@timber-js/app 0.2.0-alpha.19 → 0.2.0-alpha.190

package/dist/_chunks/fs-identity-D7vb6GdI.js

@@ -0,0 +1,208 @@
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { rm, stat, writeFile } from "node:fs/promises";
+//#region src/shared/static-platform-files.ts
+/**
+* Platform files the static build is allowed to overwrite in the output.
+*
+* The build merges two trees into the deployed directory — the client bundle
+* (which carries everything the user put in `public/`) and the pre-rendered
+* site. That merge otherwise refuses overlaps, because a silent overwrite
+* leaves one of two artifacts deployed with nothing recording which
+* (TIM-1266).
+*
+* These names are the exception, and only because the pre-rendered copy is
+* *derived from* the one it replaces rather than competing with it:
+* `plugins/static-build.ts` reads `public/_redirects` and writes the
+* generated rules plus the user's, so the winner is a superset of the loser.
+*
+* That holds only for a file the current pass produced, which is why
+* `cleanConditionalArtifacts` deletes a previous build's `_redirects` before
+* generation: written only when a pass finds redirects, it would otherwise
+* survive into a pass that produced nothing and claim an exemption it no
+* longer earns.
+*
+* `_headers` is NOT here. It is not written into the pre-rendered tree at
+* all — adapters generate it directly into the output, folding in the
+* user's copy as they go (TIM-1326).
+*
+* Declared once so the code that performs the merge and the code that
+* produces the merged file cannot disagree about which names are exempt.
+*
+* Isomorphic: no server, client, or build-time imports.
+*/
+/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */
+var REDIRECTS_FILE = "_redirects";
+/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */
+var HEADERS_FILE = "_headers";
+/**
+* Where a user authors platform files. Stated once because two modules read
+* from here — `plugins/static-build.ts` for `_redirects`, adapters for
+* `_headers` — and they must look in the same place.
+*
+* Both read the **project source**, never the build output. The generated
+* file lands under the same name in the output directory, so a reader aimed
+* there would fold the previous build's generated rules back in and compound
+* them on every rebuild.
+*/
+var USER_PLATFORM_DIR = "public";
+/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */
+var USER_MERGED_PLATFORM_FILES = [REDIRECTS_FILE];
+/**
+* Output paths the framework writes itself, which no route may claim.
+*
+* These are written outside the per-entry writer — `_redirects` after
+* generation, `_headers` by the adapter after the copy — so the collision
+* tracker never sees them and a route rendering to one of these paths is
+* overwritten with nothing recording it.
+*
+* Reserved rather than tracked, because there is no version of "serve a route
+* at `/_headers`" that works: Cloudflare Pages and Netlify read these two
+* files themselves and never serve them, so the route is unservable however
+* the conflict is resolved.
+*
+* That justification is per-file, not per-mechanism. `.nojekyll` is written
+* the same way and is deliberately NOT here: only the `github-pages` target
+* writes it, and everywhere else `/.nojekyll` is an ordinary servable path,
+* so reserving it globally would refuse a valid Cloudflare site. Its write
+* site skips the write when a file is already there instead — GitHub Pages
+* only cares that the file exists.
+*
+* Same reasoning as the synthetic 404 entry using an internal urlPath so a
+* real `/404` route cannot collide with `404.html`.
+*/
+var RESERVED_OUTPUT_PATHS = [REDIRECTS_FILE, HEADERS_FILE];
+//#endregion
+//#region src/adapters/fs-identity.ts
+/**
+* What the output filesystem considers "the same file".
+*
+* Two build steps compare paths to decide whether two artifacts would land on
+* one file — the render pass (`plugins/static-build.ts`) and the adapter's
+* tree merge (`build-output-helper.ts`). Both are predicting a filesystem
+* decision, so both ask the filesystem rather than comparing raw strings
+* (TIM-1266).
+*
+* Two properties matter, and they are independent:
+*
+* - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does
+*   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on
+*   Linux CI.
+* - **Unicode normalization.** APFS compares normalization-insensitively, so
+*   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one
+*   file. This holds even on a *case-sensitive* APFS volume, which is why it
+*   is probed separately rather than inferred from case folding.
+*
+* Probed rather than read off `process.platform`: a case-sensitive volume on
+* macOS and a case-insensitive mount on Linux are both ordinary, and the
+* answer that matters is the one for the directory being written.
+*
+* Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,
+* which `server/asset-headers.ts` re-exports from and which therefore must
+* stay free of `node:fs` for the Workers bundle.
