@timber-js/app 0.2.0-alpha.192 → 0.2.0-alpha.194

package/dist/_chunks/dist-BA3u1z3W.js

@@ -1,423 +0,0 @@
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res, err) => () => {
-	if (err) throw err[0];
-	try {
-		return fn && (res = fn(fn = 0)), res;
-	} catch (e) {
-		throw err = [e], e;
-	}
-};
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-//#endregion
-//#region src/cookies/validation.ts
-/**
-* Cookie name and value validation per RFC 6265 §4.1.1.
-*
-* This module is pure — no server or client imports — so it can be loaded
-* by both `server/request-context.ts` (which guards `getCookies().set()`)
-* and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The
-* shared validator gives both sides identical encoding contracts:
-* **the framework never silently encodes — callers emit `cookie-octet`
-* bytes or get a developer-facing error.**
-*
-* Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and
-* design/29-cookies.md §"Cookie Name and Value Validation".
-*/
-/**
-* RFC 7230 §3.2.6 token characters used as the cookie-name production in
-* RFC 6265 §4.1.1. Anchored, non-empty match.
-*
-* Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.
-* Disallowed: whitespace, controls, delimiters
-* (`(` `)` `<` `>` `@` `,` `;` `:` `\` `"` `/` `[` `]` `?` `=` `{` `}`).
-*/
-var COOKIE_NAME_RE = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
-/**
-* Format a single byte for a clear error message — escape control bytes
-* and non-ASCII as `0x..` and quote printables.
-*/
-function describeChar(value, index) {
-	const code = value.charCodeAt(index);
-	if (code < 32 || code === 127 || code > 126) return `0x${code.toString(16).padStart(2, "0")}`;
-	return JSON.stringify(value[index]);
-}
-/**
-* Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.
-* Throws a developer-facing error naming the offending byte and its index.
-*/
-function assertValidCookieName(name) {
-	if (typeof name !== "string" || name.length === 0) throw new Error("[timber] cookie name must be a non-empty string.");
-	if (!COOKIE_NAME_RE.test(name)) {
-		for (let i = 0; i < name.length; i++) if (!COOKIE_NAME_RE.test(name[i])) throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — disallowed character ${describeChar(name, i)} at index ${i}. Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, and \`!#$%&'*+-.^_\`|~\`; no whitespace, controls, or delimiters).`);
-		throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — must match RFC 6265 §4.1.1 token grammar.`);
-	}
-}
-/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */
-function isCookieOctet(code) {
-	return code === 33 || code >= 35 && code <= 43 || code >= 45 && code <= 58 || code >= 60 && code <= 91 || code >= 93 && code <= 126;
-}
-/**
-* Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`
-* production:
-*
-*     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
-*     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
-*
-* Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are
-* valid. The wrapped form is common in upstream `Set-Cookie` headers
-* (e.g. `sid="abc"; Path=/`) and must be forwardable through
-* `setFromHeaders` verbatim — stripping or rejecting the surrounding
-* quotes would corrupt the on-the-wire bytes and break value semantics
-* for the upstream service.
-*
-* Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),
-* interior DQUOTE, comma, semicolon, backslash, DEL, and anything
-* non-ASCII. The smuggling primitive (`;`) is rejected regardless of
-* wrapping.
-*
-* Throws a developer-facing error naming the offending byte and its
-* index. Callers passing user-controlled data through the default
-* `set()` path don't need to call this — `set()` auto-encodes via
-* `encodeURIComponent`, whose output is always valid cookie-octet.
-* This validator is for the `{ raw: true }` opt-out and for
-* `setFromHeaders` forwarding.
-*/
-/**
-* Characters that must not appear in path or domain cookie attributes.
-* Semicolons delimit cookie attributes on the wire, so allowing `;` in
-* path or domain would inject extra attributes. CR/LF enable HTTP header
-* injection.
-*/
-var ATTR_INJECTION_RE = /[;\r\n]/;
-var VALID_SAME_SITE = /* @__PURE__ */ new Set([
-	"strict",
-	"lax",
-	"none"
-]);
-/**
-* Validate cookie option attributes at runtime to prevent Set-Cookie
-* header injection through unsanitized option values.
-*
-* TypeScript types enforce correct shapes at compile time, but at runtime
-* (e.g. from untyped libraries or user-controlled config) invalid values
-* could inject additional Set-Cookie attributes.
-*/
-function assertValidCookieOptions(options) {
-	if (options.sameSite !== void 0) {
-		const lower = options.sameSite.toLowerCase();
-		if (!VALID_SAME_SITE.has(lower)) throw new Error(`[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — must be 'strict', 'lax', or 'none'.`);
-	}
-	if (options.path !== void 0 && ATTR_INJECTION_RE.test(options.path)) throw new Error(`[timber] invalid cookie path ${JSON.stringify(options.path)} — path must not contain ';', CR, or LF (Set-Cookie header injection).`);
-	if (options.domain !== void 0 && ATTR_INJECTION_RE.test(options.domain)) throw new Error(`[timber] invalid cookie domain ${JSON.stringify(options.domain)} — domain must not contain ';', CR, or LF (Set-Cookie header injection).`);
-	if (options.maxAge !== void 0 && (typeof options.maxAge !== "number" || !Number.isFinite(options.maxAge))) throw new Error(`[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — maxAge must be a finite number.`);
-}
-function assertValidCookieValue(name, value) {
-	if (typeof value !== "string") throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);
-	const wrapped = value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34;
-	const start = wrapped ? 1 : 0;
-	const end = wrapped ? value.length - 1 : value.length;
-	for (let i = start; i < end; i++) if (!isCookieOctet(value.charCodeAt(i))) throw new Error(`[timber] cookie ${JSON.stringify(name)}: invalid cookie value — disallowed character ${describeChar(value, i)} at index ${i}. Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes (US-ASCII printable, excluding whitespace, \`"\`, \`,\`, \`;\`, and \`\\\`), optionally enclosed in a single DQUOTE pair. Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/cookie@1.1.1/node_modules/cookie/dist/index.js
-var require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.parseCookie = parseCookie;
-	exports.stringifySetCookie = stringifySetCookie;
-	exports.serialize = stringifySetCookie;
-	exports.parseSetCookie = parseSetCookie;
-	exports.stringifySetCookie = stringifySetCookie;
-	exports.serialize = stringifySetCookie;
-	/**
-	* RegExp to match cookie-name in RFC 6265 sec 4.1.1
-	* This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
-	* which has been replaced by the token definition in RFC 7230 appendix B.
-	*
-	* cookie-name       = token
-	* token             = 1*tchar
-	* tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
-	*                     "*" / "+" / "-" / "." / "^" / "_" /
-	*                     "`" / "|" / "~" / DIGIT / ALPHA
-	*
-	* Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
-	* Allow same range as cookie value, except `=`, which delimits end of name.
-	*/
-	var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
-	/**
-	* RegExp to match cookie-value in RFC 6265 sec 4.1.1
-	*
-	* cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
-	* cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
-	*                     ; US-ASCII characters excluding CTLs,
-	*                     ; whitespace DQUOTE, comma, semicolon,
-	*                     ; and backslash
-	*
-	* Allowing more characters: https://github.com/jshttp/cookie/issues/191
-	* Comma, backslash, and DQUOTE are not part of the parsing algorithm.
-	*/
-	var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
-	/**
-	* RegExp to match domain-value in RFC 6265 sec 4.1.1
-	*
-	* domain-value      = <subdomain>
-	*                     ; defined in [RFC1034], Section 3.5, as
-	*                     ; enhanced by [RFC1123], Section 2.1
-	* <subdomain>       = <label> | <subdomain> "." <label>
-	* <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
-	*                     Labels must be 63 characters or less.
-	*                     'let-dig' not 'letter' in the first char, per RFC1123
-	* <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
-	* <let-dig-hyp>     = <let-dig> | "-"
-	* <let-dig>         = <letter> | <digit>
-	* <letter>          = any one of the 52 alphabetic characters A through Z in
-	*                     upper case and a through z in lower case
-	* <digit>           = any one of the ten digits 0 through 9
-	*
-	* Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
-	*
-	* > (Note that a leading %x2E ("."), if present, is ignored even though that
-	* character is not permitted, but a trailing %x2E ("."), if present, will
-	* cause the user agent to ignore the attribute.)
-	*/
-	var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-	/**
-	* RegExp to match path-value in RFC 6265 sec 4.1.1
-	*
-	* path-value        = <any CHAR except CTLs or ";">
-	* CHAR              = %x01-7F
-	*                     ; defined in RFC 5234 appendix B.1
-	*/
-	var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
-	/**
-	* RegExp to match max-age-value in RFC 6265 sec 5.6.2
-	*/
-	var maxAgeRegExp = /^-?\d+$/;
-	var __toString = Object.prototype.toString;
-	var NullObject = /* @__PURE__ */ (() => {
-		const C = function() {};
-		C.prototype = Object.create(null);
-		return C;
-	})();
-	/**
-	* Parse a `Cookie` header.
