@timber-js/app 0.2.0-alpha.15 → 0.2.0-alpha.151

package/dist/_chunks/cache-api-Co-yI-gP.js

@@ -0,0 +1,424 @@
+import { N as waitUntilAls, d as logSwrRefetchFailed, y as addSpanEventSync } from "./logger-CM0clugc.js";
+import { t as fnv1aHash } from "./fast-hash-D6hIVt1Y.js";
+//#region src/server/waituntil-bridge.ts
+/**
+* Per-request waitUntil bridge — ALS bridge for platform adapters.
+*
+* The generated entry point (Nitro, Cloudflare) wraps the handler with
+* `runWithWaitUntil`, binding the platform's lifecycle extension function
+* (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the
+* request duration. The `waitUntil()` primitive reads from this ALS to
+* dispatch background work to the correct platform API.
+*
+* Design doc: design/11-platform.md §"waitUntil()"
+*/
+/**
+* Get the current request's waitUntil function, if available.
+*
+* Returns undefined when no platform adapter has installed a waitUntil
+* handler for the current request (e.g., on platforms that don't support
+* lifecycle extension, or outside a request context).
+*/
+function getWaitUntil() {
+	return waitUntilAls.getStore();
+}
+//#endregion
+//#region src/cache/stable-stringify.ts
+/**
+* Deterministic JSON serialization with sorted object keys.
+* Used for cache key generation — ensures { a: 1, b: 2 } and { b: 2, a: 1 }
+* produce the same string.
+*
+* Matches JSON.stringify semantics for toJSON: Date serializes to its ISO
+* string, URL to its href, and class instances with a custom toJSON use it.
+* Map and Set serialize their entries explicitly (insertion-order
+* independent). Values that would serialize lossily — functions, symbols,
+* and non-plain objects with no enumerable own state (RegExp, class
+* instances holding data behind getters or internal slots) — throw instead:
+* every such value would collapse to the same cache key, silently returning
+* one argument's cached data for another (TIM-1020).
+*/
+function stableStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	const type = typeof value;
+	if (type === "function" || type === "symbol") throw new TypeError(`stableStringify: cannot serialize a ${type} into a stable cache key — all such values would collide. Provide an explicit \`key\` option to cache().`);
+	if (type !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return "[" + value.map((item) => stableStringify(item)).join(",") + "]";
+	const withToJSON = value;
+	if (typeof withToJSON.toJSON === "function") {
+		const json = withToJSON.toJSON();
+		if (json !== value) return stableStringify(json);
+	}
+	if (value instanceof Map) return "Map(" + [...value.entries()].map(([k, v]) => stableStringify(k) + "=>" + stableStringify(v)).sort().join(",") + ")";
+	if (value instanceof Set) return "Set(" + [...value].map((member) => stableStringify(member)).sort().join(",") + ")";
+	const obj = value;
+	const keys = Object.keys(obj).sort();
+	const pairs = [];
+	for (const key of keys) {
+		if (obj[key] === void 0) continue;
+		if (key === "toJSON" && typeof obj[key] === "function") continue;
+		pairs.push(JSON.stringify(key) + ":" + stableStringify(obj[key]));
+	}
+	if (pairs.length === 0) {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) {
+			const name = value.constructor?.name || "Object";
+			throw new TypeError(`stableStringify: ${name} instance has no serializable own state — all instances would share one cache key. Provide an explicit \`key\` option to cache(), or add a toJSON() method.`);
+		}
+	}
+	return "{" + pairs.join(",") + "}";
+}
+//#endregion
+//#region src/cache/singleflight.ts
+/**
+* Error thrown when a singleflight call exceeds `timeoutMs`.
+* Exported so callers can distinguish timeout from other errors.
+*/
+var SingleflightTimeoutError = class extends Error {
+	constructor(key, timeoutMs) {
+		super(`Singleflight timeout: key "${key}" exceeded ${timeoutMs}ms`);
+		this.name = "SingleflightTimeoutError";
+	}
+};
+function createSingleflight(opts) {
+	const inflight = /* @__PURE__ */ new Map();
+	const timeoutMs = opts?.timeoutMs;
+	return { do(key, fn) {
+		const existing = inflight.get(key);
+		if (existing) return existing;
+		let promise;
+		if (timeoutMs != null && timeoutMs > 0) promise = new Promise((resolve, reject) => {
+			const timer = setTimeout(() => reject(new SingleflightTimeoutError(key, timeoutMs)), timeoutMs);
+			try {
+				fn().then((value) => {
+					clearTimeout(timer);
+					resolve(value);
+				}, (err) => {
+					clearTimeout(timer);
+					reject(err);
+				});
+			} catch (err) {
+				clearTimeout(timer);
+				reject(err);
+			}
+		});
+		else promise = fn();
+		const tracked = promise.finally(() => {
+			inflight.delete(key);
+		});
+		inflight.set(key, tracked);
+		return tracked;
+	} };
+}
+//#endregion
+//#region src/cache/invalidation-epoch.ts
+/**
+* Per-process invalidation epoch tracking for timber.cache (TIM-1028).
+*
+* handler.set for a cache miss runs after `fn()` resolves. An explicit
+* `cache.invalidate({ tag })` / `revalidateTag` that lands while fn is in
+* flight would otherwise be silently undone — the just-invalidated value
+* re-stored as fresh for the full TTL, resurrecting pre-mutation data.
+*
+* Every invalidation bumps a monotonic epoch and records it against the
+* invalidated key/tag. Before storing a result, the cache wrapper checks
+* whether its key or any of its tags were invalidated after fn started and
+* skips the write if so. Skipping is always safe: the only cost is one
+* extra cache miss on the next call.
+*
+* Scope: per-process, like the singleflight map. An invalidation issued by
+* another instance against a shared handler (Redis/KV) during fn flight is
+* not observable here — closing that window fully would require store-level
+* versioning, which no CacheHandler backend offers.
+*/
+var epoch = 0;
+/**
+* Last-invalidated epoch per `key:<k>` / `tag:<t>` entry. Insertion order is
+* epoch order (entries are re-inserted on update), so the oldest entry is
+* always first — pruning evicts lowest epochs.
+*/
+var lastInvalidated = /* @__PURE__ */ new Map();
+/**
+* Bound on tracked entries so high-cardinality tag invalidation (e.g.
+* per-user tags) cannot grow this map without limit.
+*/
+var MAX_TRACKED_ENTRIES = 1e4;
+/**
+* Highest epoch evicted from the map. Any execution that started at or
+* before this epoch conservatively counts as invalidated — history was
+* truncated, so we can no longer prove it wasn't.
+*/
+var evictedEpochFloor = 0;
+/** The current epoch. Capture before running fn(), pass to wasInvalidatedSince. */
+function currentInvalidationEpoch() {
+	return epoch;
+}
+/**
+* Record an invalidation. Call BEFORE handler.invalidate() so an execution
+* whose set-check races the invalidation errs toward skipping the write.
+*/
+function recordInvalidation(opts) {
+	epoch++;
+	if (opts.key) track(`key:${opts.key}`);
+	if (opts.tag) track(`tag:${opts.tag}`);
+}
+function track(entry) {
+	lastInvalidated.delete(entry);
+	lastInvalidated.set(entry, epoch);
+	while (lastInvalidated.size > MAX_TRACKED_ENTRIES) {
+		const oldest = lastInvalidated.entries().next().value;
+		if (oldest === void 0) break;
+		evictedEpochFloor = Math.max(evictedEpochFloor, oldest[1]);
+		lastInvalidated.delete(oldest[0]);
+	}
+}
+/**
+* Whether the key or any tag was invalidated after `startEpoch` (the epoch
+* captured when fn started executing).
