@timber-js/app 0.2.0-alpha.191 → 0.2.0-alpha.194

package/dist/_chunks/{mdx-file-C005ay-P.js → mdx-file-CXyHGUpS.js}

@@ -9,7 +9,7 @@
 *
 * See design/10-error-handling.md §"Status-Code File Variants".
 */
-/** MDX/markdown extensions — server components by default. */
+/** MDX/markdown extensions (dotted) — the canonical list, also used by plugins/mdx.ts. */
 var MDX_EXTENSIONS = /* @__PURE__ */ new Set([".mdx", ".md"]);
 /**
 * Check if a file path ends with an MDX/markdown extension.
@@ -20,6 +20,6 @@ function isMdxFilePath(filePath) {
 	return MDX_EXTENSIONS.has(filePath.slice(dotIndex));
 }
 //#endregion
-export { isMdxFilePath as t };
+export { isMdxFilePath as n, MDX_EXTENSIONS as t };
 
-//# sourceMappingURL=mdx-file-C005ay-P.js.map
+//# sourceMappingURL=mdx-file-CXyHGUpS.js.map

package/dist/_chunks/mdx-file-CXyHGUpS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdx-file-CXyHGUpS.js","names":[],"sources":["../../src/server/utils/mdx-file.ts"],"sourcesContent":["/**\n * MDX file-path detection shared by error/deny rendering paths.\n *\n * MDX status and error files are server components — they cannot be passed\n * as function props across the RSC→client boundary (e.g. to\n * TimberErrorBoundary or ErrorReconstituter) and must be pre-rendered as\n * elements with plain props instead.\n *\n * See design/10-error-handling.md §\"Status-Code File Variants\".\n */\n\n/** MDX/markdown extensions (dotted) — the canonical list, also used by plugins/mdx.ts. */\nexport const MDX_EXTENSIONS = new Set(['.mdx', '.md']);\n\n/**\n * Check if a file path ends with an MDX/markdown extension.\n */\nexport function isMdxFilePath(filePath: string): boolean {\n  const dotIndex = filePath.lastIndexOf('.');\n  if (dotIndex === -1) return false;\n  return MDX_EXTENSIONS.has(filePath.slice(dotIndex));\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,iCAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;;;;AAKrD,SAAgB,cAAc,UAA2B;CACvD,MAAM,WAAW,SAAS,YAAY,GAAG;CACzC,IAAI,aAAa,IAAI,OAAO;CAC5B,OAAO,eAAe,IAAI,SAAS,MAAM,QAAQ,CAAC;AACpD"}

package/dist/_chunks/{plugin-context-rCinWLiE.js → plugin-context-8idfR3UZ.js}

@@ -1,4 +1,4 @@
-import { o as __exportAll } from "./dist-BA3u1z3W.js";
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { parseAst } from "vite";
 import { join, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -318,4 +318,4 @@ function mergeFileConfig(inline, fileConfig) {
 //#endregion
 export { plugin_context_exports as a, resolveClientJavascript as c, mergeFileConfig as i, createNoopTimer as l, isTimberPluginApi as n, resolveAppDir as o, loadTimberConfigFile as r, resolveBuildDir as s, createPluginContext as t };
 
-//# sourceMappingURL=plugin-context-rCinWLiE.js.map
+//# sourceMappingURL=plugin-context-8idfR3UZ.js.map

