@nifrajs/web 3.3.0 → 4.0.0

package/dist/csp.js

@@ -0,0 +1,122 @@
+import { PRE_HYDRATION_GUARD } from "./internal/runtime-contract.js";
+import { createNonceResolver } from "./nonce.js";
+const CSP_POLICY = Symbol.for("nifra.web.cspPolicy");
+/** How a `createWebApp` app's documents meet a CSP: `"nonce"` (every document carries one, so none is
+ * cacheable) or `"hash"` (a {@link CspPolicy}). Read by wrappers that cache documents. */
+export const DOCUMENT_POLICY = Symbol.for("nifra.web.documentPolicy");
+/**
+ * Create a hash-based Content-Security-Policy for nifra documents, so a page can carry a strict CSP
+ * and still be cached.
+ *
+ * A per-request nonce makes every document unique: nifra marks a nonce-bearing document
+ * `private, no-store`, so no shared cache (ISR, a CDN) may store it. Under this policy a document
+ * gets a nonce only when it carries a script specific to this request: a page that `defer()`s streams
+ * one per settled value, and `unsafeInlineScript` names the nonce. Every other document is nonce-free.
+ * Its inline scripts are the constant ones nifra writes, listed by hash, so the CSP header is the
+ * same on every request and the page stays cacheable. Page data rides in an inert JSON script, which
+ * a CSP does not govern.
+ *
+ * ```ts
+ * const csp = createCspPolicy({
+ *   header: ({ sources }) => `default-src 'self'; script-src 'self' ${sources}; object-src 'none'`,
+ * })
+ * const app = createWebApp({ adapter, manifest, clientEntry, csp })
+ * ```
+ */
+export function createCspPolicy(options) {
+    if (typeof options?.header !== "function") {
+        throw new TypeError("[nifra/web] createCspPolicy requires a header function");
+    }
+    return {
+        [CSP_POLICY]: {
+            header: options.header,
+            // A UUID's hyphens are outside the CSP base64-value grammar; the remaining 122 random bits are
+            // plenty for a per-response nonce, on every fetch runtime.
+            generate: options.generate ?? (() => crypto.randomUUID().replaceAll("-", "")),
+            adapters: new WeakMap(),
+        },
+    };
+}
+/** True for a value made by {@link createCspPolicy}. */
+export const isCspPolicy = (value) => typeof value === "object" && value !== null && CSP_POLICY in value;
+// A closing tag ends at any space, slash or `>` after its name, as a browser reads it.
+const INLINE_SCRIPT = /<script\b([^>]*)>([\s\S]*?)<\/script(?=[\s/>])[^>]*>/gi;
+/** The bodies of the executable inline scripts in a fragment of markup (no `src`, no inert type). */
+const inlineScriptBodies = (html) => {
+    const bodies = [];
+    for (const match of html.matchAll(INLINE_SCRIPT)) {
+        const attrs = match[1] ?? "";
+        if (/\bsrc\s*=/i.test(attrs) || /\btype\s*=\s*["']?application\/(ld\+)?json/i.test(attrs))
+            continue;
+        bodies.push(match[2] ?? "");
+    }
+    return bodies;
+};
+const ENCODER = new TextEncoder();
+/** A CSP hash source for one inline script body: `'sha256-<base64 of the UTF-8 bytes>'`. */
+async function hashSource(body) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", ENCODER.encode(body)));
+    let binary = "";
+    for (const byte of digest)
+        binary += String.fromCharCode(byte);
+    return `'sha256-${btoa(binary)}'`;
+}
+/**
+ * The `'sha256-…'` sources for the constant inline scripts nifra writes into a document rendered
+ * with `adapter`: the pre-hydration form guard and the adapter's hydration head. For a CSP set outside
+ * the app (a proxy, a CDN rule); {@link createCspPolicy} computes the same list itself.
+ */
+export async function nifraScriptHashes(adapter) {
+    const bodies = [PRE_HYDRATION_GUARD, ...inlineScriptBodies(adapter.hydrationHead())];
+    return Promise.all([...new Set(bodies)].map(hashSource));
+}
+/**
+ * Compute (once per adapter) the policy's hash sources. Returns `undefined` once they are ready, so
+ * the renderer stays synchronous after the first document.
+ */
+export function prepareCspPolicy(policy, adapter) {
+    const state = policy[CSP_POLICY];
+    const known = state.adapters.get(adapter);
+    if (known !== undefined)
+        return known instanceof Promise ? known.then(() => undefined) : undefined;
+    const head = adapter.hydrationHead();
+    const pending = nifraScriptHashes(adapter).then((hashes) => {
+        const sources = { head, sources: hashes.join(" ") };
+        state.adapters.set(adapter, sources);
+        return sources;
+    });
+    state.adapters.set(adapter, pending);
+    // A failed digest must not pin a rejected promise: the next document retries.
+    pending.catch(() => state.adapters.delete(adapter));
+    return pending.then(() => undefined);
+}
+const preparedSources = (policy, adapter) => {
+    const known = policy[CSP_POLICY].adapters.get(adapter);
+    if (known === undefined || known instanceof Promise) {
+        throw new Error("[nifra/web] CSP policy used before prepareCspPolicy resolved");
+    }
+    return known;
+};
+/**
+ * The nonce one document carries under `policy`: `undefined` unless the document needs one -
+ * `needsNonce` (a deferred value or a head tag naming the nonce), or an adapter whose hydration head
+ * no longer matches the one the policy hashed. A needed nonce reuses the caller's, else is generated.
+ */
+export function cspDocumentNonce(policy, adapter, hydrate, needsNonce, requested) {
+    const varies = hydrate && adapter.hydrationHead() !== preparedSources(policy, adapter).head;
+    if (!needsNonce && !varies)
+        return undefined;
+    return requested ?? policy[CSP_POLICY].generate();
+}
+/** The Content-Security-Policy value for one document, or `undefined` when the policy sends none. */
+export function cspHeaderValue(policy, adapter, nonce) {
+    const { sources } = preparedSources(policy, adapter);
+    const state = policy[CSP_POLICY];
+    return nonce === undefined
+        ? state.header({ sources })
+        : state.header({ sources: `${sources} 'nonce-${nonce}'`, nonce });
+}
+/** The per-request nonce source for a page executor under `policy`: generated eagerly so `meta` can
+ * name it in `unsafeInlineScript`, and dropped by the renderer from documents that do not need it. */
+export const cspNonceResolver = (policy) => createNonceResolver({ generate: () => policy[CSP_POLICY].generate() });
+//# sourceMappingURL=csp.js.map

