higgsfield-ai/skills

"owner": {     "name": "Higgsfield AI",     "url": "https://higgsfield.ai"

"name": "Higgsfield AI",     "url": "https://higgsfield.ai"   },

"url": "https://higgsfield.ai"

"author": {     "name": "Higgsfield AI",     "url": "https://higgsfield.ai"

"name": "Higgsfield AI",     "url": "https://higgsfield.ai"   },

"url": "https://higgsfield.ai"

},   "homepage": "https://higgsfield.ai",   "repository": "https://github.com/higgsfield-ai/skills",

"homepage": "https://higgsfield.ai",

"repository": "https://github.com/higgsfield-ai/skills",

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

https://docs.google.com/presentation/d/1rAfUJ-PbZ4S-h3puYSUHpE5UIcdKyRw1/export/pptx

{   "name": "northline-symbol",   "logo_svg": "https://replace-with-selected-recraft-result.svg",

"name": "northline-symbol",   "logo_svg": "https://replace-with-selected-recraft-result.svg",   "delivery": "user",

"logo_svg": "https://replace-with-selected-recraft-result.svg",

sudo apt-get update

sudo apt-get install -y imagemagick librsvg2-bin poppler-utils fontconfig libreoffice

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

"asset": {       "id": "replace-with-upload-or-job-id",       "url": "https://replace-with-exact-approved-logo.svg"

"id": "replace-with-upload-or-job-id",       "url": "https://replace-with-exact-approved-logo.svg"     },

"url": "https://replace-with-exact-approved-logo.svg"

},     "font_links": [       "https://fonts.google.com/specimen/Fraunces",

"font_links": [       "https://fonts.google.com/specimen/Fraunces",       "https://fonts.google.com/specimen/Inter"

"https://fonts.google.com/specimen/Fraunces",

"https://fonts.google.com/specimen/Inter"

#!/usr/bin/env python3

encoded = google_family.replace(" ", "+")         css = (             '@import url("https://fonts.googleapis.com/css2?family='

css = (             '@import url("https://fonts.googleapis.com/css2?family='             f"{html.escape(encoded)}:wght@{weight}&display=swap\");"

'@import url("https://fonts.googleapis.com/css2?family='

#!/usr/bin/env python3

TEMPLATE_URL = (     "https://docs.google.com/presentation/d/"

"https://docs.google.com/presentation/d/"

relationship_id: str,     target: str,     relation_type: str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image",

target: str,     relation_type: str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image", ) -> str:

relation_type: str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image",

relationship_id,             f"slides/slide{slide_number}.xml",             "http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide",

f"slides/slide{slide_number}.xml",             "http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide",         ),

"http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide",

if signature == b"\x00\x01\x00\x00":

axis = f"ital,wght@1,{weight}" if style == "italic" else f"wght@{weight}"         css_url = (             "https://fonts.googleapis.com/css2?family="

css_url = (             "https://fonts.googleapis.com/css2?family="             + quote(requested).replace("%20", "+")

"https://fonts.googleapis.com/css2?family="

#!/usr/bin/env python3

[Credential-related source omitted]

Bash

Bash

#!/usr/bin/env bash

#!/usr/bin/env bash

echo "ERROR: --last-visual-only requires --last-seconds in (0,3]" >&2; exit 1; } fi for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done

echo "ERROR: --last-visual-only requires --last-seconds in (0,3]" >&2; exit 1; } fi for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done

fi for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done n=${#ARGS[@]}

fi for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done n=${#ARGS[@]}

for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done

for b in ffmpeg ffprobe curl awk python3; do command -v "$b" >/dev/null 2>&1 || { echo "ERROR: '$b' not found" >&2; exit 1; }; done

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT fetch(){ if [[ "$1" == http://* || "$1" == https://* ]]; then curl -fsSL "$1" -o "$2"; else [[ -f "$1" ]] || { echo "ERROR: not found: $1" >&2; exit 1; }; cp "$1" "$2"; fi; }

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT fetch(){ if [[ "$1" == http://* || "$1" == https://* ]]; then curl -fsSL "$1" -o "$2"; else [[ -f "$1" ]] || { echo "ERROR: not found: $1" >&2; exit 1; }; cp "$1" "$2"; fi; }

fetch(){ if [[ "$1" == http://* || "$1" == https://* ]]; then curl -fsSL "$1" -o "$2"; else [[ -f "$1" ]] || { echo "ERROR: not found: $1" >&2; exit 1; }; cp "$1" "$2"; fi; }

fetch(){ if [[ "$1" == http://* || "$1" == https://* ]]; then curl -fsSL "$1" -o "$2"; else [[ -f "$1" ]] || { echo "ERROR: not found: $1" >&2; exit 1; }; cp "$1" "$2"; fi; }

#!/usr/bin/env bash

#!/usr/bin/env bash

rm -rf "$TMP"

rm -rf "$TMP"

#!/usr/bin/env bash

#!/usr/bin/env bash

rm -rf "$TMP"

rm -rf "$TMP"

#!/usr/bin/env bash

#!/usr/bin/env bash

trap 'rm -rf "$TMP"' EXIT

trap 'rm -rf "$TMP"' EXIT

if not isinstance(frame_job_id, str) or not frame_job_id.strip():         raise SystemExit(f"ERROR: timeline frame {expected} frame_job_id is missing")     if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://"

if not isinstance(frame_job_id, str) or not frame_job_id.strip():         raise SystemExit(f"ERROR: timeline frame {expected} frame_job_id is missing")     if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://"

raise SystemExit(f"ERROR: timeline frame {expected} frame_job_id is missing")     if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://")):         raise SystemExit(f"ERROR: timeline frame {expected} frame_url 

raise SystemExit(f"ERROR: timeline frame {expected} frame_job_id is missing")     if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://")):         raise SystemExit(f"ERROR: timeline frame {expected} frame_url 

if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://")):

if not isinstance(frame_url, str) or not frame_url.startswith(("http://", "https://")):

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env bash

#!/usr/bin/env bash

# Font: put a bold face at scripts/fonts/ — default family "TikTok Sans" # (TikTokSans-Bold.ttf, SIL OFL, Latin+Cyrillic+Greek; see fonts/README.md for the # curl one-liner). Binaries are not committed; without a .ttf libass falls back to a

# Font: put a bold face at scripts/fonts/ — default family "TikTok Sans" # (TikTokSans-Bold.ttf, SIL OFL, Latin+Cyrillic+Greek; see fonts/README.md for the # curl one-liner). Binaries are not committed; without a .ttf libass falls back to a

# (TikTokSans-Bold.ttf, SIL OFL, Latin+Cyrillic+Greek; see fonts/README.md for the # curl one-liner). Binaries are not committed; without a .ttf libass falls back to a # system font (the script warns — the look will differ).

# (TikTokSans-Bold.ttf, SIL OFL, Latin+Cyrillic+Greek; see fonts/README.md for the # curl one-liner). Binaries are not committed; without a .ttf libass falls back to a # system font (the script warns — the look will differ).

# curl one-liner). Binaries are not committed; without a .ttf libass falls back to a

# curl one-liner). Binaries are not committed; without a .ttf libass falls back to a

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env bash

#!/usr/bin/env bash

rm -f "$png"; rmdir "$temp_dir"; echo "$QC"; return $rc

rm -f "$png"; rmdir "$temp_dir"; echo "$QC"; return $rc

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

'shots': shots(n * 400), 'assets_used': [location, 'seed_prop']}                          for n, role, location in [(1, 'hook', 'soil'), (2, 'turn', 'garden'), (3, 'payoff', 'greenhouse')]],               'sources': ['https://example.com/pl

'shots': shots(n * 400), 'assets_used': [location, 'seed_prop']}                          for n, role, location in [(1, 'hook', 'soil'), (2, 'turn', 'garden'), (3, 'payoff', 'greenhouse')]],               'sources': ['https://example.com/pl

for n, role, location in [(1, 'hook', 'soil'), (2, 'turn', 'garden'), (3, 'payoff', 'greenhouse')]],               'sources': ['https://example.com/plants']}     result = validator._validate(script, 30)

for n, role, location in [(1, 'hook', 'soil'), (2, 'turn', 'garden'), (3, 'payoff', 'greenhouse')]],               'sources': ['https://example.com/plants']}     result = validator._validate(script, 30)

'sources': ['https://example.com/plants']}

'sources': ['https://example.com/plants']}

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

assert frames and all(f["duration"] <= 1.5 for f in frames)     results = {"results": [{"output_slot": f["output_slot"], "job_id": f"id-{f['n']}",                             "result_url": f"https://example.test/{f['n']}.png", "status": "co

assert frames and all(f["duration"] <= 1.5 for f in frames)     results = {"results": [{"output_slot": f["output_slot"], "job_id": f"id-{f['n']}",                             "result_url": f"https://example.test/{f['n']}.png", "status": "co

results = {"results": [{"output_slot": f["output_slot"], "job_id": f"id-{f['n']}",                             "result_url": f"https://example.test/{f['n']}.png", "status": "completed",                             "params": {"medias": [{"ro

results = {"results": [{"output_slot": f["output_slot"], "job_id": f"id-{f['n']}",                             "result_url": f"https://example.test/{f['n']}.png", "status": "completed",                             "params": {"medias": [{"ro