+*/
+function wasInvalidatedSince(startEpoch, key, tags) {
+	return lastInvalidationEpochFor(key, tags) > startEpoch;
+}
+/**
+* The highest epoch at which the key or any of the tags was invalidated
+* (0 if never). Used to scope the singleflight key: callers arriving after
+* an invalidation must not coalesce onto a flight that started before it —
+* they would receive the pre-invalidation result the invalidation was
+* issued to discard.
+*/
+function lastInvalidationEpochFor(key, tags) {
+	let last = evictedEpochFloor;
+	const keyEpoch = lastInvalidated.get(`key:${key}`);
+	if (keyEpoch !== void 0 && keyEpoch > last) last = keyEpoch;
+	for (const tag of tags) {
+		const tagEpoch = lastInvalidated.get(`tag:${tag}`);
+		if (tagEpoch !== void 0 && tagEpoch > last) last = tagEpoch;
+	}
+	return last;
+}
+//#endregion
+//#region src/cache/timber-cache.ts
+var defaultSingleflight = createSingleflight();
+/**
+* Set the timeout for the module-level default singleflight.
+* Called at framework boot with renderTimeoutMs from timber.config.ts so that
+* cache calls without a per-call timeoutMs still get deadlock protection.
+* See design/06-caching.md §"Singleflight Timeout — Deadlock Risk".
+*/
+function setDefaultSingleflightTimeout(timeoutMs) {
+	defaultSingleflight = createSingleflight({ timeoutMs });
+}
+/**
+* Generate a cache key from function identity and serialized args.
+*
+* Uses FNV-1a (fast non-crypto hash) instead of SHA-256. Cache keys don't
+* need collision resistance — they need speed. The fnId prefix provides
+* namespace isolation; the hash covers the args.
+*
+* See TIM-370 for perf motivation.
+*/
+function defaultKeyGenerator(fnId, args) {
+	const raw = fnId + ":" + stableStringify(args);
+	return fnId + ":" + fnv1aHash(raw);
+}
+/**
+* Resolve tags from the options — supports static array or function form.
+*/
+function resolveTags(opts, args) {
+	if (!opts.tags) return [];
+	if (Array.isArray(opts.tags)) return opts.tags;
+	return opts.tags(...args);
+}
+/** Per-process count of byte-identical fn sources seen by deriveFallbackFnId. */
+var fallbackIdOccurrences = /* @__PURE__ */ new Map();
+var hasWarnedFallbackId = false;
+/**
+* Derive a fallback fnId for callsites the timber-cache-transform Vite plugin
+* could not statically detect (aliased bindings, user re-export wrappers).
+*
+* The base is fnv1a(fn.toString()) — deterministic across instances and cold
+* starts of the same build, so two *different* functions can never swap fnIds
+* by module-evaluation order (the TIM-997 poisoning scenario that the old
+* process-local counter allowed; see TIM-1054). A per-process occurrence
+* suffix disambiguates byte-identical duplicate sources. That residue is the
+* one remaining hazard: closures produced by the same factory share source
+* text but capture different values, and their occurrence order may differ
+* across instances — such callsites need an explicit `key` option.
+*/
+function deriveFallbackFnId(fn) {
+	const sourceHash = fnv1aHash(fn.toString());
+	const occurrence = fallbackIdOccurrences.get(sourceHash) ?? 0;
+	fallbackIdOccurrences.set(sourceHash, occurrence + 1);
+	if (!hasWarnedFallbackId && typeof process !== "undefined" && process.env.NODE_ENV !== "test") {
+		hasWarnedFallbackId = true;
+		console.warn("[timber] cache() callsite has no build-time stable ID and no explicit `key` option — the call is not statically visible to the timber Vite plugin (e.g. an aliased binding like `const c = cache` or a re-export wrapper module). Falling back to a function-source hash for the cache key. With a shared CacheHandler (Redis/KV) this is safe for distinct functions, but byte-identical closures from a factory can swap cache entries across instances. Provide an explicit `key` option to make the cache key contract stable and auditable.");
+	}
+	return `timber-cache:fn:${sourceHash}:${occurrence}`;
+}
+/**
+* Creates a cached wrapper around an async function.
+*
+* - FNV-1a default keys with normalized JSON args
+* - Singleflight: concurrent misses → single execution AND single
+*   handler.set — the write happens inside the coalesced callback (TIM-1028)
+* - Writes are skipped when the key/tags were invalidated while fn was in
+*   flight, so explicit invalidation is never silently undone (TIM-1028)
+* - SWR: serve stale immediately, background refetch
+* - Tags as string[] or function of args
+* - The handler is resolved per invocation via `getHandler`, never captured
+*   at wrapper-creation time — module-scope cache() wrappers created before
+*   the framework's boot wiring calls setCacheHandler() still use the
+*   configured handler once it arrives (TIM-1029)
+* - No ALS dependency for correctness — cache() works outside a request
+*   context. The waitUntil ALS bridge is read optionally so the SWR
+*   background refetch survives handler return on Workers/Lambda.
+*
+* Cache hits/misses are recorded as OTEL span events on the enclosing
+* span (not child spans). The DevSpanProcessor reads these for dev log output.
+*/
+function createCache(fn, opts, getHandler, stableId) {
+	const fnId = stableId ?? (opts.key ? void 0 : deriveFallbackFnId(fn));
+	const perCallSf = opts.timeoutMs !== void 0 ? createSingleflight({ timeoutMs: opts.timeoutMs }) : void 0;
+	return (async (...args) => {
+		const sf = perCallSf ?? defaultSingleflight;
+		const key = opts.key ? opts.key(...args) : defaultKeyGenerator(fnId, args);
+		const cacheStart = performance.now();
+		const cached = await getHandler().get(key);
+		if (cached && !cached.stale) {
+			addSpanEventSync("timber.cache.hit", {
+				key,
+				duration_ms: Math.round(performance.now() - cacheStart)
+			});
+			return cached.value;
+		}
+		const tags = resolveTags(opts, args);
+		const flightKey = `${key}\u0000${lastInvalidationEpochFor(key, tags)}`;
+		/**
+		* Run fn and store the result — exactly once per coalesced execution,
+		* inside the singleflight callback. The write is skipped when the key or
+		* any resolved tag was invalidated after fn started: storing would
+		* resurrect just-invalidated data as fresh for the full TTL.
+		*/
+		const executeAndStore = async () => {
+			const startEpoch = currentInvalidationEpoch();
+			const result = await fn(...args);
+			if (!wasInvalidatedSince(startEpoch, key, tags)) await getHandler().set(key, result, {
+				ttl: opts.ttl,
+				tags
+			});
+			return result;
+		};
+		if (cached && cached.stale && opts.staleWhileRevalidate) {
+			addSpanEventSync("timber.cache.hit", {
+				key,
+				duration_ms: Math.round(performance.now() - cacheStart),
+				stale: true
+			});
+			const refetch = sf.do(`swr:${flightKey}`, async () => {
+				try {
+					await executeAndStore();
+				} catch (err) {
+					logSwrRefetchFailed({
+						cacheKey: key,
+						error: err
+					});
+				}
+			}).catch(() => {});
+			getWaitUntil()?.(refetch);
+			return cached.value;
+		}
+		const result = await sf.do(flightKey, executeAndStore);
+		addSpanEventSync("timber.cache.miss", {
+			key,
+			duration_ms: Math.round(performance.now() - cacheStart)
+		});
+		return result;
+	});
+}
+//#endregion
+//#region src/cache/handler-store.ts
+var handler = null;
+/** Replace the active cache handler. Called by the framework at boot. */
+function setCacheHandler(h) {
+	handler = h;
+}
+/**
+* Get the active cache handler. Creates a default MemoryCacheHandler on
+* first access if none has been set via setCacheHandler().