package/dist/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAsB,MAAM,YAAY,CAAA;AA6BpE,MAAM,UAAU,GAAkB,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;AAEnE;0FAC0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAkB,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;AAsBpF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO;QACL,CAAC,UAAU,CAAC,EAAE;YACZ,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,+FAA+F;YAC/F,2DAA2D;YAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7E,QAAQ,EAAE,IAAI,OAAO,EAAE;SACxB;KACF,CAAA;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAsB,EAAE,CAChE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,IAAI,KAAK,CAAA;AAEpE,uFAAuF;AACvF,MAAM,aAAa,GAAG,wDAAwD,CAAA;AAE9E,qGAAqG;AACrG,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAY,EAAE;IACpD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC;YACvF,SAAQ;QACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1F,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9D,OAAO,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAsB;IAC5D,MAAM,MAAM,GAAG,CAAC,mBAAmB,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IACpF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,OAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAA;IACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACnD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpC,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACpC,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,OAAsB,EAAkB,EAAE;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,OAAsB,EACtB,OAAgB,EAChB,UAAmB,EACnB,SAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,CAAC,aAAa,EAAE,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAA;IAC3F,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC5C,OAAO,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;AACnD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,OAAsB,EACtB,KAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IAChC,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,WAAW,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;AACrE,CAAC;AAED;sGACsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAiB,EAAiB,EAAE,CACnE,mBAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA"}

package/dist/css-contract.d.ts

@@ -0,0 +1,21 @@
+/**
+ * How framework-owned stylesheets are made active during the first document load.
+ *
+ * `blocking` is the backwards-compatible default. `deferred` is intended for an aggregate
+ * stylesheet: the document fetches it with `media="print"`, then the generated client promotes it
+ * to `media="all"` after the resource settles and before mounting the app.
+ */
+export type CssLoadingMode = "blocking" | "deferred";
+/** The default remains the ordinary render-blocking stylesheet link. */
+export declare const DEFAULT_CSS_LOADING: CssLoadingMode;
+/** Runtime validation for the Vite CSS output switch. `undefined` means Vite's default (`true`). */
+export declare function normalizeCssCodeSplit(value: unknown): boolean;
+/** Runtime validation for JavaScript callers, generated manifests, and hand-authored integrations. */
+export declare function normalizeCssLoading(value: unknown): CssLoadingMode;
+/**
+ * Guard the only Vite combination that would claim to solve the stylesheet-insertion regression while
+ * leaving the cause in place. A deferred split build can still attach CSS when a prefetched lazy chunk
+ * evaluates, so it must fail closed instead of producing a misleadingly healthy deployment.
+ */
+export declare function assertCssLoadingCompatible(cssCodeSplit: boolean, cssLoading: CssLoadingMode): void;
+//# sourceMappingURL=css-contract.d.ts.map

