@timber-js/app 0.2.0-alpha.16 → 0.2.0-alpha.160

package/src/plugins/cloudflare-wasm.ts

@@ -0,0 +1,141 @@
+/**
+ * timber-cloudflare-wasm — Handle WASM modules for Cloudflare Workers builds.
+ *
+ * Cloudflare Workers can natively import `.wasm` files as compiled
+ * WebAssembly.Module. But Rolldown can't load `.wasm` files at build time.
+ *
+ * This plugin bridges the gap:
+ * 1. Adds the `workerd` resolve condition so libraries like @takumi-rs/wasm
+ *    resolve to their Cloudflare-native entry (bare `.wasm` import)
+ * 2. Externalizes `.wasm` imports so Rolldown skips them
+ * 3. Copies the WASM files to the build output so wrangler can find them
+ *
+ * Only active for Cloudflare adapter production builds — every hook bails
+ * unless `isCloudflareBuild` was set in configResolved. In dev and non-CF
+ * builds, `.wasm` imports are left to Vite's own handling (?init / ?url or
+ * a clear build error), never silently externalized.
+ */
+
+import { basename, resolve, dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+import { copyFile, mkdir, readFile } from 'node:fs/promises';
+import type { Plugin, ResolvedConfig } from 'vite';
+import type { PluginContext } from '../plugin-context.js';
+
+function isCloudflareAdapter(ctx: PluginContext): boolean {
+  const adapter = ctx.config.adapter as { name?: string } | undefined;
+  return adapter?.name === 'cloudflare';
+}
+
+export function timberCloudflareWasm(ctx: PluginContext): Plugin[] {
+  // Resolved WASM files, keyed by absolute source path so two files that
+  // share a basename (e.g. lib_bg.wasm from two packages) don't collide.
+  // The value is the unique output basename used for the external import
+  // specifier and the copy destination.
+  const wasmFiles = new Map<string, string>();
+  const usedBasenames = new Set<string>();
+  let isCloudflareBuild = false;
+
+  const plugin: Plugin = {
+    name: 'timber-cloudflare-wasm',
+
+    configResolved(resolved: ResolvedConfig) {
+      if (resolved.command !== 'build') return;
+      if (!isCloudflareAdapter(ctx)) return;
+      isCloudflareBuild = true;
+
+      // Prepend `workerd` to resolve conditions for server environments
+      // so @takumi-rs/wasm/auto resolves to the Cloudflare-native entry
+      // (bare WASM import) instead of the Vite entry (?url + fetch).
+      // Must happen in configResolved because the RSC plugin sets its own
+      // conditions during config — merging via config() would lose them.
+      for (const envName of ['rsc', 'ssr']) {
+        const env = resolved.environments[envName];
+        if (!env) continue;
+        const conditions = env.resolve.conditions;
+        if (!conditions.includes('workerd')) {
+          conditions.unshift('workerd');
+        }
+      }
+    },
+
+    // Strip /* @vite-ignore */ from @takumi-rs/wasm dynamic imports so
+    // Rolldown bundles them instead of leaving bare specifiers that fail
+    // at runtime on Cloudflare Workers (no node_modules).
+    transform(code, id) {
+      if (!isCloudflareBuild) return;
+      if (!id.includes('takumi')) return;
+      const stripped = code.replaceAll(
+        /\/\*\s*@vite-ignore\s*\*\/\s*\n\s*"@takumi-rs\/wasm"/g,
+        '"@takumi-rs/wasm"'
+      );
+      if (stripped !== code) return stripped;
+    },
+
+    resolveId: {
+      order: 'pre',
+      async handler(source, importer) {
+        if (!isCloudflareBuild) return;
+        if (!source.endsWith('.wasm')) return;
+
+        let absolutePath: string;
+        if (source.startsWith('.') && importer) {
+          absolutePath = resolve(dirname(importer), source);
+        } else {
+          return;
+        }
+
+        let outputName = wasmFiles.get(absolutePath);
+        if (!outputName) {
+          outputName = basename(absolutePath);
+          if (usedBasenames.has(outputName)) {
+            // Another wasm file already claimed this basename — disambiguate
+            // with a short content hash so both files land in the output.
+            const hash = createHash('sha256')
+              .update(await readFile(absolutePath))
+              .digest('hex')
+              .slice(0, 8);
+            outputName = outputName.replace(/\.wasm$/, `.${hash}.wasm`);
+          }
+          usedBasenames.add(outputName);
+          wasmFiles.set(absolutePath, outputName);
+        }
+
+        return { id: './' + outputName, external: true };
+      },
+    },
+
+    async writeBundle(options, bundle) {
+      if (!isCloudflareBuild) return;
+      if (wasmFiles.size === 0) return;
+
+      const outDir = options.dir;
+      if (!outDir) return;
+
+      // Find which output chunks reference WASM files and copy the WASM
+      // to the same directory so the relative imports resolve correctly.
+      const targetDirs = new Set<string>();
+      for (const chunk of Object.values(bundle)) {
+        if (chunk.type !== 'chunk') continue;
+        for (const outputName of wasmFiles.values()) {
+          if (chunk.code.includes(outputName)) {
+            targetDirs.add(dirname(resolve(outDir, chunk.fileName)));
+          }
+        }
+      }
+
+      if (targetDirs.size === 0) return;
+
+      const copies: Promise<void>[] = [];
+      for (const dir of targetDirs) {
+        await mkdir(dir, { recursive: true });
+        for (const [absolutePath, outputName] of wasmFiles) {
+          copies.push(copyFile(absolutePath, resolve(dir, outputName)));
+        }
+      }
+      await Promise.all(copies);
+    },
+  };
+
+  return [plugin];
+}

