@timber-js/app 0.2.0-alpha.15 → 0.2.0-alpha.151

package/dist/_chunks/canonicalize-P41GR6tY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize-P41GR6tY.js","names":[],"sources":["../../src/server/metadata-routes.ts","../../src/server/canonicalize.ts"],"sourcesContent":["/**\n * Metadata route classification for timber.js.\n *\n * Metadata routes are file-based endpoints that generate well-known URLs for\n * crawlers and browsers (sitemap.xml, robots.txt, OG images, etc.).\n *\n * These routes run through proxy.ts but NOT through middleware.ts or access.ts —\n * they are public endpoints by nature.\n *\n * See design/16-metadata.md §\"Metadata Routes\"\n */\n\n// ─── Types ───────────────────────────────────────────────────────────────────\n\n/** Classification of a metadata route file. */\nexport interface MetadataRouteInfo {\n  /** The metadata route type. */\n  type: MetadataRouteType;\n  /** The content type to serve this route with. */\n  contentType: string;\n  /** Whether this route can appear in nested segments (not just app root). */\n  nestable: boolean;\n}\n\nexport type MetadataRouteType =\n  | 'sitemap'\n  | 'robots'\n  | 'manifest'\n  | 'favicon'\n  | 'icon'\n  | 'opengraph-image'\n  | 'apple-icon';\n\n// ─── Convention Table ────────────────────────────────────────────────────────\n\n/**\n * All recognized metadata route file conventions.\n *\n * Each entry maps a base file name (without extension) to its route info.\n * The extensions determine whether the file is static or dynamic.\n *\n * Static extensions: .xml, .txt, .json, .png, .jpg, .ico, .svg\n * Dynamic extensions: .ts, .tsx\n */\nexport const METADATA_ROUTE_CONVENTIONS: Record<\n  string,\n  {\n    type: MetadataRouteType;\n    contentType: string;\n    nestable: boolean;\n    staticExtensions: string[];\n    dynamicExtensions: string[];\n    /** The URL path this file serves at (relative to segment). */\n    servePath: string;\n  }\n> = {\n  'sitemap': {\n    type: 'sitemap',\n    contentType: 'application/xml',\n    nestable: true,\n    staticExtensions: ['xml'],\n    dynamicExtensions: ['ts'],\n    servePath: 'sitemap.xml',\n  },\n  'robots': {\n    type: 'robots',\n    contentType: 'text/plain',\n    nestable: false,\n    staticExtensions: ['txt'],\n    dynamicExtensions: ['ts'],\n    servePath: 'robots.txt',\n  },\n  'manifest': {\n    type: 'manifest',\n    contentType: 'application/manifest+json',\n    nestable: false,\n    staticExtensions: ['json'],\n    dynamicExtensions: ['ts'],\n    servePath: 'manifest.webmanifest',\n  },\n  'favicon': {\n    type: 'favicon',\n    contentType: 'image/x-icon',\n    nestable: false,\n    staticExtensions: ['ico'],\n    dynamicExtensions: ['ts', 'tsx'],\n    servePath: 'favicon.ico',\n  },\n  'icon': {\n    type: 'icon',\n    contentType: 'image/*',\n    nestable: true,\n    staticExtensions: ['png', 'jpg', 'svg'],\n    dynamicExtensions: ['ts', 'tsx'],\n    servePath: 'icon',\n  },\n  'opengraph-image': {\n    type: 'opengraph-image',\n    contentType: 'image/*',\n    nestable: true,\n    staticExtensions: ['png', 'jpg'],\n    dynamicExtensions: ['ts', 'tsx'],\n    servePath: 'opengraph-image',\n  },\n\n  'apple-icon': {\n    type: 'apple-icon',\n    contentType: 'image/*',\n    nestable: true,\n    staticExtensions: ['png'],\n    dynamicExtensions: ['ts', 'tsx'],\n    servePath: 'apple-icon',\n  },\n};\n\n// ─── MIME Type Resolution ─────────────────────────────────────────────────────\n\n/**\n * Map of file extensions to MIME types for static metadata route files.\n * Used to resolve the generic `image/*` content type for static image files.\n */\nconst EXTENSION_MIME_TYPES: Record<string, string> = {\n  xml: 'application/xml',\n  txt: 'text/plain',\n  json: 'application/json',\n  ico: 'image/x-icon',\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  svg: 'image/svg+xml',\n  webp: 'image/webp',\n};\n\n/**\n * Resolve the concrete MIME type for a static metadata route file.\n *\n * For generic content types like `image/*`, this resolves to the actual\n * MIME type based on the file extension (e.g. `image/png` for `.png`).\n *\n * @param conventionContentType - The content type from the convention table (may be generic like `image/*`)\n * @param extension - The file extension without leading dot (e.g. \"png\", \"xml\")\n * @returns The resolved MIME type\n */\nexport function resolveStaticContentType(conventionContentType: string, extension: string): string {\n  if (conventionContentType.includes('*')) {\n    return EXTENSION_MIME_TYPES[extension] ?? 'application/octet-stream';\n  }\n  return conventionContentType;\n}\n\n/**\n * Check if a file extension represents a static (non-code) metadata route file.