@nifrajs/web 4.0.0 → 5.0.0

package/dist/server-components/definition.js

@@ -0,0 +1,94 @@
+import { narrowCapabilityContext } from "@nifrajs/core/capabilities";
+import { validateStandard } from "@nifrajs/core/schema";
+import { outputGuard, runGuard } from "../internal/output-guard.js";
+import { isControlFlow, isStatusSignal } from "../internal/render-document.js";
+import { ServerComponentError } from "./error.js";
+import { assertComponentSchema, componentValue } from "./schema.js";
+const definitions = new WeakMap();
+const authorizations = new WeakMap();
+export function defineServerComponent(definition, reference) {
+    if (typeof definition.authorize !== "function" || typeof definition.load !== "function")
+        throw new ServerComponentError("component_contract");
+    assertComponentSchema(definition.input);
+    assertComponentSchema(definition.props);
+    const component = {
+        view: definition.view,
+        input: definition.input,
+        props: definition.props,
+    };
+    if (reference !== undefined)
+        Object.assign(component, { reference });
+    Object.freeze(component);
+    definitions.set(component, {
+        authorize: definition.authorize,
+        load: definition.load,
+        guard: outputGuard(definition.props, "server component", "props"),
+        capabilities: Object.freeze([...(definition.capabilities ?? [])]),
+    });
+    return component;
+}
+export function isServerComponent(value) {
+    return typeof value === "object" && value !== null && definitions.has(value);
+}
+export function serverComponentCapabilities(component) {
+    const definition = definitions.get(component);
+    if (definition === undefined)
+        throw new ServerComponentError("component_contract");
+    return definition.capabilities;
+}
+export function inheritOwnerAuthorization() { }
+/** Used for whole-owner preflight so an invalid sibling cannot follow successful work. */
+export async function validateServerComponentInput(component, input) {
+    if (!definitions.has(component))
+        throw new ServerComponentError("component_unavailable", 404);
+    componentValue(input, 1024);
+    const parsed = await validateStandard(component.input, input);
+    if (!parsed.ok)
+        throw new ServerComponentError("component_input", 422);
+    componentValue(parsed.value, 1024);
+}
+export async function prepareServerComponent(component, input, ctx) {
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private definition registry binds each schema to its callbacks; validation and authorization precede this erased generic invocation.
+    return (await prepareAuthorizedServerComponent(
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private definition registry binds each schema to its callbacks; validation and authorization precede this erased generic invocation.
+    await authorizeServerComponent(component, input, ctx)));
+}
+export async function authorizeServerComponent(component, input, ctx) {
+    const definition = definitions.get(component);
+    if (definition === undefined)
+        throw new ServerComponentError("component_unavailable", 404);
+    if (ctx.signal.aborted)
+        throw new ServerComponentError("component_cancelled", 499);
+    componentValue(input, 1024);
+    const parsed = await validateStandard(component.input, input);
+    if (!parsed.ok)
+        throw new ServerComponentError("component_input", 422);
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private definition registry binds each schema to its callbacks; validation and authorization precede this erased generic invocation.
+    const scope = narrowCapabilityContext(ctx, definition.capabilities);
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private definition registry binds each schema to its callbacks; validation and authorization precede this erased generic invocation.
+    await definition.authorize(scope, parsed.value);
+    if (ctx.signal.aborted)
+        throw new ServerComponentError("component_cancelled", 499);
+    const token = Object.freeze({});
+    authorizations.set(token, { component, definition, input: parsed.value, scope });
+    return token;
+}
+export async function prepareAuthorizedServerComponent(token) {
+    const authorized = authorizations.get(token);
+    if (authorized === undefined)
+        throw new ServerComponentError("component_contract");
+    authorizations.delete(token);
+    const { component, definition, scope, input } = authorized;
+    if (scope.signal.aborted)
+        throw new ServerComponentError("component_cancelled", 499);
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private definition registry binds each schema to its callbacks; validation and authorization precede this erased generic invocation.
+    const data = await definition.load(scope, input);
+    if (isControlFlow(data) || isStatusSignal(data))
+        throw data;
+    if (scope.signal.aborted)
+        throw new ServerComponentError("component_cancelled", 499);
+    const props = await runGuard(definition.guard, data, "server component props");
+    const publicProps = componentValue(props);
+    return { props: publicProps, view: component.view };
+}
+//# sourceMappingURL=definition.js.map

