@timber-js/app 0.2.0-alpha.191 → 0.2.0-alpha.194

package/dist/_chunks/dist-DtrJyBbw.js

@@ -0,0 +1,386 @@
+//#region src/cookies/validation.ts
+/**
+* Cookie name and value validation per RFC 6265 §4.1.1.
+*
+* This module is pure — no server or client imports — so it can be loaded
+* by both `server/request-context.ts` (which guards `getCookies().set()`)
+* and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The
+* shared validator gives both sides identical encoding contracts:
+* **the framework never silently encodes — callers emit `cookie-octet`
+* bytes or get a developer-facing error.**
+*
+* Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and
+* design/29-cookies.md §"Cookie Name and Value Validation".
+*/
+/**
+* RFC 7230 §3.2.6 token characters used as the cookie-name production in
+* RFC 6265 §4.1.1. Anchored, non-empty match.
+*
+* Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.
+* Disallowed: whitespace, controls, delimiters
+* (`(` `)` `<` `>` `@` `,` `;` `:` `\` `"` `/` `[` `]` `?` `=` `{` `}`).
+*/
+var COOKIE_NAME_RE = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
+/**
+* Format a single byte for a clear error message — escape control bytes
+* and non-ASCII as `0x..` and quote printables.
+*/
+function describeChar(value, index) {
+	const code = value.charCodeAt(index);
+	if (code < 32 || code === 127 || code > 126) return `0x${code.toString(16).padStart(2, "0")}`;
+	return JSON.stringify(value[index]);
+}
+/**
+* Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.
+* Throws a developer-facing error naming the offending byte and its index.
+*/
+function assertValidCookieName(name) {
+	if (typeof name !== "string" || name.length === 0) throw new Error("[timber] cookie name must be a non-empty string.");
+	if (!COOKIE_NAME_RE.test(name)) {
+		for (let i = 0; i < name.length; i++) if (!COOKIE_NAME_RE.test(name[i])) throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — disallowed character ${describeChar(name, i)} at index ${i}. Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, and \`!#$%&'*+-.^_\`|~\`; no whitespace, controls, or delimiters).`);
+		throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — must match RFC 6265 §4.1.1 token grammar.`);
+	}
+}
+/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */
+function isCookieOctet(code) {
+	return code === 33 || code >= 35 && code <= 43 || code >= 45 && code <= 58 || code >= 60 && code <= 91 || code >= 93 && code <= 126;
+}
+/**
+* Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`
+* production:
+*
+*     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+*     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*
+* Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are
+* valid. The wrapped form is common in upstream `Set-Cookie` headers
+* (e.g. `sid="abc"; Path=/`) and must be forwardable through
+* `setFromHeaders` verbatim — stripping or rejecting the surrounding
+* quotes would corrupt the on-the-wire bytes and break value semantics
+* for the upstream service.
+*
+* Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),
+* interior DQUOTE, comma, semicolon, backslash, DEL, and anything
+* non-ASCII. The smuggling primitive (`;`) is rejected regardless of
+* wrapping.
+*
+* Throws a developer-facing error naming the offending byte and its
+* index. Callers passing user-controlled data through the default
+* `set()` path don't need to call this — `set()` auto-encodes via
+* `encodeURIComponent`, whose output is always valid cookie-octet.
+* This validator is for the `{ raw: true }` opt-out and for
+* `setFromHeaders` forwarding.
+*/
+/**
+* Characters that must not appear in path or domain cookie attributes.
+* Semicolons delimit cookie attributes on the wire, so allowing `;` in
+* path or domain would inject extra attributes. CR/LF enable HTTP header
+* injection.
+*/
+var ATTR_INJECTION_RE = /[;\r\n]/;
+var VALID_SAME_SITE = /* @__PURE__ */ new Set([
+	"strict",
+	"lax",
+	"none"
+]);
+/**
+* Validate cookie option attributes at runtime to prevent Set-Cookie
+* header injection through unsanitized option values.
+*
+* TypeScript types enforce correct shapes at compile time, but at runtime
+* (e.g. from untyped libraries or user-controlled config) invalid values
+* could inject additional Set-Cookie attributes.
+*/
+function assertValidCookieOptions(options) {
+	if (options.sameSite !== void 0) {
+		const lower = options.sameSite.toLowerCase();
+		if (!VALID_SAME_SITE.has(lower)) throw new Error(`[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — must be 'strict', 'lax', or 'none'.`);
+	}
+	if (options.path !== void 0 && ATTR_INJECTION_RE.test(options.path)) throw new Error(`[timber] invalid cookie path ${JSON.stringify(options.path)} — path must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.domain !== void 0 && ATTR_INJECTION_RE.test(options.domain)) throw new Error(`[timber] invalid cookie domain ${JSON.stringify(options.domain)} — domain must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.maxAge !== void 0 && (typeof options.maxAge !== "number" || !Number.isFinite(options.maxAge))) throw new Error(`[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — maxAge must be a finite number.`);
+}
+function assertValidCookieValue(name, value) {
+	if (typeof value !== "string") throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);
+	const wrapped = value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34;
+	const start = wrapped ? 1 : 0;
+	const end = wrapped ? value.length - 1 : value.length;
+	for (let i = start; i < end; i++) if (!isCookieOctet(value.charCodeAt(i))) throw new Error(`[timber] cookie ${JSON.stringify(name)}: invalid cookie value — disallowed character ${describeChar(value, i)} at index ${i}. Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes (US-ASCII printable, excluding whitespace, \`"\`, \`,\`, \`;\`, and \`\\\`), optionally enclosed in a single DQUOTE pair. Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/cookie@2.0.1/node_modules/cookie/dist/index.js
+/**
+* RegExp to match cookie-name in RFC 6265 sec 4.1.1
+* This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+* which has been replaced by the token definition in RFC 7230 appendix B.
+*
+* cookie-name       = token
+* token             = 1*tchar
+* tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+*                     "*" / "+" / "-" / "." / "^" / "_" /
+*                     "`" / "|" / "~" / DIGIT / ALPHA
+*
+* Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+* Allow same range as cookie value, except `=`, which delimits end of name.
+*/
+var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+/**
+* RegExp to match cookie-value in RFC 6265 sec 4.1.1
+*
+* cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+* cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*                     ; US-ASCII characters excluding CTLs,
+*                     ; whitespace DQUOTE, comma, semicolon,
+*                     ; and backslash
+*
+* Allowing more characters: https://github.com/jshttp/cookie/issues/191
+* Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+*/
+var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+/**
+* RegExp to match domain-value in RFC 6265 sec 4.1.1
+*
+* domain-value      = <subdomain>
+*                     ; defined in [RFC1034], Section 3.5, as
+*                     ; enhanced by [RFC1123], Section 2.1
+* <subdomain>       = <label> | <subdomain> "." <label>
+* <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+*                     Labels must be 63 characters or less.
+*                     'let-dig' not 'letter' in the first char, per RFC1123
+* <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+* <let-dig-hyp>     = <let-dig> | "-"
+* <let-dig>         = <letter> | <digit>
+* <letter>          = any one of the 52 alphabetic characters A through Z in
+*                     upper case and a through z in lower case
+* <digit>           = any one of the ten digits 0 through 9
+*
+* Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+*
+* > (Note that a leading %x2E ("."), if present, is ignored even though that
+* character is not permitted, but a trailing %x2E ("."), if present, will
+* cause the user agent to ignore the attribute.)
+*/
+var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/**
+* RegExp to match path-value in RFC 6265 sec 4.1.1
+*
+* path-value        = <any CHAR except CTLs or ";">
+* CHAR              = %x01-7F
+*                     ; defined in RFC 5234 appendix B.1
+*/
+var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+/**
+* RegExp to match max-age-value in RFC 6265 sec 5.6.2
+*/
+var maxAgeRegExp = /^-?\d+$/;
+/**
+* RegExp to match RFC 6265 cookie-octet values (without % to preserve roundtrip) that need no URL encoding.
+*/
+var cookieOctetRegExp = /^[!#$&'()*+\-.\/0-9:<=>?@A-Z[\]\^_`a-z{|}~]*$/;
+var NullObject = /* @__PURE__ */ (() => {
+	const C = function() {};
+	C.prototype = Object.create(null);
+	return C;
+})();
+/**
+* Parse a `Cookie` header.
+*
+* Parse the given cookie header string into an object
+* The object has the various cookies as keys(names) => values
+*/
+function parseCookie(str, options) {
+	const obj = new NullObject();
+	const len = str.length;
+	if (len < 2) return obj;
+	const dec = options?.decode || decode;
+	let index = 0;
+	do {
+		const eqIdx = eqIndex(str, index, len);
+		if (eqIdx === len) break;
+		const endIdx = endIndex(str, index, len);
+		if (eqIdx > endIdx) {
+			index = str.lastIndexOf(";", eqIdx - 1) + 1;
+			continue;
+		}
+		const key = valueSlice(str, index, eqIdx);
+		if (obj[key] === void 0) obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
+		index = endIdx + 1;
+	} while (index < len);
+	return obj;
+}
+/**
+* Serialize data into a cookie header.
+*
+* Serialize a name value pair into a cookie string suitable for
+* http headers. An optional options object specifies cookie parameters.
+*
+* stringifySetCookie({ name: 'foo', value: 'bar', httpOnly: true })
+*   => "foo=bar; HttpOnly"
+*/
+function stringifySetCookie(cookie, options) {
+	const enc = options?.encode || defaultEncode;
+	if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
+	const value = cookie.value == null ? "" : enc(cookie.value);
+	if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
+	let str = cookie.name + "=" + value;
+	if (cookie.maxAge !== void 0) {
+		if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+		str += "; Max-Age=" + cookie.maxAge;
+	}
+	if (cookie.domain) {
+		if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+		str += "; Domain=" + cookie.domain;
+	}
+	if (cookie.path) {
+		if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
+		str += "; Path=" + cookie.path;
+	}
+	if (cookie.expires) {
+		if (!Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+		str += "; Expires=" + cookie.expires.toUTCString();
+	}
+	if (cookie.httpOnly) str += "; HttpOnly";
+	if (cookie.secure) str += "; Secure";
+	if (cookie.partitioned) str += "; Partitioned";
+	if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
+		case "low":
+			str += "; Priority=Low";
+			break;
+		case "medium":
+			str += "; Priority=Medium";
+			break;
+		case "high":
+			str += "; Priority=High";
+			break;
+		default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+	}
+	if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
+		case true:
+		case "strict":
+			str += "; SameSite=Strict";
+			break;
+		case "lax":
+			str += "; SameSite=Lax";
+			break;
+		case "none":
+			str += "; SameSite=None";
+			break;
+		default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+	}
+	return str;
+}
+/**
+* Deserialize a `Set-Cookie` header into an object.
+*
+* parseSetCookie('foo=bar; HttpOnly')
+*   => { name: 'foo', value: 'bar', httpOnly: true }
+*/
+function parseSetCookie(str, options) {
+	const dec = options?.decode || decode;
+	const len = str.length;
+	const endIdx = endIndex(str, 0, len);
+	let eqIdx = eqIndex(str, 0, len);
+	const setCookie = eqIdx < endIdx ? {
+		name: valueSlice(str, 0, eqIdx),
+		value: dec(valueSlice(str, eqIdx + 1, endIdx))
+	} : {
+		name: "",
+		value: dec(valueSlice(str, 0, endIdx))
+	};
+	let index = endIdx + 1;
+	while (index < len) {
+		const endIdx = endIndex(str, index, len);
+		if (eqIdx < index) eqIdx = eqIndex(str, index, len);
+		const attr = eqIdx < endIdx ? valueSlice(str, index, eqIdx) : valueSlice(str, index, endIdx);
+		const val = eqIdx < endIdx ? valueSlice(str, eqIdx + 1, endIdx) : void 0;
+		switch (attr.toLowerCase()) {
+			case "httponly":
+				setCookie.httpOnly = true;
+				break;
+			case "secure":
+				setCookie.secure = true;
+				break;
+			case "partitioned":
+				setCookie.partitioned = true;
+				break;
+			case "domain":
+				setCookie.domain = val;
+				break;
+			case "path":
+				setCookie.path = val;
+				break;
+			case "max-age":
+				if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Number(val);
+				break;
+			case "expires":
+				if (!val) break;
+				const date = new Date(val);
+				if (Number.isFinite(date.valueOf())) setCookie.expires = date;
+				break;
+			case "priority":
+				if (!val) break;
+				const priority = val.toLowerCase();
+				if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
+				break;
+			case "samesite":
+				if (!val) break;
+				const sameSite = val.toLowerCase();
+				if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
+		}
+		index = endIdx + 1;
+	}
+	return setCookie;
+}
+/**
+* Find the next `;` character, or return `len`.
+*/
+function endIndex(str, min, len) {
+	const index = str.indexOf(";", min);
+	return index === -1 ? len : index;
+}
+/**
+* Find the next `=` character, or return `len`.
+*/
+function eqIndex(str, min, len) {
+	const index = str.indexOf("=", min);
+	return index === -1 ? len : index;
+}
+/**
+* Slice out a value between startPod to max.
+*/
+function valueSlice(str, min, max) {
+	if (min === max) return "";
+	let start = min;
+	let end = max;
+	do {
+		const code = str.charCodeAt(start);
+		if (code !== 32 && code !== 9) break;
+	} while (++start < end);
+	while (end > start) {
+		const code = str.charCodeAt(end - 1);
+		if (code !== 32 && code !== 9) break;
+		end--;
+	}
+	return str.slice(start, end);
+}
+/**
+* URL-decode string value. Optimized to skip native call when no %.
+*/
+function decode(str) {
+	if (str.indexOf("%") === -1) return str;
+	try {
+		return decodeURIComponent(str);
+	} catch (e) {
+		return str;
+	}
+}
+/**
+* URL-encode string value. Optimized to skip native call for roundtrip-safe cookie-octet values.