\n *\n * @param baseName - The base file name without extension (e.g. \"sitemap\", \"icon\")\n * @param extension - The file extension without leading dot (e.g. \"xml\", \"png\", \"ts\")\n * @returns true if this is a static file, false if dynamic or unrecognized\n */\nexport function isStaticMetadataExtension(baseName: string, extension: string): boolean {\n  const convention = METADATA_ROUTE_CONVENTIONS[baseName];\n  if (!convention) return false;\n  return convention.staticExtensions.includes(extension);\n}\n\n/**\n * Check if a file extension represents a dynamic (code) metadata route file.\n *\n * @param baseName - The base file name without extension (e.g. \"sitemap\", \"icon\")\n * @param extension - The file extension without leading dot (e.g. \"ts\", \"tsx\")\n * @returns true if this is a dynamic file, false if static or unrecognized\n */\nexport function isDynamicMetadataExtension(baseName: string, extension: string): boolean {\n  const convention = METADATA_ROUTE_CONVENTIONS[baseName];\n  if (!convention) return false;\n  return convention.dynamicExtensions.includes(extension);\n}\n\n// ─── Classification ──────────────────────────────────────────────────────────\n\n/**\n * Classify a file name as a metadata route, or return null if it's not one.\n *\n * @param fileName - The full file name including extension (e.g. \"sitemap.xml\", \"icon.tsx\")\n * @returns Classification info, or null if not a metadata route\n */\nexport function classifyMetadataRoute(fileName: string): MetadataRouteInfo | null {\n  const dotIndex = fileName.lastIndexOf('.');\n  if (dotIndex === -1) return null;\n\n  const baseName = fileName.slice(0, dotIndex);\n  const ext = fileName.slice(dotIndex + 1);\n\n  const convention = METADATA_ROUTE_CONVENTIONS[baseName];\n  if (!convention) return null;\n\n  const isStatic = convention.staticExtensions.includes(ext);\n  const isDynamic = convention.dynamicExtensions.includes(ext);\n\n  if (!isStatic && !isDynamic) return null;\n\n  return {\n    type: convention.type,\n    contentType: convention.contentType,\n    nestable: convention.nestable,\n  };\n}\n\n/**\n * Get the serve path for a metadata route type.\n *\n * @param type - The metadata route type\n * @returns The URL path fragment this route serves at\n */\nexport function getMetadataRouteServePath(type: MetadataRouteType): string {\n  for (const convention of Object.values(METADATA_ROUTE_CONVENTIONS)) {\n    if (convention.type === type) return convention.servePath;\n  }\n  throw new Error(`[timber] Unknown metadata route type: ${type}`);\n}\n\nconst METADATA_SERVE_PATHS = new Set(\n  Object.values(METADATA_ROUTE_CONVENTIONS).map((c) => c.servePath)\n);\n\nexport function isMetadataRouteServePath(pathname: string): boolean {\n  const lastSegment = pathname.slice(pathname.lastIndexOf('/') + 1);\n  return METADATA_SERVE_PATHS.has(lastSegment);\n}\n\n/** A <link> auto-link tag. */\nexport interface AutoLinkLink {\n  tag: 'link';\n  rel: string;\n  href: string;\n  type?: string;\n}\n\n/** A <meta> auto-link tag. */\nexport interface AutoLinkMeta {\n  tag: 'meta';\n  property?: string;\n  name?: string;\n  content: string;\n}\n\nexport type AutoLinkTag = AutoLinkLink | AutoLinkMeta;\n\n/**\n * Get the auto-link tags to inject into <head> for metadata route files\n * discovered in a segment.\n *\n * Returns link tags for icon/apple-icon/manifest, and meta tags for\n * opengraph-image (emits both og:image and twitter:image). Returns null\n * for types that don't auto-link (favicon, sitemap, robots).\n *\n * @param type - The metadata route type\n * @param href - The resolved URL path to the metadata route\n * @returns Tag descriptor(s) for the <head>, or null if no auto-link\n */\nexport function getMetadataRouteAutoLink(type: MetadataRouteType, href: string): AutoLinkTag[] {\n  switch (type) {\n    case 'icon':\n      return [{ tag: 'link', rel: 'icon', href }];\n    case 'apple-icon':\n      return [{ tag: 'link', rel: 'apple-touch-icon', href }];\n    case 'manifest':\n      return [{ tag: 'link', rel: 'manifest', href }];\n    case 'opengraph-image':\n      return [\n        { tag: 'meta', property: 'og:image', content: href },\n        { tag: 'meta', name: 'twitter:image', content: href },\n      ];\n    default:\n      return [];\n  }\n}\n","/**\n * URL canonicalization — runs once at the request boundary.\n *\n * Every layer (proxy.ts, middleware.ts, access.ts, components) sees the same\n * canonical path. No re-decoding occurs at any later stage.