@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.186

package/dist/_chunks/rsc-cache-key-DD0fl_-s.js

@@ -0,0 +1,243 @@
+//#region src/shared/rsc-cache-key.ts
+/**
+* The `_rsc` payload cache key — derived identically on both sides.
+*
+* The client puts this in the payload URL so the document and its Flight
+* payload occupy different cache keys (TIM-1268). The server recomputes it
+* from the received headers so a request cannot claim one client's key while
+* sending another client's headers — see `server/rsc-cache-key-guard.ts`.
+* Both sides must agree exactly, which is why the derivation lives here and
+* not in either one.
+*
+* Isomorphic: no server or client imports. The browser bundle audit
+* (`tests/client-bundle-audit.test.ts`) enforces the client half of that.
+*
+* See design/19-client-navigation.md §"The `_rsc` cache key".
+*/
+/**
+* Digest length in hex characters. 128 bits: the origin guard compares a
+* caller-supplied key against a recomputed one, so the relevant bound is a
+* birthday attack (an attacker who can influence a victim's `X-Timber-URL`
+* gets to search both sides), not second preimage. 64 bits would fall to
+* ~2^32 work; 128 puts it at 2^64.
+*/
+var KEY_HEX_LENGTH = 32;
+/**
+* Marks a value as a framework-issued key, and versions the derivation.
+*
+* Without it, an application value that happened to be 32 lowercase hex — an
+* MD5, a token — is indistinguishable from a forged claim: both are "the
+* right shape, the wrong digest", and no information in the value separates
+* them. So the exemption cannot key on shape alone.
+*
+* The prefix resolves that because it is anchored to the address the
+* victim's own client uses. A payload lives at `?_rsc=1.<digest>`, so
+* anything aimed at that cache entry must carry the prefix and therefore
+* gets validated; anything without it cannot be addressing a payload URL at
+* all, and is exempt as application data. An attacker cannot both hit the
+* victim's cache key and dodge the check.
+*
+* The version component also gives the derivation a migration path: the
+* client and the origin must agree byte for byte, so a future change to the
+* canonical form can be rolled out by bumping this instead of a flag day.
+*/
+var KEY_PREFIX = "1.";
+/**
+* The request headers that vary an RSC payload response, in canonical
+* casing — this list is also emitted verbatim as the response's `Vary`
+* tokens (`server/pipeline.ts`), since "what varies the response" is one
+* question with one answer, not two lists that happen to agree.
+*
+* This list is the contract, and it is enforced rather than trusted:
+* `tests/rsc-cache-key.test.ts` asserts that the header names
+* `buildRscHeaders()` can emit are exactly this set. A header added to the
+* request without being added here fails that test, because a varying input
+* outside the key is precisely the cache-poisoning hazard the key exists to
+* close.
+*
+* **No credentials, session identifiers, or user-supplied content may be
+* added.** Every value here is hashed into a URL, and URLs are logged by
+* proxies, CDNs, and origin access logs. `fnv1aHash` is a cache-key hash,
+* not a KDF — a low-entropy secret would be recoverable by brute force.
+* Authentication travels on cookies, which never enter the key.
+*/
+var RSC_KEY_HEADERS = [
+	"Accept",
+	"X-Timber-State-Tree",
+	"X-Timber-URL",
+	"X-Timber-Deployment-Id"
+];
+/**
+* Whether a value could be a key this module produced.
+*
+* `_rsc` is not a reserved parameter name — an application may already use
+* it for its own search state, including for a value that happens to look
+* like a digest. Anything without the `KEY_PREFIX` is therefore application
+* data, not a claim on a payload cache key, and the origin guard leaves it
+* alone rather than penalizing the response.
+*
+* Derived from `KEY_PREFIX` and `KEY_HEX_LENGTH` rather than spelled again,
+* so the shape cannot drift from the digest that has to satisfy it.
+*
+* Ignoring a malformed value costs no protection: clients only ever send
+* well-formed keys, so a URL bearing a malformed one is an address no
+* legitimate request will ever ask for, and nothing can be poisoned at an
+* address nobody reads.
+*/
+function isRscCacheKeyShape(value) {
+	if (!value.startsWith(KEY_PREFIX)) return false;
+	const digest = value.slice(2);
+	return digest.length === KEY_HEX_LENGTH && /^[0-9a-f]+$/.test(digest);
+}
+/**
+* The query parameter carrying the payload cache key.
+*
+* Spelled here rather than at each of the four places that read or write it
+* — the client that appends it, the origin guard that validates it, and the
+* strip below — because it is a wire contract between two independent
+* implementations, exactly like the digest itself.
+*/
+var RSC_KEY_PARAM = "_rsc";
+/**
+* Decode one raw `name` or `value` the way `URLSearchParams` does:
+* `application/x-www-form-urlencoded`, so `+` is a space.
+*
+* Malformed percent-escapes throw in `decodeURIComponent`. `URLSearchParams`
+* leaves those bytes as-is rather than throwing, and so do we — a pair we
+* cannot decode is by definition not the framework's, so it is kept.
+*/
+function formDecode(raw) {
+	try {
+		return decodeURIComponent(raw.replace(/\+/g, " "));
+	} catch {
+		return raw;
+	}
+}
+/**
+* Remove framework-issued `_rsc` values from a raw query string.
+*
+* Only values matching `isRscCacheKeyShape` are removed. `_rsc` is not a
+* reserved name (see that function), so `/search?_rsc=foo` is application
+* state and survives — the same exemption the origin guard applies, derived
+* from the same predicate so the two cannot disagree about what "ours"
+* means.
+*
+* Operates on the raw string rather than round-tripping through
+* `URLSearchParams`, so every surviving pair keeps its original bytes.
+* Re-serializing would rewrite `?b` as `?b=` and `?a=%7E` as `?a=~` on RSC
+* navigations only, which is the same class of inconsistency this function
+* exists to remove.
+*
+* Matching decodes the name, because `?%5Frsc=<key>` is a `_rsc` parameter
+* as far as `URLSearchParams` is concerned — the same reasoning as the
+* guard's fast path.
+*
+* @param search - `url.search`, with or without the leading `?`.
+* @returns The query string including a leading `?`, or `''` if empty.
+*/
+function stripRscCacheKey(search) {
+	const query = search.startsWith("?") ? search.slice(1) : search;
+	if (query === "") return "";
+	const result = query.split("&").filter((pair) => {
+		const eq = pair.indexOf("=");
+		if (formDecode(eq === -1 ? pair : pair.slice(0, eq)) !== "_rsc") return true;
+		return !isRscCacheKeyShape(eq === -1 ? "" : formDecode(pair.slice(eq + 1)));
+	}).join("&");
+	return result === "" ? "" : `?${result}`;
+}
+/**
+* The search state application code sees, for any request URL.
+*
+* The `_rsc` key rides on the payload URL of every RSC navigation and on no
+* other request, so reading search params straight off `req.url` makes the
+* same page observe different search state depending on whether it was
+* reached by a full load or a client navigation — and lets the cache key
+* leak into whatever the page builds from it: a canonical URL, a pagination
+* link, an analytics payload (TIM-1272).
+*
+* Every application-facing derivation of search state goes through here.
+* `params` and `search` are returned together, from one strip, because they
+* are two views of one answer and were previously two expressions that had
+* to agree.
+*
+* The raw request URL is deliberately untouched: `server/rsc-cache-key-guard.ts`
+* still reads the parameter from `req.url` to bind the key to the request.
+*/
+function appVisibleSearch(url) {
+	const search = stripRscCacheKey(url.search);
+	return {
+		params: new URLSearchParams(search),
+		search
+	};
+}
+/**
+* Compute the `_rsc` cache key for a request.
+*
+* Absent headers are omitted rather than sent as empty, so "header missing"
+* and "header present but empty" produce different keys.
+*
+* Values are length-prefixed rather than delimiter-separated. Any delimiter
+* can be forged by a value that contains it: with a `\0` separator, an
+* `accept` of `a\nx-timber-url\0b` serializes identically to an `accept` of
+* `a` alongside an `x-timber-url` of `b`, which would let one header claim
+* another's key. HTTP forbids control characters in header values and both
+* `fetch()` and the server runtime reject them, so this is defense in depth
+* — but a length prefix is unambiguous for *any* content, which is a
+* property worth having in a function whose whole job is to be agreed on by
+* two independent implementations.
+*
+* SHA-256, truncated to 128 bits. A fast non-cryptographic hash is the
+* obvious choice for a cache key and is the wrong one here: the origin
+* *compares* this value against a recomputed one, which makes it a check.
+* FNV-1a — used for timber's other cache keys — is a multiply-xor over a
+* fixed field, so an attacker controlling a few bytes of any input (their
+* own `X-Timber-URL`, say) can solve for a chosen digest rather than search
+* for one, and forge a key belonging to somebody else.
+*
+* Returns `null` when no digest is available — `crypto.subtle` is absent in
+* non-secure browsing contexts (plain `http://` on a LAN address). Callers
+* must treat that as "no key", never as "key matches": the client omits the
+* parameter and the server refuses to share-cache. That returns those
+* clients to the pre-TIM-1268 posture, where `Vary` alone separates HTML
+* from Flight — acceptable, because a non-secure origin has no shared-CDN
+* caching story to protect in the first place.
+*/
+async function rscCacheKey(lookup) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return null;
+	let canonical = "";
+	for (const name of RSC_KEY_HEADERS) {
+		const value = lookup(name);
+		if (value == null) continue;
+		canonical += `${name.toLowerCase()}:${value.length}:${value}`;
+	}
+	const digest = await subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+	let hex = "";
+	for (const byte of new Uint8Array(digest, 0, KEY_HEX_LENGTH / 2)) hex += byte.toString(16).padStart(2, "0");
+	return KEY_PREFIX + hex;
+}
+/**
+* An unverifiable stand-in key, for the one case where the digest cannot be
+* computed: `crypto.subtle` is absent in non-secure browsing contexts.
+* `crypto.getRandomValues` is not gated that way, so it is available exactly
+* where the digest is not.
+*
+* Carries `KEY_PREFIX` like any other key, so the origin reads it as a claim
+* it cannot verify — and refuses to share-cache the response — rather than
+* exempting it as application data. Lives here so the prefix has one home.
+*/
+function randomRscCacheKey() {
+	const bytes = new Uint8Array(KEY_HEX_LENGTH / 2);
+	globalThis.crypto.getRandomValues(bytes);
+	return KEY_PREFIX + [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Build a case-insensitive lookup over a plain header record. */
+function recordLookup(headers) {
+	const lowered = {};
+	for (const name of Object.keys(headers)) lowered[name.toLowerCase()] = headers[name];
+	return (name) => lowered[name.toLowerCase()];
+}
+//#endregion
+export { randomRscCacheKey as a, isRscCacheKeyShape as i, RSC_KEY_PARAM as n, recordLookup as o, appVisibleSearch as r, rscCacheKey as s, RSC_KEY_HEADERS as t };
+
+//# sourceMappingURL=rsc-cache-key-DD0fl_-s.js.map

