@nifrajs/web 3.5.0 → 4.0.2

package/dist/fn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fn.d.ts","sourceRoot":"","sources":["../src/fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAA;AAE7B,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAE5C,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,oDAAoD;AACpD,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjD,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC1C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ,CAAC,KAAK,EAAE,MAAM;IACrC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACtD,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;CAC5C;AAED,qFAAqF;AACrF,MAAM,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AAElF,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,GACvB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAEjC,wGAAwG;AACxG,eAAO,MAAM,SAAS,EAAE,OAAO,MAA6C,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,KAAK,GAAG,IAAI,EAAE,MAAM,GAAG,OAAO,EACrD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAC7B,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,MAAM,CAAC,GAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAEzB;AAiBD,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,GACnC,IAAI,CAAA;CACR;AAED,oEAAoE;AACpE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,cAAc,CA4CzF"}
+{"version":3,"file":"fn.d.ts","sourceRoot":"","sources":["../src/fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAEL,KAAK,OAAO,EAEZ,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAA;AAG7B,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAE5C,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,oDAAoD;AACpD,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC1C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ,CAAC,KAAK,EAAE,MAAM;IACrC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACtD,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;CAC5C;AAED,qFAAqF;AACrF,MAAM,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,CAAA;AAElF,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,GACvB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAEjC,wGAAwG;AACxG,eAAO,MAAM,SAAS,EAAE,OAAO,MAA6C,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,KAAK,GAAG,IAAI,EAAE,MAAM,GAAG,OAAO,EACrD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAC7B,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,MAAM,CAAC,GAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAEzB;AAiBD,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,GACnC,IAAI,CAAA;CACR;AAED,oEAAoE;AACpE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,cAAc,CAsDzF"}

package/dist/fn.js

@@ -45,6 +45,7 @@
  * bespoke dispatcher.
  */
 import { defineIdentityPlugin, isSameOriginRequest, } from "@nifrajs/core/server";
+import { guardChannel, outputGuard } from "./internal/output-guard.js";
 /** The URL prefix every mounted function lives under. Namespaced per mount, then by export name. */
 export const SERVER_FN_PREFIX = "/_nifra/fn";
 /** Brand identifying a value produced by {@link serverFn}, so mounting cannot pick up stray exports. */
@@ -97,6 +98,12 @@ export function serverFunctions(namespace, module) {
                 throw new Error(`[nifra/fn] server function ${JSON.stringify(name)} in namespace ${JSON.stringify(namespace)} is not a valid identifier.`);
             }
             const config = fn[SERVER_FN];
+            const label = `server function "${namespace}.${name}"`;
+            const guarded = guardChannel(fn, {
+                label,
+                guard: config.output === undefined ? undefined : outputGuard(config.output, label, "output"),
+                missing: "an output schema in its serverFn({ output }) config",
+            });
             const schema = {
                 ...(config.input !== undefined ? { body: config.input } : {}),
                 ...(config.capabilities !== undefined ? { capabilities: config.capabilities } : {}),
@@ -107,17 +114,20 @@ export function serverFunctions(namespace, module) {
                 // has happened yet, so rejecting here is a complete refusal.
                 const request = c.req;
                 const contentType = request.headers.get("content-type") ?? "";
-                if (!contentType.includes("application/json")) {
+                const semi = contentType.indexOf(";");
+                const mediaType = (semi === -1 ? contentType : contentType.slice(0, semi)).trim();
+                if (mediaType.toLowerCase() !== "application/json") {
                     // A form cannot send this content type cross-origin without a preflight. Rejecting anything
                     // else is what makes form-driven CSRF against a server function impossible rather than
-                    // merely unlikely.
+                    // merely unlikely. Compare the media type, never search the header: `text/plain;
+                    // x=application/json` contains the string but is a no-preflight `text/plain` request.
                     return c.json({ ok: false, error: "unsupported_media_type" }, 415);
                 }
                 const origin = request.headers.get("origin");
                 if (origin !== null && !sameOrigin(origin, request)) {
                     return c.json({ ok: false, error: "forbidden_origin" }, 403);
                 }
-                return fn(config.input === undefined ? undefined : c.body, c);
+                return guarded(config.input === undefined ? undefined : c.body, c);
             }));
         }
         return app;