package/dist/_chunks/plugin-context-8idfR3UZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-context-8idfR3UZ.js","names":[],"sources":["../../src/utils/startup-timer.ts","../../src/plugin-context.ts"],"sourcesContent":["/**\n * Startup timer — records named phases with their durations.\n *\n * Used by the plugin system to instrument cold start and report a\n * timing breakdown in dev mode. Zero overhead in production (disabled).\n *\n * See design/18-build-system.md, TIM-155.\n */\n\nimport { performance } from 'node:perf_hooks';\n\nexport interface PhaseRecord {\n  name: string;\n  startMs: number;\n  durationMs: number;\n}\n\nexport interface StartupTimer {\n  /** Mark the beginning of a named phase. */\n  start(phase: string): void;\n  /** Mark the end of a named phase. Returns duration in ms. */\n  end(phase: string): number;\n  /** Get all completed phase records, ordered by start time. */\n  getPhases(): PhaseRecord[];\n  /** Total elapsed time from first start() to last end(). */\n  totalMs(): number;\n  /** Format a human-readable summary string. */\n  formatSummary(): string;\n}\n\n/**\n * Create a startup timer that records phase durations.\n */\nexport function createStartupTimer(): StartupTimer {\n  const pending = new Map<string, number>();\n  const phases: PhaseRecord[] = [];\n\n  return {\n    start(phase: string): void {\n      pending.set(phase, performance.now());\n    },\n\n    end(phase: string): number {\n      const startMs = pending.get(phase);\n      if (startMs === undefined) {\n        return 0;\n      }\n      pending.delete(phase);\n      const durationMs = performance.now() - startMs;\n      phases.push({ name: phase, startMs, durationMs });\n      return durationMs;\n    },\n\n    getPhases(): PhaseRecord[] {\n      return [...phases].sort((a, b) => a.startMs - b.startMs);\n    },\n\n    totalMs(): number {\n      if (phases.length === 0) return 0;\n      const sorted = this.getPhases();\n      const first = sorted[0];\n      const last = sorted[sorted.length - 1];\n      return last.startMs + last.durationMs - first.startMs;\n    },\n\n    formatSummary(): string {\n      const sorted = this.getPhases();\n      if (sorted.length === 0) return 'No phases recorded.';\n\n      const lines = sorted.map((p) => {\n        const ms = p.durationMs.toFixed(1);\n        return `  ${p.name.padEnd(30)} ${ms.padStart(8)}ms`;\n      });\n\n      const total = this.totalMs().toFixed(1);\n      lines.push(`  ${'total'.padEnd(30)} ${total.padStart(8)}ms`);\n\n      return ['[timber] startup timing:', ...lines].join('\\n');\n    },\n  };\n}\n\n/**\n * No-op timer for production builds — all methods are empty.\n */\nexport function createNoopTimer(): StartupTimer {\n  return {\n    start() {},\n    end() {\n      return 0;\n    },\n    getPhases() {\n      return [];\n    },\n    totalMs() {\n      return 0;\n    },\n    formatSummary() {\n      return '';\n    },\n  };\n}\n","/**\n * Plugin context — internal types and helpers for timber sub-plugins.\n *\n * These are NOT part of the user-facing API. They are consumed by\n * sub-plugins (routing, entries, shims, etc.) via relative imports.\n * The root entry point (index.ts) does not re-export them.\n *\n * Design doc: 18-build-system.md §\"Shared Plugin Context\"\n */\n\nimport { existsSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { createRequire } from 'node:module';\nimport { parseAst } from 'vite';\nimport type { RouteTree } from './routing/types.ts';\nimport type { BuildManifest } from './server/build-manifest.ts';\nimport type { CaptureSummary } from './server/prebuilt-builder.ts';\nimport type { StartupTimer } from './utils/startup-timer.ts';\nimport { createStartupTimer } from './utils/startup-timer.ts';\nimport type { TimberUserConfig, ClientJavascriptConfig } from './config-types.ts';\nimport type { RscManifest } from './plugins/static-build.ts';\nimport type { HoldingServer } from './dev-tools/holding-server.ts';\nimport type { ProgramNode } from './plugins/callsite-ast.ts';\n\n// Re-export for sub-plugin convenience — they import from plugin-context.ts\nexport type { TimberUserConfig, ClientJavascriptConfig } from './config-types.ts';\n\n// ── Client JavaScript config ─────────────────────────────────────────────\n\n/** Fully resolved client JavaScript configuration (no optionals). */\nexport interface ResolvedClientJavascript {\n  disabled: boolean;\n  enableHMRInDev: boolean;\n}\n\n/**\n * Resolve `clientJavascript` into a fully resolved config.\n */\nexport function resolveClientJavascript(config: TimberUserConfig): ResolvedClientJavascript {\n  if (config.clientJavascript !== undefined) {\n    if (typeof config.clientJavascript === 'boolean') {\n      return {\n        disabled: !config.clientJavascript,\n        enableHMRInDev: !config.clientJavascript,\n      };\n    }\n    return {\n      disabled: config.clientJavascript.disabled,\n      enableHMRInDev: config.clientJavascript.enableHMRInDev ?? config.clientJavascript.disabled,\n    };\n  }\n  return { disabled: false, enableHMRInDev: false };\n}\n\n// ── Plugin Context ────────────────────────────────────────────────────────\n\n/**\n * Shared context object passed to all sub-plugins via closure.\n *\n * Sub-plugins communicate through this context — not through Vite's\n * plugin API or global state.\n * See design/18-build-system.md §\"Shared Plugin Context\".\n */\nexport interface PluginContext {\n  config: TimberUserConfig;\n  /** Resolved client JavaScript configuration */\n  clientJavascript: ResolvedClientJavascript;\n  /** The scanned route tree (populated by timber-routing, consumed by timber-entries) */\n  routeTree: RouteTree | null;\n  /** Absolute path to the app/ directory */\n  appDir: string;\n  /** Absolute path to the project root */\n  root: string;\n  /** Whether the dev server is running (set by timber-root-sync in configResolved) */\n  dev: boolean;\n  /**\n   * Vite's resolved `base` (set by timber-root-sync in configResolved).\n   * Always has a trailing slash; `'/'` unless the app is deployed under a\n   * sub-path. Every URL the framework emits — assets, fonts, RSC payloads —\n   * carries this prefix. This is the single copy: sub-plugins read it here\n   * rather than capturing `config.base` in their own configResolved.\n   *\n   * **Availability:** written by timber-root-sync, which has no `enforce`, so\n   * it is populated from `buildStart`/`load`/`generateBundle`/`configureServer`\n   * onward — but NOT during the `configResolved` of an `enforce: 'pre'`\n   * plugin, which Vite runs first. A pre plugin that needs the base inside\n   * its own `configResolved` must read `config.base` there (timber-fonts\n   * does). See TIM-1261.\n   */\n  base: string;\n  /** CSS build manifest (populated by adapter after client build, null in dev) */\n  buildManifest: BuildManifest | null;\n  /** Per-build deployment ID for version skew detection (null in dev) */\n  deploymentId: string | null;\n  /** Startup timer for profiling cold start phases (active in dev, no-op in prod) */\n  timer: StartupTimer;\n  /** Holding server that binds the port during dev startup (closed in timber-dev-server) */\n  holdingServer?: HoldingServer | null;\n  /**\n   * Resolved absolute path to the build output directory.\n   *\n   * Defaults to `<root>/.timber/dist`. Can be overridden via\n   * `timber.config.ts` `buildDir` or Vite's `build.outDir`.\n   * Timber config takes precedence when both are set.\n   *\n   * Used by adapter-build and cli preview.\n   */\n  buildDir: string;\n  /**\n   * Per-route client reference keys captured during the RSC build.\n   * Maps absolute route file paths to the set of client reference\n   * hash keys they transitively import. Used by adapter-build to\n   * populate per-route modulepreload entries from clientReferenceDeps.\n   */\n  routeClientRefKeys?: Map<string, Set<string>>;\n  /**\n   * Static request-dependency verdict per segment entry file, keyed by the\n   * absolute `filePath` the route scanner produced. Computed once by\n   * `timber-request-dep`'s RSC `buildEnd` and serialized into\n   * `buildManifest.requestDep` by `timber-build-manifest` (build only — dev\n   * answers the same question through the `Symbol.for('timber:request-dep')`\n   * bridge instead).\n   *\n   * `undefined` and `{}` are different states and the difference is the whole\n   * of TIM-1300: an empty object means the analysis ran and found no segments,\n   * `undefined` means it never ran, and the runtime cannot tell them apart —\n   * every key is absent either way, so every segment falls to the conservative\n   * `true` and nothing is ever skipped. The build fails loudly on `undefined`\n   * rather than shipping that silently.\n   */\n  requestDepMap?: Record<string, boolean>;\n  /**\n   * Maps absolute module IDs of client references in non-facade RSC\n   * chunks to the absolute paths of their consuming facade modules.\n   * Built during the RSC `generateBundle` phase by timber-chunks,\n   * consumed by `clientChunkGroup` to reclassify `shared:` modules\n   * that are only used by a single route boundary.\n   * See design/27-chunking-strategy.md, TIM-1107.\n   */\n  sharedModuleFacades?: Map<string, string[]>;\n  /**\n   * Module ID → prebuilt component IDs declared in it. Recorded by the\n   * timber-prebuilt transform (RSC environment, production builds only),\n   * consumed by the RSC `generateBundle` module-graph walk that computes\n   * `routePrebuiltComponents`. See design/44-render-at-build-time.md.\n   */\n  prebuiltModuleComponents?: Map<string, string[]>;\n  /**\n   * Module ID → mapping of variable name to component ID for the prebuilt\n   * components declared in that module. Used at `generateBundle` time to\n   * trace imports from other modules back to specific component IDs.\n   */\n  prebuiltBindingNames?: Map<string, Map<string, string>>;\n  /**\n   * Component ID → distinct static call-site prop objects captured from\n   * JSX usage sites during the transform and generateBundle phases.\n   * Consumed by the post-build capture pass to render with actual props\n   * instead of empty `{}`. See design/44 §Props Derivation.\n   */\n  prebuiltCallSiteProps?: Map<string, Record<string, unknown>[]>;\n  /**\n   * Route file path (page or layout, absolute) → prebuilt component IDs\n   * transitively reachable from it. Computed during RSC `generateBundle`,\n   * consumed by the post-build capture pass (TIM-1119) to decide which\n   * components to render under which route's param combos.\n   */\n  routePrebuiltComponents?: Map<string, string[]>;\n  /**\n   * Page file paths that were desugared from `export const prerender` by\n   * timber-prerender-sugar. The prebuilt transform uses this to verify\n   * the generated `cache.component(...)` call was picked up.\n   */\n  prerenderSugarPages?: Set<string>;\n  /**\n   * Component ID → built chunk file name for prebuilt-declaring modules\n   * that are only reachable via dynamic imports (import.meta.glob, lazy\n   * routes). The capture pass imports these chunks to trigger\n   * cache.component() registration before rendering. Populated during\n   * RSC generateBundle alongside routePrebuiltComponents.\n   */\n  prebuiltLazyChunks?: Map<string, string>;\n  /** Post-build prebuilt capture summary (populated by timber-prebuilt, consumed by build-report). */\n  captureSummary?: CaptureSummary;\n  /**\n   * Content-keyed AST parse memo shared across cache/prebuilt/prerender-sugar\n   * transforms. Collapses both cross-plugin and cross-environment duplicate\n   * parses: identical code hits, rewritten code misses (correct because Vite\n   * transforms chain — a rewrite produces different code). Bounded LRU (32\n   * entries) so it doesn't hold programs for the whole build.\n   *\n   * Consumers MUST treat the returned ProgramNode as read-only — they collect\n   * ranges and rewrite CODE via MagicString; the AST itself is never mutated.\n   */\n  parseCached?: ParseMemo;\n  /**\n   * Content-Type mappings for extensionless static API route outputs.\n   * Populated during static generation, consumed by adapter-build to\n   * write per-path Content-Type rules in _headers. See TIM-1241.\n   */\n  staticContentTypes?: Record<string, string>;\n  /**\n   * RSC flight payload manifest mapping unhashed → hashed URLs.\n   * Populated during static generation, consumed by adapters to set\n   * immutable cache headers for `_rsc/` files. See TIM-1254.\n   */\n  rscManifest?: RscManifest;\n}\n\n// ── AST parse memo ───────────────────────────────────────────────────────\n\nconst PARSE_MEMO_CAPACITY = 32;\n\n/**\n * Content-keyed LRU memo for `parseAst`. Transforms for the same module run\n * back-to-back across plugins and environments, so a tiny window captures the\n * wins. The returned ProgramNode is shared — callers MUST NOT mutate it.\n */\nexport class ParseMemo {\n  private cache = new Map<string, ProgramNode>();\n\n  /**\n   * Parse code, returning a cached ProgramNode if the same code was parsed\n   * before. The returned AST MUST NOT be mutated — it may be shared across\n   * multiple consumers.\n   */\n  parse(code: string): ProgramNode {\n    const existing = this.cache.get(code);\n    if (existing) {\n      // LRU refresh: move to end\n      this.cache.delete(code);\n      this.cache.set(code, existing);\n      return existing;\n    }\n    const program = parseAst(code, { lang: 'tsx' }) as unknown as ProgramNode;\n    if (this.cache.size >= PARSE_MEMO_CAPACITY) {\n      // Evict oldest (first inserted)\n      const firstKey = this.cache.keys().next().value!;\n      this.cache.delete(firstKey);\n    }\n    this.cache.set(code, program);\n    return program;\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ── App directory resolution ──────────────────────────────────────────────\n\n// ── Plugin API (Vite `plugin.api`) ────────────────────────────────────────\n\n/**\n * What `timber-root-sync` publishes on its Vite `plugin.api`.\n *\n * The single supported way to read timber's *resolved* configuration from\n * outside the plugin pipeline. Re-reading `timber.config.ts` is not equivalent:\n * config passed inline as `timber({ ... })` in `vite.config.ts` exists only in\n * the plugin's closure, and `root`/`appDir` are resolved against Vite's root\n * rather than the caller's cwd.\n */\nexport interface TimberPluginApi {\n  /** The live plugin context. Fully populated from `configResolved` onward. */\n  getContext(): PluginContext;\n}\n\n/** Narrow an unknown Vite `plugin.api` to timber's. */\nexport function isTimberPluginApi(api: unknown): api is TimberPluginApi {\n  return (\n    typeof api === 'object' &&\n    api !== null &&\n    'getContext' in api &&\n    typeof api.getContext === 'function'\n  );\n}\n\n/**\n * Resolve the app directory. Checks (in order):\n * 1. Explicit `configAppDir` from timber.config.ts\n * 2. `<root>/app`\n * 3. `<root>/src/app`\n *\n * Throws if none exist.\n */\nexport function resolveAppDir(root: string, configAppDir?: string): string {\n  if (configAppDir) {\n    const explicit = join(root, configAppDir);\n    if (!existsSync(explicit)) {\n      throw new Error(`[timber] Configured appDir \"${configAppDir}\" does not exist at ${explicit}`);\n    }\n    return explicit;\n  }\n\n  const rootApp = join(root, 'app');\n  if (existsSync(rootApp)) return rootApp;\n\n  const srcApp = join(root, 'src', 'app');\n  if (existsSync(srcApp)) return srcApp;\n\n  throw new Error(\n    `[timber] Could not find app directory. Expected \"app/\" or \"src/app/\" in ${root}. ` +\n      `You can set appDir in timber.config.ts to specify a custom location.`\n  );\n}\n\n// ── Plugin context factory ────────────────────────────────────────────────\n\nexport function createPluginContext(config?: TimberUserConfig, root?: string): PluginContext {\n  const projectRoot = root ?? process.cwd();\n  const resolvedConfig: TimberUserConfig = { ...config };\n  return {\n    config: resolvedConfig,\n    clientJavascript: resolveClientJavascript(resolvedConfig),\n    routeTree: null,\n    appDir: join(projectRoot, 'app'),\n    root: projectRoot,\n    dev: false,\n    base: '/',\n    buildManifest: null,\n    deploymentId: null,\n    timer: createStartupTimer(),\n    holdingServer: null,\n    buildDir: resolveBuildDir(projectRoot, resolvedConfig.buildDir),\n    parseCached: new ParseMemo(),\n  };\n}\n\n// ── Build directory resolution ────────────────────────────────────────────\n\n/** Default build output directory (relative to root). */\nexport const DEFAULT_BUILD_DIR = join('.timber', 'dist');\n\n/**\n * Resolve the build output directory.\n *\n * Priority:\n * 1. Explicit `timberBuildDir` from timber.config.ts\n * 2. Explicit `viteBuildOutDir` from Vite's build.outDir (if not the default 'dist')\n * 3. Default: `.timber/dist`\n *\n * Returns an absolute path.\n */\nexport function resolveBuildDir(\n  root: string,\n  timberBuildDir?: string,\n  viteBuildOutDir?: string\n): string {\n  if (timberBuildDir) {\n    return resolve(root, timberBuildDir);\n  }\n  if (viteBuildOutDir && viteBuildOutDir !== 'dist') {\n    return resolve(root, viteBuildOutDir);\n  }\n  return join(root, DEFAULT_BUILD_DIR);\n}\n\n// ── Config file loading ───────────────────────────────────────────────────\n\n/**\n * Map known timber.config load failures to actionable hints (TIM-1040).\n * Returns null when the error has no known remedy beyond its own message.\n *\n * Known failure modes of loading timber.config.ts via native require():\n * - Node < 22.18 has no default type stripping → ERR_UNKNOWN_FILE_EXTENSION\n * - Non-erasable TS syntax (enums, namespaces, parameter properties)\n *   → ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX / ERR_INVALID_TYPESCRIPT_SYNTAX\n * - ESM syntax in a `\"type\": \"commonjs\"` package → the stripped .ts is\n *   parsed as CJS and throws SyntaxError: \"Unexpected token 'export'\"\n *   (export statements) or \"Cannot use import statement outside a\n *   module\" (import statements)\n */\nexport function configLoadHint(configName: string, err: unknown): string | null {\n  const code = (err as NodeJS.ErrnoException | null)?.code;\n  const isTs = configName.endsWith('.ts');\n\n  if (isTs && code === 'ERR_UNKNOWN_FILE_EXTENSION') {\n    return (\n      'Loading a TypeScript config requires Node.js 22.18+ (built-in type stripping). ' +\n      'Upgrade Node.js or rewrite the config as timber.config.js.'\n    );\n  }\n  if (code === 'ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX' || code === 'ERR_INVALID_TYPESCRIPT_SYNTAX') {\n    return (\n      'Node.js loads the config with type stripping, which only supports erasable TypeScript syntax — ' +\n      'replace enums, namespaces, and constructor parameter properties with plain objects and types.'\n    );\n  }\n  if (\n    isTs &&\n    err instanceof SyntaxError &&\n    /Unexpected token '(export|import)'|Cannot use import statement outside a module/.test(\n      err.message\n    )\n  ) {\n    return (\n      'The config uses ESM syntax but Node.js parsed it as CommonJS — ' +\n      'set \"type\": \"module\" in package.json, or use module.exports instead of export default.'\n    );\n  }\n  return null;\n}\n\n/**\n * Load timber.config.ts (or .js, .mjs) from the project root.\n * Returns the config object or null if no config file is found.\n * Throws a descriptive error naming the file when a config file exists\n * but fails to load — a broken config must fail loudly, never silently\n * degrade (see TIM-1066). Known failure modes get an actionable hint\n * appended (see configLoadHint, TIM-1040).\n *\n * Uses require() — Node 22.12+ can require() ESM modules, and Node\n * 22.18+ strips types from .ts files by default (hence the engines\n * field requiring >=22.18.0). This keeps timber() synchronous — no\n * async config loading needed.\n * This is the single config loader — dev, build, and preview all use it.\n */\nexport function loadTimberConfigFile(root: string): TimberUserConfig | null {\n  const configNames = ['timber.config.ts', 'timber.config.js', 'timber.config.mjs'];\n  const req = createRequire(join(root, 'package.json'));\n\n  for (const name of configNames) {\n    const configPath = join(root, name);\n    if (existsSync(configPath)) {\n      try {\n        const mod = req(configPath);\n        return (mod.default ?? mod) as TimberUserConfig;\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        const hint = configLoadHint(name, err);\n        throw new Error(\n          `[timber] Failed to load ${configPath}: ${message}${hint ? `\\n${hint}` : ''}`,\n          { cause: err }\n        );\n      }\n    }\n  }\n  return null;\n}\n\n/**\n * Detect config keys set in both inline (vite.config.ts) and file (timber.config.ts)\n * and warn the user. The `output` key is excluded because it defaults to 'server'\n * in createPluginContext and would always appear as an inline key.\n *\n * Returns the list of conflicting key names (for testing).\n */\nexport function warnConfigConflicts(\n  inline: TimberUserConfig,\n  fileConfig: TimberUserConfig\n): string[] {\n  const conflicts: string[] = [];\n  for (const key of Object.keys(fileConfig) as (keyof TimberUserConfig)[]) {\n    if (key in inline && inline[key] !== undefined) {\n      conflicts.push(key);\n    }\n  }\n  if (conflicts.length > 0) {\n    console.warn(\n      `[timber] Config conflict: ${conflicts.map((k) => `\"${k}\"`).join(', ')} set in both ` +\n        `vite.config.ts (inline) and timber.config.ts. ` +\n        `Move all config to timber.config.ts to avoid confusion. ` +\n        `The inline value from vite.config.ts will be used.`\n    );\n  }\n  return conflicts;\n}\n\n/**\n * Drop own keys whose value is `undefined` so they don't clobber file\n * config during spread merging. `timber({ buildDir: process.env.BUILD_DIR })`\n * with the var unset must not erase the timber.config.ts value.\n */\nfunction stripUndefined<T extends object>(obj: T): T {\n  return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined)) as T;\n}\n\n/**\n * Merge file-based config (timber.config.ts) with inline config (vite.config.ts).\n * Inline config takes precedence — file config only fills in missing fields.\n * Inline keys explicitly set to `undefined` are treated as absent, matching\n * the `!== undefined` check in warnConfigConflicts.\n */\nexport function mergeFileConfig(\n  inline: TimberUserConfig,\n  fileConfig: TimberUserConfig\n): TimberUserConfig {\n  warnConfigConflicts(inline, fileConfig);\n  const definedInline = stripUndefined(inline);\n\n  return {\n    ...fileConfig,\n    ...definedInline,\n    ...(fileConfig.limits && definedInline.limits\n      ? { limits: { ...fileConfig.limits, ...stripUndefined(definedInline.limits) } }\n      : {}),\n    ...(fileConfig.dev && definedInline.dev\n      ? { dev: { ...fileConfig.dev, ...stripUndefined(definedInline.dev) } }\n      : {}),\n    ...(fileConfig.mdx && definedInline.mdx\n      ? { mdx: { ...fileConfig.mdx, ...stripUndefined(definedInline.mdx) } }\n      : {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,SAAgB,qBAAmC;CACjD,MAAM,0BAAU,IAAI,IAAoB;CACxC,MAAM,SAAwB,CAAC;CAE/B,OAAO;EACL,MAAM,OAAqB;GACzB,QAAQ,IAAI,OAAO,YAAY,IAAI,CAAC;EACtC;EAEA,IAAI,OAAuB;GACzB,MAAM,UAAU,QAAQ,IAAI,KAAK;GACjC,IAAI,YAAY,KAAA,GACd,OAAO;GAET,QAAQ,OAAO,KAAK;GACpB,MAAM,aAAa,YAAY,IAAI,IAAI;GACvC,OAAO,KAAK;IAAE,MAAM;IAAO;IAAS;GAAW,CAAC;GAChD,OAAO;EACT;EAEA,YAA2B;GACzB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;EACzD;EAEA,UAAkB;GAChB,IAAI,OAAO,WAAW,GAAG,OAAO;GAChC,MAAM,SAAS,KAAK,UAAU;GAC9B,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS;GACpC,OAAO,KAAK,UAAU,KAAK,aAAa,MAAM;EAChD;EAEA,gBAAwB;GACtB,MAAM,SAAS,KAAK,UAAU;GAC9B,IAAI,OAAO,WAAW,GAAG,OAAO;GAEhC,MAAM,QAAQ,OAAO,KAAK,MAAM;IAC9B,MAAM,KAAK,EAAE,WAAW,QAAQ,CAAC;IACjC,OAAO,KAAK,EAAE,KAAK,OAAO,EAAE,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE;GAClD,CAAC;GAED,MAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ,CAAC;GACtC,MAAM,KAAK,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG;GAE3D,OAAO,CAAC,4BAA4B,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI;EACzD;CACF;AACF;;;;AAKA,SAAgB,kBAAgC;CAC9C,OAAO;EACL,QAAQ,CAAC;EACT,MAAM;GACJ,OAAO;EACT;EACA,YAAY;GACV,OAAO,CAAC;EACV;EACA,UAAU;GACR,OAAO;EACT;EACA,gBAAgB;GACd,OAAO;EACT;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/DA,SAAgB,wBAAwB,QAAoD;CAC1F,IAAI,OAAO,qBAAqB,KAAA,GAAW;EACzC,IAAI,OAAO,OAAO,qBAAqB,WACrC,OAAO;GACL,UAAU,CAAC,OAAO;GAClB,gBAAgB,CAAC,OAAO;EAC1B;EAEF,OAAO;GACL,UAAU,OAAO,iBAAiB;GAClC,gBAAgB,OAAO,iBAAiB,kBAAkB,OAAO,iBAAiB;EACpF;CACF;CACA,OAAO;EAAE,UAAU;EAAO,gBAAgB;CAAM;AAClD;AA8JA,IAAM,sBAAsB;;;;;;AAO5B,IAAa,YAAb,MAAuB;CACrB,wBAAgB,IAAI,IAAyB;;;;;;CAO7C,MAAM,MAA2B;EAC/B,MAAM,WAAW,KAAK,MAAM,IAAI,IAAI;EACpC,IAAI,UAAU;GAEZ,KAAK,MAAM,OAAO,IAAI;GACtB,KAAK,MAAM,IAAI,MAAM,QAAQ;GAC7B,OAAO;EACT;EACA,MAAM,UAAU,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC;EAC9C,IAAI,KAAK,MAAM,QAAQ,qBAAqB;GAE1C,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,KAAK,MAAM,OAAO,QAAQ;EAC5B;EACA,KAAK,MAAM,IAAI,MAAM,OAAO;EAC5B,OAAO;CACT;CAEA,IAAI,OAAe;EACjB,OAAO,KAAK,MAAM;CACpB;AACF;;AAqBA,SAAgB,kBAAkB,KAAsC;CACtE,OACE,OAAO,QAAQ,YACf,QAAQ,QACR,gBAAgB,OAChB,OAAO,IAAI,eAAe;AAE9B;;;;;;;;;AAUA,SAAgB,cAAc,MAAc,cAA+B;CACzE,IAAI,cAAc;EAChB,MAAM,WAAW,KAAK,MAAM,YAAY;EACxC,IAAI,CAAC,WAAW,QAAQ,GACtB,MAAM,IAAI,MAAM,+BAA+B,aAAa,sBAAsB,UAAU;EAE9F,OAAO;CACT;CAEA,MAAM,UAAU,KAAK,MAAM,KAAK;CAChC,IAAI,WAAW,OAAO,GAAG,OAAO;CAEhC,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK;CACtC,IAAI,WAAW,MAAM,GAAG,OAAO;CAE/B,MAAM,IAAI,MACR,2EAA2E,KAAK,uEAElF;AACF;AAIA,SAAgB,oBAAoB,QAA2B,MAA8B;CAC3F,MAAM,cAAc,QAAQ,QAAQ,IAAI;CACxC,MAAM,iBAAmC,EAAE,GAAG,OAAO;CACrD,OAAO;EACL,QAAQ;EACR,kBAAkB,wBAAwB,cAAc;EACxD,WAAW;EACX,QAAQ,KAAK,aAAa,KAAK;EAC/B,MAAM;EACN,KAAK;EACL,MAAM;EACN,eAAe;EACf,cAAc;EACd,OAAO,mBAAmB;EAC1B,eAAe;EACf,UAAU,gBAAgB,aAAa,eAAe,QAAQ;EAC9D,aAAa,IAAI,UAAU;CAC7B;AACF;;AAKA,IAAa,oBAAoB,KAAK,WAAW,MAAM;;;;;;;;;;;AAYvD,SAAgB,gBACd,MACA,gBACA,iBACQ;CACR,IAAI,gBACF,OAAO,QAAQ,MAAM,cAAc;CAErC,IAAI,mBAAmB,oBAAoB,QACzC,OAAO,QAAQ,MAAM,eAAe;CAEtC,OAAO,KAAK,MAAM,iBAAiB;AACrC;;;;;;;;;;;;;;AAiBA,SAAgB,eAAe,YAAoB,KAA6B;CAC9E,MAAM,OAAQ,KAAsC;CACpD,MAAM,OAAO,WAAW,SAAS,KAAK;CAEtC,IAAI,QAAQ,SAAS,8BACnB,OACE;CAIJ,IAAI,SAAS,uCAAuC,SAAS,iCAC3D,OACE;CAIJ,IACE,QACA,eAAe,eACf,kFAAkF,KAChF,IAAI,OACN,GAEA,OACE;CAIJ,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAgB,qBAAqB,MAAuC;CAC1E,MAAM,cAAc;EAAC;EAAoB;EAAoB;CAAmB;CAChF,MAAM,MAAM,cAAc,KAAK,MAAM,cAAc,CAAC;CAEpD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,aAAa,KAAK,MAAM,IAAI;EAClC,IAAI,WAAW,UAAU,GACvB,IAAI;GACF,MAAM,MAAM,IAAI,UAAU;GAC1B,OAAQ,IAAI,WAAW;EACzB,SAAS,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC/D,MAAM,OAAO,eAAe,MAAM,GAAG;GACrC,MAAM,IAAI,MACR,2BAA2B,WAAW,IAAI,UAAU,OAAO,KAAK,SAAS,MACzE,EAAE,OAAO,IAAI,CACf;EACF;CAEJ;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,oBACd,QACA,YACU;CACV,MAAM,YAAsB,CAAC;CAC7B,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GACtC,IAAI,OAAO,UAAU,OAAO,SAAS,KAAA,GACnC,UAAU,KAAK,GAAG;CAGtB,IAAI,UAAU,SAAS,GACrB,QAAQ,KACN,6BAA6B,UAAU,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,sKAIzE;CAEF,OAAO;AACT;;;;;;AAOA,SAAS,eAAiC,KAAW;CACnD,OAAO,OAAO,YAAY,OAAO,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AAClF;;;;;;;AAQA,SAAgB,gBACd,QACA,YACkB;CAClB,oBAAoB,QAAQ,UAAU;CACtC,MAAM,gBAAgB,eAAe,MAAM;CAE3C,OAAO;EACL,GAAG;EACH,GAAG;EACH,GAAI,WAAW,UAAU,cAAc,SACnC,EAAE,QAAQ;GAAE,GAAG,WAAW;GAAQ,GAAG,eAAe,cAAc,MAAM;EAAE,EAAE,IAC5E,CAAC;EACL,GAAI,WAAW,OAAO,cAAc,MAChC,EAAE,KAAK;GAAE,GAAG,WAAW;GAAK,GAAG,eAAe,cAAc,GAAG;EAAE,EAAE,IACnE,CAAC;EACL,GAAI,WAAW,OAAO,cAAc,MAChC,EAAE,KAAK;GAAE,GAAG,WAAW;GAAK,GAAG,eAAe,cAAc,GAAG;EAAE,EAAE,IACnE,CAAC;CACP;AACF"}