package/dist/server-components/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","sourceRoot":"","sources":["../../src/server-components/definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAcnE,MAAM,WAAW,GAAG,IAAI,OAAO,EAA6B,CAAA;AAC5D,MAAM,cAAc,GAAG,IAAI,OAAO,EAQ/B,CAAA;AAEH,MAAM,UAAU,qBAAqB,CACnC,UAAyD,EACzD,SAAkB;IAElB,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU;QACrF,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAA;IACtD,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACvC,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,SAAS,GAAwC;QACrD,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACxB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;QACzB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;KAClE,CAAC,CAAA;IACF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAA;IAClF,OAAO,UAAU,CAAC,YAAY,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,yBAAyB,KAAU,CAAC;AAEpD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,SAA0B,EAC1B,KAAc;IAEd,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;IAC7F,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACtE,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA8C,EAC9C,KAAc,EACd,GAA2B;IAE3B,0MAA0M;IAC1M,OAAO,CAAC,MAAM,gCAAgC;IAC5C,0MAA0M;IAC1M,MAAM,wBAAwB,CAAC,SAA4B,EAAE,KAAK,EAAE,GAAG,CAAC,CACzE,CAAyC,CAAA;AAC5C,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAA0B,EAC1B,KAAc,EACd,GAA2B;IAE3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;IAC1F,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;IAClF,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACtE,0MAA0M;IAC1M,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,YAAY,CAA2B,CAAA;IAC7F,0MAA0M;IAC1M,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAc,CAAC,CAAA;IACxD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/B,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAa;IAEb,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAA;IAClF,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAA;IAC1D,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;IACpF,0MAA0M;IAC1M,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,KAAc,CAAC,CAAA;IACzD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,CAAA;IAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC9E,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACzC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC"}

package/dist/server-components/dev-http.d.ts

@@ -0,0 +1,5 @@
+import type { ViteDevServer } from "vite";
+import type { ComponentPipelineOptions } from "./build.js";
+/** The native dev path serves the same factory and Fetch handler as production. */
+export declare function installComponentDevHandler(server: ViteDevServer, options: ComponentPipelineOptions): void;
+//# sourceMappingURL=dev-http.d.ts.map

package/dist/server-components/dev-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-http.d.ts","sourceRoot":"","sources":["../../src/server-components/dev-http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1D,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CAiEN"}

package/dist/server-components/dev-http.js

@@ -0,0 +1,71 @@
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+/** The native dev path serves the same factory and Fetch handler as production. */
+export function installComponentDevHandler(server, options) {
+    if (options.adapter === "react")
+        return; // plugin-rsc owns the SSR request entry in React dev.
+    server.middlewares.use(async (req, res, next) => {
+        const path = req.url ?? "/";
+        if (path.startsWith("/@") ||
+            path.startsWith("/node_modules/") ||
+            /\.(?:[cm]?[jt]sx?|vue|svelte|css)(?:\?|$)/.test(path)) {
+            next();
+            return;
+        }
+        const abort = new AbortController();
+        const close = () => {
+            if (!res.writableEnded)
+                abort.abort();
+        };
+        res.on("close", close);
+        try {
+            const module = await server.ssrLoadModule(options.entries.ssr);
+            if (typeof module.createApp !== "function")
+                throw new Error("[nifra/components] The SSR entry must export createApp(clientEntry, assets)");
+            const app = await module.createApp(`/${options.entries.client.replace(/^\.\//, "")}`, {
+                styles: [],
+            });
+            if (typeof app?.fetch !== "function")
+                throw new Error("component_contract");
+            const headers = new Headers();
+            for (let i = 0; i < req.rawHeaders.length; i += 2)
+                headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);
+            const method = req.method ?? "GET";
+            const init = { method, headers, signal: abort.signal };
+            if (!["GET", "HEAD"].includes(method)) {
+                // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion lint/plugin/noChainedTypeAssertions: Node and Bun name the same WHATWG stream API differently; this zero-copy bridge preserves that ABI.
+                init.body = Readable.toWeb(req);
+                init.duplex = "half";
+            }
+            const request = new Request(new URL(path, `http://${req.headers.host ?? "localhost"}`), init);
+            const response = await app.fetch(request);
+            if (abort.signal.aborted || res.destroyed) {
+                await response.body?.cancel();
+                return;
+            }
+            res.statusCode = response.status;
+            for (const [name, value] of response.headers)
+                if (name !== "set-cookie")
+                    res.setHeader(name, value);
+            const cookies = response.headers.getSetCookie();
+            if (cookies.length > 0)
+                res.setHeader("set-cookie", cookies);
+            // The runtime stream implements Node's Web Streams API despite the distinct TS declarations.
+            if (response.body !== null && method !== "HEAD")
+                await pipeline(Readable.fromWeb(
+                // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion lint/plugin/noChainedTypeAssertions: Node and Bun name the same WHATWG stream API differently; this bridge preserves the stream without copying or decoding.
+                response.body), res);
+            else
+                res.end();
+        }
+        catch (error) {
+            // A disconnected read has no response destination and must not broadcast a Vite error overlay.
+            if (!abort.signal.aborted && !res.destroyed)
+                next(error);
+        }
+        finally {
+            res.off("close", close);
+        }
+    });
+}
+//# sourceMappingURL=dev-http.js.map

