    const name = classification.packageName;
+    if (classification.declared === "backend")
+        return `package "${name}" declares itself backend-only`;
+    if (name !== undefined && SERVER_PACKAGES.includes(name)) {
+        return `package "${name}" is server code (a driver, server SDK or credential helper)`;
+    }
+    if (specifier !== undefined && SERVER_SUBPATHS.test(specifier)) {
+        return `"${specifier}" is a database driver entry`;
+    }
+    const driver = classification.modulePath?.match(SERVER_SUBPATHS)?.[0];
+    if (driver !== undefined)
+        return `"${driver.replace(/\/$/, "")}" is a database driver entry`;
+    return undefined;
+}
+/** Whether a module in `from` may import (with a value import) a module in `to`. */
+export function importAllowed(from, to) {
+    if (from === "generated" || from === "library")
+        return true;
+    if (to === "generated" || to === "library")
+        return true;
+    if (FRONTEND_ZONES.has(from))
+        return FRONTEND_ZONES.has(to) || to === "shared" || to === "fn";
+    if (SERVER_ZONES.has(from))
+        return !FRONTEND_ZONES.has(to);
+    // shared
+    return to === "shared";
+}
+/** The message for an import {@link importAllowed} refuses. */
+export function importRuleMessage(fromFile, from, toFile, to) {
+    const side = (zone) => zone === "route-frontend"
+        ? "a route's frontend half"
+        : zone === "route-backend"
+            ? "a route's backend half"
+            : zone === "fn"
+                ? "a server-function module"
+                : `${zone} code`;
+    const hint = from === "shared"
+        ? "shared code runs on both sides, so it may import only shared code and third-party packages"
+        : SERVER_ZONES.has(from)
+            ? "backend code may not import frontend code; move what both need into shared/"
+            : "frontend code may not import backend code; reach it through a loader, an action or a *.fn.ts server function";
+    return `${fromFile} (${side(from)}) imports ${toFile} (${side(to)}): ${hint}. A type-only import (\`import type\`) is allowed`;
+}
+export { isSensitiveFieldName } from "./internal/output-guard.js";
+export { privateEnvReads, privateEnvReason } from "./internal/private-env.js";
+export { publicScanFiles, scanForSecrets, } from "./internal/secret-scan.js";
+//# sourceMappingURL=zones.js.map