+*/
+/** Every path comparison is exact — the conservative answer when unprobed. */
+var EXACT_FS_IDENTITY = {
+	caseInsensitive: false,
+	normalizationInsensitive: false,
+	stripsTrailingDotsAndSpaces: false
+};
+/**
+* Probe `dir` by writing one file and asking for it under other spellings.
+*
+* Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That
+* under-detects, but a directory this cannot write to is one the caller is
+* about to fail on anyway, with a clearer error than a missed collision.
+*/
+async function detectFsIdentity(dir) {
+	const name = `.timber-probe-${randomUUID()}-café`;
+	const path = join(dir, name);
+	try {
+		await writeFile(path, "");
+		const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] = await Promise.all([
+			exists(join(dir, name.toUpperCase())),
+			exists(join(dir, name.normalize("NFD"))),
+			exists(join(dir, `${name}.`))
+		]);
+		return {
+			caseInsensitive,
+			normalizationInsensitive,
+			stripsTrailingDotsAndSpaces
+		};
+	} catch {
+		return EXACT_FS_IDENTITY;
+	} finally {
+		await rm(path, { force: true }).catch(() => {});
+	}
+}
+/**
+* Fold a path to the identity the filesystem compares it under.
+*
+* Normalization first, then case: `toLowerCase()` operates per code point, so
+* folding a decomposed string first would leave the combining marks in a
+* different order than folding a precomposed one.
+*
+* An approximation of the filesystem's own algorithm — APFS and NTFS fold per
+* their own Unicode tables, which `toLowerCase()` matches for everything short
+* of the exotic. It errs toward *finding* a collision, and the cost of a false
+* positive is a build error naming two routes rather than a silent overwrite.
+*/
+function fsKey(path, identity) {
+	let key = identity.caseInsensitive ? caseFold(path) : path;
+	if (identity.normalizationInsensitive) key = key.normalize("NFC");
+	if (identity.stripsTrailingDotsAndSpaces) key = key.split("/").map(stripTrailing).join("/");
+	return key;
+}
+/**
+* Approximate Unicode case folding, which is what case-insensitive
+* filesystems actually compare under.
+*
+* `toLowerCase()` is not it. Greek `σ` and final `ς` are both already
+* lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS
+* folds `ς` to `σ` — so two routes differing only in that letter are one file
+* on both, and a lowercase key admitted them as two claims (TIM-1266).
+* Uppercasing first collapses them.
+*
+* The residual is over-folding, in these cases and a few like them:
+*
+* | pair      | folded together here | NTFS / APFS       |
+* | --------- | -------------------- | ----------------- |
+* | `σ` / `ς` | yes                  | yes — the fix     |
+* | `ß` / `ss`| yes                  | no                |
+* | `ı` / `i` | yes                  | no                |
+* | `fi` / `fi`| yes                  | no                |
+*
+* That direction is deliberate. Over-folding costs a build error naming two
+* routes, which a developer fixes by renaming one; under-folding costs a
+* payload silently overwritten by another route's, which nothing downstream
+* can detect. An exact fold would need `Intl.Collator`, which compares but
+* emits no sort key, so using it would turn a hash lookup into a pairwise
+* scan over every claimed path.
+*/
+function caseFold(value) {
+	return value.toUpperCase().toLowerCase();
+}
+/**
+* Drop trailing dots and spaces from one path segment, as Win32 does.
+*
+* A segment that is nothing but dots and spaces is left alone: `.` and `..`
+* are traversal, which the caller rejects before reaching here, and emptying
+* a segment would merge two unrelated paths rather than the aliases this
+* models.