package/dist/css-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"css-contract.d.ts","sourceRoot":"","sources":["../src/css-contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,CAAA;AAEpD,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,cAA2B,CAAA;AAE7D,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM7D;AAED,sGAAsG;AACtG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,OAAO,EACrB,UAAU,EAAE,cAAc,GACzB,IAAI,CAMN"}

package/dist/css-contract.js

@@ -0,0 +1,28 @@
+/** The default remains the ordinary render-blocking stylesheet link. */
+export const DEFAULT_CSS_LOADING = "blocking";
+/** Runtime validation for the Vite CSS output switch. `undefined` means Vite's default (`true`). */
+export function normalizeCssCodeSplit(value) {
+    if (value === undefined)
+        return true;
+    if (typeof value === "boolean")
+        return value;
+    throw new TypeError(`[nifra/web] cssCodeSplit must be a boolean when provided, received ${JSON.stringify(value)}`);
+}
+/** Runtime validation for JavaScript callers, generated manifests, and hand-authored integrations. */
+export function normalizeCssLoading(value) {
+    if (value === "blocking" || value === "deferred")
+        return value;
+    throw new TypeError(`[nifra/web] cssLoading must be "blocking" or "deferred", received ${JSON.stringify(value)}`);
+}
+/**
+ * Guard the only Vite combination that would claim to solve the stylesheet-insertion regression while
+ * leaving the cause in place. A deferred split build can still attach CSS when a prefetched lazy chunk
+ * evaluates, so it must fail closed instead of producing a misleadingly healthy deployment.
+ */
+export function assertCssLoadingCompatible(cssCodeSplit, cssLoading) {
+    if (cssLoading !== "deferred" || !cssCodeSplit)
+        return;
+    throw new Error('[nifra/web] cssLoading: "deferred" requires cssCodeSplit: false. Vite can otherwise inject ' +
+        "stylesheets when prefetched lazy chunks evaluate, reintroducing page-wide style/layout work.");
+}
+//# sourceMappingURL=css-contract.js.map

package/dist/css-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"css-contract.js","sourceRoot":"","sources":["../src/css-contract.ts"],"names":[],"mappings":"AASA,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAmB,UAAU,CAAA;AAE7D,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,IAAI,SAAS,CACjB,sEAAsE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAA;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAA;IAC9D,MAAM,IAAI,SAAS,CACjB,qEAAqE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAqB,EACrB,UAA0B;IAE1B,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,YAAY;QAAE,OAAM;IACtD,MAAM,IAAI,KAAK,CACb,6FAA6F;QAC3F,8FAA8F,CACjG,CAAA;AACH,CAAC"}