package/dist/_chunks/rsc-cache-key-DD0fl_-s.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-cache-key-DD0fl_-s.js","names":[],"sources":["../../src/shared/rsc-cache-key.ts"],"sourcesContent":["/**\n * The `_rsc` payload cache key — derived identically on both sides.\n *\n * The client puts this in the payload URL so the document and its Flight\n * payload occupy different cache keys (TIM-1268). The server recomputes it\n * from the received headers so a request cannot claim one client's key while\n * sending another client's headers — see `server/rsc-cache-key-guard.ts`.\n * Both sides must agree exactly, which is why the derivation lives here and\n * not in either one.\n *\n * Isomorphic: no server or client imports. The browser bundle audit\n * (`tests/client-bundle-audit.test.ts`) enforces the client half of that.\n *\n * See design/19-client-navigation.md §\"The `_rsc` cache key\".\n */\n\n/**\n * Digest length in hex characters. 128 bits: the origin guard compares a\n * caller-supplied key against a recomputed one, so the relevant bound is a\n * birthday attack (an attacker who can influence a victim's `X-Timber-URL`\n * gets to search both sides), not second preimage. 64 bits would fall to\n * ~2^32 work; 128 puts it at 2^64.\n */\nconst KEY_HEX_LENGTH = 32;\n\n/**\n * Marks a value as a framework-issued key, and versions the derivation.\n *\n * Without it, an application value that happened to be 32 lowercase hex — an\n * MD5, a token — is indistinguishable from a forged claim: both are \"the\n * right shape, the wrong digest\", and no information in the value separates\n * them. So the exemption cannot key on shape alone.\n *\n * The prefix resolves that because it is anchored to the address the\n * victim's own client uses. A payload lives at `?_rsc=1.<digest>`, so\n * anything aimed at that cache entry must carry the prefix and therefore\n * gets validated; anything without it cannot be addressing a payload URL at\n * all, and is exempt as application data. An attacker cannot both hit the\n * victim's cache key and dodge the check.\n *\n * The version component also gives the derivation a migration path: the\n * client and the origin must agree byte for byte, so a future change to the\n * canonical form can be rolled out by bumping this instead of a flag day.\n */\nconst KEY_PREFIX = '1.';\n\n/**\n * The request headers that vary an RSC payload response, in canonical\n * casing — this list is also emitted verbatim as the response's `Vary`\n * tokens (`server/pipeline.ts`), since \"what varies the response\" is one\n * question with one answer, not two lists that happen to agree.\n *\n * This list is the contract, and it is enforced rather than trusted:\n * `tests/rsc-cache-key.test.ts` asserts that the header names\n * `buildRscHeaders()` can emit are exactly this set. A header added to the\n * request without being added here fails that test, because a varying input\n * outside the key is precisely the cache-poisoning hazard the key exists to\n * close.\n *\n * **No credentials, session identifiers, or user-supplied content may be\n * added.** Every value here is hashed into a URL, and URLs are logged by\n * proxies, CDNs, and origin access logs. `fnv1aHash` is a cache-key hash,\n * not a KDF — a low-entropy secret would be recoverable by brute force.\n * Authentication travels on cookies, which never enter the key.\n */\nexport const RSC_KEY_HEADERS = [\n  'Accept',\n  'X-Timber-State-Tree',\n  'X-Timber-URL',\n  'X-Timber-Deployment-Id',\n] as const;\n\n/**\n * Whether a value could be a key this module produced.\n *\n * `_rsc` is not a reserved parameter name — an application may already use\n * it for its own search state, including for a value that happens to look\n * like a digest. Anything without the `KEY_PREFIX` is therefore application\n * data, not a claim on a payload cache key, and the origin guard leaves it\n * alone rather than penalizing the response.\n *\n * Derived from `KEY_PREFIX` and `KEY_HEX_LENGTH` rather than spelled again,\n * so the shape cannot drift from the digest that has to satisfy it.\n *\n * Ignoring a malformed value costs no protection: clients only ever send\n * well-formed keys, so a URL bearing a malformed one is an address no\n * legitimate request will ever ask for, and nothing can be poisoned at an\n * address nobody reads.\n */\nexport function isRscCacheKeyShape(value: string): boolean {\n  if (!value.startsWith(KEY_PREFIX)) return false;\n  const digest = value.slice(KEY_PREFIX.length);\n  return digest.length === KEY_HEX_LENGTH && /^[0-9a-f]+$/.test(digest);\n}\n\n/**\n * The query parameter carrying the payload cache key.\n *\n * Spelled here rather than at each of the four places that read or write it\n * — the client that appends it, the origin guard that validates it, and the\n * strip below — because it is a wire contract between two independent\n * implementations, exactly like the digest itself.\n */\nexport const RSC_KEY_PARAM = '_rsc';\n\n// ─── Keeping the key out of application state ────────────────────────────\n\n/**\n * Decode one raw `name` or `value` the way `URLSearchParams` does:\n * `application/x-www-form-urlencoded`, so `+` is a space.\n *\n * Malformed percent-escapes throw in `decodeURIComponent`. `URLSearchParams`\n * leaves those bytes as-is rather than throwing, and so do we — a pair we\n * cannot decode is by definition not the framework's, so it is kept.\n */\nfunction formDecode(raw: string): string {\n  try {\n    return decodeURIComponent(raw.replace(/\\+/g, ' '));\n  } catch {\n    return raw;\n  }\n}\n\n/**\n * Remove framework-issued `_rsc` values from a raw query string.\n *\n * Only values matching `isRscCacheKeyShape` are removed. `_rsc` is not a\n * reserved name (see that function), so `/search?_rsc=foo` is application\n * state and survives — the same exemption the origin guard applies, derived\n * from the same predicate so the two cannot disagree about what \"ours\"\n * means.\n *\n * Operates on the raw string rather than round-tripping through\n * `URLSearchParams`, so every surviving pair keeps its original bytes.\n * Re-serializing would rewrite `?b` as `?b=` and `?a=%7E` as `?a=~` on RSC\n * navigations only, which is the same class of inconsistency this function\n * exists to remove.\n *\n * Matching decodes the name, because `?%5Frsc=<key>` is a `_rsc` parameter\n * as far as `URLSearchParams` is concerned — the same reasoning as the\n * guard's fast path.\n *\n * @param search - `url.search`, with or without the leading `?`.\n * @returns The query string including a leading `?`, or `''` if empty.\n */\nexport function stripRscCacheKey(search: string): string {\n  const query = search.startsWith('?') ? search.slice(1) : search;\n  if (query === '') return '';\n  const kept = query.split('&').filter((pair) => {\n    const eq = pair.indexOf('=');\n    if (formDecode(eq === -1 ? pair : pair.slice(0, eq)) !== RSC_KEY_PARAM) return true;\n    return !isRscCacheKeyShape(eq === -1 ? '' : formDecode(pair.slice(eq + 1)));\n  });\n  const result = kept.join('&');\n  return result === '' ? '' : `?${result}`;\n}\n\n/** A request's search state as application code should see it. */\nexport interface AppVisibleSearch {\n  /** Parsed params, with the framework's cache key removed. */\n  params: URLSearchParams;\n  /** The matching raw query string — `''` or `?…`. */\n  search: string;\n}\n\n/**\n * The search state application code sees, for any request URL.\n *\n * The `_rsc` key rides on the payload URL of every RSC navigation and on no\n * other request, so reading search params straight off `req.url` makes the\n * same page observe different search state depending on whether it was\n * reached by a full load or a client navigation — and lets the cache key\n * leak into whatever the page builds from it: a canonical URL, a pagination\n * link, an analytics payload (TIM-1272).\n *\n * Every application-facing derivation of search state goes through here.\n * `params` and `search` are returned together, from one strip, because they\n * are two views of one answer and were previously two expressions that had\n * to agree.\n *\n * The raw request URL is deliberately untouched: `server/rsc-cache-key-guard.ts`\n * still reads the parameter from `req.url` to bind the key to the request.\n */\nexport function appVisibleSearch(url: URL): AppVisibleSearch {\n  const search = stripRscCacheKey(url.search);\n  return { params: new URLSearchParams(search), search };\n}\n\n/**\n * Reads a header value by name. Must be case-insensitive — `Headers.get()`\n * already is, and `recordLookup` below makes a plain record so.\n */\nexport type HeaderLookup = (name: string) => string | null | undefined;\n\n/**\n * Compute the `_rsc` cache key for a request.\n *\n * Absent headers are omitted rather than sent as empty, so \"header missing\"\n * and \"header present but empty\" produce different keys.\n *\n * Values are length-prefixed rather than delimiter-separated. Any delimiter\n * can be forged by a value that contains it: with a `\\0` separator, an\n * `accept` of `a\\nx-timber-url\\0b` serializes identically to an `accept` of\n * `a` alongside an `x-timber-url` of `b`, which would let one header claim\n * another's key. HTTP forbids control characters in header values and both\n * `fetch()` and the server runtime reject them, so this is defense in depth\n * — but a length prefix is unambiguous for *any* content, which is a\n * property worth having in a function whose whole job is to be agreed on by\n * two independent implementations.\n *\n * SHA-256, truncated to 128 bits. A fast non-cryptographic hash is the\n * obvious choice for a cache key and is the wrong one here: the origin\n * *compares* this value against a recomputed one, which makes it a check.\n * FNV-1a — used for timber's other cache keys — is a multiply-xor over a\n * fixed field, so an attacker controlling a few bytes of any input (their\n * own `X-Timber-URL`, say) can solve for a chosen digest rather than search\n * for one, and forge a key belonging to somebody else.\n *\n * Returns `null` when no digest is available — `crypto.subtle` is absent in\n * non-secure browsing contexts (plain `http://` on a LAN address). Callers\n * must treat that as \"no key\", never as \"key matches\": the client omits the\n * parameter and the server refuses to share-cache. That returns those\n * clients to the pre-TIM-1268 posture, where `Vary` alone separates HTML\n * from Flight — acceptable, because a non-secure origin has no shared-CDN\n * caching story to protect in the first place.\n */\nexport async function rscCacheKey(lookup: HeaderLookup): Promise<string | null> {\n  const subtle = globalThis.crypto?.subtle;\n  if (!subtle) return null;\n  let canonical = '';\n  for (const name of RSC_KEY_HEADERS) {\n    const value = lookup(name);\n    if (value == null) continue;\n    // Lowercased in the canonical form so the two implementations cannot\n    // disagree over the casing of the constant they share.\n    canonical += `${name.toLowerCase()}:${value.length}:${value}`;\n  }\n  const digest = await subtle.digest('SHA-256', new TextEncoder().encode(canonical));\n  let hex = '';\n  for (const byte of new Uint8Array(digest, 0, KEY_HEX_LENGTH / 2)) {\n    hex += byte.toString(16).padStart(2, '0');\n  }\n  return KEY_PREFIX + hex;\n}\n\n/**\n * An unverifiable stand-in key, for the one case where the digest cannot be\n * computed: `crypto.subtle` is absent in non-secure browsing contexts.\n * `crypto.getRandomValues` is not gated that way, so it is available exactly\n * where the digest is not.\n *\n * Carries `KEY_PREFIX` like any other key, so the origin reads it as a claim\n * it cannot verify — and refuses to share-cache the response — rather than\n * exempting it as application data. Lives here so the prefix has one home.\n */\nexport function randomRscCacheKey(): string {\n  const bytes = new Uint8Array(KEY_HEX_LENGTH / 2);\n  globalThis.crypto.getRandomValues(bytes);\n  return KEY_PREFIX + [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\n/** Build a case-insensitive lookup over a plain header record. */\nexport function recordLookup(headers: Record<string, string>): HeaderLookup {\n  const lowered: Record<string, string> = {};\n  for (const name of Object.keys(headers)) {\n    lowered[name.toLowerCase()] = headers[name];\n  }\n  return (name) => lowered[name.toLowerCase()];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;AAqBvB,IAAM,aAAa;;;;;;;;;;;;;;;;;;;;AAqBnB,IAAa,kBAAkB;CAC7B;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,mBAAmB,OAAwB;CACzD,IAAI,CAAC,MAAM,WAAW,UAAU,GAAG,OAAO;CAC1C,MAAM,SAAS,MAAM,MAAM,CAAiB;CAC5C,OAAO,OAAO,WAAW,kBAAkB,cAAc,KAAK,MAAM;AACtE;;;;;;;;;AAUA,IAAa,gBAAgB;;;;;;;;;AAY7B,SAAS,WAAW,KAAqB;CACvC,IAAI;EACF,OAAO,mBAAmB,IAAI,QAAQ,OAAO,GAAG,CAAC;CACnD,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,iBAAiB,QAAwB;CACvD,MAAM,QAAQ,OAAO,WAAW,GAAG,IAAI,OAAO,MAAM,CAAC,IAAI;CACzD,IAAI,UAAU,IAAI,OAAO;CAMzB,MAAM,SALO,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,SAAS;EAC7C,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,WAAW,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC,MAAA,QAAqB,OAAO;EAC/E,OAAO,CAAC,mBAAmB,OAAO,KAAK,KAAK,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC;CAC5E,CACe,CAAA,CAAK,KAAK,GAAG;CAC5B,OAAO,WAAW,KAAK,KAAK,IAAI;AAClC;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,iBAAiB,KAA4B;CAC3D,MAAM,SAAS,iBAAiB,IAAI,MAAM;CAC1C,OAAO;EAAE,QAAQ,IAAI,gBAAgB,MAAM;EAAG;CAAO;AACvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,YAAY,QAA8C;CAC9E,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,YAAY;CAChB,KAAK,MAAM,QAAQ,iBAAiB;EAClC,MAAM,QAAQ,OAAO,IAAI;EACzB,IAAI,SAAS,MAAM;EAGnB,aAAa,GAAG,KAAK,YAAY,EAAE,GAAG,MAAM,OAAO,GAAG;CACxD;CACA,MAAM,SAAS,MAAM,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC;CACjF,IAAI,MAAM;CACV,KAAK,MAAM,QAAQ,IAAI,WAAW,QAAQ,GAAG,iBAAiB,CAAC,GAC7D,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE1C,OAAO,aAAa;AACtB;;;;;;;;;;;AAYA,SAAgB,oBAA4B;CAC1C,MAAM,QAAQ,IAAI,WAAW,iBAAiB,CAAC;CAC/C,WAAW,OAAO,gBAAgB,KAAK;CACvC,OAAO,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AACpF;;AAGA,SAAgB,aAAa,SAA+C;CAC1E,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAO,KAAK,OAAO,GACpC,QAAQ,KAAK,YAAY,KAAK,QAAQ;CAExC,QAAQ,SAAS,QAAQ,KAAK,YAAY;AAC5C"}