\n *\n * See design/07-routing.md §\"URL Canonicalization & Security\"\n */\n\n/** Result of canonicalization — either a clean path or a rejection. */\nexport type CanonicalizeResult = { ok: true; pathname: string } | { ok: false; status: 400 };\n\n/**\n * Encoded separators that produce a 400 rejection.\n * %2f (/) and %5c (\\) cause path-confusion attacks.\n *\n * Shared between the runtime canonicalizer and the build-time route scanner\n * to ensure both enforce identical security rules. See design/13-security.md.\n */\nexport const ENCODED_SEPARATOR_RE = /%2f|%5c/i;\n\n/** Null byte — rejected. Shared with the route scanner. */\nexport const NULL_BYTE_RE = /%00/i;\n\n/**\n * Canonicalize a URL pathname.\n *\n * 1. Reject encoded separators (%2f, %5c) and null bytes (%00)\n * 2. Single percent-decode\n * 3. Collapse // → /\n * 4. Resolve .. segments (reject if escaping root)\n * 5. Strip trailing slash (except root \"/\")\n *\n * @param rawPathname - The raw pathname from the request URL (percent-encoded)\n * @param stripTrailingSlash - Whether to strip trailing slashes. Default: true.\n */\nexport function canonicalize(rawPathname: string, stripTrailingSlash = true): CanonicalizeResult {\n  // Step 1: Reject dangerous encoded sequences BEFORE decoding.\n  // This must happen on the raw input so %252f doesn't bypass after a single decode.\n  if (ENCODED_SEPARATOR_RE.test(rawPathname)) {\n    return { ok: false, status: 400 };\n  }\n  if (NULL_BYTE_RE.test(rawPathname)) {\n    return { ok: false, status: 400 };\n  }\n\n  // Step 2: Single percent-decode.\n  // Double-encoded input (%2561 → %61) stays as %61 — not decoded again.\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPathname);\n  } catch {\n    // Malformed percent-encoding → 400\n    return { ok: false, status: 400 };\n  }\n\n  // Reject null bytes that appeared after decoding (from valid %00-like sequences\n  // that weren't caught above — belt and suspenders).\n  if (decoded.includes('\\0')) {\n    return { ok: false, status: 400 };\n  }\n\n  // Backslash is NOT a path separator — keep as literal character.\n  // But reject if it would create // after normalization (e.g., /\\evil.com).\n  // We do NOT convert \\ to / — it stays as a literal.\n\n  // Step 3: Collapse consecutive slashes.\n  let pathname = decoded.replace(/\\/\\/+/g, '/');\n\n  // Step 4: Resolve .. and . segments.\n  const segments = pathname.split('/');\n  const resolved: string[] = [];\n  for (const seg of segments) {\n    if (seg === '..') {\n      if (resolved.length <= 1) {\n        // Trying to escape root — 400\n        return { ok: false, status: 400 };\n      }\n      resolved.pop();\n    } else if (seg !== '.') {\n      resolved.push(seg);\n    }\n  }\n\n  pathname = resolved.join('/') || '/';\n\n  // Step 5: Strip trailing slash (except root \"/\").\n  if (stripTrailingSlash && pathname.length > 1 && pathname.endsWith('/')) {\n    pathname = pathname.slice(0, -1);\n  }\n\n  return { ok: true, pathname };\n}\n"],"mappings":";;;;;;;;;;AA4CA,IAAa,6BAWT;CACF,WAAW;EACT,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,KAAK;EACxB,mBAAmB,CAAC,IAAI;EACxB,WAAW;CACb;CACA,UAAU;EACR,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,KAAK;EACxB,mBAAmB,CAAC,IAAI;EACxB,WAAW;CACb;CACA,YAAY;EACV,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,MAAM;EACzB,mBAAmB,CAAC,IAAI;EACxB,WAAW;CACb;CACA,WAAW;EACT,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,KAAK;EACxB,mBAAmB,CAAC,MAAM,KAAK;EAC/B,WAAW;CACb;CACA,QAAQ;EACN,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB;GAAC;GAAO;GAAO;EAAK;EACtC,mBAAmB,CAAC,MAAM,KAAK;EAC/B,WAAW;CACb;CACA,mBAAmB;EACjB,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,OAAO,KAAK;EAC/B,mBAAmB,CAAC,MAAM,KAAK;EAC/B,WAAW;CACb;CAEA,cAAc;EACZ,MAAM;EACN,aAAa;EACb,UAAU;EACV,kBAAkB,CAAC,KAAK;EACxB,mBAAmB,CAAC,MAAM,KAAK;EAC/B,WAAW;CACb;AACF;;;;;;;;AAyDA,SAAgB,2BAA2B,UAAkB,WAA4B;CACvF,MAAM,aAAa,2BAA2B;CAC9C,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO,WAAW,kBAAkB,SAAS,SAAS;AACxD;;;;;;;AAUA,SAAgB,sBAAsB,UAA4C;CAChF,MAAM,WAAW,SAAS,YAAY,GAAG;CACzC,IAAI,aAAa,IAAI,OAAO;CAE5B,MAAM,WAAW,SAAS,MAAM,GAAG,QAAQ;CAC3C,MAAM,MAAM,SAAS,MAAM,WAAW,CAAC;CAEvC,MAAM,aAAa,2BAA2B;CAC9C,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,WAAW,WAAW,iBAAiB,SAAS,GAAG;CACzD,MAAM,YAAY,WAAW,kBAAkB,SAAS,GAAG;CAE3D,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;CAEpC,OAAO;EACL,MAAM,WAAW;EACjB,aAAa,WAAW;EACxB,UAAU,WAAW;CACvB;AACF;;;;;;;AAQA,SAAgB,0BAA0B,MAAiC;CACzE,KAAK,MAAM,cAAc,OAAO,OAAO,0BAA0B,GAC/D,IAAI,WAAW,SAAS,MAAM,OAAO,WAAW;CAElD,MAAM,IAAI,MAAM,yCAAyC,MAAM;AACjE;AAEA,IAAM,uBAAuB,IAAI,IAC/B,OAAO,OAAO,0BAA0B,EAAE,KAAK,MAAM,EAAE,SAAS,CAClE;AAEA,SAAgB,yBAAyB,UAA2B;CAClE,MAAM,cAAc,SAAS,MAAM,SAAS,YAAY,GAAG,IAAI,CAAC;CAChE,OAAO,qBAAqB,IAAI,WAAW;AAC7C;;;;;;;;;;;;;AAgCA,SAAgB,yBAAyB,MAAyB,MAA6B;CAC7F,QAAQ,MAAR;EACE,KAAK,QACH,OAAO,CAAC;GAAE,KAAK;GAAQ,KAAK;GAAQ;EAAK,CAAC;EAC5C,KAAK,cACH,OAAO,CAAC;GAAE,KAAK;GAAQ,KAAK;GAAoB;EAAK,CAAC;EACxD,KAAK,YACH,OAAO,CAAC;GAAE,KAAK;GAAQ,KAAK;GAAY;EAAK,CAAC;EAChD,KAAK,mBACH,OAAO,CACL;GAAE,KAAK;GAAQ,UAAU;GAAY,SAAS;EAAK,GACnD;GAAE,KAAK;GAAQ,MAAM;GAAiB,SAAS;EAAK,CACtD;EACF,SACE,OAAO,CAAC;CACZ;AACF;;;;;;;;;;AC/PA,IAAa,uBAAuB;;AAGpC,IAAa,eAAe;;;;;;;;;;;;;AAc5B,SAAgB,aAAa,aAAqB,qBAAqB,MAA0B;CAG/F,IAAI,qBAAqB,KAAK,WAAW,GACvC,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAI;CAElC,IAAI,aAAa,KAAK,WAAW,GAC/B,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAI;CAKlC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,WAAW;CAC1C,QAAQ;EAEN,OAAO;GAAE,IAAI;GAAO,QAAQ;EAAI;CAClC;CAIA,IAAI,QAAQ,SAAS,IAAI,GACvB,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAI;CAQlC,IAAI,WAAW,QAAQ,QAAQ,UAAU,GAAG;CAG5C,MAAM,WAAW,SAAS,MAAM,GAAG;CACnC,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,OAAO,UAChB,IAAI,QAAQ,MAAM;EAChB,IAAI,SAAS,UAAU,GAErB,OAAO;GAAE,IAAI;GAAO,QAAQ;EAAI;EAElC,SAAS,IAAI;CACf,OAAO,IAAI,QAAQ,KACjB,SAAS,KAAK,GAAG;CAIrB,WAAW,SAAS,KAAK,GAAG,KAAK;CAGjC,IAAI,sBAAsB,SAAS,SAAS,KAAK,SAAS,SAAS,GAAG,GACpE,WAAW,SAAS,MAAM,GAAG,EAAE;CAGjC,OAAO;EAAE,IAAI;EAAM;CAAS;AAC9B"}

package/dist/_chunks/cli-schema-sync-DJDdyEae.js

@@ -0,0 +1,629 @@
+import { a as classifyMetadataRoute, c as isDynamicMetadataExtension, n as NULL_BYTE_RE, t as ENCODED_SEPARATOR_RE } from "./canonicalize-P41GR6tY.js";
+import { r as DEFAULT_PAGE_EXTENSIONS, t as classifySegment } from "./segment-classify-CDDRVKs7.js";
+import { h as swallow } from "./logger-CM0clugc.js";
+import { o as resolveAppDir } from "./plugin-context-GfDWsdd2.js";
+import { basename, extname, join } from "node:path";
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+//#region src/routing/scanner.ts
+/**
+* Route discovery scanner.
+*
+* Pure function: (appDir, config) → RouteTree
+*
+* Scans the app/ directory and builds a segment tree recognizing all
+* timber.js file conventions. Does NOT handle request matching — this
+* is discovery only.
+*/
+/**
+* File convention names that use pageExtensions (can be .tsx, .ts, .jsx, .js, .mdx, etc.)
+*/
+var PAGE_EXT_CONVENTIONS = new Set([
+	"page",
+	"layout",
+	"error",
+	"default",
+	"denied"
+]);
+/**
+* Legacy compat status-code files.
+* Maps legacy file name → HTTP status code for the fallback chain.
+* See design/10-error-handling.md §"Fallback Chain".
+*/
+var LEGACY_STATUS_FILES = {
+	"not-found": 404,
+	"forbidden": 403,
+	"unauthorized": 401
+};
+/**
+* File convention names that are always .ts/.tsx (never .mdx etc.)
+*/
+var FIXED_CONVENTIONS = new Set([
+	"middleware",
+	"access",
+	"route",
+	"params"
+]);
+/**
+* Status-code file patterns:
+* - Exact 3-digit codes: 401.tsx, 429.tsx, 503.tsx
+* - Category catch-alls: 4xx.tsx, 5xx.tsx
+*/
+var STATUS_CODE_PATTERN = /^(\d{3}|[45]xx)$/;
+/**
+* Scan the app/ directory and build the route tree.
+*
+* @param appDir - Absolute path to the app/ directory
+* @param config - Scanner configuration
+* @returns The complete route tree
+*/
+function scanRoutes(appDir, config = {}) {
+	const pageExtensions = config.pageExtensions ?? DEFAULT_PAGE_EXTENSIONS;
+	const extSet = new Set(pageExtensions);
+	const tree = { root: createSegmentNode("", "static", "/") };
+	const proxyFile = findFixedFile(appDir, "proxy");
+	if (proxyFile) tree.proxy = proxyFile;
+	const globalErrorFile = findPageExtFile(appDir, "global-error", extSet);
+	if (globalErrorFile) tree.globalError = globalErrorFile;
+	scanSegmentFiles(appDir, tree.root, extSet);
+	scanChildren(appDir, tree.root, extSet);
+	validateRouteGroupCollisions(tree.root);
+	validateDuplicateParamNames(tree.root);
+	validateUniqueBracketForms(tree.root);
+	return tree;
+}
+/**
+* Create an empty segment node.
+*/
+function createSegmentNode(segmentName, segmentType, urlPath, paramName, interceptionMarker, interceptedSegmentName) {
+	return {
+		segmentName,
+		segmentType,
+		urlPath,
+		paramName,
+		interceptionMarker,
+		interceptedSegmentName,
+		children: [],
+		slots: {}
+	};
+}
+/**
+* Compute the URL path for a child segment given its parent's URL path.
+* Route groups, slots, and intercepting routes do NOT add URL depth.
+*/
+function computeUrlPath(parentUrlPath, dirName, segmentType) {
+	if (segmentType === "group" || segmentType === "slot" || segmentType === "intercepting") return parentUrlPath;
+	return `${parentUrlPath === "/" ? "" : parentUrlPath}/${dirName}`;
+}
+/**
+* Scan a directory for file conventions and populate the segment node.
