@timber-js/app 0.2.0-alpha.16 → 0.2.0-alpha.160

package/dist/_chunks/dist-BA3u1z3W.js

@@ -0,0 +1,423 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+//#endregion
+//#region src/cookies/validation.ts
+/**
+* Cookie name and value validation per RFC 6265 §4.1.1.
+*
+* This module is pure — no server or client imports — so it can be loaded
+* by both `server/request-context.ts` (which guards `getCookies().set()`)
+* and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The
+* shared validator gives both sides identical encoding contracts:
+* **the framework never silently encodes — callers emit `cookie-octet`
+* bytes or get a developer-facing error.**
+*
+* Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and
+* design/29-cookies.md §"Cookie Name and Value Validation".
+*/
+/**
+* RFC 7230 §3.2.6 token characters used as the cookie-name production in
+* RFC 6265 §4.1.1. Anchored, non-empty match.
+*
+* Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.
+* Disallowed: whitespace, controls, delimiters
+* (`(` `)` `<` `>` `@` `,` `;` `:` `\` `"` `/` `[` `]` `?` `=` `{` `}`).
+*/
+var COOKIE_NAME_RE = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
+/**
+* Format a single byte for a clear error message — escape control bytes
+* and non-ASCII as `0x..` and quote printables.
+*/
+function describeChar(value, index) {
+	const code = value.charCodeAt(index);
+	if (code < 32 || code === 127 || code > 126) return `0x${code.toString(16).padStart(2, "0")}`;
+	return JSON.stringify(value[index]);
+}
+/**
+* Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.
+* Throws a developer-facing error naming the offending byte and its index.
+*/
+function assertValidCookieName(name) {
+	if (typeof name !== "string" || name.length === 0) throw new Error("[timber] cookie name must be a non-empty string.");
+	if (!COOKIE_NAME_RE.test(name)) {
+		for (let i = 0; i < name.length; i++) if (!COOKIE_NAME_RE.test(name[i])) throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — disallowed character ${describeChar(name, i)} at index ${i}. Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, and \`!#$%&'*+-.^_\`|~\`; no whitespace, controls, or delimiters).`);
+		throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — must match RFC 6265 §4.1.1 token grammar.`);
+	}
+}
+/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */
+function isCookieOctet(code) {
+	return code === 33 || code >= 35 && code <= 43 || code >= 45 && code <= 58 || code >= 60 && code <= 91 || code >= 93 && code <= 126;
+}
+/**
+* Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`
+* production:
+*
+*     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+*     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*
+* Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are
+* valid. The wrapped form is common in upstream `Set-Cookie` headers
+* (e.g. `sid="abc"; Path=/`) and must be forwardable through
+* `setFromHeaders` verbatim — stripping or rejecting the surrounding
+* quotes would corrupt the on-the-wire bytes and break value semantics
+* for the upstream service.
+*
+* Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),
+* interior DQUOTE, comma, semicolon, backslash, DEL, and anything
+* non-ASCII. The smuggling primitive (`;`) is rejected regardless of
+* wrapping.
+*
+* Throws a developer-facing error naming the offending byte and its
+* index. Callers passing user-controlled data through the default
+* `set()` path don't need to call this — `set()` auto-encodes via
+* `encodeURIComponent`, whose output is always valid cookie-octet.
+* This validator is for the `{ raw: true }` opt-out and for
+* `setFromHeaders` forwarding.
+*/
+/**
+* Characters that must not appear in path or domain cookie attributes.
+* Semicolons delimit cookie attributes on the wire, so allowing `;` in
+* path or domain would inject extra attributes. CR/LF enable HTTP header
+* injection.
+*/
+var ATTR_INJECTION_RE = /[;\r\n]/;
+var VALID_SAME_SITE = /* @__PURE__ */ new Set([
+	"strict",
+	"lax",
+	"none"
+]);
+/**
+* Validate cookie option attributes at runtime to prevent Set-Cookie
+* header injection through unsanitized option values.
+*
+* TypeScript types enforce correct shapes at compile time, but at runtime
+* (e.g. from untyped libraries or user-controlled config) invalid values
+* could inject additional Set-Cookie attributes.
+*/
+function assertValidCookieOptions(options) {
+	if (options.sameSite !== void 0) {
+		const lower = options.sameSite.toLowerCase();
+		if (!VALID_SAME_SITE.has(lower)) throw new Error(`[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — must be 'strict', 'lax', or 'none'.`);
+	}
+	if (options.path !== void 0 && ATTR_INJECTION_RE.test(options.path)) throw new Error(`[timber] invalid cookie path ${JSON.stringify(options.path)} — path must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.domain !== void 0 && ATTR_INJECTION_RE.test(options.domain)) throw new Error(`[timber] invalid cookie domain ${JSON.stringify(options.domain)} — domain must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.maxAge !== void 0 && (typeof options.maxAge !== "number" || !Number.isFinite(options.maxAge))) throw new Error(`[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — maxAge must be a finite number.`);
+}
+function assertValidCookieValue(name, value) {
+	if (typeof value !== "string") throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);
+	const wrapped = value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34;
+	const start = wrapped ? 1 : 0;
+	const end = wrapped ? value.length - 1 : value.length;
+	for (let i = start; i < end; i++) if (!isCookieOctet(value.charCodeAt(i))) throw new Error(`[timber] cookie ${JSON.stringify(name)}: invalid cookie value — disallowed character ${describeChar(value, i)} at index ${i}. Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes (US-ASCII printable, excluding whitespace, \`"\`, \`,\`, \`;\`, and \`\\\`), optionally enclosed in a single DQUOTE pair. Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/cookie@1.1.1/node_modules/cookie/dist/index.js
+var require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.parseCookie = parseCookie;
+	exports.stringifySetCookie = stringifySetCookie;
+	exports.serialize = stringifySetCookie;
+	exports.parseSetCookie = parseSetCookie;
+	exports.stringifySetCookie = stringifySetCookie;
+	exports.serialize = stringifySetCookie;
+	/**
+	* RegExp to match cookie-name in RFC 6265 sec 4.1.1
+	* This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+	* which has been replaced by the token definition in RFC 7230 appendix B.