-	*
-	* Parse the given cookie header string into an object
-	* The object has the various cookies as keys(names) => values
-	*/
-	function parseCookie(str, options) {
-		const obj = new NullObject();
-		const len = str.length;
-		if (len < 2) return obj;
-		const dec = options?.decode || decode;
-		let index = 0;
-		do {
-			const eqIdx = eqIndex(str, index, len);
-			if (eqIdx === -1) break;
-			const endIdx = endIndex(str, index, len);
-			if (eqIdx > endIdx) {
-				index = str.lastIndexOf(";", eqIdx - 1) + 1;
-				continue;
-			}
-			const key = valueSlice(str, index, eqIdx);
-			if (obj[key] === void 0) obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
-			index = endIdx + 1;
-		} while (index < len);
-		return obj;
-	}
-	function stringifySetCookie(_name, _val, _opts) {
-		const cookie = typeof _name === "object" ? _name : {
-			..._opts,
-			name: _name,
-			value: String(_val)
-		};
-		const enc = (typeof _val === "object" ? _val : _opts)?.encode || encodeURIComponent;
-		if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
-		const value = cookie.value ? enc(cookie.value) : "";
-		if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
-		let str = cookie.name + "=" + value;
-		if (cookie.maxAge !== void 0) {
-			if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
-			str += "; Max-Age=" + cookie.maxAge;
-		}
-		if (cookie.domain) {
-			if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
-			str += "; Domain=" + cookie.domain;
-		}
-		if (cookie.path) {
-			if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
-			str += "; Path=" + cookie.path;
-		}
-		if (cookie.expires) {
-			if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
-			str += "; Expires=" + cookie.expires.toUTCString();
-		}
-		if (cookie.httpOnly) str += "; HttpOnly";
-		if (cookie.secure) str += "; Secure";
-		if (cookie.partitioned) str += "; Partitioned";
-		if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
-			case "low":
-				str += "; Priority=Low";
-				break;
-			case "medium":
-				str += "; Priority=Medium";
-				break;
-			case "high":
-				str += "; Priority=High";
-				break;
-			default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
-		}
-		if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
-			case true:
-			case "strict":
-				str += "; SameSite=Strict";
-				break;
-			case "lax":
-				str += "; SameSite=Lax";
-				break;
-			case "none":
-				str += "; SameSite=None";
-				break;
-			default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
-		}
-		return str;
-	}
-	/**
-	* Deserialize a `Set-Cookie` header into an object.
-	*
-	* deserialize('foo=bar; httpOnly')
-	*   => { name: 'foo', value: 'bar', httpOnly: true }
-	*/
-	function parseSetCookie(str, options) {
-		const dec = options?.decode || decode;
-		const len = str.length;
-		const endIdx = endIndex(str, 0, len);
-		const eqIdx = eqIndex(str, 0, endIdx);
-		const setCookie = eqIdx === -1 ? {
-			name: "",
-			value: dec(valueSlice(str, 0, endIdx))
-		} : {
-			name: valueSlice(str, 0, eqIdx),
-			value: dec(valueSlice(str, eqIdx + 1, endIdx))
-		};
-		let index = endIdx + 1;
-		while (index < len) {
-			const endIdx = endIndex(str, index, len);
-			const eqIdx = eqIndex(str, index, endIdx);
-			const attr = eqIdx === -1 ? valueSlice(str, index, endIdx) : valueSlice(str, index, eqIdx);
-			const val = eqIdx === -1 ? void 0 : valueSlice(str, eqIdx + 1, endIdx);
-			switch (attr.toLowerCase()) {
-				case "httponly":
-					setCookie.httpOnly = true;
-					break;
-				case "secure":
-					setCookie.secure = true;
-					break;
-				case "partitioned":
-					setCookie.partitioned = true;
-					break;
-				case "domain":
-					setCookie.domain = val;
-					break;
-				case "path":
-					setCookie.path = val;
-					break;
-				case "max-age":
-					if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Number(val);
-					break;
-				case "expires":
-					if (!val) break;
-					const date = new Date(val);
-					if (Number.isFinite(date.valueOf())) setCookie.expires = date;
-					break;
-				case "priority":
-					if (!val) break;
-					const priority = val.toLowerCase();
-					if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
-					break;
-				case "samesite":
-					if (!val) break;
-					const sameSite = val.toLowerCase();
-					if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
-					break;
-			}
-			index = endIdx + 1;
-		}
-		return setCookie;
-	}
-	/**
-	* Find the `;` character between `min` and `len` in str.
-	*/
-	function endIndex(str, min, len) {
-		const index = str.indexOf(";", min);
-		return index === -1 ? len : index;
-	}
-	/**
-	* Find the `=` character between `min` and `max` in str.
-	*/
-	function eqIndex(str, min, max) {
-		const index = str.indexOf("=", min);
-		return index < max ? index : -1;
-	}
-	/**
-	* Slice out a value between startPod to max.
-	*/
-	function valueSlice(str, min, max) {
-		let start = min;
-		let end = max;
-		do {
-			const code = str.charCodeAt(start);
-			if (code !== 32 && code !== 9) break;
-		} while (++start < end);
-		while (end > start) {
-			const code = str.charCodeAt(end - 1);
-			if (code !== 32 && code !== 9) break;
-			end--;
-		}
-		return str.slice(start, end);
-	}
-	/**
-	* URL-decode string value. Optimized to skip native call when no %.
-	*/
-	function decode(str) {
-		if (str.indexOf("%") === -1) return str;
-		try {
-			return decodeURIComponent(str);
-		} catch (e) {
-			return str;
-		}
-	}
-	/**
-	* Determine if value is a Date.
-	*/
-	function isDate(val) {
-		return __toString.call(val) === "[object Date]";
-	}
-}));
-//#endregion
-export { __esmMin as a, assertValidCookieValue as i, assertValidCookieName as n, __exportAll as o, assertValidCookieOptions as r, __toCommonJS as s, require_dist as t };
-
-//# sourceMappingURL=dist-BA3u1z3W.js.map

package/dist/_chunks/dist-BA3u1z3W.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dist-BA3u1z3W.js","names":[],"sources":["../../src/cookies/validation.ts","../../../../node_modules/.pnpm/cookie@1.1.1/node_modules/cookie/dist/index.js"],"sourcesContent":["/**\n * Cookie name and value validation per RFC 6265 §4.1.1.\n *\n * This module is pure — no server or client imports — so it can be loaded\n * by both `server/request-context.ts` (which guards `getCookies().set()`)\n * and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The\n * shared validator gives both sides identical encoding contracts:\n * **the framework never silently encodes — callers emit `cookie-octet`\n * bytes or get a developer-facing error.**\n *\n * Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and\n * design/29-cookies.md §\"Cookie Name and Value Validation\".\n */\n\n// ─── RFC 6265 cookie-octet ────────────────────────────────────────────────\n//\n//   cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n//\n// Equivalently: US-ASCII printable bytes excluding whitespace, `\"` (0x22),\n// `,` (0x2C), `;` (0x3B), `\\` (0x5C), and DEL (0x7F).\n\n/**\n * RFC 7230 §3.2.6 token characters used as the cookie-name production in\n * RFC 6265 §4.1.1. Anchored, non-empty match.\n *\n * Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.\n * Disallowed: whitespace, controls, delimiters\n * (`(` `)` `<` `>` `@` `,` `;` `:` `\\` `\"` `/` `[` `]` `?` `=` `{` `}`).\n */\nconst COOKIE_NAME_RE = /^[!#$%&'*+\\-.0-9A-Z^_`a-z|~]+$/;\n\n/**\n * Format a single byte for a clear error message — escape control bytes\n * and non-ASCII as `0x..` and quote printables.\n */\nfunction describeChar(value: string, index: number): string {\n  const code = value.charCodeAt(index);\n  if (code < 0x20 || code === 0x7f || code > 0x7e) {\n    return `0x${code.toString(16).padStart(2, '0')}`;\n  }\n  return JSON.stringify(value[index]);\n}\n\n/**\n * Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.\n * Throws a developer-facing error naming the offending byte and its index.\n */\nexport function assertValidCookieName(name: string): void {\n  if (typeof name !== 'string' || name.length === 0) {\n    throw new Error('[timber] cookie name must be a non-empty string.');\n  }\n  if (!COOKIE_NAME_RE.test(name)) {\n    for (let i = 0; i < name.length; i++) {\n      if (!COOKIE_NAME_RE.test(name[i])) {\n        throw new Error(\n          `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n            `disallowed character ${describeChar(name, i)} at index ${i}. ` +\n            `Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, ` +\n            `and \\`!