package/dist/dev-client.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The browser half of the dev feed: a small inline script a dev server puts first in each page's
+ * `<head>`, so the agent sees what the page did after it left the server - uncaught errors, unhandled
+ * rejections, failed script/stylesheet loads, hydration mismatches and console output.
+ *
+ * Inline and first, rather than a module, so it is listening before any module (the framework, the
+ * HMR client, the app) runs. Dev only: nothing here is reachable from a production build.
+ */
+import { type DevLogLevel } from "./dev-feed.js";
+export interface DevClientConfig {
+    /** Where the batches go (same origin). */
+    readonly ingestPath: string;
+    /** Proves a batch came from a page this server served. */
+    readonly pageToken: string;
+    /** The request that rendered this document: browser entries from it carry the same id. */
+    readonly requestId?: string | undefined;
+    /** The document's path + search, so a client-side navigation away stops claiming that request. */
+    readonly documentPath?: string | undefined;
+    /** The issues indicator module, loaded on the first error the server answers for; none when off. */
+    readonly indicatorPath?: string | undefined;
+}
+/** The script's text (without the `<script>` element). */
+export declare function devClientSource(config: DevClientConfig): string;
+/** The CSP source that admits exactly `source`. */
+export declare function scriptHash(source: string): string;
+/** Whether a response is a page the script belongs in: HTML, with a body nobody has encoded yet. */
+export declare function isInjectablePage(response: Response, method: string): boolean;
+/**
+ * Prepare `headers` for the script: admit it in the page's CSP, by hash unless `nonced` (the caller
+ * puts a nonce on every script afterwards). Returns the `<script>` element to insert, or undefined
+ * when the page's CSP forbids scripts and nothing should be inserted.
+ */
+export declare function devClientTag(config: DevClientConfig, headers: Headers, origin: string, nonced?: boolean): string | undefined;
+/** `html` with `tag` inserted into its head; unchanged when there is no `<head>`. */
+export declare function injectIntoHtml(html: string, tag: string): string;
+/**
+ * Stream `body` with `tag` inserted into its head. Only the prefix up to the insertion point is held
+ * back; the rest streams through untouched, so a streamed SSR page keeps its first-byte time.
+ */
+export declare function injectIntoStream(body: ReadableStream<Uint8Array>, tag: string): ReadableStream<Uint8Array>;
+/** One batch is bounded by what `fetch(keepalive)` may carry. */
+export declare const CLIENT_BATCH_MAX_BYTES: number;
+export declare const CLIENT_BATCH_MAX_EVENTS = 50;
+interface EventContext {
+    readonly page: string;
+    readonly requestId?: string | undefined;
+}
+export interface BrowserError {
+    readonly name: string;
+    readonly message: string;
+    readonly stack: string;
+}
+export type ClientEvent = EventContext & ({
+    readonly kind: "error" | "rejection";
+    readonly name: string;
+    readonly message: string;
+    readonly stack: string;
+} | {
+    readonly kind: "resource";
+    readonly tag: string;
+    readonly url: string;
+} | {
+    readonly kind: "console";
+    readonly level: DevLogLevel;
+    readonly message: string;
+    /** The first Error a `console.error` call was given: frameworks report caught errors so. */
+    readonly error?: BrowserError | undefined;
+});
+export interface ClientBatch {
+    readonly token: string;
+    readonly events: readonly ClientEvent[];
+}
+/** A batch the script could have sent, or undefined. Malformed events are dropped, not fatal. */
+export declare function parseClientBatch(value: unknown): ClientBatch | undefined;
+export {};
+//# sourceMappingURL=dev-client.d.ts.map

package/dist/dev-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-client.d.ts","sourceRoot":"","sources":["../src/dev-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,eAAe,CAAA;AAG/D,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,oGAAoG;IACpG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5C;AA0FD,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAQ/D;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK5E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,UAAQ,GACb,MAAM,GAAG,SAAS,CASpB;AA2BD,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGhE;AAYD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,GAAG,EAAE,MAAM,GACV,cAAc,CAAC,UAAU,CAAC,CAuC5B;AAMD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,QAAY,CAAA;AAC/C,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,UAAU,YAAY;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GACpC,CACI;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,CAAA;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CAC1C,CACJ,CAAA;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;CACxC;AAiDD,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAUxE"}