package/dist/_chunks/rsc-error-envelope-tT5PJs4q.js

@@ -0,0 +1,40 @@
+//#region src/shared/rsc-error-envelope.ts
+/**
+* The hard-navigate error envelope shared by the server and the client router.
+*
+* A client-navigation (RSC) request cannot carry an error *page* — the response
+* body must be Flight data or the decoder crashes. Instead the server answers
+* with this envelope: an `X-Timber-Error: 1` header and a minimal JSON body.
+* The client treats it as "give up on SPA navigation and hard-navigate", and
+* the resulting document request renders the real error page as HTML.
+*
+* The header name lives here so the four server producers and the single
+* client consumer cannot drift apart. See design/10-error-handling.md
+* §"Error Page Rendering for Client Navigation".
+*/
+/** Header the client checks to decide whether to hard-navigate. */
+var TIMBER_ERROR_HEADER = "X-Timber-Error";
+/**
+* Build the hard-navigate envelope for a status code.
+*
+* `responseHeaders` carries anything middleware already set (cookies, cache
+* directives); the content type and error header are overwritten because the
+* body is always this envelope. The body deliberately carries no message —
+* only the status already on the wire (design/13-security.md principle 4).
+*/
+function rscErrorEnvelope(status, responseHeaders) {
+	const headers = responseHeaders ?? new Headers();
+	headers.set(TIMBER_ERROR_HEADER, "1");
+	headers.set("content-type", "application/json; charset=utf-8");
+	return new Response(JSON.stringify({
+		error: true,
+		status
+	}), {
+		status,
+		headers
+	});
+}
+//#endregion
+export { rscErrorEnvelope as n, TIMBER_ERROR_HEADER as t };
+
+//# sourceMappingURL=rsc-error-envelope-tT5PJs4q.js.map

package/dist/_chunks/rsc-error-envelope-tT5PJs4q.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-error-envelope-tT5PJs4q.js","names":[],"sources":["../../src/shared/rsc-error-envelope.ts"],"sourcesContent":["/**\n * The hard-navigate error envelope shared by the server and the client router.\n *\n * A client-navigation (RSC) request cannot carry an error *page* — the response\n * body must be Flight data or the decoder crashes. Instead the server answers\n * with this envelope: an `X-Timber-Error: 1` header and a minimal JSON body.\n * The client treats it as \"give up on SPA navigation and hard-navigate\", and\n * the resulting document request renders the real error page as HTML.\n *\n * The header name lives here so the four server producers and the single\n * client consumer cannot drift apart. See design/10-error-handling.md\n * §\"Error Page Rendering for Client Navigation\".\n */\n\n/** Header the client checks to decide whether to hard-navigate. */\nexport const TIMBER_ERROR_HEADER = 'X-Timber-Error';\n\n/**\n * Build the hard-navigate envelope for a status code.\n *\n * `responseHeaders` carries anything middleware already set (cookies, cache\n * directives); the content type and error header are overwritten because the\n * body is always this envelope. The body deliberately carries no message —\n * only the status already on the wire (design/13-security.md principle 4).\n */\nexport function rscErrorEnvelope(status: number, responseHeaders?: Headers): Response {\n  const headers = responseHeaders ?? new Headers();\n  headers.set(TIMBER_ERROR_HEADER, '1');\n  headers.set('content-type', 'application/json; charset=utf-8');\n  return new Response(JSON.stringify({ error: true, status }), { status, headers });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,IAAa,sBAAsB;;;;;;;;;AAUnC,SAAgB,iBAAiB,QAAgB,iBAAqC;CACpF,MAAM,UAAU,mBAAmB,IAAI,QAAQ;CAC/C,QAAQ,IAAI,qBAAqB,GAAG;CACpC,QAAQ,IAAI,gBAAgB,iCAAiC;CAC7D,OAAO,IAAI,SAAS,KAAK,UAAU;EAAE,OAAO;EAAM;CAAO,CAAC,GAAG;EAAE;EAAQ;CAAQ,CAAC;AAClF"}