"result_url": f"https://example.test/{f['n']}.png", "status": "completed",

"result_url": f"https://example.test/{f['n']}.png", "status": "completed",

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

Bash

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

- **Setting** — reusable environment / scene context. Browse with `higgsfield marketing-studio settings list`. - **Ad reference** — reusable inspiration video that can be bound to an avatar and/or product. Created from an uploaded video (`-

- **Setting** — reusable environment / scene context. Browse with `higgsfield marketing-studio settings list`. - **Ad reference** — reusable inspiration video that can be bound to an avatar and/or product. Created from an uploaded video (`-

- **Ad reference** — reusable inspiration video that can be bound to an avatar and/or product. Created from an uploaded video (`--video-input <upload_id>`) or a previous generation job (`--job <job_id>`). Browse with `higgsfield marketing-s

- **Ad reference** — reusable inspiration video that can be bound to an avatar and/or product. Created from an uploaded video (`--video-input <upload_id>`) or a previous generation job (`--job <job_id>`). Browse with `higgsfield marketing-s

- **Brand kit** — captures a brand's identity (name, logo, hero images, colours, fonts, tone) for reuse across image generations. Created by handing in a website URL (`higgsfield marketing-studio brand-kits fetch --url https://… --wait`). S

- **Brand kit** — captures a brand's identity (name, logo, hero images, colours, fonts, tone) for reuse across image generations. Created by handing in a website URL (`higgsfield marketing-studio brand-kits fetch --url https://… --wait`). S

# 1. Trigger fetch (returns the product id, import runs in the background)

# 1. Trigger fetch (returns the product id, import runs in the background)

higgsfield marketing-studio products fetch --url https://shop.example.com/sneakers --wait

higgsfield marketing-studio products fetch --url https://shop.example.com/sneakers --wait

# 2. Generate the marketing video against the same URL — backend reuses the entity higgsfield generate create marketing_studio_video \   --url https://shop.example.com/sneakers \

# 2. Generate the marketing video against the same URL — backend reuses the entity higgsfield generate create marketing_studio_video \   --url https://shop.example.com/sneakers \

higgsfield generate create marketing_studio_video    --url https://shop.example.com/sneakers

higgsfield generate create marketing_studio_video    --url https://shop.example.com/sneakers

--url https://shop.example.com/sneakers \

--url https://shop.example.com/sneakers \

# Fire and forget — returns the id, fetch runs in the background KIT_ID=$(higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --json | jq -r .id)

# Fire and forget — returns the id, fetch runs in the background KIT_ID=$(higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --json | jq -r .id)

KIT_ID=$(higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --json | jq -r .id)

KIT_ID=$(higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --json | jq -r .id)

# Block until the kit is completed or failed (typical 30–90s) higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait

# Block until the kit is completed or failed (typical 30–90s) higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait

higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait

higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait

higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait --timeout 180s

higgsfield marketing-studio brand-kits fetch --url https://drinkolipop.com --wait --timeout 180s

Two ways to register a product: URL fetch (auto-imports title, description, images) or manual (provide your own).

Two ways to register a product: URL fetch (auto-imports title, description, images) or manual (provide your own).

## URL fetch (default)

## URL fetch (default)

ID=$(higgsfield marketing-studio products fetch --url https://shop.example.com/sneakers --wait --json | jq -r .id)

ID=$(higgsfield marketing-studio products fetch --url https://shop.example.com/sneakers --wait --json | jq -r .id)

higgsfield marketing-studio webproducts fetch --url https://apps.apple.com/... --wait

higgsfield marketing-studio webproducts fetch --url https://apps.apple.com/... --wait

higgsfield marketing-studio webproducts create \   --url "https://example.com" \

higgsfield marketing-studio webproducts create \   --url "https://example.com" \

--url "https://example.com" \

--url "https://example.com" \

--subtitle "Productivity for teams" \   --description "..." \   --favicon-url "https://example.com/favicon.png" \

--subtitle "Productivity for teams" \   --description "..." \   --favicon-url "https://example.com/favicon.png" \

--description "..." \   --favicon-url "https://example.com/favicon.png" \   --desktop "https://cdn/screenshot1.png" \

--description "..." \   --favicon-url "https://example.com/favicon.png" \   --desktop "https://cdn/screenshot1.png" \

--favicon-url "https://example.com/favicon.png" \

--favicon-url "https://example.com/favicon.png" \

--desktop "https://cdn/screenshot1.png" \

--desktop "https://cdn/screenshot1.png" \

--mobile "https://cdn/mobile-screenshot.png"

--mobile "https://cdn/mobile-screenshot.png"

Bash

Bash

1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh`.

1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh`.

1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh`.

1. If `higgsfield` is not on `$PATH`, install it by running the official installer with Bash: `curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh`.

Marketplace cards ready: - Main image: https://...

Marketplace cards ready: - Main image: https://...

- Main image: https://...

- Main image: https://...

- Infographic: https://...

- Infographic: https://...

- Lifestyle: https://...

- Lifestyle: https://...

Bash

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

3 lifestyle shots ready: - https://cdn.higgsfield.ai/.../job_abc.jpg

3 lifestyle shots ready: - https://cdn.higgsfield.ai/.../job_abc.jpg

- https://cdn.higgsfield.ai/.../job_abc.jpg

- https://cdn.higgsfield.ai/.../job_abc.jpg

- https://cdn.higgsfield.ai/.../job_def.jpg

- https://cdn.higgsfield.ai/.../job_def.jpg

- https://cdn.higgsfield.ai/.../job_ghi.jpg

- https://cdn.higgsfield.ai/.../job_ghi.jpg

Bash

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

Bash

Bash

Bash

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

intended mood as repeated `--image` flags (the CLI auto-imports http(s) URLs) — they carry grade/energy only; never let a ref's content leak into the concept. Hosted at `https://static.higgsfield.ai/website-builder/app-cover-generator/refs/

intended mood as repeated `--image` flags (the CLI auto-imports http(s) URLs) — they carry grade/energy only; never let a ref's content leak into the concept. Hosted at `https://static.higgsfield.ai/website-builder/app-cover-generator/refs/

Hosted at `https://static.higgsfield.ai/website-builder/app-cover-generator/refs/`:

Hosted at `https://static.higgsfield.ai/website-builder/app-cover-generator/refs/`:

higgsfield generate create gpt_image_2 \   --aspect_ratio 3:2 --quality high --resolution 2k --count 2 \   --image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \

higgsfield generate create gpt_image_2 \   --aspect_ratio 3:2 --quality high --resolution 2k --count 2 \   --image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \

--aspect_ratio 3:2 --quality high --resolution 2k --count 2 \   --image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \   --prompt "<scene prompt — ends with: no text, no letters, no logos, no cap

--aspect_ratio 3:2 --quality high --resolution 2k --count 2 \   --image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \   --prompt "<scene prompt — ends with: no text, no letters, no logos, no cap

--image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \

--image https://static.higgsfield.ai/website-builder/app-cover-generator/refs/scene-epic-film.jpg \

Open your `_og.png` NEXT TO the official covers at `https://static.higgsfield.ai/website-builder/app-cover-generator/layout/layout-hooks.jpg`

Open your `_og.png` NEXT TO the official covers at `https://static.higgsfield.ai/website-builder/app-cover-generator/layout/layout-hooks.jpg`

`https://static.higgsfield.ai/website-builder/app-cover-generator/layout/layout-hooks.jpg`

`https://static.higgsfield.ai/website-builder/app-cover-generator/layout/layout-hooks.jpg`

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"COVER_ASSET_BASE",     "https://static.higgsfield.ai/website-builder/app-cover-generator", ).rstrip("/")

"COVER_ASSET_BASE",     "https://static.higgsfield.ai/website-builder/app-cover-generator", ).rstrip("/")

"https://static.higgsfield.ai/website-builder/app-cover-generator",

"https://static.higgsfield.ai/website-builder/app-cover-generator",

[Credential-related source omitted]

[Credential-related source omitted]

try:         # A browser-ish User-Agent — some CDNs/WAFs 403 the default urllib UA.         req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

try:         # A browser-ish User-Agent — some CDNs/WAFs 403 the default urllib UA.         req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

# A browser-ish User-Agent — some CDNs/WAFs 403 the default urllib UA.         req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})         with urllib.request.urlopen(req, timeout=30) as r:  # noqa: S310 (trusted host)

# A browser-ish User-Agent — some CDNs/WAFs 403 the default urllib UA.         req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})         with urllib.request.urlopen(req, timeout=30) as r:  # noqa: S310 (trusted host)

req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

with urllib.request.urlopen(req, timeout=30) as r:  # noqa: S310 (trusted host)

with urllib.request.urlopen(req, timeout=30) as r:  # noqa: S310 (trusted host)

Call Higgsfield internal services exclusively from server code at `https://fnf.internal/*` (the platform attaches the user's identity on server

Call Higgsfield internal services exclusively from server code at `https://fnf.internal/*` (the platform attaches the user's identity on server

`https://fnf.internal/*` (the platform attaches the user's identity on server

`https://fnf.internal/*` (the platform attaches the user's identity on server

egress, so tokens never live in app code). NEVER call `https://fnf.internal/*`

egress, so tokens never live in app code). NEVER call `https://fnf.internal/*`

When creating SDK clients, use only `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` — imported

When creating SDK clients, use only `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` — imported

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` — imported

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` — imported

Schema in `app/migrations/000N_*.sql` (additive; rule 5). - **Real fnf integration.** Generations, media, profile, and credits come from   the live SDK against `https://fnf.internal`, never hardcoded fixtures.