+*/
+function getCacheHandler() {
+	if (!handler) handler = createDefaultHandler();
+	return handler;
+}
+function createDefaultHandler() {
+	const store = /* @__PURE__ */ new Map();
+	const maxEntries = 1e3;
+	return {
+		async get(key) {
+			const entry = store.get(key);
+			if (!entry) return null;
+			store.delete(key);
+			store.set(key, entry);
+			const stale = Date.now() > entry.expiresAt;
+			return {
+				value: entry.value,
+				stale
+			};
+		},
+		async set(key, value, opts) {
+			if (store.has(key)) store.delete(key);
+			while (store.size >= maxEntries) {
+				const oldest = store.keys().next().value;
+				if (oldest !== void 0) store.delete(oldest);
+				else break;
+			}
+			store.set(key, {
+				value,
+				expiresAt: Date.now() + opts.ttl * 1e3,
+				tags: opts.tags
+			});
+		},
+		async invalidate(opts) {
+			if (opts.key) store.delete(opts.key);
+			if (opts.tag) {
+				for (const [key, entry] of store) if (entry.tags.includes(opts.tag)) store.delete(key);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/cache/cache-api.ts
+/**
+* Public caching API: `cache(fn, opts)`.
+*
+* Wraps an async function with cross-request caching. Uses the configured
+* cache handler (defaults to MemoryCacheHandler, overridable via timber.config.ts).
+*
+* ```ts
+* import { cache } from '@timber-js/app/cache';
+*
+* const getUser = cache(
+*   async (id: string) => db.users.findUnique({ where: { id } }),
+*   { ttl: 60, tags: (id) => [`user:${id}`] }
+* );
+* ```
+*/
+function cache(fn, opts, stableId) {
+	return createCache(fn, opts, getCacheHandler, stableId);
+}
+/**
+* Invalidate cache entries by tag or key.
+*
+* ```ts
+* cache.invalidate({ tag: 'products' });
+* cache.invalidate({ key: 'user:abc' });
+* ```
+*/
+cache.invalidate = async function invalidate(opts) {
+	recordInvalidation(opts);
+	await getCacheHandler().invalidate(opts);
+};
+//#endregion
+export { getWaitUntil as a, setDefaultSingleflightTimeout as i, getCacheHandler as n, setCacheHandler as r, cache as t };
+
+//# sourceMappingURL=cache-api-Co-yI-gP.js.map

package/dist/_chunks/cache-api-Co-yI-gP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-api-Co-yI-gP.js","names":[],"sources":["../../src/server/waituntil-bridge.ts","../../src/cache/stable-stringify.ts","../../src/cache/singleflight.ts","../../src/cache/invalidation-epoch.ts","../../src/cache/timber-cache.ts","../../src/cache/handler-store.ts","../../src/cache/cache-api.ts"],"sourcesContent":["/**\n * Per-request waitUntil bridge — ALS bridge for platform adapters.\n *\n * The generated entry point (Nitro, Cloudflare) wraps the handler with\n * `runWithWaitUntil`, binding the platform's lifecycle extension function\n * (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the\n * request duration. The `waitUntil()` primitive reads from this ALS to\n * dispatch background work to the correct platform API.\n *\n * Design doc: design/11-platform.md §\"waitUntil()\"\n */\n\nimport { waitUntilAls } from './als-registry.js';\n\n/**\n * Run a function with a per-request waitUntil handler installed.\n *\n * Called by generated entry points (Nitro node-server/bun, Cloudflare)\n * to bind the platform's lifecycle extension for the request duration.\n */\nexport function runWithWaitUntil<T>(\n  waitUntilFn: (promise: Promise<unknown>) => void,\n  fn: () => T\n): T {\n  return waitUntilAls.run(waitUntilFn, fn);\n}\n\n/**\n * Get the current request's waitUntil function, if available.\n *\n * Returns undefined when no platform adapter has installed a waitUntil\n * handler for the current request (e.g., on platforms that don't support\n * lifecycle extension, or outside a request context).\n */\nexport function getWaitUntil(): ((promise: Promise<unknown>) => void) | undefined {\n  return waitUntilAls.getStore();\n}\n","/**\n * Deterministic JSON serialization with sorted object keys.\n * Used for cache key generation — ensures { a: 1, b: 2 } and { b: 2, a: 1 }\n * produce the same string.\n *\n * Matches JSON.stringify semantics for toJSON: Date serializes to its ISO\n * string, URL to its href, and class instances with a custom toJSON use it.\n * Map and Set serialize their entries explicitly (insertion-order\n * independent). Values that would serialize lossily — functions, symbols,\n * and non-plain objects with no enumerable own state (RegExp, class\n * instances holding data behind getters or internal slots) — throw instead:\n * every such value would collapse to the same cache key, silently returning\n * one argument's cached data for another (TIM-1020).\n */\nexport function stableStringify(value: unknown): string {\n  if (value === null || value === undefined) return String(value);\n\n  const type = typeof value;\n  if (type === 'function' || type === 'symbol') {\n    throw new TypeError(\n      `stableStringify: cannot serialize a ${type} into a stable cache key — ` +\n        'all such values would collide. Provide an explicit `key` option to cache().'\n    );\n  }\n  if (type !== 'object') return JSON.stringify(value);\n\n  if (Array.isArray(value)) {\n    return '[' + value.map((item) => stableStringify(item)).join(',') + ']';\n  }\n\n  // Honor toJSON like JSON.stringify does (Date → ISO string, URL → href,\n  // custom class serialization). JSON.stringify does not re-invoke toJSON\n  // on the value it returns, so a toJSON that returns `this` falls through\n  // to plain own-property serialization instead of recursing forever.\n  const withToJSON = value as { toJSON?: () => unknown };\n  if (typeof withToJSON.toJSON === 'function') {\n    const json = withToJSON.toJSON();\n    if (json !== value) return stableStringify(json);\n  }\n\n  // Map/Set have no enumerable own properties — serialize entries explicitly.\n  // Entries are sorted after serialization so insertion order doesn't change\n  // the key. The Map(/Set( prefixes can't collide with object ('{'), array\n  // ('['), or string ('\"') output.\n  if (value instanceof Map) {\n    const entries = [...value.entries()].map(\n      ([k, v]) => stableStringify(k) + '=>' + stableStringify(v)\n    );\n    return 'Map(' + entries.sort().join(',') + ')';\n  }\n  if (value instanceof Set) {\n    const members = [...value].map((member) => stableStringify(member));\n    return 'Set(' + members.sort().join(',') + ')';\n  }\n\n  const obj = value as Record<string, unknown>;\n  const keys = Object.keys(obj).sort();\n  const pairs: string[] = [];\n  for (const key of keys) {\n    if (obj[key] === undefined) continue;\n    // A callable own toJSON only reaches this loop via the returns-`this`\n    // fall-through above. It's the serialization protocol, not data —\n    // JSON.stringify omits it too.