package/dist/server-components/dev-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-http.js","sourceRoot":"","sources":["../../src/server-components/dev-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAI/C,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,OAAiC;IAEjC,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,OAAM,CAAC,sDAAsD;IAC9F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC3B,IACE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACjC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EACtD,CAAC;YACD,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACvC,CAAC,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC9D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU;gBACxC,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpF,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;YACF,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;YAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;YAClC,MAAM,IAAI,GAAsC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;YACzF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,yMAAyM;gBACzM,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAA0C,CAAA;gBACxE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;YACtB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;YAC7F,MAAM,QAAQ,GAAa,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;gBAC7B,OAAM;YACR,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAA;YAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO;gBAC1C,IAAI,IAAI,KAAK,YAAY;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAA;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;YAC5D,6FAA6F;YAC7F,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM;gBAC7C,MAAM,QAAQ,CACZ,QAAQ,CAAC,OAAO;gBACd,6NAA6N;gBAC7N,QAAQ,CAAC,IAAuE,CACjF,EACD,GAAG,CACJ,CAAA;;gBACE,GAAG,CAAC,GAAG,EAAE,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+FAA+F;YAC/F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/server-components/error.d.ts

@@ -0,0 +1,9 @@
+export declare const COMPONENT_ERROR_CODES: readonly ["component_contract", "component_input", "component_protocol", "component_limit", "component_denied", "component_unavailable", "component_version", "component_busy", "component_timeout", "component_failed", "component_cancelled"];
+export type ComponentErrorCode = (typeof COMPONENT_ERROR_CODES)[number];
+export declare class ServerComponentError extends Error {
+    readonly code: ComponentErrorCode;
+    readonly status: number;
+    readonly name = "ServerComponentError";
+    constructor(code: ComponentErrorCode, status?: number);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/server-components/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/server-components/error.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,iPAYxB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvE,qBAAa,oBAAqB,SAAQ,KAAK;IAG3C,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAHzB,SAAkB,IAAI,0BAAyB;gBAEpC,IAAI,EAAE,kBAAkB,EACxB,MAAM,GAAE,MAAY;CAIhC"}

package/dist/server-components/error.js

@@ -0,0 +1,24 @@
+export const COMPONENT_ERROR_CODES = [
+    "component_contract",
+    "component_input",
+    "component_protocol",
+    "component_limit",
+    "component_denied",
+    "component_unavailable",
+    "component_version",
+    "component_busy",
+    "component_timeout",
+    "component_failed",
+    "component_cancelled",
+];
+export class ServerComponentError extends Error {
+    code;
+    status;
+    name = "ServerComponentError";
+    constructor(code, status = 500) {
+        super(`[nifra/web] ${code}`);
+        this.code = code;
+        this.status = status;
+    }
+}
+//# sourceMappingURL=error.js.map

package/dist/server-components/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/server-components/error.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,qBAAqB;CACb,CAAA;AAGV,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGlC;IACA;IAHO,IAAI,GAAG,sBAAsB,CAAA;IAC/C,YACW,IAAwB,EACxB,SAAiB,GAAG;QAE7B,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAA;QAHnB,SAAI,GAAJ,IAAI,CAAoB;QACxB,WAAM,GAAN,MAAM,CAAc;IAG/B,CAAC;CACF"}