+	*
+	* cookie-name       = token
+	* token             = 1*tchar
+	* tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+	*                     "*" / "+" / "-" / "." / "^" / "_" /
+	*                     "`" / "|" / "~" / DIGIT / ALPHA
+	*
+	* Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+	* Allow same range as cookie value, except `=`, which delimits end of name.
+	*/
+	var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+	/**
+	* RegExp to match cookie-value in RFC 6265 sec 4.1.1
+	*
+	* cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+	* cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+	*                     ; US-ASCII characters excluding CTLs,
+	*                     ; whitespace DQUOTE, comma, semicolon,
+	*                     ; and backslash
+	*
+	* Allowing more characters: https://github.com/jshttp/cookie/issues/191
+	* Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+	*/
+	var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+	/**
+	* RegExp to match domain-value in RFC 6265 sec 4.1.1
+	*
+	* domain-value      = <subdomain>
+	*                     ; defined in [RFC1034], Section 3.5, as
+	*                     ; enhanced by [RFC1123], Section 2.1
+	* <subdomain>       = <label> | <subdomain> "." <label>
+	* <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+	*                     Labels must be 63 characters or less.
+	*                     'let-dig' not 'letter' in the first char, per RFC1123
+	* <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+	* <let-dig-hyp>     = <let-dig> | "-"
+	* <let-dig>         = <letter> | <digit>
+	* <letter>          = any one of the 52 alphabetic characters A through Z in
+	*                     upper case and a through z in lower case
+	* <digit>           = any one of the ten digits 0 through 9
+	*
+	* Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+	*
+	* > (Note that a leading %x2E ("."), if present, is ignored even though that
+	* character is not permitted, but a trailing %x2E ("."), if present, will
+	* cause the user agent to ignore the attribute.)
+	*/
+	var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+	/**
+	* RegExp to match path-value in RFC 6265 sec 4.1.1
+	*
+	* path-value        = <any CHAR except CTLs or ";">
+	* CHAR              = %x01-7F
+	*                     ; defined in RFC 5234 appendix B.1
+	*/
+	var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+	/**
+	* RegExp to match max-age-value in RFC 6265 sec 5.6.2
+	*/
+	var maxAgeRegExp = /^-?\d+$/;
+	var __toString = Object.prototype.toString;
+	var NullObject = /* @__PURE__ */ (() => {
+		const C = function() {};
+		C.prototype = Object.create(null);
+		return C;
+	})();
+	/**
+	* Parse a `Cookie` header.
+	*
+	* Parse the given cookie header string into an object
+	* The object has the various cookies as keys(names) => values
+	*/
+	function parseCookie(str, options) {
+		const obj = new NullObject();
+		const len = str.length;
+		if (len < 2) return obj;
+		const dec = options?.decode || decode;
+		let index = 0;
+		do {
+			const eqIdx = eqIndex(str, index, len);
+			if (eqIdx === -1) break;
+			const endIdx = endIndex(str, index, len);
+			if (eqIdx > endIdx) {
+				index = str.lastIndexOf(";", eqIdx - 1) + 1;
+				continue;
+			}
+			const key = valueSlice(str, index, eqIdx);
+			if (obj[key] === void 0) obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
+			index = endIdx + 1;
+		} while (index < len);
+		return obj;
+	}
+	function stringifySetCookie(_name, _val, _opts) {
+		const cookie = typeof _name === "object" ? _name : {
+			..._opts,
+			name: _name,
+			value: String(_val)
+		};
+		const enc = (typeof _val === "object" ? _val : _opts)?.encode || encodeURIComponent;
+		if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
+		const value = cookie.value ? enc(cookie.value) : "";
+		if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
+		let str = cookie.name + "=" + value;
+		if (cookie.maxAge !== void 0) {
+			if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+			str += "; Max-Age=" + cookie.maxAge;
+		}
+		if (cookie.domain) {
+			if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+			str += "; Domain=" + cookie.domain;
+		}
+		if (cookie.path) {
+			if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
+			str += "; Path=" + cookie.path;
+		}
+		if (cookie.expires) {
+			if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+			str += "; Expires=" + cookie.expires.toUTCString();
+		}
+		if (cookie.httpOnly) str += "; HttpOnly";
+		if (cookie.secure) str += "; Secure";
+		if (cookie.partitioned) str += "; Partitioned";
+		if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
+			case "low":
+				str += "; Priority=Low";
+				break;
+			case "medium":
+				str += "; Priority=Medium";
+				break;
+			case "high":
+				str += "; Priority=High";
+				break;
+			default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+		}
+		if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
+			case true:
+			case "strict":
+				str += "; SameSite=Strict";
+				break;
+			case "lax":
+				str += "; SameSite=Lax";
+				break;
+			case "none":
+				str += "; SameSite=None";
+				break;
+			default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+		}
+		return str;
+	}
+	/**
+	* Deserialize a `Set-Cookie` header into an object.
+	*
+	* deserialize('foo=bar; httpOnly')
+	*   => { name: 'foo', value: 'bar', httpOnly: true }
+	*/
+	function parseSetCookie(str, options) {
+		const dec = options?.decode || decode;
+		const len = str.length;
+		const endIdx = endIndex(str, 0, len);
+		const eqIdx = eqIndex(str, 0, endIdx);
+		const setCookie = eqIdx === -1 ? {
+			name: "",
+			value: dec(valueSlice(str, 0, endIdx))
+		} : {
+			name: valueSlice(str, 0, eqIdx),
+			value: dec(valueSlice(str, eqIdx + 1, endIdx))
+		};
+		let index = endIdx + 1;
+		while (index < len) {
+			const endIdx = endIndex(str, index, len);
+			const eqIdx = eqIndex(str, index, endIdx);
+			const attr = eqIdx === -1 ? valueSlice(str, index, endIdx) : valueSlice(str, index, eqIdx);
+			const val = eqIdx === -1 ? void 0 : valueSlice(str, eqIdx + 1, endIdx);
+			switch (attr.toLowerCase()) {
+				case "httponly":
+					setCookie.httpOnly = true;
+					break;
+				case "secure":
+					setCookie.secure = true;
+					break;
+				case "partitioned":
+					setCookie.partitioned = true;
+					break;
+				case "domain":
+					setCookie.domain = val;
+					break;
+				case "path":
+					setCookie.path = val;
+					break;
+				case "max-age":
+					if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Number(val);
+					break;
+				case "expires":
+					if (!val) break;
+					const date = new Date(val);
+					if (Number.isFinite(date.valueOf())) setCookie.expires = date;
+					break;
+				case "priority":
+					if (!val) break;
+					const priority = val.toLowerCase();
+					if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
+					break;
+				case "samesite":
+					if (!val) break;
+					const sameSite = val.toLowerCase();
+					if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
+					break;
+			}
+			index = endIdx + 1;
+		}
+		return setCookie;
+	}
+	/**
+	* Find the `;` character between `min` and `len` in str.