#$%&'*+-.^_\\`|~\\`; no whitespace, controls, or delimiters).`\n        );\n      }\n    }\n    throw new Error(\n      `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n        `must match RFC 6265 §4.1.1 token grammar.`\n    );\n  }\n}\n\n/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */\nfunction isCookieOctet(code: number): boolean {\n  return (\n    code === 0x21 ||\n    (code >= 0x23 && code <= 0x2b) ||\n    (code >= 0x2d && code <= 0x3a) ||\n    (code >= 0x3c && code <= 0x5b) ||\n    (code >= 0x5d && code <= 0x7e)\n  );\n}\n\n/**\n * Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`\n * production:\n *\n *     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n *     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *\n * Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are\n * valid. The wrapped form is common in upstream `Set-Cookie` headers\n * (e.g. `sid=\"abc\"; Path=/`) and must be forwardable through\n * `setFromHeaders` verbatim — stripping or rejecting the surrounding\n * quotes would corrupt the on-the-wire bytes and break value semantics\n * for the upstream service.\n *\n * Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),\n * interior DQUOTE, comma, semicolon, backslash, DEL, and anything\n * non-ASCII. The smuggling primitive (`;`) is rejected regardless of\n * wrapping.\n *\n * Throws a developer-facing error naming the offending byte and its\n * index. Callers passing user-controlled data through the default\n * `set()` path don't need to call this — `set()` auto-encodes via\n * `encodeURIComponent`, whose output is always valid cookie-octet.\n * This validator is for the `{ raw: true }` opt-out and for\n * `setFromHeaders` forwarding.\n */\n// ─── Cookie attribute validation ──────────────────────────────────────────\n\n/**\n * Characters that must not appear in path or domain cookie attributes.\n * Semicolons delimit cookie attributes on the wire, so allowing `;` in\n * path or domain would inject extra attributes. CR/LF enable HTTP header\n * injection.\n */\nconst ATTR_INJECTION_RE = /[;\\r\\n]/;\n\nconst VALID_SAME_SITE = new Set(['strict', 'lax', 'none']);\n\n/**\n * Validate cookie option attributes at runtime to prevent Set-Cookie\n * header injection through unsanitized option values.\n *\n * TypeScript types enforce correct shapes at compile time, but at runtime\n * (e.g. from untyped libraries or user-controlled config) invalid values\n * could inject additional Set-Cookie attributes.\n */\nexport function assertValidCookieOptions(options: {\n  sameSite?: string;\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n}): void {\n  if (options.sameSite !== undefined) {\n    const lower = options.sameSite.toLowerCase();\n    if (!VALID_SAME_SITE.has(lower)) {\n      throw new Error(\n        `[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — ` +\n          `must be 'strict', 'lax', or 'none'.`\n      );\n    }\n  }\n  if (options.path !== undefined && ATTR_INJECTION_RE.test(options.path)) {\n    throw new Error(\n      `[timber] invalid cookie path ${JSON.stringify(options.path)} — ` +\n        `path must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (options.domain !== undefined && ATTR_INJECTION_RE.test(options.domain)) {\n    throw new Error(\n      `[timber] invalid cookie domain ${JSON.stringify(options.domain)} — ` +\n        `domain must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (\n    options.maxAge !== undefined &&\n    (typeof options.maxAge !== 'number' || !Number.isFinite(options.maxAge))\n  ) {\n    throw new Error(\n      `[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — ` +\n        `maxAge must be a finite number.`\n    );\n  }\n}\n\nexport function assertValidCookieValue(name: string, value: string): void {\n  if (typeof value !== 'string') {\n    throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);\n  }\n  // Detect the DQUOTE-wrapped form: at least two characters and both\n  // endpoints are `\"`. The interior must be pure cookie-octet (no\n  // interior DQUOTEs allowed — the grammar says *cookie-octet, and\n  // cookie-octet excludes 0x22).\n  const wrapped =\n    value.length >= 2 &&\n    value.charCodeAt(0) === 0x22 &&\n    value.charCodeAt(value.length - 1) === 0x22;\n  const start = wrapped ? 1 : 0;\n  const end = wrapped ? value.length - 1 : value.length;\n  for (let i = start; i < end; i++) {\n    const code = value.charCodeAt(i);\n    if (!isCookieOctet(code)) {\n      throw new Error(\n        `[timber] cookie ${JSON.stringify(name)}: invalid cookie value — ` +\n          `disallowed character ${describeChar(value, i)} at index ${i}. ` +\n          `Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes ` +\n          `(US-ASCII printable, excluding whitespace, \\`\"\\`, \\`,\\`, \\`;\\`, and \\`\\\\\\`), ` +\n          `optionally enclosed in a single DQUOTE pair. ` +\n          `Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`\n      );\n    }\n  }\n}\n","\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.parseCookie = parseCookie;\nexports.parse = parseCookie;\nexports.stringifyCookie = stringifyCookie;\nexports.stringifySetCookie = stringifySetCookie;\nexports.serialize = stringifySetCookie;\nexports.parseSetCookie = parseSetCookie;\nexports.stringifySetCookie = stringifySetCookie;\nexports.serialize = stringifySetCookie;\n/**\n * RegExp to match cookie-name in RFC 6265 sec 4.1.1\n * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2\n * which has been replaced by the token definition in RFC 7230 appendix B.\n *\n * cookie-name       = token\n * token             = 1*tchar\n * tchar             = \"!\" / \"#\" / \"$\" / \"%\" / \"&\" / \"'\" /\n *                     \"*\" / \"+\" / \"-\" / \".\" / \"^\" / \"_\" /\n *                     \"`\" / \"|\" / \"~\" / DIGIT / ALPHA\n *\n * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191\n * Allow same range as cookie value, except `=`, which delimits end of name.\n */\nconst cookieNameRegExp = /^[\\u0021-\\u003A\\u003C\\u003E-\\u007E]+$/;\n/**\n * RegExp to match cookie-value in RFC 6265 sec 4.1.1\n *\n * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *                     ; US-ASCII characters excluding CTLs,\n *                     ; whitespace DQUOTE, comma, semicolon,\n *                     ; and backslash\n *\n * Allowing more characters: https://github.com/jshttp/cookie/issues/191\n * Comma, backslash, and DQUOTE are not part of the parsing algorithm.\n */\nconst cookieValueRegExp = /^[\\u0021-\\u003A\\u003C-\\u007E]*$/;\n/**\n * RegExp to match domain-value in RFC 6265 sec 4.1.1\n *\n * domain-value      = <subdomain>\n *                     ; defined in [RFC1034], Section 3.5, as\n *                     ; enhanced by [RFC1123], Section 2.1\n * <subdomain>       = <label> | <subdomain> \".\" <label>\n * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]\n *                     Labels must be 63 characters or less.\n *                     'let-dig' not 'letter' in the first char, per RFC1123\n * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>\n * <let-dig-hyp>     = <let-dig> | \"-\"\n * <let-dig>         = <letter> | <digit>\n * <letter>          = any one of the 52 alphabetic characters A through Z in\n *                     upper case and a through z in lower case\n * <digit>           = any one of the ten digits 0 through 9\n *\n * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173\n *\n * > (Note that a leading %x2E (\".\"), if present, is ignored even though that\n * character is not permitted, but a trailing %x2E (\".\"), if present, will\n * cause the user agent to ignore the attribute.)\n */\nconst domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;\n/**\n * RegExp to match path-value in RFC 6265 sec 4.1.1\n *\n * path-value        = <any CHAR except CTLs or \";\">\n * CHAR              = %x01-7F\n *                     ; defined in RFC 5234 appendix B.1\n */\nconst pathValueRegExp = /^[\\u0020-\\u003A\\u003D-\\u007E]*$/;\n/**\n * RegExp to match max-age-value in RFC 6265 sec 5.6.2\n */\nconst maxAgeRegExp = /^-?\\d+$/;\nconst __toString = Object.prototype.toString;\nconst NullObject = /* @__PURE__ */ (() => {\n    const C = function () { };\n    C.prototype = Object.create(null);\n    return C;\n})();\n/**\n * Parse a `Cookie` header.