+*/
+function scanSegmentFiles(dirPath, node, extSet) {
+	let entries;
+	try {
+		entries = readdirSync(dirPath);
+	} catch (err) {
+		swallow(err, `scanSegmentFiles: unreadable directory ${dirPath}`, { level: "warn" });
+		return;
+	}
+	for (const entry of entries) {
+		const fullPath = join(dirPath, entry);
+		try {
+			if (statSync(fullPath).isDirectory()) continue;
+		} catch {
+			continue;
+		}
+		const ext = extname(entry).slice(1);
+		const name = basename(entry, `.${ext}`);
+		if (PAGE_EXT_CONVENTIONS.has(name) && extSet.has(ext)) {
+			const key = name;
+			const existing = node[key];
+			if (existing) throwDuplicateConvention(name, existing.filePath, fullPath);
+			node[key] = {
+				filePath: fullPath,
+				extension: ext
+			};
+			continue;
+		}
+		if (FIXED_CONVENTIONS.has(name) && /^[jt]sx?$/.test(ext)) {
+			const key = name;
+			const existing = node[key];
+			if (existing) throwDuplicateConvention(name, existing.filePath, fullPath);
+			node[key] = {
+				filePath: fullPath,
+				extension: ext
+			};
+			continue;
+		}
+		if (STATUS_CODE_PATTERN.test(name) && ext === "json") {
+			if (!node.jsonStatusFiles) node.jsonStatusFiles = {};
+			node.jsonStatusFiles[name] = {
+				filePath: fullPath,
+				extension: ext
+			};
+			continue;
+		}
+		if (STATUS_CODE_PATTERN.test(name) && extSet.has(ext)) {
+			if (!node.statusFiles) node.statusFiles = {};
+			const existing = node.statusFiles[name];
+			if (existing) throwDuplicateConvention(name, existing.filePath, fullPath);
+			node.statusFiles[name] = {
+				filePath: fullPath,
+				extension: ext
+			};
+			continue;
+		}
+		if (name in LEGACY_STATUS_FILES && extSet.has(ext)) {
+			if (!node.legacyStatusFiles) node.legacyStatusFiles = {};
+			const existing = node.legacyStatusFiles[name];
+			if (existing) throwDuplicateConvention(name, existing.filePath, fullPath);
+			node.legacyStatusFiles[name] = {
+				filePath: fullPath,
+				extension: ext
+			};
+			continue;
+		}
+		if (classifyMetadataRoute(entry)) {
+			if (!node.metadataRoutes) node.metadataRoutes = {};
+			const existing = node.metadataRoutes[name];
+			if (existing) {
+				const existingIsDynamic = isDynamicMetadataExtension(name, existing.extension);
+				const newIsDynamic = isDynamicMetadataExtension(name, ext);
+				if (existingIsDynamic === newIsDynamic) throwDuplicateConvention(name, existing.filePath, fullPath);
+				if (newIsDynamic) node.metadataRoutes[name] = {
+					filePath: fullPath,
+					extension: ext
+				};
+			} else node.metadataRoutes[name] = {
+				filePath: fullPath,
+				extension: ext
+			};
+		}
+	}
+	if (node.route && node.page) throw new Error(`Build error: route.ts and page.* cannot coexist in the same segment.\n  route.ts: ${node.route.filePath}\n  page:     ${node.page.filePath}\nA URL is either an API endpoint or a rendered page, not both.`);
+}
+/**
+* Throw a build error for two files claiming the same convention slot in
+* one segment (e.g. page.tsx + page.jsx). Which file readdir returns first
+* is platform-dependent (APFS sorts entries, ext4 does not) — silently
+* picking one would let macOS dev and Linux CI serve different
+* implementations of the same route.
+*/
+function throwDuplicateConvention(convention, firstPath, secondPath) {
+	throw new Error(`Build error: duplicate '${convention}' files in the same route segment.\n  File 1: ${firstPath}\n  File 2: ${secondPath}\nEach segment may define '${convention}' at most once. Remove one of the files.`);
+}
+/**
+* Recursively scan child directories and build the segment tree.
+*/
+function scanChildren(dirPath, parentNode, extSet) {
+	let entries;
+	try {
+		entries = readdirSync(dirPath);
+	} catch (err) {
+		swallow(err, `scanChildren: unreadable directory ${dirPath}`, { level: "warn" });
+		return;
+	}
+	for (const entry of entries) {
+		const fullPath = join(dirPath, entry);
+		try {
+			if (!statSync(fullPath).isDirectory()) continue;
+		} catch {
+			continue;
+		}
+		if (ENCODED_SEPARATOR_RE.test(entry)) throw new Error(`Build error: directory name contains an encoded path delimiter (%2F or %5C).\n  Directory: ${fullPath}\nEncoded separators in directory names cause route collisions when decoded. Rename the directory to remove the encoded delimiter.`);
+		if (NULL_BYTE_RE.test(entry)) throw new Error(`Build error: directory name contains an encoded null byte (%00).\n  Directory: ${fullPath}\nEncoded null bytes in directory names are not allowed. Rename the directory to remove the null byte encoding.`);
+		const { type, paramName, interceptionMarker, interceptedSegmentName } = classifySegment(entry);
+		if (type === "private") continue;
+		const childNode = createSegmentNode(entry, type, computeUrlPath(parentNode.urlPath, entry, type), paramName, interceptionMarker, interceptedSegmentName);
+		scanSegmentFiles(fullPath, childNode, extSet);
+		scanChildren(fullPath, childNode, extSet);
+		if (type === "slot") {
+			const slotName = entry.slice(1);
+			parentNode.slots[slotName] = childNode;
+		} else parentNode.children.push(childNode);
+	}
+}
+/**
+* Validate that route groups don't produce conflicting pages/routes at the same URL path.
+*
+* Two route groups like (auth)/login/page.tsx and (marketing)/login/page.tsx both claim
+* /login — the scanner must detect and reject this at build time.
+*
+* Each parallel slot is validated as its OWN collision space: a slot's pages
+* intentionally share URL paths with the parent tree (that's the point of
+* parallel routes), but two route groups INSIDE one slot claiming the same
+* URL — e.g. @side/(a)/x/page.tsx + @side/(b)/x/page.tsx — still collide.