\n    if (key === 'toJSON' && typeof obj[key] === 'function') continue;\n    pairs.push(JSON.stringify(key) + ':' + stableStringify(obj[key]));\n  }\n\n  // A non-plain object that serializes to '{}' carries its state behind\n  // getters or internal slots (RegExp, sessions, ORM entities). Serializing\n  // it would give every instance the same cache key.\n  if (pairs.length === 0) {\n    const proto = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null) {\n      const name = (value as object).constructor?.name || 'Object';\n      throw new TypeError(\n        `stableStringify: ${name} instance has no serializable own state — ` +\n          'all instances would share one cache key. Provide an explicit `key` ' +\n          'option to cache(), or add a toJSON() method.'\n      );\n    }\n  }\n\n  return '{' + pairs.join(',') + '}';\n}\n","/**\n * Singleflight coalesces concurrent calls with the same key into a single\n * execution. All callers receive the same result (or error).\n *\n * Per-process, in-memory. Each process coalesces independently.\n *\n * An optional `timeoutMs` prevents hung `fn()` calls from permanently\n * blocking all future callers for that key. When set, `fn()` is raced\n * against a timeout — if the timeout fires first, the promise rejects\n * with `SingleflightTimeoutError`, `finally` cleans up the key, and\n * subsequent callers can retry. See TIM-518.\n */\n\nexport interface SingleflightOptions {\n  /** Maximum time (ms) a coalesced call may run before being rejected. */\n  timeoutMs?: number;\n}\n\nexport interface Singleflight {\n  do<T>(key: string, fn: () => Promise<T>): Promise<T>;\n}\n\n/**\n * Error thrown when a singleflight call exceeds `timeoutMs`.\n * Exported so callers can distinguish timeout from other errors.\n */\nexport class SingleflightTimeoutError extends Error {\n  constructor(key: string, timeoutMs: number) {\n    super(`Singleflight timeout: key \"${key}\" exceeded ${timeoutMs}ms`);\n    this.name = 'SingleflightTimeoutError';\n  }\n}\n\nexport function createSingleflight(opts?: SingleflightOptions): Singleflight {\n  const inflight = new Map<string, Promise<unknown>>();\n  const timeoutMs = opts?.timeoutMs;\n\n  return {\n    do<T>(key: string, fn: () => Promise<T>): Promise<T> {\n      const existing = inflight.get(key);\n      if (existing) return existing as Promise<T>;\n\n      let promise: Promise<T>;\n\n      if (timeoutMs != null && timeoutMs > 0) {\n        // Race fn() against a timeout to prevent hung calls from\n        // permanently blocking the key. See TIM-518.\n        promise = new Promise<T>((resolve, reject) => {\n          const timer = setTimeout(\n            () => reject(new SingleflightTimeoutError(key, timeoutMs)),\n            timeoutMs\n          );\n          // Wrap in try/catch so a synchronous throw from fn()\n          // (e.g. argument validation) still clears the timer.\n          // Without this, the timer leaks until expiry.\n          try {\n            fn().then(\n              (value) => {\n                clearTimeout(timer);\n                resolve(value);\n              },\n              (err) => {\n                clearTimeout(timer);\n                reject(err);\n              }\n            );\n          } catch (err) {\n            clearTimeout(timer);\n            reject(err);\n          }\n        });\n      } else {\n        promise = fn();\n      }\n\n      const tracked = promise.finally(() => {\n        inflight.delete(key);\n      });\n\n      inflight.set(key, tracked);\n      return tracked as Promise<T>;\n    },\n  };\n}\n","/**\n * Per-process invalidation epoch tracking for timber.cache (TIM-1028).\n *\n * handler.set for a cache miss runs after `fn()` resolves. An explicit\n * `cache.invalidate({ tag })` / `revalidateTag` that lands while fn is in\n * flight would otherwise be silently undone — the just-invalidated value\n * re-stored as fresh for the full TTL, resurrecting pre-mutation data.\n *\n * Every invalidation bumps a monotonic epoch and records it against the\n * invalidated key/tag. Before storing a result, the cache wrapper checks\n * whether its key or any of its tags were invalidated after fn started and\n * skips the write if so. Skipping is always safe: the only cost is one\n * extra cache miss on the next call.\n *\n * Scope: per-process, like the singleflight map. An invalidation issued by\n * another instance against a shared handler (Redis/KV) during fn flight is\n * not observable here — closing that window fully would require store-level\n * versioning, which no CacheHandler backend offers.\n */\n\nlet epoch = 0;\n\n/**\n * Last-invalidated epoch per `key:<k>` / `tag:<t>` entry. Insertion order is\n * epoch order (entries are re-inserted on update), so the oldest entry is\n * always first — pruning evicts lowest epochs.\n */\nconst lastInvalidated = new Map<string, number>();\n\n/**\n * Bound on tracked entries so high-cardinality tag invalidation (e.g.\n * per-user tags) cannot grow this map without limit.\n */\nconst MAX_TRACKED_ENTRIES = 10_000;\n\n/**\n * Highest epoch evicted from the map. Any execution that started at or\n * before this epoch conservatively counts as invalidated — history was\n * truncated, so we can no longer prove it wasn't.\n */\nlet evictedEpochFloor = 0;\n\n/** The current epoch. Capture before running fn(), pass to wasInvalidatedSince. */\nexport function currentInvalidationEpoch(): number {\n  return epoch;\n}\n\n/**\n * Record an invalidation. Call BEFORE handler.invalidate() so an execution\n * whose set-check races the invalidation errs toward skipping the write.\n */\nexport function recordInvalidation(opts: { key?: string; tag?: string }): void {\n  epoch++;\n  if (opts.key) track(`key:${opts.key}`);\n  if (opts.tag) track(`tag:${opts.tag}`);\n}\n\nfunction track(entry: string): void {\n  lastInvalidated.delete(entry);\n  lastInvalidated.set(entry, epoch);\n  while (lastInvalidated.size > MAX_TRACKED_ENTRIES) {\n    const oldest = lastInvalidated.entries().next().value;\n    if (oldest === undefined) break;\n    evictedEpochFloor = Math.max(evictedEpochFloor, oldest[1]);\n    lastInvalidated.delete(oldest[0]);\n  }\n}\n\n/**\n * Whether the key or any tag was invalidated after `startEpoch` (the epoch\n * captured when fn started executing).