package/dist/server-components/frames.d.ts

@@ -0,0 +1,7 @@
+export declare function componentFrames(metadata: unknown, value: unknown, maxBytes?: 1048576): ReadableStream<Uint8Array>;
+export interface DecodedComponentFrames {
+    readonly metadata: unknown;
+    readonly value: unknown;
+}
+export declare function readComponentFrames(stream: ReadableStream<Uint8Array>, signal: AbortSignal, maxBytes?: 1048576): Promise<DecodedComponentFrames>;
+//# sourceMappingURL=frames.d.ts.map

package/dist/server-components/frames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.d.ts","sourceRoot":"","sources":["../../src/server-components/frames.ts"],"names":[],"mappings":"AAeA,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,EACd,QAAQ,UAA+B,GACtC,cAAc,CAAC,UAAU,CAAC,CA4B5B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,MAAM,EAAE,WAAW,EACnB,QAAQ,UAA+B,GACtC,OAAO,CAAC,sBAAsB,CAAC,CA0HjC"}

package/dist/server-components/frames.js

@@ -0,0 +1,169 @@
+import { ServerComponentError } from "./error.js";
+import { COMPONENT_LIMITS } from "./protocol.js";
+const magic = new Uint8Array([78, 83, 67, 49]);
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+function frame(type, data) {
+    const bytes = new Uint8Array(data.length + 5);
+    bytes[0] = type;
+    new DataView(bytes.buffer).setUint32(1, data.length);
+    bytes.set(data, 5);
+    return bytes;
+}
+export function componentFrames(metadata, value, maxBytes = COMPONENT_LIMITS.outputBytes) {
+    const meta = encoder.encode(JSON.stringify(metadata));
+    const body = encoder.encode(JSON.stringify(value));
+    if (meta.length > COMPONENT_LIMITS.frameBytes || body.length + meta.length > maxBytes)
+        throw new ServerComponentError("component_limit", 413);
+    let position = -2;
+    return new ReadableStream({
+        pull(controller) {
+            if (position === -2) {
+                controller.enqueue(magic);
+                position++;
+                return;
+            }
+            if (position === -1) {
+                controller.enqueue(frame(1, meta));
+                position++;
+                return;
+            }
+            if (position < body.length) {
+                const end = Math.min(body.length, position + 65536);
+                controller.enqueue(frame(2, body.subarray(position, end)));
+                position = end;
+                return;
+            }
+            controller.enqueue(frame(3, new Uint8Array()));
+            controller.close();
+        },
+    });
+}
+export async function readComponentFrames(stream, signal, maxBytes = COMPONENT_LIMITS.outputBytes) {
+    const reader = stream.getReader();
+    const header = new Uint8Array(5);
+    let magicOffset = 0;
+    let headerOffset = 0;
+    let payload;
+    let payloadOffset = 0;
+    let type = 0;
+    let metadata;
+    let gotMetadata = false;
+    let terminal = false;
+    let bytes = 0;
+    let bodyBytes = 0;
+    let metadataBytes = 0;
+    const body = [];
+    const deadline = AbortSignal.any([signal, AbortSignal.timeout(COMPONENT_LIMITS.operationMs)]);
+    const cancel = () => {
+        void reader.cancel().catch(() => {
+            /* The original read failure is authoritative. */
+        });
+    };
+    deadline.addEventListener("abort", cancel, { once: true });
+    const consume = (data) => {
+        if (type === 1) {
+            if (gotMetadata || bodyBytes !== 0)
+                throw new ServerComponentError("component_protocol", 400);
+            metadataBytes = data.length;
+            metadata = JSON.parse(decoder.decode(data));
+            gotMetadata = true;
+        }
+        else if (type === 2) {
+            if (!gotMetadata || data.length === 0)
+                throw new ServerComponentError("component_protocol", 400);
+            bodyBytes += data.length;
+            if (bodyBytes + metadataBytes > maxBytes)
+                throw new ServerComponentError("component_limit", 413);
+            body.push(data);
+        }
+        else {
+            if (!gotMetadata || bodyBytes === 0 || data.length !== 0)