package/dist/fn.js.map

@@ -1 +1 @@
-{"version":3,"file":"fn.js","sourceRoot":"","sources":["../src/fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAGL,oBAAoB,EAEpB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAA;AAE7B,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAsC5C,wGAAwG;AACxG,MAAM,CAAC,MAAM,SAAS,GAAkB,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CACtB,MAA6B,EAC7B,EAA4D;IAE5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAA4B,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAc,EAAuC,EAAE,CACzE,OAAO,KAAK,KAAK,UAAU,IAAI,SAAS,IAAK,KAAgB,CAAA;AAE/D,uGAAuG;AACvG,MAAM,SAAS,GAAG,+BAA+B,CAAA;AACjD,kEAAkE;AAClE,MAAM,WAAW,GAAG,4BAA4B,CAAA;AAEhD;;;;GAIG;AACH,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAetC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAsB;IACvE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,6DAA6D,CACvI,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAiD,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAA;IAED,MAAM,KAAK,GAAG,CAAsB,GAAM,EAAK,EAAE;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,6BAA6B,CAC1H,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAgB;gBAC1B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAA;YACD,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,gBAAgB,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAU,EAAE,EAAE;gBACvF,2FAA2F;gBAC3F,8FAA8F;gBAC9F,6DAA6D;gBAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAA;gBACrB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;gBAC7D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAC9C,4FAA4F;oBAC5F,uFAAuF;oBACvF,mBAAmB;oBACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;oBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC9D,CAAC;gBACD,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,CAAC,CAAC,IAAc,EAAE,CAAC,CAAC,CAAA;YACrF,CAAC,CAAgC,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,OAAO,oBAAoB,CAAC,mBAAmB,SAAS,EAAE,EAAE,KAAK,CAAC,CAAA;AACpE,CAAC"}
+{"version":3,"file":"fn.js","sourceRoot":"","sources":["../src/fn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAGL,oBAAoB,EAEpB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAEtE,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AA2C5C,wGAAwG;AACxG,MAAM,CAAC,MAAM,SAAS,GAAkB,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CACtB,MAA6B,EAC7B,EAA4D;IAE5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAA4B,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAc,EAAuC,EAAE,CACzE,OAAO,KAAK,KAAK,UAAU,IAAI,SAAS,IAAK,KAAgB,CAAA;AAE/D,uGAAuG;AACvG,MAAM,SAAS,GAAG,+BAA+B,CAAA;AACjD,kEAAkE;AAClE,MAAM,WAAW,GAAG,4BAA4B,CAAA;AAEhD;;;;GAIG;AACH,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAetC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAsB;IACvE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,6DAA6D,CACvI,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAiD,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAA;IAED,MAAM,KAAK,GAAG,CAAsB,GAAM,EAAK,EAAE;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,6BAA6B,CAC1H,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC5B,MAAM,KAAK,GAAG,oBAAoB,SAAS,IAAI,IAAI,GAAG,CAAA;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,EAAE;gBAC/B,KAAK;gBACL,KAAK,EACH,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;gBACvF,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAA;YACF,MAAM,MAAM,GAAgB;gBAC1B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAA;YACD,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,gBAAgB,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAU,EAAE,EAAE;gBACvF,2FAA2F;gBAC3F,8FAA8F;gBAC9F,6DAA6D;gBAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAA;gBACrB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;gBAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACrC,MAAM,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;oBACnD,4FAA4F;oBAC5F,uFAAuF;oBACvF,iFAAiF;oBACjF,sFAAsF;oBACtF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;oBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC9D,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACpE,CAAC,CAAgC,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,OAAO,oBAAoB,CAAC,mBAAmB,SAAS,EAAE,EAAE,KAAK,CAAC,CAAA;AACpE,CAAC"}

package/dist/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAOA,OAAO,EAAiB,KAAK,QAAQ,EAAoB,MAAM,eAAe,CAAA;AAE9E,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;sEAEkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3D;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,QAAQ,CAczF"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAA;AAEtB,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;sEAEkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3D;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,QAAQ,CAmBzF"}

package/dist/fs.js

@@ -13,12 +13,14 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
  */
 import { readdirSync } from "node:fs";
 import { join } from "node:path";
-import { buildManifest } from "./manifest.js";
+import { buildManifest, isMiddlewareFile, isRouteBackendFile, } from "./manifest.js";
 /** Scan a `routes/` directory (recursively) and build the route manifest. */
 export function discoverRoutes(dir, options = {}) {
     const files = readdirSync(dir, { recursive: true })
         .map((file) => file.replaceAll("\\", "/")) // normalize Windows separators
-        .filter((file) => /\.(tsx|jsx|svelte|vue|mdx)$/.test(file));
+        .filter((file) => /\.(tsx|jsx|svelte|vue|mdx)$/.test(file) ||
+        isRouteBackendFile(file) ||
+        isMiddlewareFile(file));
     const query = options.importQuery ? `?${options.importQuery}` : "";
     const load = options.load;
     return buildManifest(files, (file) => load === undefined