+*/
+function stripTrailing(segment) {
+	const stripped = segment.replace(/[. ]+$/, "");
+	return stripped === "" ? segment : stripped;
+}
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { REDIRECTS_FILE as a, USER_PLATFORM_DIR as c, HEADERS_FILE as i, detectFsIdentity as n, RESERVED_OUTPUT_PATHS as o, fsKey as r, USER_MERGED_PLATFORM_FILES as s, EXACT_FS_IDENTITY as t };
+
+//# sourceMappingURL=fs-identity-D7vb6GdI.js.map

package/dist/_chunks/fs-identity-D7vb6GdI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-identity-D7vb6GdI.js","names":[],"sources":["../../src/shared/static-platform-files.ts","../../src/adapters/fs-identity.ts"],"sourcesContent":["/**\n * Platform files the static build is allowed to overwrite in the output.\n *\n * The build merges two trees into the deployed directory — the client bundle\n * (which carries everything the user put in `public/`) and the pre-rendered\n * site. That merge otherwise refuses overlaps, because a silent overwrite\n * leaves one of two artifacts deployed with nothing recording which\n * (TIM-1266).\n *\n * These names are the exception, and only because the pre-rendered copy is\n * *derived from* the one it replaces rather than competing with it:\n * `plugins/static-build.ts` reads `public/_redirects` and writes the\n * generated rules plus the user's, so the winner is a superset of the loser.\n *\n * That holds only for a file the current pass produced, which is why\n * `cleanConditionalArtifacts` deletes a previous build's `_redirects` before\n * generation: written only when a pass finds redirects, it would otherwise\n * survive into a pass that produced nothing and claim an exemption it no\n * longer earns.\n *\n * `_headers` is NOT here. It is not written into the pre-rendered tree at\n * all — adapters generate it directly into the output, folding in the\n * user's copy as they go (TIM-1326).\n *\n * Declared once so the code that performs the merge and the code that\n * produces the merged file cannot disagree about which names are exempt.\n *\n * Isomorphic: no server, client, or build-time imports.\n */\n\n/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */\nexport const REDIRECTS_FILE = '_redirects';\n\n/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */\nexport const HEADERS_FILE = '_headers';\n\n/**\n * Where a user authors platform files. Stated once because two modules read\n * from here — `plugins/static-build.ts` for `_redirects`, adapters for\n * `_headers` — and they must look in the same place.\n *\n * Both read the **project source**, never the build output. The generated\n * file lands under the same name in the output directory, so a reader aimed\n * there would fold the previous build's generated rules back in and compound\n * them on every rebuild.\n */\nexport const USER_PLATFORM_DIR = 'public';\n\n/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */\nexport const USER_MERGED_PLATFORM_FILES: readonly string[] = [REDIRECTS_FILE];\n\n/**\n * Output paths the framework writes itself, which no route may claim.\n *\n * These are written outside the per-entry writer — `_redirects` after\n * generation, `_headers` by the adapter after the copy — so the collision\n * tracker never sees them and a route rendering to one of these paths is\n * overwritten with nothing recording it.\n *\n * Reserved rather than tracked, because there is no version of \"serve a route\n * at `/_headers`\" that works: Cloudflare Pages and Netlify read these two\n * files themselves and never serve them, so the route is unservable however\n * the conflict is resolved.\n *\n * That justification is per-file, not per-mechanism. `.nojekyll` is written\n * the same way and is deliberately NOT here: only the `github-pages` target\n * writes it, and everywhere else `/.nojekyll` is an ordinary servable path,\n * so reserving it globally would refuse a valid Cloudflare site. Its write\n * site skips the write when a file is already there instead — GitHub Pages\n * only cares that the file exists.\n *\n * Same reasoning as the synthetic 404 entry using an internal urlPath so a\n * real `/404` route cannot collide with `404.html`.\n */\nexport const RESERVED_OUTPUT_PATHS: readonly string[] = [REDIRECTS_FILE, HEADERS_FILE];\n","/**\n * What the output filesystem considers \"the same file\".\n *\n * Two build steps compare paths to decide whether two artifacts would land on\n * one file — the render pass (`plugins/static-build.ts`) and the adapter's\n * tree merge (`build-output-helper.ts`). Both are predicting a filesystem\n * decision, so both ask the filesystem rather than comparing raw strings\n * (TIM-1266).\n *\n * Two properties matter, and they are independent:\n *\n * - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does\n *   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on\n *   Linux CI.\n * - **Unicode normalization.