+                throw new ServerComponentError("component_protocol", 400);
+            terminal = true;
+        }
+    };
+    try {
+        while (true) {
+            if (deadline.aborted)
+                throw new ServerComponentError(signal.aborted ? "component_cancelled" : "component_timeout", 504);
+            let timeout;
+            const next = await Promise.race([
+                reader.read(),
+                new Promise((_, reject) => {
+                    timeout = setTimeout(() => {
+                        reject(new ServerComponentError("component_timeout", 504));
+                        // Publish the timeout before cancellation can resolve reader.read() as ordinary EOF.
+                        cancel();
+                    }, COMPONENT_LIMITS.idleMs);
+                }),
+            ]).finally(() => clearTimeout(timeout));
+            if (next.done)
+                break;
+            if (terminal || next.value.length === 0)
+                throw new ServerComponentError("component_protocol", 400);
+            bytes += next.value.length;
+            if (bytes > maxBytes + 4096)
+                throw new ServerComponentError("component_limit", 413);
+            let offset = 0;
+            while (offset < next.value.length) {
+                if (terminal)
+                    throw new ServerComponentError("component_protocol", 400);
+                if (magicOffset < magic.length) {
+                    if (next.value[offset++] !== magic[magicOffset++])
+                        throw new ServerComponentError("component_protocol", 400);
+                    continue;
+                }
+                if (headerOffset < header.length) {
+                    const size = Math.min(header.length - headerOffset, next.value.length - offset);
+                    header.set(next.value.subarray(offset, offset + size), headerOffset);
+                    offset += size;
+                    headerOffset += size;
+                    if (headerOffset < header.length)
+                        continue;
+                    type = header[0];
+                    const length = new DataView(header.buffer).getUint32(1);
+                    if (length > COMPONENT_LIMITS.frameBytes || ![1, 2, 3].includes(type))
+                        throw new ServerComponentError("component_protocol", 400);
+                    payload = new Uint8Array(length);
+                    payloadOffset = 0;
+                }
+                // A frame allocates once. Arbitrarily split transport chunks are copied exactly once.
+                const data = payload;
+                const size = Math.min(data.length - payloadOffset, next.value.length - offset);
+                data.set(next.value.subarray(offset, offset + size), payloadOffset);
+                offset += size;
+                payloadOffset += size;
+                if (payloadOffset === data.length) {
+                    consume(data);
+                    headerOffset = 0;
+                    payload = undefined;
+                }
+            }
+        }
+        if (deadline.aborted)
+            throw new ServerComponentError(signal.aborted ? "component_cancelled" : "component_timeout", 504);
+        if (!terminal || headerOffset !== 0 || payload !== undefined)
+            throw new ServerComponentError("component_protocol", 400);
+        const merged = new Uint8Array(bodyBytes);
+        let offset = 0;
+        for (const chunk of body) {
+            merged.set(chunk, offset);
+            offset += chunk.length;
+        }
+        return { metadata, value: JSON.parse(decoder.decode(merged)) };
+    }
+    catch (error) {
+        await reader.cancel().catch(() => {
+            /* Preserve the first protocol/read failure. */
+        });
+        if (error instanceof ServerComponentError)
+            throw error;
+        throw new ServerComponentError("component_protocol", 400);
+    }
+    finally {
+        deadline.removeEventListener("abort", cancel);
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=frames.js.map