Schema in `app/migrations/000N_*.sql` (additive; rule 5). - **Real fnf integration.** Generations, media, profile, and credits come from   the live SDK against `https://fnf.internal`, never hardcoded fixtures.

the live SDK against `https://fnf.internal`, never hardcoded fixtures.

the live SDK against `https://fnf.internal`, never hardcoded fixtures.

`src/` is the single biggest time sink. If a detail is truly missing, make the    reasonable call and let `bun run typecheck` catch a mistake. 2. **fnf runs server-side only** against `https://fnf.internal` — never from the

`src/` is the single biggest time sink. If a detail is truly missing, make the    reasonable call and let `bun run typecheck` catch a mistake. 2. **fnf runs server-side only** against `https://fnf.internal` — never from the

reasonable call and let `bun run typecheck` catch a mistake. 2. **fnf runs server-side only** against `https://fnf.internal` — never from the    browser, never with tokens in app code (`references/auth.md`, rule 3 in

reasonable call and let `bun run typecheck` catch a mistake. 2. **fnf runs server-side only** against `https://fnf.internal` — never from the    browser, never with tokens in app code (`references/auth.md`, rule 3 in

2. **fnf runs server-side only** against `https://fnf.internal` — never from the

2. **fnf runs server-side only** against `https://fnf.internal` — never from the

handlers: {       GET: async () => {         const upstream = await fetch('https://fnf.internal/user')

handlers: {       GET: async () => {         const upstream = await fetch('https://fnf.internal/user')

GET: async () => {         const upstream = await fetch('https://fnf.internal/user')         const body = await upstream.text()

GET: async () => {         const upstream = await fetch('https://fnf.internal/user')         const body = await upstream.text()

const upstream = await fetch('https://fnf.internal/user')

const upstream = await fetch('https://fnf.internal/user')

// Browser: read the current user; null = signed out (don't crash the page) export async function fetchCurrentUser() {   const res = await fetch('/api/user', { credentials: 'include' })

// Browser: read the current user; null = signed out (don't crash the page) export async function fetchCurrentUser() {   const res = await fetch('/api/user', { credentials: 'include' })

export async function fetchCurrentUser() {   const res = await fetch('/api/user', { credentials: 'include' })   if (res.status === 401) return null

export async function fetchCurrentUser() {   const res = await fetch('/api/user', { credentials: 'include' })   if (res.status === 401) return null

const res = await fetch('/api/user', { credentials: 'include' })

const res = await fetch('/api/user', { credentials: 'include' })

const adapter = createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })

const adapter = createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

- Browser code must call app-local endpoints only. - Server code may call `https://fnf.internal/*`.

- Browser code must call app-local endpoints only. - Server code may call `https://fnf.internal/*`.

- Server code may call `https://fnf.internal/*`.

- Server code may call `https://fnf.internal/*`.

- Do not send auth headers to `fnf.internal`; identity is attached by the   platform/runtime automatically. - Do not call `https://fnf.internal/*` from the browser. It is not reachable

- Do not send auth headers to `fnf.internal`; identity is attached by the   platform/runtime automatically. - Do not call `https://fnf.internal/*` from the browser. It is not reachable

platform/runtime automatically. - Do not call `https://fnf.internal/*` from the browser. It is not reachable   there and would be a security bug even if it were.

platform/runtime automatically. - Do not call `https://fnf.internal/*` from the browser. It is not reachable   there and would be a security bug even if it were.

- Do not call `https://fnf.internal/*` from the browser. It is not reachable

- Do not call `https://fnf.internal/*` from the browser. It is not reachable

| Purpose | Endpoint | Caller | |---|---|---| | Current user profile | `GET https://fnf.internal/user` | server only |

| Purpose | Endpoint | Caller | |---|---|---| | Current user profile | `GET https://fnf.internal/user` | server only |

|---|---|---| | Current user profile | `GET https://fnf.internal/user` | server only | | Browser-safe user proxy | `GET /api/user` | frontend/browser |

|---|---|---| | Current user profile | `GET https://fnf.internal/user` | server only | | Browser-safe user proxy | `GET /api/user` | frontend/browser |

| Current user profile | `GET https://fnf.internal/user` | server only |

| Current user profile | `GET https://fnf.internal/user` | server only |

`GET https://fnf.internal/user` returns the current user's profile JSON and

`GET https://fnf.internal/user` returns the current user's profile JSON and

`GET /api/user` must call `https://fnf.internal/user` server-side and return the same status code and JSON body unchanged. This endpoint is the only user-profile endpoint browser components should fetch.

`GET /api/user` must call `https://fnf.internal/user` server-side and return the same status code and JSON body unchanged. This endpoint is the only user-profile endpoint browser components should fetch.

| Website need | Auth mode | Required behavior | |---|---|---| | Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and s

| Website need | Auth mode | Required behavior | |---|---|---| | Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and s

|---|---|---| | Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and server-side `https://fnf.internal` guards | | The 

|---|---|---| | Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and server-side `https://fnf.internal` guards | | The 

| Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and server-side `https://fnf.internal` guards |

| Higgsfield SDK/model generation, media upload, profile, workspace, credits, feed/history | Higgsfield platform auth | Use `/api/user`, `/__auth/login`, `/__auth/logout`, and server-side `https://fnf.internal` guards |

handlers: {       GET: async () => {         const upstream = await fetch('https://fnf.internal/user')

handlers: {       GET: async () => {         const upstream = await fetch('https://fnf.internal/user')

GET: async () => {         const upstream = await fetch('https://fnf.internal/user')         const body = await upstream.text()

GET: async () => {         const upstream = await fetch('https://fnf.internal/user')         const body = await upstream.text()

const upstream = await fetch('https://fnf.internal/user')

const upstream = await fetch('https://fnf.internal/user')

export async function fetchCurrentUser() {   const response = await fetch('/api/user', { credentials: 'include' })

export async function fetchCurrentUser() {   const response = await fetch('/api/user', { credentials: 'include' })

const response = await fetch('/api/user', { credentials: 'include' })

const response = await fetch('/api/user', { credentials: 'include' })

const response = await fetch(downloadUrl, {

const response = await fetch(downloadUrl, {

For generated websites using the fnf SDK, create SDK adapters server-side with `baseUrl: 'https://fnf.internal'`. The auth boundary above is for website UI

For generated websites using the fnf SDK, create SDK adapters server-side with `baseUrl: 'https://fnf.internal'`. The auth boundary above is for website UI

`baseUrl: 'https://fnf.internal'`. The auth boundary above is for website UI

`baseUrl: 'https://fnf.internal'`. The auth boundary above is for website UI

4. Disable or hide submit/upload/cost/profile controls while signed out. 5. Every server function or server route that performs an SDK operation must    call `https://fnf.internal/user` first and stop on `401`.

4. Disable or hide submit/upload/cost/profile controls while signed out. 5. Every server function or server route that performs an SDK operation must    call `https://fnf.internal/user` first and stop on `401`.

call `https://fnf.internal/user` first and stop on `401`.

call `https://fnf.internal/user` first and stop on `401`.

// app/src/lib/auth.server.ts export async function requireCurrentUser() {   const response = await fetch('https://fnf.internal/user')

// app/src/lib/auth.server.ts export async function requireCurrentUser() {   const response = await fetch('https://fnf.internal/user')

export async function requireCurrentUser() {   const response = await fetch('https://fnf.internal/user')   const body = await response.json().catch(() => null)

export async function requireCurrentUser() {   const response = await fetch('https://fnf.internal/user')   const body = await response.json().catch(() => null)

const response = await fetch('https://fnf.internal/user')

const response = await fetch('https://fnf.internal/user')

await fetch('https://fnf.internal/user') // bad in browser code

await fetch('https://fnf.internal/user') // bad in browser code

await fetch('/api/user')                 // good in browser code

await fetch('/api/user')                 // good in browser code

fetch('https://fnf.internal/user', {

fetch('https://fnf.internal/user', {

RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*

RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*

http.createServer(async (req, res) => {   const url = new URL(req.url, "http://c");

http.createServer(async (req, res) => {   const url = new URL(req.url, "http://c");

const url = new URL(req.url, "http://c");

const url = new URL(req.url, "http://c");

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

//   await fetch(`${job.appBaseUrl}/api/whatever`,

//   await fetch(`${job.appBaseUrl}/api/whatever`,

private async bootAndStart(job: any) {     try {       await this.containerFetch("http://c/start", {

private async bootAndStart(job: any) {     try {       await this.containerFetch("http://c/start", {

try {       await this.containerFetch("http://c/start", {         method: "POST",

try {       await this.containerFetch("http://c/start", {         method: "POST",

await this.containerFetch("http://c/start", {

await this.containerFetch("http://c/start", {

// Kickoff hands the full job here. Boot in the background; start the monitor.   override async fetch(req: Request): Promise<Response> {

// Kickoff hands the full job here. Boot in the background; start the monitor.   override async fetch(req: Request): Promise<Response> {

override async fetch(req: Request): Promise<Response> {

override async fetch(req: Request): Promise<Response> {

return Response.json({ ok: true });     }     return super.fetch(req); // your normal SSR / routes

return Response.json({ ok: true });     }     return super.fetch(req); // your normal SSR / routes