** APFS compares normalization-insensitively, so\n *   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one\n *   file. This holds even on a *case-sensitive* APFS volume, which is why it\n *   is probed separately rather than inferred from case folding.\n *\n * Probed rather than read off `process.platform`: a case-sensitive volume on\n * macOS and a case-insensitive mount on Linux are both ordinary, and the\n * answer that matters is the one for the directory being written.\n *\n * Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,\n * which `server/asset-headers.ts` re-exports from and which therefore must\n * stay free of `node:fs` for the Workers bundle.\n */\n\nimport { writeFile, stat, rm } from 'node:fs/promises';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path';\n\n/** How the output filesystem decides that two paths name one file. */\nexport interface FsIdentity {\n  /** `Foo` and `foo` are the same file. */\n  caseInsensitive: boolean;\n  /** Canonically equivalent Unicode spellings are the same file. */\n  normalizationInsensitive: boolean;\n  /**\n   * Trailing dots and spaces are stripped from each segment, so `foo.` and\n   * `foo` are the same file. Win32 does this in path resolution rather than\n   * in the filesystem, which is why it is probed like the others.\n   */\n  stripsTrailingDotsAndSpaces: boolean;\n}\n\n/** Every path comparison is exact — the conservative answer when unprobed. */\nexport const EXACT_FS_IDENTITY: FsIdentity = {\n  caseInsensitive: false,\n  normalizationInsensitive: false,\n  stripsTrailingDotsAndSpaces: false,\n};\n\n/**\n * Probe `dir` by writing one file and asking for it under other spellings.\n *\n * Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That\n * under-detects, but a directory this cannot write to is one the caller is\n * about to fail on anyway, with a clearer error than a missed collision.\n */\nexport async function detectFsIdentity(dir: string): Promise<FsIdentity> {\n  // `café` — NFC, with a precomposed é. The UUID contributes the\n  // hex letters the case probe needs.\n  const name = `.timber-probe-${randomUUID()}-café`;\n  const path = join(dir, name);\n\n  try {\n    await writeFile(path, '');\n    const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] =\n      await Promise.all([\n        exists(join(dir, name.toUpperCase())),\n        // NFD spells the same string as `e` + U+0301; a filesystem that\n        // resolves it to the NFC file compares normalization-insensitively.\n        exists(join(dir, name.normalize('NFD'))),\n        // Win32 strips trailing dots and spaces during path resolution, so\n        // asking for `name.` reaches `name`.\n        exists(join(dir, `${name}.`)),\n      ]);\n    return { caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces };\n  } catch {\n    return EXACT_FS_IDENTITY;\n  } finally {\n    await rm(path, { force: true }).catch(() => {});\n  }\n}\n\n/**\n * Fold a path to the identity the filesystem compares it under.\n *\n * Normalization first, then case: `toLowerCase()` operates per code point, so\n * folding a decomposed string first would leave the combining marks in a\n * different order than folding a precomposed one.\n *\n * An approximation of the filesystem's own algorithm — APFS and NTFS fold per\n * their own Unicode tables, which `toLowerCase()` matches for everything short\n * of the exotic. It errs toward *finding* a collision, and the cost of a false\n * positive is a build error naming two routes rather than a silent overwrite.\n */\nexport function fsKey(path: string, identity: FsIdentity): string {\n  let key = identity.caseInsensitive ? caseFold(path) : path;\n  if (identity.normalizationInsensitive) key = key.normalize('NFC');\n  if (identity.stripsTrailingDotsAndSpaces) key = key.split('/').map(stripTrailing).join('/');\n  return key;\n}\n\n/**\n * Approximate Unicode case folding, which is what case-insensitive\n * filesystems actually compare under.\n *\n * `toLowerCase()` is not it. Greek `σ` and final `ς` are both already\n * lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS\n * folds `ς` to `σ` — so two routes differing only in that letter are one file\n * on both, and a lowercase key admitted them as two claims (TIM-1266).\n * Uppercasing first collapses them.\n *\n * The residual is over-folding, in these cases and a few like them:\n *\n * | pair      | folded together here | NTFS / APFS       |\n * | --------- | -------------------- | ----------------- |\n * | `σ` / `ς` | yes                  | yes — the fix     |\n * | `ß` / `ss`| yes                  | no                |\n * | `ı` / `i` | yes                  | no                |\n * | `fi` / `fi`| yes                  | no                |\n *\n * That direction is deliberate. Over-folding costs a build error naming two\n * routes, which a developer fixes by renaming one; under-folding costs a\n * payload silently overwritten by another route's, which nothing downstream\n * can detect. An exact fold would need `Intl.Collator`, which compares but\n * emits no sort key, so using it would turn a hash lookup into a pairwise\n * scan over every claimed path.