package/dist/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAmC,MAAM,eAAe,CAAA;AAsB9E,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,UAAiC,EAAE;IAC7E,MAAM,KAAK,GAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,+BAA+B;SACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACnC,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,kCAAC,GAAG,GAAG,IAAI,IAAI,GAAG,KAAK,EAAE,EAAyB;QAChE,CAAC,CAAC,2FAA2F;YAC3F,yFAAyF;YACzF,yBAAyB;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAyB,CACxD,CAAA;AACH,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,eAAe,CAAA;AAsBtB,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,UAAiC,EAAE;IAC7E,MAAM,KAAK,GAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,+BAA+B;SACzE,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,kBAAkB,CAAC,IAAI,CAAC;QACxB,gBAAgB,CAAC,IAAI,CAAC,CACzB,CAAA;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACnC,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,kCAAC,GAAG,GAAG,IAAI,IAAI,GAAG,KAAK,EAAE,EAAyB;QAChE,CAAC,CAAC,2FAA2F;YAC3F,yFAAyF;YACzF,yBAAyB;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAyB,CACxD,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -9,6 +9,7 @@
  */
 export { assertStaticBoundaryImports, type Boundary, type BoundaryDescriptor, type BoundaryError, type BoundaryMode, type BoundaryRegistration, type BoundaryRequestCtx, type BoundaryState, type BoundaryStates, type BoundaryStatus, boundaryDescriptors, boundaryModeKey, type DynamicBoundary, type DynamicBoundaryBatch, type InterceptBoundary, MemoryStaticBoundaryCache, type PendingBoundary, resolveDynamicBoundaries, resolveStaticBoundaries, type StaticBoundary, type StaticBoundaryCache, type StaticBoundaryImportEdge, type StaticBoundaryRoot, type StaticCtx, startDynamicBoundaries, } from "./boundary.js";
 export { assertRenderAdapterConformance, RenderAdapterConformanceError, type RenderAdapterConformanceFixture, } from "./conformance.js";
+export { type CreateCspPolicyOptions, type CspHeaderContext, type CspPolicy, createCspPolicy, nifraScriptHashes, } from "./csp.js";
 export { assertCssLoadingCompatible, type CssLoadingMode, DEFAULT_CSS_LOADING, normalizeCssLoading, } from "./css-contract.js";
 export { type Deferred, defer } from "./deferred.js";
 export { DRAFT_COOKIE, type DraftCookieControls, disableDraft, type EnableDraftOptions, enableDraft, isDraftEnabled, type PreviewEndpointOptions, previewEndpoint, } from "./draft.js";
@@ -16,25 +17,22 @@ export { type FontDisplay, type FontFace, type FontPreloadInput, type FontSource
 export { type GenerateClientEntryOptions, type GenerateRouteSearchTypesOptions, type GenerateServerManifestOptions, generateClientEntry, generateRouteSearchTypes, generateServerManifest, } from "./internal/codegen.js";
 export { mergeHeads, resolveMeta } from "./internal/head-merge.js";
 export { canonical, gone, jsonLd, notFound, type OpenGraphInput, openGraph, type RedirectOptions, type RenderAssemblyCache, type RenderedPage, type RenderPageInput, type RenderPageOptions, type RevalidateResult, redirect, renderPage, renderPageResult, revalidate, type StatusPageOptions, serializeData, statusPage, unsafeInlineScript, } from "./internal/render-document.js";
-export { DEFAULT_DEV_PORT, PRE_HYDRATION_GUARD, type ServerOnly, } from "./internal/runtime-contract.js";
+export { type BackendOnly, DEFAULT_DEV_PORT, PRE_HYDRATION_GUARD, } from "./internal/runtime-contract.js";
 /**
- * The two file-name conventions that decide what never reaches a browser: a `*.server` module is
- * EMPTIED in the client build, a `*.fn` module is REPLACED with client stubs.
- *
- * Exported because more than the bundlers need them. `nifra dev --bun` cannot transform (Bun's dev
- * bundler takes no plugins) so it must REFUSE instead, and a refusal driven by its own hand-written
- * glob drifts from the transform - which is how `.fn.mts` came to be stubbed by both build pipelines
- * and waved through by the guard that exists to stop it leaking. Anything deciding "is this module
- * server-only" should import the matcher rather than re-encode it.
+ * The `*.fn` server-function convention: the browser build REPLACES such a module with client stubs.
+ * Exported so anything deciding "is this a server-function module" imports the matcher instead of
+ * re-encoding it - a hand-written glob drifts from the transform, which is how `.fn.mts` was once
+ * stubbed by both build pipelines and waved through by the guard meant to stop it leaking.
  */
-export { SERVER_FN_MODULE, SERVER_ONLY_MODULE } from "./internal/server-boundary.js";
-export { type CreateWebAppOptions, createWebApp, type NonceResolver, } from "./internal/web-app.js";
-export { type CachedResponse, type CacheStore, ISR_REVALIDATE_HEADER, ISR_REVALIDATE_TAGS_HEADER, ISR_STATUS_HEADER, type ISRApp, type ISROptions, type ISRPlatform, KVCacheStore, type KVCacheStoreOptions, type KVNamespaceLike, MemoryCacheStore, type MemoryCacheStoreOptions, type RevalidateEndpointOptions, revalidateEndpoint, withISR, } from "./isr.js";
-export { type Action, buildManifest, type ClientAction, type ClientActionArgs, type ClientActionResult, type ClientLoader, type ClientLoaderArgs, type ClientRequestBody, type ClientRouteHooks, enumerateStaticRoutes, filePathToPattern, filePathToPatterns, type GetStaticPaths, type InertScriptType, type LayoutEntry, type LinkDescriptor, type Loader, type LoaderContext, type Manifest, type Meta, type MetaArgs, type MetaDescriptor, type MetaInput, type RouteEntry, type RouteModule, type ScriptDescriptor, type StaticPath, type StaticPaths, type StaticRoutes, type UnsafeScriptDescriptor, } from "./manifest.js";
-export { type Blocker, type BlockerController, type BlockerFunction, type BlockerLocation, type BlockerState, type BrowserNavigate, getBrowserNavigate, IDLE_BLOCKER, type NavigateFunction, type NavigateOptions, type NavigateSearchOf, type NavigateTargetInput, type RouteSearch, registerBlocker, resolveNavigate, setBlockerController, setBrowserNavigate, } from "./navigation.js";
+export { SERVER_FN_MODULE } from "./internal/server-boundary.js";
+export { type CreateWebAppOptions, createWebApp, type NonceResolver, webProjectEvidence, } from "./internal/web-app.js";
+export { type CachedResponse, type CacheStore, type CdnPurgeOutcome, type CdnPurgeTarget, ISR_REVALIDATE_HEADER, ISR_REVALIDATE_TAGS_HEADER, ISR_STATUS_HEADER, type ISRApp, type ISROptions, type ISRPlatform, type ISRQuery, isCacheablePage, KVCacheStore, type KVCacheStoreOptions, type KVNamespaceLike, MemoryCacheStore, type MemoryCacheStoreOptions, type RevalidateEndpointOptions, type RevalidateTags, type RevalidateTagsInput, revalidateEndpoint, withISR, } from "./isr.js";
