@timber-js/app 0.2.0-alpha.107 → 0.2.0-alpha.109

package/dist/server/internal.js

@@ -1556,7 +1556,9 @@ async function coerceSegmentParams(match) {
 		try {
 			mod = await loadModule(segment.params);
 		} catch (err) {
-			throw new ParamCoercionError(`Failed to load params module for segment "${segment.segmentName}": ${err instanceof Error ? err.message : String(err)}`);
+			const message = `Failed to load params module for segment "${segment.segmentName}": ${err instanceof Error ? err.message : String(err)}`;
+			if (isDebug()) console.warn(`[timber] Param coercion error: ${message}\n  Segment: ${segment.segmentName}\n  Params file: ${segment.params}`);
+			throw new ParamCoercionError(message);
 		}
 		const segmentParamsDef = mod.segmentParams;
 		if (!segmentParamsDef || typeof segmentParamsDef.parse !== "function") continue;
@@ -1564,7 +1566,12 @@ async function coerceSegmentParams(match) {
 			const coerced = segmentParamsDef.parse(match.segmentParams);
 			for (const key of Object.keys(coerced)) if (key !== "__proto__") mergeTarget[key] = sanitizeParamValue(coerced[key]);
 		} catch (err) {
-			throw new ParamCoercionError(err instanceof Error ? err.message : String(err));
+			const message = err instanceof Error ? err.message : String(err);
+			if (isDebug()) {
+				const rawKeys = Object.keys(match.segmentParams).join(", ");
+				console.warn(`[timber] Param codec rejected values for segment "${segment.segmentName}"\n  Error: ${message}\n  Available raw params: { ${rawKeys} }\n  Params file: ${segment.params}\n  Hint: if some params are only present at deeper route depths,\n  make them optional in defineSegmentParams().`);
+			}
+			throw new ParamCoercionError(message);
 		}
 	}
 }
@@ -1626,6 +1633,7 @@ async function outcomeToResponse(config, outcome, ctx) {
 				await fireOnRequestError(denyRenderError, ctx.req, "render");
 				if (config.onPipelineError && denyRenderError instanceof Error) config.onPipelineError(denyRenderError, "render");
 			}
+			if (isDebug()) console.warn(`[timber] DenySignal(${outcome.signal.status}) from ${outcome.phase} phase — no renderDenyFallback configured, returning bare ${outcome.signal.status} response\n  Request: ${ctx.method} ${ctx.path}\n  Add a not-found.tsx or error.tsx to render a custom deny page.`);
 			return new Response(null, {
 				status: outcome.signal.status,
 				headers
@@ -1816,14 +1824,20 @@ async function handleRequest(config, req, method, path) {
 	const stripTrailingSlash = config.stripTrailingSlash ?? true;
 	const url = new URL(req.url);
 	const result = canonicalize(url.pathname, stripTrailingSlash);
-	if (!result.ok) return new Response(null, { status: result.status });
+	if (!result.ok) {
+		if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+		return new Response(null, { status: result.status });
+	}
 	const canonicalPathname = result.pathname;
 	if (config.matchMetadataRoute) {
 		const metaMatch = config.matchMetadataRoute(canonicalPathname);
 		if (metaMatch) try {
 			if (metaMatch.isStatic) return await serveStaticMetadataFile(metaMatch);
 			const mod = await loadModule(metaMatch.file);
-			if (typeof mod.default !== "function") return new Response("Metadata route must export a default function", { status: 500 });
+			if (typeof mod.default !== "function") {
+				if (isDebug()) console.warn(`[timber] Metadata route ${metaMatch.file} does not export a default function — responding with 500\n  Metadata routes must export a default function that returns the metadata content.`);
+				return new Response("Metadata route must export a default function", { status: 500 });
+			}
 			const handlerResult = await mod.default();
 			if (handlerResult instanceof Response) return cloneWithMutableHeaders(handlerResult);
 			const contentType = metaMatch.contentType;
@@ -1901,6 +1915,10 @@ async function handleRequest(config, req, method, path) {
 		await coerceSegmentParams(match);
 	} catch (error) {
 		if (error instanceof ParamCoercionError) {
+			if (isDebug()) {
+				const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
+				console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a params.ts codec rejected the URL params.\n  Check that all fields in defineSegmentParams() are optional for params\n  that don't appear at every route depth (e.g. year, month, day).`);
+			}
 			const leafSegment = match.segments[match.segments.length - 1];
 			if (leafSegment.route && !leafSegment.page) return new Response(null, { status: 404 });
 			if (config.renderNoMatch) return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));