@nifrajs/web 3.5.0 → 4.0.0

package/dist/internal/web-app.d.ts

@@ -1,5 +1,6 @@
-import type { Platform } from "@nifrajs/core/server";
+import type { MountableApp } from "@nifrajs/core/server";
 import { type ServerOptions, server } from "@nifrajs/core/server";
+import { type CspPolicy } from "../csp.js";
 import type { CssLoadingMode } from "../css-contract.js";
 import type { Manifest } from "../manifest.js";
 import type { RenderAdapter } from "../render-seam.js";
@@ -20,6 +21,13 @@ export interface CreateWebAppOptions<Env = unknown> {
      * policy's allowed sources are app-specific.
      */
     readonly nonce?: NonceResolver<Env>;
+    /**
+     * A hash-based Content-Security-Policy from `createCspPolicy`, instead of `nonce`. A document then
+     * carries a nonce only when it needs one (it `defer()`s a value, or `meta` names the nonce in
+     * `unsafeInlineScript`); every other page is nonce-free, gets the same CSP header on every request,
+     * and stays cacheable by `withISR` or a CDN. `meta` still receives a nonce to name.
+     */
+    readonly csp?: CspPolicy;
     /**
      * Options for the underlying `server()` - `requestTimeoutMs`, `admission`, `gracefulSignals`, and
      * the rest of {@link ServerOptions}.
@@ -81,14 +89,26 @@ export interface CreateWebAppOptions<Env = unknown> {
      * mount interface from `@nifrajs/core/mount`; `createWebApp` also serves that backend over HTTP at
      * {@link apiPrefix} (default `/api`): a request whose pathname starts with the prefix is dispatched
      * before page routing with the same `env`/`waitUntil` platform context, and the backend's `Response`
-     * is returned untouched. The mount runs in `nifra dev` too. Pass `apiPrefix: ""` to disable it. */
+     * is returned untouched. The mount runs in `nifra dev` too. Pass `apiPrefix: ""` to disable it.
+     *
+     * **Request-scoped loader calls.** While a page renders, its loaders, actions and boundaries get a
+     * `ctx.api` bound to that request's platform identity: a backend handler reached through it sees the
+     * visitor's `c.clientIp` (derived under this app's `server.clientIp` trust declaration), `c.env` and
+     * `c.waitUntil`, so a per-caller rate limit or audit field keys on the real visitor. `c.clientIp` is
+     * the supported way to read the caller - identity travels in the platform, so rebuilding a `Request`
+     * does not lose it. Headers do NOT travel: the page request's `cookie` and `authorization` are never
+     * copied, so a loader call is anonymous unless the loader passes headers on the call itself. */
     readonly api?: unknown;
     /** HTTP path prefix the {@link api} backend is auto-mounted at (default `"/api"`). A request whose
      * pathname is exactly the prefix or starts with `prefix + "/"` is dispatched to the backend before
      * page routing; the backend therefore defines its routes at the **full** path (`server().post("/api/
      * sync", …)`), matching the in-process `inProcessClient` call sites. Set to `""` to disable the
      * auto-mount entirely (the app serves pages only and `api` stays a loader-only `ctx.api`). Mounting
-     * is also a no-op when `api` does not expose the symbol mount. */
+     * is also a no-op when `api` does not expose the symbol mount.
+     *
+     * A page file under the prefix (`routes/api/report.tsx`) could never render - the backend answers
+     * first and its 404 is final - so `createWebApp` throws, naming the file. The same holds for every
+     * other pre-route mount. */
     readonly apiPrefix?: string;
     /**
      * Strip {@link apiPrefix} from the pathname before dispatching to `api` (default `false`).
@@ -110,14 +130,16 @@ export interface CreateWebAppOptions<Env = unknown> {
      *
      * Tried longest-path-first and BEFORE the `api` mount, so a mount at `/api/auth` wins over a backend
      * at `/api` no matter which was declared first. `stripPrefix` is the per-mount form of {@link apiStrip}:
-     * leave it off to pass the full path through.
+     * leave it off to pass the full path through. `opaque` states why a mount whose routes nifra cannot
+     * read (better-auth's handler) is outside assurance; it is then listed as a known gap.
      */
     readonly mounts?: ReadonlyArray<{
         readonly path: string;
-        readonly app: {
-            fetch(request: Request, platform?: Platform<Env>): Response | Promise<Response>;
-        };
+        readonly app: MountableApp<Env>;
         readonly stripPrefix?: boolean;
+        readonly priority?: number;
+        readonly fallbackOn?: 404;
+        readonly opaque?: string;
     }>;
     /** Secret for **draft / preview mode** (see `enableDraft`). When set, a request carrying a valid
      * signed `__nifra_draft` cookie gets `ctx.draft === true` in loaders/actions (else always `false`).