+export { type Action, buildManifest, type ClientAction, type ClientActionArgs, type ClientActionResult, type ClientLoader, type ClientLoaderArgs, type ClientRequestBody, type ClientRouteHooks, enumerateStaticRoutes, filePathToPattern, filePathToPatterns, type GetStaticPaths, type InertScriptType, type LayoutEntry, type LinkDescriptor, type Loader, type LoaderContext, type LoaderResponseControls, type LoadingEntry, type Manifest, type Meta, type MetaArgs, type MetaDescriptor, type MetaInput, type MiddlewareOutcome, type NotFoundEntry, type NotFoundScope, type RouteEntry, type RouteMiddleware, type RouteModule, type ScriptDescriptor, type ShouldRevalidate, type ShouldRevalidateArgs, type StaticPath, type StaticPaths, type StaticRoutes, type UnsafeScriptDescriptor, } from "./manifest.js";
+export { type Blocker, type BlockerController, type BlockerFunction, type BlockerLocation, type BlockerState, type BrowserNavigate, getBrowserNavigate, IDLE_BLOCKER, type NavigateFunction, type NavigateOptions, type NavigateSearchOf, type NavigateTargetInput, type PrefetchMode, type RouteSearch, registerBlocker, resolveNavigate, setBlockerController, setBrowserNavigate, } from "./navigation.js";
+export { type CreateNonceResolverOptions, createNonceResolver, type NonceContext, type NonceGenerator, type NonceHeader, type NonceHeaderContext, } from "./nonce.js";
 export { type PublicDirCache, resolvePublicPath, type ServePublicDirOptions, servePublicDir, } from "./public-dir.js";
 export { createMutation, createQueryClient, type DehydratedState, hashQueryKey, type InfiniteData, type InfiniteQueryHandle, type InfiniteQueryOptions, type MutationCallbacks, type MutationHandle, type MutationState, type MutationStatus, type QueryClient, type QueryClientOptions, type QueryHandle, type QueryOptions, type QueryState, type QueryStatus, } from "./query.js";
-export { ACTION_GLOBAL, BOUNDARY_GLOBAL, DATA_GLOBAL, LAYOUT_DATA_GLOBAL, type RenderAdapter, type RenderProps, ROOT_ATTRIBUTE, ROUTE_GLOBAL, type SsrModuleLoader, setSsrModuleLoader, ssrModuleLoader, } from "./render-seam.js";
+export { ACTION_GLOBAL, BOUNDARY_GLOBAL, DATA_GLOBAL, HANDOVER_ID, LAYOUT_DATA_GLOBAL, type MatchChain, type RenderAdapter, type RenderProps, type RenderStreamOptions, ROOT_ATTRIBUTE, ROUTE_GLOBAL, type SsrModuleLoader, setSsrModuleLoader, ssrModuleLoader, type UIMatch, } from "./render-seam.js";
 export { type ClientRouter, type ClientRouterOptions, createClientRouter, createMatcher, DATA_HEADER, type Fetcher, type FetcherState, type FetchRouteData, type MountRouterOptions, NAV_FROM_HEADER, REDIRECT_HEADER, RETAIN_HEADER, REVALIDATE_HEADER, type RouteMatch, type RoutePattern, type RouterState, STATUS_HEADER, type Submission, type SubmitOptions, } from "./router.js";
 export { type SearchOf, searchOf, searchOfChain, serializeSearch } from "./search.js";
 export { type HtmlSanitizer, type SanitizedHtml, sanitizedHtml, sanitizeHtml, type TrustedHtml, trustHtml, } from "./trusted-html.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,mBAAmB,EACnB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,eAAe,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,KAAK,+BAA+B,GACrC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,cAAc,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,kBAAkB,EACvB,WAAW,EACX,cAAc,EACd,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,GACZ,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,EACL,SAAS,EACT,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,KAAK,cAAc,EACnB,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,KAAK,iBAAiB,EACtB,aAAa,EACb,UAAU,EACV,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,UAAU,GAChB,MAAM,gCAAgC,CAAA;AACvC;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACpF,OAAO,EACL,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,OAAO,GACR,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,KAAK,MAAM,EACX,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,KAAK,cAAc,EACnB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,cAAc,GACf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA;AAKpB,OAAO,EAAE,KAAK,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,SAAS,GACV,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,mBAAmB,EACnB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,eAAe,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,KAAK,+BAA+B,GACrC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,KAAK,cAAc,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,kBAAkB,EACvB,WAAW,EACX,cAAc,EACd,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,GACZ,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,EACL,SAAS,EACT,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,KAAK,cAAc,EACnB,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,KAAK,iBAAiB,EACtB,aAAa,EACb,UAAU,EACV,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,KAAK,WAAW,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gCAAgC,CAAA;AACvC;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EACL,KAAK,mBAAmB,EACxB,YAAY,EACZ,KAAK,aAAa,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,eAAe,EACf,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,OAAO,GACR,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,KAAK,MAAM,EACX,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,cAAc,GACf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,OAAO,GACb,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA;AAKpB,OAAO,EAAE,KAAK,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,SAAS,GACV,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -10,6 +10,8 @@
 // Draft / preview mode - a signed cookie that flips `ctx.draft` for loaders + bypasses ISR for editors.
 export { assertStaticBoundaryImports, boundaryDescriptors, boundaryModeKey, MemoryStaticBoundaryCache, resolveDynamicBoundaries, resolveStaticBoundaries, startDynamicBoundaries, } from "./boundary.js";
 export { assertRenderAdapterConformance, RenderAdapterConformanceError, } from "./conformance.js";
+// Hash-based CSP: a document carries a nonce only when it needs one, so a CSP page stays cacheable.
+export { createCspPolicy, nifraScriptHashes, } from "./csp.js";
 export { assertCssLoadingCompatible, DEFAULT_CSS_LOADING, normalizeCssLoading, } from "./css-contract.js";
 // Deferred loader data (`defer()` + the `Deferred<T>` type) - consumed by the adapter's `<Await>`.
 export { defer } from "./deferred.js";
@@ -23,31 +25,28 @@ export { mergeHeads, resolveMeta } from "./internal/head-merge.js";
 export { canonical, gone, jsonLd, notFound, openGraph, redirect, renderPage, renderPageResult, revalidate, serializeData, statusPage, unsafeInlineScript, } from "./internal/render-document.js";
 export { DEFAULT_DEV_PORT, PRE_HYDRATION_GUARD, } from "./internal/runtime-contract.js";
 /**
- * The two file-name conventions that decide what never reaches a browser: a `*.server` module is
- * EMPTIED in the client build, a `*.fn` module is REPLACED with client stubs.
- *
- * Exported because more than the bundlers need them. `nifra dev --bun` cannot transform (Bun's dev
- * bundler takes no plugins) so it must REFUSE instead, and a refusal driven by its own hand-written
- * glob drifts from the transform - which is how `.fn.mts` came to be stubbed by both build pipelines
- * and waved through by the guard that exists to stop it leaking. Anything deciding "is this module
- * server-only" should import the matcher rather than re-encode it.