}     return super.fetch(req); // your normal SSR / routes   }

}     return super.fetch(req); // your normal SSR / routes   }

return super.fetch(req); // your normal SSR / routes

return super.fetch(req); // your normal SSR / routes

let s: any = null;     try {       const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });

let s: any = null;     try {       const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });

try {       const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });       const body = await r.text();

try {       const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });       const body = await r.text();

const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });

const r = await this.containerFetch(`http://c/status?jobId=${jobId}`, { signal: AbortSignal.timeout(POLL_TIMEOUT_MS) });

// ONE shared container for the whole app → route by a STABLE name, not jobId. const stub = env.CONTAINER.getByName("app"); await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container

// ONE shared container for the whole app → route by a STABLE name, not jobId. const stub = env.CONTAINER.getByName("app"); await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container

const stub = env.CONTAINER.getByName("app"); await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container   method: "POST",

const stub = env.CONTAINER.getByName("app"); await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container   method: "POST",

await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container

await stub.fetch(new Request("https://do/__keepalive/start", {   // the DO route, not the container

const { token } = await fetch("/__auth/container-token", { method: "POST" }).then(r => r.json());

const { token } = await fetch("/__auth/container-token", { method: "POST" }).then(r => r.json());

[Credential-related source omitted]

[Credential-related source omitted]

await fetch(`${appBaseUrl}/api/generate`, {

await fetch(`${appBaseUrl}/api/generate`, {

4. **Your `/api/generate` route** calls fnf the normal way (server-side, via the    fnf SDK / `https://fnf.internal/*`) — the platform injects the viewer's

4. **Your `/api/generate` route** calls fnf the normal way (server-side, via the    fnf SDK / `https://fnf.internal/*`) — the platform injects the viewer's

fnf SDK / `https://fnf.internal/*`) — the platform injects the viewer's

fnf SDK / `https://fnf.internal/*`) — the platform injects the viewer's

> The contest is admin-curated and recurs — treat specifics (amounts, dates) as > this round's, and the live details are on > `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics

> The contest is admin-curated and recurs — treat specifics (amounts, dates) as > this round's, and the live details are on > `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics

> this round's, and the live details are on > `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics > (auto-publish on entry, social-link submission, judging on real usage) are

> this round's, and the live details are on > `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics > (auto-publish on entry, social-link submission, judging on real usage) are

> `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics

> `https://higgsfield.ai/supercomputer/apps?tab=prizes`. The mechanics

# after `higgsfield website deploy <website_id>` has shipped (metadata filled) higgsfield website contest <website_id> \   --url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

# after `higgsfield website deploy <website_id>` has shipped (metadata filled) higgsfield website contest <website_id> \   --url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

higgsfield website contest <website_id>    --url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

higgsfield website contest <website_id>    --url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

--url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

--url https://x.com/<user>/status/…   # ≥1 public post, #HiggsfieldApp

1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, 

1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, 

2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:    * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g

2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:    * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g

* `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)

* `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)

**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos: * **Source: Simple Icons*

**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos: * **Source: Simple Icons*

* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.

* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.

* **Hand-rolled decorative SVGs strongly discouraged** as default (see Section 4.8). * **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, o

* **Hand-rolled decorative SVGs strongly discouraged** as default (see Section 4.8). * **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, o

* **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, or skip the preview. * **NO broken Unsplash links.** Use `https://picsum.photos/seed/{

* **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, or skip the preview. * **NO broken Unsplash links.** Use `https://picsum.photos/seed/{

* **NO broken Unsplash links.** Use `https://picsum.photos/seed/{descriptive-string}/{w}/{h}`, or generated photo placeholders, or actual assets.

* **NO broken Unsplash links.** Use `https://picsum.photos/seed/{descriptive-string}/{w}/{h}`, or generated photo placeholders, or actual assets.

# Add this to your app HTML head: #   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" /> #   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>

# Add this to your app HTML head: #   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" /> #   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>

[Credential-related source omitted]

[Credential-related source omitted]

#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>

#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>

### Material Web - https://github.com/material-components/material-web

### Material Web - https://github.com/material-components/material-web

- https://github.com/material-components/material-web

- https://github.com/material-components/material-web

- https://material-web.dev/theming/material-theming/

- https://material-web.dev/theming/material-theming/

- https://m3.material.io/develop/web

- https://m3.material.io/develop/web

### Fluent UI - https://fluent2.microsoft.design/get-started/develop

### Fluent UI - https://fluent2.microsoft.design/get-started/develop

- https://fluent2.microsoft.design/get-started/develop

- https://fluent2.microsoft.design/get-started/develop

- https://fluent2.microsoft.design/components/web/react/

- https://fluent2.microsoft.design/components/web/react/

- https://github.com/microsoft/fluentui

- https://github.com/microsoft/fluentui

- https://learn.microsoft.com/en-us/fluent-ui/web-components/

- https://learn.microsoft.com/en-us/fluent-ui/web-components/

### Carbon - https://carbondesignsystem.com/

### Carbon - https://carbondesignsystem.com/

- https://carbondesignsystem.com/

- https://carbondesignsystem.com/

- https://github.com/carbon-design-system/carbon

- https://github.com/carbon-design-system/carbon

- https://carbondesignsystem.com/developing/react-tutorial/overview/

- https://carbondesignsystem.com/developing/react-tutorial/overview/

- https://carbondesignsystem.com/developing/web-components-tutorial/overview/

- https://carbondesignsystem.com/developing/web-components-tutorial/overview/

### Shopify Polaris - https://shopify.dev/docs/api/app-home/web-components

### Shopify Polaris - https://shopify.dev/docs/api/app-home/web-components

- https://shopify.dev/docs/api/app-home/web-components

- https://shopify.dev/docs/api/app-home/web-components

- https://github.com/Shopify/polaris-react

- https://github.com/Shopify/polaris-react

- https://polaris-react.shopify.com/components

- https://polaris-react.shopify.com/components

### Atlassian - https://atlassian.design/get-started/develop

### Atlassian - https://atlassian.design/get-started/develop

- https://atlassian.design/get-started/develop

- https://atlassian.design/get-started/develop

- https://atlassian.design/components/button/examples

- https://atlassian.design/components/button/examples

- https://atlaskit.atlassian.com/packages/design-system/button/example/disabled

- https://atlaskit.atlassian.com/packages/design-system/button/example/disabled

- https://atlassian.design/tokens/design-tokens

- https://atlassian.design/tokens/design-tokens

### Primer - https://primer.style/

### Primer - https://primer.style/

- https://primer.style/

- https://primer.style/

- https://github.com/primer/css

- https://github.com/primer/css

- https://github.com/primer/brand

- https://github.com/primer/brand

### GOV.UK - https://design-system.service.gov.uk/components/button/

### GOV.UK - https://design-system.service.gov.uk/components/button/

- https://design-system.service.gov.uk/components/button/

- https://design-system.service.gov.uk/components/button/

- https://design-system.service.gov.uk/styles/layout/

- https://design-system.service.gov.uk/styles/layout/

- https://github.com/alphagov/govuk-frontend

- https://github.com/alphagov/govuk-frontend

### USWDS - https://designsystem.digital.gov/documentation/developers/

### USWDS - https://designsystem.digital.gov/documentation/developers/

- https://designsystem.digital.gov/documentation/developers/

- https://designsystem.digital.gov/documentation/developers/

- https://designsystem.digital.gov/components/button/

- https://designsystem.digital.gov/components/button/

- https://designsystem.digital.gov/components/card/

- https://designsystem.digital.gov/components/card/

- https://github.com/uswds/uswds

- https://github.com/uswds/uswds

### Bootstrap - https://getbootstrap.com/docs/5.3/layout/grid/

### Bootstrap - https://getbootstrap.com/docs/5.3/layout/grid/

- https://getbootstrap.com/docs/5.3/layout/grid/

- https://getbootstrap.com/docs/5.3/layout/grid/

- https://getbootstrap.com/docs/5.3/components/card/

- https://getbootstrap.com/docs/5.3/components/card/

### Tailwind - https://tailwindcss.com/docs/dark-mode

### Tailwind - https://tailwindcss.com/docs/dark-mode

- https://tailwindcss.com/docs/dark-mode

- https://tailwindcss.com/docs/dark-mode

- https://tailwindcss.com/blog/tailwindcss-v4

- https://tailwindcss.com/blog/tailwindcss-v4

### Radix - https://www.radix-ui.com/themes/docs/components/theme

### Radix - https://www.radix-ui.com/themes/docs/components/theme

- https://www.radix-ui.com/themes/docs/components/theme

- https://www.radix-ui.com/themes/docs/components/theme

- https://www.radix-ui.com/themes/docs/components/card

- https://www.radix-ui.com/themes/docs/components/card

- https://github.com/radix-ui/themes

- https://github.com/radix-ui/themes

### shadcn/ui - https://ui.shadcn.com/docs

### shadcn/ui - https://ui.shadcn.com/docs

- https://ui.shadcn.com/docs

- https://ui.shadcn.com/docs

- https://ui.shadcn.com/docs/components/card

- https://ui.shadcn.com/docs/components/card

- https://github.com/shadcn-ui/ui

- https://github.com/shadcn-ui/ui

### Native CSS / W3C standards - https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/backdrop-filter

### Native CSS / W3C standards - https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/backdrop-filter

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/backdrop-filter

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/backdrop-filter

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@media/prefers-color-scheme

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@media/prefers-color-scheme

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@media/prefers-reduced-motion

- https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@media/prefers-reduced-motion

- https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Grid_layout

- https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Grid_layout

- https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Scroll-driven_animations

- https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Scroll-driven_animations

- https://drafts.csswg.org/scroll-animations-1/

- https://drafts.csswg.org/scroll-animations-1/

### Apple Liquid Glass (Apple platforms only) - https://developer.apple.com/design/human-interface-guidelines/materials

### Apple Liquid Glass (Apple platforms only) - https://developer.apple.com/design/human-interface-guidelines/materials

- https://developer.apple.com/design/human-interface-guidelines/materials

- https://developer.apple.com/design/human-interface-guidelines/materials

- https://developer.apple.com/documentation/TechnologyOverviews/liquid-glass

- https://developer.apple.com/documentation/TechnologyOverviews/liquid-glass

- https://developer.apple.com/documentation/TechnologyOverviews/adopting-liquid-glass

- https://developer.apple.com/documentation/TechnologyOverviews/adopting-liquid-glass

- https://developer.apple.com/documentation/SwiftUI/Material

- https://developer.apple.com/documentation/SwiftUI/Material

If the website also has in-app accounts for its product data, keep those sessions separate. `FnfProvider` and every SDK-backed route still require `/api/user` and server-side `https://fnf.internal/user` guards.