@@ -144,14 +166,19 @@ export interface CreateWebAppOptions<Env = unknown> {
      */
     readonly cssLoading?: CssLoadingMode;
     /** SSG: the prerendered-path set (e.g. `enumerateStaticRoutes(routes).paths` or the build's
-     * `prerendered.json`). Injected as `window.__NIFRA_PRERENDERED__` on every page so a client soft-nav
-     * into a prerendered route fetches its static `_data.json` instead of hitting the worker. */
+     * `prerendered.json`). Handed over as `window.__NIFRA_PRERENDERED__` on every page so a client soft-nav
+     * into a prerendered route fetches its static `_data.json` instead of hitting the worker. A set over
+     * 4 KB of JSON is served once from `/__nifra/prerendered.json?v=<version>`, cacheable for good, and
+     * pages hand over only that URL; `prerenderRoutes` writes the file into a static output. */
     readonly prerenderedPaths?: readonly string[];
     /** Publish the project's `AGENTS.md` inside `/llms.txt` and `/llms-full.txt`. **Off by default**:
      * those endpoints are public and unauthenticated, while `AGENTS.md` is a repo file written for the
      * team - unreleased feature names, internal hostnames, and "don't touch X yet" notes live there
      * routinely. Turn it on only for a repo whose guidelines you would publish as a page. */
     readonly publishLocalGuidelines?: boolean;
+    /** Serve `/llms.txt` and `/llms-full.txt` (default `true`): the page routes, and the backend routes
+     * when the backend is mounted over HTTP at {@link apiPrefix}. `false` registers neither path. */
+    readonly llmsTxt?: boolean;
     /** SSG: per dynamic route pattern, its `getStaticPaths` `fallback` (from `enumerateStaticRoutes` or
      * the build's `prerendered.json`). A route mapped to `"404"` rejects any path NOT in
      * `prerenderedPaths` with the 404 page - the unlisted path simply doesn't exist. `"ssr"` (the
@@ -187,4 +214,6 @@ export interface CreateWebAppOptions<Env = unknown> {
  * secure default; validate at the trust boundary before use.
  */
 export declare function createWebApp<Env = unknown>(options: CreateWebAppOptions<Env>): ReturnType<typeof server<Env>>;
+/** Resolve one composed, token-only evidence snapshot for a web app and its mounted surfaces. */
+export declare function webProjectEvidence(source: unknown): Promise<import("@nifrajs/core/evidence").ProjectEvidenceSnapshot>;
 //# sourceMappingURL=web-app.d.ts.map

package/dist/internal/web-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-app.d.ts","sourceRoot":"","sources":["../../src/internal/web-app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGnF,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,MAAM,WAAW,mBAAmB,CAAC,GAAG,GAAG,OAAO;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAA;IAC5D;;;;;;;uGAOmG;IACnG,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;sEAKkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE;YACZ,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;SAChF,CAAA;QACD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAC/B,CAAC,CAAA;IACF;;uGAEmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;sGAEkG;IAClG,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IACnE;;gGAE4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;qGAGiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAClE;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC;;iGAE6F;IAC7F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C;;;6FAGyF;IACzF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;IACzC;;;wEAGoE;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;IAClE;qGACiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,gBAAgB,EAAE,mBAAmB,CAAA;IAC3E;;;;;4BAKwB;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,KAAK,EAAE,OAAO,EACd,GAAG,EAAE;QACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KACvB,KACE,IAAI,CAAA;CACV;AAmDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAG,OAAO,EACxC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAChC,UAAU,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CA+FhC"}
+{"version":3,"file":"web-app.d.ts","sourceRoot":"","sources":["../../src/internal/web-app.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,KAAK,SAAS,EAAkD,MAAM,WAAW,CAAA;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGtD,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnF,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,MAAM,WAAW,mBAAmB,CAAC,GAAG,GAAG,OAAO;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAA;IAC5D;;;;;;;;;;;;;;;oGAegG;IAChG,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;;gCAS4B;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;QAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,CAAA;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KACzB,CAAC,CAAA;IACF;;uGAEmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;sGAEkG;IAClG,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IACnE;;gGAE4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;qGAGiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAClE;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC;;;;gGAI4F;IAC5F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C;;;6FAGyF;IACzF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;IACzC;qGACiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;;wEAGoE;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;IAClE;qGACiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,gBAAgB,EAAE,mBAAmB,CAAA;IAC3E;;;;;4BAKwB;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,KAAK,EAAE,OAAO,EACd,GAAG,EAAE;QACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KACvB,KACE,IAAI,CAAA;CACV;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAG,OAAO,EACxC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAChC,UAAU,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CA2MhC;AAED,iGAAiG;AACjG,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,wBAAwB,EAAE,uBAAuB,CAAC,CAMnE"}

package/dist/internal/web-app.js

@@ -1,8 +1,11 @@
-import { NIFRA_BACKEND_MOUNT, } from "@nifrajs/core/mount";
+import { NIFRA_BACKEND_EVIDENCE, NIFRA_BACKEND_MOUNT, NIFRA_BACKEND_WS_MOUNT, NIFRA_BACKEND_WS_RUNTIME, preRouteMountPaths, } from "@nifrajs/core/mount";
 import { server } from "@nifrajs/core/server";
+import { cspNonceResolver, DOCUMENT_POLICY, isCspPolicy } from "../csp.js";
+import { CACHE_CHANNEL } from "../isr.js";
 import { generateLlmsTxt } from "../llms-txt.js";
+import { PRERENDERED_LIST_PATH } from "../router.js";
+import { formatShadowedPages, shadowedPages } from "./mount-shadow.js";
 import { createPageRequestExecutor } from "./page-execution.js";
-import { urlPartsFor } from "./request-url.js";
 /**
  * Re-issue `request` with `prefix` removed from its pathname.