+	*/
+	function endIndex(str, min, len) {
+		const index = str.indexOf(";", min);
+		return index === -1 ? len : index;
+	}
+	/**
+	* Find the `=` character between `min` and `max` in str.
+	*/
+	function eqIndex(str, min, max) {
+		const index = str.indexOf("=", min);
+		return index < max ? index : -1;
+	}
+	/**
+	* Slice out a value between startPod to max.
+	*/
+	function valueSlice(str, min, max) {
+		let start = min;
+		let end = max;
+		do {
+			const code = str.charCodeAt(start);
+			if (code !== 32 && code !== 9) break;
+		} while (++start < end);
+		while (end > start) {
+			const code = str.charCodeAt(end - 1);
+			if (code !== 32 && code !== 9) break;
+			end--;
+		}
+		return str.slice(start, end);
+	}
+	/**
+	* URL-decode string value. Optimized to skip native call when no %.
+	*/
+	function decode(str) {
+		if (str.indexOf("%") === -1) return str;
+		try {
+			return decodeURIComponent(str);
+		} catch (e) {
+			return str;
+		}
+	}
+	/**
+	* Determine if value is a Date.
+	*/
+	function isDate(val) {
+		return __toString.call(val) === "[object Date]";
+	}
+}));
+//#endregion
+export { __esmMin as a, assertValidCookieValue as i, assertValidCookieName as n, __exportAll as o, assertValidCookieOptions as r, __toCommonJS as s, require_dist as t };
+
+//# sourceMappingURL=dist-BA3u1z3W.js.map

package/dist/_chunks/dist-BA3u1z3W.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-BA3u1z3W.js","names":[],"sources":["../../src/cookies/validation.ts","../../../../node_modules/.pnpm/cookie@1.1.1/node_modules/cookie/dist/index.js"],"sourcesContent":["/**\n * Cookie name and value validation per RFC 6265 §4.1.1.\n *\n * This module is pure — no server or client imports — so it can be loaded\n * by both `server/request-context.ts` (which guards `getCookies().set()`)\n * and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The\n * shared validator gives both sides identical encoding contracts:\n * **the framework never silently encodes — callers emit `cookie-octet`\n * bytes or get a developer-facing error.**\n *\n * Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and\n * design/29-cookies.md §\"Cookie Name and Value Validation\".\n */\n\n// ─── RFC 6265 cookie-octet ────────────────────────────────────────────────\n//\n//   cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n//\n// Equivalently: US-ASCII printable bytes excluding whitespace, `\"` (0x22),\n// `,` (0x2C), `;` (0x3B), `\\` (0x5C), and DEL (0x7F).\n\n/**\n * RFC 7230 §3.2.6 token characters used as the cookie-name production in\n * RFC 6265 §4.1.1. Anchored, non-empty match.\n *\n * Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.\n * Disallowed: whitespace, controls, delimiters\n * (`(` `)` `<` `>` `@` `,` `;` `:` `\\` `\"` `/` `[` `]` `?` `=` `{` `}`).\n */\nconst COOKIE_NAME_RE = /^[!#$%&'*+\\-.0-9A-Z^_`a-z|~]+$/;\n\n/**\n * Format a single byte for a clear error message — escape control bytes\n * and non-ASCII as `0x..` and quote printables.\n */\nfunction describeChar(value: string, index: number): string {\n  const code = value.charCodeAt(index);\n  if (code < 0x20 || code === 0x7f || code > 0x7e) {\n    return `0x${code.toString(16).padStart(2, '0')}`;\n  }\n  return JSON.stringify(value[index]);\n}\n\n/**\n * Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.\n * Throws a developer-facing error naming the offending byte and its index.\n */\nexport function assertValidCookieName(name: string): void {\n  if (typeof name !== 'string' || name.length === 0) {\n    throw new Error('[timber] cookie name must be a non-empty string.');\n  }\n  if (!COOKIE_NAME_RE.test(name)) {\n    for (let i = 0; i < name.length; i++) {\n      if (!COOKIE_NAME_RE.test(name[i])) {\n        throw new Error(\n          `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n            `disallowed character ${describeChar(name, i)} at index ${i}. ` +\n            `Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, ` +\n            `and \\`!#$%&'*+-.^_\\`|~\\`; no whitespace, controls, or delimiters).`\n        );\n      }\n    }\n    throw new Error(\n      `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n        `must match RFC 6265 §4.1.1 token grammar.`\n    );\n  }\n}\n\n/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */\nfunction isCookieOctet(code: number): boolean {\n  return (\n    code === 0x21 ||\n    (code >= 0x23 && code <= 0x2b) ||\n    (code >= 0x2d && code <= 0x3a) ||\n    (code >= 0x3c && code <= 0x5b) ||\n    (code >= 0x5d && code <= 0x7e)\n  );\n}\n\n/**\n * Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`\n * production:\n *\n *     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n *     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *\n * Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are\n * valid. The wrapped form is common in upstream `Set-Cookie` headers\n * (e.g. `sid=\"abc\"; Path=/`) and must be forwardable through\n * `setFromHeaders` verbatim — stripping or rejecting the surrounding\n * quotes would corrupt the on-the-wire bytes and break value semantics\n * for the upstream service.\n *\n * Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),\n * interior DQUOTE, comma, semicolon, backslash, DEL, and anything\n * non-ASCII. The smuggling primitive (`;`) is rejected regardless of\n * wrapping.