package/dist/zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zones.js","sourceRoot":"","sources":["../src/zones.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AA8BhE,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAA;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,aAAa,GAAsB,IAAI,GAAG,CAAC;IACtD,gBAAgB;IAChB,UAAU;IACV,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,SAAS;CACV,CAAC,CAAA;AAEF,MAAM,YAAY,GAAsB,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;AACnF,MAAM,cAAc,GAAsB,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAA;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,MAAM;IACN,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,WAAW;IACX,aAAa;IACb,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,SAAS;CACV,CAAA;AAED,iGAAiG;AACjG,MAAM,eAAe,GACnB,wKAAwK,CAAA;AAE1K,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,MAAM,GAAG,iCAAiC,CAAA;AAChD,wGAAwG;AACxG,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAA;AAC9D,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAA;AAC9E,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,eAAe,MAAM,GAAG,CAAC,CAAA;AAEjE,MAAM,YAAY,GAAmC;IACnD,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,UAAU;CACnB,CAAA;AAiBD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AAEpE,iGAAiG;AACjG,qGAAqG;AACrG,MAAM,yBAAyB,GAAG,qDAAqD,CAAA;AACvF,MAAM,oBAAoB,GAAG,+BAA+B,CAAA;AAE5D,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,yBAAyB,CAAA;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,mGAAmG;QACnG,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA;IACrE,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,MAAc,EAAW,EAAE,CAC1D,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;AAEpF,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACzD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AACzF,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChG,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,yEAAyE;IACzE,MAAM,UAAU,GAAG,CAAC,GAAW,EAA2B,EAAE;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,IAAI,OAAO,GAAG,GAAG,CAAA;QACjB,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACzD,OAAO,MAAM,IAAI,SAAS,CAAA;YAC5B,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,IAAI,MAAM,GAA0D,EAAE,CAAA;gBACtE,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAkB,CAAA;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,uFAAuF;gBACzF,CAAC;gBACD,MAAM,IAAI,GAAgB;oBACxB,GAAG,EAAE,OAAO;oBACZ,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC/D,WAAW,EACT,OAAO,MAAM,CAAC,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBACvF,CAAA;gBACD,KAAK,MAAM,OAAO,IAAI,IAAI;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBACvD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YACxC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,KAAK,MAAM,OAAO,IAAI,IAAI;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBACvD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAkB,EAAE;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC/C,MAAM,QAAQ,GACZ,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC3E,CAAC,CAAE,IAAI,CAAC,WAAkC;gBAC1C,CAAC,CAAC,SAAS,CAAA;YACf,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBACpF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YAC9B,CAAC;YACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,wJAAwJ;iBAC9L,CAAA;YACH,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACnC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAK5B,CAAA;YACb,4FAA4F;YAC5F,0CAA0C;YAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,GAAG,8IAA8I;iBAC9J,CAAA;YACH,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC9B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;gBACnE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBAC1C,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;gBAC1D,IAAI,MAAM,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;gBAClD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;YACnC,CAAC;YACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;gBACtE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBAClE,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,GAAG,aAAa,GAAG,eAAe,MAAM,kFAAkF;iBACvI,CAAA;YACH,CAAC;YACD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;YAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAA;QACtD,CAAC;QACD,8FAA8F;QAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,CAAA;QACrC,IAAI,WAAW,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvE,OAAO,WAAW,KAAK,SAAS;gBAC9B,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,QAAQ,EAAE,SAAS;iBACpB;gBACH,CAAC,CAAC,EAAE,IAAI,EAAE,WAAmB,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;QACtD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI,IAAI,0CAA0C,KAAK,4GAA4G,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE;SAClP,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,OAAO;QACP,QAAQ,CAAC,KAAa;YACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;YACrC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACvB,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,kBAAkB,GAAqC;IAC3D,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,sBAAsB;CACvC,CAAA;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,GAAG,wBAAwB,KAAK,qCAAqC,CAAA;IAClF,CAAC;IACD,OAAO,IAAI,GAAG,+IAA+I,CAAA;AAC/J,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAChE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACnF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,cAA8B,EAC9B,SAAkB;IAElB,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,MAAM,CAAA;IACjE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,cAAc,CAAC,IAAI,KAAK,eAAe;YAC5C,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,oBAAoB,CAAA;IAC1B,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAA;IACvC,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,YAAY,IAAI,gCAAgC,CAAA;IAClG,IAAI,