  *
@@ -16,13 +19,6 @@ import { urlPartsFor } from "./request-url.js";
  * The `Request` is rebuilt rather than mutated (`url` is read-only), preserving method, headers, body,
  * and duplex streaming - the body is passed through unread, so a large or streamed upload is untouched.
  */
-function stripMountPrefix(request, prefix) {
-    const url = new URL(request.url);
-    const rest = url.pathname.slice(prefix.length);
-    url.pathname = rest === "" ? "/" : rest;
-    // `url.href`, not the `URL`: this type set only declares the string and Request overloads.
-    return new Request(url.href, request);
-}
 /**
  * Resolve the explicit symbol-keyed backend mount interface. The symbol seam forwards platform
  * context without making web depend on client.
@@ -33,16 +29,37 @@ function backendMountOf(api) {
     const explicit = api[NIFRA_BACKEND_MOUNT];
     if (typeof explicit !== "function")
         return undefined;
-    return (request, platform) => explicit.call(api, request, platform);
-}
-function requestPathOf(request) {
-    try {
-        const parts = urlPartsFor(request);
-        return parts.pathname + parts.search;
-    }
-    catch {
-        return "/";
+    const websocket = api[NIFRA_BACKEND_WS_MOUNT];
+    const runtime = api[NIFRA_BACKEND_WS_RUNTIME];
+    const evidence = api[NIFRA_BACKEND_EVIDENCE];
+    const mount = {
+        fetch: (request, platform) => explicit.call(api, request, platform),
+    };
+    if (typeof websocket === "function") {
+        mount.resolveWebSocketUpgrade = (request, platform) => websocket.call(api, request, platform);
     }
+    if (typeof runtime === "function")
+        mount[NIFRA_BACKEND_WS_RUNTIME] = runtime;
+    if (typeof evidence === "function")
+        mount[NIFRA_BACKEND_EVIDENCE] = evidence;
+    return mount;
+}
+function evidenceProviderOf(value) {
+    if ((typeof value !== "object" && typeof value !== "function") || value === null)
+        return undefined;
+    const provider = value[NIFRA_BACKEND_EVIDENCE];
+    return typeof provider === "function" ? provider : undefined;
+}
+function mountPathPrefix(path) {
+    const withoutWildcard = path.endsWith("/*") ? path.slice(0, -2) : path;
+    if (withoutWildcard === "" || withoutWildcard === "/")
+        return "";
+    // Index-scan instead of `/\/+$/`: mount paths can be library input, and the
+    // unanchored-start trailing-run replacement can backtrack quadratically.
+    let end = withoutWildcard.length;
+    while (end > 0 && withoutWildcard.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    return withoutWildcard.slice(0, end);
 }
 /**
  * Build a nifra app from a route manifest: every route SSRs its layout chain via `renderPage`,
@@ -60,6 +77,12 @@ function requestPathOf(request) {
  */
 export function createWebApp(options) {
     const { adapter, manifest, clientEntry, title, api } = options;
+    if (options.csp !== undefined && options.nonce !== undefined) {
+        throw new TypeError("[nifra/web] createWebApp takes `csp` or `nonce`, not both");
+    }
+    if (options.csp !== undefined && !isCspPolicy(options.csp)) {
+        throw new TypeError("[nifra/web] createWebApp `csp` must come from createCspPolicy()");
+    }
     // Seed the context with the declared `Env` so `app.fetch(req, { env })` / `toFetchHandler(app)` type
     // the platform bindings (see the `createWebApp` doc). The runtime `env` still arrives per-request via
     // `app.fetch(req, { env })`; this is a compile-time-only seed (`server<Env>()` casts, doesn't store).
@@ -68,39 +91,58 @@ export function createWebApp(options) {
     // `beforeHandle`, assurance evidence) actually bind to them - see the `use` option. A caller
     // cannot do this after the fact: by the time this function returns, the routes are declared.
     options.use?.(app);
+    // A resolver created by `createNonceResolver({ header })` carries a paired response hook. Register it
+    // after caller middleware so its request-specific CSP value is the last default applied to a page.