+*/
+function defaultEncode(str) {
+	return cookieOctetRegExp.test(str) ? str : encodeURIComponent(str);
+}
+//#endregion
+export { assertValidCookieOptions as a, assertValidCookieName as i, parseSetCookie as n, assertValidCookieValue as o, stringifySetCookie as r, parseCookie as t };
+
+//# sourceMappingURL=dist-DtrJyBbw.js.map

package/dist/_chunks/dist-DtrJyBbw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-DtrJyBbw.js","names":[],"sources":["../../src/cookies/validation.ts","../../../../node_modules/.pnpm/cookie@2.0.1/node_modules/cookie/dist/index.js"],"sourcesContent":["/**\n * Cookie name and value validation per RFC 6265 §4.1.1.\n *\n * This module is pure — no server or client imports — so it can be loaded\n * by both `server/request-context.ts` (which guards `getCookies().set()`)\n * and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The\n * shared validator gives both sides identical encoding contracts:\n * **the framework never silently encodes — callers emit `cookie-octet`\n * bytes or get a developer-facing error.**\n *\n * Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and\n * design/29-cookies.md §\"Cookie Name and Value Validation\".\n */\n\n// ─── RFC 6265 cookie-octet ────────────────────────────────────────────────\n//\n//   cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n//\n// Equivalently: US-ASCII printable bytes excluding whitespace, `\"` (0x22),\n// `,` (0x2C), `;` (0x3B), `\\` (0x5C), and DEL (0x7F).\n\n/**\n * RFC 7230 §3.2.6 token characters used as the cookie-name production in\n * RFC 6265 §4.1.1. Anchored, non-empty match.\n *\n * Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.\n * Disallowed: whitespace, controls, delimiters\n * (`(` `)` `<` `>` `@` `,` `;` `:` `\\` `\"` `/` `[` `]` `?` `=` `{` `}`).\n */\nconst COOKIE_NAME_RE = /^[!#$%&'*+\\-.0-9A-Z^_`a-z|~]+$/;\n\n/**\n * Format a single byte for a clear error message — escape control bytes\n * and non-ASCII as `0x..` and quote printables.\n */\nfunction describeChar(value: string, index: number): string {\n  const code = value.charCodeAt(index);\n  if (code < 0x20 || code === 0x7f || code > 0x7e) {\n    return `0x${code.toString(16).padStart(2, '0')}`;\n  }\n  return JSON.stringify(value[index]);\n}\n\n/**\n * Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.\n * Throws a developer-facing error naming the offending byte and its index.\n */\nexport function assertValidCookieName(name: string): void {\n  if (typeof name !== 'string' || name.length === 0) {\n    throw new Error('[timber] cookie name must be a non-empty string.');\n  }\n  if (!COOKIE_NAME_RE.test(name)) {\n    for (let i = 0; i < name.length; i++) {\n      if (!COOKIE_NAME_RE.test(name[i])) {\n        throw new Error(\n          `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n            `disallowed character ${describeChar(name, i)} at index ${i}. ` +\n            `Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, ` +\n            `and \\`!#$%&'*+-.^_\\`|~\\`; no whitespace, controls, or delimiters).`\n        );\n      }\n    }\n    throw new Error(\n      `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n        `must match RFC 6265 §4.1.1 token grammar.`\n    );\n  }\n}\n\n/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */\nfunction isCookieOctet(code: number): boolean {\n  return (\n    code === 0x21 ||\n    (code >= 0x23 && code <= 0x2b) ||\n    (code >= 0x2d && code <= 0x3a) ||\n    (code >= 0x3c && code <= 0x5b) ||\n    (code >= 0x5d && code <= 0x7e)\n  );\n}\n\n/**\n * Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`\n * production:\n *\n *     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n *     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *\n * Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are\n * valid. The wrapped form is common in upstream `Set-Cookie` headers\n * (e.g. `sid=\"abc\"; Path=/`) and must be forwardable through\n * `setFromHeaders` verbatim — stripping or rejecting the surrounding\n * quotes would corrupt the on-the-wire bytes and break value semantics\n * for the upstream service.\n *\n * Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),\n * interior DQUOTE, comma, semicolon, backslash, DEL, and anything\n * non-ASCII. The smuggling primitive (`;`) is rejected regardless of\n * wrapping.\n *\n * Throws a developer-facing error naming the offending byte and its\n * index. Callers passing user-controlled data through the default\n * `set()` path don't need to call this — `set()` auto-encodes via\n * `encodeURIComponent`, whose output is always valid cookie-octet.\n * This validator is for the `{ raw: true }` opt-out and for\n * `setFromHeaders` forwarding.\n */\n// ─── Cookie attribute validation ──────────────────────────────────────────\n\n/**\n * Characters that must not appear in path or domain cookie attributes.\n * Semicolons delimit cookie attributes on the wire, so allowing `;` in\n * path or domain would inject extra attributes. CR/LF enable HTTP header\n * injection.\n */\nconst ATTR_INJECTION_RE = /[;\\r\\n]/;\n\nconst VALID_SAME_SITE = new Set(['strict', 'lax', 'none']);\n\n/**\n * Validate cookie option attributes at runtime to prevent Set-Cookie\n * header injection through unsanitized option values.\n *\n * TypeScript types enforce correct shapes at compile time, but at runtime\n * (e.g. from untyped libraries or user-controlled config) invalid values\n * could inject additional Set-Cookie attributes.\n */\nexport function assertValidCookieOptions(options: {\n  sameSite?: string;\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n}): void {\n  if (options.sameSite !== undefined) {\n    const lower = options.sameSite.toLowerCase();\n    if (!VALID_SAME_SITE.has(lower)) {\n      throw new Error(\n        `[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — ` +\n          `must be 'strict', 'lax', or 'none'.`\n      );\n    }\n  }\n  if (options.path !== undefined && ATTR_INJECTION_RE.test(options.path)) {\n    throw new Error(\n      `[timber] invalid cookie path ${JSON.stringify(options.path)} — ` +\n        `path must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (options.domain !== undefined && ATTR_INJECTION_RE.test(options.domain)) {\n    throw new Error(\n      `[timber] invalid cookie domain ${JSON.stringify(options.domain)} — ` +\n        `domain must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (\n    options.maxAge !== undefined &&\n    (typeof options.maxAge !== 'number' || !Number.isFinite(options.maxAge))\n  ) {\n    throw new Error(\n      `[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — ` +\n        `maxAge must be a finite number.`\n    );\n  }\n}\n\nexport function assertValidCookieValue(name: string, value: string): void {\n  if (typeof value !== 'string') {\n    throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);\n  }\n  // Detect the DQUOTE-wrapped form: at least two characters and both\n  // endpoints are `\"`. The interior must be pure cookie-octet (no\n  // interior DQUOTEs allowed — the grammar says *cookie-octet, and\n  // cookie-octet excludes 0x22).\n  const wrapped =\n    value.length >= 2 &&\n    value.charCodeAt(0) === 0x22 &&\n    value.charCodeAt(value.length - 1) === 0x22;\n  const start = wrapped ? 1 : 0;\n  const end = wrapped ? value.length - 1 : value.length;\n  for (let i = start; i < end; i++) {\n    const code = value.charCodeAt(i);\n    if (!isCookieOctet(code)) {\n      throw new Error(\n        `[timber] cookie ${JSON.stringify(name)}: invalid cookie value — ` +\n          `disallowed character ${describeChar(value, i)} at index ${i}. ` +\n          `Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes ` +\n          `(US-ASCII printable, excluding whitespace, \\`\"\\`, \\`,\\`, \\`;\\`, and \\`\\\\\\`), ` +\n          `optionally enclosed in a single DQUOTE pair. ` +\n          `Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`\n      );\n    }\n  }\n}\n","/**\n * RegExp to match cookie-name in RFC 6265 sec 4.1.1\n * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2\n * which has been replaced by the token definition in RFC 7230 appendix B.\n *\n * cookie-name       = token\n * token             = 1*tchar\n * tchar             = \"!\" / \"#\" / \"$\" / \"%\" / \"&\" / \"'\" /\n *                     \"*\" / \"+\" / \"-\" / \".\" / \"^\" / \"_\" /\n *                     \"`\" / \"|\" / \"~\" / DIGIT / ALPHA\n *\n * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191\n * Allow same range as cookie value, except `=`, which delimits end of name.\n */\nconst cookieNameRegExp = /^[\\u0021-\\u003A\\u003C\\u003E-\\u007E]+$/;\n/**\n * RegExp to match cookie-value in RFC 6265 sec 4.1.1\n *\n * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *                     ; US-ASCII characters excluding CTLs,\n *                     ; whitespace DQUOTE, comma, semicolon,\n *                     ; and backslash\n *\n * Allowing more characters: https://github.com/jshttp/cookie/issues/191\n * Comma, backslash, and DQUOTE are not part of the parsing algorithm.\n */\nconst cookieValueRegExp = /^[\\u0021-\\u003A\\u003C-\\u007E]*$/;\n/**\n * RegExp to match domain-value in RFC 6265 sec 4.1.1\n *\n * domain-value      = <subdomain>\n *                     ; defined in [RFC1034], Section 3.5, as\n *                     ; enhanced by [RFC1123], Section 2.1\n * <subdomain>       = <label> | <subdomain> \".\" <label>\n * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]\n *                     Labels must be 63 characters or less.\n *                     'let-dig' not 'letter' in the first char, per RFC1123\n * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>\n * <let-dig-hyp>     = <let-dig> | \"-\"\n * <let-dig>         = <letter> | <digit>\n * <letter>          = any one of the 52 alphabetic characters A through Z in\n *                     upper case and a through z in lower case\n * <digit>           = any one of the ten digits 0 through 9\n *\n * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173\n *\n * > (Note that a leading %x2E (\".\"), if present, is ignored even though that\n * character is not permitted, but a trailing %x2E (\".\"), if present, will\n * cause the user agent to ignore the attribute.)\n */\nconst domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;\n/**\n * RegExp to match path-value in RFC 6265 sec 4.1.1\n *\n * path-value        = <any CHAR except CTLs or \";\">\n * CHAR              = %x01-7F\n *                     ; defined in RFC 5234 appendix B.1\n */\nconst pathValueRegExp = /^[\\u0020-\\u003A\\u003D-\\u007E]*$/;\n/**\n * RegExp to match max-age-value in RFC 6265 sec 5.6.2\n */\nconst maxAgeRegExp = /^-?\\d+$/;\n/**\n * RegExp to match RFC 6265 cookie-octet values (without % to preserve roundtrip) that need no URL encoding.\n */\nconst cookieOctetRegExp = /^[!#$&'()*+\\-.\\/0-9:<=>?@A-Z[\\]\\^_`a-z{|}~]*$/;\nconst NullObject = /* @__PURE__ */ (() => {\n    const C = function () { };\n    C.prototype = Object.create(null);\n    return C;\n})();\n/**\n * Parse a `Cookie` header.\n *\n * Parse the given cookie header string into an object\n * The object has the various cookies as keys(names) => values\n */\nexport function parseCookie(str, options) {\n    const obj = new NullObject();\n    const len = str.length;\n    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.\n    if (len < 2)\n        return obj;\n    const dec = options?.decode || decode;\n    let index = 0;\n    do {\n        const eqIdx = eqIndex(str, index, len);\n        if (eqIdx === len)\n            break; // No more cookie pairs.\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx > endIdx) {\n            // backtrack on prior semicolon\n            index = str.lastIndexOf(\";\", eqIdx - 1) + 1;\n            continue;\n        }\n        const key = valueSlice(str, index, eqIdx);\n        // only assign once\n        if (obj[key] === undefined) {\n            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));\n        }\n        index = endIdx + 1;\n    } while (index < len);\n    return obj;\n}\n/**\n * Stringifies an object into an HTTP `Cookie` header.\n */\nexport function stringifyCookie(cookie, options) {\n    const enc = options?.encode || defaultEncode;\n    const keys = Object.keys(cookie);\n    let str = \"\";\n    for (let i = 0; i < keys.length; i++) {\n        const name = keys[i];\n        const val = cookie[name];\n        if (val === undefined)\n            continue;\n        if (!cookieNameRegExp.test(name)) {\n            throw new TypeError(`cookie name is invalid: ${name}`);\n        }\n        const value = enc(val);\n        if (!cookieValueRegExp.test(value)) {\n            throw new TypeError(`cookie val is invalid: ${val}`);\n        }\n        if (str)\n            str += \"; \";\n        str += name + \"=\" + value;\n    }\n    return str;\n}\n/**\n * Serialize data into a cookie header.\n *\n * Serialize a name value pair into a cookie string suitable for\n * http headers. An optional options object specifies cookie parameters.