\n *\n * Throws a developer-facing error naming the offending byte and its\n * index. Callers passing user-controlled data through the default\n * `set()` path don't need to call this — `set()` auto-encodes via\n * `encodeURIComponent`, whose output is always valid cookie-octet.\n * This validator is for the `{ raw: true }` opt-out and for\n * `setFromHeaders` forwarding.\n */\n// ─── Cookie attribute validation ──────────────────────────────────────────\n\n/**\n * Characters that must not appear in path or domain cookie attributes.\n * Semicolons delimit cookie attributes on the wire, so allowing `;` in\n * path or domain would inject extra attributes. CR/LF enable HTTP header\n * injection.\n */\nconst ATTR_INJECTION_RE = /[;\\r\\n]/;\n\nconst VALID_SAME_SITE = new Set(['strict', 'lax', 'none']);\n\n/**\n * Validate cookie option attributes at runtime to prevent Set-Cookie\n * header injection through unsanitized option values.\n *\n * TypeScript types enforce correct shapes at compile time, but at runtime\n * (e.g. from untyped libraries or user-controlled config) invalid values\n * could inject additional Set-Cookie attributes.\n */\nexport function assertValidCookieOptions(options: {\n  sameSite?: string;\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n}): void {\n  if (options.sameSite !== undefined) {\n    const lower = options.sameSite.toLowerCase();\n    if (!VALID_SAME_SITE.has(lower)) {\n      throw new Error(\n        `[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — ` +\n          `must be 'strict', 'lax', or 'none'.`\n      );\n    }\n  }\n  if (options.path !== undefined && ATTR_INJECTION_RE.test(options.path)) {\n    throw new Error(\n      `[timber] invalid cookie path ${JSON.stringify(options.path)} — ` +\n        `path must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (options.domain !== undefined && ATTR_INJECTION_RE.test(options.domain)) {\n    throw new Error(\n      `[timber] invalid cookie domain ${JSON.stringify(options.domain)} — ` +\n        `domain must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (\n    options.maxAge !== undefined &&\n    (typeof options.maxAge !== 'number' || !Number.isFinite(options.maxAge))\n  ) {\n    throw new Error(\n      `[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — ` +\n        `maxAge must be a finite number.`\n    );\n  }\n}\n\nexport function assertValidCookieValue(name: string, value: string): void {\n  if (typeof value !== 'string') {\n    throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);\n  }\n  // Detect the DQUOTE-wrapped form: at least two characters and both\n  // endpoints are `\"`. The interior must be pure cookie-octet (no\n  // interior DQUOTEs allowed — the grammar says *cookie-octet, and\n  // cookie-octet excludes 0x22).\n  const wrapped =\n    value.length >= 2 &&\n    value.charCodeAt(0) === 0x22 &&\n    value.charCodeAt(value.length - 1) === 0x22;\n  const start = wrapped ? 1 : 0;\n  const end = wrapped ? value.length - 1 : value.length;\n  for (let i = start; i < end; i++) {\n    const code = value.charCodeAt(i);\n    if (!isCookieOctet(code)) {\n      throw new Error(\n        `[timber] cookie ${JSON.stringify(name)}: invalid cookie value — ` +\n          `disallowed character ${describeChar(value, i)} at index ${i}. ` +\n          `Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes ` +\n          `(US-ASCII printable, excluding whitespace, \\`\"\\`, \\`,\\`, \\`;\\`, and \\`\\\\\\`), ` +\n          `optionally enclosed in a single DQUOTE pair. ` +\n          `Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`\n      );\n    }\n  }\n}\n","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.parseCookie = parseCookie;\nexports.parse = parseCookie;\nexports.stringifyCookie = stringifyCookie;\nexports.stringifySetCookie = stringifySetCookie;\nexports.serialize = stringifySetCookie;\nexports.parseSetCookie = parseSetCookie;\nexports.stringifySetCookie = stringifySetCookie;\nexports.serialize = stringifySetCookie;\n/**\n * RegExp to match cookie-name in RFC 6265 sec 4.1.1\n * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2\n * which has been replaced by the token definition in RFC 7230 appendix B.\n *\n * cookie-name       = token\n * token             = 1*tchar\n * tchar             = \"!\" / \"#\" / \"$\" / \"%\" / \"&\" / \"'\" /\n *                     \"*\" / \"+\" / \"-\" / \".\" / \"^\" / \"_\" /\n *                     \"`\" / \"|\" / \"~\" / DIGIT / ALPHA\n *\n * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191\n * Allow same range as cookie value, except `=`, which delimits end of name.\n */\nconst cookieNameRegExp = /^[\\u0021-\\u003A\\u003C\\u003E-\\u007E]+$/;\n/**\n * RegExp to match cookie-value in RFC 6265 sec 4.1.1\n *\n * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *                     ; US-ASCII characters excluding CTLs,\n *                     ; whitespace DQUOTE, comma, semicolon,\n *                     ; and backslash\n *\n * Allowing more characters: https://github.com/jshttp/cookie/issues/191\n * Comma, backslash, and DQUOTE are not part of the parsing algorithm.