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,YAAY,IAAI,8DAA8D,CAAA;IACvF,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,SAAS,8BAA8B,CAAA;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACrE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAA;IAC5F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,EAAQ;IAChD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAA;IAC7F,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC1D,SAAS;IACT,OAAO,EAAE,KAAK,QAAQ,CAAA;AACxB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAU,EAAE,MAAc,EAAE,EAAQ;IACtF,MAAM,IAAI,GAAG,CAAC,IAAU,EAAU,EAAE,CAClC,IAAI,KAAK,gBAAgB;QACvB,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,IAAI,KAAK,eAAe;YACxB,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;gBACb,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,GAAG,IAAI,OAAO,CAAA;IACxB,MAAM,IAAI,GACR,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,4FAA4F;QAC9F,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,6EAA6E;YAC/E,CAAC,CAAC,8GAA8G,CAAA;IACtH,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,mDAAmD,CAAA;AAChI,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EACL,eAAe,EAMf,cAAc,GACf,MAAM,2BAA2B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/web",
-  "version": "3.3.0",
+  "version": "4.0.0",
   "description": "Framework-agnostic SSR core for nifra - the render seam + HTML document orchestration.",
   "keywords": [
     "bun",
@@ -20,6 +20,9 @@
     "streaming-ssr"
   ],
   "type": "module",
+  "nifra": {
+    "environment": "library"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -39,11 +42,31 @@
       "types": "./dist/client.d.ts",
       "default": "./dist/client.js"
     },
+    "./vitals": {
+      "bun": "./src/vitals.ts",
+      "types": "./dist/vitals.d.ts",
+      "default": "./dist/vitals.js"
+    },
     "./diagnostic": {
       "bun": "./src/diagnostic.ts",
       "types": "./dist/diagnostic.d.ts",
       "default": "./dist/diagnostic.js"
     },
+    "./cdn": {
+      "bun": "./src/cdn.ts",
+      "types": "./dist/cdn.d.ts",
+      "default": "./dist/cdn.js"
+    },
+    "./diagnostic-prompt": {
+      "bun": "./src/diagnostic-prompt.ts",
+      "types": "./dist/diagnostic-prompt.d.ts",
+      "default": "./dist/diagnostic-prompt.js"
+    },
+    "./dev-feed": {
+      "bun": "./src/dev-feed.ts",
+      "types": "./dist/dev-feed.d.ts",
+      "default": "./dist/dev-feed.js"
+    },
     "./forms": {
       "bun": "./src/forms.ts",
       "types": "./dist/forms.d.ts",
@@ -69,10 +92,25 @@
       "types": "./dist/service-worker.d.ts",
       "default": "./dist/service-worker.js"
     },
-    "./server-only": {
-      "bun": "./src/server-only.ts",
-      "types": "./dist/server-only.d.ts",
-      "default": "./dist/server-only.js"
+    "./pwa-manifest": {
+      "bun": "./src/pwa-manifest.ts",
+      "types": "./dist/pwa-manifest.d.ts",
+      "default": "./dist/pwa-manifest.js"
+    },
+    "./zones": {
+      "bun": "./src/zones.ts",
+      "types": "./dist/zones.d.ts",
+      "default": "./dist/zones.js"
+    },
+    "./route-types": {
+      "bun": "./src/route-types.ts",
+      "types": "./dist/route-types.d.ts",
+      "default": "./dist/route-types.js"
+    },
+    "./backend-only": {
+      "bun": "./src/backend-only.ts",
+      "types": "./dist/backend-only.d.ts",
+      "default": "./dist/backend-only.js"
     },
     "./build": {
       "bun": "./src/build.ts",
@@ -155,16 +193,16 @@
       "types": "./dist/plugins/vite-server-fn.d.ts",
       "default": "./dist/plugins/vite-server-fn.js"
     },
-    "./plugins/vite-server-only": {
-      "bun": "./src/plugins/vite-server-only.ts",
-      "types": "./dist/plugins/vite-server-only.d.ts",
-      "default": "./dist/plugins/vite-server-only.js"
-    },
     "./fn-state": {
       "bun": "./src/fn-state.ts",
       "types": "./dist/fn-state.d.ts",
       "default": "./dist/fn-state.js"
     },
+    "./internal/dev-reserved": {
+      "bun": "./src/internal/dev-reserved.ts",
+      "types": "./dist/internal/dev-reserved.d.ts",
+      "default": "./dist/internal/dev-reserved.js"
+    },
     "./internal/parity": {
       "bun": "./src/internal/parity.ts",
       "types": "./dist/internal/parity.d.ts",
@@ -179,6 +217,16 @@
       "bun": "./src/internal/fetcher-runtime.ts",
       "types": "./dist/internal/fetcher-runtime.d.ts",
       "default": "./dist/internal/fetcher-runtime.js"
+    },
+    "./internal/loading-runtime": {
+      "bun": "./src/internal/loading-runtime.ts",
+      "types": "./dist/internal/loading-runtime.d.ts",
+      "default": "./dist/internal/loading-runtime.js"
+    },
+    "./internal/matches-runtime": {
+      "bun": "./src/internal/matches-runtime.ts",
+      "types": "./dist/internal/matches-runtime.d.ts",
+      "default": "./dist/internal/matches-runtime.js"
     }
   },
   "files": [
@@ -196,8 +244,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/core": "3.3.0",
-    "@nifrajs/island-trigger": "3.3.0"
+    "@nifrajs/core": "4.0.0",
+    "@nifrajs/island-trigger": "4.0.0"
   },
   "peerDependencies": {
     "@babel/core": "^7.26.0",
@@ -206,7 +254,8 @@
     "@babel/plugin-syntax-typescript": "^7.25.9",
     "@stylexjs/babel-plugin": "^0.19.0",
     "sass": "^1.0.0",
-    "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+    "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0",
+    "web-vitals": "^6.0.0"
   },
   "peerDependenciesMeta": {
     "@babel/core": {
@@ -229,6 +278,9 @@
     },
     "vite": {
       "optional": true
+    },
+    "web-vitals": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -243,7 +295,8 @@
     "@stylexjs/babel-plugin": "^0.19.0",
     "@stylexjs/stylex": "^0.19.0",
     "sass": "^1.77.0",
-    "vite": "^8.2.1"
+    "vite": "^8.2.1",
+    "web-vitals": "^6.2.2"
   },
   "repository": {
     "type": "git",