+*/
+function validateRouteGroupCollisions(root) {
+	collectRoutableLeaves(root, /* @__PURE__ */ new Map(), "");
+}
+/**
+* Walk the segment tree and collect all routable leaves (page or route files),
+* throwing on collision. Each slot recurses with a FRESH collision map —
+* slots are parallel routes that intentionally share URL paths with their
+* parent tree, but collisions within a single slot are real errors.
+*/
+function collectRoutableLeaves(node, seen, segmentPath) {
+	if (node.segmentType === "intercepting") return;
+	const currentPath = segmentPath ? `${segmentPath}/${node.segmentName}` : node.segmentName || "(root)";
+	const routableFile = node.page ?? node.route;
+	if (routableFile) {
+		const existing = seen.get(node.urlPath);
+		if (existing) throw new Error(`Build error: route collision — multiple route groups produce a page/route at the same URL path.\n  URL path: ${node.urlPath}\n  File 1:   ${existing.filePath} (via ${existing.segmentPath})\n  File 2:   ${routableFile.filePath} (via ${currentPath})\nEach URL path must map to exactly one page or route handler. Rename or move one of the conflicting files.`);
+		seen.set(node.urlPath, {
+			filePath: routableFile.filePath,
+			segmentPath: currentPath
+		});
+	}
+	for (const child of node.children) collectRoutableLeaves(child, seen, currentPath);
+	for (const slotNode of Object.values(node.slots)) collectRoutableLeaves(slotNode, /* @__PURE__ */ new Map(), currentPath);
+}
+/**
+* Validate that no route chain contains duplicate dynamic param names.
+*
+* Example violation:
+*   app/[id]/items/[id]/page.tsx — 'id' appears twice in the ancestor chain.
+*
+* Route groups are transparent — params accumulate through them.
+* Slots are independent — duplicate detection does NOT cross slot boundaries.
+*
+* See design/07-routing.md §"Duplicate Param Name Detection"
+*/
+function validateDuplicateParamNames(root) {
+	walkForDuplicateParams(root, /* @__PURE__ */ new Map());
+}
+/**
+* Recursively walk the segment tree, tracking seen param names → segment paths.
+* Throws on the first duplicate found.
+*/
+function walkForDuplicateParams(node, seen) {
+	if (node.paramName) {
+		const existing = seen.get(node.paramName);
+		if (existing) throw new Error(`[timber] Duplicate param name '${node.paramName}' in route chain.\n  First defined at: ${existing}\n  Duplicate at: ${node.urlPath || "/"}\n  Rename one of the segments to avoid ambiguity.`);
+		seen = new Map(seen);
+		seen.set(node.paramName, node.urlPath || "/");
+	}
+	for (const child of node.children) walkForDuplicateParams(child, seen);
+	for (const slotNode of Object.values(node.slots)) walkForDuplicateParams(slotNode, new Map(seen));
+}
+/**
+* Validate that each param name uses a single bracket form across the entire route tree.
+*
+* Different bracket forms produce different types:
+*   [id]      → string
+*   [...id]   → string[]
+*   [[...id]] → string[] | undefined
+*
+* If the same param name appears with multiple forms, the no-argument
+* getSegmentParams() / useSegmentParams() return type becomes ambiguous.
+*
+* Same name + same form across different routes is fine and expected.
+*/
+function validateUniqueBracketForms(root) {
+	collectBracketForms(root, /* @__PURE__ */ new Map());
+}
+function collectBracketForms(node, forms) {
+	if (node.paramName && node.segmentType !== "static" && node.segmentType !== "group") {
+		const existing = forms.get(node.paramName);
+		if (existing && existing.segmentType !== node.segmentType) {
+			const bracketExamples = {
+				"dynamic": `[${node.paramName}]`,
+				"catch-all": `[...${node.paramName}]`,
+				"optional-catch-all": `[[...${node.paramName}]]`
+			};
+			throw new Error(`[timber] Param name '${node.paramName}' uses multiple bracket forms.\n  ${bracketExamples[existing.segmentType] ?? existing.segmentType} at: ${existing.urlPath}\n  ${bracketExamples[node.segmentType] ?? node.segmentType} at: ${node.urlPath || "/"}\n  Each param name must use a single bracket form across all routes.\n  Rename one of the segments to fix this (e.g., [${node.paramName}] → [${node.paramName}Id]).`);
+		}
+		if (!existing) forms.set(node.paramName, {
+			segmentType: node.segmentType,
+			urlPath: node.urlPath || "/"
+		});
+	}
+	for (const child of node.children) collectBracketForms(child, forms);
+	for (const slotNode of Object.values(node.slots)) collectBracketForms(slotNode, forms);
+}
+/**
+* Find a fixed-extension file (proxy.ts) in a directory.
+*/
+function findFixedFile(dirPath, name) {
+	for (const ext of ["ts", "tsx"]) {
+		const fullPath = join(dirPath, `${name}.${ext}`);
+		try {
+			if (statSync(fullPath).isFile()) return {
+				filePath: fullPath,
+				extension: ext
+			};
+		} catch {}
+	}
+}
+/**
+* Find a file using the configured page extensions (tsx, ts, jsx, js, mdx, etc.).
+* Used for app-root conventions like global-error that aren't per-segment.
+*/
+function findPageExtFile(dirPath, name, extSet) {
+	for (const ext of extSet) {
+		const fullPath = join(dirPath, `${name}.${ext}`);
+		try {
+			if (statSync(fullPath).isFile()) return {
+				filePath: fullPath,
+				extension: ext
+			};
+		} catch {}
+	}
+}
+//#endregion
+//#region src/cli-schema-sync.ts
+/**
+* `timber schema sync` — scan filesystem for dynamic segments, append
+* missing entries with `codec.string` defaults, and remove stale entries
+* whose segments no longer exist in the filesystem.