\n */\nconst cookieValueRegExp = /^[\\u0021-\\u003A\\u003C-\\u007E]*$/;\n/**\n * RegExp to match domain-value in RFC 6265 sec 4.1.1\n *\n * domain-value      = <subdomain>\n *                     ; defined in [RFC1034], Section 3.5, as\n *                     ; enhanced by [RFC1123], Section 2.1\n * <subdomain>       = <label> | <subdomain> \".\" <label>\n * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]\n *                     Labels must be 63 characters or less.\n *                     'let-dig' not 'letter' in the first char, per RFC1123\n * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>\n * <let-dig-hyp>     = <let-dig> | \"-\"\n * <let-dig>         = <letter> | <digit>\n * <letter>          = any one of the 52 alphabetic characters A through Z in\n *                     upper case and a through z in lower case\n * <digit>           = any one of the ten digits 0 through 9\n *\n * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173\n *\n * > (Note that a leading %x2E (\".\"), if present, is ignored even though that\n * character is not permitted, but a trailing %x2E (\".\"), if present, will\n * cause the user agent to ignore the attribute.)\n */\nconst domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;\n/**\n * RegExp to match path-value in RFC 6265 sec 4.1.1\n *\n * path-value        = <any CHAR except CTLs or \";\">\n * CHAR              = %x01-7F\n *                     ; defined in RFC 5234 appendix B.1\n */\nconst pathValueRegExp = /^[\\u0020-\\u003A\\u003D-\\u007E]*$/;\n/**\n * RegExp to match max-age-value in RFC 6265 sec 5.6.2\n */\nconst maxAgeRegExp = /^-?\\d+$/;\nconst __toString = Object.prototype.toString;\nconst NullObject = /* @__PURE__ */ (() => {\n    const C = function () { };\n    C.prototype = Object.create(null);\n    return C;\n})();\n/**\n * Parse a `Cookie` header.\n *\n * Parse the given cookie header string into an object\n * The object has the various cookies as keys(names) => values\n */\nfunction parseCookie(str, options) {\n    const obj = new NullObject();\n    const len = str.length;\n    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.\n    if (len < 2)\n        return obj;\n    const dec = options?.decode || decode;\n    let index = 0;\n    do {\n        const eqIdx = eqIndex(str, index, len);\n        if (eqIdx === -1)\n            break; // No more cookie pairs.\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx > endIdx) {\n            // backtrack on prior semicolon\n            index = str.lastIndexOf(\";\", eqIdx - 1) + 1;\n            continue;\n        }\n        const key = valueSlice(str, index, eqIdx);\n        // only assign once\n        if (obj[key] === undefined) {\n            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));\n        }\n        index = endIdx + 1;\n    } while (index < len);\n    return obj;\n}\n/**\n * Stringifies an object into an HTTP `Cookie` header.\n */\nfunction stringifyCookie(cookie, options) {\n    const enc = options?.encode || encodeURIComponent;\n    const cookieStrings = [];\n    for (const name of Object.keys(cookie)) {\n        const val = cookie[name];\n        if (val === undefined)\n            continue;\n        if (!cookieNameRegExp.test(name)) {\n            throw new TypeError(`cookie name is invalid: ${name}`);\n        }\n        const value = enc(val);\n        if (!cookieValueRegExp.test(value)) {\n            throw new TypeError(`cookie val is invalid: ${val}`);\n        }\n        cookieStrings.push(`${name}=${value}`);\n    }\n    return cookieStrings.join(\"; \");\n}\nfunction stringifySetCookie(_name, _val, _opts) {\n    const cookie = typeof _name === \"object\"\n        ? _name\n        : { ..._opts, name: _name, value: String(_val) };\n    const options = typeof _val === \"object\" ? _val : _opts;\n    const enc = options?.encode || encodeURIComponent;\n    if (!cookieNameRegExp.test(cookie.name)) {\n        throw new TypeError(`argument name is invalid: ${cookie.name}`);\n    }\n    const value = cookie.value ? enc(cookie.value) : \"\";\n    if (!cookieValueRegExp.test(value)) {\n        throw new TypeError(`argument val is invalid: ${cookie.value}`);\n    }\n    let str = cookie.name + \"=\" + value;\n    if (cookie.maxAge !== undefined) {\n        if (!Number.isInteger(cookie.maxAge)) {\n            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);\n        }\n        str += \"; Max-Age=\" + cookie.maxAge;\n    }\n    if (cookie.domain) {\n        if (!domainValueRegExp.test(cookie.domain)) {\n            throw new TypeError(`option domain is invalid: ${cookie.domain}`);\n        }\n        str += \"; Domain=\" + cookie.domain;\n    }\n    if (cookie.path) {\n        if (!pathValueRegExp.test(cookie.path)) {\n            throw new TypeError(`option path is invalid: ${cookie.path}`);\n        }\n        str += \"; Path=\" + cookie.path;\n    }\n    if (cookie.expires) {\n        if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) {\n            throw new TypeError(`option expires is invalid: ${cookie.expires}`);\n        }\n        str += \"; Expires=\" + cookie.expires.toUTCString();\n    }\n    if (cookie.httpOnly) {\n        str += \"; HttpOnly\";\n    }\n    if (cookie.secure) {\n        