package/src/backend-only.ts

@@ -0,0 +1,16 @@
+/**
+ * `@nifrajs/web/backend-only` - the poison-import marker (Next's `import "server-only"`). A module that
+ * must never reach a browser can say so with a side-effect import at its top:
+ *
+ *     import "@nifrajs/web/backend-only"
+ *
+ * Every browser build and dev server refuses a module graph that reaches this specifier, naming the
+ * import chain. The zone rules already keep `backend/` and `*.backend.ts` out of the browser; the
+ * marker is for a module that must stay server-side wherever it is imported from, such as one inside
+ * a shared workspace package. On the server it is an empty module, so the marked file runs untouched.
+ *
+ * Pair it with the type-level {@link BackendOnly} brand (from `@nifrajs/web`) on the module's exports.
+ */
+
+// Intentionally empty: the marker is the import itself.
+export {}

package/src/boundary.ts

@@ -18,6 +18,8 @@ export interface BoundaryRequestCtx {
 /** Build-safe inputs available to a static boundary. It intentionally has no request/session/params API. */
 export interface StaticCtx {
   readonly phase: "build"
+  /** The deployment's origin, when the caller resolving static boundaries knows it. A request never
+   * supplies it: the value is cached for every visitor, and a Host header is the client's to choose. */
   readonly origin?: string
 }
 
@@ -127,17 +129,23 @@ export interface DynamicBoundaryBatch {
 export interface StaticBoundaryCache {
   get(boundary: BoundaryRegistration): Promise<unknown> | undefined
   set(boundary: BoundaryRegistration, value: Promise<unknown>): void
+  /** Drop a value whose load failed, so the next request retries it. */
+  delete?(boundary: BoundaryRegistration): void
 }
 
 export class MemoryStaticBoundaryCache implements StaticBoundaryCache {
-  readonly #values = new WeakMap<object, Promise<unknown>>()
+  readonly #values = new WeakMap<BoundaryRegistration, Promise<unknown>>()
 
   get(boundary: BoundaryRegistration): Promise<unknown> | undefined {
-    return this.#values.get(boundary as object)
+    return this.#values.get(boundary)
   }
 
   set(boundary: BoundaryRegistration, value: Promise<unknown>): void {
-    this.#values.set(boundary as object, value)
+    this.#values.set(boundary, value)
+  }
+
+  delete(boundary: BoundaryRegistration): void {
+    this.#values.delete(boundary)
   }
 }
 
@@ -373,8 +381,13 @@ export async function resolveStaticBoundaries(
       }
       let value = cache.get(boundary)
       if (value === undefined) {
-        value = Promise.resolve().then(() => boundary.load?.(context))
-        cache.set(boundary, value)
+        const loading = Promise.resolve().then(() => boundary.load?.(context))
+        cache.set(boundary, loading)
+        // A failed load is not the boundary's value: the next request loads it again.
+        loading.catch(() => {
+          if (cache.get(boundary) === loading) cache.delete?.(boundary)
+        })
+        value = loading
       }
       try {
         const data = await value