+*
+* Design doc: design/41-global-params.md §Auto-Scaffolding
+*/
+/**
+* Collect all unique bracket-keyed dynamic segment names from the route tree.
+* Returns entries like '[artistSlug]', '[...slug]', '[[...topic]]'.
+*/
+function collectDynamicSegments(appDir) {
+	const tree = scanRoutes(appDir);
+	const segments = /* @__PURE__ */ new Set();
+	walkSegments(tree.root, segments);
+	return [...segments].sort();
+}
+function walkSegments(node, segments) {
+	if (node.paramName) segments.add(node.segmentName);
+	for (const child of node.children) walkSegments(child, segments);
+	for (const slot of Object.values(node.slots)) walkSegments(slot, segments);
+}
+/**
+* Replace comment bodies (and optionally string contents) with spaces,
+* preserving length and newlines so every index maps 1:1 to the original.
+* Lets the structural scanning below ignore `segmentParams` mentions and
+* braces inside comments/strings without a TS parser (fine pre-alpha,
+* see TIM-1066).
+*
+* With `maskStrings`, string contents are blanked too — except literal
+* 'segmentParams' strings, kept so a quoted property key stays findable.
+*/
+function maskSource(content, maskStrings) {
+	const out = content.split("");
+	const n = content.length;
+	let i = 0;
+	const blank = (from, to) => {
+		for (let j = from; j < to; j++) if (content[j] !== "\n") out[j] = " ";
+	};
+	while (i < n) {
+		const ch = content[i];
+		const next = content[i + 1];
+		if (ch === "/" && next === "/") {
+			const start = i;
+			while (i < n && content[i] !== "\n") i++;
+			blank(start, i);
+		} else if (ch === "/" && next === "*") {
+			const start = i;
+			i += 2;
+			while (i < n && !(content[i] === "*" && content[i + 1] === "/")) i++;
+			i = Math.min(i + 2, n);
+			blank(start, i);
+		} else if (ch === "\"" || ch === "'" || ch === "`") {
+			const start = i;
+			i++;
+			while (i < n && content[i] !== ch) {
+				if (content[i] === "\\") i++;
+				i++;
+			}
+			const end = i;
+			if (maskStrings && content.slice(start + 1, end) !== "segmentParams") blank(start + 1, end);
+			i++;
+		} else i++;
+	}
+	return out.join("");
+}
+/**
+* Locate the `segmentParams: { ... }` block in a schema file.
+* Returns the indices of the opening and matching closing brace, or null
+* if no segmentParams property is found. Comments and strings are masked
+* first, so a JSDoc example mentioning `segmentParams: { ... }` above the
+* real defineSchema call is not mistaken for the block, and braces inside
+* comments/strings don't skew the depth count. The search is anchored to
+* the `defineSchema(` call when present, so helper objects with their own
+* segmentParams property earlier in the file are skipped.
+*/
+function findSegmentParamsBlock(content) {
+	const masked = maskSource(content, true);
+	const defineCall = /\bdefineSchema\s*\(/.exec(masked);
+	const keyRe = /(['"]?)segmentParams\1\s*:\s*\{/g;
+	keyRe.lastIndex = defineCall ? defineCall.index + defineCall[0].length : 0;
+	const keyMatch = keyRe.exec(masked);
+	if (!keyMatch) return null;
+	const openBrace = keyMatch.index + keyMatch[0].length - 1;
+	let depth = 1;
+	let i = openBrace + 1;
+	while (i < masked.length && depth > 0) {
+		if (masked[i] === "{") depth++;
+		else if (masked[i] === "}") depth--;
+		i++;
+	}
+	if (depth > 0) return null;
+	return {
+		openBrace,
+		closeBrace: i - 1
+	};
+}
+/**
+* Parse existing bracket keys from an app/schema.ts file.
+* Scoped to the segmentParams: { ... } block — bracket keys elsewhere in
+* the file (unrelated objects, comments above defineSchema) are ignored.
+* Comments inside the block are masked, so a commented-out entry does not
+* count as registered.
+*
+* The key charset matches the route classifier (segment-classify.ts):
+* any character except `]`, so hyphenated params like '[my-param]' parse.
+*/
+function parseExistingSchemaKeys(content) {
+	const block = findSegmentParamsBlock(content);
+	if (!block) return [];
+	const blockContent = maskSource(content, false).slice(block.openBrace, block.closeBrace);
+	const keys = [];
+	const re = /['"](\[{1,2}(?:\.{3})?[^\]]+\]{1,2})['"]\s*:/g;
+	let m;
+	while ((m = re.exec(blockContent)) !== null) keys.push(m[1]);
+	return keys;
+}
+/** Schema file extensions to check. */
+var SCHEMA_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".js",
+	".jsx"
+];
+/**
+* Find the schema file path if it exists.
+*/
+function findSchemaFile(appDir) {
+	for (const ext of SCHEMA_EXTENSIONS) {
+		const p = join(appDir, `schema${ext}`);
+		if (existsSync(p)) return p;
+	}
+}
+function defaultCodecForSegment(seg) {
+	if (seg.startsWith("[[...")) return "codec.optionalCatchAll(codec.string)";
+	if (seg.startsWith("[...")) return "codec.stringArray";
+	return "codec.string";
+}
+/**
+* Generate the content for a new app/schema.ts with the given segment keys.
+*/
+function generateNewSchema(segments) {
+	const lines = [];
+	lines.push("import { defineSchema } from '@timber-js/app/params';");
+	lines.push("import { codec } from '@timber-js/app/codec';");
+	lines.push("");
+	lines.push("export default defineSchema({");
+	lines.push("  segmentParams: {");
+	for (const seg of segments) lines.push(`    '${seg}': ${defaultCodecForSegment(seg)},`);
+	lines.push("  },");
+	lines.push("});");
+	lines.push("");
+	return lines.join("\n");
+}
+/**
+* Append missing segment entries to an existing schema file.