\n *\n * Parse the given cookie header string into an object\n * The object has the various cookies as keys(names) => values\n */\nfunction parseCookie(str, options) {\n    const obj = new NullObject();\n    const len = str.length;\n    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.\n    if (len < 2)\n        return obj;\n    const dec = options?.decode || decode;\n    let index = 0;\n    do {\n        const eqIdx = eqIndex(str, index, len);\n        if (eqIdx === -1)\n            break; // No more cookie pairs.\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx > endIdx) {\n            // backtrack on prior semicolon\n            index = str.lastIndexOf(\";\", eqIdx - 1) + 1;\n            continue;\n        }\n        const key = valueSlice(str, index, eqIdx);\n        // only assign once\n        if (obj[key] === undefined) {\n            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));\n        }\n        index = endIdx + 1;\n    } while (index < len);\n    return obj;\n}\n/**\n * Stringifies an object into an HTTP `Cookie` header.\n */\nfunction stringifyCookie(cookie, options) {\n    const enc = options?.encode || encodeURIComponent;\n    const cookieStrings = [];\n    for (const name of Object.keys(cookie)) {\n        const val = cookie[name];\n        if (val === undefined)\n            continue;\n        if (!cookieNameRegExp.test(name)) {\n            throw new TypeError(`cookie name is invalid: ${name}`);\n        }\n        const value = enc(val);\n        if (!cookieValueRegExp.test(value)) {\n            throw new TypeError(`cookie val is invalid: ${val}`);\n        }\n        cookieStrings.push(`${name}=${value}`);\n    }\n    return cookieStrings.join(\"; \");\n}\nfunction stringifySetCookie(_name, _val, _opts) {\n    const cookie = typeof _name === \"object\"\n        ? _name\n        : { ..._opts, name: _name, value: String(_val) };\n    const options = typeof _val === \"object\" ? _val : _opts;\n    const enc = options?.encode || encodeURIComponent;\n    if (!cookieNameRegExp.test(cookie.name)) {\n        throw new TypeError(`argument name is invalid: ${cookie.name}`);\n    }\n    const value = cookie.value ? enc(cookie.value) : \"\";\n    if (!cookieValueRegExp.test(value)) {\n        throw new TypeError(`argument val is invalid: ${cookie.value}`);\n    }\n    let str = cookie.name + \"=\" + value;\n    if (cookie.maxAge !== undefined) {\n        if (!Number.isInteger(cookie.maxAge)) {\n            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);\n        }\n        str += \"; Max-Age=\" + cookie.maxAge;\n    }\n    if (cookie.domain) {\n        if (!domainValueRegExp.test(cookie.domain)) {\n            throw new TypeError(`option domain is invalid: ${cookie.domain}`);\n        }\n        str += \"; Domain=\" + cookie.domain;\n    }\n    if (cookie.path) {\n        if (!pathValueRegExp.test(cookie.path)) {\n            throw new TypeError(`option path is invalid: ${cookie.path}`);\n        }\n        str += \"; Path=\" + cookie.path;\n    }\n    if (cookie.expires) {\n        if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) {\n            throw new TypeError(`option expires is invalid: ${cookie.expires}`);\n        }\n        str += \"; Expires=\" + cookie.expires.toUTCString();\n    }\n    if (cookie.httpOnly) {\n        str += \"; HttpOnly\";\n    }\n    if (cookie.secure) {\n        str += \"; Secure\";\n    }\n    if (cookie.partitioned) {\n        str += \"; Partitioned\";\n    }\n    if (cookie.priority) {\n        const priority = typeof cookie.priority === \"string\"\n            ? cookie.priority.toLowerCase()\n            : undefined;\n        switch (priority) {\n            case \"low\":\n                str += \"; Priority=Low\";\n                break;\n            case \"medium\":\n                str += \"; Priority=Medium\";\n                break;\n            case \"high\":\n                str += \"; Priority=High\";\n                break;\n            default:\n                throw new TypeError(`option priority is invalid: ${cookie.priority}`);\n        }\n    }\n    if (cookie.sameSite) {\n        const sameSite = typeof cookie.sameSite === \"string\"\n            ? cookie.sameSite.toLowerCase()\n            : cookie.sameSite;\n        switch (sameSite) {\n            case true:\n            case \"strict\":\n                str += \"; SameSite=Strict\";\n                break;\n            case \"lax\":\n                str += \"; SameSite=Lax\";\n                break;\n            case \"none\":\n                str += \"; SameSite=None\";\n                break;\n            default:\n                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);\n        }\n    }\n    return str;\n}\n/**\n * Deserialize a `Set-Cookie` header into an object.\n *\n * deserialize('foo=bar; httpOnly')\n *   => { name: 'foo', value: 'bar', httpOnly: true }\n */\nfunction parseSetCookie(str, options) {\n    const dec = options?.decode || decode;\n    const len = str.length;\n    const endIdx = endIndex(str, 0, len);\n    const eqIdx = eqIndex(str, 0, endIdx);\n    const setCookie = eqIdx === -1\n        ? { name: \"\", value: dec(valueSlice(str, 0, endIdx)) }\n        : {\n            name: valueSlice(str, 0, eqIdx),\n            value: dec(valueSlice(str, eqIdx + 1, endIdx)),\n        };\n    let index = endIdx + 1;\n    while (index < len) {\n        const endIdx = endIndex(str, index, len);\n        const eqIdx = eqIndex(str, index, endIdx);\n        const attr = eqIdx === -1\n            ? valueSlice(str, index, endIdx)\n            : valueSlice(str, index, eqIdx);\n        const val = eqIdx === -1 ? undefined : valueSlice(str, eqIdx + 1, endIdx);\n        switch (attr.toLowerCase()) {\n            case \"httponly\":\n                setCookie.httpOnly = true;\n                break;\n            case \"secure\":\n                setCookie.secure = true;\n                break;\n            case \"partitioned\":\n                setCookie.partitioned = true;\n                break;\n            case \"domain\":\n                setCookie.domain = val;\n                break;\n            case \"path\":\n                setCookie.path = val;\n                break;\n            case \"max-age\":\n                if (val && maxAgeRegExp.test(val))\n                    setCookie.maxAge = Number(val);\n                break;\n            case \"expires\":\n                if (!val)\n                    break;\n                const date = new Date(val);\n                if (Number.isFinite(date.valueOf()))\n                    setCookie.expires = date;\n                break;\n            case \"priority\":\n                if (!val)\n                    break;\n                const priority = val.toLowerCase();\n                if (priority === \"low\" ||\n                    priority === \"medium\" ||\n                    priority === \"high\") {\n                    setCookie.priority = priority;\n                }\n                break;\n            case \"samesite\":\n                if (!val)\n                    break;\n                const sameSite = val.toLowerCase();\n                if (sameSite === \"lax\" ||\n                    sameSite === \"strict\" ||\n                    sameSite === \"none\") {\n                    setCookie.sameSite = sameSite;\n                }\n                break;\n        }\n        index = endIdx + 1;\n    }\n    return setCookie;\n}\n/**\n * Find the `;` character between `min` and `len` in str.\n */\nfunction endIndex(str, min, len) {\n    const index = str.indexOf(\";\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Find the `=` character between `min` and `max` in str.\n */\nfunction eqIndex(str, min, max) {\n    const index = str.indexOf(\"=\", min);\n    return index < max ? index : -1;\n}\n/**\n * Slice out a value between startPod to max.\n */\nfunction valueSlice(str, min, max) {\n    let start = min;\n    let end = max;\n    do {\n        const code = str.charCodeAt(start);\n        if (code !== 0x20 /*   */ && code !== 0x09 /* \\t */)\n            break;\n    } while (++start < end);\n    while (end > start) {\n        const code = str.charCodeAt(end - 1);\n        if (code !== 0x20 /*   */ && code !== 0x09 /* \\t */)\n            break;\n        end--;\n    }\n    return str.slice(start, end);\n}\n/**\n * URL-decode string value. Optimized to skip native call when no %.