\n */\nexport function wasInvalidatedSince(startEpoch: number, key: string, tags: string[]): boolean {\n  return lastInvalidationEpochFor(key, tags) > startEpoch;\n}\n\n/**\n * The highest epoch at which the key or any of the tags was invalidated\n * (0 if never). Used to scope the singleflight key: callers arriving after\n * an invalidation must not coalesce onto a flight that started before it —\n * they would receive the pre-invalidation result the invalidation was\n * issued to discard.\n */\nexport function lastInvalidationEpochFor(key: string, tags: string[]): number {\n  let last = evictedEpochFloor;\n  const keyEpoch = lastInvalidated.get(`key:${key}`);\n  if (keyEpoch !== undefined && keyEpoch > last) last = keyEpoch;\n  for (const tag of tags) {\n    const tagEpoch = lastInvalidated.get(`tag:${tag}`);\n    if (tagEpoch !== undefined && tagEpoch > last) last = tagEpoch;\n  }\n  return last;\n}\n","import type { CacheHandler, CacheOptions } from './index';\nimport { stableStringify } from './stable-stringify';\nimport { createSingleflight } from './singleflight';\nimport {\n  currentInvalidationEpoch,\n  lastInvalidationEpochFor,\n  wasInvalidatedSince,\n} from './invalidation-epoch';\nimport { addSpanEventSync } from '../server/tracing.js';\nimport { logSwrRefetchFailed } from '../server/logger.js';\nimport { getWaitUntil } from '../server/waituntil-bridge.js';\nimport { fnv1aHash } from './fast-hash.js';\n\nlet defaultSingleflight = createSingleflight();\n\n/**\n * Set the timeout for the module-level default singleflight.\n * Called at framework boot with renderTimeoutMs from timber.config.ts so that\n * cache calls without a per-call timeoutMs still get deadlock protection.\n * See design/06-caching.md §\"Singleflight Timeout — Deadlock Risk\".\n */\nexport function setDefaultSingleflightTimeout(timeoutMs: number): void {\n  defaultSingleflight = createSingleflight({ timeoutMs });\n}\n\n/**\n * Generate a cache key from function identity and serialized args.\n *\n * Uses FNV-1a (fast non-crypto hash) instead of SHA-256. Cache keys don't\n * need collision resistance — they need speed. The fnId prefix provides\n * namespace isolation; the hash covers the args.\n *\n * See TIM-370 for perf motivation.\n */\nfunction defaultKeyGenerator(fnId: string, args: unknown[]): string {\n  const raw = fnId + ':' + stableStringify(args);\n  return fnId + ':' + fnv1aHash(raw);\n}\n\n/**\n * Resolve tags from the options — supports static array or function form.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction resolveTags<Fn extends (...args: any[]) => any>(\n  opts: CacheOptions<Fn>,\n  args: Parameters<Fn>\n): string[] {\n  if (!opts.tags) return [];\n  if (Array.isArray(opts.tags)) return opts.tags;\n  return opts.tags(...args);\n}\n\n/** Per-process count of byte-identical fn sources seen by deriveFallbackFnId. */\nconst fallbackIdOccurrences = new Map<string, number>();\nlet hasWarnedFallbackId = false;\n\n/**\n * Derive a fallback fnId for callsites the timber-cache-transform Vite plugin\n * could not statically detect (aliased bindings, user re-export wrappers).\n *\n * The base is fnv1a(fn.toString()) — deterministic across instances and cold\n * starts of the same build, so two *different* functions can never swap fnIds\n * by module-evaluation order (the TIM-997 poisoning scenario that the old\n * process-local counter allowed; see TIM-1054). A per-process occurrence\n * suffix disambiguates byte-identical duplicate sources. That residue is the\n * one remaining hazard: closures produced by the same factory share source\n * text but capture different values, and their occurrence order may differ\n * across instances — such callsites need an explicit `key` option.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction deriveFallbackFnId(fn: (...args: any[]) => any): string {\n  const sourceHash = fnv1aHash(fn.toString());\n  const occurrence = fallbackIdOccurrences.get(sourceHash) ?? 0;\n  fallbackIdOccurrences.set(sourceHash, occurrence + 1);\n\n  if (!hasWarnedFallbackId && typeof process !== 'undefined' && process.env?.NODE_ENV !== 'test') {\n    hasWarnedFallbackId = true;\n    console.warn(\n      '[timber] cache() callsite has no build-time stable ID and no explicit `key` option — ' +\n        'the call is not statically visible to the timber Vite plugin (e.g. an aliased ' +\n        'binding like `const c = cache` or a re-export wrapper module). Falling back to a ' +\n        'function-source hash for the cache key. With a shared CacheHandler (Redis/KV) this ' +\n        'is safe for distinct functions, but byte-identical closures from a factory can swap ' +\n        'cache entries across instances. Provide an explicit `key` option to make the cache ' +\n        'key contract stable and auditable.'\n    );\n  }\n\n  return `timber-cache:fn:${sourceHash}:${occurrence}`;\n}\n\n/**\n * Creates a cached wrapper around an async function.\n *\n * - FNV-1a default keys with normalized JSON args\n * - Singleflight: concurrent misses → single execution AND single\n *   handler.set — the write happens inside the coalesced callback (TIM-1028)\n * - Writes are skipped when the key/tags were invalidated while fn was in\n *   flight, so explicit invalidation is never silently undone (TIM-1028)\n * - SWR: serve stale immediately, background refetch\n * - Tags as string[] or function of args\n * - The handler is resolved per invocation via `getHandler`, never captured\n *   at wrapper-creation time — module-scope cache() wrappers created before\n *   the framework's boot wiring calls setCacheHandler() still use the\n *   configured handler once it arrives (TIM-1029)\n * - No ALS dependency for correctness — cache() works outside a request\n *   context. The waitUntil ALS bridge is read optionally so the SWR\n *   background refetch survives handler return on Workers/Lambda.\n *\n * Cache hits/misses are recorded as OTEL span events on the enclosing\n * span (not child spans). The DevSpanProcessor reads these for dev log output.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function createCache<Fn extends (...args: any[]) => Promise<any>>(\n  fn: Fn,\n  opts: CacheOptions<Fn>,\n  getHandler: () => CacheHandler,\n  stableId?: string\n): Fn {\n  // With an explicit `key` option the fnId never reaches key generation, so\n  // no fallback derivation (or warning) is needed in that case.