package/dist/dev-client.js

@@ -0,0 +1,280 @@
+/**
+ * The browser half of the dev feed: a small inline script a dev server puts first in each page's
+ * `<head>`, so the agent sees what the page did after it left the server - uncaught errors, unhandled
+ * rejections, failed script/stylesheet loads, hydration mismatches and console output.
+ *
+ * Inline and first, rather than a module, so it is listening before any module (the framework, the
+ * HMR client, the app) runs. Dev only: nothing here is reachable from a production build.
+ */
+import { createHash } from "node:crypto";
+import { isDevLogLevel } from "./dev-feed.js";
+import { admitInlineScript } from "./internal/dev-csp.js";
+// ES2017, no dependencies, one global: `__nifraDevClient`, the idempotence flag that also queues issues
+// for the indicator module. Keep it small: it ships in every dev page, and its hash goes into every CSP
+// that needs one.
+const CLIENT_SOURCE = String.raw `(function(C){
+if(window.__nifraDevClient)return;var S=window.__nifraDevClient={issues:[]};
+var nonce=document.currentScript&&document.currentScript.nonce,loading=0;
+var q=[],timer=0,inside=0,MSG=8000,STACK=16000;
+function cap(s,n){s=String(s);return s.length>n?s.slice(0,n)+"...":s}
+function where(){return location.pathname+location.search}
+function ser(v,d){
+if(typeof v==="string")return v;
+if(v instanceof Error)return v.stack||v.name+": "+v.message;
+if(typeof v==="function")return"[Function "+(v.name||"anonymous")+"]";
+if(typeof v!=="object"||v===null)return String(v);
+if(typeof Element!=="undefined"&&v instanceof Element)return"<"+v.tagName.toLowerCase()+(v.id?"#"+v.id:"")+">";
+if(d>2)return Array.isArray(v)?"[Array]":"[Object]";
+var seen=[];
+try{return JSON.stringify(v,function(k,x){
+if(typeof x==="object"&&x!==null){if(seen.indexOf(x)!==-1)return"[Circular]";seen.push(x)}
+if(typeof x==="bigint")return x+"n";
+if(x instanceof Error)return x.name+": "+x.message;
+return x})}catch(e){return Object.prototype.toString.call(v)}}
+function fmt(a){
+var args=Array.prototype.slice.call(a),out=[];
+if(typeof args[0]==="string"&&args[0].indexOf("%")!==-1){
+var rest=args.slice(1);
+out.push(args[0].replace(/%([sdifoOjc%])/g,function(m,k){
+if(k==="%")return"%";
+if(!rest.length)return m;
+var v=rest.shift();
+if(k==="c")return"";
+if(k==="d"||k==="i")return String(parseInt(v,10));
+if(k==="f")return String(parseFloat(v));
+return ser(v,0)}));
+args=rest}
+for(var i=0;i<args.length;i++)out.push(ser(args[i],0));
+return out.join(" ")}
+function send(keep){
+clearTimeout(timer);timer=0;
+while(q.length){
+var body=JSON.stringify({token:C.t,events:q.splice(0,50)});
+try{fetch(C.u,{method:"POST",body:body,keepalive:!!keep&&body.length<60000,headers:{"content-type":"application/json"},credentials:"same-origin"}).then(function(r){if(r.status===200&&C.i)return r.json().then(issues)}).catch(function(){})}catch(e){}}}
+function issues(j){
+var list=j&&j.issues;if(!list||!list.length)return;
+if(S.indicator){S.indicator.add(list);return}
+S.issues=S.issues.concat(list);if(loading)return;loading=1;
+var s=document.createElement("script");s.type="module";s.src=C.i;if(nonce)s.nonce=nonce;
+(document.head||document.documentElement).appendChild(s)}
+function push(e){
+e.page=cap(where(),2000);
+if(C.r&&e.page===C.p)e.requestId=C.r;
+q.push(e);
+if(q.length>=50)send(false);else if(!timer)timer=setTimeout(send,100)}
+["debug","info","log","warn","error"].forEach(function(level){
+var orig=console[level];if(typeof orig!=="function")return;
+console[level]=function(){
+if(!inside){inside=1;try{
+var ev={kind:"console",level:level,message:cap(fmt(arguments),MSG)};
+if(level==="error")for(var i=0;i<arguments.length;i++){var x=arguments[i];
+if(x instanceof Error){ev.error={name:cap(x.name,200),message:cap(x.message,MSG),stack:cap(x.stack||"",STACK)};break}}
+push(ev)}catch(e){}inside=0}
+return orig.apply(this,arguments)}});
+addEventListener("error",function(ev){
+var t=ev.target;
+if(t&&t!==window&&t.tagName){
+var tag=t.tagName.toLowerCase(),rel=(t.rel||"").toLowerCase();
+if(tag==="script"||(tag==="link"&&/stylesheet|modulepreload|preload/.test(rel)))push({kind:"resource",tag:tag,url:cap(t.src||t.href||"",2000)});
+return}
+var e=ev.error;
+if(!e&&ev.message==="Script error.")return;
+push({kind:"error",name:cap(e&&e.name?e.name:"Error",200),message:cap(e&&e.message!=null?e.message:ev.message,MSG),
+stack:cap(e&&e.stack?e.stack:(ev.filename?"    at "+ev.filename+":"+ev.lineno+":"+ev.colno:""),STACK)})},true);
+addEventListener("unhandledrejection",function(ev){
+var r=ev.reason;
+if(r instanceof Error)push({kind:"rejection",name:cap(r.name,200),message:cap(r.message,MSG),stack:cap(r.stack||"",STACK)});
+else push({kind:"rejection",name:"UnhandledRejection",message:cap(ser(r,0),MSG)})});
+addEventListener("pagehide",function(){send(true)});
+document.addEventListener("visibilitychange",function(){if(document.visibilityState==="hidden")send(true)});
+})`;
+// `</script` inside a JSON value would end the element early; `<!--` can start a script-data escape.
+const scriptSafe = (json) => json
+    .replaceAll("<", "\\u003c")
+    .replaceAll(">", "\\u003e")
+    .replaceAll("\u2028", "\\u2028")
+    .replaceAll("\u2029", "\\u2029");
+/** The script's text (without the `<script>` element). */
+export function devClientSource(config) {
+    const settings = { u: config.ingestPath, t: config.pageToken };
+    if (config.indicatorPath !== undefined)
+        settings.i = config.indicatorPath;
+    if (config.requestId !== undefined && config.documentPath !== undefined) {
+        settings.r = config.requestId;
+        settings.p = config.documentPath;
+    }
+    return `${CLIENT_SOURCE}(${scriptSafe(JSON.stringify(settings))})`;
+}
+/** The CSP source that admits exactly `source`. */
+export function scriptHash(source) {
+    return `'sha256-${createHash("sha256").update(source).digest("base64")}'`;
+}
+/** Whether a response is a page the script belongs in: HTML, with a body nobody has encoded yet. */
+export function isInjectablePage(response, method) {
+    if (method === "HEAD" || response.body === null)
+        return false;
+    if (response.status === 204 || response.status === 304)
+        return false;
+    if (response.headers.has("content-encoding"))
+        return false;
+    return (response.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
+}
+/**
+ * Prepare `headers` for the script: admit it in the page's CSP, by hash unless `nonced` (the caller