+ * The `*.fn` server-function convention: the browser build REPLACES such a module with client stubs.
+ * Exported so anything deciding "is this a server-function module" imports the matcher instead of
+ * re-encoding it - a hand-written glob drifts from the transform, which is how `.fn.mts` was once
+ * stubbed by both build pipelines and waved through by the guard meant to stop it leaking.
  */
-export { SERVER_FN_MODULE, SERVER_ONLY_MODULE } from "./internal/server-boundary.js";
-export { createWebApp, } from "./internal/web-app.js";
+export { SERVER_FN_MODULE } from "./internal/server-boundary.js";
+export { createWebApp, webProjectEvidence, } from "./internal/web-app.js";
 // ISR (incremental static regeneration): a pluggable cache store + the `withISR` stale-while-revalidate
 // wrapper for rendered SSR responses.
-export { ISR_REVALIDATE_HEADER, ISR_REVALIDATE_TAGS_HEADER, ISR_STATUS_HEADER, KVCacheStore, MemoryCacheStore, revalidateEndpoint, withISR, } from "./isr.js";
+export { ISR_REVALIDATE_HEADER, ISR_REVALIDATE_TAGS_HEADER, ISR_STATUS_HEADER, isCacheablePage, KVCacheStore, MemoryCacheStore, revalidateEndpoint, withISR, } from "./isr.js";
 // File-based routing manifest - pure + fs-free. `discoverRoutes` (fs) lives in `@nifrajs/web/fs`.
 export { buildManifest, enumerateStaticRoutes, filePathToPattern, filePathToPatterns, } from "./manifest.js";
 // Navigation bridge - a DOM-free seam the browser layer (`installHistory`) populates so an adapter's
 // `useNavigate` (a route component, importing only this agnostic entry) reaches history-aware nav.
 export { getBrowserNavigate, IDLE_BLOCKER, registerBlocker, resolveNavigate, setBlockerController, setBrowserNavigate, } from "./navigation.js";
+export { createNonceResolver, } from "./nonce.js";
 // public/ - user-authored static files, served identically in dev and production by one handler.
 export { resolvePublicPath, servePublicDir, } from "./public-dir.js";
 // Keyed query-cache (agnostic) - a `query(key, fn)` primitive (dedup + staleness + invalidation + GC)
 // consumed by the per-adapter `useQuery`/`createQuery` bindings.
 export { createMutation, createQueryClient, hashQueryKey, } from "./query.js";
-export { ACTION_GLOBAL, BOUNDARY_GLOBAL, DATA_GLOBAL, LAYOUT_DATA_GLOBAL, ROOT_ATTRIBUTE, ROUTE_GLOBAL, setSsrModuleLoader, ssrModuleLoader, } from "./render-seam.js";
+export { ACTION_GLOBAL, BOUNDARY_GLOBAL, DATA_GLOBAL, HANDOVER_ID, LAYOUT_DATA_GLOBAL, ROOT_ATTRIBUTE, ROUTE_GLOBAL, setSsrModuleLoader, ssrModuleLoader, } from "./render-seam.js";
 // Agnostic client-side router core (pure + DOM-free) - consumed by per-adapter Router bindings.
 // `DATA_HEADER` marks a navigation's data-only GET; `createWebApp` answers it with loader JSON.
 export { createClientRouter, createMatcher, DATA_HEADER, NAV_FROM_HEADER, REDIRECT_HEADER, RETAIN_HEADER, REVALIDATE_HEADER, STATUS_HEADER, } from "./router.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,OAAO,EACL,2BAA2B,EAU3B,mBAAmB,EACnB,eAAe,EAIf,yBAAyB,EAEzB,wBAAwB,EACxB,uBAAuB,EAMvB,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAE9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,0BAA0B,EAE1B,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,mGAAmG;AACnG,OAAO,EAAiB,KAAK,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,YAAY,EAEZ,YAAY,EAEZ,WAAW,EACX,cAAc,EAEd,eAAe,GAChB,MAAM,YAAY,CAAA;AACnB,oGAAoG;AACpG,OAAO,EAKL,QAAQ,EACR,WAAW,GACZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAIL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,4FAA4F;AAC5F,sGAAsG;AACtG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,EACL,SAAS,EACT,IAAI,EACJ,MAAM,EACN,QAAQ,EAER,SAAS,EAOT,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,UAAU,EAEV,aAAa,EACb,UAAU,EACV,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,gCAAgC,CAAA;AACvC;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACpF,OAAO,EAEL,YAAY,GAEb,MAAM,uBAAuB,CAAA;AAC9B,wGAAwG;AACxG,sCAAsC;AACtC,OAAO,EAGL,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EAIjB,YAAY,EAGZ,gBAAgB,EAGhB,kBAAkB,EAClB,OAAO,GACR,MAAM,UAAU,CAAA;AACjB,kGAAkG;AAClG,OAAO,EAEL,aAAa,EAQb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GAmBnB,MAAM,eAAe,CAAA;AACtB,qGAAqG;AACrG,mGAAmG;AACnG,OAAO,EAOL,kBAAkB,EAClB,YAAY,EAMZ,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AACxB,iGAAiG;AACjG,OAAO,EAEL,iBAAiB,EAEjB,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,sGAAsG;AACtG,iEAAiE;AACjE,OAAO,EACL,cAAc,EACd,iBAAiB,EAEjB,YAAY,GAcb,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,kBAAkB,EAGlB,cAAc,EACd,YAAY,EAEZ,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,gGAAgG;AAChG,gGAAgG;AAChG,OAAO,EAGL,kBAAkB,EAClB,aAAa,EACb,WAAW,EAKX,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EAIjB,aAAa,GAGd,MAAM,aAAa,CAAA;AACpB,mGAAmG;AACnG,wGAAwG;AACxG,wGAAwG;AACxG,kGAAkG;AAClG,OAAO,EAAiB,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,EAGL,aAAa,EACb,YAAY,EAEZ,SAAS,GACV,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wGAAwG;AACxG,OAAO,EACL,2BAA2B,EAU3B,mBAAmB,EACnB,eAAe,EAIf,yBAAyB,EAEzB,wBAAwB,EACxB,uBAAuB,EAMvB,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAE9B,MAAM,kBAAkB,CAAA;AACzB,oGAAoG;AACpG,OAAO,EAIL,eAAe,EACf,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAE1B,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,mGAAmG;AACnG,OAAO,EAAiB,KAAK,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,YAAY,EAEZ,YAAY,EAEZ,WAAW,EACX,cAAc,EAEd,eAAe,GAChB,MAAM,YAAY,CAAA;AACnB,oGAAoG;AACpG,OAAO,EAKL,QAAQ,EACR,WAAW,GACZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAIL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,4FAA4F;AAC5F,sGAAsG;AACtG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,EACL,SAAS,EACT,IAAI,EACJ,MAAM,EACN,QAAQ,EAER,SAAS,EAOT,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,UAAU,EAEV,aAAa,EACb,UAAU,EACV,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAEL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gCAAgC,CAAA;AACvC;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAEL,YAAY,EAEZ,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAC9B,wGAAwG;AACxG,sCAAsC;AACtC,OAAO,EAKL,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EAKjB,eAAe,EACf,YAAY,EAGZ,gBAAgB,EAKhB,kBAAkB,EAClB,OAAO,GACR,MAAM,UAAU,CAAA;AACjB,kGAAkG;AAClG,OAAO,EAEL,aAAa,EAQb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GA2BnB,MAAM,eAAe,CAAA;AACtB,qGAAqG;AACrG,mGAAmG;AACnG,OAAO,EAOL,kBAAkB,EAClB,YAAY,EAOZ,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAEL,mBAAmB,GAKpB,MAAM,YAAY,CAAA;AACnB,iGAAiG;AACjG,OAAO,EAEL,iBAAiB,EAEjB,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,sGAAsG;AACtG,iEAAiE;AACjE,OAAO,EACL,cAAc,EACd,iBAAiB,EAEjB,YAAY,GAcb,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,EACX,kBAAkB,EAKlB,cAAc,EACd,YAAY,EAEZ,kBAAkB,EAClB,eAAe,GAEhB,MAAM,kBAAkB,CAAA;AACzB,gGAAgG;AAChG,gGAAgG;AAChG,OAAO,EAGL,kBAAkB,EAClB,aAAa,EACb,WAAW,EAKX,eAAe,EACf,eAAe,EACf,aAAa,EACb,iBAAiB,EAIjB,aAAa,GAGd,MAAM,aAAa,CAAA;AACpB,mGAAmG;AACnG,wGAAwG;AACxG,wGAAwG;AACxG,kGAAkG;AAClG,OAAO,EAAiB,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,EAGL,aAAa,EACb,YAAY,EAEZ,SAAS,GACV,MAAM,mBAAmB,CAAA"}