+    const nonceResponse = options.nonce?.onResponse;
+    if (nonceResponse !== undefined)
+        app.onResponse(nonceResponse);
+    // How this app's documents meet a CSP, for wrappers that cache them (`withISR` warns on "nonce").
+    const documentPolicy = options.csp !== undefined ? "hash" : options.nonce !== undefined ? "nonce" : undefined;
+    if (documentPolicy !== undefined) {
+        Object.defineProperty(app, DOCUMENT_POLICY, { value: documentPolicy });
+    }
+    const cacheChannel = { enabled: false };
+    Object.defineProperty(app, CACHE_CHANNEL, {
+        value: () => {
+            cacheChannel.enabled = true;
+        },
+    });
     // Auto-mount the in-process backend over HTTP at `apiPrefix` (default `/api`), BEFORE page routing.
-    // `onRequest` runs on the raw request ahead of the router, so this wins over the page wildcard `/*`
-    // for every method (POST/GET/PUT/…) - not just the GET page routes - and a backend 404 (`/api/none`)
-    // surfaces as the backend's own response, never the page 404. We dispatch the SAME `Request` object
-    // (its body unread) so streamed/large bodies pass through untouched; the backend defines its routes
-    // at the full prefixed path (`server().post("/api/sync", …)`), matching the `inProcessClient` call
-    // sites. `apiPrefix: ""` opts out; a non-mountable `api` (no symbol mount) is left pages-only. The hook
-    // is registered ONLY when both hold, so a pages-only app keeps core's synchronous no-hook fast path.
+    // Core's pre-route mount seam runs before the page wildcard `/*`; parent request hooks run first,
+    // child request hooks run inside the mount, and parent response hooks still wrap the result.
+    // The mount handles every HTTP method and preserves backend 404 responses instead of letting the
+    // page catch-all render them. We dispatch the same `Request` object (its body unread), so
+    // streamed/large bodies pass through untouched. The backend defines full prefixed paths
+    // (`server().post("/api/sync", …)`) unless `apiStrip` is enabled. `apiPrefix: ""` opts out;
+    // a non-mountable `api` remains loader-only and pages-only apps keep the no-mount fast path.
     const apiPrefix = options.apiPrefix ?? "/api";
     const apiStrip = options.apiStrip === true;
     const mountedApi = backendMountOf(api);
     // Longest path first, so a more specific mount (`/api/auth`) is tried before a broader one (`/api`)
     // regardless of the order they were declared in.
-    const mounts = [...(options.mounts ?? [])].sort((a, b) => b.path.length - a.path.length);
-    const underPrefix = (pathname, prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`);
-    if (mounts.length > 0 || (apiPrefix !== "" && mountedApi !== undefined)) {
-        app.onRequest((req, platform) => {
-            const { pathname } = urlPartsFor(req);
-            // Sub-app mounts win over the backend prefix: they are the more specific declaration, and an
-            // auth handler mounted at `/api/auth` must not be swallowed by the backend mounted at `/api`.
-            for (const mount of mounts) {
-                if (!underPrefix(pathname, mount.path))
-                    continue;
-                return mount.app.fetch(mount.stripPrefix === true ? stripMountPrefix(req, mount.path) : req, platform);
-            }
-            // Exactly the prefix (`/api`) or a sub-path (`/api/…`) - NOT a sibling like `/apixyz` that merely
-            // shares the prefix as a string head. Dispatch the original `req` (body intact) to the backend.
-            if (mountedApi !== undefined && apiPrefix !== "" && underPrefix(pathname, apiPrefix)) {
-                return mountedApi(apiStrip ? stripMountPrefix(req, apiPrefix) : req, platform);
-            }
-            return undefined; // not an API path → continue to page routing
-        });
+    const configuredMounts = Object.freeze((options.mounts ?? []).map((mount) => ({
+        path: mount.path,
+        app: mount.app,
+        ...(mount.stripPrefix === undefined ? {} : { stripPrefix: mount.stripPrefix }),
+        ...(mount.priority === undefined ? {} : { priority: mount.priority }),
+        ...(mount.fallbackOn === undefined ? {} : { fallbackOn: mount.fallbackOn }),
+        ...(mount.opaque === undefined ? {} : { opaque: mount.opaque }),
+    })));
+    const mounts = [...configuredMounts];
+    if (mountedApi !== undefined && apiPrefix !== "") {
+        mounts.push({ path: apiPrefix, app: mountedApi, stripPrefix: apiStrip });
     }
+    for (const mount of mounts)
+        app.mount(mount);
+    // Read back the server's own mount table, so a mount added in `use` counts as well: a page under any
+    // pre-route mount is unreachable, and serving it as a silent 404 hides that.