package/dist/_chunks/rsc-payload-path-B_LBodc2.js

@@ -0,0 +1,48 @@
+//#region src/shared/rsc-payload-path.ts
+/**
+* Where a route's Flight payload lives in `output: 'static'`.
+*
+* The static build writes these files and the client fetches them, so the two
+* halves must agree byte for byte. They used to state the naming rule
+* separately — `plugins/static-build.ts` for the write and
+* `client/rsc-fetch.ts` for the read — which is a duplicate representation with
+* nothing checking it. One function now, called by both.
+*
+* ## The shape
+*
+* The payload path mirrors the HTML path: every route gets a directory and the
+* artifact is the `index` inside it.
+*
+*   /           → /_rsc/index.rsc          (cf. index.html)
+*   /about      → /_rsc/about/index.rsc    (cf. about/index.html)
+*   /blog/hello → /_rsc/blog/hello/index.rsc
+*
+* That shape is **injective**, which the previous one (`/about` →
+* `/_rsc/about.rsc`, root → `/_rsc/index.rsc`) was not: a site with both `/`
+* and `/index` produced two payloads at `_rsc/index.rsc`, and the second write
+* won silently — a client navigation to one route was served the other route's
+* payload, same content type and same shape, undetectable downstream
+* (TIM-1266).
+*
+* Injectivity holds because two distinct non-root routes give distinct
+* directories, and the root's `/_rsc/index.rsc` has no directory component for
+* a non-root route to occupy — reaching it would need an empty route path,
+* which is not a route.
+*
+* Isomorphic: no server, client, or build-time imports.
+*/
+/**
+* The route-space path of a route's static Flight payload.
+*
+* @param routePath A route-space pathname: leading slash, no deployment base,
+*   no query or fragment, no trailing slash (except the root `/`). Callers
+*   normalize; this function does not, because the two callers normalize from
+*   different sources (a browser URL, a build-time route entry).
+*/
+function rscPayloadPath(routePath) {
+	return `/_rsc${routePath === "/" ? "" : routePath}/index.rsc`;
+}
+//#endregion
+export { rscPayloadPath as t };
+
+//# sourceMappingURL=rsc-payload-path-B_LBodc2.js.map

package/dist/_chunks/rsc-payload-path-B_LBodc2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-payload-path-B_LBodc2.js","names":[],"sources":["../../src/shared/rsc-payload-path.ts"],"sourcesContent":["/**\n * Where a route's Flight payload lives in `output: 'static'`.\n *\n * The static build writes these files and the client fetches them, so the two\n * halves must agree byte for byte. They used to state the naming rule\n * separately — `plugins/static-build.ts` for the write and\n * `client/rsc-fetch.ts` for the read — which is a duplicate representation with\n * nothing checking it. One function now, called by both.\n *\n * ## The shape\n *\n * The payload path mirrors the HTML path: every route gets a directory and the\n * artifact is the `index` inside it.\n *\n *   /           → /_rsc/index.rsc          (cf. index.html)\n *   /about      → /_rsc/about/index.rsc    (cf. about/index.html)\n *   /blog/hello → /_rsc/blog/hello/index.rsc\n *\n * That shape is **injective**, which the previous one (`/about` →\n * `/_rsc/about.rsc`, root → `/_rsc/index.rsc`) was not: a site with both `/`\n * and `/index` produced two payloads at `_rsc/index.rsc`, and the second write\n * won silently — a client navigation to one route was served the other route's\n * payload, same content type and same shape, undetectable downstream\n * (TIM-1266).\n *\n * Injectivity holds because two distinct non-root routes give distinct\n * directories, and the root's `/_rsc/index.rsc` has no directory component for\n * a non-root route to occupy — reaching it would need an empty route path,\n * which is not a route.\n *\n * Isomorphic: no server, client, or build-time imports.\n */\n\n/**\n * The route-space path of a route's static Flight payload.\n *\n * @param routePath A route-space pathname: leading slash, no deployment base,\n *   no query or fragment, no trailing slash (except the root `/`). Callers\n *   normalize; this function does not, because the two callers normalize from\n *   different sources (a browser URL, a build-time route entry).\n */\nexport function rscPayloadPath(routePath: string): string {\n  const prefix = routePath === '/' ? '' : routePath;\n  return `/_rsc${prefix}/index.rsc`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,SAAgB,eAAe,WAA2B;CAExD,OAAO,QADQ,cAAc,MAAM,KAAK,UAClB;AACxB"}

package/dist/_chunks/{segment-classify-Byy425ng.js → segment-classify-C539Pa2O.js}

@@ -146,6 +146,27 @@ function classifySegment(dirName) {
 	}
 	return { type: "static" };
 }
+function effectiveUrlSegment(node) {
+	if (node.segmentType !== "intercepting" || !node.interceptedSegmentName) return {
+		segmentName: node.segmentName,
+		segmentType: node.segmentType,
+		paramName: node.paramName,
+		paramPrefix: node.paramPrefix,
+		paramSuffix: node.paramSuffix
+	};
+	const seg = classifyUrlSegment(node.interceptedSegmentName);
+	if (seg.kind === "static") return {
+		segmentName: seg.value,
+		segmentType: "static"
+	};
+	return {
+		segmentName: node.interceptedSegmentName,
+		segmentType: seg.kind,
+		paramName: seg.name,
+		paramPrefix: seg.kind === "dynamic" ? seg.prefix : void 0,
+		paramSuffix: seg.kind === "dynamic" ? seg.suffix : void 0
+	};
+}
 /**
 * Parse an interception marker from a directory name.
 *
@@ -171,6 +192,6 @@ function parseInterceptionMarker(dirName) {
 	return null;
 }
 //#endregion
-export { INTERCEPTION_MARKERS as i, classifyUrlSegment as n, DEFAULT_PAGE_EXTENSIONS as r, classifySegment as t };
+export { INTERCEPTION_MARKERS as a, DEFAULT_PAGE_EXTENSIONS as i, classifyUrlSegment as n, effectiveUrlSegment as r, classifySegment as t };
 
-//# sourceMappingURL=segment-classify-Byy425ng.js.map
+//# sourceMappingURL=segment-classify-C539Pa2O.js.map

package/dist/_chunks/{segment-classify-Byy425ng.js.map → segment-classify-C539Pa2O.js.map}