package/dist/_chunks/poison-rules-DoEhbqaY.js

@@ -0,0 +1,110 @@
+import { isBuiltin } from "node:module";
+//#region src/analyze/poison-rules.ts
+/**
+* poison-rules — single source of truth for server-only / client-only
+* module rules.
+*
+* Two tiers with different enforcement policies (design/47 §3):
+*
+* 1. **Explicit markers** (`server-only`, `client-only`) — evaluation-time
+*    poison pills. `plugins/shims.ts` resolves them to virtual modules
+*    whose body is a top-level `throw` in the wrong environment and a
+*    silent no-op in the right one. The error fires when the module is
+*    evaluated, not at resolve time.
+*
+* 2. **Inferred rules** (`node:*` imports, timber's ALS modules, browser
+*    globals) — report-only. They have legitimate false positives
+*    (`import.meta.env.SSR`-guarded `node:*` use, conditionally-imported
+*    packages), so erroring the build on them would refuse working apps.
+*    The `timber graph` reporter surfaces them as hints.
+*
+* Both shims.ts and the reporter consume this module so the two surfaces
+* can never disagree. Promoting inferred rules to build errors is a
+* policy flip on this list, never a new rule set.
+*
+* Design doc: 47-module-environment-tooling.md §3.
+*/
+var EXPLICIT_MARKERS = [{
+	specifier: "server-only",
+	virtualId: "\0timber:server-only",
+	violatesIn: (env) => env === "client",
+	errorMessage: "This module cannot be imported from a Client Component module. It should only be used from a Server Component.",
+	enforcement: "poison-pill"
+}, {
+	specifier: "client-only",
+	virtualId: "\0timber:client-only",
+	violatesIn: (env) => env !== "client",
+	errorMessage: "This module cannot be imported from a Server Component module. It should only be used from a Client Component.",
+	enforcement: "poison-pill"
+}];
+/**
+* Look up an explicit marker by its import specifier. Throws on an
+* unknown specifier — callers reference rules that must exist, and a
+* silent undefined would just defer the failure.
+*/
+function markerFor(specifier) {
+	const marker = EXPLICIT_MARKERS.find((m) => m.specifier === specifier);
+	if (!marker) throw new Error(`[timber] unknown poison marker: ${specifier}`);
+	return marker;
+}
+/**
+* Generate the virtual module body for an explicit marker in `env`:
+* a top-level throw in the wrong environment, a no-op otherwise.
+*/
+function poisonPillSource(marker, env) {
+	if (marker.violatesIn(env)) return `throw new Error(${JSON.stringify(marker.errorMessage)});`;
+	return "export {};";
+}
+/**
+* Timber modules that hold per-request AsyncLocalStorage state. Importing
+* one from client-reachable code is a strong server-only signal — cf. the
+* no-server-imports-in-isomorphic-define-modules rule.
+*/
+var ALS_MODULE_SPECIFIERS = /* @__PURE__ */ new Set([
+	"@timber-js/app/server",
+	"@timber-js/app/server/internal",
+	"#server-internal"
+]);
+/**
+* The ALS registry module itself, as it appears in import sources.
+* Framework code imports it ESM-style with a `.js` specifier — both
+* `../server/als-registry.js` and sibling `./als-registry.js` forms
+* exist throughout src/server — while resolved module ids carry `.ts`.
+* Matching any path ending in the basename is deliberate: the rule is
+* report-only, and a user file coincidentally named als-registry is a
+* far rarer event than a missed hint on the real one.
+*/
+var ALS_REGISTRY_SUFFIX = /(?:^|\/)als-registry\.(?:ts|js)$/;
+var INFERRED_RULES = [
+	{
+		id: "node-builtin-import",
+		implies: "server-only",
+		enforcement: "report-only",
+		description: "imports a node:* built-in module",
+		matchesImport: (specifier) => specifier.startsWith("node:") && isBuiltin(specifier)
+	},
+	{
+		id: "timber-als-module",
+		implies: "server-only",
+		enforcement: "report-only",
+		description: "imports timber's per-request AsyncLocalStorage modules",
+		matchesImport: (specifier) => ALS_MODULE_SPECIFIERS.has(specifier) || ALS_REGISTRY_SUFFIX.test(specifier)
+	},
+	{
+		id: "browser-global",
+		implies: "client-only",
+		enforcement: "report-only",
+		description: "references a browser-only global",
+		identifiers: [
+			"window",
+			"document",
+			"navigator",
+			"localStorage",
+			"sessionStorage"
+		]
+	}
+];
+//#endregion
+export { poisonPillSource as i, INFERRED_RULES as n, markerFor as r, EXPLICIT_MARKERS as t };
+
+//# sourceMappingURL=poison-rules-DoEhbqaY.js.map