\n *\n * stringifySetCookie({ name: 'foo', value: 'bar', httpOnly: true })\n *   => \"foo=bar; HttpOnly\"\n */\nexport function stringifySetCookie(cookie, options) {\n    const enc = options?.encode || defaultEncode;\n    if (!cookieNameRegExp.test(cookie.name)) {\n        throw new TypeError(`argument name is invalid: ${cookie.name}`);\n    }\n    const value = cookie.value == null ? \"\" : enc(cookie.value);\n    if (!cookieValueRegExp.test(value)) {\n        throw new TypeError(`argument val is invalid: ${cookie.value}`);\n    }\n    let str = cookie.name + \"=\" + value;\n    if (cookie.maxAge !== undefined) {\n        if (!Number.isInteger(cookie.maxAge)) {\n            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);\n        }\n        str += \"; Max-Age=\" + cookie.maxAge;\n    }\n    if (cookie.domain) {\n        if (!domainValueRegExp.test(cookie.domain)) {\n            throw new TypeError(`option domain is invalid: ${cookie.domain}`);\n        }\n        str += \"; Domain=\" + cookie.domain;\n    }\n    if (cookie.path) {\n        if (!pathValueRegExp.test(cookie.path)) {\n            throw new TypeError(`option path is invalid: ${cookie.path}`);\n        }\n        str += \"; Path=\" + cookie.path;\n    }\n    if (cookie.expires) {\n        if (!Number.isFinite(cookie.expires.valueOf())) {\n            throw new TypeError(`option expires is invalid: ${cookie.expires}`);\n        }\n        str += \"; Expires=\" + cookie.expires.toUTCString();\n    }\n    if (cookie.httpOnly) {\n        str += \"; HttpOnly\";\n    }\n    if (cookie.secure) {\n        str += \"; Secure\";\n    }\n    if (cookie.partitioned) {\n        str += \"; Partitioned\";\n    }\n    if (cookie.priority) {\n        const priority = typeof cookie.priority === \"string\"\n            ? cookie.priority.toLowerCase()\n            : undefined;\n        switch (priority) {\n            case \"low\":\n                str += \"; Priority=Low\";\n                break;\n            case \"medium\":\n                str += \"; Priority=Medium\";\n                break;\n            case \"high\":\n                str += \"; Priority=High\";\n                break;\n            default:\n                throw new TypeError(`option priority is invalid: ${cookie.priority}`);\n        }\n    }\n    if (cookie.sameSite) {\n        const sameSite = typeof cookie.sameSite === \"string\"\n            ? cookie.sameSite.toLowerCase()\n            : cookie.sameSite;\n        switch (sameSite) {\n            case true:\n            case \"strict\":\n                str += \"; SameSite=Strict\";\n                break;\n            case \"lax\":\n                str += \"; SameSite=Lax\";\n                break;\n            case \"none\":\n                str += \"; SameSite=None\";\n                break;\n            default:\n                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);\n        }\n    }\n    return str;\n}\n/**\n * Deserialize a `Set-Cookie` header into an object.\n *\n * parseSetCookie('foo=bar; HttpOnly')\n *   => { name: 'foo', value: 'bar', httpOnly: true }\n */\nexport function parseSetCookie(str, options) {\n    const dec = options?.decode || decode;\n    const len = str.length;\n    const endIdx = endIndex(str, 0, len);\n    let eqIdx = eqIndex(str, 0, len);\n    const setCookie = eqIdx < endIdx\n        ? {\n            name: valueSlice(str, 0, eqIdx),\n            value: dec(valueSlice(str, eqIdx + 1, endIdx)),\n        }\n        : { name: \"\", value: dec(valueSlice(str, 0, endIdx)) };\n    let index = endIdx + 1;\n    while (index < len) {\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx < index)\n            eqIdx = eqIndex(str, index, len);\n        const attr = eqIdx < endIdx\n            ? valueSlice(str, index, eqIdx)\n            : valueSlice(str, index, endIdx);\n        const val = eqIdx < endIdx ? valueSlice(str, eqIdx + 1, endIdx) : undefined;\n        switch (attr.toLowerCase()) {\n            case \"httponly\":\n                setCookie.httpOnly = true;\n                break;\n            case \"secure\":\n                setCookie.secure = true;\n                break;\n            case \"partitioned\":\n                setCookie.partitioned = true;\n                break;\n            case \"domain\":\n                setCookie.domain = val;\n                break;\n            case \"path\":\n                setCookie.path = val;\n                break;\n            case \"max-age\":\n                if (val && maxAgeRegExp.test(val))\n                    setCookie.maxAge = Number(val);\n                break;\n            case \"expires\":\n                if (!val)\n                    break;\n                const date = new Date(val);\n                if (Number.isFinite(date.valueOf()))\n                    setCookie.expires = date;\n                break;\n            case \"priority\":\n                if (!val)\n                    break;\n                const priority = val.toLowerCase();\n                if (priority === \"low\" ||\n                    priority === \"medium\" ||\n                    priority === \"high\") {\n                    setCookie.priority = priority;\n                }\n                break;\n            case \"samesite\":\n                if (!val)\n                    break;\n                const sameSite = val.toLowerCase();\n                if (sameSite === \"lax\" ||\n                    sameSite === \"strict\" ||\n                    sameSite === \"none\") {\n                    setCookie.sameSite = sameSite;\n                }\n                break;\n        }\n        index = endIdx + 1;\n    }\n    return setCookie;\n}\n/**\n * Find the next `;` character, or return `len`.\n */\nfunction endIndex(str, min, len) {\n    const index = str.indexOf(\";\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Find the next `=` character, or return `len`.\n */\nfunction eqIndex(str, min, len) {\n    const index = str.indexOf(\"=\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Slice out a value between startPod to max.\n */\nfunction valueSlice(str, min, max) {\n    if (min === max)\n        return \"\";\n    let start = min;\n    let end = max;\n    do {\n        const code = str.charCodeAt(start);\n        if (code !== 32 /*   */ && code !== 9 /* \\t */)\n            break;\n    } while (++start < end);\n    while (end > start) {\n        const code = str.charCodeAt(end - 1);\n        if (code !== 32 /*   */ && code !== 9 /* \\t */)\n            break;\n        end--;\n    }\n    return str.slice(start, end);\n}\n/**\n * URL-decode string value. Optimized to skip native call when no %.\n */\nfunction decode(str) {\n    if (str.indexOf(\"%\") === -1)\n        return str;\n    try {\n        return decodeURIComponent(str);\n    }\n    catch (e) {\n        return str;\n    }\n}\n/**\n * URL-encode string value. Optimized to skip native call for roundtrip-safe cookie-octet values.\n */\nfunction defaultEncode(str) {\n    return cookieOctetRegExp.test(str) ? str : encodeURIComponent(str);\n}\n//# sourceMappingURL=index.js.map"],"x_google_ignoreList":[1],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,iBAAiB;;;;;AAMvB,SAAS,aAAa,OAAe,OAAuB;CAC1D,MAAM,OAAO,MAAM,WAAW,KAAK;CACnC,IAAI,OAAO,MAAQ,SAAS,OAAQ,OAAO,KACzC,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE/C,OAAO,KAAK,UAAU,MAAM,MAAM;AACpC;;;;;AAMA,SAAgB,sBAAsB,MAAoB;CACxD,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,GAC9B,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,0BAC3B,aAAa,MAAM,CAAC,EAAE,YAAY,EAAE,0JAGhE;EAGJ,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,6CAEvD;CACF;AACF;;AAGA,SAAS,cAAc,MAAuB;CAC5C,OACE,SAAS,MACR,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAoB;AAE1B,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAU;CAAO;AAAM,CAAC;;;;;;;;;AAUzD,SAAgB,yBAAyB,SAKhC;CACP,IAAI,QAAQ,aAAa,KAAA,GAAW;EAClC,MAAM,QAAQ,QAAQ,SAAS,YAAY;EAC3C,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAC5B,MAAM,IAAI,MACR,0CAA0C,KAAK,UAAU,QAAQ,QAAQ,EAAE,uCAE7E;CAEJ;CACA,IAAI,QAAQ,SAAS,KAAA,KAAa,kBAAkB,KAAK,QAAQ,IAAI,GACnE,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,QAAQ,IAAI,EAAE,uEAE/D;CAEF,IAAI,QAAQ,WAAW,KAAA,KAAa,kBAAkB,KAAK,QAAQ,MAAM,GACvE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,yEAEnE;CAEF,IACE,QAAQ,WAAW,KAAA,MAClB,OAAO,QAAQ,WAAW,YAAY,CAAC,OAAO,SAAS,QAAQ,MAAM,IAEtE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,mCAEnE;AAEJ;AAEA,SAAgB,uBAAuB,MAAc,OAAqB;CACxE,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,IAAI,EAAE,iCAAiC;CAM3F,MAAM,UACJ,MAAM,UAAU,KAChB,MAAM,WAAW,CAAC,MAAM,MACxB,MAAM,WAAW,MAAM,SAAS,CAAC,MAAM;CACzC,MAAM,QAAQ,UAAU,IAAI;CAC5B,MAAM,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM;CAC/C,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,KAE3B,IAAI,CAAC,cADQ,MAAM,WAAW,CACX,CAAI,GACrB,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,IAAI,EAAE,gDACd,aAAa,OAAO,CAAC,EAAE,YAAY,EAAE,gRAKjE;AAGN;;;;;;;;;;;;;;;;;ACjLA,IAAM,mBAAmB;;;;;;;;;;;;;AAazB,IAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;AAwB1B,IAAM,oBAAoB;;;;;;;;AAQ1B,IAAM,kBAAkB;;;;AAIxB,IAAM,eAAe;;;;AAIrB,IAAM,oBAAoB;AAC1B,IAAM,aAA6B,uBAAO;CACtC,MAAM,IAAI,WAAY,CAAE;CACxB,EAAE,YAAY,OAAO,OAAO,IAAI;CAChC,OAAO;AACX,EAAA,CAAG;;;;;;;AAOH,SAAgB,YAAY,KAAK,SAAS;CACtC,MAAM,MAAM,IAAI,WAAW;CAC3B,MAAM,MAAM,IAAI;CAEhB,IAAI,MAAM,GACN,OAAO;CACX,MAAM,MAAM,SAAS,UAAU;CAC/B,IAAI,QAAQ;CACZ,GAAG;EACC,MAAM,QAAQ,QAAQ,KAAK,OAAO,GAAG;EACrC,IAAI,UAAU,KACV;EACJ,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;EACvC,IAAI,QAAQ,QAAQ;GAEhB,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC,IAAI;GAC1C;EACJ;EACA,MAAM,MAAM,WAAW,KAAK,OAAO,KAAK;EAExC,IAAI,IAAI,SAAS,KAAA,GACb,IAAI,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;EAErD,QAAQ,SAAS;CACrB,SAAS,QAAQ;CACjB,OAAO;AACX;;;;;;;;;;AAmCA,SAAgB,mBAAmB,QAAQ,SAAS;CAChD,MAAM,MAAM,SAAS,UAAU;CAC/B,IAAI,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAClC,MAAM,IAAI,UAAU,6BAA6B,OAAO,MAAM;CAElE,MAAM,QAAQ,OAAO,SAAS,OAAO,KAAK,IAAI,OAAO,KAAK;CAC1D,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC7B,MAAM,IAAI,UAAU,4BAA4B,OAAO,OAAO;CAElE,IAAI,MAAM,OAAO,OAAO,MAAM;CAC9B,IAAI,OAAO,WAAW,KAAA,GAAW;EAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,MAAM,GAC/B,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAEpE,OAAO,eAAe,OAAO;CACjC;CACA,IAAI,OAAO,QAAQ;EACf,IAAI,CAAC,kBAAkB,KAAK,OAAO,MAAM,GACrC,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAEpE,OAAO,cAAc,OAAO;CAChC;CACA,IAAI,OAAO,MAAM;EACb,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,GACjC,MAAM,IAAI,UAAU,2BAA2B,OAAO,MAAM;EAEhE,OAAO,YAAY,OAAO;CAC9B;CACA,IAAI,OAAO,SAAS;EAChB,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC,GACzC,MAAM,IAAI,UAAU,8BAA8B,OAAO,SAAS;EAEtE,OAAO,eAAe,OAAO,QAAQ,YAAY;CACrD;CACA,IAAI,OAAO,UACP,OAAO;CAEX,IAAI,OAAO,QACP,OAAO;CAEX,IAAI,OAAO,aACP,OAAO;CAEX,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,KAAA,GACN;EACI,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAC5E;CAEJ,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,OAAO,UACb;EACI,KAAK;EACL,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAC5E;CAEJ,OAAO;AACX;;;;;;;AAOA,SAAgB,eAAe,KAAK,SAAS;CACzC,MAAM,MAAM,SAAS,UAAU;CAC/B,MAAM,MAAM,IAAI;CAChB,MAAM,SAAS,SAAS,KAAK,GAAG,GAAG;CACnC,IAAI,QAAQ,QAAQ,KAAK,GAAG,GAAG;CAC/B,MAAM,YAAY,QAAQ,SACpB;EACE,MAAM,WAAW,KAAK,GAAG,KAAK;EAC9B,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;CACjD,IACE;EAAE,MAAM;EAAI,OAAO,IAAI,WAAW,KAAK,GAAG,MAAM,CAAC;CAAE;CACzD,IAAI,QAAQ,SAAS;CACrB,OAAO,QAAQ,KAAK;EAChB,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;EACvC,IAAI,QAAQ,OACR,QAAQ,QAAQ,KAAK,OAAO,GAAG;EACnC,MAAM,OAAO,QAAQ,SACf,WAAW,KAAK,OAAO,KAAK,IAC5B,WAAW,KAAK,OAAO,MAAM;EACnC,MAAM,MAAM,QAAQ,SAAS,WAAW,KAAK,QAAQ,GAAG,MAAM,IAAI,KAAA;EAClE,QAAQ,KAAK,YAAY,GAAzB;GACI,KAAK;IACD,UAAU,WAAW;IACrB;GACJ,KAAK;IACD,UAAU,SAAS;IACnB;GACJ,KAAK;IACD,UAAU,cAAc;IACxB;GACJ,KAAK;IACD,UAAU,SAAS;IACnB;GACJ,KAAK;IACD,UAAU,OAAO;IACjB;GACJ,KAAK;IACD,IAAI,OAAO,aAAa,KAAK,GAAG,GAC5B,UAAU,SAAS,OAAO,GAAG;IACjC;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,OAAO,IAAI,KAAK,GAAG;IACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,GAC9B,UAAU,UAAU;IACxB;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,WAAW,IAAI,YAAY;IACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;IAEzB;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,WAAW,IAAI,YAAY;IACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;EAGjC;EACA,QAAQ,SAAS;CACrB;CACA,OAAO;AACX;;;;AAIA,SAAS,SAAS,KAAK,KAAK,KAAK;CAC7B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;CAClC,OAAO,UAAU,KAAK,MAAM;AAChC;;;;AAIA,SAAS,QAAQ,KAAK,KAAK,KAAK;CAC5B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;CAClC,OAAO,UAAU,KAAK,MAAM;AAChC;;;;AAIA,SAAS,WAAW,KAAK,KAAK,KAAK;CAC/B,IAAI,QAAQ,KACR,OAAO;CACX,IAAI,QAAQ;CACZ,IAAI,MAAM;CACV,GAAG;EACC,MAAM,OAAO,IAAI,WAAW,KAAK;EACjC,IAAI,SAAS,MAAc,SAAS,GAChC;CACR,SAAS,EAAE,QAAQ;CACnB,OAAO,MAAM,OAAO;EAChB,MAAM,OAAO,IAAI,WAAW,MAAM,CAAC;EACnC,IAAI,SAAS,MAAc,SAAS,GAChC;EACJ;CACJ;CACA,OAAO,IAAI,MAAM,OAAO,GAAG;AAC/B;;;;AAIA,SAAS,OAAO,KAAK;CACjB,IAAI,IAAI,QAAQ,GAAG,MAAM,IACrB,OAAO;CACX,IAAI;EACA,OAAO,mBAAmB,GAAG;CACjC,SACO,GAAG;EACN,OAAO;CACX;AACJ;;;;AAIA,SAAS,cAAc,KAAK;CACxB,OAAO,kBAAkB,KAAK,GAAG,IAAI,MAAM,mBAAmB,GAAG;AACrE"}