@@ -1 +1 @@
-{"version":3,"file":"segment-classify-Byy425ng.js","names":[],"sources":["../../src/routing/types.ts","../../src/routing/segment-classify.ts"],"sourcesContent":["/**\n * Route tree types for timber.js file-system routing.\n *\n * The route tree is built by scanning the app/ directory and recognizing\n * file conventions (page.*, layout.*, middleware.ts, access.ts, route.ts, etc.).\n *\n * **Single shape, two specializations** (TIM-848):\n *\n * `SegmentNode<TFile>` is the one canonical in-memory shape for the\n * timber route tree. The same interface is used at build time (with\n * `TFile = RouteFile`) and at request time (with `TFile = ManifestFile`,\n * see `server/route-matcher.ts`). Walkers parameterized over `TFile`\n * work on either, eliminating the previous duplication between\n * `SegmentNode` (Map-based) and `ManifestSegmentNode` (object-based).\n *\n * Keyed groups (`slots`, `statusFiles`, `jsonStatusFiles`,\n * `metadataRoutes`) are plain `Record<string, …>`\n * objects rather than `Map`s so that the build-time tree can be\n * serialized into the virtual route manifest with no shape transform.\n *\n * See design/07-routing.md §\"Route Tree Shape\" and design/18-build-system.md\n * §\"Route Manifest Shape\".\n */\n\n/** Segment type classification */\nexport type SegmentType =\n  | 'static' // e.g. \"dashboard\"\n  | 'dynamic' // e.g. \"[id]\"\n  | 'catch-all' // e.g. \"[...slug]\"\n  | 'optional-catch-all' // e.g. \"[[...slug]]\"\n  | 'group' // e.g. \"(marketing)\"\n  | 'slot' // e.g. \"@sidebar\"\n  | 'intercepting' // e.g. \"(.)photo\", \"(..)photo\", \"(...)photo\"\n  | 'private'; // e.g. \"_components\", \"_lib\" — excluded from routing\n\n/**\n * Intercepting route marker — indicates how many levels up to resolve the\n * intercepted route from the intercepting route's location.\n *\n * See design/07-routing.md §\"Intercepting Routes\"\n */\nexport type InterceptionMarker = '(.)' | '(..)' | '(...)' | '(..)(..)';\n\n/** All recognized interception markers, ordered longest-first for parsing. */\nexport const INTERCEPTION_MARKERS: InterceptionMarker[] = ['(..)(..)', '(.)', '(..)', '(...)'];\n\n/**\n * A single file discovered in a route segment at build time.\n *\n * The runtime equivalent (`ManifestFile`, defined in\n * `server/route-matcher.ts`) replaces `extension` with a lazy `load`\n * function. Walkers that only need `filePath` are parameterized over\n * `TFile` and accept either.\n */\nexport interface RouteFile {\n  /** Absolute path to the file */\n  filePath: string;\n  /** File extension without leading dot (e.g. \"tsx\", \"ts\", \"mdx\") */\n  extension: string;\n}\n\n/**\n * A node in the segment tree.\n *\n * Generic over `TFile` so the same interface describes both the\n * build-time tree (`SegmentNode<RouteFile>`, the default) and the\n * runtime manifest tree (`SegmentNode<ManifestFile>`, aliased as\n * `ManifestSegmentNode`). All keyed groups use `Record` (not `Map`)\n * so the build-time tree serializes to the virtual route manifest\n * with no shape transform.\n */\nexport interface SegmentNode<TFile = RouteFile> {\n  /** The raw directory name (e.g. \"dashboard\", \"[id]\", \"(auth)\", \"@sidebar\") */\n  segmentName: string;\n  /** Classified segment type */\n  segmentType: SegmentType;\n  /** The dynamic param name, if dynamic (e.g. \"id\" for \"[id]\", \"slug\" for \"[...slug]\") */\n  paramName?: string;\n  /** Literal prefix before the dynamic bracket (e.g. \"img-\" for \"img-[id].png\") */\n  paramPrefix?: string;\n  /** Literal suffix after the dynamic bracket (e.g. \".png\" for \"img-[id].png\") */\n  paramSuffix?: string;\n  /** The URL path prefix at this segment level (e.g. \"/dashboard\") */\n  urlPath: string;\n  /** For intercepting segments: the marker used, e.g. \"(.)\". */\n  interceptionMarker?: InterceptionMarker;\n  /**\n   * For intercepting segments: the segment name after stripping the marker.\n   * E.g., for \"(.)photo\" this is \"photo\".\n   */\n  interceptedSegmentName?: string;\n\n  // --- File conventions ---\n  page?: TFile;\n  layout?: TFile;\n  middleware?: TFile;\n  access?: TFile;\n  route?: TFile;\n  /**\n   * params.ts — isomorphic convention file exporting segmentParams and/or searchParams.\n   * Discovered by the scanner like middleware.ts and access.ts.\n   * See design/07-routing.md §\"params.ts Convention File\"\n   */\n  params?: TFile;\n  error?: TFile;\n  default?: TFile;\n  /** Status-code files: 4xx.tsx, 5xx.tsx, {status}.tsx (component format) */\n  statusFiles?: Record<string, TFile>;\n  /** JSON status-code files: 4xx.json, 5xx.json, {status}.json */\n  jsonStatusFiles?: Record<string, TFile>;\n  /** denied.tsx — slot-only denial rendering */\n  denied?: TFile;\n\n  /** Metadata route files (sitemap.ts, robots.ts, icon.tsx, etc.) keyed by base name */\n  metadataRoutes?: Record<string, TFile>;\n\n  // --- Children ---\n  children: SegmentNode<TFile>[];\n  /** Parallel route slots (keyed by slot name without @) */\n  slots: Record<string, SegmentNode<TFile>>;\n}\n\n/**\n * The full route tree output from the scanner (or the root of the\n * runtime route manifest, when `TFile = ManifestFile`).\n *\n * Generic so the same wrapper carries app-root metadata for both\n * shapes. The runtime manifest extends this with `viteRoot` (see\n * `ManifestRoot` in `server/route-matcher.ts`).\n */\nexport interface RouteTree<TFile = RouteFile> {\n  /** The root segment node (representing app/) */\n  root: SegmentNode<TFile>;\n  /** All discovered proxy.ts files (should be at most one, in app/) */\n  proxy?: TFile;\n  /**\n   * Global error page: app/global-error.{tsx,ts,jsx,js}\n   *\n   * Rendered as a standalone full-page replacement (no layout wrapping)\n   * when no segment-level error file is found. SSR-only render path.\n   * Must provide its own <html> and <body>.\n   *\n   * See design/10-error-handling.md §\"Tier 2 — Global Error Page\"\n   */\n  globalError?: TFile;\n}\n\n/** Configuration passed to the scanner */\nexport interface ScannerConfig {\n  /** Recognized page/layout extensions (without dots). Default: ['tsx', 'ts', 'jsx', 'js'] */\n  pageExtensions?: string[];\n}\n\n/** Default page extensions */\nexport const DEFAULT_PAGE_EXTENSIONS = ['tsx', 'ts', 'jsx', 'js'];\n","/**\n * Shared segment classifier — both URL tokens and filesystem directory names.\n *\n * `classifyUrlSegment(token)` is a pure single-pass character parser that\n * classifies a route segment token (e.g. \"dashboard\", \"[id]\", \"[...slug]\",\n * \"[[...path]]\") into a typed discriminated union. NO regex, NO Node.js-only\n * APIs — safe to import from browser code (used by `Link` interpolation).\n *\n * `classifySegment(dirName)` is the build-time directory-name classifier\n * used by the scanner. It recognizes timber-only conventions (private\n * `_*`, parallel `@*`, route groups `(name)`, intercepting routes\n * `(.)`/`(..)`/`(...)`/`(..)(..)`) and delegates bracket syntax to\n * `classifyUrlSegment`. It is the **single source of truth** for what\n * counts as a routing segment — there is no separate copy in the\n * scanner. (TIM-848.)\n *\n * Malformed input falls through to `{ kind: 'static' }` — the safe default.\n *\n * If you change the bracket syntax, update ONLY this file. Every\n * consumer imports from here.\n *\n * See design/07-routing.md §\"Route Segments\"\n */\n\nimport type { InterceptionMarker, SegmentType } from './types.js';\nimport { INTERCEPTION_MARKERS } from './types.js';\n\nexport type UrlSegment =\n  | { kind: 'static'; value: string }\n  | { kind: 'dynamic'; name: string; prefix?: string; suffix?: string }\n  | { kind: 'catch-all'; name: string }\n  | { kind: 'optional-catch-all'; name: string };\n\n/**\n * Classify a URL path segment token.\n *\n * Walks the string left-to-right in one pass:\n *   1. Find the first '[' — characters before it are the prefix.\n *   2. Count opening brackets (1 or 2) to detect optional.\n *   3. Check for '...' to detect catch-all.\n *   4. Read the param name up to the closing bracket.\n *   5. Validate the expected closing sequence (']' or ']]').\n *   6. Characters after the close are the suffix.\n *   7. Reject affixes on catch-all/optional-catch-all.\n *   8. Reject affixes that contain '[' or ']' (no multi-param segments).\n *\n * Any structural violation → static (safe default).\n */\nexport function classifyUrlSegment(token: string): UrlSegment {\n  const len = token.length;\n  if (len === 0) return { kind: 'static', value: token };\n\n  // Find first '[' — characters before it are the prefix\n  const bracketStart = token.indexOf('[');\n  if (bracketStart === -1) return { kind: 'static', value: token };\n\n  const prefix = token.slice(0, bracketStart);\n\n  let i = bracketStart + 1;\n\n  // Check for optional: '[[...'\n  const optional = i < len && token[i] === '[';\n  if (optional) i++;\n\n  // Check for catch-all: '...'\n  const catchAll = i + 2 < len && token[i] === '.' && token[i + 1] === '.' && token[i + 2] === '.';\n  if (catchAll) i += 3;\n\n  // Read param name — everything up to ']'\n  const nameStart = i;\n  while (i < len && token[i] !== ']') i++;\n\n  // Must have found a ']' and name must be non-empty\n  if (i >= len || i === nameStart) {\n    return { kind: 'static', value: token };\n  }\n\n  const name = token.slice(nameStart, i);\n  i++; // skip first ']'\n\n  // Optional requires a second ']'\n  if (optional) {\n    if (i >= len || token[i] !== ']') {\n      return { kind: 'static', value: token };\n    }\n    i++;\n  }\n\n  const suffix = token.slice(i);\n\n  // Reject affixes containing brackets (no multi-param segments like [foo]-[bar])\n  if (suffix.includes('[') || suffix.includes(']')) {\n    return { kind: 'static', value: token };\n  }\n  if (prefix.includes(']')) {\n    return { kind: 'static', value: token };\n  }\n\n  const hasAffixes = prefix.length > 0 || suffix.length > 0;\n\n  if (optional && catchAll) {\n    // No affixes on optional catch-all\n    if (hasAffixes) return { kind: 'static', value: token };\n    return { kind: 'optional-catch-all', name };\n  }\n  if (catchAll) {\n    // No affixes on catch-all\n    if (hasAffixes) return { kind: 'static', value: token };\n    return { kind: 'catch-all', name };\n  }\n  if (optional) {\n    // '[[name]]' without '...' is malformed — not a valid segment syntax\n    return { kind: 'static', value: token };\n  }\n\n  if (hasAffixes) {\n    return {\n      kind: 'dynamic',\n      name,\n      prefix: prefix || undefined,\n      suffix: suffix || undefined,\n    };\n  }\n  return { kind: 'dynamic', name };\n}\n\n// ─── Directory-name classifier (build-time scanner) ─────────────────────────\n\n/** Result of classifying a filesystem directory name. */\nexport interface SegmentClassification {\n  type: SegmentType;\n  paramName?: string;\n  paramPrefix?: string;\n  paramSuffix?: string;\n  interceptionMarker?: InterceptionMarker;\n  interceptedSegmentName?: string;\n}\n\n/**\n * Classify a directory name into its segment type.\n *\n * Recognizes all timber file-system conventions in priority order:\n *   1. Private folders: `_name` (excluded from routing)\n *   2. Parallel route slots: `@name`\n *   3. Intercepting routes: `(.)name`, `(..)name`, `(...)name`, `(..)(..)name`\n *   4. Route groups: `(name)`\n *   5. Bracket syntax: `[id]`, `[...slug]`, `[[...path]]` (delegated to\n *      `classifyUrlSegment`)\n *   6. Static: anything else\n *\n * If you change the bracket syntax, update only `classifyUrlSegment`.\n * If you change the directory-prefix conventions, update this function.\n */\nexport function classifySegment(dirName: string): SegmentClassification {\n  // Private folder: _name (excluded from routing)\n  if (dirName.startsWith('_')) {\n    return { type: 'private' };\n  }\n\n  // Parallel route slot: @name\n  if (dirName.startsWith('@')) {\n    return { type: 'slot' };\n  }\n\n  // Intercepting routes: (.)name, (..)name, (...)name, (..)