+ * puts a nonce on every script afterwards). Returns the `<script>` element to insert, or undefined
+ * when the page's CSP forbids scripts and nothing should be inserted.
+ */
+export function devClientTag(config, headers, origin, nonced = false) {
+    const source = devClientSource(config);
+    const hash = nonced ? undefined : scriptHash(source);
+    // A nonced client hands its nonce to the module it loads, so only a hashed one needs the URL admitted.
+    const indicator = nonced || config.indicatorPath === undefined ? undefined : new URL(config.indicatorPath, origin);
+    if (!admitInlineScript(headers, hash, new URL(config.ingestPath, origin), indicator))
+        return undefined;
+    return `<script data-nifra-dev>${source}</script>`;
+}
+// Latin-1 views keep string offsets equal to byte offsets, so a match position is a splice point.
+const latin1 = new TextDecoder("latin1");
+const HEAD_OPEN = /<head(?:\s[^>]*)?>/i;
+const META_CHARSET = /^\s*<meta\s[^>]*charset\s*=[^>]*>/i;
+// Past this, a page without `<head>` is a fragment: stop looking and stream it as it is.
+const HEAD_SEARCH_LIMIT = 64 * 1024;
+// Enough to see a `<meta charset>` that immediately follows `<head>`.
+const META_LOOKAHEAD = 256;
+/** Where the script goes in `text`: after `<head>`, and after a `<meta charset>` that leads it. */
+function insertionPoint(text, final) {
+    const head = HEAD_OPEN.exec(text);
+    if (head === null) {
+        const body = /<body[\s>]/i.test(text);
+        return final || body || text.length > HEAD_SEARCH_LIMIT ? "none" : "wait";
+    }
+    const afterHead = head.index + head[0].length;
+    const rest = text.slice(afterHead);
+    const meta = META_CHARSET.exec(rest);
+    if (meta !== null)
+        return afterHead + meta[0].length;
+    if (!final && rest.length < META_LOOKAHEAD && !/<(?!meta)/i.test(rest.replace(/^\s+/, "")))
+        return "wait";
+    return afterHead;
+}
+/** `html` with `tag` inserted into its head; unchanged when there is no `<head>`. */
+export function injectIntoHtml(html, tag) {
+    const at = insertionPoint(html, true);
+    return typeof at === "number" ? html.slice(0, at) + tag + html.slice(at) : html;
+}
+function concat(chunks, length) {
+    const out = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+}
+/**
+ * Stream `body` with `tag` inserted into its head. Only the prefix up to the insertion point is held
+ * back; the rest streams through untouched, so a streamed SSR page keeps its first-byte time.
+ */
+export function injectIntoStream(body, tag) {
+    const insert = new TextEncoder().encode(tag);
+    const held = [];
+    let heldBytes = 0;
+    let done = false;
+    const release = (controller, final) => {
+        const bytes = concat(held, heldBytes);
+        const at = insertionPoint(latin1.decode(bytes), final);
+        if (at === "wait")
+            return;
+        held.length = 0;
+        heldBytes = 0;
+        done = true;
+        if (at === "none") {
+            controller.enqueue(bytes);
+            return;
+        }
+        controller.enqueue(bytes.subarray(0, at));
+        controller.enqueue(insert);
+        controller.enqueue(bytes.subarray(at));
+    };
+    return body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            if (done) {
+                controller.enqueue(chunk);
+                return;
+            }
+            held.push(chunk);
+            heldBytes += chunk.byteLength;
+            release(controller, false);
+        },
+        flush(controller) {
+            if (!done && heldBytes > 0)
+                release(controller, true);
+        },
+    }));
+}
+// ---------------------------------------------------------------------------------------------------
+// What the script sends
+// ---------------------------------------------------------------------------------------------------
+/** One batch is bounded by what `fetch(keepalive)` may carry. */
+export const CLIENT_BATCH_MAX_BYTES = 64 * 1024;
+export const CLIENT_BATCH_MAX_EVENTS = 50;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value, max) => typeof value === "string" ? value.slice(0, max) : undefined;
+// The script only ever tags an event with the id the server put in it; anything else is dropped.
+const REQUEST_ID = /^r\d{1,12}$/;
+function parseBrowserError(value) {
+    if (!isRecord(value))
+        return undefined;
+    const message = text(value.message, 8 * 1024);
+    if (message === undefined)
+        return undefined;
+    return {
+        name: text(value.name, 200) || "Error",
+        message,
+        stack: text(value.stack, 16 * 1024) ?? "",
+    };
+}
+function parseEvent(value) {
+    if (!isRecord(value))
+        return undefined;
+    const page = text(value.page, 2048);
+    if (page === undefined || !page.startsWith("/"))
+        return undefined;
+    const requestId = typeof value.requestId === "string" && REQUEST_ID.test(value.requestId)
+        ? value.requestId
+        : undefined;
+    if (value.kind === "error" || value.kind === "rejection") {
+        const error = parseBrowserError(value);
+        return error === undefined ? undefined : { kind: value.kind, ...error, page, requestId };
+    }
+    if (value.kind === "resource") {
+        const tag = text(value.tag, 20);
+        const url = text(value.url, 2048);
+        if (tag === undefined || url === undefined)
+            return undefined;
+        return { kind: "resource", tag, url, page, requestId };
+    }
+    if (value.kind === "console") {
+        const message = text(value.message, 8 * 1024);
+        if (message === undefined || !isDevLogLevel(value.level))
+            return undefined;
+        const error = parseBrowserError(value.error);
+        return { kind: "console", level: value.level, message, error, page, requestId };
+    }
+    return undefined;
+}
+/** A batch the script could have sent, or undefined. Malformed events are dropped, not fatal. */
+export function parseClientBatch(value) {
+    if (!isRecord(value) || typeof value.token !== "string" || !Array.isArray(value.events))
+        return undefined;
+    if (value.events.length > CLIENT_BATCH_MAX_EVENTS)
+        return undefined;
+    const events = [];
+    for (const raw of value.events) {
+        const event = parseEvent(raw);
+        if (event !== undefined)
+            events.push(event);
+    }
+    return { token: value.token, events };
+}
+//# sourceMappingURL=dev-client.js.map