package/dist/_chunks/error-boundary-D-ODYX41.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-boundary-D-ODYX41.js","names":[],"sources":["../../src/client/unload-guard.ts","../../src/client/stale-client.ts","../../src/client/error-boundary.tsx"],"sourcesContent":["/**\n * Page unload detection — suppresses spurious errors during page refresh/navigation.\n *\n * When the user refreshes the page or navigates away while React is still\n * streaming Suspense content, the aborted connection causes streaming errors.\n * These are not application errors — they're a side effect of the browser\n * tearing down the connection. This module tracks whether the page is being\n * unloaded so error boundaries and error handlers can suppress abort-related\n * errors during the unload window.\n *\n * This is the single owner of \"is this document going away\". Anything that\n * needs the answer imports `isPageUnloading()` — an unload flag maintained a\n * second time somewhere else is a flag that will drift out of agreement with\n * this one (TIM-1260).\n *\n * Mutable state is delegated to client/state.ts for singleton guarantees.\n * See design/18-build-system.md §\"Singleton State Registry\"\n *\n * See design/10-error-handling.md §\"Known limitation: deny() inside Suspense and hydration\"\n */\n\nimport { unloading, _setUnloading } from './state.js';\n\n/**\n * Departure is *committed*: `pagehide` has fired, or this document has called\n * reload() on itself. `beforeunload` alone doesn't qualify — it is\n * speculative, and the user can still cancel out of it.\n */\nlet committed = false;\n\nif (typeof window !== 'undefined') {\n  window.addEventListener('beforeunload', () => {\n    _setUnloading(true);\n\n    // An app with an unsaved-changes prompt can have this cancelled. Nothing\n    // fires to say so, so the only signal is that the page is still running\n    // afterwards — and timers are blocked while the modal is up, so this task\n    // cannot run until the user has chosen. If they left, `pagehide` has\n    // already committed and this is a no-op.\n    setTimeout(() => {\n      if (!committed) _setUnloading(false);\n    }, 0);\n  });\n\n  // pagehide is the committed-departure event, and fires for both navigations\n  // and bfcache entry. Safari in particular may skip beforeunload entirely.\n  window.addEventListener('pagehide', () => {\n    committed = true;\n    _setUnloading(true);\n  });\n\n  window.addEventListener('pageshow', (event) => {\n    // A bfcache restore un-does the teardown `pagehide` announced: the same\n    // document is alive again, with this module's state intact. Without the\n    // reset, every consumer would go on suppressing errors on a live page.\n    if (event.persisted) {\n      committed = false;\n      _setUnloading(false);\n    }\n  });\n}\n\n/**\n * Returns true if the page is currently being unloaded (user refreshed\n * or navigated away). Error boundaries should suppress errors in this state.\n */\nexport function isPageUnloading(): boolean {\n  return unloading;\n}\n","/**\n * Stale Client — knowing when this bundle has been superseded.\n *\n * Layer 1 of version skew handling (see design/33-version-skew.md) is\n * proactive: the server compares `X-Timber-Deployment-Id` against the current\n * build and answers a stale client with `X-Timber-Reload: 1`. That covers\n * every RSC navigation and every server action — as long as there is a server\n * in the request path.\n *\n * This module is the reactive half, plus the state both halves feed. It\n * recognizes the two error shapes a stale client produces on its own:\n *\n * 1. **Stale client references** — React's Flight client throws\n *    \"Could not find the module …\" when an RSC payload names a client module\n *    ID that isn't in this bundle's manifest.\n * 2. **Chunk load failures** — a content-hashed chunk that no longer exists on\n *    the CDN fails to `import()`. Every engine words this differently.\n *\n * It matters most for `output: 'static'`, where there is no server to send the\n * reload header and this is the *only* skew detection that can run.\n *\n * **Nothing here reloads the page.** A stale client is recorded, not acted on;\n * the router turns the next user-initiated navigation into a full document\n * load. See design/33-version-skew.md §\"Recovery on the next navigation\" for\n * why — a self-issued `location.reload()` cannot tell a recovery from a bounce\n * between two live deployments, and mid-rollout it produces exactly that loop.\n *\n * See TIM-1260, TIM-1275.\n */\n\n// The only import: the shared unload state. Kept minimal because this module\n// is reached from the error boundary, a `'use client'` component evaluated in\n// the SSR graph too — a dependency on the client fetch layer would drag that\n// graph along with it.\nimport { isPageUnloading } from './unload-guard.js';\n\n// ─── Error Shapes ────────────────────────────────────────────────\n\n/**\n * Substrings that identify a failed dynamic import, lowercased for\n * case-insensitive matching. Engines and bundlers each word this\n * differently and none of them expose a stable error code.\n */\nconst CHUNK_LOAD_PATTERNS = [\n  // Chromium\n  'failed to fetch dynamically imported module',\n  // Firefox\n  'error loading dynamically imported module',\n  // Safari\n  'importing a module script failed',\n  // Vite's preload helper, for the stylesheet of a lazily-imported chunk\n  'unable to preload css for',\n];\n\n/** Substring React's Flight client uses when a client module ID is unknown. */\nconst STALE_REFERENCE_PATTERN = 'could not find the module';\n\n/**\n * Pull a comparable message out of an unknown thrown value. Rejections cross\n * enough boundaries (event handlers, `unhandledrejection`, Vite's preload\n * event) that the value is not reliably an `Error`.\n */\nfunction messageOf(error: unknown): string {\n  if (typeof error === 'string') return error.toLowerCase();\n  if (error instanceof Error) return error.message.toLowerCase();\n  if (error && typeof error === 'object' && 'message' in error) {\n    const message = (error as { message: unknown }).message;\n    if (typeof message === 'string') return message.toLowerCase();\n  }\n  return '';\n}\n\n/**\n * True when the error is React's \"client reference not in this manifest\"\n * failure — the payload was produced by a build this bundle doesn't match.\n */\nexport function isStaleClientReference(error: unknown): boolean {\n  return messageOf(error).includes(STALE_REFERENCE_PATTERN);\n}\n\n/**\n * True when the error is a failed dynamic import or CSS preload — the\n * content-hashed chunk this bundle asks for is gone from the CDN.\n */\nexport function isChunkLoadError(error: unknown): boolean {\n  if (error instanceof Error && error.name === 'ChunkLoadError') return true;\n  const message = messageOf(error);\n  return CHUNK_LOAD_PATTERNS.some((pattern) => message.includes(pattern));\n}\n\n// ─── Staleness ───────────────────────────────────────────────────\n\n/**\n * True once this client is known to be running against a superseded\n * deployment. One-way: a document that has gone stale cannot come back, since\n * the only way to get fresh code is to load a new document.\n *\n * In-memory on purpose. Persisting it would be wrong — the next document gets\n * whatever build the server hands it, and if that one is stale too it will\n * find out the same way.\n */\nlet stale = false;\n\n/**\n * True once {@link initStaleClient} has seen a deployment ID — i.e. this is a\n * production build. False in dev, where nothing is ever stale: HMR owns code\n * updates, and a failed dynamic import is a real error the developer needs to\n * see rather than something a page load fixes.\n */\nlet deployed = false;\n\n/** Whether this client has been superseded by a newer deployment. */\nexport function isClientStale(): boolean {\n  return stale;\n}\n\n/**\n * Record that the origin has told us this client is stale — the `X-Timber-Reload`\n * header on an RSC or action response. Authoritative, so it is not gated on\n * anything: a dev server never sends the header in the first place.\n */\nexport function markClientStale(): void {\n  stale = true;\n}\n\n/**\n * Record staleness if `error` is one of the shapes a superseded bundle\n * produces. Returns whether it did, so a caller mid-navigation can decide to\n * hard-navigate instead of surfacing the error.\n *\n * Inference, unlike {@link markClientStale}, so it is gated on being a\n * production build. This is the single place that gate lives — call sites\n * cannot see each other, and \"remember to gate the next one too\" is not a\n * guarantee.\n */\nexport function markStaleFromError(error: unknown): boolean {\n  if (!deployed) return false;\n\n  // A document being torn down aborts its in-flight dynamic imports, and an\n  // aborted import reads exactly like a chunk the CDN has dropped. That is not\n  // evidence of staleness, and the bit outlives the teardown that produced it:\n  // a document entering the back-forward cache is frozen, not destroyed, so a\n  // false positive recorded on the way out would cost the *restored* page its\n  // client-side navigation for good. `unload-guard.ts` clears its own flag on\n  // a persisted `pageshow`; this one is one-way by design, so it has to not be\n  // set in the first place.\n  if (isPageUnloading()) return false;\n\n  if (!isStaleClientReference(error) && !isChunkLoadError(error)) return false;\n  stale = true;\n  return true;\n}\n\n// ─── Initialization ──────────────────────────────────────────────\n\n/**\n * The underlying error Vite attaches to a `vite:preloadError` event.\n *\n * Narrowed at runtime rather than cast: the property is Vite's, not ours, and\n * a shape change should fall back to matching the event itself rather than\n * silently reading `undefined` forever.\n */\nfunction preloadErrorPayload(event: Event): unknown {\n  return 'payload' in event ? (event as Event & { payload: unknown }).payload : event;\n}\n\n/**\n * Arm the module, and register the listeners that catch stale-client errors\n * never passing through the router: a lazily imported client component, a\n * preloaded stylesheet, anything that rejects outside a navigation.\n *\n * No-op when `deploymentId` is null — that is dev. Called from the browser\n * entry before hydration, so it precedes any render or navigation that could\n * throw.\n */\nexport function initStaleClient(deploymentId: string | null): void {\n  if (!deploymentId) return;\n  deployed = true;\n\n  // Vite dispatches this for failed chunk/CSS preloads. Note what is *not*\n  // here: `preventDefault()`. Recording staleness is not recovering from this\n  // error — the page is still broken until the user navigates — so Vite must\n  // go on rethrowing it rather than have it silently swallowed.\n  window.addEventListener('vite:preloadError', (event) => {\n    markStaleFromError(preloadErrorPayload(event));\n  });\n\n  window.addEventListener('unhandledrejection', (event: PromiseRejectionEvent) => {\n    markStaleFromError(event.reason);\n  });\n}\n","'use client';\n\n/**\n * Framework-injected React error boundary.\n *\n * Catches errors thrown by children and renders a fallback component\n * with the appropriate props based on error type:\n *   - DenySignal (4xx) → { status, dangerouslyPassData }\n *   - RenderError (5xx) → { error, digest, reset }\n *   - Unhandled error → { error, digest: null, reset }\n *\n * The `status` prop controls which errors this boundary catches:\n *   - Specific code (e.g. 403) → only that status\n *   - Category (400) → any 4xx\n *   - Category (500) → any 5xx\n *   - Omitted → catches everything (error.tsx behavior)\n *\n * See design/10-error-handling.md §\"Status-Code Files\"\n */\n\nimport { Component, createElement, type ReactNode } from 'react';\nimport { getSsrData } from './ssr-data.js';\nimport { getRouterOrNull } from './router-ref.js';\nimport { markStaleFromError } from './stale-client.js';\n// Page unload detection: when the page is being torn down, error boundaries\n// suppress activation — the error is from the aborted connection, not the\n// application. unload-guard.ts is the single owner of that state; this module\n// used to keep its own copy, which drifted (TIM-1260).\nimport { isPageUnloading } from './unload-guard.js';\n\n// ─── Digest Types ────────────────────────────────────────────────────────────\n\n/** Structured digest returned by RSC onError for DenySignal. */\ninterface DenyDigest {\n  type: 'deny';\n  status: number;\n  data: unknown;\n  /**\n   * Segment key of the segment that owns the matched deny page, present when\n   * an in-tree catch site matched a file it may not render at its own\n   * position and re-threw to reach the owner. See TIM-1356.