package/src/plugins/content.ts

@@ -11,7 +11,7 @@
 import type { Plugin } from 'vite';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import type { PluginContext } from '#/index.js';
+import type { PluginContext } from '../plugin-context.js';
 
 const CONFIG_FILE_NAMES = [
   'content-collections.ts',

package/src/plugins/dev-server.ts

@@ -14,11 +14,25 @@
 
 import type { Plugin, ViteDevServer, DevEnvironment } from 'vite';
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TLSSocket } from 'node:tls';
+import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import type { PluginContext } from '#/index.js';
-import { setViteServer } from '#/server/dev-warnings.js';
-import { sendErrorToOverlay, classifyErrorPhase, parseFirstAppFrame } from './dev-error-overlay.js';
-import { compressResponse } from '#/server/compress.js';
+import type { PluginContext } from '../plugin-context.js';
+import {
+  sendErrorToOverlay,
+  classifyErrorPhase,
+  fixErrorStacktrace,
+  parseFirstAppFrame,
+  type ErrorPhase,
+} from '../dev-tools/overlay.js';
+import { generateDevErrorPage } from '../dev-tools/error-page.js';
+import { extractHmrOptions, type DevErrorHmrOptions } from '../dev-tools/dev-page-shell.js';
+import { addVirtualModuleContext } from '../config-validation.js';
+import { compressResponse } from '../server/compress.js';
+import { isMetadataRouteServePath } from '../server/metadata-routes.js';
+import { canonicalize } from '../server/canonicalize.js';
+import { matchUrlParts } from '../server/tree-match.js';
+import type { RouteTree } from '../routing/types.js';
 
 // ─── Constants ────────────────────────────────────────────────────────────
 
@@ -72,20 +86,15 @@ export function timberDevServer(ctx: PluginContext): Plugin {
      * filtered out explicitly and passed through to Vite.
      */
     configureServer(server: ViteDevServer) {
-      // Watch config files for full restart.
-      // timber.config.ts is loaded once at startup — any change requires
-      // a full dev server restart. See 21-dev-server.md §HMR Wiring.
+      // Ensure config files are in the watch set. Vite's watcher covers
+      // the project root, but `server.watcher.add()` is a no-op for files
+      // already watched, and ensures newly-created config files (e.g. from
+      // create-timber-app) are picked up. The actual restart logic is
+      // handled by Vite's built-in configFileDependencies check — see the
+      // configResolved hook in index.ts where we register the config path.
+      // See 21-dev-server.md §HMR Wiring.
       const configPaths = CONFIG_FILE_NAMES.map((name) => join(ctx.root, name));
-
-      server.watcher.on('change', (filePath: string) => {
-        if (configPaths.includes(filePath)) {
-          server.restart();
-        }
-      });
-
-      // Register Vite server for browser console warning forwarding.
-      // See 21-dev-server.md §Dev-Mode Warnings.
-      setViteServer(server);
+      server.watcher.add(configPaths);
 