\n */\nfunction decode(str) {\n    if (str.indexOf(\"%\") === -1)\n        return str;\n    try {\n        return decodeURIComponent(str);\n    }\n    catch (e) {\n        return str;\n    }\n}\n/**\n * Determine if value is a Date.\n */\nfunction isDate(val) {\n    return __toString.call(val) === \"[object Date]\";\n}\n//# sourceMappingURL=index.js.map"],"x_google_ignoreList":[1],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,iBAAiB;;;;;AAMvB,SAAS,aAAa,OAAe,OAAuB;CAC1D,MAAM,OAAO,MAAM,WAAW,KAAK;CACnC,IAAI,OAAO,MAAQ,SAAS,OAAQ,OAAO,KACzC,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE/C,OAAO,KAAK,UAAU,MAAM,MAAM;AACpC;;;;;AAMA,SAAgB,sBAAsB,MAAoB;CACxD,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,GAC9B,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,0BAC3B,aAAa,MAAM,CAAC,EAAE,YAAY,EAAE,0JAGhE;EAGJ,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,6CAEvD;CACF;AACF;;AAGA,SAAS,cAAc,MAAuB;CAC5C,OACE,SAAS,MACR,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAoB;AAE1B,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAU;CAAO;AAAM,CAAC;;;;;;;;;AAUzD,SAAgB,yBAAyB,SAKhC;CACP,IAAI,QAAQ,aAAa,KAAA,GAAW;EAClC,MAAM,QAAQ,QAAQ,SAAS,YAAY;EAC3C,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAC5B,MAAM,IAAI,MACR,0CAA0C,KAAK,UAAU,QAAQ,QAAQ,EAAE,uCAE7E;CAEJ;CACA,IAAI,QAAQ,SAAS,KAAA,KAAa,kBAAkB,KAAK,QAAQ,IAAI,GACnE,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,QAAQ,IAAI,EAAE,uEAE/D;CAEF,IAAI,QAAQ,WAAW,KAAA,KAAa,kBAAkB,KAAK,QAAQ,MAAM,GACvE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,yEAEnE;CAEF,IACE,QAAQ,WAAW,KAAA,MAClB,OAAO,QAAQ,WAAW,YAAY,CAAC,OAAO,SAAS,QAAQ,MAAM,IAEtE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,mCAEnE;AAEJ;AAEA,SAAgB,uBAAuB,MAAc,OAAqB;CACxE,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,IAAI,EAAE,iCAAiC;CAM3F,MAAM,UACJ,MAAM,UAAU,KAChB,MAAM,WAAW,CAAC,MAAM,MACxB,MAAM,WAAW,MAAM,SAAS,CAAC,MAAM;CACzC,MAAM,QAAQ,UAAU,IAAI;CAC5B,MAAM,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM;CAC/C,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,KAE3B,IAAI,CAAC,cADQ,MAAM,WAAW,CACX,CAAI,GACrB,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,IAAI,EAAE,gDACd,aAAa,OAAO,CAAC,EAAE,YAAY,EAAE,gRAKjE;AAGN;;;;CC9LA,OAAO,eAAe,SAAS,cAAc,EAAE,OAAO,KAAK,CAAC;CAC5D,QAAQ,cAAc;CAGtB,QAAQ,qBAAqB;CAC7B,QAAQ,YAAY;CACpB,QAAQ,iBAAiB;CACzB,QAAQ,qBAAqB;CAC7B,QAAQ,YAAY;;;;;;;;;;;;;;;CAepB,IAAM,mBAAmB;;;;;;;;;;;;;CAazB,IAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;CAwB1B,IAAM,oBAAoB;;;;;;;;CAQ1B,IAAM,kBAAkB;;;;CAIxB,IAAM,eAAe;CACrB,IAAM,aAAa,OAAO,UAAU;CACpC,IAAM,aAA6B,uBAAO;EACtC,MAAM,IAAI,WAAY,CAAE;EACxB,EAAE,YAAY,OAAO,OAAO,IAAI;EAChC,OAAO;CACX,EAAA,CAAG;;;;;;;CAOH,SAAS,YAAY,KAAK,SAAS;EAC/B,MAAM,MAAM,IAAI,WAAW;EAC3B,MAAM,MAAM,IAAI;EAEhB,IAAI,MAAM,GACN,OAAO;EACX,MAAM,MAAM,SAAS,UAAU;EAC/B,IAAI,QAAQ;EACZ,GAAG;GACC,MAAM,QAAQ,QAAQ,KAAK,OAAO,GAAG;GACrC,IAAI,UAAU,IACV;GACJ,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;GACvC,IAAI,QAAQ,QAAQ;IAEhB,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC,IAAI;IAC1C;GACJ;GACA,MAAM,MAAM,WAAW,KAAK,OAAO,KAAK;GAExC,IAAI,IAAI,SAAS,KAAA,GACb,IAAI,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;GAErD,QAAQ,SAAS;EACrB,SAAS,QAAQ;EACjB,OAAO;CACX;CAsBA,SAAS,mBAAmB,OAAO,MAAM,OAAO;EAC5C,MAAM,SAAS,OAAO,UAAU,WAC1B,QACA;GAAE,GAAG;GAAO,MAAM;GAAO,OAAO,OAAO,IAAI;EAAE;EAEnD,MAAM,OADU,OAAO,SAAS,WAAW,OAAO,MAAA,EAC7B,UAAU;EAC/B,IAAI,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAClC,MAAM,IAAI,UAAU,6BAA6B,OAAO,MAAM;EAElE,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,KAAK,IAAI;EACjD,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC7B,MAAM,IAAI,UAAU,4BAA4B,OAAO,OAAO;EAElE,IAAI,MAAM,OAAO,OAAO,MAAM;EAC9B,IAAI,OAAO,WAAW,KAAA,GAAW;GAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,MAAM,GAC/B,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;GAEpE,OAAO,eAAe,OAAO;EACjC;EACA,IAAI,OAAO,QAAQ;GACf,IAAI,CAAC,kBAAkB,KAAK,OAAO,MAAM,GACrC,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;GAEpE,OAAO,cAAc,OAAO;EAChC;EACA,IAAI,OAAO,MAAM;GACb,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,GACjC,MAAM,IAAI,UAAU,2BAA2B,OAAO,MAAM;GAEhE,OAAO,YAAY,OAAO;EAC9B;EACA,IAAI,OAAO,SAAS;GAChB,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC,GACpE,MAAM,IAAI,UAAU,8BAA8B,OAAO,SAAS;GAEtE,OAAO,eAAe,OAAO,QAAQ,YAAY;EACrD;EACA,IAAI,OAAO,UACP,OAAO;EAEX,IAAI,OAAO,QACP,OAAO;EAEX,IAAI,OAAO,aACP,OAAO;EAEX,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,KAAA,GACN;GACI,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;EAC5E;EAEJ,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,OAAO,UACb;GACI,KAAK;GACL,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,KAAK;IACD,OAAO;IACP;GACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;EAC5E;EAEJ,OAAO;CACX;;;;;;;CAOA,SAAS,eAAe,KAAK,SAAS;EAClC,MAAM,MAAM,SAAS,UAAU;EAC/B,MAAM,MAAM,IAAI;EAChB,MAAM,SAAS,SAAS,KAAK,GAAG,GAAG;EACnC,MAAM,QAAQ,QAAQ,KAAK,GAAG,MAAM;EACpC,MAAM,YAAY,UAAU,KACtB;GAAE,MAAM;GAAI,OAAO,IAAI,WAAW,KAAK,GAAG,MAAM,CAAC;EAAE,IACnD;GACE,MAAM,WAAW,KAAK,GAAG,KAAK;GAC9B,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;EACjD;EACJ,IAAI,QAAQ,SAAS;EACrB,OAAO,QAAQ,KAAK;GAChB,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;GACvC,MAAM,QAAQ,QAAQ,KAAK,OAAO,MAAM;GACxC,MAAM,OAAO,UAAU,KACjB,WAAW,KAAK,OAAO,MAAM,IAC7B,WAAW,KAAK,OAAO,KAAK;GAClC,MAAM,MAAM,UAAU,KAAK,KAAA,IAAY,WAAW,KAAK,QAAQ,GAAG,MAAM;GACxE,QAAQ,KAAK,YAAY,GAAzB;IACI,KAAK;KACD,UAAU,WAAW;KACrB;IACJ,KAAK;KACD,UAAU,SAAS;KACnB;IACJ,KAAK;KACD,UAAU,cAAc;KACxB;IACJ,KAAK;KACD,UAAU,SAAS;KACnB;IACJ,KAAK;KACD,UAAU,OAAO;KACjB;IACJ,KAAK;KACD,IAAI,OAAO,aAAa,KAAK,GAAG,GAC5B,UAAU,SAAS,OAAO,GAAG;KACjC;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,OAAO,IAAI,KAAK,GAAG;KACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,GAC9B,UAAU,UAAU;KACxB;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,WAAW,IAAI,YAAY;KACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;KAEzB;IACJ,KAAK;KACD,IAAI,CAAC,KACD;KACJ,MAAM,WAAW,IAAI,YAAY;KACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;KAEzB;GACR;GACA,QAAQ,SAAS;EACrB;EACA,OAAO;CACX;;;;CAIA,SAAS,SAAS,KAAK,KAAK,KAAK;EAC7B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;EAClC,OAAO,UAAU,KAAK,MAAM;CAChC;;;;CAIA,SAAS,QAAQ,KAAK,KAAK,KAAK;EAC5B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;EAClC,OAAO,QAAQ,MAAM,QAAQ;CACjC;;;;CAIA,SAAS,WAAW,KAAK,KAAK,KAAK;EAC/B,IAAI,QAAQ;EACZ,IAAI,MAAM;EACV,GAAG;GACC,MAAM,OAAO,IAAI,WAAW,KAAK;GACjC,IAAI,SAAS,MAAgB,SAAS,GAClC;EACR,SAAS,EAAE,QAAQ;EACnB,OAAO,MAAM,OAAO;GAChB,MAAM,OAAO,IAAI,WAAW,MAAM,CAAC;GACnC,IAAI,SAAS,MAAgB,SAAS,GAClC;GACJ;EACJ;EACA,OAAO,IAAI,MAAM,OAAO,GAAG;CAC/B;;;;CAIA,SAAS,OAAO,KAAK;EACjB,IAAI,IAAI,QAAQ,GAAG,MAAM,IACrB,OAAO;EACX,IAAI;GACA,OAAO,mBAAmB,GAAG;EACjC,SACO,GAAG;GACN,OAAO;EACX;CACJ;;;;CAIA,SAAS,OAAO,KAAK;EACjB,OAAO,WAAW,KAAK,GAAG,MAAM;CACpC"}

package/dist/_chunks/mdx-file-C005ay-P.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mdx-file-C005ay-P.js","names":[],"sources":["../../src/server/utils/mdx-file.ts"],"sourcesContent":["/**\n * MDX file-path detection shared by error/deny rendering paths.\n *\n * MDX status and error files are server components — they cannot be passed\n * as function props across the RSC→client boundary (e.g. to\n * TimberErrorBoundary or ErrorReconstituter) and must be pre-rendered as\n * elements with plain props instead.\n *\n * See design/10-error-handling.md §\"Status-Code File Variants\".\n */\n\n/** MDX/markdown extensions — server components by default. */\nconst MDX_EXTENSIONS = new Set(['.mdx', '.md']);\n\n/**\n * Check if a file path ends with an MDX/markdown extension.\n */\nexport function isMdxFilePath(filePath: string): boolean {\n  const dotIndex = filePath.lastIndexOf('.');\n  if (dotIndex === -1) return false;\n  return MDX_EXTENSIONS.has(filePath.slice(dotIndex));\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAM,iCAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;;;;AAK9C,SAAgB,cAAc,UAA2B;CACvD,MAAM,WAAW,SAAS,YAAY,GAAG;CACzC,IAAI,aAAa,IAAI,OAAO;CAC5B,OAAO,eAAe,IAAI,SAAS,MAAM,QAAQ,CAAC;AACpD"}