\n   */\n  ownerKey?: string;\n}\n\n/** Structured digest returned by RSC onError for RenderError. */\ninterface RenderErrorDigest {\n  type: 'render-error';\n  code: string;\n  data: unknown;\n  status: number;\n}\n\n/** Structured digest returned by RSC onError for RedirectSignal. */\ninterface RedirectDigest {\n  type: 'redirect';\n  location: string;\n  status: number;\n}\n\ntype ParsedDigest = DenyDigest | RenderErrorDigest | RedirectDigest;\n\n// ─── Props & State ───────────────────────────────────────────────────────────\n\nexport interface TimberErrorBoundaryProps {\n  /** The component to render when an error is caught. */\n  fallbackComponent?: (...args: unknown[]) => ReactNode;\n  /**\n   * Pre-rendered fallback element. Used for MDX status files which are server\n   * components and cannot be passed as function props across the RSC→client\n   * boundary. When set, rendered directly instead of calling fallbackComponent.\n   *\n   * See design/10-error-handling.md §\"Status-Code File Variants\" — MDX status\n   * files are server components by default (zero client JS).\n   */\n  fallbackElement?: ReactNode;\n  /**\n   * Status code filter. If set, only catches errors matching this status.\n   * 400 = any 4xx, 500 = any 5xx, specific number = exact match.\n   */\n  status?: number;\n  /**\n   * When true, this boundary wraps a parallel slot. Slot denials are\n   * graceful degradation — they must NOT change the HTTP status code.\n   */\n  isSlotBoundary?: boolean;\n  /**\n   * Segment key of the segment that declared this boundary. Only meaningful\n   * against a deny digest carrying an `ownerKey`. See the decline rule in\n   * `render()` and TIM-1356.\n   */\n  segmentKey?: string;\n  children: ReactNode;\n}\n\ninterface TimberErrorBoundaryState {\n  hasError: boolean;\n  error: Error | null;\n}\n\n// Module-level guard: the first boundary to catch a given redirect digest\n// schedules the navigation and marks it handled here. Subsequent renders\n// (React retries the error-boundary render path multiple times in dev, and\n// outer boundaries that also see the error) become no-ops, preventing\n// duplicate router.navigate() calls.\nconst _handledRedirects = new WeakSet<object>();\n\n// Companion guard keyed by location: client-render redirect() (the\n// next/navigation shim) throws a FRESH error instance on every render\n// attempt, and React replays the errored render — so the WeakSet alone\n// would schedule the navigation twice. While a navigation to a location\n// is pending, further redirect errors for the same location are no-ops.\nlet _pendingRedirectLocation: string | null = null;\n\n// ─── Component ───────────────────────────────────────────────────────────────\n\nexport class TimberErrorBoundary extends Component<\n  TimberErrorBoundaryProps,\n  TimberErrorBoundaryState\n> {\n  constructor(props: TimberErrorBoundaryProps) {\n    super(props);\n    this.state = { hasError: false, error: null };\n  }\n\n  static getDerivedStateFromError(error: Error): TimberErrorBoundaryState {\n    // Suppress error boundaries during page unload (refresh/navigate away).\n    // The aborted connection causes React's streaming hydration to error,\n    // but the page is about to be replaced — showing an error boundary\n    // would be a jarring flash for the user.\n    if (isPageUnloading()) {\n      return { hasError: false, error: null };\n    }\n\n    return { hasError: true, error };\n  }\n\n  componentDidCatch(error: Error): void {\n    // A stale bundle most often surfaces here rather than as a rejected\n    // navigation: a client reference missing from this build's manifest, or\n    // a lazily-imported chunk the CDN no longer has, thrown during render.\n    //\n    // Recording it is all that happens — this boundary still renders its\n    // fallback, and the recovery is the user's next navigation, which the\n    // router turns into a full document load. Reloading from here would be a\n    // page load the user did not ask for, on a page that may be mid-rollout\n    // and would come back just as stale (TIM-1275).\n    markStaleFromError(error);\n  }\n\n  componentDidUpdate(prevProps: TimberErrorBoundaryProps): void {\n    // Reset error state when children change (e.g. client-side navigation).\n    // Without this, navigating from one error page to another keeps the\n    // stale error — getDerivedStateFromError doesn't re-fire for new children.\n    if (this.state.hasError && prevProps.children !== this.props.children) {\n      this.setState({ hasError: false, error: null });\n    }\n  }\n\n  /** Reset the error state so children re-render. */\n  private reset = () => {\n    this.setState({ hasError: false, error: null });\n  };\n\n  render(): ReactNode {\n    if (!this.state.hasError || !this.state.error) {\n      return this.props.children;\n    }\n\n    const error = this.state.error;\n    const parsed = parseDigest(error);\n\n    // RedirectSignal handling splits by environment:\n    //\n    // - SSR (no window): re-throw so the Fizz shell fails and the server\n    //   pipeline catch block can produce a proper HTTP 3xx response. See\n    //   design/04-authorization.md.\n    //\n    // - Client (window exists): a RedirectSignal that leaked into the RSC\n    //   Flight payload during client navigation would otherwise bubble past\n    //   every error boundary to `window.onerror`, which in dev triggers the\n    //   Vite error overlay (false positive — navigation itself works).\n    //   Instead, ask the router to perform an SPA navigation to the target\n    //   and render nothing while it takes over. The router's own catch path\n    //   handles cross-origin / hard navigations. See TIM-838.\n    if (parsed?.type === 'redirect') {\n      if (typeof window === 'undefined') {\n        throw error;\n      }\n      // Dedupe: React may render the error-boundary fallback path more\n      // than once for a single caught error (dev-mode double render, and\n      // additional boundaries above us in the tree). Only schedule the\n      // navigation on the first render that sees this error instance.\n      const alreadyHandled =\n        _handledRedirects.has(error) || _pendingRedirectLocation === parsed.location;\n      if (!alreadyHandled) {\n        _handledRedirects.add(error);\n        const router = getRouterOrNull();\n        if (router) {\n          _pendingRedirectLocation = parsed.location;\n          // Schedule the navigation outside the render phase to avoid\n          // setState-during-render warnings from router state updates.\n          queueMicrotask(() => {\n            router\n              .navigate(parsed.location, { replace: true })\n              .catch(() => {\n                // Fall back to a hard navigation if the soft navigation fails.\n                window.location.href = parsed.location;\n              })\n              .finally(() => {\n                _pendingRedirectLocation = null;\n              });\n          });\n        } else {\n          // No router available (shouldn't happen post-bootstrap) — fall\n          // back to a hard navigation so the user still ends up at the\n          // target.\n          window.location.href = parsed.location;\n        }\n      }\n      return null;\n    }\n\n    // Owner-addressed denies: an in-tree catch site already resolved the\n    // fallback chain and matched a file it may not render at its own\n    // position, so it re-threw to reach the segment that owns that file.\n    // Every boundary but that one declines — otherwise the nearest boundary\n    // whose status filter happens to match catches first and renders the\n    // deny page at its own depth, wrapped in the layouts the hoist existed\n    // to skip, and from a different file than the chain chose. (Boundary\n    // nesting is per-segment `{status} → category → error`; the 4xx chain\n    // runs status files across ALL segments before any error.tsx, so a\n    // leaf error.tsx would otherwise beat a root 404.tsx.)\n    //\n    // Declining is the default: an unkeyed boundary — a slot boundary, or\n    // one from a construction site that builds no deny chains — never\n    // claims a deny addressed to a segment. See TIM-1356.\n    // `typeof === 'string'`, not a null check: the digest is untrusted JSON —\n    // `parseDigest` validates only `type`, and any component can set\n    // `error.digest` itself. A non-string `ownerKey` is unequal to every\n    // boundary's key, so a truthiness test would let one error decline its\n    // way past the entire tree and blank the page, where it would otherwise\n    // have hit the nearest matching boundary.\n    if (\n      parsed?.type === 'deny' &&\n      typeof parsed.ownerKey === 'string' &&\n      parsed.ownerKey !== this.props.segmentKey\n    ) {\n      throw error;\n    }\n\n    // If this boundary has a status filter, check whether the error matches.\n    // Non-matching errors re-throw so an outer boundary can catch them.\n    if (this.props.status != null) {\n      const errorStatus = getErrorStatus(parsed, error);\n      if (errorStatus == null || !statusMatches(this.props.status, errorStatus)) {\n        // Re-throw: this boundary doesn't handle this error.\n        throw error;\n      }\n    }\n\n    // Report DenySignal handling so the pipeline skips the redundant\n    // renderDenyPage() re-render — but ONLY when this boundary can fully\n    // handle the deny in-tree:\n    //\n    // ✅ TSX boundaries (fallbackComponent) — can receive runtime props\n    //    (status, dangerouslyPassData) dynamically in render()\n    // ❌ MDX boundaries (fallbackElement) — pre-rendered at tree-build time,\n    //    cannot receive runtime deny props. Must fall through to re-render.\n    //\n    // For qualifying segment boundaries: also set the HTTP status code from\n    // the DenySignal so the Response has the correct 4xx status. This runs\n    // synchronously during Fizz rendering, BEFORE onShellReady.\n    //\n    // For slot boundaries: set _denyHandledByBoundary but do NOT change\n    // statusCode — slot denials are graceful degradation.\n    //\n    // See TIM-664, LOCAL-298.\n    if (parsed?.type === 'deny') {\n      const canHandleInTree = this.props.fallbackElement == null;\n\n      if (canHandleInTree || this.props.isSlotBoundary) {\n        const ssrData = getSsrData();\n        if (ssrData?._navContext) {\n          ssrData._navContext._denyHandledByBoundary = true;\n          if (!this.props.isSlotBoundary) {\n            ssrData._navContext.statusCode = parsed.status;\n          }\n        }\n      }\n    }\n\n    // Pre-rendered fallback element (MDX status files) — render directly.\n    // MDX components are server components that cannot be passed as function\n    // props across the RSC→client boundary. Instead, they are pre-rendered\n    // as elements in the RSC environment and passed here as fallbackElement.\n    if (this.props.fallbackElement != null) {\n      return this.props.fallbackElement;\n    }\n\n    // Render the fallback component with the right props shape.\n    if (parsed?.type === 'deny') {\n      // Status-code file boundaries (404.tsx, 4xx.tsx, …) get the documented\n      // 4xx props. error.tsx boundaries (no status filter) get their\n      // documented { error, digest, reset } contract — plus the deny extras\n      // for dual-shape implementations. Without the error prop, an error.tsx\n      // reading error.message crashes on deny fall-through. See TIM-1081.\n      if (this.props.status != null) {\n        return createElement(this.props.fallbackComponent as never, {\n          status: parsed.status,\n          dangerouslyPassData: parsed.data,\n        });\n      }\n      return createElement(this.props.fallbackComponent as never, {\n        error: denyError(parsed.status, error),\n        digest: null,\n        reset: this.reset,\n        status: parsed.status,\n        dangerouslyPassData: parsed.data,\n      });\n    }\n\n    // 5xx / RenderError / unhandled error\n    const digest =\n      parsed?.type === 'render-error' ? { code: parsed.code, data: parsed.data } : null;\n\n    return createElement(this.props.fallbackComponent as never, {\n      error,\n      digest,\n      reset: this.reset,\n    });\n  }\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Parse the structured digest from the error.\n * React sets `error.digest` from the string returned by RSC's onError.\n */\nfunction parseDigest(error: Error): ParsedDigest | null {\n  const raw = (error as { digest?: string }).digest;\n  if (typeof raw !== 'string') return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (parsed && typeof parsed === 'object' && typeof parsed.type === 'string') {\n      return parsed as ParsedDigest;\n    }\n  } catch (e) {\n    console.debug('[timber] error digest is not valid JSON:', e instanceof Error ? e.message : e);\n  }\n  return null;\n}\n\n/**\n * The Error an `error.tsx` serving a deny should receive.\n *\n * The error that actually arrives here is React's, not the framework's: a\n * server-thrown error crossing Flight has its message and name replaced with\n * a generic redacted string in production, by design. An `error.tsx` written\n * per the docs branches on `error.message` — so handing it the redacted error\n * gives it nothing to branch on, while the in-tree path hands the same file a\n * `DenySignal` named error reading `Access denied with status <N>` (see\n * `renderDenyEntry`). This reconstructs that shape from the digest, which is\n * where the status already is.