package/dist/_chunks/poison-rules-DoEhbqaY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poison-rules-DoEhbqaY.js","names":[],"sources":["../../src/analyze/poison-rules.ts"],"sourcesContent":["/**\n * poison-rules — single source of truth for server-only / client-only\n * module rules.\n *\n * Two tiers with different enforcement policies (design/47 §3):\n *\n * 1. **Explicit markers** (`server-only`, `client-only`) — evaluation-time\n *    poison pills. `plugins/shims.ts` resolves them to virtual modules\n *    whose body is a top-level `throw` in the wrong environment and a\n *    silent no-op in the right one. The error fires when the module is\n *    evaluated, not at resolve time.\n *\n * 2. **Inferred rules** (`node:*` imports, timber's ALS modules, browser\n *    globals) — report-only. They have legitimate false positives\n *    (`import.meta.env.SSR`-guarded `node:*` use, conditionally-imported\n *    packages), so erroring the build on them would refuse working apps.\n *    The `timber graph` reporter surfaces them as hints.\n *\n * Both shims.ts and the reporter consume this module so the two surfaces\n * can never disagree. Promoting inferred rules to build errors is a\n * policy flip on this list, never a new rule set.\n *\n * Design doc: 47-module-environment-tooling.md §3.\n */\n\nimport { isBuiltin } from 'node:module';\n\n/** Vite environment names the dev server / build run. */\nexport type EnvironmentName = 'rsc' | 'ssr' | 'client';\n\n// ─── Tier 1: explicit markers (evaluation-time poison pills) ──────────────\n\nexport interface ExplicitMarker {\n  /** The bare specifier user code imports (`server-only` / `client-only`). */\n  readonly specifier: string;\n  /** Virtual module ID the specifier resolves to in shims.ts. */\n  readonly virtualId: string;\n  /**\n   * True when evaluating the marker in `env` is a violation (the virtual\n   * module body must throw). `undefined` means \"no environment context\"\n   * (e.g. a non-environment-aware build) and is treated as a server\n   * environment — matching the historical shims.ts behavior.\n   */\n  readonly violatesIn: (env: EnvironmentName | string | undefined) => boolean;\n  /** Exact runtime error message thrown in the wrong environment. */\n  readonly errorMessage: string;\n  readonly enforcement: 'poison-pill';\n}\n\nexport const EXPLICIT_MARKERS: readonly ExplicitMarker[] = [\n  {\n    specifier: 'server-only',\n    virtualId: '\\0timber:server-only',\n    violatesIn: (env) => env === 'client',\n    errorMessage:\n      'This module cannot be imported from a Client Component module. ' +\n      'It should only be used from a Server Component.',\n    enforcement: 'poison-pill',\n  },\n  {\n    specifier: 'client-only',\n    virtualId: '\\0timber:client-only',\n    violatesIn: (env) => env !== 'client',\n    errorMessage:\n      'This module cannot be imported from a Server Component module. ' +\n      'It should only be used from a Client Component.',\n    enforcement: 'poison-pill',\n  },\n];\n\n/**\n * Look up an explicit marker by its import specifier. Throws on an\n * unknown specifier — callers reference rules that must exist, and a\n * silent undefined would just defer the failure.\n */\nexport function markerFor(specifier: string): ExplicitMarker {\n  const marker = EXPLICIT_MARKERS.find((m) => m.specifier === specifier);\n  if (!marker) throw new Error(`[timber] unknown poison marker: ${specifier}`);\n  return marker;\n}\n\n/**\n * Generate the virtual module body for an explicit marker in `env`:\n * a top-level throw in the wrong environment, a no-op otherwise.\n */\nexport function poisonPillSource(\n  marker: ExplicitMarker,\n  env: EnvironmentName | string | undefined\n): string {\n  if (marker.violatesIn(env)) {\n    return `throw new Error(${JSON.stringify(marker.errorMessage)});`;\n  }\n  return 'export {};';\n}\n\n// ─── Tier 2: inferred rules (report-only) ─────────────────────────────────\n\nexport interface InferredRule {\n  readonly id: string;\n  /** Which exclusivity the signal implies for the containing module. */\n  readonly implies: 'server-only' | 'client-only';\n  readonly enforcement: 'report-only';\n  /** Human-readable description for reporter output. */\n  readonly description: string;\n  /** Import-specifier signal — matches static import sources. */\n  readonly matchesImport?: (specifier: string) => boolean;\n  /**\n   * Identifier signal — global names whose use implies the exclusivity.\n   * Consumers must apply shadow-safe matching (an allowlisted-position\n   * AST check, not a text search).\n   */\n  readonly identifiers?: readonly string[];\n}\n\n/**\n * Timber modules that hold per-request AsyncLocalStorage state. Importing\n * one from client-reachable code is a strong server-only signal — cf. the\n * no-server-imports-in-isomorphic-define-modules rule.\n */\nconst ALS_MODULE_SPECIFIERS = new Set([\n  '@timber-js/app/server',\n  '@timber-js/app/server/internal',\n  '#server-internal',\n]);\n\n/**\n * The ALS registry module itself, as it appears in import sources.\n * Framework code imports it ESM-style with a `.js` specifier — both\n * `../server/als-registry.js` and sibling `./als-registry.js` forms\n * exist throughout src/server — while resolved module ids carry `.ts`.\n * Matching any path ending in the basename is deliberate: the rule is\n * report-only, and a user file coincidentally named als-registry is a\n * far rarer event than a missed hint on the real one.\n */\nconst ALS_REGISTRY_SUFFIX = /(?:^|\\/)als-registry\\.(?:ts|js)$/;\n\nexport const INFERRED_RULES: readonly InferredRule[] = [\n  {\n    id: 'node-builtin-import',\n    implies: 'server-only',\n    enforcement: 'report-only',\n    description: 'imports a node:* built-in module',\n    // Deliberately node:-prefixed only, matching design/47 §3's scope.\n    // Bare builtin names (`buffer`, `events`, `process`, `util`, …) are\n    // also real npm packages that browser code legitimately imports (the\n    // classic polyfill set) — matching them would report working client\n    // code, so they are intentionally NOT a signal.\n    matchesImport: (specifier) => specifier.startsWith('node:') && isBuiltin(specifier),\n  },\n  {\n    id: 'timber-als-module',\n    implies: 'server-only',\n    enforcement: 'report-only',\n    description: \"imports timber's per-request AsyncLocalStorage modules\",\n    matchesImport: (specifier) =>\n      ALS_MODULE_SPECIFIERS.has(specifier) || ALS_REGISTRY_SUFFIX.test(specifier),\n  },\n  {\n    id: 'browser-global',\n    implies: 'client-only',\n    enforcement: 'report-only',\n    description: 'references a browser-only global',\n    identifiers: ['window', 'document', 'navigator', 'localStorage', 'sessionStorage'],\n  },\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa,mBAA8C,CACzD;CACE,WAAW;CACX,WAAW;CACX,aAAa,QAAQ,QAAQ;CAC7B,cACE;CAEF,aAAa;AACf,GACA;CACE,WAAW;CACX,WAAW;CACX,aAAa,QAAQ,QAAQ;CAC7B,cACE;CAEF,aAAa;AACf,CACF;;;;;;AAOA,SAAgB,UAAU,WAAmC;CAC3D,MAAM,SAAS,iBAAiB,MAAM,MAAM,EAAE,cAAc,SAAS;CACrE,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,mCAAmC,WAAW;CAC3E,OAAO;AACT;;;;;AAMA,SAAgB,iBACd,QACA,KACQ;CACR,IAAI,OAAO,WAAW,GAAG,GACvB,OAAO,mBAAmB,KAAK,UAAU,OAAO,YAAY,EAAE;CAEhE,OAAO;AACT;;;;;;AA0BA,IAAM,wCAAwB,IAAI,IAAI;CACpC;CACA;CACA;AACF,CAAC;;;;;;;;;;AAWD,IAAM,sBAAsB;AAE5B,IAAa,iBAA0C;CACrD;EACE,IAAI;EACJ,SAAS;EACT,aAAa;EACb,aAAa;EAMb,gBAAgB,cAAc,UAAU,WAAW,OAAO,KAAK,UAAU,SAAS;CACpF;CACA;EACE,IAAI;EACJ,SAAS;EACT,aAAa;EACb,aAAa;EACb,gBAAgB,cACd,sBAAsB,IAAI,SAAS,KAAK,oBAAoB,KAAK,SAAS;CAC9E;CACA;EACE,IAAI;EACJ,SAAS;EACT,aAAa;EACb,aAAa;EACb,aAAa;GAAC;GAAU;GAAY;GAAa;GAAgB;EAAgB;CACnF;AACF"}