(..)name\n  // Check before route groups since intercepting markers also start with (\n  const interception = parseInterceptionMarker(dirName);\n  if (interception) {\n    return {\n      type: 'intercepting',\n      interceptionMarker: interception.marker,\n      interceptedSegmentName: interception.segmentName,\n    };\n  }\n\n  // Route group: (name)\n  if (dirName.startsWith('(') && dirName.endsWith(')')) {\n    return { type: 'group' };\n  }\n\n  // Bracket-syntax segments: [param], [...param], [[...param]]\n  const urlSeg = classifyUrlSegment(dirName);\n  if (urlSeg.kind !== 'static') {\n    const result: SegmentClassification = { type: urlSeg.kind, paramName: urlSeg.name };\n    if (urlSeg.kind === 'dynamic') {\n      if (urlSeg.prefix) result.paramPrefix = urlSeg.prefix;\n      if (urlSeg.suffix) result.paramSuffix = urlSeg.suffix;\n    }\n    return result;\n  }\n\n  return { type: 'static' };\n}\n\n/**\n * Parse an interception marker from a directory name.\n *\n * Returns the marker and the remaining segment name, or null if not an\n * intercepting route. Markers are checked longest-first to avoid `(..)`\n * matching before `(..)(..)`.\n *\n * Examples:\n *   \"(.)photo\"      → { marker: \"(.)\", segmentName: \"photo\" }\n *   \"(..)feed\"      → { marker: \"(..)\", segmentName: \"feed\" }\n *   \"(...)photos\"   → { marker: \"(...)\", segmentName: \"photos\" }\n *   \"(..)(..)admin\" → { marker: \"(..)(..)\", segmentName: \"admin\" }\n *   \"(marketing)\"   → null (route group, not interception)\n */\nfunction parseInterceptionMarker(\n  dirName: string\n): { marker: InterceptionMarker; segmentName: string } | null {\n  for (const marker of INTERCEPTION_MARKERS) {\n    if (dirName.startsWith(marker)) {\n      const rest = dirName.slice(marker.length);\n      // Must have a segment name after the marker, and the rest must not\n      // be empty or end with ) (which would be a route group like \"(auth)\")\n      if (rest.length > 0 && !rest.endsWith(')')) {\n        return { marker, segmentName: rest };\n      }\n    }\n  }\n  return null;\n}\n"],"mappings":";;AA4CA,IAAa,uBAA6C;CAAC;CAAY;CAAO;CAAQ;AAAO;;AA8G7F,IAAa,0BAA0B;CAAC;CAAO;CAAM;CAAO;AAAI;;;;;;;;;;;;;;;;;;AC1GhE,SAAgB,mBAAmB,OAA2B;CAC5D,MAAM,MAAM,MAAM;CAClB,IAAI,QAAQ,GAAG,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGrD,MAAM,eAAe,MAAM,QAAQ,GAAG;CACtC,IAAI,iBAAiB,IAAI,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAE/D,MAAM,SAAS,MAAM,MAAM,GAAG,YAAY;CAE1C,IAAI,IAAI,eAAe;CAGvB,MAAM,WAAW,IAAI,OAAO,MAAM,OAAO;CACzC,IAAI,UAAU;CAGd,MAAM,WAAW,IAAI,IAAI,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,IAAI,OAAO;CAC7F,IAAI,UAAU,KAAK;CAGnB,MAAM,YAAY;CAClB,OAAO,IAAI,OAAO,MAAM,OAAO,KAAK;CAGpC,IAAI,KAAK,OAAO,MAAM,WACpB,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,MAAM,OAAO,MAAM,MAAM,WAAW,CAAC;CACrC;CAGA,IAAI,UAAU;EACZ,IAAI,KAAK,OAAO,MAAM,OAAO,KAC3B,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EAExC;CACF;CAEA,MAAM,SAAS,MAAM,MAAM,CAAC;CAG5B,IAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG,GAC7C,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAExC,IAAI,OAAO,SAAS,GAAG,GACrB,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,MAAM,aAAa,OAAO,SAAS,KAAK,OAAO,SAAS;CAExD,IAAI,YAAY,UAAU;EAExB,IAAI,YAAY,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EACtD,OAAO;GAAE,MAAM;GAAsB;EAAK;CAC5C;CACA,IAAI,UAAU;EAEZ,IAAI,YAAY,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EACtD,OAAO;GAAE,MAAM;GAAa;EAAK;CACnC;CACA,IAAI,UAEF,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,IAAI,YACF,OAAO;EACL,MAAM;EACN;EACA,QAAQ,UAAU,KAAA;EAClB,QAAQ,UAAU,KAAA;CACpB;CAEF,OAAO;EAAE,MAAM;EAAW;CAAK;AACjC;;;;;;;;;;;;;;;;AA6BA,SAAgB,gBAAgB,SAAwC;CAEtE,IAAI,QAAQ,WAAW,GAAG,GACxB,OAAO,EAAE,MAAM,UAAU;CAI3B,IAAI,QAAQ,WAAW,GAAG,GACxB,OAAO,EAAE,MAAM,OAAO;CAKxB,MAAM,eAAe,wBAAwB,OAAO;CACpD,IAAI,cACF,OAAO;EACL,MAAM;EACN,oBAAoB,aAAa;EACjC,wBAAwB,aAAa;CACvC;CAIF,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GACjD,OAAO,EAAE,MAAM,QAAQ;CAIzB,MAAM,SAAS,mBAAmB,OAAO;CACzC,IAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,SAAgC;GAAE,MAAM,OAAO;GAAM,WAAW,OAAO;EAAK;EAClF,IAAI,OAAO,SAAS,WAAW;GAC7B,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO;GAC/C,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO;EACjD;EACA,OAAO;CACT;CAEA,OAAO,EAAE,MAAM,SAAS;AAC1B;;;;;;;;;;;;;;;AAgBA,SAAS,wBACP,SAC4D;CAC5D,KAAK,MAAM,UAAU,sBACnB,IAAI,QAAQ,WAAW,MAAM,GAAG;EAC9B,MAAM,OAAO,QAAQ,MAAM,OAAO,MAAM;EAGxC,IAAI,KAAK,SAAS,KAAK,CAAC,KAAK,SAAS,GAAG,GACvC,OAAO;GAAE;GAAQ,aAAa;EAAK;CAEvC;CAEF,OAAO;AACT"}
+{"version":3,"file":"segment-classify-C539Pa2O.js","names":[],"sources":["../../src/routing/types.ts","../../src/routing/segment-classify.ts"],"sourcesContent":["/**\n * Route tree types for timber.js file-system routing.\n *\n * The route tree is built by scanning the app/ directory and recognizing\n * file conventions (page.*, layout.*, middleware.ts, access.ts, route.ts, etc.).\n *\n * **Single shape, two specializations** (TIM-848):\n *\n * `SegmentNode<TFile>` is the one canonical in-memory shape for the\n * timber route tree. The same interface is used at build time (with\n * `TFile = RouteFile`) and at request time (with `TFile = ManifestFile`,\n * see `server/route-matcher.ts`). Walkers parameterized over `TFile`\n * work on either, eliminating the previous duplication between\n * `SegmentNode` (Map-based) and `ManifestSegmentNode` (object-based).\n *\n * Keyed groups (`slots`, `statusFiles`, `jsonStatusFiles`,\n * `metadataRoutes`) are plain `Record<string, …>`\n * objects rather than `Map`s so that the build-time tree can be\n * serialized into the virtual route manifest with no shape transform.\n *\n * See design/07-routing.md §\"Route Tree Shape\" and design/18-build-system.md\n * §\"Route Manifest Shape\".\n */\n\n/** Segment type classification */\nexport type SegmentType =\n  | 'static' // e.g. \"dashboard\"\n  | 'dynamic' // e.g. \"[id]\"\n  | 'catch-all' // e.g. \"[...slug]\"\n  | 'optional-catch-all' // e.g. \"[[...slug]]\"\n  | 'group' // e.g. \"(marketing)\"\n  | 'slot' // e.g. \"@sidebar\"\n  | 'intercepting' // e.g. \"(.)photo\", \"(..)photo\", \"(...)photo\"\n  | 'private'; // e.g. \"_components\", \"_lib\" — excluded from routing\n\n/**\n * Intercepting route marker — indicates how many levels up to resolve the\n * intercepted route from the intercepting route's location.\n *\n * See design/07-routing.md §\"Intercepting Routes\"\n */\nexport type InterceptionMarker = '(.)' | '(..)' | '(...)' | '(..)(..)';\n\n/** All recognized interception markers, ordered longest-first for parsing. */\nexport const INTERCEPTION_MARKERS: InterceptionMarker[] = ['(..)(..)', '(.)', '(..)', '(...)'];\n\n/**\n * A single file discovered in a route segment at build time.\n *\n * The runtime equivalent (`ManifestFile`, defined in\n * `server/route-matcher.ts`) replaces `extension` with a lazy `load`\n * function. Walkers that only need `filePath` are parameterized over\n * `TFile` and accept either.\n */\nexport interface RouteFile {\n  /** Absolute path to the file */\n  filePath: string;\n  /** File extension without leading dot (e.g. \"tsx\", \"ts\", \"mdx\") */\n  extension: string;\n}\n\n/**\n * A node in the segment tree.\n *\n * Generic over `TFile` so the same interface describes both the\n * build-time tree (`SegmentNode<RouteFile>`, the default) and the\n * runtime manifest tree (`SegmentNode<ManifestFile>`, aliased as\n * `ManifestSegmentNode`). All keyed groups use `Record` (not `Map`)\n * so the build-time tree serializes to the virtual route manifest\n * with no shape transform.\n */\nexport interface SegmentNode<TFile = RouteFile> {\n  /** The raw directory name (e.g. \"dashboard\", \"[id]\", \"(auth)\", \"@sidebar\") */\n  segmentName: string;\n  /** Classified segment type */\n  segmentType: SegmentType;\n  /** The dynamic param name, if dynamic (e.g. \"id\" for \"[id]\", \"slug\" for \"[...slug]\") */\n  paramName?: string;\n  /** Literal prefix before the dynamic bracket (e.g. \"img-\" for \"img-[id].png\") */\n  paramPrefix?: string;\n  /** Literal suffix after the dynamic bracket (e.g. \".png\" for \"img-[id].png\") */\n  paramSuffix?: string;\n  /** The URL path prefix at this segment level (e.g. \"/dashboard\") */\n  urlPath: string;\n  /** For intercepting segments: the marker used, e.g. \"(.)\". */\n  interceptionMarker?: InterceptionMarker;\n  /**\n   * For intercepting segments: the segment name after stripping the marker.\n   * E.g., for \"(.)photo\" this is \"photo\".\n   */\n  interceptedSegmentName?: string;\n\n  // --- File conventions ---\n  page?: TFile;\n  layout?: TFile;\n  middleware?: TFile;\n  access?: TFile;\n  route?: TFile;\n  /**\n   * params.ts — isomorphic convention file exporting segmentParams and/or searchParams.\n   * Discovered by the scanner like middleware.ts and access.ts.\n   * See design/07-routing.md §\"params.ts Convention File\"\n   */\n  params?: TFile;\n  error?: TFile;\n  default?: TFile;\n  /** Status-code files: 4xx.tsx, 5xx.tsx, {status}.tsx (component format) */\n  statusFiles?: Record<string, TFile>;\n  /** JSON status-code files: 4xx.json, 5xx.json, {status}.json */\n  jsonStatusFiles?: Record<string, TFile>;\n  /** denied.tsx — slot-only denial rendering */\n  denied?: TFile;\n\n  /** Metadata route files (sitemap.ts, robots.ts, icon.tsx, etc.) keyed by base name */\n  metadataRoutes?: Record<string, TFile>;\n\n  // --- Children ---\n  children: SegmentNode<TFile>[];\n  /** Parallel route slots (keyed by slot name without @) */\n  slots: Record<string, SegmentNode<TFile>>;\n}\n\n/**\n * The full route tree output from the scanner (or the root of the\n * runtime route manifest, when `TFile = ManifestFile`).\n *\n * Generic so the same wrapper carries app-root metadata for both\n * shapes. The runtime manifest extends this with `viteRoot` (see\n * `ManifestRoot` in `server/route-matcher.ts`).\n */\nexport interface RouteTree<TFile = RouteFile> {\n  /** The root segment node (representing app/) */\n  root: SegmentNode<TFile>;\n  /** All discovered proxy.ts files (should be at most one, in app/) */\n  proxy?: TFile;\n  /**\n   * Global error page: app/global-error.{tsx,ts,jsx,js}\n   *\n   * Rendered as a standalone full-page replacement (no layout wrapping)\n   * when no segment-level error file is found. SSR-only render path.\n   * Must provide its own <html> and <body>.\n   *\n   * See design/10-error-handling.md §\"Tier 2 — Global Error Page\"\n   */\n  globalError?: TFile;\n}\n\n/** Configuration passed to the scanner */\nexport interface ScannerConfig {\n  /** Recognized page/layout extensions (without dots). Default: ['tsx', 'ts', 'jsx', 'js'] */\n  pageExtensions?: string[];\n}\n\n/** Default page extensions */\nexport const DEFAULT_PAGE_EXTENSIONS = ['tsx', 'ts', 'jsx', 'js'];\n","/**\n * Shared segment classifier — both URL tokens and filesystem directory names.\n *\n * `classifyUrlSegment(token)` is a pure single-pass character parser that\n * classifies a route segment token (e.g. \"dashboard\", \"[id]\", \"[...slug]\",\n * \"[[...path]]\") into a typed discriminated union. NO regex, NO Node.js-only\n * APIs — safe to import from browser code (used by `Link` interpolation).\n *\n * `classifySegment(dirName)` is the build-time directory-name classifier\n * used by the scanner. It recognizes timber-only conventions (private\n * `_*`, parallel `@*`, route groups `(name)`, intercepting routes\n * `(.)`/`(..)`/`(...)`/`(..)(..)`) and delegates bracket syntax to\n * `classifyUrlSegment`. It is the **single source of truth** for what\n * counts as a routing segment — there is no separate copy in the\n * scanner. (TIM-848.)