+    const shadowed = shadowedPages(manifest, preRouteMountPaths(app));
+    if (shadowed.length > 0)
+        throw new Error(`[nifra/web] ${formatShadowedPages(shadowed)}`);
+    const ownPatterns = new Set(manifest.routes.map((route) => route.pattern));
+    const prerenderedList = ownPatterns.has(PRERENDERED_LIST_PATH)
+        ? undefined
+        : servedPrerenderedList(options.prerenderedPaths);
     const pageExecutor = createPageRequestExecutor({
         adapter,
         manifest,
@@ -115,33 +157,131 @@ export function createWebApp(options) {
         ...(options.prerenderedPaths === undefined
             ? {}
             : { prerenderedPaths: options.prerenderedPaths }),
+        ...(prerenderedList === undefined ? {} : { prerenderedListUrl: prerenderedList.url }),
         ...(options.staticFallbacks === undefined ? {} : { staticFallbacks: options.staticFallbacks }),
         ...(options.staticBoundaryCache === undefined
             ? {}
             : { staticBoundaryCache: options.staticBoundaryCache }),
         ...(options.nonce === undefined ? {} : { nonce: options.nonce }),
+        ...(options.csp === undefined
+            ? {}
+            : { nonce: cspNonceResolver(options.csp), csp: options.csp }),
         ...(options.onLoaderError === undefined ? {} : { onLoaderError: options.onLoaderError }),
+        cacheChannel,
     });
     for (const route of manifest.routes) {
         app.register("GET", route.pattern, undefined, pageExecutor.get(route));
         app.register("POST", route.pattern, undefined, pageExecutor.post(route));
     }
-    // Register llms.txt & llms-full.txt
-    const llmsOptions = { includeLocalGuidelines: options.publishLocalGuidelines === true };
-    app.register("GET", "/llms.txt", undefined, async () => {
-        const text = await generateLlmsTxt(false, manifest.routes, api, llmsOptions);
-        return new Response(text, {
-            headers: { "content-type": "text/plain; charset=utf-8" },
-        });
-    });
-    app.register("GET", "/llms-full.txt", undefined, async () => {
-        const text = await generateLlmsTxt(true, manifest.routes, api, llmsOptions);
-        return new Response(text, {
-            headers: { "content-type": "text/plain; charset=utf-8" },
-        });
+    // llms.txt & llms-full.txt describe what a visitor can reach: the pages, and the backend only when it
+    // is served over HTTP - a backend the loaders call in-process has no public surface to describe. An
+    // app route at either path takes precedence, and each text is built once per app.
+    if (options.llmsTxt !== false) {
+        const llmsOptions = { includeLocalGuidelines: options.publishLocalGuidelines === true };
+        const publicApi = mountedApi !== undefined && apiPrefix !== "" ? api : undefined;
+        for (const [path, full] of [
+            ["/llms.txt", false],
+            ["/llms-full.txt", true],
+        ]) {
+            if (ownPatterns.has(path))
+                continue;
+            let text;
+            app.register("GET", path, undefined, async () => {
+                text ??= generateLlmsTxt(full, manifest.routes, publicApi, llmsOptions).catch((error) => {
+                    text = undefined;
+                    throw error;
+                });
+                return new Response(await text, {
+                    headers: { "content-type": "text/plain; charset=utf-8" },
+                });
+            });
+        }
+    }
+    if (prerenderedList !== undefined) {
+        const { body, version } = prerenderedList;
+        app.register("GET", PRERENDERED_LIST_PATH, undefined, (c) => new Response(body, {
+            headers: {
+                "content-type": "application/json",
+                // Only the versioned URL pages hand over is immutable; a bare request gets today's list.
+                "cache-control": new URL(c.req.url).searchParams.get("v") === version
+                    ? "public, max-age=31536000, immutable"
+                    : "no-cache",
+            },
+        }));
+    }
+    // Wildcard catch-all: unmatched paths render the nearest `_404` (404), or a plain text 404 if
+    // absent.
+    app.register("GET", "/*", undefined, pageExecutor.fallback);
+    let evidenceComposing = false;
+    const evidenceProvider = async () => {
+        if (evidenceComposing) {
+            throw new Error("[nifra/web] cyclic composed assurance evidence mount");
+        }
+        evidenceComposing = true;
+        try {
+            const { composeProjectEvidence, snapshotProjectEvidence } = await import("@nifrajs/core/evidence");
+            const parts = [{ evidence: snapshotProjectEvidence(app) }];
+            for (const mount of configuredMounts) {
+                const provider = evidenceProviderOf(mount.app);
+                if (provider === undefined) {
+                    // A declared opaque mount reaches the snapshot as a known gap, through this app's own
+                    // mount reflection above.