\n  const fnId = stableId ?? (opts.key ? undefined : deriveFallbackFnId(fn));\n\n  // Per-call timeoutMs gets a dedicated singleflight instance. Otherwise\n  // resolve defaultSingleflight per invocation (not captured at creation\n  // time) so wrappers created before boot pick up the timeout once\n  // setDefaultSingleflightTimeout is called (TIM-1032, same rationale as\n  // getCacheHandler for TIM-1029).\n  const perCallSf =\n    opts.timeoutMs !== undefined ? createSingleflight({ timeoutMs: opts.timeoutMs }) : undefined;\n\n  // Cast to Fn to preserve the original function's generic call signature.\n  // Without this, generic type parameters (e.g. <T> in apiFetch<T>) are\n  // erased and callers lose type safety on the return type.\n  return (async (...args: Parameters<Fn>): Promise<Awaited<ReturnType<Fn>>> => {\n    const sf = perCallSf ?? defaultSingleflight;\n    const key = opts.key ? opts.key(...args) : defaultKeyGenerator(fnId as string, args);\n\n    const cacheStart = performance.now();\n    const cached = await getHandler().get(key);\n\n    if (cached && !cached.stale) {\n      // Record as OTEL span event on enclosing span (not a child span).\n      // Fire-and-forget — no microtask overhead on the cache hot path.\n      addSpanEventSync('timber.cache.hit', {\n        key,\n        duration_ms: Math.round(performance.now() - cacheStart),\n      });\n      return cached.value as Awaited<ReturnType<Fn>>;\n    }\n\n    // From here fn() will execute (SWR refetch or miss). Scope the\n    // singleflight key by the last invalidation epoch affecting this\n    // key/tags: a caller arriving after an invalidation must not coalesce\n    // onto a flight that started before it — it would receive the\n    // pre-invalidation result the invalidation was issued to discard.\n    // NUL separator: cannot collide with user-provided key strings.\n    const tags = resolveTags(opts, args);\n    const flightKey = `${key}\\u0000${lastInvalidationEpochFor(key, tags)}`;\n\n    /**\n     * Run fn and store the result — exactly once per coalesced execution,\n     * inside the singleflight callback. The write is skipped when the key or\n     * any resolved tag was invalidated after fn started: storing would\n     * resurrect just-invalidated data as fresh for the full TTL.\n     */\n    const executeAndStore = async (): Promise<Awaited<ReturnType<Fn>>> => {\n      const startEpoch = currentInvalidationEpoch();\n      const result = await fn(...args);\n      if (!wasInvalidatedSince(startEpoch, key, tags)) {\n        await getHandler().set(key, result, { ttl: opts.ttl, tags });\n      }\n      return result;\n    };\n\n    if (cached && cached.stale && opts.staleWhileRevalidate) {\n      // Record stale cache hit as OTEL span event (fire-and-forget).\n      addSpanEventSync('timber.cache.hit', {\n        key,\n        duration_ms: Math.round(performance.now() - cacheStart),\n        stale: true,\n      });\n      // Serve stale immediately, trigger background refetch\n      const refetch = sf\n        .do(`swr:${flightKey}`, async () => {\n          try {\n            await executeAndStore();\n          } catch (err) {\n            // Failed refetch — stale entry continues to be served.\n            logSwrRefetchFailed({ cacheKey: key, error: err });\n          }\n        })\n        .catch(() => {\n          // Singleflight promise rejection handled — stale continues.\n        });\n      // Platforms that cancel work when the handler returns (Cloudflare\n      // Workers, Lambda) would otherwise kill the refetch mid-flight —\n      // stale data re-served forever. Register the (never-rejecting)\n      // refetch with the request's waitUntil; undefined outside a request\n      // context or on platforms without lifecycle extension (Node servers\n      // keep floating promises alive, so behavior there is unchanged).\n      getWaitUntil()?.(refetch);\n      return cached.value as Awaited<ReturnType<Fn>>;\n    }\n\n    // Cache miss (or stale without SWR) — execute with singleflight.\n    // The handler.set lives inside the coalesced callback, so N concurrent\n    // misses produce exactly one write (TIM-1028).\n    const result = await sf.do(flightKey, executeAndStore);\n\n    // Record cache miss as OTEL span event (fire-and-forget).\n    addSpanEventSync('timber.cache.miss', {\n      key,\n      duration_ms: Math.round(performance.now() - cacheStart),\n    });\n\n    return result;\n  }) as unknown as Fn;\n}\n","/**\n * Module-level cache handler singleton.\n *\n * Lazily initialized to MemoryCacheHandler on first access. The framework\n * replaces this at boot from timber.config.ts via setCacheHandler().\n *\n * This module avoids importing from ./index to prevent circular dependencies.\n */\n\n// Inline the interface to avoid circular import with index.ts\ninterface CacheHandlerLike {\n  get(key: string): Promise<{ value: unknown; stale: boolean } | null>;\n  set(key: string, value: unknown, opts: { ttl: number; tags: string[] }): Promise<void>;\n  invalidate(opts: { key?: string; tag?: string }): Promise<void>;\n}\n\nlet handler: CacheHandlerLike | null = null;\n\n/** Replace the active cache handler. Called by the framework at boot. */\nexport function setCacheHandler(h: CacheHandlerLike): void {\n  handler = h;\n}\n\n/**\n * Get the active cache handler. Creates a default MemoryCacheHandler on\n * first access if none has been set via setCacheHandler().\n */\nexport function getCacheHandler(): CacheHandlerLike {\n  if (!handler) {\n    // Inline a minimal LRU cache to avoid circular dep with index.ts.\n    // In production, the framework always calls setCacheHandler() at boot.\n    handler = createDefaultHandler();\n  }\n  return handler;\n}\n\nfunction createDefaultHandler(): CacheHandlerLike {\n  const store = new Map<string, { value: unknown; expiresAt: number; tags: string[] }>();\n  const maxEntries = 1000;\n\n  return {\n    async get(key) {\n      const entry = store.get(key);\n      if (!entry) return null;\n      store.delete(key);\n      store.set(key, entry);\n      const stale = Date.now() > entry.expiresAt;\n      return { value: entry.value, stale };\n    },\n    async set(key, value, opts) {\n      if (store.has(key)) store.delete(key);\n      while (store.size >= maxEntries) {\n        const oldest = store.keys().next().value;\n        if (oldest !