package/dist/_chunks/poison-scan-BAxfTT5L.js

@@ -0,0 +1,101 @@
+import { n as INFERRED_RULES, t as EXPLICIT_MARKERS } from "./poison-rules-DoEhbqaY.js";
+import { o as langForFile } from "./chains-h7EO-u3n.js";
+import { parseAst } from "vite";
+//#region src/analyze/poison-scan.ts
+/**
+* poison-scan — report-only poisoning detection for `timber graph`.
+*
+* Matches a module's static import specifiers against the shared rule
+* lists in poison-rules.ts (the single source of truth — design/47 §3)
+* and reports a poisoning only when the implied exclusivity CONFLICTS
+* with where the module actually runs: a server-only signal in a
+* client-reachable module, or a client-only signal in a server-reachable
+* one. A `node:fs` import in a file only the RSC environment loads is
+* working code, not a finding.
+*
+* Scope: import-specifier signals only (explicit markers + the inferred
+* rules' `matchesImport`). The inferred browser-global identifier rules
+* need shadow-safe allowlisted-position AST matching and are a separate
+* ticket — reporting them from a text scan would flag legitimate code.
+*
+* Design docs: 47-module-environment-tooling.md §3.
+*/
+/** File extensions the specifier scan can parse. */
+var PARSEABLE_EXTENSIONS = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/;
+/**
+* A NON-EMPTY specifier list where every entry is type-only. Empty or
+* absent lists return false — a bare `import 'pkg'` is a side-effect
+* import and very much runs.
+*/
+function isAllSpecifiersTypeOnly(specifiers) {
+	if (!specifiers || specifiers.length === 0) return false;
+	return specifiers.every((s) => s.importKind === "type" || s.exportKind === "type");
+}
+/**
+* Collect every static import/export source and string-literal dynamic
+* import from a module's original source. Sources that fail to parse
+* (or are not JS/TS at all) return [] — no specifiers is a safe
+* default for a report-only scan.
+*/
+function collectImportSpecifiers(code, file) {
+	if (!PARSEABLE_EXTENSIONS.test(file)) return [];
+	let program;
+	try {
+		program = parseAst(code, { lang: langForFile(file) });
+	} catch {
+		return [];
+	}
+	const specifiers = [];
+	const visit = (node) => {
+		if (Array.isArray(node)) {
+			for (const child of node) visit(child);
+			return;
+		}
+		if (typeof node !== "object" || node === null) return;
+		const record = node;
+		if ((record.type === "ImportDeclaration" || record.type === "ExportNamedDeclaration" || record.type === "ExportAllDeclaration") && record.importKind !== "type" && record.exportKind !== "type" && !isAllSpecifiersTypeOnly(record.specifiers) && typeof record.source?.value === "string") specifiers.push(record.source.value);
+		else if (record.type === "ImportExpression" && record.source?.type === "Literal" && typeof record.source.value === "string") specifiers.push(record.source.value);
+		for (const key of Object.keys(record)) {
+			if (key === "type") continue;
+			visit(record[key]);
+		}
+	};
+	visit(program.body);
+	return specifiers;
+}
+/** Exclusivity signals a module's import specifiers carry. */
+function importSignals(specifiers) {
+	const signals = [];
+	for (const specifier of specifiers) {
+		for (const marker of EXPLICIT_MARKERS) if (specifier === marker.specifier) signals.push({
+			rule: marker.specifier,
+			specifier,
+			implies: marker.specifier === "server-only" ? "server-only" : "client-only",
+			description: `imports the ${marker.specifier} poison-pill marker`
+		});
+		for (const rule of INFERRED_RULES) if (rule.matchesImport?.(specifier)) signals.push({
+			rule: rule.id,
+			specifier,
+			implies: rule.implies,
+			description: rule.description
+		});
+	}
+	return signals;
+}
+/**
+* Filter a module's signals down to actual conflicts with its
+* classification. Environment reach follows the taxonomy: boundary /
+* client-internal / shared modules run client-side; server / shared /
+* server-action modules run server-side. Pending (provisional) modules
+* run nowhere confirmed, so nothing conflicts yet.
+*/
+function poisoningsFor(kind, pending, signals) {
+	if (pending || signals.length === 0) return [];
+	const clientReachable = kind === "client-boundary" || kind === "client-internal" || kind === "shared";
+	const serverReachable = kind === "server" || kind === "shared" || kind === "server-action";
+	return signals.filter((signal) => signal.implies === "server-only" && clientReachable || signal.implies === "client-only" && serverReachable);
+}
+//#endregion
+export { importSignals as n, poisoningsFor as r, collectImportSpecifiers as t };
+
+//# sourceMappingURL=poison-scan-BAxfTT5L.js.map

package/dist/_chunks/poison-scan-BAxfTT5L.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poison-scan-BAxfTT5L.js","names":[],"sources":["../../src/analyze/poison-scan.ts"],"sourcesContent":["/**\n * poison-scan — report-only poisoning detection for `timber graph`.\n *\n * Matches a module's static import specifiers against the shared rule\n * lists in poison-rules.ts (the single source of truth — design/47 §3)\n * and reports a poisoning only when the implied exclusivity CONFLICTS\n * with where the module actually runs: a server-only signal in a\n * client-reachable module, or a client-only signal in a server-reachable\n * one. A `node:fs` import in a file only the RSC environment loads is\n * working code, not a finding.\n *\n * Scope: import-specifier signals only (explicit markers + the inferred\n * rules' `matchesImport`). The inferred browser-global identifier rules\n * need shadow-safe allowlisted-position AST matching and are a separate\n * ticket — reporting them from a text scan would flag legitimate code.\n *\n * Design docs: 47-module-environment-tooling.md §3.\n */\n\nimport { parseAst } from 'vite';\nimport { EXPLICIT_MARKERS, INFERRED_RULES } from './poison-rules.ts';\nimport { langForFile, type ModuleKind } from './classify.ts';\n\n/** One poisoning finding on a module, in the JSON-contract shape. */\nexport interface Poisoning {\n  /** Rule id — an inferred rule's id, or the explicit marker specifier. */\n  rule: string;\n  /** The import specifier that matched. */\n  specifier: string;\n  /** Which exclusivity the signal implies for the containing module. */\n  implies: 'server-only' | 'client-only';\n  /** Human-readable description for reporter output. */\n  description: string;\n}\n\n/** File extensions the specifier scan can parse. */\nconst PARSEABLE_EXTENSIONS = /\\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/;\n\n/**\n * A NON-EMPTY specifier list where every entry is type-only. Empty or\n * absent lists return false — a bare `import 'pkg'` is a side-effect\n * import and very much runs.\n */\nfunction isAllSpecifiersTypeOnly(\n  specifiers: Array<{ importKind?: string; exportKind?: string }> | undefined\n): boolean {\n  if (!specifiers || specifiers.length === 0) return false;\n  return specifiers.every((s) => s.importKind === 'type' || s.exportKind === 'type');\n}\n\n/**\n * Collect every static import/export source and string-literal dynamic\n * import from a module's original source. Sources that fail to parse\n * (or are not JS/TS at all) return [] — no specifiers is a safe\n * default for a report-only scan.\n */\nexport function collectImportSpecifiers(code: string, file: string): string[] {\n  if (!PARSEABLE_EXTENSIONS.test(file)) return [];\n  let program;\n  try {\n    // Language from the extension, never forced tsx — see langForFile.\n    program = parseAst(code, { lang: langForFile(file) });\n  } catch {\n    return [];\n  }\n  const specifiers: string[] = [];\n  const visit = (node: unknown): void => {\n    if (Array.isArray(node)) {\n      for (const child of node) visit(child);\n      return;\n    }\n    if (typeof node !== 'object' || node === null) return;\n    const record = node as Record<string, unknown> & {\n      type?: string;\n      importKind?: string;\n      exportKind?: string;\n      specifiers?: Array<{ importKind?: string; exportKind?: string }>;\n    };\n    if (\n      (record.type === 'ImportDeclaration' ||\n        record.type === 'ExportNamedDeclaration' ||\n        record.type === 'ExportAllDeclaration') &&\n      // Type-only imports/exports are erased at runtime — `import type\n      // { Stats } from 'node:fs'` in client code is working code, and\n      // flagging it would be a false positive in a report-only scan.\n      // Covers both the declaration-level form (`import type {…}`,\n      // importKind on the declaration) and the inline form\n      // (`import { type Stats }`, where the declaration stays 'value'\n      // and each SPECIFIER carries the kind) — a declaration whose\n      // specifiers are all type-only is erased just the same.\n      record.importKind !== 'type' &&\n      record.exportKind !== 'type' &&\n      !isAllSpecifiersTypeOnly(record.specifiers) &&\n      typeof (record.source as { value?: unknown } | null)?.value === 'string'\n    ) {\n      specifiers.push((record.source as { value: string }).value);\n    } else if (\n      record.type === 'ImportExpression' &&\n      (record.source as { type?: string; value?: unknown })?.type === 'Literal' &&\n      typeof (record.source as { value?: unknown }).value === 'string'\n    ) {\n      specifiers.push((record.source as { value: string }).value);\n    }\n    for (const key of Object.keys(record)) {\n      if (key === 'type') continue;\n      visit(record[key]);\n    }\n  };\n  visit(program.body);\n  return specifiers;\n}\n\n/** Exclusivity signals a module's import specifiers carry. */\nexport function importSignals(specifiers: string[]): Poisoning[] {\n  const signals: Poisoning[] = [];\n  for (const specifier of specifiers) {\n    for (const marker of EXPLICIT_MARKERS) {\n      if (specifier === marker.specifier) {\n        signals.push({\n          rule: marker.specifier,\n          specifier,\n          implies: marker.specifier === 'server-only' ? 'server-only' : 'client-only',\n          description: `imports the ${marker.specifier} poison-pill marker`,\n        });\n      }\n    }\n    for (const rule of INFERRED_RULES) {\n      if (rule.matchesImport?.(specifier)) {\n        signals.push({\n          rule: rule.id,\n          specifier,\n          implies: rule.implies,\n          description: rule.description,\n        });\n      }\n    }\n  }\n  return signals;\n}\n\n/**\n * Filter a module's signals down to actual conflicts with its\n * classification. Environment reach follows the taxonomy: boundary /\n * client-internal / shared modules run client-side; server / shared /\n * server-action modules run server-side. Pending (provisional) modules\n * run nowhere confirmed, so nothing conflicts yet.\n */\nexport function poisoningsFor(\n  kind: ModuleKind,\n  pending: boolean,\n  signals: Poisoning[]\n): Poisoning[] {\n  if (pending || signals.length === 0) return [];\n  const clientReachable =\n    kind === 'client-boundary' || kind === 'client-internal' || kind === 'shared';\n  const serverReachable = kind === 'server' || kind === 'shared' || kind === 'server-action';\n  return signals.filter(\n    (signal) =>\n      (signal.implies === 'server-only' && clientReachable) ||\n      (signal.implies === 'client-only' && serverReachable)\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,uBAAuB;;;;;;AAO7B,SAAS,wBACP,YACS;CACT,IAAI,CAAC,cAAc,WAAW,WAAW,GAAG,OAAO;CACnD,OAAO,WAAW,OAAO,MAAM,EAAE,eAAe,UAAU,EAAE,eAAe,MAAM;AACnF;;;;;;;AAQA,SAAgB,wBAAwB,MAAc,MAAwB;CAC5E,IAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC;CAC9C,IAAI;CACJ,IAAI;EAEF,UAAU,SAAS,MAAM,EAAE,MAAM,YAAY,IAAI,EAAE,CAAC;CACtD,QAAQ;EACN,OAAO,CAAC;CACV;CACA,MAAM,aAAuB,CAAC;CAC9B,MAAM,SAAS,SAAwB;EACrC,IAAI,MAAM,QAAQ,IAAI,GAAG;GACvB,KAAK,MAAM,SAAS,MAAM,MAAM,KAAK;GACrC;EACF;EACA,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;EAC/C,MAAM,SAAS;EAMf,KACG,OAAO,SAAS,uBACf,OAAO,SAAS,4BAChB,OAAO,SAAS,2BASlB,OAAO,eAAe,UACtB,OAAO,eAAe,UACtB,CAAC,wBAAwB,OAAO,UAAU,KAC1C,OAAQ,OAAO,QAAuC,UAAU,UAEhE,WAAW,KAAM,OAAO,OAA6B,KAAK;OACrD,IACL,OAAO,SAAS,sBACf,OAAO,QAA+C,SAAS,aAChE,OAAQ,OAAO,OAA+B,UAAU,UAExD,WAAW,KAAM,OAAO,OAA6B,KAAK;EAE5D,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;GACrC,IAAI,QAAQ,QAAQ;GACpB,MAAM,OAAO,IAAI;EACnB;CACF;CACA,MAAM,QAAQ,IAAI;CAClB,OAAO;AACT;;AAGA,SAAgB,cAAc,YAAmC;CAC/D,MAAM,UAAuB,CAAC;CAC9B,KAAK,MAAM,aAAa,YAAY;EAClC,KAAK,MAAM,UAAU,kBACnB,IAAI,cAAc,OAAO,WACvB,QAAQ,KAAK;GACX,MAAM,OAAO;GACb;GACA,SAAS,OAAO,cAAc,gBAAgB,gBAAgB;GAC9D,aAAa,eAAe,OAAO,UAAU;EAC/C,CAAC;EAGL,KAAK,MAAM,QAAQ,gBACjB,IAAI,KAAK,gBAAgB,SAAS,GAChC,QAAQ,KAAK;GACX,MAAM,KAAK;GACX;GACA,SAAS,KAAK;GACd,aAAa,KAAK;EACpB,CAAC;CAGP;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,cACd,MACA,SACA,SACa;CACb,IAAI,WAAW,QAAQ,WAAW,GAAG,OAAO,CAAC;CAC7C,MAAM,kBACJ,SAAS,qBAAqB,SAAS,qBAAqB,SAAS;CACvE,MAAM,kBAAkB,SAAS,YAAY,SAAS,YAAY,SAAS;CAC3E,OAAO,QAAQ,QACZ,WACE,OAAO,YAAY,iBAAiB,mBACpC,OAAO,YAAY,iBAAiB,eACzC;AACF"}