If the website also has in-app accounts for its product data, keep those sessions separate. `FnfProvider` and every SDK-backed route still require `/api/user` and server-side `https://fnf.internal/user` guards.

server-side `https://fnf.internal/user` guards.

server-side `https://fnf.internal/user` guards.

`complete`/`stream`, tool-calling) when a browser-safe `llm` backend is   passed to `FnfProvider`; the hook throws if none was provided. The raw   `createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is

`complete`/`stream`, tool-calling) when a browser-safe `llm` backend is   passed to `FnfProvider`; the hook throws if none was provided. The raw   `createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is

passed to `FnfProvider`; the hook throws if none was provided. The raw   `createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is   Worker-side only (zero-token — the platform attaches the visitor's identity

passed to `FnfProvider`; the hook throws if none was provided. The raw   `createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is   Worker-side only (zero-token — the platform attaches the visitor's identity

`createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is

`createLlmClient({ baseUrl: 'https://fnf.internal/llm' })` client is

In-app auth can coexist for product users, but SDK submit/upload/profile/   credits/feed routes must still be protected by Higgsfield auth through   `/api/user` and server-side `https://fnf.internal/user`.

In-app auth can coexist for product users, but SDK submit/upload/profile/   credits/feed routes must still be protected by Higgsfield auth through   `/api/user` and server-side `https://fnf.internal/user`.

credits/feed routes must still be protected by Higgsfield auth through   `/api/user` and server-side `https://fnf.internal/user`. - Browser auth/user UI calls `/api/user`; that route proxies

credits/feed routes must still be protected by Higgsfield auth through   `/api/user` and server-side `https://fnf.internal/user`. - Browser auth/user UI calls `/api/user`; that route proxies

`/api/user` and server-side `https://fnf.internal/user`.

`/api/user` and server-side `https://fnf.internal/user`.

- Browser auth/user UI calls `/api/user`; that route proxies   `https://fnf.internal/user` server-side. Do not call `fnf.internal` from the   browser.

- Browser auth/user UI calls `/api/user`; that route proxies   `https://fnf.internal/user` server-side. Do not call `fnf.internal` from the   browser.

`https://fnf.internal/user` server-side. Do not call `fnf.internal` from the

`https://fnf.internal/user` server-side. Do not call `fnf.internal` from the

browser. - Generated websites must use `createWorkflowPlatformAdapter` with   `baseUrl: 'https://fnf.internal'` from server code. Do not use

browser. - Generated websites must use `createWorkflowPlatformAdapter` with   `baseUrl: 'https://fnf.internal'` from server code. Do not use

- Generated websites must use `createWorkflowPlatformAdapter` with   `baseUrl: 'https://fnf.internal'` from server code. Do not use   env-controlled backend URL selectors, public fnf URLs, dev fnf URLs,

- Generated websites must use `createWorkflowPlatformAdapter` with   `baseUrl: 'https://fnf.internal'` from server code. Do not use   env-controlled backend URL selectors, public fnf URLs, dev fnf URLs,

`baseUrl: 'https://fnf.internal'` from server code. Do not use

`baseUrl: 'https://fnf.internal'` from server code. Do not use

- `GET /api/user` route that proxies `https://fnf.internal/user` server-side.

- `GET /api/user` route that proxies `https://fnf.internal/user` server-side.

All calls stay server-side after the Higgsfield auth guard and reuse the same `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`:

All calls stay server-side after the Higgsfield auth guard and reuse the same `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`:

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`:

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`:

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })

const adapter = createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })

const FNF_INTERNAL_BASE_URL = 'https://fnf.internal'

const FNF_INTERNAL_BASE_URL = 'https://fnf.internal'

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

Do not pass `getToken`. Do not send `Authorization`. The platform attaches identity automatically for server-side calls to `https://fnf.internal`.

Do not pass `getToken`. Do not send `Authorization`. The platform attaches identity automatically for server-side calls to `https://fnf.internal`.

identity automatically for server-side calls to `https://fnf.internal`.

identity automatically for server-side calls to `https://fnf.internal`.

createDevFnfWebAdapter(...) createAppsMarketplaceAdapter(...) fetch('https://fnf.internal/jobs') // hand-written request; use the SDK adapter

createDevFnfWebAdapter(...) createAppsMarketplaceAdapter(...) fetch('https://fnf.internal/jobs') // hand-written request; use the SDK adapter

fetch('https://fnf.internal/jobs') // hand-written request; use the SDK adapter

fetch('https://fnf.internal/jobs') // hand-written request; use the SDK adapter

const response = await fetch('/api/media/upload', {

const response = await fetch('/api/media/upload', {

const adapter = createWorkflowPlatformAdapter({       baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({       baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

import { createLlmClient } from '@higgsfield/fnf' const llm = createLlmClient({ baseUrl: 'https://fnf.internal/llm' })

import { createLlmClient } from '@higgsfield/fnf' const llm = createLlmClient({ baseUrl: 'https://fnf.internal/llm' })

const llm = createLlmClient({ baseUrl: 'https://fnf.internal/llm' })

const llm = createLlmClient({ baseUrl: 'https://fnf.internal/llm' })

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

tests or trusted service experiments only. Generated websites must not use it. Generated websites use `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`

tests or trusted service experiments only. Generated websites must not use it. Generated websites use `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`

Generated websites use `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` exclusively.

Generated websites use `createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })` exclusively.

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`

`createWorkflowPlatformAdapter({ baseUrl: 'https://fnf.internal' })`

1. Confirm the app-local generation function/route is `POST`, not `GET`. 2. Confirm the code calls `jobs.submit(...)` or `jobs.cost(...)` through the SDK,    not hand-written `fetch('/jobs?...')`.

1. Confirm the app-local generation function/route is `POST`, not `GET`. 2. Confirm the code calls `jobs.submit(...)` or `jobs.cost(...)` through the SDK,    not hand-written `fetch('/jobs?...')`.

2. Confirm the code calls `jobs.submit(...)` or `jobs.cost(...)` through the SDK,    not hand-written `fetch('/jobs?...')`. 3. Confirm `createWorkflowPlatformAdapter({ baseUrl })` uses exactly

2. Confirm the code calls `jobs.submit(...)` or `jobs.cost(...)` through the SDK,    not hand-written `fetch('/jobs?...')`. 3. Confirm `createWorkflowPlatformAdapter({ baseUrl })` uses exactly

not hand-written `fetch('/jobs?...')`.

not hand-written `fetch('/jobs?...')`.

3. Confirm `createWorkflowPlatformAdapter({ baseUrl })` uses exactly    `https://fnf.internal`, not the deployed website URL, `/api/user`, a public fnf    URL, a dev fnf URL, or a model-specific fnf route.

3. Confirm `createWorkflowPlatformAdapter({ baseUrl })` uses exactly    `https://fnf.internal`, not the deployed website URL, `/api/user`, a public fnf    URL, a dev fnf URL, or a model-specific fnf route.

`https://fnf.internal`, not the deployed website URL, `/api/user`, a public fnf

`https://fnf.internal`, not the deployed website URL, `/api/user`, a public fnf

URL, a dev fnf URL, or a model-specific fnf route. 4. Confirm the server handler re-checks `https://fnf.internal/user` before SDK    calls, then creates the adapter/client inside the server handler.

URL, a dev fnf URL, or a model-specific fnf route. 4. Confirm the server handler re-checks `https://fnf.internal/user` before SDK    calls, then creates the adapter/client inside the server handler.