+                    if (mount.opaque !== undefined)
+                        continue;
+                    throw new Error(`[nifra/web] cannot compose assurance evidence: mount "${mount.path}" has no token-only evidence provider - declare why it is not analyzed with { opaque: "<reason>" }`);
+                }
+                parts.push({
+                    evidence: await provider.call(mount.app),
+                    ...(mount.stripPrefix === true ? { pathPrefix: mountPathPrefix(mount.path) } : {}),
+                });
+            }
+            if (mountedApi !== undefined && apiPrefix !== "") {
+                const provider = evidenceProviderOf(api);
+                if (provider === undefined) {
+                    throw new Error(`[nifra/web] cannot compose assurance evidence: auto-mounted API at "${apiPrefix}" has no token-only evidence provider`);
+                }
+                parts.push({
+                    evidence: await provider.call(api),
+                    ...(apiStrip ? { pathPrefix: mountPathPrefix(apiPrefix) } : {}),
+                });
+            }
+            return composeProjectEvidence(parts);
+        }
+        finally {
+            evidenceComposing = false;
+        }
+    };
+    Object.defineProperty(app, NIFRA_BACKEND_EVIDENCE, {
+        configurable: false,
+        enumerable: false,
+        value: evidenceProvider,
+        writable: false,
     });
-    // Wildcard catch-all: unmatched paths render `_404` (404), or a plain text 404 if absent.
-    app.register("GET", "/*", undefined, (c) => pageExecutor.notFound(c.req, c.env, requestPathOf(c.req)));
     return app;
 }
+/** Resolve one composed, token-only evidence snapshot for a web app and its mounted surfaces. */
+export async function webProjectEvidence(source) {
+    const provider = evidenceProviderOf(source);
+    if (provider === undefined) {
+        throw new TypeError("webProjectEvidence(): expected an app created by createWebApp");
+    }
+    return provider.call(source);
+}
+// Up to this many characters of JSON, the prerendered set rides inline in each page's handover.
+const INLINE_PRERENDERED_CHARS = 4096;
+/** The prerendered set as a served, content-versioned list, when it is too large to inline. */
+function servedPrerenderedList(paths) {
+    if (paths === undefined || paths.length === 0)
+        return undefined;
+    const body = JSON.stringify(paths);
+    if (body.length <= INLINE_PRERENDERED_CHARS)
+        return undefined;
+    // FNV-1a: a version that changes with the list is all the URL needs; a stale cached list only
+    // costs a fallback to the dynamic data request.
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < body.length; i++)
+        hash = Math.imul(hash ^ body.charCodeAt(i), 0x01000193);
+    const version = (hash >>> 0).toString(16).padStart(8, "0");
+    return { body, version, url: `${PRERENDERED_LIST_PATH}?v=${version}` };
+}
 //# sourceMappingURL=web-app.js.map

package/dist/internal/web-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-app.js","sourceRoot":"","sources":["../../src/internal/web-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAsB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,EAAE,yBAAyB,EAAsB,MAAM,qBAAqB,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAsL9C;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,OAAgB,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9C,GAAG,CAAC,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,2FAA2F;IAC3F,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAM,GAAY;IACvC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,UAAU,CAAC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC5F,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC,CAAA;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAClC,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC9D,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,MAAM,GAAG,GAAG,MAAM,CAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,2FAA2F;IAC3F,6FAA6F;IAC7F,6FAA6F;IAC7F,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAClB,oGAAoG;IACpG,oGAAoG;IACpG,qGAAqG;IACrG,oGAAoG;IACpG,oGAAoG;IACpG,mGAAmG;IACnG,wGAAwG;IACxG,qGAAqG;IACrG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAA;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAM,GAAG,CAAC,CAAA;IAC3C,oGAAoG;IACpG,iDAAiD;IACjD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxF,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAW,EAAE,CAChE,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAE1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YACrC,6FAA6F;YAC7F,8FAA8F;YAC9F,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAChD,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CACpB,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EACpE,QAAQ,CACT,CAAA;YACH,CAAC;YACD,kGAAkG;YAClG,gGAAgG;YAChG,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACrF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,SAAS,CAAA,CAAC,6CAA6C;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,yBAAyB,CAAM;QAClD,OAAO;QACP,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;KACzF,CAAC,CAAA;IAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,oCAAoC;IACpC,MAAM,WAAW,GAAG,EAAE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAA;IACvF,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,0FAA0F;IAC1F,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAoB,EAAE,EAAE,CAC5D,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC1D,CAAA;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"web-app.js","sourceRoot":"","sources":["../../src/internal/web-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAsB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAkB,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE1F,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAsB,MAAM,qBAAqB,CAAA;AAwMnF;;;;;;;;;;;;GAYG;AACH;;;GAGG;AACH,SAAS,cAAc,CAAM,GAAY;IACvC