package/dist/internal/cdn/cloudflare.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Cloudflare: a proxied zone in front of the origin, and Workers Cache in front of a Worker. Both read
+ * `Cache-Tag` and `Cloudflare-CDN-Cache-Control` and strip them before the browser; the zone purges
+ * through the API (at most 100 tags a call; the Free plan allows 5 calls a minute), Workers Cache
+ * through the Worker's own `cache.purge` (always Free-plan limits).
+ */
+import { type CdnProvider, type PurgeQueueOptions } from "./core.js";
+export interface CloudflareZoneOptions {
+    /** The zone id (32 hex characters, on the zone's Overview page). */
+    readonly zoneId: string;
+    /** An API token scoped to Zone > Cache Purge for this zone. Keep it in an env binding. */
+    readonly apiToken: string;
+    readonly queue?: PurgeQueueOptions;
+    /** The fetch purge calls go through; tests pass their own. */
+    readonly fetch?: typeof fetch;
+}
+/**
+ * A Cloudflare zone proxying the origin. HTML is only cached by a Cache Rule that makes it eligible,
+ * and the zone's cache ignores `Vary`: the rule must also bypass the cache when the request carries
+ * `x-nifra-data` (soft navigations fetch the page URL with that header). `nifra cdn-check` tests both.
+ */
+export declare function cloudflareZone(options: CloudflareZoneOptions): CdnProvider;
+/** The Worker's cache binding: `import { cache } from "cloudflare:workers"`, or `ctx.cache`. */
+export interface WorkersCacheLike {
+    purge(options: {
+        tags?: string[];
+        pathPrefixes?: string[];
+    }): Promise<{
+        success: boolean;
+        errors?: readonly {
+            code?: number;
+            message?: string;
+        }[];
+    }>;
+}
+export interface CloudflareWorkersCacheOptions {
+    /** `import { cache } from "cloudflare:workers"` (needs `[cache] enabled = true` in wrangler). */
+    readonly cache: WorkersCacheLike;
+    /**
+     * Whether the Worker serves different content per hostname. Workers Cache keys entries by path, not
+     * host, so such an app would serve one host's page to another: `true` is refused.
+     */
+    readonly hostRouted?: boolean;
+    readonly queue?: PurgeQueueOptions;
+}
+/** Workers Cache in front of the Worker serving the app. Purges are scoped to the calling entrypoint. */
+export declare function cloudflareWorkersCache(options: CloudflareWorkersCacheOptions): CdnProvider;
+//# sourceMappingURL=cloudflare.d.ts.map