       // Listen for client-side errors forwarded from the browser.
       // The browser entry sends 'timber:client-error' events via HMR
@@ -94,7 +103,22 @@ export function timberDevServer(ctx: PluginContext): Plugin {
       listenForClientErrors(server, ctx.root);
 
       // Pre-hook — registers middleware before Vite's internals
-      server.middlewares.use(createTimberMiddleware(server, ctx.root));
+      server.middlewares.use(createTimberMiddleware(server, ctx));
+
+      // Wrap server.listen() to close the holding server immediately
+      // before Vite binds the port — no gap where nothing is listening.
+      // The holding server was started in rootSync's config() hook to
+      // serve a loading page during initialization.
+      // See design/21-dev-server.md §"Startup Holding Server", TIM-665.
+      if (ctx.holdingServer) {
+        const originalListen = server.listen.bind(server);
+        const holdingRef = ctx.holdingServer;
+        ctx.holdingServer = null;
+        server.listen = async (port?: number, isRestart?: boolean) => {
+          await holdingRef.close().catch(() => {});
+          return originalListen(port, isRestart);
+        };
+      }
 
       // Log startup timing summary. configureServer runs on all plugins
       // before the server listens, so this captures the full cold start.
@@ -121,7 +145,12 @@ export function timberDevServer(ctx: PluginContext): Plugin {
  * For non-route requests (assets, Vite internals, HMR), the middleware
  * calls next() to let Vite handle them.
  */
-function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
+function createTimberMiddleware(server: ViteDevServer, ctx: PluginContext) {
+  const projectRoot = ctx.root;
+  // Extract HMR connection options once so the error page can construct
+  // a correct WebSocket URL (TIM-789).
+  const hmrOptions = extractHmrOptions(server.config);
+
   return async (req: IncomingMessage, res: ServerResponse, next: () => void): Promise<void> => {
     const url = req.url;
     if (!url) {
@@ -135,8 +164,27 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
       return;
     }
 
-    // Pass through static asset requests
-    if (isAssetRequest(url)) {
+    // Files that exist in public/ are always served by Vite's static
+    // middleware, regardless of extension. Without this, extensions like
+    // .ico, .txt, .xml, .html either get caught by the metadata route
+    // check or aren't in ASSET_EXTENSIONS, so they fall through to the
+    // app router where a dynamic segment like [artistSlug] 404s them.
+    if (isPublicFile(server, url)) {
+      next();
+      return;
+    }
+
+    // Pass through static asset requests — but not metadata routes like
+    // /favicon.ico that match asset extensions but are handled by timber,
+    // and not registered routes like app/feed.json/route.ts whose URL ends
+    // in an asset extension. Production serves these through the RSC
+    // handler, so letting them fall through to Vite would 404 in dev only
+    // (TIM-1038).
+    if (
+      isAssetRequest(url) &&
+      !isMetadataRouteServePath(url) &&
+      !isRouteOwnedAsset(ctx.routeTree, server, url)
+    ) {
       next();
       return;
     }
@@ -160,13 +208,50 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
       handler = rscModule.default as (req: Request) => Promise<Response>;
 