package/dist/server-components/frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../src/server-components/frames.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAEzD,SAAS,KAAK,CAAC,IAAY,EAAE,IAAgB;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACf,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACpD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAAiB,EACjB,KAAc,EACd,QAAQ,GAAG,gBAAgB,CAAC,WAAW;IAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAClD,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ;QACnF,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACxD,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,OAAO,IAAI,cAAc,CAAC;QACxB,IAAI,CAAC,UAAU;YACb,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACzB,QAAQ,EAAE,CAAA;gBACV,OAAM;YACR,CAAC;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;gBAClC,QAAQ,EAAE,CAAA;gBACV,OAAM;YACR,CAAC;YACD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAA;gBACnD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC1D,QAAQ,GAAG,GAAG,CAAA;gBACd,OAAM;YACR,CAAC;YACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC,CAAA;YAC9C,UAAU,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkC,EAClC,MAAmB,EACnB,QAAQ,GAAG,gBAAgB,CAAC,WAAW;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAChC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,OAA+B,CAAA;IACnC,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,QAAiB,CAAA;IACrB,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,MAAM,IAAI,GAAiB,EAAE,CAAA;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC7F,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,iDAAiD;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;QACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,WAAW,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAC7F,aAAa,GAAG,IAAI,CAAC,MAAM,CAAA;YAC3B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3C,WAAW,GAAG,IAAI,CAAA;QACpB,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnC,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAC3D,SAAS,IAAI,IAAI,CAAC,MAAM,CAAA;YACxB,IAAI,SAAS,GAAG,aAAa,GAAG,QAAQ;gBACtC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,IAAI,SAAS,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACtD,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAC3D,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,QAAQ,CAAC,OAAO;gBAClB,MAAM,IAAI,oBAAoB,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,EAC5D,GAAG,CACJ,CAAA;YACH,IAAI,OAAkD,CAAA;YACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAC9B,MAAM,CAAC,IAAI,EAAE;gBACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;wBACxB,MAAM,CAAC,IAAI,oBAAoB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAA;wBAC1D,qFAAqF;wBACrF,MAAM,EAAE,CAAA;oBACV,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBAC7B,CAAC,CAAC;aACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAK;YACpB,IAAI,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBACrC,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAC3D,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;YAC1B,IAAI,KAAK,GAAG,QAAQ,GAAG,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YACnF,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,QAAQ;oBAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;gBACvE,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;wBAC/C,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;oBAC3D,SAAQ;gBACV,CAAC;gBACD,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;oBAC/E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,YAAY,CAAC,CAAA;oBACpE,MAAM,IAAI,IAAI,CAAA;oBACd,YAAY,IAAI,IAAI,CAAA;oBACpB,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM;wBAAE,SAAQ;oBAC1C,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;oBACjB,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;oBACvD,IAAI,MAAM,GAAG,gBAAgB,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACnE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;oBAC3D,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;oBAChC,aAAa,GAAG,CAAC,CAAA;gBACnB,CAAC;gBACD,sFAAsF;gBACtF,MAAM,IAAI,GAAG,OAAQ,CAAA;gBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;gBAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,aAAa,CAAC,CAAA;gBACnE,MAAM,IAAI,IAAI,CAAA;gBACd,aAAa,IAAI,IAAI,CAAA;gBACrB,IAAI,aAAa,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACb,YAAY,GAAG,CAAC,CAAA;oBAChB,OAAO,GAAG,SAAS,CAAA;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO;YAClB,MAAM,IAAI,oBAAoB,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,EAC5D,GAAG,CACJ,CAAA;QACH,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS;YAC1D,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;QACxB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/B,+CAA+C;QACjD,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,YAAY,oBAAoB;YAAE,MAAM,KAAK,CAAA;QACtD,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;AACH,CAAC"}

package/dist/server-components/html-policy.d.ts

@@ -0,0 +1,6 @@
+/** The same decoded-attribute policy applies before SSR and before DOM insertion. */
+export declare function validateComponentTag(tag: string, attributes: readonly {
+    name: string;
+    value: string;
+}[], assets?: ReadonlySet<string>): void;
+//# sourceMappingURL=html-policy.d.ts.map

package/dist/server-components/html-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-policy.d.ts","sourceRoot":"","sources":["../../src/server-components/html-policy.ts"],"names":[],"mappings":"AA0DA,qFAAqF;AACrF,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,EACtD,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,IAAI,CA8BN"}