== undefined) store.delete(oldest);\n        else break;\n      }\n      store.set(key, { value, expiresAt: Date.now() + opts.ttl * 1000, tags: opts.tags });\n    },\n    async invalidate(opts) {\n      if (opts.key) store.delete(opts.key);\n      if (opts.tag) {\n        for (const [key, entry] of store) {\n          if (entry.tags.includes(opts.tag)) store.delete(key);\n        }\n      }\n    },\n  };\n}\n","import type { CacheOptions } from './index';\nimport { createCache } from './timber-cache';\nimport { getCacheHandler } from './handler-store';\nimport { recordInvalidation } from './invalidation-epoch';\n\n/**\n * Public caching API: `cache(fn, opts)`.\n *\n * Wraps an async function with cross-request caching. Uses the configured\n * cache handler (defaults to MemoryCacheHandler, overridable via timber.config.ts).\n *\n * ```ts\n * import { cache } from '@timber-js/app/cache';\n *\n * const getUser = cache(\n *   async (id: string) => db.users.findUnique({ where: { id } }),\n *   { ttl: 60, tags: (id) => [`user:${id}`] }\n * );\n * ```\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function cache<Fn extends (...args: any[]) => Promise<any>>(\n  fn: Fn,\n  opts: CacheOptions<Fn>,\n  stableId?: string\n): Fn {\n  // Pass the getter, not a resolved handler: the wrapper re-resolves it on\n  // every call, so module-scope wrappers created before the framework's boot\n  // wiring calls setCacheHandler() still pick up the configured handler\n  // instead of permanently binding the in-memory fallback (TIM-1029).\n  return createCache(fn, opts, getCacheHandler, stableId);\n}\n\n/**\n * Invalidate cache entries by tag or key.\n *\n * ```ts\n * cache.invalidate({ tag: 'products' });\n * cache.invalidate({ key: 'user:abc' });\n * ```\n */\ncache.invalidate = async function invalidate(opts: { key?: string; tag?: string }): Promise<void> {\n  // Record before the handler delete so a cached fn in flight skips its\n  // post-resolve set instead of resurrecting the invalidated value (TIM-1028).\n  recordInvalidation(opts);\n  await getCacheHandler().invalidate(opts);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,eAAkE;CAChF,OAAO,aAAa,SAAS;AAC/B;;;;;;;;;;;;;;;;;ACtBA,SAAgB,gBAAgB,OAAwB;CACtD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO,OAAO,KAAK;CAE9D,MAAM,OAAO,OAAO;CACpB,IAAI,SAAS,cAAc,SAAS,UAClC,MAAM,IAAI,UACR,uCAAuC,KAAK,yGAE9C;CAEF,IAAI,SAAS,UAAU,OAAO,KAAK,UAAU,KAAK;CAElD,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,MAAM,KAAK,SAAS,gBAAgB,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI;CAOtE,MAAM,aAAa;CACnB,IAAI,OAAO,WAAW,WAAW,YAAY;EAC3C,MAAM,OAAO,WAAW,OAAO;EAC/B,IAAI,SAAS,OAAO,OAAO,gBAAgB,IAAI;CACjD;CAMA,IAAI,iBAAiB,KAInB,OAAO,SAHS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,KAClC,CAAC,GAAG,OAAO,gBAAgB,CAAC,IAAI,OAAO,gBAAgB,CAAC,CAE3C,EAAQ,KAAK,EAAE,KAAK,GAAG,IAAI;CAE7C,IAAI,iBAAiB,KAEnB,OAAO,SADS,CAAC,GAAG,KAAK,EAAE,KAAK,WAAW,gBAAgB,MAAM,CACjD,EAAQ,KAAK,EAAE,KAAK,GAAG,IAAI;CAG7C,MAAM,MAAM;CACZ,MAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;CACnC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,IAAI,SAAS,KAAA,GAAW;EAI5B,IAAI,QAAQ,YAAY,OAAO,IAAI,SAAS,YAAY;EACxD,MAAM,KAAK,KAAK,UAAU,GAAG,IAAI,MAAM,gBAAgB,IAAI,IAAI,CAAC;CAClE;CAKA,IAAI,MAAM,WAAW,GAAG;EACtB,MAAM,QAAQ,OAAO,eAAe,KAAK;EACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MAAM;GAChD,MAAM,OAAQ,MAAiB,aAAa,QAAQ;GACpD,MAAM,IAAI,UACR,oBAAoB,KAAK,4JAG3B;EACF;CACF;CAEA,OAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AACjC;;;;;;;ACzDA,IAAa,2BAAb,cAA8C,MAAM;CAClD,YAAY,KAAa,WAAmB;EAC1C,MAAM,8BAA8B,IAAI,aAAa,UAAU,GAAG;EAClE,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,mBAAmB,MAA0C;CAC3E,MAAM,2BAAW,IAAI,IAA8B;CACnD,MAAM,YAAY,MAAM;CAExB,OAAO,EACL,GAAM,KAAa,IAAkC;EACnD,MAAM,WAAW,SAAS,IAAI,GAAG;EACjC,IAAI,UAAU,OAAO;EAErB,IAAI;EAEJ,IAAI,aAAa,QAAQ,YAAY,GAGnC,UAAU,IAAI,SAAY,SAAS,WAAW;GAC5C,MAAM,QAAQ,iBACN,OAAO,IAAI,yBAAyB,KAAK,SAAS,CAAC,GACzD,SACF;GAIA,IAAI;IACF,GAAG,EAAE,MACF,UAAU;KACT,aAAa,KAAK;KAClB,QAAQ,KAAK;IACf,IACC,QAAQ;KACP,aAAa,KAAK;KAClB,OAAO,GAAG;IACZ,CACF;GACF,SAAS,KAAK;IACZ,aAAa,KAAK;IAClB,OAAO,GAAG;GACZ;EACF,CAAC;OAED,UAAU,GAAG;EAGf,MAAM,UAAU,QAAQ,cAAc;GACpC,SAAS,OAAO,GAAG;EACrB,CAAC;EAED,SAAS,IAAI,KAAK,OAAO;EACzB,OAAO;CACT,EACF;AACF;;;;;;;;;;;;;;;;;;;;;;AC/DA,IAAI,QAAQ;;;;;;AAOZ,IAAM,kCAAkB,IAAI,IAAoB;;;;;AAMhD,IAAM,sBAAsB;;;;;;AAO5B,IAAI,oBAAoB;;AAGxB,SAAgB,2BAAmC;CACjD,OAAO;AACT;;;;;AAMA,SAAgB,mBAAmB,MAA4C;CAC7E;CACA,IAAI,KAAK,KAAK,MAAM,OAAO,KAAK,KAAK;CACrC,IAAI,KAAK,KAAK,MAAM,OAAO,KAAK,KAAK;AACvC;AAEA,SAAS,MAAM,OAAqB;CAClC,gBAAgB,OAAO,KAAK;CAC5B,gBAAgB,IAAI,OAAO,KAAK;CAChC,OAAO,gBAAgB,OAAO,qBAAqB;EACjD,MAAM,SAAS,gBAAgB,QAAQ,EAAE,KAAK,EAAE;EAChD,IAAI,WAAW,KAAA,GAAW;EAC1B,oBAAoB,KAAK,IAAI,mBAAmB,OAAO,EAAE;EACzD,gBAAgB,OAAO,OAAO,EAAE;CAClC;AACF;;;;;AAMA,SAAgB,oBAAoB,YAAoB,KAAa,MAAyB;CAC5F,OAAO,yBAAyB,KAAK,IAAI,IAAI;AAC/C;;;;;;;;AASA,SAAgB,yBAAyB,KAAa,MAAwB;CAC5E,IAAI,OAAO;CACX,MAAM,WAAW,gBAAgB,IAAI,OAAO,KAAK;CACjD,IAAI,aAAa,KAAA,KAAa,WAAW,MAAM,OAAO;CACtD,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,WAAW,gBAAgB,IAAI,OAAO,KAAK;EACjD,IAAI,aAAa,KAAA,KAAa,WAAW,MAAM,OAAO;CACxD;CACA,OAAO;AACT;;;AC/EA,IAAI,sBAAsB,mBAAmB;;;;;;;AAQ7C,SAAgB,8BAA8B,WAAyB;CACrE,sBAAsB,mBAAmB,EAAE,UAAU,CAAC;AACxD;;;;;;;;;;AAWA,SAAS,oBAAoB,MAAc,MAAyB;CAClE,MAAM,MAAM,OAAO,MAAM,gBAAgB,IAAI;CAC7C,OAAO,OAAO,MAAM,UAAU,GAAG;AACnC;;;;AAMA,SAAS,YACP,MACA,MACU;CACV,IAAI,CAAC,KAAK,MAAM,OAAO,CAAC;CACxB,IAAI,MAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,KAAK;CAC1C,OAAO,KAAK,KAAK,GAAG,IAAI;AAC1B;;AAGA,IAAM,wCAAwB,IAAI,IAAoB;AACtD,IAAI,sBAAsB;;;;;;;;;;;;;;AAgB1B,SAAS,mBAAmB,IAAqC;CAC/D,MAAM,aAAa,UAAU,GAAG,SAAS,CAAC;CAC1C,MAAM,aAAa,sBAAsB,IAAI,UAAU,KAAK;CAC5D,sBAAsB,IAAI,YAAY,aAAa,CAAC;CAEpD,IAAI,CAAC,uBAAuB,OAAO,YAAY,eAAA,QAAA,IAAA,aAAyC,QAAQ;EAC9F,sBAAsB;EACtB,QAAQ,KACN,khBAOF;CACF;CAEA,OAAO,mBAAmB,WAAW,GAAG;AAC1C;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,YACd,IACA,MACA,YACA,UACI;CAGJ,MAAM,OAAO,aAAa,KAAK,MAAM,KAAA,IAAY,mBAAmB,EAAE;CAOtE,MAAM,YACJ,KAAK,cAAc,KAAA,IAAY,mBAAmB,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI,KAAA;CAKrF,QAAQ,OAAO,GAAG,SAA2D;EAC3E,MAAM,KAAK,aAAa;EACxB,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI,IAAI,oBAAoB,MAAgB,IAAI;EAEnF,MAAM,aAAa,YAAY,IAAI;EACnC,MAAM,SAAS,MAAM,WAAW,EAAE,IAAI,GAAG;EAEzC,IAAI,UAAU,CAAC,OAAO,OAAO;GAG3B,iBAAiB,oBAAoB;IACnC;IACA,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,UAAU;GACxD,CAAC;GACD,OAAO,OAAO;EAChB;EAQA,MAAM,OAAO,YAAY,MAAM,IAAI;EACnC,MAAM,YAAY,GAAG,IAAI,QAAQ,yBAAyB,KAAK,IAAI;;;;;;;EAQnE,MAAM,kBAAkB,YAA8C;GACpE,MAAM,aAAa,yBAAyB;GAC5C,MAAM,SAAS,MAAM,GAAG,GAAG,IAAI;GAC/B,IAAI,CAAC,oBAAoB,YAAY,KAAK,IAAI,GAC5C,MAAM,WAAW,EAAE,IAAI,KAAK,QAAQ;IAAE,KAAK,KAAK;IAAK;GAAK,CAAC;GAE7D,OAAO;EACT;EAEA,IAAI,UAAU,OAAO,SAAS,KAAK,sBAAsB;GAEvD,iBAAiB,oBAAoB;IACnC;IACA,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,UAAU;IACtD,OAAO;GACT,CAAC;GAED,MAAM,UAAU,GACb,GAAG,OAAO,aAAa,YAAY;IAClC,IAAI;KACF,MAAM,gBAAgB;IACxB,SAAS,KAAK;KAEZ,oBAAoB;MAAE,UAAU;MAAK,OAAO;KAAI,CAAC;IACnD;GACF,CAAC,EACA,YAAY,CAEb,CAAC;GAOH,aAAa,IAAI,OAAO;GACxB,OAAO,OAAO;EAChB;EAKA,MAAM,SAAS,MAAM,GAAG,GAAG,WAAW,eAAe;EAGrD,iBAAiB,qBAAqB;GACpC;GACA,aAAa,KAAK,MAAM,YAAY,IAAI,IAAI,UAAU;EACxD,CAAC;EAED,OAAO;CACT;AACF;;;AC1MA,IAAI,UAAmC;;AAGvC,SAAgB,gBAAgB,GAA2B;CACzD,UAAU;AACZ;;;;;AAMA,SAAgB,kBAAoC;CAClD,IAAI,CAAC,SAGH,UAAU,qBAAqB;CAEjC,OAAO;AACT;AAEA,SAAS,uBAAyC;CAChD,MAAM,wBAAQ,IAAI,IAAmE;CACrF,MAAM,aAAa;CAEnB,OAAO;EACL,MAAM,IAAI,KAAK;GACb,MAAM,QAAQ,MAAM,IAAI,GAAG;GAC3B,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,OAAO,GAAG;GAChB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,QAAQ,KAAK,IAAI,IAAI,MAAM;GACjC,OAAO;IAAE,OAAO,MAAM;IAAO;GAAM;EACrC;EACA,MAAM,IAAI,KAAK,OAAO,MAAM;GAC1B,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,OAAO,GAAG;GACpC,OAAO,MAAM,QAAQ,YAAY;IAC/B,MAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;IACnC,IAAI,WAAW,KAAA,GAAW,MAAM,OAAO,MAAM;SACxC;GACP;GACA,MAAM,IAAI,KAAK;IAAE;IAAO,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM;IAAM,MAAM,KAAK;GAAK,CAAC;EACpF;EACA,MAAM,WAAW,MAAM;GACrB,IAAI,KAAK,KAAK,MAAM,OAAO,KAAK,GAAG;GACnC,IAAI,KAAK;SACF,MAAM,CAAC,KAAK,UAAU,OACzB,IAAI,MAAM,KAAK,SAAS,KAAK,GAAG,GAAG,MAAM,OAAO,GAAG;GAAA;EAGzD;CACF;AACF;;;;;;;;;;;;;;;;;;AC9CA,SAAgB,MACd,IACA,MACA,UACI;CAKJ,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AACxD;;;;;;;;;AAUA,MAAM,aAAa,eAAe,WAAW,MAAqD;CAGhG,mBAAmB,IAAI;CACvB,MAAM,gBAAgB,EAAE,WAAW,IAAI;AACzC"}

package/dist/_chunks/{metadata-routes-Cjmvi3rQ.js → canonicalize-P41GR6tY.js}

@@ -38,7 +38,7 @@ var METADATA_ROUTE_CONVENTIONS = {
 		contentType: "image/x-icon",
 		nestable: false,
 		staticExtensions: ["ico"],
-		dynamicExtensions: [],
+		dynamicExtensions: ["ts", "tsx"],
 		servePath: "favicon.ico"
 	},
 	"icon": {
@@ -61,14 +61,6 @@ var METADATA_ROUTE_CONVENTIONS = {
 		dynamicExtensions: ["ts", "tsx"],
 		servePath: "opengraph-image"
 	},
-	"twitter-image": {
-		type: "twitter-image",
-		contentType: "image/*",
-		nestable: true,
-		staticExtensions: ["png", "jpg"],
-		dynamicExtensions: ["ts", "tsx"],
-		servePath: "twitter-image"
-	},
 	"apple-icon": {
 		type: "apple-icon",
 		contentType: "image/*",
@@ -122,32 +114,116 @@ function getMetadataRouteServePath(type) {
 	for (const convention of Object.values(METADATA_ROUTE_CONVENTIONS)) if (convention.type === type) return convention.servePath;
 	throw new Error(`[timber] Unknown metadata route type: ${type}`);
 }
+var METADATA_SERVE_PATHS = new Set(Object.values(METADATA_ROUTE_CONVENTIONS).map((c) => c.servePath));
+function isMetadataRouteServePath(pathname) {
+	const lastSegment = pathname.slice(pathname.lastIndexOf("/") + 1);
+	return METADATA_SERVE_PATHS.has(lastSegment);
+}
 /**
 * Get the auto-link tags to inject into <head> for metadata route files
 * discovered in a segment.
 *
+* Returns link tags for icon/apple-icon/manifest, and meta tags for
+* opengraph-image (emits both og:image and twitter:image). Returns null
+* for types that don't auto-link (favicon, sitemap, robots).
+*
 * @param type - The metadata route type
 * @param href - The resolved URL path to the metadata route
-* @returns An object with tag/attrs for the <head>, or null if no auto-link
+* @returns Tag descriptor(s) for the <head>, or null if no auto-link
 */
 function getMetadataRouteAutoLink(type, href) {
 	switch (type) {
-		case "icon": return {
+		case "icon": return [{
+			tag: "link",
 			rel: "icon",
 			href
-		};
-		case "apple-icon": return {
+		}];
+		case "apple-icon": return [{
+			tag: "link",
 			rel: "apple-touch-icon",
 			href
-		};
-		case "manifest": return {
+		}];
+		case "manifest": return [{
+			tag: "link",
 			rel: "manifest",
 			href
+		}];
+		case "opengraph-image": return [{
+			tag: "meta",
+			property: "og:image",
+			content: href
+		}, {
+			tag: "meta",
+			name: "twitter:image",
+			content: href
+		}];
+		default: return [];
+	}
+}
+//#endregion
+//#region src/server/canonicalize.ts
+/**
+* Encoded separators that produce a 400 rejection.
+* %2f (/) and %5c (\) cause path-confusion attacks.
+*
+* Shared between the runtime canonicalizer and the build-time route scanner
+* to ensure both enforce identical security rules. See design/13-security.md.
+*/
+var ENCODED_SEPARATOR_RE = /%2f|%5c/i;
+/** Null byte — rejected. Shared with the route scanner. */
+var NULL_BYTE_RE = /%00/i;
+/**
+* Canonicalize a URL pathname.
+*
+* 1. Reject encoded separators (%2f, %5c) and null bytes (%00)
+* 2. Single percent-decode
+* 3. Collapse // → /
+* 4. Resolve .. segments (reject if escaping root)
+* 5. Strip trailing slash (except root "/")
+*
+* @param rawPathname - The raw pathname from the request URL (percent-encoded)
+* @param stripTrailingSlash - Whether to strip trailing slashes. Default: true.
+*/
+function canonicalize(rawPathname, stripTrailingSlash = true) {
+	if (ENCODED_SEPARATOR_RE.test(rawPathname)) return {
+		ok: false,
+		status: 400
+	};
+	if (NULL_BYTE_RE.test(rawPathname)) return {
+		ok: false,
+		status: 400
+	};
+	let decoded;
+	try {
+		decoded = decodeURIComponent(rawPathname);
+	} catch {
+		return {
+			ok: false,
+			status: 400
 		};
-		default: return null;
 	}
+	if (decoded.includes("\0")) return {
+		ok: false,
+		status: 400
+	};
+	let pathname = decoded.replace(/\/\/+/g, "/");
+	const segments = pathname.split("/");
+	const resolved = [];
+	for (const seg of segments) if (seg === "..") {
+		if (resolved.length <= 1) return {
+			ok: false,
+			status: 400
+		};
+		resolved.pop();
+	} else if (seg !== ".") resolved.push(seg);
+	pathname = resolved.join("/") || "/";
+	if (stripTrailingSlash && pathname.length > 1 && pathname.endsWith("/")) pathname = pathname.slice(0, -1);
+	return {
+		ok: true,
+		pathname
+	};
 }
 //#endregion
-export { isDynamicMetadataExtension as a, getMetadataRouteServePath as i, classifyMetadataRoute as n, getMetadataRouteAutoLink as r, METADATA_ROUTE_CONVENTIONS as t };
+export { classifyMetadataRoute as a, isDynamicMetadataExtension as c, METADATA_ROUTE_CONVENTIONS as i, isMetadataRouteServePath as l, NULL_BYTE_RE as n, getMetadataRouteAutoLink as o, canonicalize as r, getMetadataRouteServePath as s, ENCODED_SEPARATOR_RE as t };
 
-//# sourceMappingURL=metadata-routes-Cjmvi3rQ.js.map
+//# sourceMappingURL=canonicalize-P41GR6tY.js.map