package/dist/_chunks/resolve-schema-CBR6Lm4i.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-schema-CBR6Lm4i.js","names":[],"sources":["../../src/params/resolve-schema.ts"],"sourcesContent":["/**\n * Schema resolution — resolves the global schema's segmentParams into\n * a runtime-ready codec map keyed by bracket name (e.g. '[id]').\n *\n * Bracket keys are preserved so that `[id]`, `[...id]`, and `[[...id]]`\n * remain distinct entries. The coercion layer reconstructs bracket keys\n * from matched segment metadata to look up the correct codec.\n *\n * Design doc: design/41-global-params.md §Pipeline Integration\n */\n\nimport type { Codec } from '../codec.js';\nimport { isCodec, resolveCodecOrSchema } from '../schema-bridge.js';\n\n/**\n * Reconstruct the bracket key for a segment from its type and param name.\n * Used by the coercion layer to look up codecs in the bracket-keyed map.\n *\n * 'dynamic'          + 'id'   → '[id]'\n * 'catch-all'        + 'slug' → '[...slug]'\n * 'optional-catch-all' + 'slug' → '[[...slug]]'\n */\nexport function toBracketKey(segmentType: string, paramName: string): string {\n  switch (segmentType) {\n    case 'catch-all':\n      return `[...${paramName}]`;\n    case 'optional-catch-all':\n      return `[[...${paramName}]]`;\n    default:\n      return `[${paramName}]`;\n  }\n}\n\nconst CATCH_ALL_RE = /^\\[\\.\\.\\..+\\]$/;\nconst OPTIONAL_CATCH_ALL_RE = /^\\[\\[\\.\\.\\..+\\]\\]$/;\n\nfunction isCatchAllKey(key: string): boolean {\n  return CATCH_ALL_RE.test(key) || OPTIONAL_CATCH_ALL_RE.test(key);\n}\n\nfunction isOptionalCatchAllKey(key: string): boolean {\n  return OPTIONAL_CATCH_ALL_RE.test(key);\n}\n\n/**\n * Resolve the global schema's segmentParams into a map of bracket-keyed\n * param name → resolved Codec.\n *\n * Keys are preserved exactly as written in `app/schema.ts` so that\n * `[id]`, `[...id]`, and `[[...id]]` remain distinct entries.\n * The coercion layer in `param-coercion.ts` reconstructs bracket keys\n * from matched segment metadata to look up the correct codec.\n *\n * Input:  { '[id]': z.coerce.number(), '[...slug]': codec.string }\n * Output: { '[id]': Codec<number>, '[...slug]': Codec<string> }\n */\nexport function resolveSchemaCodecs(\n  segmentParams: Record<string, unknown>\n): Record<string, Codec<unknown>> {\n  const resolved: Record<string, Codec<unknown>> = Object.create(null);\n\n  for (const [bracketName, value] of Object.entries(segmentParams)) {\n    if (isCatchAllKey(bracketName) && isCodec(value) && !('__catchAll' in value)) {\n      throw new Error(\n        `[timber] Schema error: '${bracketName}' is a catch-all segment and requires an array codec ` +\n          `(e.g. codec.catchAll(codec.string)). Got a scalar codec.`\n      );\n    }\n    if (\n      isOptionalCatchAllKey(bracketName) &&\n      isCodec(value) &&\n      '__catchAll' in value &&\n      !('__optional' in value)\n    ) {\n      throw new Error(\n        `[timber] Schema error: '${bracketName}' is an optional catch-all segment and requires codec.optionalCatchAll() ` +\n          `(e.g. codec.optionalCatchAll(codec.string)). Got a non-optional catch-all codec.`\n      );\n    }\n    resolved[bracketName] = resolveCodecOrSchema(bracketName, value, 'param');\n  }\n\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;AAsBA,SAAgB,aAAa,aAAqB,WAA2B;CAC3E,QAAQ,aAAR;EACE,KAAK,aACH,OAAO,OAAO,UAAU;EAC1B,KAAK,sBACH,OAAO,QAAQ,UAAU;EAC3B,SACE,OAAO,IAAI,UAAU;CACzB;AACF;AAEA,IAAM,eAAe;AACrB,IAAM,wBAAwB;AAE9B,SAAS,cAAc,KAAsB;CAC3C,OAAO,aAAa,KAAK,GAAG,KAAK,sBAAsB,KAAK,GAAG;AACjE;AAEA,SAAS,sBAAsB,KAAsB;CACnD,OAAO,sBAAsB,KAAK,GAAG;AACvC;;;;;;;;;;;;;AAcA,SAAgB,oBACd,eACgC;CAChC,MAAM,WAA2C,OAAO,OAAO,IAAI;CAEnE,KAAK,MAAM,CAAC,aAAa,UAAU,OAAO,QAAQ,aAAa,GAAG;EAChE,IAAI,cAAc,WAAW,KAAK,QAAQ,KAAK,KAAK,EAAE,gBAAgB,QACpE,MAAM,IAAI,MACR,2BAA2B,YAAY,8GAEzC;EAEF,IACE,sBAAsB,WAAW,KACjC,QAAQ,KAAK,KACb,gBAAgB,SAChB,EAAE,gBAAgB,QAElB,MAAM,IAAI,MACR,2BAA2B,YAAY,0JAEzC;EAEF,SAAS,eAAe,qBAAqB,aAAa,OAAO,OAAO;CAC1E;CAEA,OAAO;AACT"}
+{"version":3,"file":"resolve-schema-CBR6Lm4i.js","names":[],"sources":["../../src/params/resolve-schema.ts"],"sourcesContent":["/**\n * Schema resolution — resolves the global schema's segmentParams into\n * a runtime-ready codec map keyed by bracket name (e.g. '[id]').\n *\n * Bracket keys are preserved so that `[id]`, `[...id]`, and `[[...id]]`\n * remain distinct entries. The coercion layer reconstructs bracket keys\n * from matched segment metadata to look up the correct codec.\n *\n * Design doc: design/41-global-params.md §Pipeline Integration\n */\n\nimport type { Codec } from '../codec.ts';\nimport { isCodec, resolveCodecOrSchema } from '../schema-bridge.ts';\n\n/**\n * Reconstruct the bracket key for a segment from its type and param name.\n * Used by the coercion layer to look up codecs in the bracket-keyed map.\n *\n * 'dynamic'          + 'id'   → '[id]'\n * 'catch-all'        + 'slug' → '[...slug]'\n * 'optional-catch-all' + 'slug' → '[[...slug]]'\n */\nexport function toBracketKey(segmentType: string, paramName: string): string {\n  switch (segmentType) {\n    case 'catch-all':\n      return `[...${paramName}]`;\n    case 'optional-catch-all':\n      return `[[...${paramName}]]`;\n    default:\n      return `[${paramName}]`;\n  }\n}\n\nconst CATCH_ALL_RE = /^\\[\\.\\.\\..+\\]$/;\nconst OPTIONAL_CATCH_ALL_RE = /^\\[\\[\\.\\.\\..+\\]\\]$/;\n\nfunction isCatchAllKey(key: string): boolean {\n  return CATCH_ALL_RE.test(key) || OPTIONAL_CATCH_ALL_RE.test(key);\n}\n\nfunction isOptionalCatchAllKey(key: string): boolean {\n  return OPTIONAL_CATCH_ALL_RE.test(key);\n}\n\n/**\n * Resolve the global schema's segmentParams into a map of bracket-keyed\n * param name → resolved Codec.\n *\n * Keys are preserved exactly as written in `app/schema.ts` so that\n * `[id]`, `[...id]`, and `[[...id]]` remain distinct entries.\n * The coercion layer in `param-coercion.ts` reconstructs bracket keys\n * from matched segment metadata to look up the correct codec.\n *\n * Input:  { '[id]': z.coerce.number(), '[...slug]': codec.string }\n * Output: { '[id]': Codec<number>, '[...slug]': Codec<string> }\n */\nexport function resolveSchemaCodecs(\n  segmentParams: Record<string, unknown>\n): Record<string, Codec<unknown>> {\n  const resolved: Record<string, Codec<unknown>> = Object.create(null);\n\n  for (const [bracketName, value] of Object.entries(segmentParams)) {\n    if (isCatchAllKey(bracketName) && isCodec(value) && !('__catchAll' in value)) {\n      throw new Error(\n        `[timber] Schema error: '${bracketName}' is a catch-all segment and requires an array codec ` +\n          `(e.g. codec.catchAll(codec.string)). Got a scalar codec.`\n      );\n    }\n    if (\n      isOptionalCatchAllKey(bracketName) &&\n      isCodec(value) &&\n      '__catchAll' in value &&\n      !('__optional' in value)\n    ) {\n      throw new Error(\n        `[timber] Schema error: '${bracketName}' is an optional catch-all segment and requires codec.optionalCatchAll() ` +\n          `(e.g. codec.optionalCatchAll(codec.string)). Got a non-optional catch-all codec.`\n      );\n    }\n    resolved[bracketName] = resolveCodecOrSchema(bracketName, value, 'param');\n  }\n\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;AAsBA,SAAgB,aAAa,aAAqB,WAA2B;CAC3E,QAAQ,aAAR;EACE,KAAK,aACH,OAAO,OAAO,UAAU;EAC1B,KAAK,sBACH,OAAO,QAAQ,UAAU;EAC3B,SACE,OAAO,IAAI,UAAU;CACzB;AACF;AAEA,IAAM,eAAe;AACrB,IAAM,wBAAwB;AAE9B,SAAS,cAAc,KAAsB;CAC3C,OAAO,aAAa,KAAK,GAAG,KAAK,sBAAsB,KAAK,GAAG;AACjE;AAEA,SAAS,sBAAsB,KAAsB;CACnD,OAAO,sBAAsB,KAAK,GAAG;AACvC;;;;;;;;;;;;;AAcA,SAAgB,oBACd,eACgC;CAChC,MAAM,WAA2C,OAAO,OAAO,IAAI;CAEnE,KAAK,MAAM,CAAC,aAAa,UAAU,OAAO,QAAQ,aAAa,GAAG;EAChE,IAAI,cAAc,WAAW,KAAK,QAAQ,KAAK,KAAK,EAAE,gBAAgB,QACpE,MAAM,IAAI,MACR,2BAA2B,YAAY,8GAEzC;EAEF,IACE,sBAAsB,WAAW,KACjC,QAAQ,KAAK,KACb,gBAAgB,SAChB,EAAE,gBAAgB,QAElB,MAAM,IAAI,MACR,2BAA2B,YAAY,0JAEzC;EAEF,SAAS,eAAe,qBAAqB,aAAa,OAAO,OAAO;CAC1E;CAEA,OAAO;AACT"}

package/dist/_chunks/rolldown-runtime-D7D4PA-g.js

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/dist/_chunks/router-ref-DuYuV_0Q.js.map

@@ -1 +1 @@
-{"version":3,"file":"router-ref-DuYuV_0Q.js","names":[],"sources":["../../src/client/router-ref.ts"],"sourcesContent":["// Global router reference — shared between browser-entry and client hooks.\n//\n// Delegates to client/state.ts for the actual module-level variable.\n// This ensures singleton semantics regardless of import path — all\n// callers converge on the same state.ts instance via the barrel.\n//\n// See design/18-build-system.md §\"Module Singleton Strategy\"\n\nimport type { RouterInstance } from './router-types.js';\nimport { globalRouter, _setGlobalRouter } from './state.js';\n\n/**\n * Set the global router instance. Called once during bootstrap.\n */\nexport function setGlobalRouter(router: RouterInstance): void {\n  _setGlobalRouter(router);\n}\n\n/**\n * Get the global router instance. Throws if called before bootstrap.\n * Used by client-side hooks (usePendingNavigation, etc.)\n */\nexport function getRouter(): RouterInstance {\n  if (!globalRouter) {\n    throw new Error('[timber] Router not initialized. getRouter() was called before bootstrap().');\n  }\n  return globalRouter;\n}\n\n/**\n * Get the global router instance or null if not yet initialized.\n * Used by useRouter() methods to avoid silent failures — callers\n * can log a meaningful warning instead of silently no-oping.\n */\nexport function getRouterOrNull(): RouterInstance | null {\n  return globalRouter;\n}\n\n/**\n * Reset the global router to null. Used only in tests to isolate\n * module-level state between test cases.\n * @internal\n */\nexport function resetGlobalRouter(): void {\n  _setGlobalRouter(null);\n}\n"],"mappings":";;;;;AAcA,SAAgB,gBAAgB,QAA8B;CAC5D,iBAAiB,MAAM;AACzB;;;;;AAMA,SAAgB,YAA4B;CAC1C,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,6EAA6E;CAE/F,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAyC;CACvD,OAAO;AACT"}
+{"version":3,"file":"router-ref-DuYuV_0Q.js","names":[],"sources":["../../src/client/router-ref.ts"],"sourcesContent":["// Global router reference — shared between browser-entry and client hooks.\n//\n// Delegates to client/state.ts for the actual module-level variable.\n// This ensures singleton semantics regardless of import path — all\n// callers converge on the same state.ts instance via the barrel.\n//\n// See design/18-build-system.md §\"Module Singleton Strategy\"\n\nimport type { RouterInstance } from './router-types.ts';\nimport { globalRouter, _setGlobalRouter } from './state.ts';\n\n/**\n * Set the global router instance. Called once during bootstrap.\n */\nexport function setGlobalRouter(router: RouterInstance): void {\n  _setGlobalRouter(router);\n}\n\n/**\n * Get the global router instance. Throws if called before bootstrap.\n * Used by client-side hooks (usePendingNavigation, etc.)\n */\nexport function getRouter(): RouterInstance {\n  if (!globalRouter) {\n    throw new Error('[timber] Router not initialized. getRouter() was called before bootstrap().');\n  }\n  return globalRouter;\n}\n\n/**\n * Get the global router instance or null if not yet initialized.\n * Used by useRouter() methods to avoid silent failures — callers\n * can log a meaningful warning instead of silently no-oping.\n */\nexport function getRouterOrNull(): RouterInstance | null {\n  return globalRouter;\n}\n\n/**\n * Reset the global router to null. Used only in tests to isolate\n * module-level state between test cases.\n * @internal\n */\nexport function resetGlobalRouter(): void {\n  _setGlobalRouter(null);\n}\n"],"mappings":";;;;;AAcA,SAAgB,gBAAgB,QAA8B;CAC5D,iBAAiB,MAAM;AACzB;;;;;AAMA,SAAgB,YAA4B;CAC1C,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,6EAA6E;CAE/F,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAyC;CACvD,OAAO;AACT"}