4. Confirm the server handler re-checks `https://fnf.internal/user` before SDK

4. Confirm the server handler re-checks `https://fnf.internal/user` before SDK

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

const adapter = createWorkflowPlatformAdapter({   baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

baseUrl: 'https://fnf.internal',

cd <workspace> && mkdir -p blender && cd blender curl -sL -o blender.tar.xz https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz   # ~336MB, run in background

cd <workspace> && mkdir -p blender && cd blender curl -sL -o blender.tar.xz https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz   # ~336MB, run in background

curl -sL -o blender.tar.xz https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz   # ~336MB, run in background

curl -sL -o blender.tar.xz https://download.blender.org/release/Blender4.2/blender-4.2.3-linux-x64.tar.xz   # ~336MB, run in background

- **KayKit Adventurers** — `git clone --depth 1 https://github.com/KayKit-Game-Assets/KayKit-Character-Pack-Adventures-1.0.git`

- **KayKit Adventurers** — `git clone --depth 1 https://github.com/KayKit-Game-Assets/KayKit-Character-Pack-Adventures-1.0.git`

- Base URL: `https://api.meshy.ai`

- Base URL: `https://api.meshy.ai`

[Credential-related source omitted]

[Credential-related source omitted]

- Library: **~680 mocap presets** (locomotion, combat, deaths, dances,   emotes). Catalog: `https://api.meshy.ai/web/public/animations/resources`

- Library: **~680 mocap presets** (locomotion, combat, deaths, dances,   emotes). Catalog: `https://api.meshy.ai/web/public/animations/resources`

emotes). Catalog: `https://api.meshy.ai/web/public/animations/resources`

emotes). Catalog: `https://api.meshy.ai/web/public/animations/resources`

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

-d @payload.json | python3 -c 'import sys,json;print(json.load(sys.stdin)["result"])') while :; do   S=$(curl -s https://api.meshy.ai/openapi/v1/image-to-3d/$TASK \

-d @payload.json | python3 -c 'import sys,json;print(json.load(sys.stdin)["result"])') while :; do   S=$(curl -s https://api.meshy.ai/openapi/v1/image-to-3d/$TASK \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

const form = new FormData() form.append('file', file) await fetch('/api/media/upload', { method: 'POST', body: form })

const form = new FormData() form.append('file', file) await fetch('/api/media/upload', { method: 'POST', body: form })

await fetch('/api/media/upload', { method: 'POST', body: form })

await fetch('/api/media/upload', { method: 'POST', body: form })

try {         const response = await fetch(source, {

try {         const response = await fetch(source, {

const response = await fetch(source, {

const response = await fetch(source, {

Outbound `fetch()` from server functions. Risks:

Outbound `fetch()` from server functions. Risks:

**Attack:** Server function accepts a URL from the client and fetches it. Attacker provides `http://169.254.169.254/latest/meta-data/` (cloud metadata), `http://localhost:8787/internal-api`, or internal network addresses.

**Attack:** Server function accepts a URL from the client and fetches it. Attacker provides `http://169.254.169.254/latest/meta-data/` (cloud metadata), `http://localhost:8787/internal-api`, or internal network addresses.

export default {   async fetch(request: Request) {

export default {   async fetch(request: Request) {

async fetch(request: Request) {

async fetch(request: Request) {

// GOOD -- request-scoped data flows through params export default {   async fetch(request: Request, env: Env, ctx: ExecutionContext) {

// GOOD -- request-scoped data flows through params export default {   async fetch(request: Request, env: Env, ctx: ExecutionContext) {

export default {   async fetch(request: Request, env: Env, ctx: ExecutionContext) {     const user = await getUser(request);

export default {   async fetch(request: Request, env: Env, ctx: ExecutionContext) {     const user = await getUser(request);

async fetch(request: Request, env: Env, ctx: ExecutionContext) {

async fetch(request: Request, env: Env, ctx: ExecutionContext) {

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// BAD -- buffers entire response const data = await fetch(externalUrl).then(r => r.text());

// BAD -- buffers entire response const data = await fetch(externalUrl).then(r => r.text());

const data = await fetch(externalUrl).then(r => r.text());

const data = await fetch(externalUrl).then(r => r.text());

// GOOD -- stream through const upstream = await fetch(externalUrl);

// GOOD -- stream through const upstream = await fetch(externalUrl);

const upstream = await fetch(externalUrl);

const upstream = await fetch(externalUrl);

// BAD -- security bypass on any error export default {   async fetch(request, env, ctx) {

// BAD -- security bypass on any error export default {   async fetch(request, env, ctx) {

export default {   async fetch(request, env, ctx) {     ctx.passThroughOnException();

export default {   async fetch(request, env, ctx) {     ctx.passThroughOnException();

async fetch(request, env, ctx) {

async fetch(request, env, ctx) {

// GOOD -- explicit error handling export default {   async fetch(request, env, ctx) {

// GOOD -- explicit error handling export default {   async fetch(request, env, ctx) {

export default {   async fetch(request, env, ctx) {     try {

export default {   async fetch(request, env, ctx) {     try {

async fetch(request, env, ctx) {

async fetch(request, env, ctx) {

"default-src 'self'; " +       "script-src 'self' 'unsafe-inline'; " +       "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +

"default-src 'self'; " +       "script-src 'self' 'unsafe-inline'; " +       "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +

"script-src 'self' 'unsafe-inline'; " +       "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +       "font-src 'self' https://fonts.gstatic.com; " +

"script-src 'self' 'unsafe-inline'; " +       "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +       "font-src 'self' https://fonts.gstatic.com; " +

"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +

"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +

"font-src 'self' https://fonts.gstatic.com; " +

"font-src 'self' https://fonts.gstatic.com; " +

"img-src 'self' data: https:; media-src 'self' https:; " +       "connect-src 'self' https:; " +       "frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +

"img-src 'self' data: https:; media-src 'self' https:; " +       "connect-src 'self' https:; " +       "frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +

"connect-src 'self' https:; " +       "frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +       "https://*.higgsfield.ai https://fnf-dev.anwar-695.workers.dev " +

"connect-src 'self' https:; " +       "frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +       "https://*.higgsfield.ai https://fnf-dev.anwar-695.workers.dev " +

"frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +

"frame-ancestors 'self' https://*.higgsfield.app https://higgsfield.app " +

"https://*.higgsfield.ai https://fnf-dev.anwar-695.workers.dev " +

"https://*.higgsfield.ai https://fnf-dev.anwar-695.workers.dev " +

"https://feat-apps-marketplace-tools-fnf-dev.anwar-695.workers.dev; " +

"https://feat-apps-marketplace-tools-fnf-dev.anwar-695.workers.dev; " +

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// GOOD -- specific origin, only on API routes that need it if (request.headers.get('Origin') === 'https://trusted-app.example.com') {

// GOOD -- specific origin, only on API routes that need it if (request.headers.get('Origin') === 'https://trusted-app.example.com') {

if (request.headers.get('Origin') === 'https://trusted-app.example.com') {

if (request.headers.get('Origin') === 'https://trusted-app.example.com') {

headers.set('Access-Control-Allow-Origin', 'https://trusted-app.example.com');

headers.set('Access-Control-Allow-Origin', 'https://trusted-app.example.com');

| `eval()` / `new Function()` | Arbitrary code execution | Remove; use static logic or JSON parsing |

| `eval()` / `new Function()` | Arbitrary code execution | Remove; use static logic or JSON parsing |

**Command Injection:** Flag any use of `eval()`, `new Function()`, or template literal construction of executable code in server functions.

**Command Injection:** Flag any use of `eval()`, `new Function()`, or template literal construction of executable code in server functions.

const proxyFetch = createServerFn({ method: 'POST' })   .handler(async ({ data }) => {     const res = await fetch(data.url); // user controls destination

const proxyFetch = createServerFn({ method: 'POST' })   .handler(async ({ data }) => {     const res = await fetch(data.url); // user controls destination

.handler(async ({ data }) => {     const res = await fetch(data.url); // user controls destination     return res.json();

.handler(async ({ data }) => {     const res = await fetch(data.url); // user controls destination     return res.json();

const res = await fetch(data.url); // user controls destination

const res = await fetch(data.url); // user controls destination

const url = new URL(data.url);     if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');     const res = await fetch(url.toString());

const url = new URL(data.url);     if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');     const res = await fetch(url.toString());

if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');     const res = await fetch(url.toString());     return res.json();

if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');     const res = await fetch(url.toString());     return res.json();

const res = await fetch(url.toString());

const res = await fetch(url.toString());

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#### `eval()` / `new Function()`

#### `eval()` / `new Function()`

2. **Don't flag `fetch()` in server functions as SSRF unless the URL comes from user input.** Server functions that fetch hardcoded API endpoints (e.g., `fetch('https://api.stripe.com/...')`) are not SSRF.

2. **Don't flag `fetch()` in server functions as SSRF unless the URL comes from user input.** Server functions that fetch hardcoded API endpoints (e.g., `fetch('https://api.stripe.com/...')`) are not SSRF.