package/dist/_chunks/plugin-context-rCinWLiE.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin-context-rCinWLiE.js","names":[],"sources":["../../src/utils/startup-timer.ts","../../src/plugin-context.ts"],"sourcesContent":["/**\n * Startup timer — records named phases with their durations.\n *\n * Used by the plugin system to instrument cold start and report a\n * timing breakdown in dev mode. Zero overhead in production (disabled).\n *\n * See design/18-build-system.md, TIM-155.\n */\n\nimport { performance } from 'node:perf_hooks';\n\nexport interface PhaseRecord {\n  name: string;\n  startMs: number;\n  durationMs: number;\n}\n\nexport interface StartupTimer {\n  /** Mark the beginning of a named phase. */\n  start(phase: string): void;\n  /** Mark the end of a named phase. Returns duration in ms. */\n  end(phase: string): number;\n  /** Get all completed phase records, ordered by start time. */\n  getPhases(): PhaseRecord[];\n  /** Total elapsed time from first start() to last end(). */\n  totalMs(): number;\n  /** Format a human-readable summary string. */\n  formatSummary(): string;\n}\n\n/**\n * Create a startup timer that records phase durations.\n */\nexport function createStartupTimer(): StartupTimer {\n  const pending = new Map<string, number>();\n  const phases: PhaseRecord[] = [];\n\n  return {\n    start(phase: string): void {\n      pending.set(phase, performance.now());\n    },\n\n    end(phase: string): number {\n      const startMs = pending.get(phase);\n      if (startMs === undefined) {\n        return 0;\n      }\n      pending.delete(phase);\n      const durationMs = performance.now() - startMs;\n      phases.push({ name: phase, startMs, durationMs });\n      return durationMs;\n    },\n\n    getPhases(): PhaseRecord[] {\n      return [...phases].sort((a, b) => a.startMs - b.startMs);\n    },\n\n    totalMs(): number {\n      if (phases.length === 0) return 0;\n      const sorted = this.getPhases();\n      const first = sorted[0];\n      const last = sorted[sorted.length - 1];\n      return last.startMs + last.durationMs - first.startMs;\n    },\n\n    formatSummary(): string {\n      const sorted = this.getPhases();\n      if (sorted.length === 0) return 'No phases recorded.';\n\n      const lines = sorted.map((p) => {\n        const ms = p.durationMs.toFixed(1);\n        return `  ${p.name.padEnd(30)} ${ms.padStart(8)}ms`;\n      });\n\n      const total = this.totalMs().toFixed(1);\n      lines.push(`  ${'total'.padEnd(30)} ${total.padStart(8)}ms`);\n\n      return ['[timber] startup timing:', ...lines].join('\\n');\n    },\n  };\n}\n\n/**\n * No-op timer for production builds — all methods are empty.\n */\nexport function createNoopTimer(): StartupTimer {\n  return {\n    start() {},\n    end() {\n      return 0;\n    },\n    getPhases() {\n      return [];\n    },\n    totalMs() {\n      return 0;\n    },\n    formatSummary() {\n      return '';\n    },\n  };\n}\n","/**\n * Plugin context — internal types and helpers for timber sub-plugins.\n *\n * These are NOT part of the user-facing API. They are consumed by\n * sub-plugins (routing, entries, shims, etc.) via relative imports.\n * The root entry point (index.ts) does not re-export them.\n *\n * Design doc: 18-build-system.md §\"Shared Plugin Context\"\n */\n\nimport { existsSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { createRequire } from 'node:module';\nimport { parseAst } from 'vite';\nimport type { RouteTree } from './routing/types';\nimport type { BuildManifest } from './server/build-manifest';\nimport type { CaptureSummary } from './server/prebuilt-builder';\nimport type { StartupTimer } from './utils/startup-timer';\nimport { createStartupTimer } from './utils/startup-timer';\nimport type { TimberUserConfig, ClientJavascriptConfig } from './config-types.js';\nimport type { RscManifest } from './plugins/static-build.js';\nimport type { HoldingServer } from './dev-tools/holding-server.js';\nimport type { ProgramNode } from './plugins/callsite-ast.js';\n\n// Re-export for sub-plugin convenience — they import from plugin-context.ts\nexport type { TimberUserConfig, ClientJavascriptConfig } from './config-types.js';\n\n// ── Client JavaScript config ─────────────────────────────────────────────\n\n/** Fully resolved client JavaScript configuration (no optionals). */\nexport interface ResolvedClientJavascript {\n  disabled: boolean;\n  enableHMRInDev: boolean;\n}\n\n/**\n * Resolve `clientJavascript` into a fully resolved config.\n */\nexport function resolveClientJavascript(config: TimberUserConfig): ResolvedClientJavascript {\n  if (config.clientJavascript !== undefined) {\n    if (typeof config.clientJavascript === 'boolean') {\n      return {\n        disabled: !config.clientJavascript,\n        enableHMRInDev: !config.clientJavascript,\n      };\n    }\n    return {\n      disabled: config.clientJavascript.disabled,\n      enableHMRInDev: config.clientJavascript.enableHMRInDev ?? config.clientJavascript.disabled,\n    };\n  }\n  return { disabled: false, enableHMRInDev: false };\n}\n\n// ── Plugin Context ────────────────────────────────────────────────────────\n\n/**\n * Shared context object passed to all sub-plugins via closure.\n *\n * Sub-plugins communicate through this context — not through Vite's\n * plugin API or global state.\n * See design/18-build-system.md §\"Shared Plugin Context\".\n */\nexport interface PluginContext {\n  config: TimberUserConfig;\n  /** Resolved client JavaScript configuration */\n  clientJavascript: ResolvedClientJavascript;\n  /** The scanned route tree (populated by timber-routing, consumed by timber-entries) */\n  routeTree: RouteTree | null;\n  /** Absolute path to the app/ directory */\n  appDir: string;\n  /** Absolute path to the project root */\n  root: string;\n  /** Whether the dev server is running (set by timber-root-sync in configResolved) */\n  dev: boolean;\n  /**\n   * Vite's resolved `base` (set by timber-root-sync in configResolved).\n   * Always has a trailing slash; `'/'` unless the app is deployed under a\n   * sub-path. Every URL the framework emits — assets, fonts, RSC payloads —\n   * carries this prefix. This is the single copy: sub-plugins read it here\n   * rather than capturing `config.base` in their own configResolved.\n   *\n   * **Availability:** written by timber-root-sync, which has no `enforce`, so\n   * it is populated from `buildStart`/`load`/`generateBundle`/`configureServer`\n   * onward — but NOT during the `configResolved` of an `enforce: 'pre'`\n   * plugin, which Vite runs first. A pre plugin that needs the base inside\n   * its own `configResolved` must read `config.base` there (timber-fonts\n   * does). See TIM-1261.\n   */\n  base: string;\n  /** CSS build manifest (populated by adapter after client build, null in dev) */\n  buildManifest: BuildManifest | null;\n  /** Per-build deployment ID for version skew detection (null in dev) */\n  deploymentId: string | null;\n  /** Startup timer for profiling cold start phases (active in dev, no-op in prod) */\n  timer: StartupTimer;\n  /** Holding server that binds the port during dev startup (closed in timber-dev-server) */\n  holdingServer?: HoldingServer | null;\n  /**\n   * Resolved absolute path to the build output directory.\n   *\n   * Defaults to `<root>/.timber/dist`. Can be overridden via\n   * `timber.config.ts` `buildDir` or Vite's `build.outDir`.\n   * Timber config takes precedence when both are set.\n   *\n   * Used by adapter-build and cli preview.\n   */\n  buildDir: string;\n  /**\n   * Per-route client reference keys captured during the RSC build.\n   * Maps absolute route file paths to the set of client reference\n   * hash keys they transitively import. Used by adapter-build to\n   * populate per-route modulepreload entries from clientReferenceDeps.\n   */\n  routeClientRefKeys?: Map<string, Set<string>>;\n  /**\n   * Static request-dependency verdict per segment entry file, keyed by the\n   * absolute `filePath` the route scanner produced. Computed once by\n   * `timber-request-dep`'s RSC `buildEnd` and serialized into\n   * `buildManifest.requestDep` by `timber-build-manifest` (build only — dev\n   * answers the same question through the `Symbol.for('timber:request-dep')`\n   * bridge instead).\n   *\n   * `undefined` and `{}` are different states and the difference is the whole\n   * of TIM-1300: an empty object means the analysis ran and found no segments,\n   * `undefined` means it never ran, and the runtime cannot tell them apart —\n   * every key is absent either way, so every segment falls to the conservative\n   * `true` and nothing is ever skipped. The build fails loudly on `undefined`\n   * rather than shipping that silently.\n   */\n  requestDepMap?: Record<string, boolean>;\n  /**\n   * Maps absolute module IDs of client references in non-facade RSC\n   * chunks to the absolute paths of their consuming facade modules.