package/dist/server-components/html-policy.js

@@ -0,0 +1,75 @@
+import { ServerComponentError } from "./error.js";
+const forbidden = new Set([
+    "script",
+    "iframe",
+    "object",
+    "embed",
+    "applet",
+    "base",
+    "meta",
+    "link",
+    "style",
+    "template",
+    "noscript",
+    "xmp",
+    "noembed",
+    "noframes",
+    "plaintext",
+    "frame",
+    "frameset",
+    "animate",
+    "animatemotion",
+    "animatetransform",
+    "set",
+]);
+const urls = new Set([
+    "href",
+    "src",
+    "xlink:href",
+    "action",
+    "formaction",
+    "poster",
+    "background",
+    "cite",
+    "data",
+    "codebase",
+]);
+const fail = () => {
+    throw new ServerComponentError("component_protocol", 400);
+};
+function css(value) {
+    return (value
+        .replace(/\/\*[\s\S]*?\*\//g, "")
+        .replace(/\\([0-9a-f]{1,6})\s?|\\([^\r\n])/gi, (_all, hex, char) => hex === undefined
+        ? (char ?? "")
+        : String.fromCodePoint(Math.min(parseInt(hex, 16), 0x10ffff)))
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: URL/CSS schemes must be checked after stripping ASCII controls.
+        .replace(/[\u0000-\u0020\u007f]/g, "")
+        .toLowerCase());
+}
+/** The same decoded-attribute policy applies before SSR and before DOM insertion. */
+export function validateComponentTag(tag, attributes, assets) {
+    if (tag.toLowerCase() === "link" && assets !== undefined) {
+        const attrs = new Map(attributes.map((attribute) => [attribute.name.toLowerCase(), attribute.value]));
+        if (!["preload", "modulepreload"].includes(attrs.get("rel") ?? "") ||
+            !assets.has(attrs.get("href") ?? "") ||
+            [...attrs.keys()].some((name) => !["rel", "href", "as", "crossorigin", "fetchpriority"].includes(name)))
+            fail();
+        return;
+    }
+    if (forbidden.has(tag.toLowerCase()))
+        fail();
+    for (const attribute of attributes) {
+        const name = attribute.name.toLowerCase();
+        // biome-ignore lint/suspicious/noControlCharactersInRegex: Browsers discard these controls when interpreting URL schemes.
+        const value = attribute.value.replace(/[\u0000-\u0020\u007f]/g, "").toLowerCase();
+        if (name.startsWith("on") || ["srcdoc", "is", "srcset", "ping"].includes(name))
+            fail();
+        if (urls.has(name) && /^(?:javascript|vbscript|data):/.test(value))
+            fail();
+        if (name === "style" &&
+            /expression\(|@import|(?:javascript|vbscript|data):|-moz-binding|behavior:/.test(css(attribute.value)))
+            fail();
+    }
+}
+//# sourceMappingURL=html-policy.js.map

package/dist/server-components/html-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-policy.js","sourceRoot":"","sources":["../../src/server-components/html-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,UAAU;IACV,KAAK;IACL,SAAS;IACT,UAAU;IACV,WAAW;IACX,OAAO;IACP,UAAU;IACV,SAAS;IACT,eAAe;IACf,kBAAkB;IAClB,KAAK;CACN,CAAC,CAAA;AACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,MAAM;IACN,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,UAAU;CACX,CAAC,CAAA;AACF,MAAM,IAAI,GAAG,GAAU,EAAE;IACvB,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;AAC3D,CAAC,CAAA;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,CACL,KAAK;SACF,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CACN,oCAAoC,EACpC,CAAC,IAAI,EAAE,GAAuB,EAAE,IAAwB,EAAE,EAAE,CAC1D,GAAG,KAAK,SAAS;QACf,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAClE;QACD,2HAA2H;SAC1H,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,WAAW,EAAE,CACjB,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAsD,EACtD,MAA4B;IAE5B,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAC/E,CAAA;QACD,IACE,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9D,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChF;YAED,IAAI,EAAE,CAAA;QACR,OAAM;IACR,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAAE,IAAI,EAAE,CAAA;IAC5C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACzC,0HAA0H;QAC1H,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACjF,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,EAAE,CAAA;QACtF,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,CAAA;QAC1E,IACE,IAAI,KAAK,OAAO;YAChB,2EAA2E,CAAC,IAAI,CAC9E,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CACrB;YAED,IAAI,EAAE,CAAA;IACV,CAAC;AACH,CAAC"}

package/dist/server-components/html.d.ts

@@ -0,0 +1,4 @@
+export declare function validateComponentHTML(html: string, assets?: ReadonlySet<string>): void;
+/** React may produce resource hints while decoding Flight. They are not owned range nodes. */
+export declare function componentRangeHTML(html: string, assets: ReadonlySet<string>): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/server-components/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/server-components/html.ts"],"names":[],"mappings":"AAgEA,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAEtF;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAWpF"}