\n *\n * Derived from the status alone — no stack, no server data — so it is safe on\n * the client for the same reason the digest is. See design/13-security.md\n * §\"Errors don't leak\", TIM-1081.\n */\nfunction denyError(status: number, original: Error): Error {\n  // A dev build may have preserved something more useful than the redaction.\n  if (original.name === 'DenySignal') return original;\n  const error = new Error(`Access denied with status ${status}`);\n  error.name = 'DenySignal';\n  return error;\n}\n\n/**\n * Extract the HTTP status code from a parsed digest or error message.\n * Falls back to message pattern matching for errors without a digest.\n */\nfunction getErrorStatus(parsed: ParsedDigest | null, error: Error): number | null {\n  if (parsed?.type === 'deny') return parsed.status;\n  if (parsed?.type === 'render-error') return parsed.status;\n  if (parsed?.type === 'redirect') return parsed.status;\n\n  // Fallback: parse DenySignal message pattern for errors that lost their digest\n  const match = error.message.match(/^Access denied with status (\\d+)$/);\n  if (match) return parseInt(match[1], 10);\n\n  // Unhandled errors are implicitly 500\n  return 500;\n}\n\n/**\n * Check whether an error's status matches the boundary's status filter.\n * Category markers (400, 500) match any status in that range.\n */\nfunction statusMatches(boundaryStatus: number, errorStatus: number): boolean {\n  // Category catch-all: 400 matches any 4xx, 500 matches any 5xx\n  if (boundaryStatus === 400) return errorStatus >= 400 && errorStatus <= 499;\n  if (boundaryStatus === 500) return errorStatus >= 500 && errorStatus <= 599;\n  // Exact match\n  return boundaryStatus === errorStatus;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAI,YAAY;AAEhB,IAAI,OAAO,WAAW,aAAa;CACjC,OAAO,iBAAiB,sBAAsB;EAC5C,cAAc,IAAI;EAOlB,iBAAiB;GACf,IAAI,CAAC,WAAW,cAAc,KAAK;EACrC,GAAG,CAAC;CACN,CAAC;CAID,OAAO,iBAAiB,kBAAkB;EACxC,YAAY;EACZ,cAAc,IAAI;CACpB,CAAC;CAED,OAAO,iBAAiB,aAAa,UAAU;EAI7C,IAAI,MAAM,WAAW;GACnB,YAAY;GACZ,cAAc,KAAK;EACrB;CACF,CAAC;AACH;;;;;AAMA,SAAgB,kBAA2B;CACzC,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzBA,IAAM,sBAAsB;CAE1B;CAEA;CAEA;CAEA;AACF;;AAGA,IAAM,0BAA0B;;;;;;AAOhC,SAAS,UAAU,OAAwB;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,YAAY;CACxD,IAAI,iBAAiB,OAAO,OAAO,MAAM,QAAQ,YAAY;CAC7D,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,OAAO;EAC5D,MAAM,UAAW,MAA+B;EAChD,IAAI,OAAO,YAAY,UAAU,OAAO,QAAQ,YAAY;CAC9D;CACA,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,OAAyB;CAC9D,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,uBAAuB;AAC1D;;;;;AAMA,SAAgB,iBAAiB,OAAyB;CACxD,IAAI,iBAAiB,SAAS,MAAM,SAAS,kBAAkB,OAAO;CACtE,MAAM,UAAU,UAAU,KAAK;CAC/B,OAAO,oBAAoB,MAAM,YAAY,QAAQ,SAAS,OAAO,CAAC;AACxE;;;;;;;;;;AAaA,IAAI,QAAQ;;;;;;;AAQZ,IAAI,WAAW;;AAGf,SAAgB,gBAAyB;CACvC,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAwB;CACtC,QAAQ;AACV;;;;;;;;;;;AAYA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,CAAC,UAAU,OAAO;CAUtB,IAAI,gBAAgB,GAAG,OAAO;CAE9B,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC,iBAAiB,KAAK,GAAG,OAAO;CACvE,QAAQ;CACR,OAAO;AACT;;;;;;;;;;;;;;;;;;;;AC9CA,IAAM,oCAAoB,IAAI,QAAgB;AAO9C,IAAI,2BAA0C;AAI9C,IAAa,sBAAb,cAAyC,UAGvC;CACA,YAAY,OAAiC;EAC3C,MAAM,KAAK;EACX,KAAK,QAAQ;GAAE,UAAU;GAAO,OAAO;EAAK;CAC9C;CAEA,OAAO,yBAAyB,OAAwC;EAKtE,IAAI,gBAAgB,GAClB,OAAO;GAAE,UAAU;GAAO,OAAO;EAAK;EAGxC,OAAO;GAAE,UAAU;GAAM;EAAM;CACjC;CAEA,kBAAkB,OAAoB;EAUpC,mBAAmB,KAAK;CAC1B;CAEA,mBAAmB,WAA2C;EAI5D,IAAI,KAAK,MAAM,YAAY,UAAU,aAAa,KAAK,MAAM,UAC3D,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAElD;;CAGA,cAAsB;EACpB,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAChD;CAEA,SAAoB;EAClB,IAAI,CAAC,KAAK,MAAM,YAAY,CAAC,KAAK,MAAM,OACtC,OAAO,KAAK,MAAM;EAGpB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,SAAS,YAAY,KAAK;EAehC,IAAI,QAAQ,SAAS,YAAY;GAC/B,IAAI,OAAO,WAAW,aACpB,MAAM;GAQR,IAAI,EADF,kBAAkB,IAAI,KAAK,KAAK,6BAA6B,OAAO,WACjD;IACnB,kBAAkB,IAAI,KAAK;IAC3B,MAAM,SAAS,gBAAgB;IAC/B,IAAI,QAAQ;KACV,2BAA2B,OAAO;KAGlC,qBAAqB;MACnB,OACG,SAAS,OAAO,UAAU,EAAE,SAAS,KAAK,CAAC,CAAC,CAC5C,YAAY;OAEX,OAAO,SAAS,OAAO,OAAO;MAChC,CAAC,CAAC,CACD,cAAc;OACb,2BAA2B;MAC7B,CAAC;KACL,CAAC;IACH,OAIE,OAAO,SAAS,OAAO,OAAO;GAElC;GACA,OAAO;EACT;EAsBA,IACE,QAAQ,SAAS,UACjB,OAAO,OAAO,aAAa,YAC3B,OAAO,aAAa,KAAK,MAAM,YAE/B,MAAM;EAKR,IAAI,KAAK,MAAM,UAAU,MAAM;GAC7B,MAAM,cAAc,eAAe,QAAQ,KAAK;GAChD,IAAI,eAAe,QAAQ,CAAC,cAAc,KAAK,MAAM,QAAQ,WAAW,GAEtE,MAAM;EAEV;EAmBA,IAAI,QAAQ,SAAS;OACK,KAAK,MAAM,mBAAmB,QAE/B,KAAK,MAAM,gBAAgB;IAChD,MAAM,UAAU,WAAW;IAC3B,IAAI,SAAS,aAAa;KACxB,QAAQ,YAAY,yBAAyB;KAC7C,IAAI,CAAC,KAAK,MAAM,gBACd,QAAQ,YAAY,aAAa,OAAO;IAE5C;GACF;;EAOF,IAAI,KAAK,MAAM,mBAAmB,MAChC,OAAO,KAAK,MAAM;EAIpB,IAAI,QAAQ,SAAS,QAAQ;GAM3B,IAAI,KAAK,MAAM,UAAU,MACvB,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;GAEH,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,OAAO,UAAU,OAAO,QAAQ,KAAK;IACrC,QAAQ;IACR,OAAO,KAAK;IACZ,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;EACH;EAGA,MAAM,SACJ,QAAQ,SAAS,iBAAiB;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK,IAAI;EAE/E,OAAO,cAAc,KAAK,MAAM,mBAA4B;GAC1D;GACA;GACA,OAAO,KAAK;EACd,CAAC;CACH;AACF;;;;;AAQA,SAAS,YAAY,OAAmC;CACtD,MAAM,MAAO,MAA8B;CAC3C,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,UACjE,OAAO;CAEX,SAAS,GAAG;EACV,QAAQ,MAAM,4CAA4C,aAAa,QAAQ,EAAE,UAAU,CAAC;CAC9F;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAS,UAAU,QAAgB,UAAwB;CAEzD,IAAI,SAAS,SAAS,cAAc,OAAO;CAC3C,MAAM,wBAAQ,IAAI,MAAM,6BAA6B,QAAQ;CAC7D,MAAM,OAAO;CACb,OAAO;AACT;;;;;AAMA,SAAS,eAAe,QAA6B,OAA6B;CAChF,IAAI,QAAQ,SAAS,QAAQ,OAAO,OAAO;CAC3C,IAAI,QAAQ,SAAS,gBAAgB,OAAO,OAAO;CACnD,IAAI,QAAQ,SAAS,YAAY,OAAO,OAAO;CAG/C,MAAM,QAAQ,MAAM,QAAQ,MAAM,mCAAmC;CACrE,IAAI,OAAO,OAAO,SAAS,MAAM,IAAI,EAAE;CAGvC,OAAO;AACT;;;;;AAMA,SAAS,cAAc,gBAAwB,aAA8B;CAE3E,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CACxE,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CAExE,OAAO,mBAAmB;AAC5B"}
+{"version":3,"file":"error-boundary-D-ODYX41.js","names":[],"sources":["../../src/client/unload-guard.ts","../../src/client/stale-client.ts","../../src/client/error-boundary.tsx"],"sourcesContent":["/**\n * Page unload detection — suppresses spurious errors during page refresh/navigation.\n *\n * When the user refreshes the page or navigates away while React is still\n * streaming Suspense content, the aborted connection causes streaming errors.\n * These are not application errors — they're a side effect of the browser\n * tearing down the connection. This module tracks whether the page is being\n * unloaded so error boundaries and error handlers can suppress abort-related\n * errors during the unload window.\n *\n * This is the single owner of \"is this document going away\". Anything that\n * needs the answer imports `isPageUnloading()` — an unload flag maintained a\n * second time somewhere else is a flag that will drift out of agreement with\n * this one (TIM-1260).\n *\n * Mutable state is delegated to client/state.ts for singleton guarantees.\n * See design/18-build-system.md §\"Singleton State Registry\"\n *\n * See design/10-error-handling.md §\"Known limitation: deny() inside Suspense and hydration\"\n */\n\nimport { unloading, _setUnloading } from './state.ts';\n\n/**\n * Departure is *committed*: `pagehide` has fired, or this document has called\n * reload() on itself. `beforeunload` alone doesn't qualify — it is\n * speculative, and the user can still cancel out of it.\n */\nlet committed = false;\n\nif (typeof window !== 'undefined') {\n  window.addEventListener('beforeunload', () => {\n    _setUnloading(true);\n\n    // An app with an unsaved-changes prompt can have this cancelled. Nothing\n    // fires to say so, so the only signal is that the page is still running\n    // afterwards — and timers are blocked while the modal is up, so this task\n    // cannot run until the user has chosen. If they left, `pagehide` has\n    // already committed and this is a no-op.\n    setTimeout(() => {\n      if (!committed) _setUnloading(false);\n    }, 0);\n  });\n\n  // pagehide is the committed-departure event, and fires for both navigations\n  // and bfcache entry. Safari in particular may skip beforeunload entirely.\n  window.addEventListener('pagehide', () => {\n    committed = true;\n    _setUnloading(true);\n  });\n\n  window.addEventListener('pageshow', (event) => {\n    // A bfcache restore un-does the teardown `pagehide` announced: the same\n    // document is alive again, with this module's state intact. Without the\n    // reset, every consumer would go on suppressing errors on a live page.\n    if (event.persisted) {\n      committed = false;\n      _setUnloading(false);\n    }\n  });\n}\n\n/**\n * Returns true if the page is currently being unloaded (user refreshed\n * or navigated away). Error boundaries should suppress errors in this state.\n */\nexport function isPageUnloading(): boolean {\n  return unloading;\n}\n","/**\n * Stale Client — knowing when this bundle has been superseded.\n *\n * Layer 1 of version skew handling (see design/33-version-skew.md) is\n * proactive: the server compares `X-Timber-Deployment-Id` against the current\n * build and answers a stale client with `X-Timber-Reload: 1`. That covers\n * every RSC navigation and every server action — as long as there is a server\n * in the request path.\n *\n * This module is the reactive half, plus the state both halves feed. It\n * recognizes the two error shapes a stale client produces on its own:\n *\n * 1. **Stale client references** — React's Flight client throws\n *    \"Could not find the module …\" when an RSC payload names a client module\n *    ID that isn't in this bundle's manifest.\n * 2. **Chunk load failures** — a content-hashed chunk that no longer exists on\n *    the CDN fails to `import()`. Every engine words this differently.\n *\n * It matters most for `output: 'static'`, where there is no server to send the\n * reload header and this is the *only* skew detection that can run.\n *\n * **Nothing here reloads the page.** A stale client is recorded, not acted on;\n * the router turns the next user-initiated navigation into a full document\n * load. See design/33-version-skew.md §\"Recovery on the next navigation\" for\n * why — a self-issued `location.reload()` cannot tell a recovery from a bounce\n * between two live deployments, and mid-rollout it produces exactly that loop.\n *\n * See TIM-1260, TIM-1275.\n */\n\n// The only import: the shared unload state. Kept minimal because this module\n// is reached from the error boundary, a `'use client'` component evaluated in\n// the SSR graph too — a dependency on the client fetch layer would drag that\n// graph along with it.\nimport { isPageUnloading } from './unload-guard.ts';\n\n// ─── Error Shapes ────────────────────────────────────────────────\n\n/**\n * Substrings that identify a failed dynamic import, lowercased for\n * case-insensitive matching. Engines and bundlers each word this\n * differently and none of them expose a stable error code.\n */\nconst CHUNK_LOAD_PATTERNS = [\n  // Chromium\n  'failed to fetch dynamically imported module',\n  // Firefox\n  'error loading dynamically imported module',\n  // Safari\n  'importing a module script failed',\n  // Vite's preload helper, for the stylesheet of a lazily-imported chunk\n  'unable to preload css for',\n];\n\n/** Substring React's Flight client uses when a client module ID is unknown. */\nconst STALE_REFERENCE_PATTERN = 'could not find the module';\n\n/**\n * Pull a comparable message out of an unknown thrown value. Rejections cross\n * enough boundaries (event handlers, `unhandledrejection`, Vite's preload\n * event) that the value is not reliably an `Error`.\n */\nfunction messageOf(error: unknown): string {\n  if (typeof error === 'string') return error.toLowerCase();\n  if (error instanceof Error) return error.message.toLowerCase();\n  if (error && typeof error === 'object' && 'message' in error) {\n    const message = (error as { message: unknown }).message;\n    if (typeof message === 'string') return message.toLowerCase();\n  }\n  return '';\n}\n\n/**\n * True when the error is React's \"client reference not in this manifest\"\n * failure — the payload was produced by a build this bundle doesn't match.\n */\nexport function isStaleClientReference(error: unknown): boolean {\n  return messageOf(error).includes(STALE_REFERENCE_PATTERN);\n}\n\n/**\n * True when the error is a failed dynamic import or CSS preload — the\n * content-hashed chunk this bundle asks for is gone from the CDN.\n */\nexport function isChunkLoadError(error: unknown): boolean {\n  if (error instanceof Error && error.name === 'ChunkLoadError') return true;\n  const message = messageOf(error);\n  return CHUNK_LOAD_PATTERNS.some((pattern) => message.includes(pattern));\n}\n\n// ─── Staleness ───────────────────────────────────────────────────\n\n/**\n * True once this client is known to be running against a superseded\n * deployment. One-way: a document that has gone stale cannot come back, since\n * the only way to get fresh code is to load a new document.