str += \"; Secure\";\n    }\n    if (cookie.partitioned) {\n        str += \"; Partitioned\";\n    }\n    if (cookie.priority) {\n        const priority = typeof cookie.priority === \"string\"\n            ? cookie.priority.toLowerCase()\n            : undefined;\n        switch (priority) {\n            case \"low\":\n                str += \"; Priority=Low\";\n                break;\n            case \"medium\":\n                str += \"; Priority=Medium\";\n                break;\n            case \"high\":\n                str += \"; Priority=High\";\n                break;\n            default:\n                throw new TypeError(`option priority is invalid: ${cookie.priority}`);\n        }\n    }\n    if (cookie.sameSite) {\n        const sameSite = typeof cookie.sameSite === \"string\"\n            ? cookie.sameSite.toLowerCase()\n            : cookie.sameSite;\n        switch (sameSite) {\n            case true:\n            case \"strict\":\n                str += \"; SameSite=Strict\";\n                break;\n            case \"lax\":\n                str += \"; SameSite=Lax\";\n                break;\n            case \"none\":\n                str += \"; SameSite=None\";\n                break;\n            default:\n                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);\n        }\n    }\n    return str;\n}\n/**\n * Deserialize a `Set-Cookie` header into an object.\n *\n * deserialize('foo=bar; httpOnly')\n *   => { name: 'foo', value: 'bar', httpOnly: true }\n */\nfunction parseSetCookie(str, options) {\n    const dec = options?.decode || decode;\n    const len = str.length;\n    const endIdx = endIndex(str, 0, len);\n    const eqIdx = eqIndex(str, 0, endIdx);\n    const setCookie = eqIdx === -1\n        ? { name: \"\", value: dec(valueSlice(str, 0, endIdx)) }\n        : {\n            name: valueSlice(str, 0, eqIdx),\n            value: dec(valueSlice(str, eqIdx + 1, endIdx)),\n        };\n    let index = endIdx + 1;\n    while (index < len) {\n        const endIdx = endIndex(str, index, len);\n        const eqIdx = eqIndex(str, index, endIdx);\n        const attr = eqIdx === -1\n            ? valueSlice(str, index, endIdx)\n            : valueSlice(str, index, eqIdx);\n        const val = eqIdx === -1 ? undefined : valueSlice(str, eqIdx + 1, endIdx);\n        switch (attr.toLowerCase()) {\n            case \"httponly\":\n                setCookie.httpOnly = true;\n                break;\n            case \"secure\":\n                setCookie.secure = true;\n                break;\n            case \"partitioned\":\n                setCookie.partitioned = true;\n                break;\n            case \"domain\":\n                setCookie.domain = val;\n                break;\n            case \"path\":\n                setCookie.path = val;\n                break;\n            case \"max-age\":\n                if (val && maxAgeRegExp.test(val))\n                    setCookie.maxAge = Number(val);\n                break;\n            case \"expires\":\n                if (!val)\n                    break;\n                const date = new Date(val);\n                if (Number.isFinite(date.valueOf()))\n                    setCookie.expires = date;\n                break;\n            case \"priority\":\n                if (!val)\n                    break;\n                const priority = val.toLowerCase();\n                if (priority === \"low\" ||\n                    priority === \"medium\" ||\n                    priority === \"high\") {\n                    setCookie.priority = priority;\n                }\n                break;\n            case \"samesite\":\n                if (!val)\n                    break;\n                const sameSite = val.toLowerCase();\n                if (sameSite === \"lax\" ||\n                    sameSite === \"strict\" ||\n                    sameSite === \"none\") {\n                    setCookie.sameSite = sameSite;\n                }\n                break;\n        }\n        index = endIdx + 1;\n    }\n    return setCookie;\n}\n/**\n * Find the `;` character between `min` and `len` in str.\n */\nfunction endIndex(str, min, len) {\n    const index = str.indexOf(\";\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Find the `=` character between `min` and `max` in str.\n */\nfunction eqIndex(str, min, max) {\n    const index = str.indexOf(\"=\", min);\n    return index < max ? index : -1;\n}\n/**\n * Slice out a value between startPod to max.\n */\nfunction valueSlice(str, min, max) {\n    let start = min;\n    let end = max;\n    do {\n        const code = str.charCodeAt(start);\n        if (code !== 0x20 /*   */ && code !== 0x09 /* \\t */)\n            break;\n    } while (++start < end);\n    while (end > start) {\n        const code = str.charCodeAt(end - 1);\n        if (code !== 0x20 /*   */ && code !== 0x09 /* \\t */)\n            break;\n        end--;\n    }\n    return str.slice(start, end);\n}\n/**\n * URL-decode string value. Optimized to skip native call when no %.\n */\nfunction decode(str) {\n    if (str.indexOf(\"%\") === -1)\n        return str;\n    try {\n        return decodeURIComponent(str);\n    }\n    catch (e) {\n        return str;\n    }\n}\n/**\n * Determine if value is a Date.