+* Inserts new entries before the closing `}` of segmentParams.
+*/
+var CODEC_IMPORT = "import { codec } from '@timber-js/app/codec';";
+function hasCodecImport(content) {
+	return /import\s+\{[^}]*\bcodec\b[^}]*\}\s+from\s+['"]@timber-js\/app\/codec['"]/.test(content);
+}
+function ensureCodecImport(content) {
+	if (hasCodecImport(content)) return content;
+	const lines = content.split("\n");
+	let lastImportIndex = -1;
+	for (let i = 0; i < lines.length; i++) if (/^\s*import\s/.test(lines[i])) lastImportIndex = i;
+	if (lastImportIndex === -1) return "import { codec } from '@timber-js/app/codec';\n" + content;
+	lines.splice(lastImportIndex + 1, 0, CODEC_IMPORT);
+	return lines.join("\n");
+}
+function appendToSchema(content, newSegments) {
+	content = ensureCodecImport(content);
+	const block = findSegmentParamsBlock(content);
+	if (!block) throw new Error("[timber] Could not find segmentParams in schema file. Expected a defineSchema({ segmentParams: { ... } }) call.");
+	const { openBrace, closeBrace } = block;
+	const existingLine = content.slice(openBrace, closeBrace).match(/^(\s+)['"]\[/m);
+	const indent = existingLine ? existingLine[1] : "    ";
+	const insertion = newSegments.map((seg) => `${indent}'${seg}': ${defaultCodecForSegment(seg)},`).join("\n");
+	const before = content.slice(0, closeBrace);
+	const after = content.slice(closeBrace);
+	return before + (before.trimEnd().endsWith(",") ? "\n" : "\n") + insertion + "\n" + after;
+}
+/**
+* Remove entries from the segmentParams block whose keys match `staleSegments`.
+* Removes the entire entry including trailing comma/whitespace. Scoped to
+* the segmentParams block — identical keys in unrelated objects elsewhere
+* in the file are left untouched.
+*/
+function removeFromSchema(content, staleSegments) {
+	const block = findSegmentParamsBlock(content);
+	if (!block) return content;
+	let blockContent = content.slice(block.openBrace, block.closeBrace);
+	let blockMasked = maskSource(blockContent, false);
+	for (const seg of staleSegments) {
+		const escaped = seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const keyRe = new RegExp(`^[ \t]*['"]${escaped}['"][ \t]*:`, "gm");
+		let m;
+		while ((m = keyRe.exec(blockMasked)) !== null) {
+			const start = m.index;
+			let i = m.index + m[0].length;
+			let depth = 0;
+			let inString = null;
+			while (i < blockMasked.length) {
+				const ch = blockMasked[i];
+				if (inString) {
+					if (ch === "\\") i++;
+					else if (ch === inString) inString = null;
+				} else if (ch === "\"" || ch === "'" || ch === "`") inString = ch;
+				else if (ch === "(" || ch === "{" || ch === "[") depth++;
+				else if (ch === ")" || ch === "}" || ch === "]") depth--;
+				else if (depth === 0 && ch === ",") {
+					i++;
+					break;
+				} else if (depth === 0 && (ch === "\n" || ch === "}")) break;
+				i++;
+			}
+			if (i < blockMasked.length && blockMasked[i] === "\n") i++;
+			blockContent = blockContent.slice(0, start) + blockContent.slice(i);
+			blockMasked = blockMasked.slice(0, start) + blockMasked.slice(i);
+			keyRe.lastIndex = start;
+		}
+	}
+	return content.slice(0, block.openBrace) + blockContent + content.slice(block.closeBrace);
+}
+/**
+* Run the schema sync: scan filesystem, diff against schema, append missing.
+*/
+function runSchemaSync(projectRoot) {
+	const appDir = resolveAppDir(projectRoot);
+	const filesystemSegments = collectDynamicSegments(appDir);
+	const schemaPath = findSchemaFile(appDir);
+	if (filesystemSegments.length === 0 && !schemaPath) return {
+		filesystemSegments: [],
+		existingSegments: [],
+		addedSegments: [],
+		removedSegments: [],
+		created: false
+	};
+	if (!schemaPath) {
+		writeFileSync(join(appDir, "schema.ts"), generateNewSchema(filesystemSegments), "utf-8");
+		return {
+			filesystemSegments,
+			existingSegments: [],
+			addedSegments: filesystemSegments,
+			removedSegments: [],
+			created: true
+		};
+	}
+	const content = readFileSync(schemaPath, "utf-8");
+	const existingSegments = parseExistingSchemaKeys(content);
+	const missing = filesystemSegments.filter((seg) => !existingSegments.includes(seg));
+	const stale = existingSegments.filter((seg) => !filesystemSegments.includes(seg));
+	if (missing.length === 0 && stale.length === 0) return {
+		filesystemSegments,
+		existingSegments,
+		addedSegments: [],
+		removedSegments: [],
+		created: false
+	};
+	let updated = content;
+	if (stale.length > 0) updated = removeFromSchema(updated, stale);
+	if (missing.length > 0) updated = appendToSchema(updated, missing);
+	writeFileSync(schemaPath, updated, "utf-8");
+	return {
+		filesystemSegments,
+		existingSegments,
+		addedSegments: missing,
+		removedSegments: stale,
+		created: false
+	};
+}
+//#endregion
+export { parseExistingSchemaKeys as a, findSegmentParamsBlock as i, defaultCodecForSegment as n, runSchemaSync as o, findSchemaFile as r, scanRoutes as s, collectDynamicSegments as t };
+
+//# sourceMappingURL=cli-schema-sync-DJDdyEae.js.map