       // Wire pipeline errors into the browser error overlay.
-      // setDevPipelineErrorHandler is only defined in dev (rsc-entry.ts exports it).
-      const setHandler = rscModule.setDevPipelineErrorHandler as
-        | ((fn: (error: Error, phase: string) => void) => void)
+      // Set devPipelineErrorHandler directly on the pipeline config —
+      // no module-level singleton. The handler receives optional RSC debug
+      // component data (component names, environments, stack frames) from
+      // the Flight debug channel for render errors.
+      const config = rscModule.pipelineConfig as
+        | {
+            devPipelineErrorHandler?: (
+              error: Error,
+              phase: string,
+              debugComponents?: Array<{
+                name: string;
+                env: string | null;
+                stack: unknown[] | null;
+              }>
+            ) => void;
+            devHmrOptions?: DevErrorHmrOptions;
+          }
+        | undefined;
+      if (config) {
+        config.devPipelineErrorHandler = (error, _phase, debugComponents) => {
+          sendErrorToOverlay(
+            server,
+            error,
+            classifyErrorPhase(error, projectRoot),
+            projectRoot,
+            debugComponents
+          );
+        };
+        // Plumb the resolved HMR options into the RSC environment. The RSC
+        // entry can't read the Vite server config (separate module graph),
+        // but its dev 404 page and fallback error page need the HMR endpoint
+        // (including Vite 8's required WS token) for auto-reload (TIM-1067).
+        config.devHmrOptions = hmrOptions;
+      }
+
+      // Wire source-map handler so error pages show original positions.
+      // fixErrorStacktrace rewrites the error's stack trace in-place using
+      // the Vite dev server's module graph. See TIM-811.
+      const setSourceMap = rscModule.setDevSourceMapHandler as
+        | ((fn: (error: Error) => void) => void)
         | undefined;
-      if (typeof setHandler === 'function') {
-        setHandler((error) => {
-          sendErrorToOverlay(server, error, classifyErrorPhase(error, projectRoot), projectRoot);
+      if (typeof setSourceMap === 'function') {
+        setSourceMap((error: Error) => {
+          fixErrorStacktrace(server, error);
         });
       }
     } catch (error) {
@@ -174,9 +259,11 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
       // Vite may already show its own overlay for these, but we still
       // log to stderr with frame dimming for the terminal.
       if (error instanceof Error) {
+        // Add context for virtual:timber-* module errors
+        addTimberContext(error);
         sendErrorToOverlay(server, error, 'module-transform', projectRoot);
       }
-      respond500(res, error);
+      respond500(res, error, 'module-transform', projectRoot, hmrOptions);
       return;
     }
 
@@ -191,8 +278,20 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
       // Convert Node IncomingMessage → Web Request
       const webRequest = toWebRequest(req);
 
-      // Run the full pipeline
-      const webResponse = await handler(webRequest);
+      // Check for a platform-specific request wrapper (e.g., Cloudflare
+      // dev bindings). The cloudflareDevBindings() plugin stores a wrapper
+      // function on the server instance using a well-known Symbol. The
+      // wrapper runs the handler inside an ALS context so platform APIs
+      // like getCloudflareBindings() work during dev.
+      // See design/35-cloudflare-primitives.md §"Dev Experience".
+      const wrapper = (server as any)[Symbol.for('timber:dev-request-wrapper')] as
+        | (<T>(fn: () => T) => T)
+        | undefined;
+
+      // Run the full pipeline (wrapped if a platform dev plugin is active)
+      const webResponse = wrapper
+        ? await wrapper(() => handler(webRequest))
+        : await handler(webRequest);
 
       // Compress the response if the client supports it.
       // In dev mode, compression is always enabled for parity with production.
@@ -205,26 +304,71 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
       // Pipeline error — classify the phase, send to overlay, respond 500.
       // The dev server remains running for recovery on file fix + HMR.
       if (error instanceof Error) {
-        const phase = classifyErrorPhase(error, projectRoot);
-        sendErrorToOverlay(server, error, phase, projectRoot);
+        // Unwrap SsrStreamError to show the real cause in the error overlay.
+        // SsrStreamError wraps the original RSC render error with a generic
+        // message; the developer needs to see the actual error (e.g.,
+        // "useSegmentParams is not a function"), not the wrapper.
+        const displayError =
+          error.name === 'SsrStreamError' && error.cause instanceof Error ? error.cause : error;
+        const phase = classifyErrorPhase(displayError, projectRoot);
+        sendErrorToOverlay(server, displayError, phase, projectRoot);
+        respond500(res, displayError, phase, projectRoot, hmrOptions);
       } else {
         process.stderr.write(`\x1b[31m[timber] Dev server error:\x1b[0m ${String(error)}\n`);
+        respond500(res, error, 'render', projectRoot, hmrOptions);
       }
-      respond500(res, error);
     }
   };
 }
 