package/dist/dev-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-client.js","sourceRoot":"","sources":["../src/dev-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAoB,aAAa,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAezD,wGAAwG;AACxG,wGAAwG;AACxG,kBAAkB;AAClB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2E7B,CAAA;AAEH,qGAAqG;AACrG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAC1C,IAAI;KACD,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;KAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;KAC1B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC/B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AAEpC,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,QAAQ,GAA2B,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAA;IACzE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxE,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAA;QAC7B,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAA;AACpE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAA;AAC3E,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,MAAc;IACjE,IAAI,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACpE,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,OAAgB,EAChB,MAAc,EACd,MAAM,GAAG,KAAK;IAEd,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACpD,uGAAuG;IACvG,MAAM,SAAS,GACb,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAClG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC;QAClF,OAAO,SAAS,CAAA;IAClB,OAAO,0BAA0B,MAAM,WAAW,CAAA;AACpD,CAAC;AAED,kGAAkG;AAClG,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAA;AACxC,MAAM,SAAS,GAAG,qBAAqB,CAAA;AACvC,MAAM,YAAY,GAAG,oCAAoC,CAAA;AACzD,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAA;AACnC,sEAAsE;AACtE,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B,mGAAmG;AACnG,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,OAAO,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACpD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAA;IACf,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjF,CAAC;AAED,SAAS,MAAM,CAAC,MAA6B,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAgC,EAChC,GAAW;IAEX,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAiB,EAAE,CAAA;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,MAAM,OAAO,GAAG,CACd,UAAwD,EACxD,KAAc,EACR,EAAE;QACR,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACrC,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QACtD,IAAI,EAAE,KAAK,MAAM;YAAE,OAAM;QACzB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;QACf,SAAS,GAAG,CAAC,CAAA;QACb,IAAI,GAAG,IAAI,CAAA;QACX,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACzB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACzC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACxC,CAAC,CAAA;IACD,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAyB;QAC1C,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAA;YAC7B,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,UAAU;YACd,IAAI,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC;gBAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACvD,CAAC;KACF,CAAC,CACH,CAAA;AACH,CAAC;AAED,sGAAsG;AACtG,wBAAwB;AACxB,sGAAsG;AAEtG,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAoCzC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,GAAW,EAAsB,EAAE,CAC/D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAE7D,iGAAiG;AACjG,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO;QACtC,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,CAAC,CAAC,KAAK,CAAC,SAAS;QACjB,CAAC,CAAC,SAAS,CAAA;IACf,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC5D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACrF,OAAO,SAAS,CAAA;IAClB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,SAAS,CAAA;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;AACvC,CAAC"}