\n */\nfunction caseFold(value: string): string {\n  return value.toUpperCase().toLowerCase();\n}\n\n/**\n * Drop trailing dots and spaces from one path segment, as Win32 does.\n *\n * A segment that is nothing but dots and spaces is left alone: `.` and `..`\n * are traversal, which the caller rejects before reaching here, and emptying\n * a segment would merge two unrelated paths rather than the aliases this\n * models.\n */\nfunction stripTrailing(segment: string): string {\n  const stripped = segment.replace(/[. ]+$/, '');\n  return stripped === '' ? segment : stripped;\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,iBAAiB;;AAG9B,IAAa,eAAe;;;;;;;;;;;AAY5B,IAAa,oBAAoB;;AAGjC,IAAa,6BAAgD,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;AAyB5E,IAAa,wBAA2C,CAAC,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3BrF,IAAa,oBAAgC;CAC3C,iBAAiB;CACjB,0BAA0B;CAC1B,6BAA6B;AAC/B;;;;;;;;AASA,eAAsB,iBAAiB,KAAkC;CAGvE,MAAM,OAAO,iBAAiB,WAAW,EAAE;CAC3C,MAAM,OAAO,KAAK,KAAK,IAAI;CAE3B,IAAI;EACF,MAAM,UAAU,MAAM,EAAE;EACxB,MAAM,CAAC,iBAAiB,0BAA0B,+BAChD,MAAM,QAAQ,IAAI;GAChB,OAAO,KAAK,KAAK,KAAK,YAAY,CAAC,CAAC;GAGpC,OAAO,KAAK,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;GAGvC,OAAO,KAAK,KAAK,GAAG,KAAK,EAAE,CAAC;EAC9B,CAAC;EACH,OAAO;GAAE;GAAiB;GAA0B;EAA4B;CAClF,QAAQ;EACN,OAAO;CACT,UAAU;EACR,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAChD;AACF;;;;;;;;;;;;;AAcA,SAAgB,MAAM,MAAc,UAA8B;CAChE,IAAI,MAAM,SAAS,kBAAkB,SAAS,IAAI,IAAI;CACtD,IAAI,SAAS,0BAA0B,MAAM,IAAI,UAAU,KAAK;CAChE,IAAI,SAAS,6BAA6B,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG;CAC1F,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,YAAY,CAAC,CAAC,YAAY;AACzC;;;;;;;;;AAUA,SAAS,cAAc,SAAyB;CAC9C,MAAM,WAAW,QAAQ,QAAQ,UAAU,EAAE;CAC7C,OAAO,aAAa,KAAK,UAAU;AACrC;AAEA,eAAe,OAAO,MAAgC;CACpD,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/_chunks/href-validation-CMc5JRls.js

@@ -0,0 +1,141 @@
+//#region src/shared/merge-search-params.ts
+/**
+* Shared utility for merging preserved search params into a target URL.
+*
+* Used by both <Link> (client) and redirect() (server). Extracted to a shared
+* module to avoid importing client code ('use client') from server modules.
+*/
+/**
+* Merge preserved search params from the current URL into a target href.
+*
+* When `preserve` is `true`, all current search params are merged.
+* When `preserve` is a `string[]`, only the named params are merged.
+*
+* The target href's own search params take precedence — preserved params
+* are only added if the target doesn't already define them.
+*
+* @param targetHref - The resolved target href (may already contain query string)
+* @param currentSearch - The current URL's search string (e.g. "?private=access&page=2")
+* @param preserve - `true` to preserve all, or `string[]` to preserve specific params
+* @returns The target href with preserved search params merged in
+*/
+function mergePreservedSearchParams(targetHref, currentSearch, preserve) {
+	const currentParams = new URLSearchParams(currentSearch);
+	if (currentParams.size === 0) return targetHref;
+	const hashIdx = targetHref.indexOf("#");
+	const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;
+	const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : "";
+	const qIdx = hrefWithoutHash.indexOf("?");
+	const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;
+	const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : "");
+	const merged = new URLSearchParams(targetParams);
+	for (const [key, value] of currentParams) if (!targetParams.has(key)) {
+		if (preserve === true || preserve.includes(key)) merged.append(key, value);
+	}
+	const qs = merged.toString();
+	return (qs ? `${targetPath}?${qs}` : targetPath) + hash;
+}
+//#endregion
+//#region src/shared/href-validation.ts
+/**
+* Shared href/URL validation for all navigation sinks.
+*
+* Used by <Link>, useRouter().push/replace, and redirectExternal().
+* Single source of truth for dangerous-scheme detection — prevents
+* control-character smuggling that bypasses naive regex checks.
+*
+* See design/13-security.md §"Link scheme injection" (test #9)
+* and design/07-routing.md §"<Link> Scheme Validation".
+*/
+/**
+* All C0 control characters (U+0000–U+001F) that browsers strip during
+* URL preprocessing. Browsers and `new URL()` strip the full C0 range,
+* not just tab/LF/CR — so we must match that behavior to prevent
+* bypass vectors like `\x00javascript:alert(1)`.
+*/
+var CONTROL_CHARS_RE = /[\x00-\x1f]/g;
+var DANGEROUS_SCHEMES = /* @__PURE__ */ new Set([
+	"javascript:",
+	"data:",
+	"vbscript:"
+]);
+/**
+* Strip C0 control chars and leading whitespace, then extract the scheme.