\n *\n * In-memory on purpose. Persisting it would be wrong — the next document gets\n * whatever build the server hands it, and if that one is stale too it will\n * find out the same way.\n */\nlet stale = false;\n\n/**\n * True once {@link initStaleClient} has seen a deployment ID — i.e. this is a\n * production build. False in dev, where nothing is ever stale: HMR owns code\n * updates, and a failed dynamic import is a real error the developer needs to\n * see rather than something a page load fixes.\n */\nlet deployed = false;\n\n/** Whether this client has been superseded by a newer deployment. */\nexport function isClientStale(): boolean {\n  return stale;\n}\n\n/**\n * Record that the origin has told us this client is stale — the `X-Timber-Reload`\n * header on an RSC or action response. Authoritative, so it is not gated on\n * anything: a dev server never sends the header in the first place.\n */\nexport function markClientStale(): void {\n  stale = true;\n}\n\n/**\n * Record staleness if `error` is one of the shapes a superseded bundle\n * produces. Returns whether it did, so a caller mid-navigation can decide to\n * hard-navigate instead of surfacing the error.\n *\n * Inference, unlike {@link markClientStale}, so it is gated on being a\n * production build. This is the single place that gate lives — call sites\n * cannot see each other, and \"remember to gate the next one too\" is not a\n * guarantee.\n */\nexport function markStaleFromError(error: unknown): boolean {\n  if (!deployed) return false;\n\n  // A document being torn down aborts its in-flight dynamic imports, and an\n  // aborted import reads exactly like a chunk the CDN has dropped. That is not\n  // evidence of staleness, and the bit outlives the teardown that produced it:\n  // a document entering the back-forward cache is frozen, not destroyed, so a\n  // false positive recorded on the way out would cost the *restored* page its\n  // client-side navigation for good. `unload-guard.ts` clears its own flag on\n  // a persisted `pageshow`; this one is one-way by design, so it has to not be\n  // set in the first place.\n  if (isPageUnloading()) return false;\n\n  if (!isStaleClientReference(error) && !isChunkLoadError(error)) return false;\n  stale = true;\n  return true;\n}\n\n// ─── Initialization ──────────────────────────────────────────────\n\n/**\n * The underlying error Vite attaches to a `vite:preloadError` event.\n *\n * Narrowed at runtime rather than cast: the property is Vite's, not ours, and\n * a shape change should fall back to matching the event itself rather than\n * silently reading `undefined` forever.\n */\nfunction preloadErrorPayload(event: Event): unknown {\n  return 'payload' in event ? (event as Event & { payload: unknown }).payload : event;\n}\n\n/**\n * Arm the module, and register the listeners that catch stale-client errors\n * never passing through the router: a lazily imported client component, a\n * preloaded stylesheet, anything that rejects outside a navigation.\n *\n * No-op when `deploymentId` is null — that is dev. Called from the browser\n * entry before hydration, so it precedes any render or navigation that could\n * throw.\n */\nexport function initStaleClient(deploymentId: string | null): void {\n  if (!deploymentId) return;\n  deployed = true;\n\n  // Vite dispatches this for failed chunk/CSS preloads. Note what is *not*\n  // here: `preventDefault()`. Recording staleness is not recovering from this\n  // error — the page is still broken until the user navigates — so Vite must\n  // go on rethrowing it rather than have it silently swallowed.\n  window.addEventListener('vite:preloadError', (event) => {\n    markStaleFromError(preloadErrorPayload(event));\n  });\n\n  window.addEventListener('unhandledrejection', (event: PromiseRejectionEvent) => {\n    markStaleFromError(event.reason);\n  });\n}\n","'use client';\n\n/**\n * Framework-injected React error boundary.\n *\n * Catches errors thrown by children and renders a fallback component\n * with the appropriate props based on error type:\n *   - DenySignal (4xx) → { status, dangerouslyPassData }\n *   - RenderError (5xx) → { error, digest, reset }\n *   - Unhandled error → { error, digest: null, reset }\n *\n * The `status` prop controls which errors this boundary catches:\n *   - Specific code (e.g. 403) → only that status\n *   - Category (400) → any 4xx\n *   - Category (500) → any 5xx\n *   - Omitted → catches everything (error.tsx behavior)\n *\n * See design/10-error-handling.md §\"Status-Code Files\"\n */\n\nimport { Component, createElement, type ReactNode } from 'react';\nimport { getSsrData } from './ssr-data.ts';\nimport { getRouterOrNull } from './router-ref.ts';\nimport { markStaleFromError } from './stale-client.ts';\n// Page unload detection: when the page is being torn down, error boundaries\n// suppress activation — the error is from the aborted connection, not the\n// application. unload-guard.ts is the single owner of that state; this module\n// used to keep its own copy, which drifted (TIM-1260).\nimport { isPageUnloading } from './unload-guard.ts';\n\n// ─── Digest Types ────────────────────────────────────────────────────────────\n\n/** Structured digest returned by RSC onError for DenySignal. */\ninterface DenyDigest {\n  type: 'deny';\n  status: number;\n  data: unknown;\n  /**\n   * Segment key of the segment that owns the matched deny page, present when\n   * an in-tree catch site matched a file it may not render at its own\n   * position and re-threw to reach the owner. See TIM-1356.\n   */\n  ownerKey?: string;\n}\n\n/** Structured digest returned by RSC onError for RenderError. */\ninterface RenderErrorDigest {\n  type: 'render-error';\n  code: string;\n  data: unknown;\n  status: number;\n}\n\n/** Structured digest returned by RSC onError for RedirectSignal. */\ninterface RedirectDigest {\n  type: 'redirect';\n  location: string;\n  status: number;\n}\n\ntype ParsedDigest = DenyDigest | RenderErrorDigest | RedirectDigest;\n\n// ─── Props & State ───────────────────────────────────────────────────────────\n\nexport interface TimberErrorBoundaryProps {\n  /** The component to render when an error is caught. */\n  fallbackComponent?: (...args: unknown[]) => ReactNode;\n  /**\n   * Pre-rendered fallback element. Used for MDX status files which are server\n   * components and cannot be passed as function props across the RSC→client\n   * boundary. When set, rendered directly instead of calling fallbackComponent.\n   *\n   * See design/10-error-handling.md §\"Status-Code File Variants\" — MDX status\n   * files are server components by default (zero client JS).\n   */\n  fallbackElement?: ReactNode;\n  /**\n   * Status code filter. If set, only catches errors matching this status.\n   * 400 = any 4xx, 500 = any 5xx, specific number = exact match.\n   */\n  status?: number;\n  /**\n   * When true, this boundary wraps a parallel slot. Slot denials are\n   * graceful degradation — they must NOT change the HTTP status code.\n   */\n  isSlotBoundary?: boolean;\n  /**\n   * Segment key of the segment that declared this boundary. Only meaningful\n   * against a deny digest carrying an `ownerKey`. See the decline rule in\n   * `render()` and TIM-1356.\n   */\n  segmentKey?: string;\n  children: ReactNode;\n}\n\ninterface TimberErrorBoundaryState {\n  hasError: boolean;\n  error: Error | null;\n}\n\n// Module-level guard: the first boundary to catch a given redirect digest\n// schedules the navigation and marks it handled here. Subsequent renders\n// (React retries the error-boundary render path multiple times in dev, and\n// outer boundaries that also see the error) become no-ops, preventing\n// duplicate router.navigate() calls.\nconst _handledRedirects = new WeakSet<object>();\n\n// Companion guard keyed by location: client-render redirect() (the\n// next/navigation shim) throws a FRESH error instance on every render\n// attempt, and React replays the errored render — so the WeakSet alone\n// would schedule the navigation twice. While a navigation to a location\n// is pending, further redirect errors for the same location are no-ops.\nlet _pendingRedirectLocation: string | null = null;\n\n// ─── Component ───────────────────────────────────────────────────────────────\n\nexport class TimberErrorBoundary extends Component<\n  TimberErrorBoundaryProps,\n  TimberErrorBoundaryState\n> {\n  constructor(props: TimberErrorBoundaryProps) {\n    super(props);\n    this.state = { hasError: false, error: null };\n  }\n\n  static getDerivedStateFromError(error: Error): TimberErrorBoundaryState {\n    // Suppress error boundaries during page unload (refresh/navigate away).\n    // The aborted connection causes React's streaming hydration to error,\n    // but the page is about to be replaced — showing an error boundary\n    // would be a jarring flash for the user.\n    if (isPageUnloading()) {\n      return { hasError: false, error: null };\n    }\n\n    return { hasError: true, error };\n  }\n\n  componentDidCatch(error: Error): void {\n    // A stale bundle most often surfaces here rather than as a rejected\n    // navigation: a client reference missing from this build's manifest, or\n    // a lazily-imported chunk the CDN no longer has, thrown during render.\n    //\n    // Recording it is all that happens — this boundary still renders its\n    // fallback, and the recovery is the user's next navigation, which the\n    // router turns into a full document load. Reloading from here would be a\n    // page load the user did not ask for, on a page that may be mid-rollout\n    // and would come back just as stale (TIM-1275).\n    markStaleFromError(error);\n  }\n\n  componentDidUpdate(prevProps: TimberErrorBoundaryProps): void {\n    // Reset error state when children change (e.g. client-side navigation).\n    // Without this, navigating from one error page to another keeps the\n    // stale error — getDerivedStateFromError doesn't re-fire for new children.\n    if (this.state.hasError && prevProps.children !== this.props.children) {\n      this.setState({ hasError: false, error: null });\n    }\n  }\n\n  /** Reset the error state so children re-render. */\n  private reset = () => {\n    this.setState({ hasError: false, error: null });\n  };\n\n  render(): ReactNode {\n    if (!this.state.hasError || !this.state.error) {\n      return this.props.children;\n    }\n\n    const error = this.state.error;\n    const parsed = parseDigest(error);\n\n    // RedirectSignal handling splits by environment:\n    //\n    // - SSR (no window): re-throw so the Fizz shell fails and the server\n    //   pipeline catch block can produce a proper HTTP 3xx response. See\n    //   design/04-authorization.md.\n    //\n    // - Client (window exists): a RedirectSignal that leaked into the RSC\n    //   Flight payload during client navigation would otherwise bubble past\n    //   every error boundary to `window.onerror`, which in dev triggers the\n    //   Vite error overlay (false positive — navigation itself works).\n    //   Instead, ask the router to perform an SPA navigation to the target\n    //   and render nothing while it takes over. The router's own catch path\n    //   handles cross-origin / hard navigations. See TIM-838.\n    if (parsed?.type === 'redirect') {\n      if (typeof window === 'undefined') {\n        throw error;\n      }\n      // Dedupe: React may render the error-boundary fallback path more\n      // than once for a single caught error (dev-mode double render, and\n      // additional boundaries above us in the tree). Only schedule the\n      // navigation on the first render that sees this error instance.\n      const alreadyHandled =\n        _handledRedirects.has(error) || _pendingRedirectLocation === parsed.location;\n      if (!alreadyHandled) {\n        _handledRedirects.add(error);\n        const router = getRouterOrNull();\n        if (router) {\n          _pendingRedirectLocation = parsed.location;\n          // Schedule the navigation outside the render phase to avoid\n          // setState-during-render warnings from router state updates.\n          queueMicrotask(() => {\n            router\n              .navigate(parsed.location, { replace: true })\n              .catch(() => {\n                // Fall back to a hard navigation if the soft navigation fails.\n                window.location.href = parsed.location;\n              })\n              .finally(() => {\n                _pendingRedirectLocation = null;\n              });\n          });\n        } else {\n          // No router available (shouldn't happen post-bootstrap) — fall\n          // back to a hard navigation so the user still ends up at the\n          // target.