\n */\nfunction isDate(val) {\n    return __toString.call(val) === \"[object Date]\";\n}\n//# sourceMappingURL=index.js.map"],"x_google_ignoreList":[1],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,iBAAiB;;;;;AAMvB,SAAS,aAAa,OAAe,OAAuB;CAC1D,MAAM,OAAO,MAAM,WAAW,KAAK;CACnC,IAAI,OAAO,MAAQ,SAAS,OAAQ,OAAO,KACzC,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE/C,OAAO,KAAK,UAAU,MAAM,MAAM;AACpC;;;;;AAMA,SAAgB,sBAAsB,MAAoB;CACxD,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,GAC9B,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,0BAC3B,aAAa,MAAM,CAAC,EAAE,YAAY,EAAE,0JAGhE;EAGJ,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,6CAEvD;CACF;AACF;;AAGA,SAAS,cAAc,MAAuB;CAC5C,OACE,SAAS,MACR,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAoB;AAE1B,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAU;CAAO;AAAM,CAAC;;;;;;;;;AAUzD,SAAgB,yBAAyB,SAKhC;CACP,IAAI,QAAQ,aAAa,KAAA,GAAW;EAClC,MAAM,QAAQ,QAAQ,SAAS,YAAY;EAC3C,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAC5B,MAAM,IAAI,MACR,0CAA0C,KAAK,UAAU,QAAQ,QAAQ,EAAE,uCAE7E;CAEJ;CACA,IAAI,QAAQ,SAAS,KAAA,KAAa,kBAAkB,KAAK,QAAQ,IAAI,GACnE,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,QAAQ,IAAI,EAAE,uEAE/D;CAEF,IAAI,QAAQ,WAAW,KAAA,KAAa,kBAAkB,KAAK,QAAQ,MAAM,GACvE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,yEAEnE;CAEF,IACE,QAAQ,WAAW,KAAA,MAClB,OAAO,QAAQ,WAAW,YAAY,CAAC,OAAO,SAAS,QAAQ,MAAM,IAEtE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,mCAEnE;AAEJ;AAEA,SAAgB,uBAAuB,MAAc,OAAqB;CACxE,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,IAAI,EAAE,iCAAiC;CAM3F,MAAM,UACJ,MAAM,UAAU,KAChB,MAAM,WAAW,CAAC,MAAM,MACxB,MAAM,WAAW,MAAM,SAAS,CAAC,MAAM;CACzC,MAAM,QAAQ,UAAU,IAAI;CAC5B,MAAM,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM;CAC/C,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,KAE3B,IAAI,CAAC,cADQ,MAAM,WAAW,CACX,CAAI,GACrB,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,IAAI,EAAE,gDACd,aAAa,OAAO,CAAC,EAAE,YAAY,EAAE,gRAKjE;AAGN;;;;CC9LA,OAAO,eAAe,SAAS,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,QAAQ,cAAc;CAGtB,QAAQ,qBAAqB;CAC7B,QAAQ,YAAY;CACpB,QAAQ,iBAAiB;CACzB,QAAQ,qBAAqB;CAC7B,QAAQ,YAAY;;;;;;;;;;;;;;;CAepB,IAAM,mBAAmB;;;;;;;;;;;;;CAazB,IAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;CAwB1B,IAAM,oBAAoB;;;;;;;;CAQ1B,IAAM,kBAAkB;;;;CAIxB,IAAM,eAAe;CACrB,IAAM,aAAa,OAAO,UAAU;CACpC,IAAM,aAA6B,uBAAO;EACtC,MAAM,IAAI,WAAY,CAAE;EACxB,EAAE,YAAY,OAAO,OAAO,IAAI;EAChC,OAAO;CACX,EAAA,CAAG;;;;;;;CAOH,SAAS,YAAY,KAAK,SAAS;EAC/B,MAAM,MAAM,IAAI,WAAW;EAC3B,MAAM,MAAM,IAAI;EAEhB,IAAI,MAAM,GACN,OAAO;EACX,MAAM,MAAM,SAAS,UAAU;EAC/B,IAAI,QAAQ;EACZ,GAAG;GACC,MAAM,QAAQ,QAAQ,KAAK,OAAO,GAAG;GACrC,IAAI,UAAU,IACV;GACJ,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;GACvC,IAAI,QAAQ,QAAQ;IAEhB,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC,IAAI;IAC1C;GACJ;GACA,MAAM,MAAM,WAAW,KAAK,OAAO,KAAK;GAExC,IAAI,IAAI,SAAS,KAAA,GACb,IAAI,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;GAErD,QAAQ,SAAS;EACrB,SAAS,QAAQ;EACjB,OAAO;CACX;CAsBA,SAAS,mBAAmB,OAAO,MAAM,OAAO;EAC5C,MAAM,SAAS,OAAO,UAAU,WAC1B,QACA;GAAE,GAAG;GAAO,MAAM;GAAO,OAAO,OAAO,IAAI;EAAE;EAEnD,MAAM,OADU,OAAO,SAAS,WAAW,OAAO,MAAA,EAC7B,UAAU;EAC/B,IAAI,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAClC,MAAM,IAAI,UAAU,6BAA6B,OAAO,MAAM;EAElE,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,KAAK,IAAI;EACjD,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC7B,MAAM,IAAI,UAAU,4BAA4B,OAAO,OAAO;EAElE,IAAI,MAAM,OAAO,OAAO,MAAM;EAC9B,IAAI,OAAO,WAAW,KAAA,GAAW;GAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,MAAM,GAC/B,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;GAEpE,OAAO,eAAe,OAAO;EACjC;EACA,IAAI,OAAO,QAAQ;GACf,IAAI,CAAC,kBAAkB,KAAK,OAAO,MAAM,GACrC,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;GAEpE,OAAO,cAAc,OAAO;EAChC;EACA,IAAI,OAAO,MAAM;GACb,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,GACjC,MAAM,IAAI,UAAU,2BAA2B,OAAO,MAAM;GAEhE,OAAO,YAAY,OAAO;EAC9B;EACA,IAAI,OAAO,SAAS;GAChB,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC,GACpE,MAAM,IAAI,UAAU,8BAA8B,OAAO,SAAS;GAEtE,OAAO,eAAe,OAAO,QAAQ,YAAY;EACrD;EACA,IAAI,OAAO,UACP,OAAO;EAEX,IAAI,OAAO,QACP,OAAO;EAEX,IAAI,OAAO,aACP,OAAO;EAEX,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,KAAA,GACN;GACI,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;EAC5E;EAEJ,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,OAAO,UACb;GACI,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;EAC5E;EAEJ,OAAO;CACX;;;;;;;CAOA,SAAS,eAAe,KAAK,SAAS;EAClC,MAAM,MAAM,SAAS,UAAU;EAC/B,MAAM,MAAM,IAAI;EAChB,MAAM,SAAS,SAAS,KAAK,GAAG,GAAG;EACnC,MAAM,QAAQ,QAAQ,KAAK,GAAG,MAAM;EACpC,MAAM,YAAY,UAAU,KACtB;GAAE,MAAM;GAAI,OAAO,IAAI,WAAW,KAAK,GAAG,MAAM,CAAC;EAAE,IACnD;GACE,MAAM,WAAW,KAAK,GAAG,KAAK;GAC9B,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;EACjD;EACJ,IAAI,QAAQ,SAAS;EACrB,OAAO,QAAQ,KAAK;GAChB,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;GACvC,MAAM,QAAQ,QAAQ,KAAK,OAAO,MAAM;GACxC,MAAM,OAAO,UAAU,KACjB,WAAW,KAAK,OAAO,MAAM,IAC7B,WAAW,KAAK,OAAO,KAAK;GAClC,MAAM,MAAM,UAAU,KAAK,KAAA,IAAY,WAAW,KAAK,QAAQ,GAAG,MAAM;GACxE,QAAQ,KAAK,YAAY,GAAzB;IACI,KAAK;KACD,UAAU,WAAW;KACrB;IACJ,KAAK;KACD,UAAU,SAAS;KACnB;IACJ,KAAK;KACD,UAAU,cAAc;KACxB;IACJ,KAAK;KACD,UAAU,SAAS;KACnB;IACJ,KAAK;KACD,UAAU,OAAO;KACjB;IACJ,KAAK;KACD,IAAI,OAAO,aAAa,KAAK,GAAG,GAC5B,UAAU,SAAS,OAAO,GAAG;KACjC;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,OAAO,IAAI,KAAK,GAAG;KACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,GAC9B,UAAU,UAAU;KACxB;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,WAAW,IAAI,YAAY;KACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;KAEzB;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,WAAW,IAAI,YAAY;KACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;KAEzB;GACR;GACA,QAAQ,SAAS;EACrB;EACA,OAAO;CACX;;;;CAIA,SAAS,SAAS,KAAK,KAAK,KAAK;EAC7B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;EAClC,OAAO,UAAU,KAAK,MAAM;CAChC;;;;CAIA,SAAS,QAAQ,KAAK,KAAK,KAAK;EAC5B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;EAClC,OAAO,QAAQ,MAAM,QAAQ;CACjC;;;;CAIA,SAAS,WAAW,KAAK,KAAK,KAAK;EAC/B,IAAI,QAAQ;EACZ,IAAI,MAAM;EACV,GAAG;GACC,MAAM,OAAO,IAAI,WAAW,KAAK;GACjC,IAAI,SAAS,MAAgB,SAAS,GAClC;EACR,SAAS,EAAE,QAAQ;EACnB,OAAO,MAAM,OAAO;GAChB,MAAM,OAAO,IAAI,WAAW,MAAM,CAAC;GACnC,IAAI,SAAS,MAAgB,SAAS,GAClC;GACJ;EACJ;EACA,OAAO,IAAI,MAAM,OAAO,GAAG;CAC/B;;;;CAIA,SAAS,OAAO,KAAK;EACjB,IAAI,IAAI,QAAQ,GAAG,MAAM,IACrB,OAAO;EACX,IAAI;GACA,OAAO,mBAAmB,GAAG;EACjC,SACO,GAAG;GACN,OAAO;EACX;CACJ;;;;CAIA,SAAS,OAAO,KAAK;EACjB,OAAO,WAAW,KAAK,GAAG,MAAM;CACpC"}

package/dist/_chunks/fast-hash-D6hIVt1Y.js

@@ -0,0 +1,36 @@
+//#region src/cache/fast-hash.ts
+/**
+* Fast non-cryptographic hash for cache keys.
+*
+* FNV-1a 64-bit produces a well-distributed hash with a collision
+* probability of ~1 in 5 billion at 77k keys (birthday paradox).
+* Not suitable for security, but ideal for cache key generation
+* where we need speed over crypto strength.
+*
+* Uses BigInt for 64-bit arithmetic — supported in all modern runtimes
+* including Cloudflare Workers. No node:crypto dependency.
+*
+* See TIM-370.
+*/
+var FNV_OFFSET_BASIS = 14695981039346656037n;
+var FNV_PRIME = 1099511628211n;
+var MASK_64 = 18446744073709551615n;
+/**
+* Compute a 64-bit FNV-1a hash of a string, returned as a 16-char hex string.
+*
+* 64 bits gives ~5 billion keys before a 50% collision probability
+* (birthday paradox), making accidental collisions effectively impossible
+* for cache key use cases.
+*/
+function fnv1aHash(input) {
+	let hash = FNV_OFFSET_BASIS;
+	for (let i = 0; i < input.length; i++) {
+		hash ^= BigInt(input.charCodeAt(i));
+		hash = hash * FNV_PRIME & MASK_64;
+	}
+	return hash.toString(16).padStart(16, "0");
+}
+//#endregion
+export { fnv1aHash as t };
+
+//# sourceMappingURL=fast-hash-D6hIVt1Y.js.map

package/dist/_chunks/fast-hash-D6hIVt1Y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fast-hash-D6hIVt1Y.js","names":[],"sources":["../../src/cache/fast-hash.ts"],"sourcesContent":["/**\n * Fast non-cryptographic hash for cache keys.\n *\n * FNV-1a 64-bit produces a well-distributed hash with a collision\n * probability of ~1 in 5 billion at 77k keys (birthday paradox).\n * Not suitable for security, but ideal for cache key generation\n * where we need speed over crypto strength.\n *\n * Uses BigInt for 64-bit arithmetic — supported in all modern runtimes\n * including Cloudflare Workers. No node:crypto dependency.\n *\n * See TIM-370.\n */\n\n// FNV-1a constants for 64-bit hash\nconst FNV_OFFSET_BASIS = 0xcbf29ce484222325n;\nconst FNV_PRIME = 0x100000001b3n;\nconst MASK_64 = 0xffffffffffffffffn;\n\n/**\n * Compute a 64-bit FNV-1a hash of a string, returned as a 16-char hex string.\n *\n * 64 bits gives ~5 billion keys before a 50% collision probability\n * (birthday paradox), making accidental collisions effectively impossible\n * for cache key use cases.\n */\nexport function fnv1aHash(input: string): string {\n  let hash = FNV_OFFSET_BASIS;\n  for (let i = 0; i < input.length; i++) {\n    hash ^= BigInt(input.charCodeAt(i));\n    hash = (hash * FNV_PRIME) & MASK_64;\n  }\n  return hash.toString(16).padStart(16, '0');\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,IAAM,mBAAmB;AACzB,IAAM,YAAY;AAClB,IAAM,UAAU;;;;;;;;AAShB,SAAgB,UAAU,OAAuB;CAC/C,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,QAAQ,OAAO,MAAM,WAAW,CAAC,CAAC;EAClC,OAAQ,OAAO,YAAa;CAC9B;CACA,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG;AAC3C"}

package/dist/_chunks/format-CfwjgPz9.js

@@ -0,0 +1,14 @@
+//#region src/utils/format.ts
+/**
+* Shared formatting utilities.
+*/
+/** Format a byte count as a human-readable string (e.g. "1.50 kB"). */
+function formatSize(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(2)} kB`;
+	return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
+}
+//#endregion
+export { formatSize as t };
+
+//# sourceMappingURL=format-CfwjgPz9.js.map

package/dist/_chunks/format-CfwjgPz9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-CfwjgPz9.js","names":[],"sources":["../../src/utils/format.ts"],"sourcesContent":["/**\n * Shared formatting utilities.\n */\n\n/** Format a byte count as a human-readable string (e.g. \"1.50 kB\"). */\nexport function formatSize(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(2)} kB`;\n  return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;\n}\n"],"mappings":";;;;;AAKA,SAAgB,WAAW,OAAuB;CAChD,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AAC/C"}