package/dist/internal/cdn/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/internal/cdn/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAGL,KAAK,WAAW,EAGhB,KAAK,iBAAiB,EACvB,MAAM,WAAW,CAAA;AAQlB,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,CAkD1E;AAED,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QACpE,OAAO,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,SAAS;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KACxD,CAAC,CAAA;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CACnC;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,WAAW,CAqC1F"}

package/dist/internal/cdn/cloudflare.js

@@ -0,0 +1,94 @@
+/**
+ * Cloudflare: a proxied zone in front of the origin, and Workers Cache in front of a Worker. Both read
+ * `Cache-Tag` and `Cloudflare-CDN-Cache-Control` and strip them before the browser; the zone purges
+ * through the API (at most 100 tags a call; the Free plan allows 5 calls a minute), Workers Cache
+ * through the Worker's own `cache.purge` (always Free-plan limits).
+ */
+import { attemptFromStatus, cdnDirectives, defineCdnProvider, } from "./core.js";
+const headersFor = (input) => ({
+    "cache-tag": input.tags.join(","),
+    "cloudflare-cdn-cache-control": cdnDirectives(input),
+});
+const NO_STORE = { "cloudflare-cdn-cache-control": "no-store" };
+/**
+ * A Cloudflare zone proxying the origin. HTML is only cached by a Cache Rule that makes it eligible,
+ * and the zone's cache ignores `Vary`: the rule must also bypass the cache when the request carries
+ * `x-nifra-data` (soft navigations fetch the page URL with that header). `nifra cdn-check` tests both.
+ */
+export function cloudflareZone(options) {
+    if (!/^[a-f0-9]{32}$/.test(options.zoneId)) {
+        throw new TypeError("[nifra/web/cdn] cloudflareZone: zoneId must be the 32-character hex zone id");
+    }
+    if (typeof options.apiToken !== "string" || options.apiToken === "") {
+        throw new TypeError("[nifra/web/cdn] cloudflareZone: apiToken is empty (is the env binding set?)");
+    }
+    const send = options.fetch ?? fetch;
+    const endpoint = `https://api.cloudflare.com/client/v4/zones/${options.zoneId}/purge_cache`;
+    return defineCdnProvider({
+        name: "cloudflare",
+        tagsPerCall: 100,
+        maxResponseTags: 1000,
+        cacheHeaders: headersFor,
+        noStoreHeaders: () => NO_STORE,
+        async purgeTags(tags) {
+            const res = await send(endpoint, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${options.apiToken}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({ tags }),
+            });
+            const attempt = attemptFromStatus(res, "cloudflare");
+            if (!res.ok) {
+                await res.body?.cancel();
+                return attempt;
+            }
+            // A 200 can still carry `success: false`; only `true` means the purge was received.
+            const body = await res.json().catch(() => null);
+            const field = (from, name) => typeof from === "object" && from !== null ? Reflect.get(from, name) : undefined;
+            if (field(body, "success") === true)
+                return attempt;
+            const errors = field(body, "errors");
+            const code = field(Array.isArray(errors) ? errors[0] : undefined, "code");
+            return {
+                ok: false,
+                retryable: false,
+                reason: typeof code === "number" ? `cloudflare_error_${code}` : "cloudflare_unsuccessful",
+            };
+        },
+    }, options.queue);
+}
+/** Workers Cache in front of the Worker serving the app. Purges are scoped to the calling entrypoint. */
+export function cloudflareWorkersCache(options) {
+    if (options.hostRouted === true) {
+        throw new Error("[nifra/web/cdn] NIFRA_CDN_HOST_ROUTED: Workers Cache keys pages by path, not host, so a Worker that serves different content per hostname would serve one host's page to another. Put a Cloudflare zone (cloudflareZone) in front instead, or serve each host from its own Worker.");
+    }
+    if (typeof options.cache?.purge !== "function") {
+        throw new TypeError('[nifra/web/cdn] cloudflareWorkersCache: pass `cache` from `import { cache } from "cloudflare:workers"`');
+    }
+    return defineCdnProvider({
+        name: "cloudflare-workers-cache",
+        tagsPerCall: 100,
+        maxResponseTags: 1000,
+        cacheHeaders: headersFor,
+        noStoreHeaders: () => NO_STORE,
+        async purgeTags(tags) {
+            const result = await options.cache.purge({ tags: [...tags] });
+            if (result.success)
+                return { ok: true };
+            const first = result.errors?.[0];
+            // A rate-limit refusal is the one worth retrying; anything else is configuration.
+            const limited = /rate/i.test(first?.message ?? "");
+            return {
+                ok: false,
+                retryable: limited,
+                rateLimited: limited,
+                reason: typeof first?.code === "number"
+                    ? `workers_cache_${first.code}`
+                    : "workers_cache_refused",
+            };
+        },
+    }, options.queue);
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/internal/cdn/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../src/internal/cdn/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,EAGjB,aAAa,EACb,iBAAiB,GAElB,MAAM,WAAW,CAAA;AAElB,MAAM,UAAU,GAAG,CAAC,KAAoB,EAA0B,EAAE,CAAC,CAAC;IACpE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACjC,8BAA8B,EAAE,aAAa,CAAC,KAAK,CAAC;CACrD,CAAC,CAAA;AACF,MAAM,QAAQ,GAAG,EAAE,8BAA8B,EAAE,UAAU,EAAE,CAAA;AAY/D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CACjB,6EAA6E,CAC9E,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CACjB,6EAA6E,CAC9E,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,QAAQ,GAAG,8CAA8C,OAAO,CAAC,MAAM,cAAc,CAAA;IAC3F,OAAO,iBAAiB,CACtB;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,GAAG;QAChB,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,UAAU;QACxB,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ;QAC9B,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;oBAC3C,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAA;YACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACpD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;gBACxB,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,oFAAoF;YACpF,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACxD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,IAAY,EAAW,EAAE,CACrD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACjF,IAAI,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAA;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACzE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC,yBAAyB;aAC1F,CAAA;QACH,CAAC;KACF,EACD,OAAO,CAAC,KAAK,CACd,CAAA;AACH,CAAC;AAqBD,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC3E,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,oRAAoR,CACrR,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CACjB,wGAAwG,CACzG,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CACtB;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,GAAG;QAChB,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,UAAU;QACxB,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ;QAC9B,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;YAChC,kFAAkF;YAClF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAA;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,OAAO;gBAClB,WAAW,EAAE,OAAO;gBACpB,MAAM,EACJ,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE;oBAC/B,CAAC,CAAC,uBAAuB;aAC9B,CAAA;QACH,CAAC;KACF,EACD,OAAO,CAAC,KAAK,CACd,CAAA;AACH,CAAC"}