+* Returns the lowercase scheme (e.g. "javascript:") or null if no scheme.
+*/
+function extractScheme(href) {
+	const cleaned = href.replace(CONTROL_CHARS_RE, "").trimStart();
+	const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);
+	return match ? match[1].toLowerCase() : null;
+}
+/**
+* Validate an href for navigation sinks (<Link>, useRouter, etc.).
+*
+* Rejects dangerous schemes (javascript:, data:, vbscript:) even when
+* control characters are embedded to bypass naive regex checks.
+* Also rejects protocol-relative URLs (//evil.com).
+*
+* Throws on rejection. Safe hrefs pass through silently.
+*/
+function validateNavigationHref(href) {
+	if (href.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/").startsWith("//")) throw new Error(`Navigation received a protocol-relative or backslash-prefixed URL: "${href}". Use an absolute URL with an explicit scheme or a relative path.`);
+	const scheme = extractScheme(href);
+	if (scheme && DANGEROUS_SCHEMES.has(scheme)) throw new Error(`Navigation received a dangerous href: "${href}". javascript:, data:, and vbscript: URLs are not allowed.`);
+}
+/**
+* Check if an href is internal (same-origin navigation) or external.
+*
+* Strips control characters before checking so that "java\tscript:" is
+* correctly identified as having a scheme (and thus not internal).
+*/
+function isInternalHref(href) {
+	const cleaned = href.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
+	if (cleaned.startsWith("//")) return false;
+	if (cleaned.startsWith("/") || cleaned.startsWith("#") || cleaned.startsWith("?")) return true;
+	if (extractScheme(href)) return false;
+	return true;
+}
+/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */
+var ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
+/**
+* Assert that a redirect target is a relative path — rejects absolute and
+* protocol-relative URLs. Used by both the server `redirect()` primitive and
+* the client next/navigation shim so they enforce identical semantics.
+*
+* Normalizes for validation only: strips C0 controls, trims, then replaces
+* backslashes with forward slashes. Browsers normalize \ → / during URL
+* resolution, so "/\evil.com" becomes "//evil.com" (protocol-relative open
+* redirect). See design/13-security.md tests #8, #8a–#8c.
+*/
+function assertRelativeRedirectPath(path) {
+	const cleaned = path.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
+	if (ABSOLUTE_URL_RE.test(cleaned)) throw new Error(`redirect() only accepts relative URLs. Got absolute URL: "${path}". Use redirectExternal(url, allowList) for external redirects.`);
+	if (/[\x00-\x1f]/.test(path)) throw new Error("redirect() received a path containing control characters (U+0000–U+001F). Sanitize user input before passing it to redirect().");
+}
+var SAFE_REDIRECT_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+/**
+* Validate and canonicalize an external redirect URL.
+*
+* Requires http: or https: scheme and checks origin against an allow-list.
+* Returns the parsed canonical URL string (from URL.href) to prevent
+* raw user input from reaching the Location header.
+*
+* @throws On invalid URL, dangerous scheme, or origin not in allow-list.
+*/
+function validateExternalRedirectUrl(url, allowList) {
+	const cleaned = url.replace(CONTROL_CHARS_RE, "").trimStart();
+	if (cleaned.startsWith("//")) throw new Error(`redirectExternal() received a protocol-relative URL: "${url}". Use an absolute URL with http: or https: scheme.`);
+	let parsed;
+	try {
+		parsed = new URL(cleaned);
+	} catch {
+		throw new Error(`redirectExternal() received an invalid URL: "${url}"`);
+	}
+	if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) throw new Error(`redirectExternal() received a non-http(s) URL: "${url}". Only http: and https: schemes are allowed for external redirects.`);
+	if (!allowList.includes(parsed.origin)) throw new Error(`redirectExternal() target "${parsed.origin}" is not in the allow-list. Allowed: [${allowList.join(", ")}]`);
+	return parsed.href;
+}
+//#endregion
+export { mergePreservedSearchParams as a, validateNavigationHref as i, isInternalHref as n, validateExternalRedirectUrl as r, assertRelativeRedirectPath as t };
