@timber-js/app 0.2.0-alpha.134 → 0.2.0-alpha.136

package/dist/index.js

@@ -3,8 +3,9 @@ import { a as isDynamicMetadataExtension, o as isMetadataRouteServePath } from "
 import { h as swallow } from "./_chunks/logger-CMd9P1xQ.js";
 import { c as loadTimberConfigFile, d as resolveBuildDir, f as resolveClientJavascript, l as mergeFileConfig, m as scanRoutes, o as DEFAULT_BUILD_DIR, p as createNoopTimer, s as createPluginContext, u as resolveAppDir } from "./_chunks/cli-schema-sync-q-Ce6-iG.js";
 import { a as generateRouteMap, i as collectInterceptionRewrites, r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "./_chunks/walkers-BbEu2_Pp.js";
-import { t as formatSize } from "./_chunks/format-BjN9HLu9.js";
-import { basename, dirname, extname, join, normalize, resolve } from "node:path";
+import { t as fnv1aHash } from "./_chunks/fast-hash-DXZ7S2D5.js";
+import { t as formatSize } from "./_chunks/format-CR6v1pWE.js";
+import { basename, dirname, extname, join, normalize, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
 import react, { reactCompilerPreset } from "@vitejs/plugin-react";
 import { existsSync, readFileSync } from "node:fs";
@@ -1062,7 +1063,7 @@ function validateConfig(config) {
 			field: "renderTimeoutMs",
 			message: `renderTimeoutMs must be a non-negative number (got ${JSON.stringify(config.renderTimeoutMs)}).`,
 			value: config.renderTimeoutMs,
-			suggestion: "Use renderTimeoutMs: 30000 (default) or renderTimeoutMs: 0 to disable."
+			suggestion: "Use renderTimeoutMs: 30000 (default). Setting 0 uses a 120s safety ceiling."
 		});
 	}
 	if (config.serverTiming !== void 0) {
@@ -6502,6 +6503,107 @@ function timberServerBundle() {
 	];
 }
 //#endregion
+//#region src/plugins/cache.ts
+/**
+* timber-cache-transform — Vite plugin that injects stable callsite IDs
+* into `cache()` calls imported from `@timber-js/app/cache`.
+*
+* Without this plugin, cache keys use a process-local counter (fnIdCounter)
+* which is unstable across cold starts in serverless/multi-instance
+* deployments. With a shared CacheHandler (Redis/KV), colliding counters
+* cause cache key poisoning — serving one route's cached data to another.
+*
+* The plugin transforms:
+*   cache(fn, opts)  →  cache(fn, opts, "stable-id")
+*
+* where stable-id = fnv1a(relativeModulePath + ":cache:" + callIndex).
+*
+* See TIM-997, design/06-caching.md §"Cache Key Security".
+*/
+var CACHE_MODULE_SOURCES = new Set(["@timber-js/app/cache", "timber/cache"]);
+/**
+* Find the local binding name(s) for `cache` imported from the cache module.
+*/
+function findCacheBindings(program) {
+	const bindings = /* @__PURE__ */ new Set();
+	for (const stmt of program.body) {
+		if (stmt.type !== "ImportDeclaration") continue;
+		const decl = stmt;
+		if (!CACHE_MODULE_SOURCES.has(decl.source.value)) continue;
+		for (const spec of decl.specifiers) {
+			if (spec.type !== "ImportSpecifier") continue;
+			if ((spec.imported?.name ?? spec.local.name) === "cache") bindings.add(spec.local.name);
+		}
+	}
+	return bindings;
+}
+/**
+* Recursively walk AST nodes to find cache() call expressions.
+*
+* cache() is typically called at module scope, but we also handle calls
+* inside functions/blocks for completeness.
+*/
+function findCacheCallSites(node, cacheBindings, results) {
+	if (node.type === "CallExpression") {
+		const call = node;
+		if (call.callee.type === "Identifier" && cacheBindings.has(call.callee.name) && call.arguments.length === 2) results.push(call);
+	}
+	for (const key of Object.keys(node)) {
+		if (key === "type" || key === "start" || key === "end") continue;
+		const val = node[key];
+		if (val && typeof val === "object") {
+			if (Array.isArray(val)) {
+				for (const item of val) if (item && typeof item === "object" && typeof item.type === "string") findCacheCallSites(item, cacheBindings, results);
+			} else if (typeof val.type === "string") findCacheCallSites(val, cacheBindings, results);
+		}
+	}
+}
+/**
+* Generate a stable callsite ID from a module path and call index.
+*
+* The ID is an FNV-1a hash of the relative module path + call index,
+* providing a deterministic identifier that is:
+* - Stable across cold starts of the same build
+* - Unique across different modules
+* - Unique across multiple cache() calls within the same module
+*/
+function generateStableId(relativeModulePath, callIndex) {
+	return fnv1aHash(`${relativeModulePath}:cache:${callIndex}`);
+}
+function timberCacheTransform(ctx) {
+	return {
+		name: "timber-cache-transform",
+		transform(code, id) {
+			if (!code.includes("@timber-js/app/cache") && !code.includes("timber/cache")) return;
+			if (id.includes("node_modules")) return;
+			let program;
+			try {
+				program = parseAst(code, { lang: "tsx" });
+			} catch {
+				return;
+			}
+			const cacheBindings = findCacheBindings(program);
+			if (cacheBindings.size === 0) return;
+			const callSites = [];
+			findCacheCallSites(program, cacheBindings, callSites);
+			if (callSites.length === 0) return;
+			callSites.sort((a, b) => a.start - b.start);
+			const relPath = relative(ctx.root || process.cwd(), id);
+			const s = new MagicString(code);
+			for (let i = 0; i < callSites.length; i++) {
+				const call = callSites[i];
+				const stableId = generateStableId(relPath, i);
+				const insertPos = call.end - 1;
+				s.appendLeft(insertPos, `, "${stableId}"`);
+			}
+			return {
+				code: s.toString(),
+				map: s.generateMap({ hires: "boundary" })
+			};
+		}
+	};
+}
+//#endregion
 //#region src/plugins/cloudflare-wasm.ts
 /**
 * timber-cloudflare-wasm — Handle WASM modules for Cloudflare Workers builds.
@@ -7408,6 +7510,7 @@ function timber(config) {
 		timberStaticBuild(ctx),
 		timberFonts(ctx),
 		timberMdx(ctx),
+		timberCacheTransform(ctx),
 		timberContent(ctx),
 		timberServerBundle(),
 		timberCloudflareWasm(ctx),