 /**
  * Send a 500 response without crashing the dev server.
+ *
+ * In dev mode, renders a styled HTML error page with source context,
+ * classified stack trace, and auto-reload on HMR. Falls back to
+ * text/plain if the HTML generator fails (must never crash).
  */
-function respond500(res: ServerResponse, error: unknown): void {
-  if (!res.headersSent) {
-    res.statusCode = 500;
-    res.setHeader('content-type', 'text/plain');
-    res.end(
-      `[timber] Internal server error\n\n${error instanceof Error ? (error.stack ?? error.message) : String(error)}`
-    );
+function respond500(
+  res: ServerResponse,
+  error: unknown,
+  phase: ErrorPhase,
+  projectRoot: string,
+  hmrOptions?: DevErrorHmrOptions
+): void {
+  if (res.headersSent) return;
+
+  // Try to render the rich HTML error page
+  if (error instanceof Error) {
+    try {
+      const html = generateDevErrorPage(error, phase, projectRoot, hmrOptions);
+      res.statusCode = 500;
+      res.setHeader('content-type', 'text/html; charset=utf-8');
+      res.end(html);
+      return;
+    } catch (e) {
+      console.debug(
+        '[timber] dev error page generation failed, falling back to text/plain:',
+        e instanceof Error ? e.message : e
+      );
+    }
+  }
+
+  // Fallback: plain text (same as before)
+  res.statusCode = 500;
+  res.setHeader('content-type', 'text/plain');
+  res.end(
+    `[timber] Internal server error\n\n${error instanceof Error ? (error.stack ?? error.message) : String(error)}`
+  );
+}
+
+/**
+ * Add timber-specific context to an error's message if it references
+ * internal virtual modules (virtual:timber-*). Mutates the error in place.
+ */
+function addTimberContext(error: Error): void {
+  const enriched = addVirtualModuleContext(error.message);
+  if (enriched !== error.message) {
+    error.message = enriched;
   }
 }
 
@@ -235,15 +379,30 @@ function respond500(res: ServerResponse, error: unknown): void {
  *
  * Constructs the full URL from the Host header and request URL,
  * and forwards the method, headers, and body.
+ *
+ * The scheme comes from the socket's TLS state — with `server.https` the
+ * browser sends `Origin: https://host`, and a hardcoded `http://` would
+ * fail CSRF origin comparison on every POST. X-Forwarded-Proto is NOT
+ * consulted: dev connections are direct, so the header would be
+ * attacker-controlled. (TIM-1067, B32)
+ *
+ * Exported for tests.
  */
-function toWebRequest(nodeReq: IncomingMessage): Request {
-  const protocol = 'http';
-  const host = nodeReq.headers.host ?? 'localhost';
+export function toWebRequest(nodeReq: IncomingMessage): Request {
+  const protocol = (nodeReq.socket as TLSSocket | undefined)?.encrypted ? 'https' : 'http';
+  // Under HTTP/2 there is no Host header — the authority lives in the
+  // `:authority` pseudo-header.
+  const host =
+    nodeReq.headers.host ?? (nodeReq.headers[':authority'] as string | undefined) ?? 'localhost';
   const url = `${protocol}://${host}${nodeReq.url}`;
 
   const headers = new Headers();
   for (const [key, value] of Object.entries(nodeReq.headers)) {
     if (value === undefined) continue;
+    // HTTP/2 pseudo-headers (:method, :path, :authority, :scheme) are not
+    // valid Headers names — Headers.set() throws on them. They're already
+    // reflected in the request URL/method above.
+    if (key.startsWith(':')) continue;
     if (Array.isArray(value)) {
       for (const v of value) {
         headers.append(key, v);
@@ -252,6 +411,11 @@ function toWebRequest(nodeReq: IncomingMessage): Request {
       headers.set(key, value);
     }
   }
+  // HTTP/2 requests carry the authority in `:authority`, not Host — but
+  // downstream consumers (CSRF origin validation) read the Host header.
+  if (!headers.has('host')) {
+    headers.set('host', host);
+  }
 
   const method = nodeReq.method ?? 'GET';
   const hasBody = method !== 'GET' && method !== 'HEAD';
@@ -317,6 +481,17 @@ async function sendWebResponse(nodeRes: ServerResponse, webResponse: Response):
   nodeRes.flushHeaders();
 