package/dist/server-components/html.js

@@ -0,0 +1,67 @@
+import { Tokenizer } from "parse5";
+import { ServerComponentError } from "./error.js";
+import { validateComponentTag } from "./html-policy.js";
+import { COMPONENT_LIMITS } from "./protocol.js";
+/**
+ * A browser reads `title` and `textarea` content as RCDATA, where `<!--` and tags are text, but
+ * only in an HTML context; a bare tokenizer never switches. Content holding no `<` before its own
+ * end tag tokenizes the same either way, so requiring that keeps this check exact wherever the
+ * HTML is inserted. Every other text-mode element is forbidden outright.
+ */
+function closesAsText(html, tag, from) {
+    const next = html.indexOf("<", from);
+    const after = next + 2 + tag.length;
+    return (next !== -1 &&
+        html.slice(next, after).toLowerCase() === `</${tag}` &&
+        /^[\t\n\f />]$/.test(html[after] ?? ""));
+}
+/** Tokenization validates attributes even in SVG/table contexts a document parser may discard. */
+function tokenize(html, assets, hints) {
+    if (new TextEncoder().encode(html).length > COMPONENT_LIMITS.outputBytes)
+        throw new ServerComponentError("component_limit", 413);
+    const tokenizer = new Tokenizer({ sourceCodeLocationInfo: true }, {
+        onStartTag(token) {
+            validateComponentTag(token.tagName, token.attrs, assets);
+            if ((token.tagName === "title" || token.tagName === "textarea") &&
+                (token.location === null || !closesAsText(html, token.tagName, token.location.endOffset)))
+                throw new ServerComponentError("component_protocol", 400);
+            if (token.tagName === "link" && token.location !== null)
+                hints?.push({ start: token.location.startOffset, end: token.location.endOffset });
+        },
+        onEndTag() { },
+        onComment() { },
+        onEof() { },
+        onCharacter() { },
+        onWhitespaceCharacter() { },
+        onNullCharacter() {
+            throw new ServerComponentError("component_protocol", 400);
+        },
+        onDoctype() {
+            throw new ServerComponentError("component_protocol", 400);
+        },
+        onParseError(error) {
+            // `<!>` (Solid's template markers, `<!$>` and `<!/>` too) is a comment to the tokenizer and to
+            // every browser alike; any other parse error is refused.
+            if (error.code !== "incorrectly-opened-comment")
+                throw new ServerComponentError("component_protocol", 400);
+        },
+    });
+    tokenizer.write(html, true);
+}
+export function validateComponentHTML(html, assets) {
+    tokenize(html, assets);
+}
+/** React may produce resource hints while decoding Flight. They are not owned range nodes. */
+export function componentRangeHTML(html, assets) {
+    const hints = [];
+    tokenize(html, assets, hints);
+    const parts = [];
+    let offset = 0;
+    for (const hint of hints) {
+        parts.push(html.slice(offset, hint.start));
+        offset = hint.end;
+    }
+    parts.push(html.slice(offset));
+    return parts.join("");
+}
+//# sourceMappingURL=html.js.map

package/dist/server-components/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/server-components/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAA;IACnC,OAAO,CACL,IAAI,KAAK,CAAC,CAAC;QACX,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,GAAG,EAAE;QACpD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CACxC,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,QAAQ,CACf,IAAY,EACZ,MAA4B,EAC5B,KAA6C;IAE7C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,WAAW;QACtE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAChC;QACE,UAAU,CAAC,KAAK;YACd,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACxD,IACE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC;gBAC3D,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAEzF,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAC3D,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;gBACrD,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;QACrF,CAAC;QACD,QAAQ,KAAI,CAAC;QACb,SAAS,KAAI,CAAC;QACd,KAAK,KAAI,CAAC;QACV,WAAW,KAAI,CAAC;QAChB,qBAAqB,KAAI,CAAC;QAC1B,eAAe;YACb,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QACD,SAAS;YACP,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QACD,YAAY,CAAC,KAAK;YAChB,+FAA+F;YAC/F,yDAAyD;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B;gBAC7C,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;KACF,CACF,CAAA;IACD,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAA4B;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAA2B;IAC1E,MAAM,KAAK,GAA0C,EAAE,CAAA;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1C,MAAM,GAAG,IAAI,CAAC,GAAG,CAAA;IACnB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC"}