{ property: 'og:title', content: 'Services — Acme Studio' },       { property: 'og:description', content: 'Brand identity, web design, and digital campaigns.' },       { property: 'og:url', content: 'https://acme-studio.higgsfield.app/servi

{ property: 'og:title', content: 'Services — Acme Studio' },       { property: 'og:description', content: 'Brand identity, web design, and digital campaigns.' },       { property: 'og:url', content: 'https://acme-studio.higgsfield.app/servi

{ property: 'og:description', content: 'Brand identity, web design, and digital campaigns.' },       { property: 'og:url', content: 'https://acme-studio.higgsfield.app/services' },       { property: 'og:image', content: 'https://acme-studio

{ property: 'og:description', content: 'Brand identity, web design, and digital campaigns.' },       { property: 'og:url', content: 'https://acme-studio.higgsfield.app/services' },       { property: 'og:image', content: 'https://acme-studio

{ property: 'og:url', content: 'https://acme-studio.higgsfield.app/services' },

{ property: 'og:url', content: 'https://acme-studio.higgsfield.app/services' },

{ property: 'og:image', content: 'https://acme-studio.higgsfield.app/og-services.png' },

{ property: 'og:image', content: 'https://acme-studio.higgsfield.app/og-services.png' },

],     links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },

],     links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },

links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },     ],

links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },     ],

{ rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },

{ rel: 'canonical', href: 'https://acme-studio.higgsfield.app/services' },

- Homepage: `https://acme-studio.higgsfield.app`

- Homepage: `https://acme-studio.higgsfield.app`

- Subpage: `https://acme-studio.higgsfield.app/services`

- Subpage: `https://acme-studio.higgsfield.app/services`

const xml = `<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

const xml = `<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

const xml = `<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

const xml = `<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

export default {   async fetch(request: Request, env: any) {

export default {   async fetch(request: Request, env: any) {

async fetch(request: Request, env: any) {

async fetch(request: Request, env: any) {

try {       const response = await handler.fetch(request, env);       return applySecurityHeaders(response);

try {       const response = await handler.fetch(request, env);       return applySecurityHeaders(response);

const response = await handler.fetch(request, env);

const response = await handler.fetch(request, env);

head: () => ({     links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },

head: () => ({     links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },

links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },     ],

links: [       { rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },     ],

{ rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },

{ rel: 'canonical', href: 'https://acme-studio.higgsfield.app/about' },

head: () => ({   links: [     { rel: 'preconnect', href: 'https://fonts.googleapis.com' },

head: () => ({   links: [     { rel: 'preconnect', href: 'https://fonts.googleapis.com' },

links: [     { rel: 'preconnect', href: 'https://fonts.googleapis.com' },     { rel: 'preconnect', href: 'https://fonts.gstatic.com', crossOrigin: 'anonymous' },

links: [     { rel: 'preconnect', href: 'https://fonts.googleapis.com' },     { rel: 'preconnect', href: 'https://fonts.gstatic.com', crossOrigin: 'anonymous' },

{ rel: 'preconnect', href: 'https://fonts.googleapis.com' },

{ rel: 'preconnect', href: 'https://fonts.googleapis.com' },

{ rel: 'preconnect', href: 'https://fonts.gstatic.com', crossOrigin: 'anonymous' },

{ rel: 'preconnect', href: 'https://fonts.gstatic.com', crossOrigin: 'anonymous' },

{ rel: 'dns-prefetch', href: 'https://fonts.googleapis.com' },

{ rel: 'dns-prefetch', href: 'https://fonts.googleapis.com' },

3. **robots.txt with a hardcoded origin.** The route derives origin from the request URL, so any host the site is served from gets correct sitemaps automatically. Don't hardcode URLs. 4. **Missing canonical on dynamic routes.** Routes with 

3. **robots.txt with a hardcoded origin.** The route derives origin from the request URL, so any host the site is served from gets correct sitemaps automatically. Don't hardcode URLs. 4. **Missing canonical on dynamic routes.** Routes with 

5. **Trailing slash redirect loops.** The normalization redirect must be the FIRST check in `fetch()`, before `handler.fetch`. Placing it after can cause double-processing or loops with Cloudflare's own redirects.

5. **Trailing slash redirect loops.** The normalization redirect must be the FIRST check in `fetch()`, before `handler.fetch`. Placing it after can cause double-processing or loops with Cloudflare's own redirects.

const ORG_SCHEMA = JSON.stringify({   '@context': 'https://schema.org',

const ORG_SCHEMA = JSON.stringify({   '@context': 'https://schema.org',

'@context': 'https://schema.org',

'@context': 'https://schema.org',

'@type': 'Organization',   name: 'Acme Studio',   url: 'https://acme-studio.higgsfield.app',

'@type': 'Organization',   name: 'Acme Studio',   url: 'https://acme-studio.higgsfield.app',

name: 'Acme Studio',   url: 'https://acme-studio.higgsfield.app',   logo: 'https://acme-studio.higgsfield.app/logo.png',

name: 'Acme Studio',   url: 'https://acme-studio.higgsfield.app',   logo: 'https://acme-studio.higgsfield.app/logo.png',

url: 'https://acme-studio.higgsfield.app',

url: 'https://acme-studio.higgsfield.app',

logo: 'https://acme-studio.higgsfield.app/logo.png',

logo: 'https://acme-studio.higgsfield.app/logo.png',

const SCHEMA = JSON.stringify({   '@context': 'https://schema.org',

const SCHEMA = JSON.stringify({   '@context': 'https://schema.org',

'@context': 'https://schema.org',

'@context': 'https://schema.org',

{       '@type': 'Organization',       '@id': 'https://acme-studio.higgsfield.app/#org',

{       '@type': 'Organization',       '@id': 'https://acme-studio.higgsfield.app/#org',

'@type': 'Organization',       '@id': 'https://acme-studio.higgsfield.app/#org',       name: 'Acme Studio',

'@type': 'Organization',       '@id': 'https://acme-studio.higgsfield.app/#org',       name: 'Acme Studio',

'@id': 'https://acme-studio.higgsfield.app/#org',

'@id': 'https://acme-studio.higgsfield.app/#org',

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       logo: 'https://acme-studio.higgsfield.app/logo.png',

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       logo: 'https://acme-studio.higgsfield.app/logo.png',

url: 'https://acme-studio.higgsfield.app',

url: 'https://acme-studio.higgsfield.app',

logo: 'https://acme-studio.higgsfield.app/logo.png',

logo: 'https://acme-studio.higgsfield.app/logo.png',

sameAs: [         'https://twitter.com/acmestudio',         'https://linkedin.com/company/acmestudio',

sameAs: [         'https://twitter.com/acmestudio',         'https://linkedin.com/company/acmestudio',

'https://twitter.com/acmestudio',

'https://twitter.com/acmestudio',

'https://linkedin.com/company/acmestudio',

'https://linkedin.com/company/acmestudio',

{       '@type': 'WebSite',       '@id': 'https://acme-studio.higgsfield.app/#website',

{       '@type': 'WebSite',       '@id': 'https://acme-studio.higgsfield.app/#website',

'@type': 'WebSite',       '@id': 'https://acme-studio.higgsfield.app/#website',       name: 'Acme Studio',

'@type': 'WebSite',       '@id': 'https://acme-studio.higgsfield.app/#website',       name: 'Acme Studio',

'@id': 'https://acme-studio.higgsfield.app/#website',

'@id': 'https://acme-studio.higgsfield.app/#website',

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       publisher: { '@id': 'https://acme-studio.higgsfield.app/#org' },

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       publisher: { '@id': 'https://acme-studio.higgsfield.app/#org' },

url: 'https://acme-studio.higgsfield.app',

url: 'https://acme-studio.higgsfield.app',

publisher: { '@id': 'https://acme-studio.higgsfield.app/#org' },

publisher: { '@id': 'https://acme-studio.higgsfield.app/#org' },

{       '@type': 'ProfessionalService',       '@id': 'https://acme-studio.higgsfield.app/#service',

{       '@type': 'ProfessionalService',       '@id': 'https://acme-studio.higgsfield.app/#service',

'@type': 'ProfessionalService',       '@id': 'https://acme-studio.higgsfield.app/#service',       name: 'Acme Studio',

'@type': 'ProfessionalService',       '@id': 'https://acme-studio.higgsfield.app/#service',       name: 'Acme Studio',

'@id': 'https://acme-studio.higgsfield.app/#service',

'@id': 'https://acme-studio.higgsfield.app/#service',

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       description: 'Full-service creative agency specializing in brand identity and web design.',

name: 'Acme Studio',       url: 'https://acme-studio.higgsfield.app',       description: 'Full-service creative agency specializing in brand identity and web design.',

url: 'https://acme-studio.higgsfield.app',

url: 'https://acme-studio.higgsfield.app',

serviceType: 'Creative Agency',       priceRange: '$$$',       provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },

serviceType: 'Creative Agency',       priceRange: '$$$',       provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },

priceRange: '$$$',       provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },     },

priceRange: '$$$',       provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },     },

provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },

provider: { '@id': 'https://acme-studio.higgsfield.app/#org' },

1. **No relative URLs.** Every `url`, `logo`, `image` field must be an absolute `https://` URL. Schema validators reject relative paths silently.

1. **No relative URLs.** Every `url`, `logo`, `image` field must be an absolute `https://` URL. Schema validators reject relative paths silently.

2. **Don't duplicate schemas.** Use `@graph` to bundle multiple types in one `<script>` tag. Multiple `<script type="application/ld+json">` blocks are valid but harder to maintain. 3. **Match visible content.** Schema `name`/`description` m

2. **Don't duplicate schemas.** Use `@graph` to bundle multiple types in one `<script>` tag. Multiple `<script type="application/ld+json">` blocks are valid but harder to maintain. 3. **Match visible content.** Schema `name`/`description` m

3. **Match visible content.** Schema `name`/`description` must match what the user sees on the page. Google penalizes mismatches. 4. **Test with Google Rich Results Test** (https://search.google.com/test/rich-results) before shipping. Schem

3. **Match visible content.** Schema `name`/`description` must match what the user sees on the page. Google penalizes mismatches. 4. **Test with Google Rich Results Test** (https://search.google.com/test/rich-results) before shipping. Schem

4. **Test with Google Rich Results Test** (https://search.google.com/test/rich-results) before shipping. Schema syntax errors are invisible to users but block rich results.