package/dist/_chunks/{rsc-media-type-DRqE_lD_.js → rsc-media-type-DDc7duTD.js}

@@ -40,7 +40,22 @@ var RSC_CONTENT_TYPE = "text/x-component";
 function isRscRequest(req) {
 	return (req.headers.get("Accept") ?? "").includes(RSC_CONTENT_TYPE);
 }
+/**
+* Does this Content-Type header value designate an RSC Flight payload?
+*
+* Case-insensitive exact media-type match per RFC 9110 §8.3.1 — media types
+* are case-insensitive. Parameters (`;charset=utf-8`) are stripped before
+* comparison.
+*
+* Contrast with `isRscRequest`, which uses substring containment because
+* `Accept` is a list of types. A `Content-Type` header names exactly one
+* type, so substring would over-match (e.g. `text/x-component-v2`).
+*/
+function isRscContentType(contentType) {
+	if (!contentType) return false;
+	return contentType.split(";")[0].trim().toLowerCase() === RSC_CONTENT_TYPE;
+}
 //#endregion
-export { isRscRequest as n, RSC_CONTENT_TYPE as t };
+export { isRscContentType as n, isRscRequest as r, RSC_CONTENT_TYPE as t };
 
-//# sourceMappingURL=rsc-media-type-DRqE_lD_.js.map
+//# sourceMappingURL=rsc-media-type-DDc7duTD.js.map

package/dist/_chunks/{rsc-media-type-DRqE_lD_.js.map → rsc-media-type-DDc7duTD.js.map}

@@ -1 +1 @@
-{"version":3,"file":"rsc-media-type-DRqE_lD_.js","names":[],"sources":["../../src/shared/rsc-media-type.ts"],"sourcesContent":["/**\n * The RSC Flight media type, and the request predicate over it.\n *\n * One module owns the string because two independently-written spellings of\n * \"is this an RSC request?\" must agree, and the consequence of them\n * disagreeing is cache poisoning rather than a visible bug. The Cloudflare\n * adapter's `isRsc` decides what may enter the edge cache; the origin's\n * pipeline decides which headers may vary the response. TIM-1269 made the\n * adapter's `VARY_HONORED` allowlist exempt `Accept` *because* `isRsc`\n * excludes Flight responses from the cache, and exempt the `X-Timber-*`\n * headers *because* the origin reads them only behind its own RSC check. If\n * one predicate is ever tightened (a real media-type parse, a\n * parameter-aware match) and the other is not, the adapter can classify a\n * request as a document while the origin treats it as RSC, and store a\n * Flight payload under the document's key — the class\n * `design/48-payload-addressing.md` exists to prevent.\n *\n * `tests/rsc-media-type-single-source.test.ts` fails if the literal reappears\n * in executable source outside this file.\n *\n * Isomorphic: zero imports, so `adapters/cloudflare.ts` — which Node's native\n * ESM loader evaluates before Vite's resolver exists — can load it and\n * interpolate the value into the generated worker. Same precedent as\n * `shared/rsc-cache-key.ts`.\n *\n * See design/19-client-navigation.md, design/25-production-deployments.md\n * §\"`Vary` and the Workers Cache API\".\n */\n\n/** Media type of a React Flight payload. */\nexport const RSC_CONTENT_TYPE = 'text/x-component';\n\n/**\n * Is this request asking for an RSC payload rather than a full document?\n *\n * Substring containment, deliberately: `Accept` is a list, and a client may\n * send `text/x-component;charset=utf-8` or list it alongside other types.\n * Tightening this to a real media-type parse is a behaviour change that has\n * to move the adapter's generated `isRsc` in the same commit — see above.\n */\nexport function isRscRequest(req: Request): boolean {\n  return (req.headers.get('Accept') ?? '').includes(RSC_CONTENT_TYPE);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,mBAAmB;;;;;;;;;AAUhC,SAAgB,aAAa,KAAuB;CAClD,QAAQ,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAA,CAAI,SAAS,gBAAgB;AACpE"}
+{"version":3,"file":"rsc-media-type-DDc7duTD.js","names":[],"sources":["../../src/shared/rsc-media-type.ts"],"sourcesContent":["/**\n * The RSC Flight media type, and the request predicate over it.\n *\n * One module owns the string because two independently-written spellings of\n * \"is this an RSC request?\" must agree, and the consequence of them\n * disagreeing is cache poisoning rather than a visible bug. The Cloudflare\n * adapter's `isRsc` decides what may enter the edge cache; the origin's\n * pipeline decides which headers may vary the response. TIM-1269 made the\n * adapter's `VARY_HONORED` allowlist exempt `Accept` *because* `isRsc`\n * excludes Flight responses from the cache, and exempt the `X-Timber-*`\n * headers *because* the origin reads them only behind its own RSC check. If\n * one predicate is ever tightened (a real media-type parse, a\n * parameter-aware match) and the other is not, the adapter can classify a\n * request as a document while the origin treats it as RSC, and store a\n * Flight payload under the document's key — the class\n * `design/48-payload-addressing.md` exists to prevent.\n *\n * `tests/rsc-media-type-single-source.test.ts` fails if the literal reappears\n * in executable source outside this file.\n *\n * Isomorphic: zero imports, so `adapters/cloudflare.ts` — which Node's native\n * ESM loader evaluates before Vite's resolver exists — can load it and\n * interpolate the value into the generated worker. Same precedent as\n * `shared/rsc-cache-key.ts`.\n *\n * See design/19-client-navigation.md, design/25-production-deployments.md\n * §\"`Vary` and the Workers Cache API\".\n */\n\n/** Media type of a React Flight payload. */\nexport const RSC_CONTENT_TYPE = 'text/x-component';\n\n/**\n * Is this request asking for an RSC payload rather than a full document?\n *\n * Substring containment, deliberately: `Accept` is a list, and a client may\n * send `text/x-component;charset=utf-8` or list it alongside other types.\n * Tightening this to a real media-type parse is a behaviour change that has\n * to move the adapter's generated `isRsc` in the same commit — see above.\n */\nexport function isRscRequest(req: Request): boolean {\n  return (req.headers.get('Accept') ?? '').includes(RSC_CONTENT_TYPE);\n}\n\n/**\n * Does this Content-Type header value designate an RSC Flight payload?\n *\n * Case-insensitive exact media-type match per RFC 9110 §8.3.1 — media types\n * are case-insensitive. Parameters (`;charset=utf-8`) are stripped before\n * comparison.\n *\n * Contrast with `isRscRequest`, which uses substring containment because\n * `Accept` is a list of types. A `Content-Type` header names exactly one\n * type, so substring would over-match (e.g. `text/x-component-v2`).\n */\nexport function isRscContentType(contentType: string | null): boolean {\n  if (!contentType) return false;\n  return contentType.split(';')[0].trim().toLowerCase() === RSC_CONTENT_TYPE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,mBAAmB;;;;;;;;;AAUhC,SAAgB,aAAa,KAAuB;CAClD,QAAQ,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAA,CAAI,SAAS,gBAAgB;AACpE;;;;;;;;;;;;AAaA,SAAgB,iBAAiB,aAAqC;CACpE,IAAI,CAAC,aAAa,OAAO;CACzB,OAAO,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,MAAM;AAC5D"}

package/dist/_chunks/scan-BoP17W3w.js

@@ -0,0 +1,140 @@
+import { join } from "node:path";
+import { readdir } from "node:fs/promises";
+//#region src/analyze/scan.ts
+/**
+* scan — project source-file disk scan shared by the crawl and the
+* graph cache.
+*
+* One walker, one rule set: the crawl uses it to find files no graph
+* reached (the provisional/pending set) and to bound graph membership,
+* and the mtime-keyed graph cache fingerprints exactly the same file
+* set — the three can never disagree about what "the project" is (a
+* file the crawl classifies but the fingerprint ignores would make the
+* cache silently stale).
+*
+* Skip rules are deliberately shallow: timber's router excludes only
+* `_`-prefixed directories, so `app/.well-known/page.tsx` and
+* `app/dist/page.tsx` are REAL routes — a rule that skipped `dist` or
+* dot-directories at any depth would hide legitimate route files from
+* the scan while the module graph still reached them (codex review,
+* PR #1056). Therefore:
+*
+* - `node_modules` is skipped at ANY depth (never project source, and
+*   graph membership excludes it identically)
+* - dot-prefixed and build-output directories (`dist`, `coverage`, …)
+*   are skipped only as the FIRST path segment under the root — that
+*   is where `.git`, `.timber`, `.wrangler`, and real build outputs
+*   live; deeper occurrences are walked
+*
+* Deliberately vite-free: the cache-hit path of `timber graph` reads
+* this module without booting (or even importing) Vite.
+*
+* Design docs: 47-module-environment-tooling.md §2, §Cold-path policy.
+*/
+/**
+* Slash-normalize a Windows path — Vite's `normalizePath` for the
+* vite-free callers (the graph cache-hit path must not import Vite).
+* Same platform guard as Vite's: posix paths pass through untouched,
+* so a filename containing a literal backslash is never corrupted.
+*/
+var normalizeSlashes = process.platform === "win32" ? (path) => path.replace(/\\/g, "/") : (path) => path;
+/**
+* Directories never scanned when they are the first path segment under
+* the root. `node_modules` is additionally skipped at any depth.
+*/
+var SCAN_IGNORED_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	"test-results",
+	"coverage"
+]);
+/**
+* Single source of truth for builtin source extensions. Includes mdx —
+* timber supports page.mdx via pageExtensions, so an unreferenced MDX
+* page must not vanish from --all output.
+*/
+var BUILTIN_EXTENSIONS = [
+	"ts",
+	"tsx",
+	"js",
+	"jsx",
+	"mjs",
+	"cjs",
+	"mts",
+	"cts",
+	"mdx"
+];
+/** Regex form of BUILTIN_EXTENSIONS for file-basename matching. */
+var SOURCE_EXTENSIONS = new RegExp(`\\.(?:${BUILTIN_EXTENSIONS.join("|")})$`);
+/** Set form for O(1) membership checks. */
+var BUILTIN_EXTENSION_SET = new Set(BUILTIN_EXTENSIONS);
+/**
+* Build a regex that matches SOURCE_EXTENSIONS plus any extra
+* extensions from the user's pageExtensions config. Returns the
+* builtin regex unchanged when nothing new is added.
+*/
+function buildSourceExtensions(pageExtensions) {
+	if (!pageExtensions) return SOURCE_EXTENSIONS;
+	const extras = pageExtensions.filter((ext) => !BUILTIN_EXTENSION_SET.has(ext));
+	if (extras.length === 0) return SOURCE_EXTENSIONS;
+	const escaped = extras.map((ext) => ext.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+	return new RegExp(`\\.(?:${BUILTIN_EXTENSIONS.join("|")}|${escaped.join("|")})$`);
+}
+/** Whether a directory SEGMENT is skipped at the given depth (0 = root child). */
+function isSkippedDirSegment(segment, depth) {
+	if (segment === "node_modules") return true;
+	if (depth === 0 && (segment.startsWith(".") || SCAN_IGNORED_DIRS.has(segment))) return true;
+	return false;
+}
+/** Whether a file basename is admitted as project source. */
+function isSourceBasename(base, depth, extensions) {
+	if (depth === 0 && base.startsWith(".")) return false;
+	if (!(extensions ?? SOURCE_EXTENSIONS).test(base)) return false;
+	if (/\.d\.[mc]?ts$/.test(base)) return false;
+	return true;
+}
+/**
+* Whether an absolute, slash-normalized path is one the scanner WOULD
+* admit — the same segment rules the walker applies, so a
+* directly-addressed path (`package.json`, `<root>/dist/generated.js`,
+* `types.d.ts`, a nested node_modules file) is answered exactly the
+* way the scan-based sweep would answer it: by exclusion. Existence
+* and is-a-file checks remain the caller's (this is pure path logic).
+*/
+function isScannableSourceFile(file, root, extensions) {
+	if (!file.startsWith(root + "/")) return false;
+	const segments = file.slice(root.length + 1).split("/");
+	const base = segments[segments.length - 1];
+	for (let depth = 0; depth < segments.length - 1; depth++) if (isSkippedDirSegment(segments[depth], depth)) return false;
+	return isSourceBasename(base, segments.length - 1, extensions);
+}
+/**
+* Recursively list project source files on disk.
+*
+* Unreadable directories are reported through `onFailure`, not thrown
+* and not swallowed — this walker exists to keep files from silently
+* vanishing, so a directory it cannot see must be visible too.
+*/
+async function scanProjectSourceFiles(dir, out, onFailure, depth = 0, extensions) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		onFailure({
+			dir,
+			message: `directory scan failed: ${error instanceof Error ? error.message : String(error)}`
+		});
+		return;
+	}
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (isSkippedDirSegment(entry.name, depth)) continue;
+			await scanProjectSourceFiles(full, out, onFailure, depth + 1, extensions);
+		} else if (entry.isFile() && isSourceBasename(entry.name, depth, extensions)) out.push(full);
+	}
+}
+//#endregion
+export { scanProjectSourceFiles as i, isScannableSourceFile as n, normalizeSlashes as r, buildSourceExtensions as t };
+
+//# sourceMappingURL=scan-BoP17W3w.js.map