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,UAAU,CAAC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC5F,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC,CAAA;IACzE,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,SAAS,GAAI,GAAkC,CAAC,sBAAsB,CAAC,CAAA;IAC7E,MAAM,OAAO,GAAI,GAAkC,CAAC,wBAAwB,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAI,GAAkC,CAAC,sBAAsB,CAAC,CAAA;IAC5E,MAAM,KAAK,GAKP;QACF,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,KAAK,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAA;IAC5E,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAA;IAC5E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAClG,MAAM,QAAQ,GAAI,KAAgD,CAAC,sBAAsB,CAAC,CAAA;IAC1F,OAAO,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,QAAoC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,IAAI,eAAe,KAAK,EAAE,IAAI,eAAe,KAAK,GAAG;QAAE,OAAO,EAAE,CAAA;IAChE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,GAAG,GAAG,eAAe,CAAC,MAAM,CAAA;IAChC,OAAO,GAAG,GAAG,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC7E,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAA;IACxF,CAAC;IACD,qGAAqG;IACrG,sGAAsG;IACtG,sGAAsG;IACtG,MAAM,GAAG,GAAG,MAAM,CAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,2FAA2F;IAC3F,6FAA6F;IAC7F,6FAA6F;IAC7F,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAClB,sGAAsG;IACtG,mGAAmG;IACnG,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAA;IAC/C,IAAI,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;IAC9D,kGAAkG;IAClG,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACvC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE;QACxC,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAA;QAC7B,CAAC;KACF,CAAC,CAAA;IACF,oGAAoG;IACpG,kGAAkG;IAClG,6FAA6F;IAC7F,iGAAiG;IACjG,0FAA0F;IAC1F,wFAAwF;IACxF,4FAA4F;IAC5F,6FAA6F;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAA;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAM,GAAG,CAAC,CAAA;IAC3C,oGAAoG;IACpG,iDAAiD;IACjD,MAAM,gBAAgB,GAAiC,MAAM,CAAC,MAAM,CAClE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CACxB,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC,CACH,CACF,CAAA;IACD,MAAM,MAAM,GAA6B,CAAC,GAAG,gBAAgB,CAAC,CAAA;IAC9D,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,qGAAqG;IACrG,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC5D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,yBAAyB,CAAM;QAClD,OAAO;QACP,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,GAAG,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAuB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACxF,YAAY;KACb,CAAC,CAAA;IAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACtE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,sGAAsG;IACtG,oGAAoG;IACpG,kFAAkF;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,EAAE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAA;QACvF,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QAChF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,WAAW,EAAE,KAAK,CAAC;YACpB,CAAC,gBAAgB,EAAE,IAAI,CAAC;SAChB,EAAE,CAAC;YACX,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACnC,IAAI,IAAiC,CAAA;YACrC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;gBAC9C,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtF,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,KAAK,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;oBAC9B,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;iBACzD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,eAAe,CAAA;QACzC,GAAG,CAAC,QAAQ,CACV,KAAK,EACL,qBAAqB,EACrB,SAAS,EACT,CAAC,CAA4B,EAAE,EAAE,CAC/B,IAAI,QAAQ,CAAC,IAAI,EAAE;YACjB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,yFAAyF;gBACzF,eAAe,EACb,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAClD,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,UAAU;aACjB;SACF,CAAC,CACL,CAAA;IACH,CAAC;IAED,8FAA8F;IAC9F,UAAU;IACV,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAE3D,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,MAAM,gBAAgB,GAA4B,KAAK,IAAI,EAAE;QAC3D,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CACtE,wBAAwB,CACzB,CAAA;YACD,MAAM,KAAK,GAGN,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjD,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,sFAAsF;oBACtF,0BAA0B;oBAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;wBAAE,SAAQ;oBACxC,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,IAAI,oGAAoG,CACxK,CAAA;gBACH,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBACxC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;gBACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE,SAAS,uCAAuC,CACxH,CAAA;gBACH,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;gBAAS,CAAC;YACT,iBAAiB,GAAG,KAAK,CAAA;QAC3B,CAAC;IACH,CAAC,CAAA;IACD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE;QACjD,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAe;IAEf,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED,gGAAgG;AAChG,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAErC,+FAA+F;AAC/F,SAAS,qBAAqB,CAC5B,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,IAAI,CAAC,MAAM,IAAI,wBAAwB;QAAE,OAAO,SAAS,CAAA;IAC7D,8FAA8F;IAC9F,gDAAgD;IAChD,IAAI,IAAI,GAAG,UAAU,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC7F,MAAM,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,qBAAqB,MAAM,OAAO,EAAE,EAAE,CAAA;AACxE,CAAC"}

package/dist/internal/zone-graph.d.ts

@@ -0,0 +1,89 @@
+import type { ClientModuleGraph } from "../module-graph.js";
+import { type Classification, type ZoneClassifier } from "../zones.js";
+/** What a graph module id names. */
+export type ModuleSource = {
+    readonly kind: "file";
+    readonly file: string;
+}
+/** `node:`/`bun:` builtins; the node-builtin guard reports these with its own message. */
+ | {
+    readonly kind: "builtin";
+}
+/** A plugin's virtual module, with the file it derives from when it names one. */
+ | {
+    readonly kind: "virtual";
+    readonly file?: string;
+};