4. **Test with Google Rich Results Test** (https://search.google.com/test/rich-results) before shipping. Schema syntax errors are invisible to users but block rich results.

| name           | Acme Corp                                    | Yes      | | description    | Automated invoicing for logistics companies  | Yes      | | url            | https://acmecorp.com                         | Yes      |

| name           | Acme Corp                                    | Yes      | | description    | Automated invoicing for logistics companies  | Yes      | | url            | https://acmecorp.com                         | Yes      |

| description    | Automated invoicing for logistics companies  | Yes      | | url            | https://acmecorp.com                         | Yes      | | logo           | https://acmecorp.com/logo.png                | Yes      |

| description    | Automated invoicing for logistics companies  | Yes      | | url            | https://acmecorp.com                         | Yes      | | logo           | https://acmecorp.com/logo.png                | Yes      |

| url            | https://acmecorp.com                         | Yes      |

| url            | https://acmecorp.com                         | Yes      |

| logo           | https://acmecorp.com/logo.png                | Yes      |

| logo           | https://acmecorp.com/logo.png                | Yes      |

- **LinkedIn** — company page URL (e.g. `https://linkedin.com/company/acmecorp`)

- **LinkedIn** — company page URL (e.g. `https://linkedin.com/company/acmecorp`)

- **Instagram** — `https://instagram.com/acmecorp`

- **Instagram** — `https://instagram.com/acmecorp`

- **X (Twitter)** — `https://x.com/acmecorp`

- **X (Twitter)** — `https://x.com/acmecorp`

- **GitHub** — `https://github.com/acmecorp` (if applicable)

- **GitHub** — `https://github.com/acmecorp` (if applicable)

- **Crunchbase** — `https://crunchbase.com/organization/acmecorp` (if listed)

- **Crunchbase** — `https://crunchbase.com/organization/acmecorp` (if listed)

- **Wikidata** — `https://wikidata.org/wiki/Q12345` (if an entry exists)

- **Wikidata** — `https://wikidata.org/wiki/Q12345` (if an entry exists)

{   "@context": "https://schema.org",

{   "@context": "https://schema.org",

"@context": "https://schema.org",

"@context": "https://schema.org",

{       "@type": "Organization",       "@id": "https://acmecorp.com/#org",

{       "@type": "Organization",       "@id": "https://acmecorp.com/#org",

"@type": "Organization",       "@id": "https://acmecorp.com/#org",       "name": "Acme Corp",

"@type": "Organization",       "@id": "https://acmecorp.com/#org",       "name": "Acme Corp",

"@id": "https://acmecorp.com/#org",

"@id": "https://acmecorp.com/#org",

"name": "Acme Corp",       "url": "https://acmecorp.com",       "logo": "https://acmecorp.com/logo.png",

"name": "Acme Corp",       "url": "https://acmecorp.com",       "logo": "https://acmecorp.com/logo.png",

"url": "https://acmecorp.com",

"url": "https://acmecorp.com",

"logo": "https://acmecorp.com/logo.png",

"logo": "https://acmecorp.com/logo.png",

"founder": { "@id": "https://acmecorp.com/#founder" },

"founder": { "@id": "https://acmecorp.com/#founder" },

"sameAs": [         "https://linkedin.com/company/acmecorp",         "https://instagram.com/acmecorp"

"sameAs": [         "https://linkedin.com/company/acmecorp",         "https://instagram.com/acmecorp"

"https://linkedin.com/company/acmecorp",

"https://linkedin.com/company/acmecorp",

"https://instagram.com/acmecorp"

"https://instagram.com/acmecorp"

{       "@type": "Person",       "@id": "https://acmecorp.com/#founder",

{       "@type": "Person",       "@id": "https://acmecorp.com/#founder",

"@type": "Person",       "@id": "https://acmecorp.com/#founder",       "name": "Jane Smith",

"@type": "Person",       "@id": "https://acmecorp.com/#founder",       "name": "Jane Smith",

"@id": "https://acmecorp.com/#founder",

"@id": "https://acmecorp.com/#founder",

"name": "Jane Smith",       "jobTitle": "CEO & Founder",       "worksFor": { "@id": "https://acmecorp.com/#org" },

"name": "Jane Smith",       "jobTitle": "CEO & Founder",       "worksFor": { "@id": "https://acmecorp.com/#org" },

"jobTitle": "CEO & Founder",       "worksFor": { "@id": "https://acmecorp.com/#org" },       "sameAs": ["https://linkedin.com/in/janesmith"]

"jobTitle": "CEO & Founder",       "worksFor": { "@id": "https://acmecorp.com/#org" },       "sameAs": ["https://linkedin.com/in/janesmith"]

"worksFor": { "@id": "https://acmecorp.com/#org" },

"worksFor": { "@id": "https://acmecorp.com/#org" },

"sameAs": ["https://linkedin.com/in/janesmith"]

"sameAs": ["https://linkedin.com/in/janesmith"]

{       "@type": "SoftwareApplication",       "@id": "https://acmecorp.com/#product",

{       "@type": "SoftwareApplication",       "@id": "https://acmecorp.com/#product",

"@type": "SoftwareApplication",       "@id": "https://acmecorp.com/#product",       "name": "Acme Invoicing",

"@type": "SoftwareApplication",       "@id": "https://acmecorp.com/#product",       "name": "Acme Invoicing",

"@id": "https://acmecorp.com/#product",

"@id": "https://acmecorp.com/#product",

"priceCurrency": "USD"       },       "provider": { "@id": "https://acmecorp.com/#org" }

"priceCurrency": "USD"       },       "provider": { "@id": "https://acmecorp.com/#org" }

},       "provider": { "@id": "https://acmecorp.com/#org" }     }

},       "provider": { "@id": "https://acmecorp.com/#org" }     }

"provider": { "@id": "https://acmecorp.com/#org" }

"provider": { "@id": "https://acmecorp.com/#org" }

const entityJson = JSON.stringify({   "@context": "https://schema.org",

const entityJson = JSON.stringify({   "@context": "https://schema.org",

"@context": "https://schema.org",

"@context": "https://schema.org",

Verify `<meta property="og:title">`, `<meta property="og:description">`, and `<meta property="og:image">` exist. The `og:image` must be an absolute URL (starts with `https://`), not a relative path. Also check for `<meta name="twitter:card"

Verify `<meta property="og:title">`, `<meta property="og:description">`, and `<meta property="og:image">` exist. The `og:image` must be an absolute URL (starts with `https://`), not a relative path. Also check for `<meta name="twitter:card"

### 3. No Higgsfield integration — but a REAL backend of the site's own A `type: "website"` product never calls `https://fnf.internal/*`, never shows

### 3. No Higgsfield integration — but a REAL backend of the site's own A `type: "website"` product never calls `https://fnf.internal/*`, never shows

A `type: "website"` product never calls `https://fnf.internal/*`, never shows

A `type: "website"` product never calls `https://fnf.internal/*`, never shows

"registries": {   "@magicui":           "https://magicui.design/r/{name}.json",

"registries": {   "@magicui":           "https://magicui.design/r/{name}.json",

"@magicui":           "https://magicui.design/r/{name}.json",

"@magicui":           "https://magicui.design/r/{name}.json",

"@cult-ui":           "https://www.cult-ui.com/r/{name}.json",

"@cult-ui":           "https://www.cult-ui.com/r/{name}.json",

"@smoothui":          "https://smoothui.dev/r/{name}.json",

"@smoothui":          "https://smoothui.dev/r/{name}.json",

"@ncdai":             "https://chanhdai.com/r/{name}.json",

"@ncdai":             "https://chanhdai.com/r/{name}.json",

"@motion-primitives": "https://motion-primitives.com/c/{name}.json",

"@motion-primitives": "https://motion-primitives.com/c/{name}.json",

"@kokonutui":         "https://kokonutui.com/r/{name}.json",

"@kokonutui":         "https://kokonutui.com/r/{name}.json",

"@tailark":           "https://tailark.com/r/{name}.json",

"@tailark":           "https://tailark.com/r/{name}.json",

"@eldoraui":          "https://eldoraui.site/r/{name}.json"

"@eldoraui":          "https://eldoraui.site/r/{name}.json"

### Magic UI — effects/backgrounds/text · `npx shadcn@latest add "https://magicui.design/r/<name>.json"`

### Magic UI — effects/backgrounds/text · `npx shadcn@latest add "https://magicui.design/r/<name>.json"`

### Cult UI (free) · `npx shadcn@latest add https://www.cult-ui.com/r/<name>.json`

### Cult UI (free) · `npx shadcn@latest add https://www.cult-ui.com/r/<name>.json`

### motion-primitives · `npx shadcn@latest add "https://motion-primitives.com/c/<name>.json"`

### motion-primitives · `npx shadcn@latest add "https://motion-primitives.com/c/<name>.json"`

### Animata · `npx shadcn add https://animata.design/r/<category>/<name>.json`

### Animata · `npx shadcn add https://animata.design/r/<category>/<name>.json`

Executable file

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

Bash

Bash

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh

<head> <meta charset="utf-8"> <link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet">

<head> <meta charset="utf-8"> <link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet">

<meta charset="utf-8"> <link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet"> <style>

<meta charset="utf-8"> <link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet"> <style>

<link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet">

<link href="https://fonts.googleapis.com/css2?family=Anton&display=swap" rel="stylesheet">

const fontLink = document.createElement('link');   fontLink.rel = 'stylesheet';   fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';

const fontLink = document.createElement('link');   fontLink.rel = 'stylesheet';   fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';

fontLink.rel = 'stylesheet';   fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';   document.head.appendChild(fontLink);

fontLink.rel = 'stylesheet';   fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';   document.head.appendChild(fontLink);

fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';

fontLink.href = 'https://fonts.googleapis.com/css2?family=Anton&display=swap';