package/dist/_chunks/scan-BoP17W3w.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-BoP17W3w.js","names":[],"sources":["../../src/analyze/scan.ts"],"sourcesContent":["/**\n * scan — project source-file disk scan shared by the crawl and the\n * graph cache.\n *\n * One walker, one rule set: the crawl uses it to find files no graph\n * reached (the provisional/pending set) and to bound graph membership,\n * and the mtime-keyed graph cache fingerprints exactly the same file\n * set — the three can never disagree about what \"the project\" is (a\n * file the crawl classifies but the fingerprint ignores would make the\n * cache silently stale).\n *\n * Skip rules are deliberately shallow: timber's router excludes only\n * `_`-prefixed directories, so `app/.well-known/page.tsx` and\n * `app/dist/page.tsx` are REAL routes — a rule that skipped `dist` or\n * dot-directories at any depth would hide legitimate route files from\n * the scan while the module graph still reached them (codex review,\n * PR #1056). Therefore:\n *\n * - `node_modules` is skipped at ANY depth (never project source, and\n *   graph membership excludes it identically)\n * - dot-prefixed and build-output directories (`dist`, `coverage`, …)\n *   are skipped only as the FIRST path segment under the root — that\n *   is where `.git`, `.timber`, `.wrangler`, and real build outputs\n *   live; deeper occurrences are walked\n *\n * Deliberately vite-free: the cache-hit path of `timber graph` reads\n * this module without booting (or even importing) Vite.\n *\n * Design docs: 47-module-environment-tooling.md §2, §Cold-path policy.\n */\n\nimport { readdir } from 'node:fs/promises';\nimport { join } from 'node:path';\n\n/**\n * Slash-normalize a Windows path — Vite's `normalizePath` for the\n * vite-free callers (the graph cache-hit path must not import Vite).\n * Same platform guard as Vite's: posix paths pass through untouched,\n * so a filename containing a literal backslash is never corrupted.\n */\nexport const normalizeSlashes: (path: string) => string =\n  process.platform === 'win32' ? (path) => path.replace(/\\\\/g, '/') : (path) => path;\n\n/** A scan failure the caller records instead of swallowing. */\nexport interface ScanFailure {\n  dir: string;\n  message: string;\n}\n\n/**\n * Directories never scanned when they are the first path segment under\n * the root. `node_modules` is additionally skipped at any depth.\n */\nexport const SCAN_IGNORED_DIRS = new Set(['node_modules', 'dist', 'test-results', 'coverage']);\n\n/**\n * Single source of truth for builtin source extensions. Includes mdx —\n * timber supports page.mdx via pageExtensions, so an unreferenced MDX\n * page must not vanish from --all output.\n */\nconst BUILTIN_EXTENSIONS = ['ts', 'tsx', 'js', 'jsx', 'mjs', 'cjs', 'mts', 'cts', 'mdx'] as const;\n\n/** Regex form of BUILTIN_EXTENSIONS for file-basename matching. */\nexport const SOURCE_EXTENSIONS = new RegExp(`\\\\.(?:${BUILTIN_EXTENSIONS.join('|')})$`);\n\n/** Set form for O(1) membership checks. */\nconst BUILTIN_EXTENSION_SET = new Set<string>(BUILTIN_EXTENSIONS);\n\n/**\n * Build a regex that matches SOURCE_EXTENSIONS plus any extra\n * extensions from the user's pageExtensions config. Returns the\n * builtin regex unchanged when nothing new is added.\n */\nexport function buildSourceExtensions(pageExtensions?: readonly string[]): RegExp {\n  if (!pageExtensions) return SOURCE_EXTENSIONS;\n  const extras = pageExtensions.filter((ext) => !BUILTIN_EXTENSION_SET.has(ext));\n  if (extras.length === 0) return SOURCE_EXTENSIONS;\n  const escaped = extras.map((ext) => ext.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&'));\n  return new RegExp(`\\\\.(?:${BUILTIN_EXTENSIONS.join('|')}|${escaped.join('|')})$`);\n}\n\n/** Whether a directory SEGMENT is skipped at the given depth (0 = root child). */\nfunction isSkippedDirSegment(segment: string, depth: number): boolean {\n  if (segment === 'node_modules') return true;\n  if (depth === 0 && (segment.startsWith('.') || SCAN_IGNORED_DIRS.has(segment))) return true;\n  return false;\n}\n\n/** Whether a file basename is admitted as project source. */\nfunction isSourceBasename(base: string, depth: number, extensions?: RegExp): boolean {\n  if (depth === 0 && base.startsWith('.')) return false;\n  if (!(extensions ?? SOURCE_EXTENSIONS).test(base)) return false;\n  // Declaration files are types-only — they never run in any environment.\n  if (/\\.d\\.[mc]?ts$/.test(base)) return false;\n  return true;\n}\n\n/**\n * Whether an absolute, slash-normalized path is one the scanner WOULD\n * admit — the same segment rules the walker applies, so a\n * directly-addressed path (`package.json`, `<root>/dist/generated.js`,\n * `types.d.ts`, a nested node_modules file) is answered exactly the\n * way the scan-based sweep would answer it: by exclusion. Existence\n * and is-a-file checks remain the caller's (this is pure path logic).\n */\nexport function isScannableSourceFile(file: string, root: string, extensions?: RegExp): boolean {\n  if (!file.startsWith(root + '/')) return false;\n  const segments = file.slice(root.length + 1).split('/');\n  const base = segments[segments.length - 1];\n  for (let depth = 0; depth < segments.length - 1; depth++) {\n    if (isSkippedDirSegment(segments[depth], depth)) return false;\n  }\n  return isSourceBasename(base, segments.length - 1, extensions);\n}\n\n/**\n * Recursively list project source files on disk.\n *\n * Unreadable directories are reported through `onFailure`, not thrown\n * and not swallowed — this walker exists to keep files from silently\n * vanishing, so a directory it cannot see must be visible too.\n */\nexport async function scanProjectSourceFiles(\n  dir: string,\n  out: string[],\n  onFailure: (failure: ScanFailure) => void,\n  depth = 0,\n  extensions?: RegExp\n): Promise<void> {\n  let entries;\n  try {\n    entries = await readdir(dir, { withFileTypes: true });\n  } catch (error) {\n    onFailure({\n      dir,\n      message: `directory scan failed: ${error instanceof Error ? error.message : String(error)}`,\n    });\n    return;\n  }\n  for (const entry of entries) {\n    const full = join(dir, entry.name);\n    if (entry.isDirectory()) {\n      if (isSkippedDirSegment(entry.name, depth)) continue;\n      await scanProjectSourceFiles(full, out, onFailure, depth + 1, extensions);\n    } else if (entry.isFile() && isSourceBasename(entry.name, depth, extensions)) {\n      out.push(full);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAa,mBACX,QAAQ,aAAa,WAAW,SAAS,KAAK,QAAQ,OAAO,GAAG,KAAK,SAAS;;;;;AAYhF,IAAa,oCAAoB,IAAI,IAAI;CAAC;CAAgB;CAAQ;CAAgB;AAAU,CAAC;;;;;;AAO7F,IAAM,qBAAqB;CAAC;CAAM;CAAO;CAAM;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK;;AAGvF,IAAa,oBAAoB,IAAI,OAAO,SAAS,mBAAmB,KAAK,GAAG,EAAE,GAAG;;AAGrF,IAAM,wBAAwB,IAAI,IAAY,kBAAkB;;;;;;AAOhE,SAAgB,sBAAsB,gBAA4C;CAChF,IAAI,CAAC,gBAAgB,OAAO;CAC5B,MAAM,SAAS,eAAe,QAAQ,QAAQ,CAAC,sBAAsB,IAAI,GAAG,CAAC;CAC7E,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,MAAM,UAAU,OAAO,KAAK,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC;CAC9E,OAAO,IAAI,OAAO,SAAS,mBAAmB,KAAK,GAAG,EAAE,GAAG,QAAQ,KAAK,GAAG,EAAE,GAAG;AAClF;;AAGA,SAAS,oBAAoB,SAAiB,OAAwB;CACpE,IAAI,YAAY,gBAAgB,OAAO;CACvC,IAAI,UAAU,MAAM,QAAQ,WAAW,GAAG,KAAK,kBAAkB,IAAI,OAAO,IAAI,OAAO;CACvF,OAAO;AACT;;AAGA,SAAS,iBAAiB,MAAc,OAAe,YAA8B;CACnF,IAAI,UAAU,KAAK,KAAK,WAAW,GAAG,GAAG,OAAO;CAChD,IAAI,EAAE,cAAc,kBAAA,CAAmB,KAAK,IAAI,GAAG,OAAO;CAE1D,IAAI,gBAAgB,KAAK,IAAI,GAAG,OAAO;CACvC,OAAO;AACT;;;;;;;;;AAUA,SAAgB,sBAAsB,MAAc,MAAc,YAA8B;CAC9F,IAAI,CAAC,KAAK,WAAW,OAAO,GAAG,GAAG,OAAO;CACzC,MAAM,WAAW,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG;CACtD,MAAM,OAAO,SAAS,SAAS,SAAS;CACxC,KAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,SAAS,GAAG,SAC/C,IAAI,oBAAoB,SAAS,QAAQ,KAAK,GAAG,OAAO;CAE1D,OAAO,iBAAiB,MAAM,SAAS,SAAS,GAAG,UAAU;AAC/D;;;;;;;;AASA,eAAsB,uBACpB,KACA,KACA,WACA,QAAQ,GACR,YACe;CACf,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CACtD,SAAS,OAAO;EACd,UAAU;GACR;GACA,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC1F,CAAC;EACD;CACF;CACA,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,OAAO,KAAK,KAAK,MAAM,IAAI;EACjC,IAAI,MAAM,YAAY,GAAG;GACvB,IAAI,oBAAoB,MAAM,MAAM,KAAK,GAAG;GAC5C,MAAM,uBAAuB,MAAM,KAAK,WAAW,QAAQ,GAAG,UAAU;EAC1E,OAAO,IAAI,MAAM,OAAO,KAAK,iBAAiB,MAAM,MAAM,OAAO,UAAU,GACzE,IAAI,KAAK,IAAI;CAEjB;AACF"}