+/** Bun metafile ids: cwd-relative paths, `node:` builtins, `namespace:path` for plugin modules. */
+export declare function bunModuleSource(cwd: string): (id: string) => ModuleSource;
+/** Rollup/Vite ids: absolute paths, `\0`-prefixed virtual modules, Vite's browser-external shim. */
+export declare function rollupModuleSource(id: string): ModuleSource;
+export interface ZoneLeak {
+    /** The refused module, as the report names it. */
+    readonly module: string;
+    readonly reason: string;
+    /** Shortest import path from an entry: `[entry, ...as-written specifiers]`. */
+    readonly chain: readonly string[];
+}
+export interface ClientGraphVerdict {
+    readonly leaks: readonly ZoneLeak[];
+    /** Evidence the graph does not account for. Any entry fails the build. */
+    readonly gaps: readonly string[];
+    /** Route frontend files whose compiled entry exports a backend-only name. */
+    readonly misplacedExports: readonly string[];
+}
+export interface VerifyClientGraphOptions {
+    readonly classifier: ZoneClassifier;
+    readonly sourceOf: (id: string) => ModuleSource;
+    /** The private-env denial for a browser-code file (see `privateEnvCheck`); unchecked when absent. */
+    readonly privateEnv?: (file: string) => string | undefined;
+    /** Files the zone guard refused while the bundler loaded them. Bun keeps the edge to a module
+     * tree-shaking removed but drops the module, so such an edge still names a refusal. */
+    readonly refused?: ReadonlySet<string>;
+}
+/** Check every module and edge of a client graph against the zone rules. */
+export declare function verifyClientGraph(graph: ClientModuleGraph, options: VerifyClientGraphOptions): ClientGraphVerdict;
+export interface ServerGraphVerdict {
+    /** Unzoned files and imports the zone rules refuse, each with the chain from an entry. */
+    readonly violations: readonly ZoneLeak[];
+}
+/**
+ * Check a server bundle's graph against the zone rules. Unlike the browser build, backend code is
+ * expected here; what is refused is a first-party file in no zone, an import the rules forbid
+ * (backend reaching frontend code, shared reaching anything but shared code), and shared code reaching
+ * a server built-in or the backend-only marker. The build's own entries and generated modules are
+ * `generated`, so they may import both halves.
+ */
+export declare function verifyServerGraph(graph: ClientModuleGraph, options: VerifyClientGraphOptions): ServerGraphVerdict;
+/** The build-failing message for a server graph that breaks the zone rules. */
+export declare function formatServerGraphVerdict(verdict: ServerGraphVerdict): string | undefined;
+/** One emitted file, as the accounting sees it. */
+export interface EmittedFile {
+    /** Output path relative to the output directory. */
+    readonly name: string;
+    readonly kind: "code" | "css" | "asset" | "map";
+    /** Source files the bundler says an asset came from, when it says. */
+    readonly sources?: readonly string[];
+    /** The file's text, for code and maps. */
+    readonly text?: string;
+}
+/**
+ * Why a file may not ship as an asset - its bytes copied or inlined into the bundle - or `undefined`
+ * when it may. A server function reaches the browser only as the stub its import is replaced with, so
+ * as an asset it is the server source itself.
+ */
+export declare function assetDenial(classification: Classification): string | undefined;
+/**
+ * Trace every emitted file back to the graph. A code or CSS file must be a graph chunk; an asset must
+ * name the module it was copied from; a source map (external or inline) may name browser-allowed
+ * sources only.
+ */
+export declare function accountEmittedFiles(files: readonly EmittedFile[], graph: ClientModuleGraph, options: VerifyClientGraphOptions & {
+    /** Where the files will be written; source map paths resolve against it. */
+    readonly outDir: string;
+}): string[];
+/** The build-failing message for a verdict, or `undefined` when the build is clean. */
+export declare function formatClientGraphVerdict(verdict: ClientGraphVerdict): string | undefined;
+/** The build-failing message for emitted files the graph does not account for. */
+export declare function formatUnaccountedOutput(problems: readonly string[]): string | undefined;
+//# sourceMappingURL=zone-graph.d.ts.map

package/dist/internal/zone-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-graph.d.ts","sourceRoot":"","sources":["../../src/internal/zone-graph.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAe,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAGL,KAAK,cAAc,EAGnB,KAAK,cAAc,EACpB,MAAM,aAAa,CAAA;AAIpB,oCAAoC;AACpC,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAClD,0FAA0F;GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,kFAAkF;GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAUxD,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,YAAY,CAOzE;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAK3D;AAED,MAAM,WAAW,QAAQ;IACvB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAA;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,YAAY,CAAA;IAC/C,qGAAqG;IACrG,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC1D;2FACuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACvC;AAiBD,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAuJpB;AA6BD,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAkGpB;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAOxF;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,CAAA;IAC/C,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,cAAc,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAO9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,wBAAwB,GAAG;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,GACA,MAAM,EAAE,CA+CV;AAqED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CA0BxF;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAGvF"}