\n          window.location.href = parsed.location;\n        }\n      }\n      return null;\n    }\n\n    // Owner-addressed denies: an in-tree catch site already resolved the\n    // fallback chain and matched a file it may not render at its own\n    // position, so it re-threw to reach the segment that owns that file.\n    // Every boundary but that one declines — otherwise the nearest boundary\n    // whose status filter happens to match catches first and renders the\n    // deny page at its own depth, wrapped in the layouts the hoist existed\n    // to skip, and from a different file than the chain chose. (Boundary\n    // nesting is per-segment `{status} → category → error`; the 4xx chain\n    // runs status files across ALL segments before any error.tsx, so a\n    // leaf error.tsx would otherwise beat a root 404.tsx.)\n    //\n    // Declining is the default: an unkeyed boundary — a slot boundary, or\n    // one from a construction site that builds no deny chains — never\n    // claims a deny addressed to a segment. See TIM-1356.\n    // `typeof === 'string'`, not a null check: the digest is untrusted JSON —\n    // `parseDigest` validates only `type`, and any component can set\n    // `error.digest` itself. A non-string `ownerKey` is unequal to every\n    // boundary's key, so a truthiness test would let one error decline its\n    // way past the entire tree and blank the page, where it would otherwise\n    // have hit the nearest matching boundary.\n    if (\n      parsed?.type === 'deny' &&\n      typeof parsed.ownerKey === 'string' &&\n      parsed.ownerKey !== this.props.segmentKey\n    ) {\n      throw error;\n    }\n\n    // If this boundary has a status filter, check whether the error matches.\n    // Non-matching errors re-throw so an outer boundary can catch them.\n    if (this.props.status != null) {\n      const errorStatus = getErrorStatus(parsed, error);\n      if (errorStatus == null || !statusMatches(this.props.status, errorStatus)) {\n        // Re-throw: this boundary doesn't handle this error.\n        throw error;\n      }\n    }\n\n    // Report DenySignal handling so the pipeline skips the redundant\n    // renderDenyPage() re-render — but ONLY when this boundary can fully\n    // handle the deny in-tree:\n    //\n    // ✅ TSX boundaries (fallbackComponent) — can receive runtime props\n    //    (status, dangerouslyPassData) dynamically in render()\n    // ❌ MDX boundaries (fallbackElement) — pre-rendered at tree-build time,\n    //    cannot receive runtime deny props. Must fall through to re-render.\n    //\n    // For qualifying segment boundaries: also set the HTTP status code from\n    // the DenySignal so the Response has the correct 4xx status. This runs\n    // synchronously during Fizz rendering, BEFORE onShellReady.\n    //\n    // For slot boundaries: set _denyHandledByBoundary but do NOT change\n    // statusCode — slot denials are graceful degradation.\n    //\n    // See TIM-664, LOCAL-298.\n    if (parsed?.type === 'deny') {\n      const canHandleInTree = this.props.fallbackElement == null;\n\n      if (canHandleInTree || this.props.isSlotBoundary) {\n        const ssrData = getSsrData();\n        if (ssrData?._navContext) {\n          ssrData._navContext._denyHandledByBoundary = true;\n          if (!this.props.isSlotBoundary) {\n            ssrData._navContext.statusCode = parsed.status;\n          }\n        }\n      }\n    }\n\n    // Pre-rendered fallback element (MDX status files) — render directly.\n    // MDX components are server components that cannot be passed as function\n    // props across the RSC→client boundary. Instead, they are pre-rendered\n    // as elements in the RSC environment and passed here as fallbackElement.\n    if (this.props.fallbackElement != null) {\n      return this.props.fallbackElement;\n    }\n\n    // Render the fallback component with the right props shape.\n    if (parsed?.type === 'deny') {\n      // Status-code file boundaries (404.tsx, 4xx.tsx, …) get the documented\n      // 4xx props. error.tsx boundaries (no status filter) get their\n      // documented { error, digest, reset } contract — plus the deny extras\n      // for dual-shape implementations. Without the error prop, an error.tsx\n      // reading error.message crashes on deny fall-through. See TIM-1081.\n      if (this.props.status != null) {\n        return createElement(this.props.fallbackComponent as never, {\n          status: parsed.status,\n          dangerouslyPassData: parsed.data,\n        });\n      }\n      return createElement(this.props.fallbackComponent as never, {\n        error: denyError(parsed.status, error),\n        digest: null,\n        reset: this.reset,\n        status: parsed.status,\n        dangerouslyPassData: parsed.data,\n      });\n    }\n\n    // 5xx / RenderError / unhandled error\n    const digest =\n      parsed?.type === 'render-error' ? { code: parsed.code, data: parsed.data } : null;\n\n    return createElement(this.props.fallbackComponent as never, {\n      error,\n      digest,\n      reset: this.reset,\n    });\n  }\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Parse the structured digest from the error.\n * React sets `error.digest` from the string returned by RSC's onError.\n */\nfunction parseDigest(error: Error): ParsedDigest | null {\n  const raw = (error as { digest?: string }).digest;\n  if (typeof raw !== 'string') return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (parsed && typeof parsed === 'object' && typeof parsed.type === 'string') {\n      return parsed as ParsedDigest;\n    }\n  } catch (e) {\n    console.debug('[timber] error digest is not valid JSON:', e instanceof Error ? e.message : e);\n  }\n  return null;\n}\n\n/**\n * The Error an `error.tsx` serving a deny should receive.\n *\n * The error that actually arrives here is React's, not the framework's: a\n * server-thrown error crossing Flight has its message and name replaced with\n * a generic redacted string in production, by design. An `error.tsx` written\n * per the docs branches on `error.message` — so handing it the redacted error\n * gives it nothing to branch on, while the in-tree path hands the same file a\n * `DenySignal` named error reading `Access denied with status <N>` (see\n * `renderDenyEntry`). This reconstructs that shape from the digest, which is\n * where the status already is.\n *\n * Derived from the status alone — no stack, no server data — so it is safe on\n * the client for the same reason the digest is. See design/13-security.md\n * §\"Errors don't leak\", TIM-1081.\n */\nfunction denyError(status: number, original: Error): Error {\n  // A dev build may have preserved something more useful than the redaction.\n  if (original.name === 'DenySignal') return original;\n  const error = new Error(`Access denied with status ${status}`);\n  error.name = 'DenySignal';\n  return error;\n}\n\n/**\n * Extract the HTTP status code from a parsed digest or error message.\n * Falls back to message pattern matching for errors without a digest.\n */\nfunction getErrorStatus(parsed: ParsedDigest | null, error: Error): number | null {\n  if (parsed?.type === 'deny') return parsed.status;\n  if (parsed?.type === 'render-error') return parsed.status;\n  if (parsed?.type === 'redirect') return parsed.status;\n\n  // Fallback: parse DenySignal message pattern for errors that lost their digest\n  const match = error.message.match(/^Access denied with status (\\d+)$/);\n  if (match) return parseInt(match[1], 10);\n\n  // Unhandled errors are implicitly 500\n  return 500;\n}\n\n/**\n * Check whether an error's status matches the boundary's status filter.\n * Category markers (400, 500) match any status in that range.\n */\nfunction statusMatches(boundaryStatus: number, errorStatus: number): boolean {\n  // Category catch-all: 400 matches any 4xx, 500 matches any 5xx\n  if (boundaryStatus === 400) return errorStatus >= 400 && errorStatus <= 499;\n  if (boundaryStatus === 500) return errorStatus >= 500 && errorStatus <= 599;\n  // Exact match\n  return boundaryStatus === errorStatus;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAI,YAAY;AAEhB,IAAI,OAAO,WAAW,aAAa;CACjC,OAAO,iBAAiB,sBAAsB;EAC5C,cAAc,IAAI;EAOlB,iBAAiB;GACf,IAAI,CAAC,WAAW,cAAc,KAAK;EACrC,GAAG,CAAC;CACN,CAAC;CAID,OAAO,iBAAiB,kBAAkB;EACxC,YAAY;EACZ,cAAc,IAAI;CACpB,CAAC;CAED,OAAO,iBAAiB,aAAa,UAAU;EAI7C,IAAI,MAAM,WAAW;GACnB,YAAY;GACZ,cAAc,KAAK;EACrB;CACF,CAAC;AACH;;;;;AAMA,SAAgB,kBAA2B;CACzC,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzBA,IAAM,sBAAsB;CAE1B;CAEA;CAEA;CAEA;AACF;;AAGA,IAAM,0BAA0B;;;;;;AAOhC,SAAS,UAAU,OAAwB;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,YAAY;CACxD,IAAI,iBAAiB,OAAO,OAAO,MAAM,QAAQ,YAAY;CAC7D,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,OAAO;EAC5D,MAAM,UAAW,MAA+B;EAChD,IAAI,OAAO,YAAY,UAAU,OAAO,QAAQ,YAAY;CAC9D;CACA,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,OAAyB;CAC9D,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,uBAAuB;AAC1D;;;;;AAMA,SAAgB,iBAAiB,OAAyB;CACxD,IAAI,iBAAiB,SAAS,MAAM,SAAS,kBAAkB,OAAO;CACtE,MAAM,UAAU,UAAU,KAAK;CAC/B,OAAO,oBAAoB,MAAM,YAAY,QAAQ,SAAS,OAAO,CAAC;AACxE;;;;;;;;;;AAaA,IAAI,QAAQ;;;;;;;AAQZ,IAAI,WAAW;;AAGf,SAAgB,gBAAyB;CACvC,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAwB;CACtC,QAAQ;AACV;;;;;;;;;;;AAYA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,CAAC,UAAU,OAAO;CAUtB,IAAI,gBAAgB,GAAG,OAAO;CAE9B,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC,iBAAiB,KAAK,GAAG,OAAO;CACvE,QAAQ;CACR,OAAO;AACT;;;;;;;;;;;;;;;;;;;;AC9CA,IAAM,oCAAoB,IAAI,QAAgB;AAO9C,IAAI,2BAA0C;AAI9C,IAAa,sBAAb,cAAyC,UAGvC;CACA,YAAY,OAAiC;EAC3C,MAAM,KAAK;EACX,KAAK,QAAQ;GAAE,UAAU;GAAO,OAAO;EAAK;CAC9C;CAEA,OAAO,yBAAyB,OAAwC;EAKtE,IAAI,gBAAgB,GAClB,OAAO;GAAE,UAAU;GAAO,OAAO;EAAK;EAGxC,OAAO;GAAE,UAAU;GAAM;EAAM;CACjC;CAEA,kBAAkB,OAAoB;EAUpC,mBAAmB,KAAK;CAC1B;CAEA,mBAAmB,WAA2C;EAI5D,IAAI,KAAK,MAAM,YAAY,UAAU,aAAa,KAAK,MAAM,UAC3D,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAElD;;CAGA,cAAsB;EACpB,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAChD;CAEA,SAAoB;EAClB,IAAI,CAAC,KAAK,MAAM,YAAY,CAAC,KAAK,MAAM,OACtC,OAAO,KAAK,MAAM;EAGpB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,SAAS,YAAY,KAAK;EAehC,IAAI,QAAQ,SAAS,YAAY;GAC/B,IAAI,OAAO,WAAW,aACpB,MAAM;GAQR,IAAI,EADF,kBAAkB,IAAI,KAAK,KAAK,6BAA6B,OAAO,WACjD;IACnB,kBAAkB,IAAI,KAAK;IAC3B,MAAM,SAAS,gBAAgB;IAC/B,IAAI,QAAQ;KACV,2BAA2B,OAAO;KAGlC,qBAAqB;MACnB,OACG,SAAS,OAAO,UAAU,EAAE,SAAS,KAAK,CAAC,CAAC,CAC5C,YAAY;OAEX,OAAO,SAAS,OAAO,OAAO;MAChC,CAAC,CAAC,CACD,cAAc;OACb,2BAA2B;MAC7B,CAAC;KACL,CAAC;IACH,OAIE,OAAO,SAAS,OAAO,OAAO;GAElC;GACA,OAAO;EACT;EAsBA,IACE,QAAQ,SAAS,UACjB,OAAO,OAAO,aAAa,YAC3B,OAAO,aAAa,KAAK,MAAM,YAE/B,MAAM;EAKR,IAAI,KAAK,MAAM,UAAU,MAAM;GAC7B,MAAM,cAAc,eAAe,QAAQ,KAAK;GAChD,IAAI,eAAe,QAAQ,CAAC,cAAc,KAAK,MAAM,QAAQ,WAAW,GAEtE,MAAM;EAEV;EAmBA,IAAI,QAAQ,SAAS,QACK;OAAA,KAAK,MAAM,mBAAmB,QAE/B,KAAK,MAAM,gBAAgB;IAChD,MAAM,UAAU,WAAW;IAC3B,IAAI,SAAS,aAAa;KACxB,QAAQ,YAAY,yBAAyB;KAC7C,IAAI,CAAC,KAAK,MAAM,gBACd,QAAQ,YAAY,aAAa,OAAO;IAE5C;GACF;;EAOF,IAAI,KAAK,MAAM,mBAAmB,MAChC,OAAO,KAAK,MAAM;EAIpB,IAAI,QAAQ,SAAS,QAAQ;GAM3B,IAAI,KAAK,MAAM,UAAU,MACvB,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;GAEH,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,OAAO,UAAU,OAAO,QAAQ,KAAK;IACrC,QAAQ;IACR,OAAO,KAAK;IACZ,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;EACH;EAGA,MAAM,SACJ,QAAQ,SAAS,iBAAiB;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK,IAAI;EAE/E,OAAO,cAAc,KAAK,MAAM,mBAA4B;GAC1D;GACA;GACA,OAAO,KAAK;EACd,CAAC;CACH;AACF;;;;;AAQA,SAAS,YAAY,OAAmC;CACtD,MAAM,MAAO,MAA8B;CAC3C,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,UACjE,OAAO;CAEX,SAAS,GAAG;EACV,QAAQ,MAAM,4CAA4C,aAAa,QAAQ,EAAE,UAAU,CAAC;CAC9F;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAS,UAAU,QAAgB,UAAwB;CAEzD,IAAI,SAAS,SAAS,cAAc,OAAO;CAC3C,MAAM,wBAAQ,IAAI,MAAM,6BAA6B,QAAQ;CAC7D,MAAM,OAAO;CACb,OAAO;AACT;;;;;AAMA,SAAS,eAAe,QAA6B,OAA6B;CAChF,IAAI,QAAQ,SAAS,QAAQ,OAAO,OAAO;CAC3C,IAAI,QAAQ,SAAS,gBAAgB,OAAO,OAAO;CACnD,IAAI,QAAQ,SAAS,YAAY,OAAO,OAAO;CAG/C,MAAM,QAAQ,MAAM,QAAQ,MAAM,mCAAmC;CACrE,IAAI,OAAO,OAAO,SAAS,MAAM,IAAI,EAAE;CAGvC,OAAO;AACT;;;;;AAMA,SAAS,cAAc,gBAAwB,aAA8B;CAE3E,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CACxE,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CAExE,OAAO,mBAAmB;AAC5B"}

package/dist/_chunks/{file-cache-DmX7OqZP.js → file-cache-Dw6BJPG7.js}

@@ -348,6 +348,10 @@ function formatDeclarationFile(routes, importBase, hasSchema, appDir) {
 			lines.push("}");
 			lines.push("");
 		}
+		lines.push("type _IsAny<T> = 0 extends 1 & T ? true : false;");
+		lines.push("type _AssertSchemaNotAny<_T extends false = _IsAny<typeof schema>> = true;");
+		lines.push("type _AssertCodecTypeNotAny<_T extends false = _IsAny<SegmentParamCodec>> = true;");
+		lines.push("");
 		lines.push("type _AssertSchemaValues = {");
 		lines.push("  [K in keyof typeof schema['segmentParams']]: typeof schema['segmentParams'][K] extends SegmentParamCodec ? true : ['Error: value for', K, 'is not a valid Codec or Standard Schema'];");
 		lines.push("};");
@@ -451,4 +455,4 @@ function readFileCached(filePath) {
 //#endregion
 export { generateRouteMap as n, readFileCached as t };
 
-//# sourceMappingURL=file-cache-DmX7OqZP.js.map
+//# sourceMappingURL=file-cache-Dw6BJPG7.js.map