package/dist/dev-diagnostics.d.ts

@@ -1,3 +1,20 @@
+import { type Diagnostic } from "./diagnostic.js";
+/**
+ * Whether a codeframe may show `file` (the canonical path it would read) to a browser: source in a
+ * browser zone. A page reports its own stack frames, so it can name any path: data files and the dev
+ * server's own `.nifra/` files (the discovery record holds the agent token) never qualify.
+ */
+export declare function createSourceGate(root: string): (file: string) => boolean;
+/** A failure as the dev feed recorded it: the entry and request let its agent prompt name a check. */
+export interface CapturedFailure {
+    readonly diagnostic: Diagnostic;
+    readonly entry?: {
+        readonly id: string;
+        readonly seq: number;
+    } | undefined;
+    readonly requestId?: string | undefined;
+    readonly category?: string | undefined;
+}
 export interface DevDiagnostics {
     /** True when a request path targets the structured last-error endpoint. */
     isLastErrorPath(pathname: string): boolean;
@@ -13,8 +30,15 @@ export interface DevDiagnostics {
         readonly method: string;
         readonly url: string;
     }): string;
+    /** The overlay HTML for a failure the feed already recorded, which also becomes the last error. */
+    show(captured: CapturedFailure): string;
 }
 /** One diagnostics surface per dev server. `root` is the resolved project root; it scopes the codeframe
- * to the project (see buildDiagnostic). Both dev servers resolve a concrete root before calling this. */
-export declare function createDevDiagnostics(root: string): DevDiagnostics;
+ * to the project (see buildDiagnostic). Both dev servers resolve a concrete root before calling this.
+ * `build` replaces the default Diagnostic builder: the dev session passes one that also records the
+ * failure in its feed (redacted), so the overlay, this endpoint and the feed show the same object. */
+export declare function createDevDiagnostics(root: string, build?: (err: unknown, request: {
+    readonly method: string;
+    readonly url: string;
+}) => CapturedFailure): DevDiagnostics;
 //# sourceMappingURL=dev-diagnostics.d.ts.map

package/dist/dev-diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-diagnostics.d.ts","sourceRoot":"","sources":["../src/dev-diagnostics.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C;wGACoG;IACpG,SAAS,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAC1F;4GACwG;IACxG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAA;CAC1F;AAED;yGACyG;AACzG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAoBjE"}
+{"version":3,"file":"dev-diagnostics.d.ts","sourceRoot":"","sources":["../src/dev-diagnostics.ts"],"names":[],"mappings":"AAYA,OAAO,EAAmB,KAAK,UAAU,EAA+B,MAAM,iBAAiB,CAAA;AAK/F;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAOxE;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C;wGACoG;IACpG,SAAS,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;IAC1F;4GACwG;IACxG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAA;IACzF,mGAAmG;IACnG,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAA;CACxC;AAED;;;sGAGsG;AACtG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,CACN,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KACvD,eAAe,GACnB,cAAc,CAqChB"}