\n   * Built during the RSC `generateBundle` phase by timber-chunks,\n   * consumed by `clientChunkGroup` to reclassify `shared:` modules\n   * that are only used by a single route boundary.\n   * See design/27-chunking-strategy.md, TIM-1107.\n   */\n  sharedModuleFacades?: Map<string, string[]>;\n  /**\n   * Module ID → prebuilt component IDs declared in it. Recorded by the\n   * timber-prebuilt transform (RSC environment, production builds only),\n   * consumed by the RSC `generateBundle` module-graph walk that computes\n   * `routePrebuiltComponents`. See design/44-render-at-build-time.md.\n   */\n  prebuiltModuleComponents?: Map<string, string[]>;\n  /**\n   * Module ID → mapping of variable name to component ID for the prebuilt\n   * components declared in that module. Used at `generateBundle` time to\n   * trace imports from other modules back to specific component IDs.\n   */\n  prebuiltBindingNames?: Map<string, Map<string, string>>;\n  /**\n   * Component ID → distinct static call-site prop objects captured from\n   * JSX usage sites during the transform and generateBundle phases.\n   * Consumed by the post-build capture pass to render with actual props\n   * instead of empty `{}`. See design/44 §Props Derivation.\n   */\n  prebuiltCallSiteProps?: Map<string, Record<string, unknown>[]>;\n  /**\n   * Route file path (page or layout, absolute) → prebuilt component IDs\n   * transitively reachable from it. Computed during RSC `generateBundle`,\n   * consumed by the post-build capture pass (TIM-1119) to decide which\n   * components to render under which route's param combos.\n   */\n  routePrebuiltComponents?: Map<string, string[]>;\n  /**\n   * Page file paths that were desugared from `export const prerender` by\n   * timber-prerender-sugar. The prebuilt transform uses this to verify\n   * the generated `cache.component(...)` call was picked up.\n   */\n  prerenderSugarPages?: Set<string>;\n  /**\n   * Component ID → built chunk file name for prebuilt-declaring modules\n   * that are only reachable via dynamic imports (import.meta.glob, lazy\n   * routes). The capture pass imports these chunks to trigger\n   * cache.component() registration before rendering. Populated during\n   * RSC generateBundle alongside routePrebuiltComponents.\n   */\n  prebuiltLazyChunks?: Map<string, string>;\n  /** Post-build prebuilt capture summary (populated by timber-prebuilt, consumed by build-report). */\n  captureSummary?: CaptureSummary;\n  /**\n   * Content-keyed AST parse memo shared across cache/prebuilt/prerender-sugar\n   * transforms. Collapses both cross-plugin and cross-environment duplicate\n   * parses: identical code hits, rewritten code misses (correct because Vite\n   * transforms chain — a rewrite produces different code). Bounded LRU (32\n   * entries) so it doesn't hold programs for the whole build.\n   *\n   * Consumers MUST treat the returned ProgramNode as read-only — they collect\n   * ranges and rewrite CODE via MagicString; the AST itself is never mutated.\n   */\n  parseCached?: ParseMemo;\n  /**\n   * Content-Type mappings for extensionless static API route outputs.\n   * Populated during static generation, consumed by adapter-build to\n   * write per-path Content-Type rules in _headers. See TIM-1241.\n   */\n  staticContentTypes?: Record<string, string>;\n  /**\n   * RSC flight payload manifest mapping unhashed → hashed URLs.\n   * Populated during static generation, consumed by adapters to set\n   * immutable cache headers for `_rsc/` files. See TIM-1254.\n   */\n  rscManifest?: RscManifest;\n}\n\n// ── AST parse memo ───────────────────────────────────────────────────────\n\nconst PARSE_MEMO_CAPACITY = 32;\n\n/**\n * Content-keyed LRU memo for `parseAst`. Transforms for the same module run\n * back-to-back across plugins and environments, so a tiny window captures the\n * wins. The returned ProgramNode is shared — callers MUST NOT mutate it.\n */\nexport class ParseMemo {\n  private cache = new Map<string, ProgramNode>();\n\n  /**\n   * Parse code, returning a cached ProgramNode if the same code was parsed\n   * before. The returned AST MUST NOT be mutated — it may be shared across\n   * multiple consumers.\n   */\n  parse(code: string): ProgramNode {\n    const existing = this.cache.get(code);\n    if (existing) {\n      // LRU refresh: move to end\n      this.cache.delete(code);\n      this.cache.set(code, existing);\n      return existing;\n    }\n    const program = parseAst(code, { lang: 'tsx' }) as unknown as ProgramNode;\n    if (this.cache.size >= PARSE_MEMO_CAPACITY) {\n      // Evict oldest (first inserted)\n      const firstKey = this.cache.keys().next().value!;\n      this.cache.delete(firstKey);\n    }\n    this.cache.set(code, program);\n    return program;\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ── App directory resolution ──────────────────────────────────────────────\n\n// ── Plugin API (Vite `plugin.api`) ────────────────────────────────────────\n\n/**\n * What `timber-root-sync` publishes on its Vite `plugin.api`.\n *\n * The single supported way to read timber's *resolved* configuration from\n * outside the plugin pipeline. Re-reading `timber.config.ts` is not equivalent:\n * config passed inline as `timber({ ... })` in `vite.config.ts` exists only in\n * the plugin's closure, and `root`/`appDir` are resolved against Vite's root\n * rather than the caller's cwd.\n */\nexport interface TimberPluginApi {\n  /** The live plugin context. Fully populated from `configResolved` onward. */\n  getContext(): PluginContext;\n}\n\n/** Narrow an unknown Vite `plugin.api` to timber's. */\nexport function isTimberPluginApi(api: unknown): api is TimberPluginApi {\n  return (\n    typeof api === 'object' &&\n    api !== null &&\n    'getContext' in api &&\n    typeof api.getContext === 'function'\n  );\n}\n\n/**\n * Resolve the app directory. Checks (in order):\n * 1. Explicit `configAppDir` from timber.config.ts\n * 2. `<root>/app`\n * 3. `<root>/src/app`\n *\n * Throws if none exist.\n */\nexport function resolveAppDir(root: string, configAppDir?: string): string {\n  if (configAppDir) {\n    const explicit = join(root, configAppDir);\n    if (!existsSync(explicit)) {\n      throw new Error(`[timber] Configured appDir \"${configAppDir}\" does not exist at ${explicit}`);\n    }\n    return explicit;\n  }\n\n  const rootApp = join(root, 'app');\n  if (existsSync(rootApp)) return rootApp;\n\n  const srcApp = join(root, 'src', 'app');\n  if (existsSync(srcApp)) return srcApp;\n\n  throw new Error(\n    `[timber] Could not find app directory. Expected \"app/\" or \"src/app/\" in ${root}. ` +\n      `You can set appDir in timber.config.ts to specify a custom location.`\n  );\n}\n\n// ── Plugin context factory ────────────────────────────────────────────────\n\nexport function createPluginContext(config?: TimberUserConfig, root?: string): PluginContext {\n  const projectRoot = root ?? process.cwd();\n  const resolvedConfig: TimberUserConfig = { ...config };\n  return {\n    config: resolvedConfig,\n    clientJavascript: resolveClientJavascript(resolvedConfig),\n    routeTree: null,\n    appDir: join(projectRoot, 'app'),\n    root: projectRoot,\n    dev: false,\n    base: '/',\n    buildManifest: null,\n    deploymentId: null,\n    timer: createStartupTimer(),\n    holdingServer: null,\n    buildDir: resolveBuildDir(projectRoot, resolvedConfig.buildDir),\n    parseCached: new ParseMemo(),\n  };\n}\n\n// ── Build directory resolution ────────────────────────────────────────────\n\n/** Default build output directory (relative to root). */\nexport const DEFAULT_BUILD_DIR = join('.timber', 'dist');\n\n/**\n * Resolve the build output directory.\n *\n * Priority:\n * 1. Explicit `timberBuildDir` from timber.config.ts\n * 2. Explicit `viteBuildOutDir` from Vite's build.outDir (if not the default 'dist')\n * 3. Default: `.timber/dist`\n *\n * Returns an absolute path.\n */\nexport function resolveBuildDir(\n  root: string,\n  timberBuildDir?: string,\n  viteBuildOutDir?: string\n): string {\n  if (timberBuildDir) {\n    return resolve(root, timberBuildDir);\n  }\n  if (viteBuildOutDir && viteBuildOutDir !== 'dist') {\n    return resolve(root, viteBuildOutDir);\n  }\n  return join(root, DEFAULT_BUILD_DIR);\n}\n\n// ── Config file loading ───────────────────────────────────────────────────\n\n/**\n * Map known timber.config load failures to actionable hints (TIM-1040).