package/dist/internal/cdn/core.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The provider-neutral half of `@nifrajs/web/cdn`: the path tag every cached page carries, and the
+ * purge queue each provider runs its API calls through (coalescing, chunking, `Retry-After`).
+ */
+import type { CdnPurgeTarget } from "../../isr.js";
+/** What a cacheable page tells the CDN: its tags and how long the CDN may serve it. */
+export interface CdnCacheInput {
+    readonly tags: readonly string[];
+    /** Seconds the CDN may serve the page as fresh. */
+    readonly maxAge: number;
+    /** Seconds past `maxAge` the CDN may serve it while it refetches. */
+    readonly staleWhileRevalidate: number;
+    /** Seconds past `maxAge` the CDN may serve it while the origin errors. */
+    readonly staleIfError?: number | undefined;
+}
+/** A CDN nifra can tag pages for and purge. Build one with {@link defineCdnProvider}. */
+export interface CdnProvider extends CdnPurgeTarget {
+    readonly name: string;
+    /** Most tags one response may carry on this CDN. */
+    readonly maxResponseTags: number;
+    /** Headers that let the CDN store a page under `input.tags` (consumed by the CDN, not the browser). */
+    cacheHeaders(input: CdnCacheInput): Readonly<Record<string, string>>;
+    /** Headers that keep the CDN from storing a page, whatever its rules say. */
+    noStoreHeaders(): Readonly<Record<string, string>>;
+}
+/** One purge API call's result. A refusal is `retryable` when sending it again may succeed. */
+export type PurgeAttempt = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly retryable: boolean;
+    readonly reason: string;
+    readonly retryAfterMs?: number | undefined;
+    readonly rateLimited?: boolean | undefined;
+};
+/** What a provider file supplies; {@link defineCdnProvider} adds the queue. */
+export interface CdnProviderDefinition {
+    readonly name: string;
+    /** Most tags one purge API call may name. */
+    readonly tagsPerCall: number;
+    readonly maxResponseTags: number;
+    cacheHeaders(input: CdnCacheInput): Readonly<Record<string, string>>;
+    noStoreHeaders(): Readonly<Record<string, string>>;
+    purgeTags(tags: readonly string[]): Promise<PurgeAttempt>;
+}
+/** A purge that did not go through, as reported to {@link PurgeQueueOptions.onError}. */
+export interface CdnPurgeError {
+    readonly code: "NIFRA_CDN_PURGE_FAILED" | "NIFRA_CDN_RATE_LIMITED";
+    readonly provider: string;
+    readonly reason: string;
+    /** How many tags the refused call named (never the tags or the credentials). */
+    readonly tags: number;
+    /** Whether the queue gave up on them. */
+    readonly final: boolean;
+}
+export interface PurgeQueueOptions {
+    /** Tags arriving within this window go out in one call (ms). Default 250. */
+    readonly debounceMs?: number;
+    /** Attempts per call before a retryable refusal is given up on. Default 5. */
+    readonly maxAttempts?: number;
+    /** Longest wait between attempts, `Retry-After` included (ms). Default 60000. */
+    readonly maxBackoffMs?: number;
+    /** Most tags waiting or retrying at once; a purge past it is refused as retryable. Default 5000. */
+    readonly maxQueuedTags?: number;
+    /** Where a refused purge is reported. Default: one `console.error` line per refusal. */
+    readonly onError?: (error: CdnPurgeError) => void;
+    /** Timer for the debounce and the backoff; tests pass their own. */
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * The tag every page a CDN stores carries for its own path, so a path purge works on CDNs that only
+ * purge by tag. It hashes the normalized pathname alone: the query and the host stay out, so one purge
+ * reaches every query variant and needs no knowledge of the public origin. Two hosts serving the same
+ * path share the tag, which can only make a purge reach more than asked, never serve a wrong page.
+ */
+export declare function pathTag(path: string): Promise<string>;
+/** `Retry-After` as milliseconds: delta seconds or an HTTP date; undefined when absent or unreadable. */
+export declare function retryAfterMs(value: string | null, now?: number): number | undefined;
+/** A purge API reply read the same way for every HTTP provider. */
+export declare function attemptFromStatus(res: Response, reason: string): PurgeAttempt;
+/** `max-age=..., stale-while-revalidate=...[, stale-if-error=...]` for a CDN TTL header. */
+export declare function cdnDirectives(input: CdnCacheInput): string;
+/**
+ * A {@link CdnProvider} from a provider's API calls, with the purge queue in front: tags arriving
+ * within `debounceMs` go out together, chunked to the provider's per-call limit and sent one call at
+ * a time; a 429 or 5xx is retried with capped exponential backoff that honors `Retry-After`. A
+ * `purge` resolves once its tags' first attempt is answered: `accepted`, `queued` (a retry is
+ * pending, kept alive with `platform.waitUntil` on edge runtimes), or `failed`.
+ */
+export declare function defineCdnProvider(definition: CdnProviderDefinition, options?: PurgeQueueOptions): CdnProvider;
+//# sourceMappingURL=core.d.ts.map

package/dist/internal/cdn/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/internal/cdn/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAmB,cAAc,EAAe,MAAM,cAAc,CAAA;AAEhF,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAED,yFAAyF;AACzF,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,uGAAuG;IACvG,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpE,6EAA6E;IAC7E,cAAc,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnD;AAED,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC3C,CAAA;AAEL,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpE,cAAc,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1D;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,wBAAwB,CAAA;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,oGAAoG;IACpG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C;AAoBD;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM3D;AAED,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS,CAMvF;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAqB7E;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAI1D;AAqBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,iBAAsB,GAC9B,WAAW,CA0Ib"}