\n *\n * Malformed input falls through to `{ kind: 'static' }` — the safe default.\n *\n * If you change the bracket syntax, update ONLY this file. Every\n * consumer imports from here.\n *\n * See design/07-routing.md §\"Route Segments\"\n */\n\nimport type { InterceptionMarker, SegmentType } from './types.js';\nimport { INTERCEPTION_MARKERS } from './types.js';\n\nexport type UrlSegment =\n  | { kind: 'static'; value: string }\n  | { kind: 'dynamic'; name: string; prefix?: string; suffix?: string }\n  | { kind: 'catch-all'; name: string }\n  | { kind: 'optional-catch-all'; name: string };\n\n/**\n * Classify a URL path segment token.\n *\n * Walks the string left-to-right in one pass:\n *   1. Find the first '[' — characters before it are the prefix.\n *   2. Count opening brackets (1 or 2) to detect optional.\n *   3. Check for '...' to detect catch-all.\n *   4. Read the param name up to the closing bracket.\n *   5. Validate the expected closing sequence (']' or ']]').\n *   6. Characters after the close are the suffix.\n *   7. Reject affixes on catch-all/optional-catch-all.\n *   8. Reject affixes that contain '[' or ']' (no multi-param segments).\n *\n * Any structural violation → static (safe default).\n */\nexport function classifyUrlSegment(token: string): UrlSegment {\n  const len = token.length;\n  if (len === 0) return { kind: 'static', value: token };\n\n  // Find first '[' — characters before it are the prefix\n  const bracketStart = token.indexOf('[');\n  if (bracketStart === -1) return { kind: 'static', value: token };\n\n  const prefix = token.slice(0, bracketStart);\n\n  let i = bracketStart + 1;\n\n  // Check for optional: '[[...'\n  const optional = i < len && token[i] === '[';\n  if (optional) i++;\n\n  // Check for catch-all: '...'\n  const catchAll = i + 2 < len && token[i] === '.' && token[i + 1] === '.' && token[i + 2] === '.';\n  if (catchAll) i += 3;\n\n  // Read param name — everything up to ']'\n  const nameStart = i;\n  while (i < len && token[i] !== ']') i++;\n\n  // Must have found a ']' and name must be non-empty\n  if (i >= len || i === nameStart) {\n    return { kind: 'static', value: token };\n  }\n\n  const name = token.slice(nameStart, i);\n  i++; // skip first ']'\n\n  // Optional requires a second ']'\n  if (optional) {\n    if (i >= len || token[i] !== ']') {\n      return { kind: 'static', value: token };\n    }\n    i++;\n  }\n\n  const suffix = token.slice(i);\n\n  // Reject affixes containing brackets (no multi-param segments like [foo]-[bar])\n  if (suffix.includes('[') || suffix.includes(']')) {\n    return { kind: 'static', value: token };\n  }\n  if (prefix.includes(']')) {\n    return { kind: 'static', value: token };\n  }\n\n  const hasAffixes = prefix.length > 0 || suffix.length > 0;\n\n  if (optional && catchAll) {\n    // No affixes on optional catch-all\n    if (hasAffixes) return { kind: 'static', value: token };\n    return { kind: 'optional-catch-all', name };\n  }\n  if (catchAll) {\n    // No affixes on catch-all\n    if (hasAffixes) return { kind: 'static', value: token };\n    return { kind: 'catch-all', name };\n  }\n  if (optional) {\n    // '[[name]]' without '...' is malformed — not a valid segment syntax\n    return { kind: 'static', value: token };\n  }\n\n  if (hasAffixes) {\n    return {\n      kind: 'dynamic',\n      name,\n      prefix: prefix || undefined,\n      suffix: suffix || undefined,\n    };\n  }\n  return { kind: 'dynamic', name };\n}\n\n// ─── Directory-name classifier (build-time scanner) ─────────────────────────\n\n/** Result of classifying a filesystem directory name. */\nexport interface SegmentClassification {\n  type: SegmentType;\n  paramName?: string;\n  paramPrefix?: string;\n  paramSuffix?: string;\n  interceptionMarker?: InterceptionMarker;\n  interceptedSegmentName?: string;\n}\n\n/**\n * Classify a directory name into its segment type.\n *\n * Recognizes all timber file-system conventions in priority order:\n *   1. Private folders: `_name` (excluded from routing)\n *   2. Parallel route slots: `@name`\n *   3. Intercepting routes: `(.)name`, `(..)name`, `(...)name`, `(..)(..)name`\n *   4. Route groups: `(name)`\n *   5. Bracket syntax: `[id]`, `[...slug]`, `[[...path]]` (delegated to\n *      `classifyUrlSegment`)\n *   6. Static: anything else\n *\n * If you change the bracket syntax, update only `classifyUrlSegment`.\n * If you change the directory-prefix conventions, update this function.\n */\nexport function classifySegment(dirName: string): SegmentClassification {\n  // Private folder: _name (excluded from routing)\n  if (dirName.startsWith('_')) {\n    return { type: 'private' };\n  }\n\n  // Parallel route slot: @name\n  if (dirName.startsWith('@')) {\n    return { type: 'slot' };\n  }\n\n  // Intercepting routes: (.)name, (..)name, (...)name, (..)(..)name\n  // Check before route groups since intercepting markers also start with (\n  const interception = parseInterceptionMarker(dirName);\n  if (interception) {\n    return {\n      type: 'intercepting',\n      interceptionMarker: interception.marker,\n      interceptedSegmentName: interception.segmentName,\n    };\n  }\n\n  // Route group: (name)\n  if (dirName.startsWith('(') && dirName.endsWith(')')) {\n    return { type: 'group' };\n  }\n\n  // Bracket-syntax segments: [param], [...param], [[...param]]\n  const urlSeg = classifyUrlSegment(dirName);\n  if (urlSeg.kind !== 'static') {\n    const result: SegmentClassification = { type: urlSeg.kind, paramName: urlSeg.name };\n    if (urlSeg.kind === 'dynamic') {\n      if (urlSeg.prefix) result.paramPrefix = urlSeg.prefix;\n      if (urlSeg.suffix) result.paramSuffix = urlSeg.suffix;\n    }\n    return result;\n  }\n\n  return { type: 'static' };\n}\n\n/**\n * The URL-matching identity of a segment node.\n *\n * For every node except an intercepting one this is the node itself. An\n * intercepting node is different: its directory name carries a marker\n * (`(.)photo`, `(.)[id]`), so the node's own `segmentType` is\n * `'intercepting'` and the bracket syntax of the segment it intercepts was\n * never classified. Everything that has to reason about *the URL part this\n * node stands for* — matching it, and keying its param for codec coercion —\n * needs that classification.\n *\n * Deriving it here, from `interceptedSegmentName`, keeps interception out\n * of `classifySegment`'s output and out of the serialized manifest: there\n * is no second copy of the classification to drift from this one. The\n * returned `segmentName` is the intercepted name (`photo`, `[id]`), NOT the\n * node's directory name — callers that need the directory name for tree\n * paths must keep reading the node. See TIM-1281.\n */\nexport interface UrlSegmentIdentity {\n  segmentName: string;\n  segmentType: SegmentType;\n  paramName?: string;\n  paramPrefix?: string;\n  paramSuffix?: string;\n}\n\nexport function effectiveUrlSegment(node: {\n  segmentName: string;\n  segmentType: SegmentType;\n  paramName?: string;\n  paramPrefix?: string;\n  paramSuffix?: string;\n  interceptedSegmentName?: string;\n}): UrlSegmentIdentity {\n  if (node.segmentType !== 'intercepting' || !node.interceptedSegmentName) {\n    return {\n      segmentName: node.segmentName,\n      segmentType: node.segmentType,\n      paramName: node.paramName,\n      paramPrefix: node.paramPrefix,\n      paramSuffix: node.paramSuffix,\n    };\n  }\n\n  const seg = classifyUrlSegment(node.interceptedSegmentName);\n  if (seg.kind === 'static') {\n    return { segmentName: seg.value, segmentType: 'static' };\n  }\n  return {\n    segmentName: node.interceptedSegmentName,\n    segmentType: seg.kind,\n    paramName: seg.name,\n    paramPrefix: seg.kind === 'dynamic' ? seg.prefix : undefined,\n    paramSuffix: seg.kind === 'dynamic' ? seg.suffix : undefined,\n  };\n}\n\n/**\n * Parse an interception marker from a directory name.\n *\n * Returns the marker and the remaining segment name, or null if not an\n * intercepting route. Markers are checked longest-first to avoid `(..)`\n * matching before `(..)(..)`.\n *\n * Examples:\n *   \"(.)photo\"      → { marker: \"(.)\", segmentName: \"photo\" }\n *   \"(..)feed\"      → { marker: \"(..)\", segmentName: \"feed\" }\n *   \"(...)photos\"   → { marker: \"(...)\", segmentName: \"photos\" }\n *   \"(..)(..)admin\" → { marker: \"(..)(..)\", segmentName: \"admin\" }\n *   \"(marketing)\"   → null (route group, not interception)\n */\nfunction parseInterceptionMarker(\n  dirName: string\n): { marker: InterceptionMarker; segmentName: string } | null {\n  for (const marker of INTERCEPTION_MARKERS) {\n    if (dirName.startsWith(marker)) {\n      const rest = dirName.slice(marker.length);\n      // Must have a segment name after the marker, and the rest must not\n      // be empty or end with ) (which would be a route group like \"(auth)\")\n      if (rest.length > 0 && !rest.endsWith(')')) {\n        return { marker, segmentName: rest };\n      }\n    }\n  }\n  return null;\n}\n"],"mappings":";;AA4CA,IAAa,uBAA6C;CAAC;CAAY;CAAO;CAAQ;AAAO;;AA8G7F,IAAa,0BAA0B;CAAC;CAAO;CAAM;CAAO;AAAI;;;;;;;;;;;;;;;;;;AC1GhE,SAAgB,mBAAmB,OAA2B;CAC5D,MAAM,MAAM,MAAM;CAClB,IAAI,QAAQ,GAAG,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGrD,MAAM,eAAe,MAAM,QAAQ,GAAG;CACtC,IAAI,iBAAiB,IAAI,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAE/D,MAAM,SAAS,MAAM,MAAM,GAAG,YAAY;CAE1C,IAAI,IAAI,eAAe;CAGvB,MAAM,WAAW,IAAI,OAAO,MAAM,OAAO;CACzC,IAAI,UAAU;CAGd,MAAM,WAAW,IAAI,IAAI,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,IAAI,OAAO;CAC7F,IAAI,UAAU,KAAK;CAGnB,MAAM,YAAY;CAClB,OAAO,IAAI,OAAO,MAAM,OAAO,KAAK;CAGpC,IAAI,KAAK,OAAO,MAAM,WACpB,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,MAAM,OAAO,MAAM,MAAM,WAAW,CAAC;CACrC;CAGA,IAAI,UAAU;EACZ,IAAI,KAAK,OAAO,MAAM,OAAO,KAC3B,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EAExC;CACF;CAEA,MAAM,SAAS,MAAM,MAAM,CAAC;CAG5B,IAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG,GAC7C,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAExC,IAAI,OAAO,SAAS,GAAG,GACrB,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,MAAM,aAAa,OAAO,SAAS,KAAK,OAAO,SAAS;CAExD,IAAI,YAAY,UAAU;EAExB,IAAI,YAAY,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EACtD,OAAO;GAAE,MAAM;GAAsB;EAAK;CAC5C;CACA,IAAI,UAAU;EAEZ,IAAI,YAAY,OAAO;GAAE,MAAM;GAAU,OAAO;EAAM;EACtD,OAAO;GAAE,MAAM;GAAa;EAAK;CACnC;CACA,IAAI,UAEF,OAAO;EAAE,MAAM;EAAU,OAAO;CAAM;CAGxC,IAAI,YACF,OAAO;EACL,MAAM;EACN;EACA,QAAQ,UAAU,KAAA;EAClB,QAAQ,UAAU,KAAA;CACpB;CAEF,OAAO;EAAE,MAAM;EAAW;CAAK;AACjC;;;;;;;;;;;;;;;;AA6BA,SAAgB,gBAAgB,SAAwC;CAEtE,IAAI,QAAQ,WAAW,GAAG,GACxB,OAAO,EAAE,MAAM,UAAU;CAI3B,IAAI,QAAQ,WAAW,GAAG,GACxB,OAAO,EAAE,MAAM,OAAO;CAKxB,MAAM,eAAe,wBAAwB,OAAO;CACpD,IAAI,cACF,OAAO;EACL,MAAM;EACN,oBAAoB,aAAa;EACjC,wBAAwB,aAAa;CACvC;CAIF,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GACjD,OAAO,EAAE,MAAM,QAAQ;CAIzB,MAAM,SAAS,mBAAmB,OAAO;CACzC,IAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,SAAgC;GAAE,MAAM,OAAO;GAAM,WAAW,OAAO;EAAK;EAClF,IAAI,OAAO,SAAS,WAAW;GAC7B,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO;GAC/C,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO;EACjD;EACA,OAAO;CACT;CAEA,OAAO,EAAE,MAAM,SAAS;AAC1B;AA4BA,SAAgB,oBAAoB,MAOb;CACrB,IAAI,KAAK,gBAAgB,kBAAkB,CAAC,KAAK,wBAC/C,OAAO;EACL,aAAa,KAAK;EAClB,aAAa,KAAK;EAClB,WAAW,KAAK;EAChB,aAAa,KAAK;EAClB,aAAa,KAAK;CACpB;CAGF,MAAM,MAAM,mBAAmB,KAAK,sBAAsB;CAC1D,IAAI,IAAI,SAAS,UACf,OAAO;EAAE,aAAa,IAAI;EAAO,aAAa;CAAS;CAEzD,OAAO;EACL,aAAa,KAAK;EAClB,aAAa,IAAI;EACjB,WAAW,IAAI;EACf,aAAa,IAAI,SAAS,YAAY,IAAI,SAAS,KAAA;EACnD,aAAa,IAAI,SAAS,YAAY,IAAI,SAAS,KAAA;CACrD;AACF;;;;;;;;;;;;;;;AAgBA,SAAS,wBACP,SAC4D;CAC5D,KAAK,MAAM,UAAU,sBACnB,IAAI,QAAQ,WAAW,MAAM,GAAG;EAC9B,MAAM,OAAO,QAAQ,MAAM,OAAO,MAAM;EAGxC,IAAI,KAAK,SAAS,KAAK,CAAC,KAAK,SAAS,GAAG,GACvC,OAAO;GAAE;GAAQ,aAAa;EAAK;CAEvC;CAEF,OAAO;AACT"}