   const reader = webResponse.body.getReader();
+
+  // Cancel the reader when the client disconnects. This causes any pending
+  // reader.read() to reject, breaking the pump loop. Critical for SSE and
+  // other infinite streams — without this, disconnected clients leak readers.
+  let clientDisconnected = false;
+  const onClose = () => {
+    clientDisconnected = true;
+    reader.cancel('Client disconnected').catch(() => {});
+  };
+  nodeRes.on('close', onClose);
+
   try {
     while (true) {
       const { done, value } = await reader.read();
@@ -325,9 +500,18 @@ async function sendWebResponse(nodeRes: ServerResponse, webResponse: Response):
       // don't need back-pressure here — just keep pushing chunks.
       nodeRes.write(value);
     }
+  } catch (err) {
+    // reader.cancel() from the close handler causes read() to reject.
+    // This is expected on client disconnect — not an error.
+    if (!clientDisconnected) {
+      throw err;
+    }
   } finally {
+    nodeRes.off('close', onClose);
     reader.releaseLock();
-    nodeRes.end();
+    if (!nodeRes.writableEnded) {
+      nodeRes.end();
+    }
   }
 }
 
@@ -347,6 +531,69 @@ function isAssetRequest(url: string): boolean {
   return ASSET_EXTENSIONS.test(url);
 }
 
+/**
+ * Check if a URL maps to a real file in the project's public/ directory.
+ * Vite serves public/ files as static assets — if a file exists there it
+ * must be passed through to Vite regardless of extension.
+ */
+function isPublicFile(server: ViteDevServer, url: string): boolean {
+  const { publicDir } = server.config;
+  if (!publicDir) return false;
+  const pathname = url.split('?')[0];
+  const relativePath = pathname.startsWith('/') ? pathname.slice(1) : pathname;
+  if (!relativePath) return false;
+  const fullPath = join(publicDir, relativePath);
+  try {
+    return statSync(fullPath).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check whether an asset-extension URL belongs to a scanned route rather
+ * than a static file.
+ *
+ * Route handlers may live at paths ending in asset-like extensions
+ * (app/feed.json/route.ts → /feed.json), which the asset bypass would
+ * otherwise hand to Vite — 404ing in dev while working in production.
+ * Uses the same canonicalization and tree walker as the runtime matcher
+ * so dev classification agrees with what the pipeline would match.
+ *
+ * A file that actually exists on disk wins over the route match: the
+ * production server serves public/ statics before the RSC handler (see
+ * adapters/nitro.ts), and Vite serves root-relative source files (e.g.
+ * /app/global.css) in dev. Without this, a broad catch-all route like
+ * app/[...slug] would shadow every static asset. Joining the canonical
+ * pathname is traversal-safe — canonicalize() resolves `..` segments and
+ * rejects root escapes and encoded separators.
+ *
+ * Reads ctx.routeTree per request — the routing plugin rescans it on
+ * file add/unlink/change, so newly created routes are picked up live.
+ */
+function isRouteOwnedAsset(
+  routeTree: RouteTree | null,
+  server: ViteDevServer,
+  url: string
+): boolean {
+  if (!routeTree) return false;
+  const rawPathname = url.split('?')[0];
+  const result = canonicalize(rawPathname);
+  // Malformed URLs can't match a route — let Vite handle them as before.
+  if (!result.ok) return false;
+  const parts = result.pathname === '/' ? [] : result.pathname.slice(1).split('/');
+  if (matchUrlParts(routeTree.root, parts) === null) return false;
+
+  // Real static files win over the route match (dev/prod parity: the
+  // production server tries public/ before the RSC handler).
+  const relativePath = result.pathname.slice(1);
+  const { publicDir, root } = server.config;
+  if (publicDir && existsSync(join(publicDir, relativePath))) return false;
+  if (existsSync(join(root, relativePath))) return false;
+
+  return true;
+}
+
 // ─── Client Error Listener ─────────────────────────────────────────────
 
 interface ClientErrorPayload {
@@ -392,8 +639,8 @@ function listenForClientErrors(server: ViteDevServer, projectRoot: string): void
           loc: loc ? { file: loc.file, line: loc.line, column: loc.column } : undefined,
         },
       });
-    } catch {
-      // Overlay send must never crash the dev server
+    } catch (e) {
+      console.debug('[timber] overlay send failed:', e instanceof Error ? e.message : e);
     }
   });
 }