+
+//# sourceMappingURL=href-validation-CMc5JRls.js.map

package/dist/_chunks/href-validation-CMc5JRls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"href-validation-CMc5JRls.js","names":[],"sources":["../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\n/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */\nconst ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\\d+\\-.]*:|\\/\\/)/;\n\n/**\n * Assert that a redirect target is a relative path — rejects absolute and\n * protocol-relative URLs. Used by both the server `redirect()` primitive and\n * the client next/navigation shim so they enforce identical semantics.\n *\n * Normalizes for validation only: strips C0 controls, trims, then replaces\n * backslashes with forward slashes. Browsers normalize \\ → / during URL\n * resolution, so \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open\n * redirect). See design/13-security.md tests #8, #8a–#8c.\n */\nexport function assertRelativeRedirectPath(path: string): void {\n  const cleaned = path.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (ABSOLUTE_URL_RE.test(cleaned)) {\n    throw new Error(\n      `redirect() only accepts relative URLs. Got absolute URL: \"${path}\". ` +\n        'Use redirectExternal(url, allowList) for external redirects.'\n    );\n  }\n\n  // eslint-disable-next-line no-control-regex -- intentional: must match C0 controls\n  if (/[\\x00-\\x1f]/.test(path)) {\n    throw new Error(\n      `redirect() received a path containing control characters (U+0000–U+001F). ` +\n        'Sanitize user input before passing it to redirect().'\n    );\n  }\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG;MACnB,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oCAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAG5E,CAAA,CAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,2BAA2B,MAAoB;CAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAAG;CAEnF,IAAI,gBAAgB,KAAK,OAAO,GAC9B,MAAM,IAAI,MACR,6DAA6D,KAAK,gEAEpE;CAIF,IAAI,cAAc,KAAK,IAAI,GACzB,MAAM,IAAI,MACR,gIAEF;AAEJ;AAEA,IAAM,wCAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}

package/dist/_chunks/json-lossy-check-ClNvBM_3.js

@@ -0,0 +1,63 @@
+//#region src/cache/json-lossy-check.ts
+var LOSSY_TYPES = [
+	"Date",
+	"Map",
+	"Set",
+	"BigInt"
+];
+var hasWarned = false;
+/**
+* Dev-mode warning when a cache value contains types that lose fidelity
+* through JSON round-trip. Only runs in development — no-op in production.
+*
+* Detects: Date (→ ISO string), Map/Set (→ {}), BigInt (→ throws).
+* Emits once per process to avoid log spam.
+*/
+function warnLossyJsonValue(value, cacheKey) {
+	if (hasWarned) return;
+	if (process.env.NODE_ENV === "production") return;
+	const lossy = findLossyTypes(value, /* @__PURE__ */ new Set(), 0);
+	if (lossy.size === 0) return;
+	hasWarned = true;
+	const types = [...lossy].join(", ");
+	console.warn(`[timber] cache value for key "${cacheKey}" contains ${types} — these types lose fidelity through JSON serialization in Redis/KV cache handlers. Date becomes an ISO string, Map/Set become {}, BigInt throws. The MemoryCacheHandler preserves them. Consider transforming values to JSON-safe types before caching, or use MemoryCacheHandler for values that require type preservation.`);
+}
+function findLossyTypes(value, seen, depth) {
+	const lossy = /* @__PURE__ */ new Set();
+	if (depth > 8 || value === null || value === void 0) return lossy;
+	if (typeof value === "bigint") {
+		lossy.add("BigInt");
+		return lossy;
+	}
+	if (typeof value !== "object" && typeof value !== "function") return lossy;
+	if (seen.has(value)) return lossy;
+	seen.add(value);
+	if (value instanceof Date) {
+		lossy.add("Date");
+		return lossy;
+	}
+	if (value instanceof Map) {
+		lossy.add("Map");
+		return lossy;
+	}
+	if (value instanceof Set) {
+		lossy.add("Set");
+		return lossy;
+	}
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			for (const t of findLossyTypes(item, seen, depth + 1)) lossy.add(t);
+			if (lossy.size === LOSSY_TYPES.length) return lossy;
+		}
+		return lossy;
+	}
+	for (const k of Object.keys(value)) {
+		for (const t of findLossyTypes(value[k], seen, depth + 1)) lossy.add(t);