package/dist/_chunks/{canonicalize-DQHyFClh.js → segment-keys-BawYuNFO.js}

@@ -243,6 +243,65 @@ function canonicalize(rawPathname, stripTrailingSlash = true) {
 	};
 }
 //#endregion
-export { classifyMetadataRoute as a, isDynamicMetadataExtension as c, METADATA_ROUTE_CONVENTIONS as i, isMetadataRouteServePath as l, NULL_BYTE_RE as n, getMetadataRouteAutoLink as o, canonicalize as r, getMetadataRouteServePath as s, ENCODED_SEPARATOR_RE as t };
+//#region src/routing/segment-keys.ts
+/**
+* Compute tree paths for a segment chain — the directory path of each segment
+* with slots elided, e.g. `app/(browse)/feed` → `/(browse)/feed`.
+*
+* This is `computeSegmentKeys` with the group branch applied to *every*
+* segment rather than only to groups. That one difference is the whole point:
+* `computeSegmentKeys` resets to `urlPath` at each URL-visible segment, so
+* `(browse)/feed` and `(landing)/feed` both key as `/feed`. Two directories
+* that render different layouts must not share an identity.
+*
+* Used for interception scoping (`routing/interception.ts`), where the
+* question is "does this route pass through *that* directory?" — not "does it
+* render this URL?". Not interchangeable with `computeSegmentKeys`: the state
+* tree is keyed by URL on purpose, because the client caches by URL.
+*/
+function computeSegmentTreePaths(segments) {
+	const paths = [];
+	let prev = "";
+	for (const segment of segments) {
+		const name = segment.segmentName ?? "";
+		if (!name) {
+			paths.push("/");
+			prev = "/";
+			continue;
+		}
+		const path = `${prev === "/" ? "" : prev}/${name}`;
+		paths.push(path);
+		prev = path;
+	}
+	return paths;
+}
+/**
+* The directory names a tree path is built from — `/` is none, `/feed/(a)` is
+* `['feed', '(a)']`.
+*
+* The inverse of the walk above, and it lives beside it so the format is
+* stated once: `findChainByTreePath` (`server/children-interception.ts`) walks
+* these names back down the tree to the directory the path addresses, and
+* `treePathDepth` counts them. Both are readings of the same string, and a
+* reader that disagreed with the producer about what separates two names
+* resolves an interception to the wrong node or to none.
+*/
+function treePathNames(treePath) {
+	return treePath === "/" ? [] : treePath.slice(1).split("/");
+}
+/**
+* How many directories a tree path names — `/` is 0, `/feed` is 1,
+* `/feed/(a)` is 2.
+*
+* Two tree paths on a single rendered chain are strictly nested, so on that
+* chain depth orders them totally — which is what makes it usable as "the
+* deeper of these two directories" wherever a route passes through both
+* (`routing/interception.ts`).
+*/
+function treePathDepth(treePath) {
+	return treePathNames(treePath).length;
+}
+//#endregion
+export { canonicalize as a, getMetadataRouteAutoLink as c, isMetadataRouteServePath as d, NULL_BYTE_RE as i, getMetadataRouteServePath as l, treePathDepth as n, METADATA_ROUTE_CONVENTIONS as o, ENCODED_SEPARATOR_RE as r, classifyMetadataRoute as s, computeSegmentTreePaths as t, isDynamicMetadataExtension as u };
 
-//# sourceMappingURL=canonicalize-DQHyFClh.js.map
+//# sourceMappingURL=segment-keys-BawYuNFO.js.map