+		if (lossy.size === LOSSY_TYPES.length) return lossy;
+	}
+	return lossy;
+}
+//#endregion
+export { warnLossyJsonValue as t };
+
+//# sourceMappingURL=json-lossy-check-ClNvBM_3.js.map

package/dist/_chunks/json-lossy-check-ClNvBM_3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-lossy-check-ClNvBM_3.js","names":[],"sources":["../../src/cache/json-lossy-check.ts"],"sourcesContent":["const LOSSY_TYPES = ['Date', 'Map', 'Set', 'BigInt'] as const;\n\nlet hasWarned = false;\n\n/**\n * Dev-mode warning when a cache value contains types that lose fidelity\n * through JSON round-trip. Only runs in development — no-op in production.\n *\n * Detects: Date (→ ISO string), Map/Set (→ {}), BigInt (→ throws).\n * Emits once per process to avoid log spam.\n */\nexport function warnLossyJsonValue(value: unknown, cacheKey: string): void {\n  if (hasWarned) return;\n  if (process.env.NODE_ENV === 'production') return;\n\n  const lossy = findLossyTypes(value, new Set(), 0);\n  if (lossy.size === 0) return;\n\n  hasWarned = true;\n  const types = [...lossy].join(', ');\n  console.warn(\n    `[timber] cache value for key \"${cacheKey}\" contains ${types} — ` +\n      'these types lose fidelity through JSON serialization in Redis/KV cache handlers. ' +\n      'Date becomes an ISO string, Map/Set become {}, BigInt throws. ' +\n      'The MemoryCacheHandler preserves them. Consider transforming values ' +\n      'to JSON-safe types before caching, or use MemoryCacheHandler for ' +\n      'values that require type preservation.'\n  );\n}\n\nfunction findLossyTypes(value: unknown, seen: Set<unknown>, depth: number): Set<string> {\n  const lossy = new Set<string>();\n  if (depth > 8 || value === null || value === undefined) return lossy;\n  if (typeof value === 'bigint') {\n    lossy.add('BigInt');\n    return lossy;\n  }\n  if (typeof value !== 'object' && typeof value !== 'function') return lossy;\n  if (seen.has(value)) return lossy;\n  seen.add(value);\n\n  if (value instanceof Date) {\n    lossy.add('Date');\n    return lossy;\n  }\n  if (value instanceof Map) {\n    lossy.add('Map');\n    return lossy;\n  }\n  if (value instanceof Set) {\n    lossy.add('Set');\n    return lossy;\n  }\n\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      for (const t of findLossyTypes(item, seen, depth + 1)) lossy.add(t);\n      if (lossy.size === LOSSY_TYPES.length) return lossy;\n    }\n    return lossy;\n  }\n\n  for (const k of Object.keys(value as Record<string, unknown>)) {\n    for (const t of findLossyTypes((value as Record<string, unknown>)[k], seen, depth + 1)) {\n      lossy.add(t);\n    }\n    if (lossy.size === LOSSY_TYPES.length) return lossy;\n  }\n  return lossy;\n}\n\n/** Reset warning state — for tests only. */\nexport function _resetLossyWarning(): void {\n  hasWarned = false;\n}\n"],"mappings":";AAAA,IAAM,cAAc;CAAC;CAAQ;CAAO;CAAO;AAAQ;AAEnD,IAAI,YAAY;;;;;;;;AAShB,SAAgB,mBAAmB,OAAgB,UAAwB;CACzE,IAAI,WAAW;CACf,IAAA,QAAA,IAAA,aAA6B,cAAc;CAE3C,MAAM,QAAQ,eAAe,uBAAO,IAAI,IAAI,GAAG,CAAC;CAChD,IAAI,MAAM,SAAS,GAAG;CAEtB,YAAY;CACZ,MAAM,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI;CAClC,QAAQ,KACN,iCAAiC,SAAS,aAAa,MAAM,8TAM/D;AACF;AAEA,SAAS,eAAe,OAAgB,MAAoB,OAA4B;CACtF,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,QAAQ,KAAK,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAC/D,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,IAAI,QAAQ;EAClB,OAAO;CACT;CACA,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO;CACrE,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,iBAAiB,MAAM;EACzB,MAAM,IAAI,MAAM;EAChB,OAAO;CACT;CACA,IAAI,iBAAiB,KAAK;EACxB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;CACA,IAAI,iBAAiB,KAAK;EACxB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;CAEA,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,QAAQ,OAAO;GACxB,KAAK,MAAM,KAAK,eAAe,MAAM,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC;GAClE,IAAI,MAAM,SAAS,YAAY,QAAQ,OAAO;EAChD;EACA,OAAO;CACT;CAEA,KAAK,MAAM,KAAK,OAAO,KAAK,KAAgC,GAAG;EAC7D,KAAK,MAAM,KAAK,eAAgB,MAAkC,IAAI,MAAM,QAAQ,CAAC,GACnF,MAAM,IAAI,CAAC;EAEb,IAAI,MAAM,SAAS,YAAY,QAAQ,OAAO;CAChD;CACA,OAAO;AACT"}