\n * Returns null when the error has no known remedy beyond its own message.\n *\n * Known failure modes of loading timber.config.ts via native require():\n * - Node < 22.18 has no default type stripping → ERR_UNKNOWN_FILE_EXTENSION\n * - Non-erasable TS syntax (enums, namespaces, parameter properties)\n *   → ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX / ERR_INVALID_TYPESCRIPT_SYNTAX\n * - ESM syntax in a `\"type\": \"commonjs\"` package → the stripped .ts is\n *   parsed as CJS and throws SyntaxError: \"Unexpected token 'export'\"\n *   (export statements) or \"Cannot use import statement outside a\n *   module\" (import statements)\n */\nexport function configLoadHint(configName: string, err: unknown): string | null {\n  const code = (err as NodeJS.ErrnoException | null)?.code;\n  const isTs = configName.endsWith('.ts');\n\n  if (isTs && code === 'ERR_UNKNOWN_FILE_EXTENSION') {\n    return (\n      'Loading a TypeScript config requires Node.js 22.18+ (built-in type stripping). ' +\n      'Upgrade Node.js or rewrite the config as timber.config.js.'\n    );\n  }\n  if (code === 'ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX' || code === 'ERR_INVALID_TYPESCRIPT_SYNTAX') {\n    return (\n      'Node.js loads the config with type stripping, which only supports erasable TypeScript syntax — ' +\n      'replace enums, namespaces, and constructor parameter properties with plain objects and types.'\n    );\n  }\n  if (\n    isTs &&\n    err instanceof SyntaxError &&\n    /Unexpected token '(export|import)'|Cannot use import statement outside a module/.test(\n      err.message\n    )\n  ) {\n    return (\n      'The config uses ESM syntax but Node.js parsed it as CommonJS — ' +\n      'set \"type\": \"module\" in package.json, or use module.exports instead of export default.'\n    );\n  }\n  return null;\n}\n\n/**\n * Load timber.config.ts (or .js, .mjs) from the project root.\n * Returns the config object or null if no config file is found.\n * Throws a descriptive error naming the file when a config file exists\n * but fails to load — a broken config must fail loudly, never silently\n * degrade (see TIM-1066). Known failure modes get an actionable hint\n * appended (see configLoadHint, TIM-1040).\n *\n * Uses require() — Node 22.12+ can require() ESM modules, and Node\n * 22.18+ strips types from .ts files by default (hence the engines\n * field requiring >=22.18.0). This keeps timber() synchronous — no\n * async config loading needed.\n * This is the single config loader — dev, build, and preview all use it.\n */\nexport function loadTimberConfigFile(root: string): TimberUserConfig | null {\n  const configNames = ['timber.config.ts', 'timber.config.js', 'timber.config.mjs'];\n  const req = createRequire(join(root, 'package.json'));\n\n  for (const name of configNames) {\n    const configPath = join(root, name);\n    if (existsSync(configPath)) {\n      try {\n        const mod = req(configPath);\n        return (mod.default ?? mod) as TimberUserConfig;\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        const hint = configLoadHint(name, err);\n        throw new Error(\n          `[timber] Failed to load ${configPath}: ${message}${hint ? `\\n${hint}` : ''}`,\n          { cause: err }\n        );\n      }\n    }\n  }\n  return null;\n}\n\n/**\n * Detect config keys set in both inline (vite.config.ts) and file (timber.config.ts)\n * and warn the user. The `output` key is excluded because it defaults to 'server'\n * in createPluginContext and would always appear as an inline key.\n *\n * Returns the list of conflicting key names (for testing).\n */\nexport function warnConfigConflicts(\n  inline: TimberUserConfig,\n  fileConfig: TimberUserConfig\n): string[] {\n  const conflicts: string[] = [];\n  for (const key of Object.keys(fileConfig) as (keyof TimberUserConfig)[]) {\n    if (key in inline && inline[key] !== undefined) {\n      conflicts.push(key);\n    }\n  }\n  if (conflicts.length > 0) {\n    console.warn(\n      `[timber] Config conflict: ${conflicts.map((k) => `\"${k}\"`).join(', ')} set in both ` +\n        `vite.config.ts (inline) and timber.config.ts. ` +\n        `Move all config to timber.config.ts to avoid confusion. ` +\n        `The inline value from vite.config.ts will be used.`\n    );\n  }\n  return conflicts;\n}\n\n/**\n * Drop own keys whose value is `undefined` so they don't clobber file\n * config during spread merging. `timber({ buildDir: process.env.BUILD_DIR })`\n * with the var unset must not erase the timber.config.ts value.\n */\nfunction stripUndefined<T extends object>(obj: T): T {\n  return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined)) as T;\n}\n\n/**\n * Merge file-based config (timber.config.ts) with inline config (vite.config.ts).\n * Inline config takes precedence — file config only fills in missing fields.\n * Inline keys explicitly set to `undefined` are treated as absent, matching\n * the `!== undefined` check in warnConfigConflicts.\n */\nexport function mergeFileConfig(\n  inline: TimberUserConfig,\n  fileConfig: TimberUserConfig\n): TimberUserConfig {\n  warnConfigConflicts(inline, fileConfig);\n  const definedInline = stripUndefined(inline);\n\n  return {\n    ...fileConfig,\n    ...definedInline,\n    ...(fileConfig.limits && definedInline.limits\n      ? { limits: { ...fileConfig.limits, ...stripUndefined(definedInline.limits) } }\n      : {}),\n    ...(fileConfig.dev && definedInline.dev\n      ? { dev: { ...fileConfig.dev, ...stripUndefined(definedInline.dev) } }\n      : {}),\n    ...(fileConfig.mdx && definedInline.mdx\n      ? { mdx: { ...fileConfig.mdx, ...stripUndefined(definedInline.mdx) } }\n      : {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,SAAgB,qBAAmC;CACjD,MAAM,0BAAU,IAAI,IAAoB;CACxC,MAAM,SAAwB,CAAC;CAE/B,OAAO;EACL,MAAM,OAAqB;GACzB,QAAQ,IAAI,OAAO,YAAY,IAAI,CAAC;EACtC;EAEA,IAAI,OAAuB;GACzB,MAAM,UAAU,QAAQ,IAAI,KAAK;GACjC,IAAI,YAAY,KAAA,GACd,OAAO;GAET,QAAQ,OAAO,KAAK;GACpB,MAAM,aAAa,YAAY,IAAI,IAAI;GACvC,OAAO,KAAK;IAAE,MAAM;IAAO;IAAS;GAAW,CAAC;GAChD,OAAO;EACT;EAEA,YAA2B;GACzB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;EACzD;EAEA,UAAkB;GAChB,IAAI,OAAO,WAAW,GAAG,OAAO;GAChC,MAAM,SAAS,KAAK,UAAU;GAC9B,MAAM,QAAQ,OAAO;GACrB,MAAM,OAAO,OAAO,OAAO,SAAS;GACpC,OAAO,KAAK,UAAU,KAAK,aAAa,MAAM;EAChD;EAEA,gBAAwB;GACtB,MAAM,SAAS,KAAK,UAAU;GAC9B,IAAI,OAAO,WAAW,GAAG,OAAO;GAEhC,MAAM,QAAQ,OAAO,KAAK,MAAM;IAC9B,MAAM,KAAK,EAAE,WAAW,QAAQ,CAAC;IACjC,OAAO,KAAK,EAAE,KAAK,OAAO,EAAE,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE;GAClD,CAAC;GAED,MAAM,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ,CAAC;GACtC,MAAM,KAAK,KAAK,QAAQ,OAAO,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG;GAE3D,OAAO,CAAC,4BAA4B,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI;EACzD;CACF;AACF;;;;AAKA,SAAgB,kBAAgC;CAC9C,OAAO;EACL,QAAQ,CAAC;EACT,MAAM;GACJ,OAAO;EACT;EACA,YAAY;GACV,OAAO,CAAC;EACV;EACA,UAAU;GACR,OAAO;EACT;EACA,gBAAgB;GACd,OAAO;EACT;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/DA,SAAgB,wBAAwB,QAAoD;CAC1F,IAAI,OAAO,qBAAqB,KAAA,GAAW;EACzC,IAAI,OAAO,OAAO,qBAAqB,WACrC,OAAO;GACL,UAAU,CAAC,OAAO;GAClB,gBAAgB,CAAC,OAAO;EAC1B;EAEF,OAAO;GACL,UAAU,OAAO,iBAAiB;GAClC,gBAAgB,OAAO,iBAAiB,kBAAkB,OAAO,iBAAiB;EACpF;CACF;CACA,OAAO;EAAE,UAAU;EAAO,gBAAgB;CAAM;AAClD;AA8JA,IAAM,sBAAsB;;;;;;AAO5B,IAAa,YAAb,MAAuB;CACrB,wBAAgB,IAAI,IAAyB;;;;;;CAO7C,MAAM,MAA2B;EAC/B,MAAM,WAAW,KAAK,MAAM,IAAI,IAAI;EACpC,IAAI,UAAU;GAEZ,KAAK,MAAM,OAAO,IAAI;GACtB,KAAK,MAAM,IAAI,MAAM,QAAQ;GAC7B,OAAO;EACT;EACA,MAAM,UAAU,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC;EAC9C,IAAI,KAAK,MAAM,QAAQ,qBAAqB;GAE1C,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,KAAK,MAAM,OAAO,QAAQ;EAC5B;EACA,KAAK,MAAM,IAAI,MAAM,OAAO;EAC5B,OAAO;CACT;CAEA,IAAI,OAAe;EACjB,OAAO,KAAK,MAAM;CACpB;AACF;;AAqBA,SAAgB,kBAAkB,KAAsC;CACtE,OACE,OAAO,QAAQ,YACf,QAAQ,QACR,gBAAgB,OAChB,OAAO,IAAI,eAAe;AAE9B;;;;;;;;;AAUA,SAAgB,cAAc,MAAc,cAA+B;CACzE,IAAI,cAAc;EAChB,MAAM,WAAW,KAAK,MAAM,YAAY;EACxC,IAAI,CAAC,WAAW,QAAQ,GACtB,MAAM,IAAI,MAAM,+BAA+B,aAAa,sBAAsB,UAAU;EAE9F,OAAO;CACT;CAEA,MAAM,UAAU,KAAK,MAAM,KAAK;CAChC,IAAI,WAAW,OAAO,GAAG,OAAO;CAEhC,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK;CACtC,IAAI,WAAW,MAAM,GAAG,OAAO;CAE/B,MAAM,IAAI,MACR,2EAA2E,KAAK,uEAElF;AACF;AAIA,SAAgB,oBAAoB,QAA2B,MAA8B;CAC3F,MAAM,cAAc,QAAQ,QAAQ,IAAI;CACxC,MAAM,iBAAmC,EAAE,GAAG,OAAO;CACrD,OAAO;EACL,QAAQ;EACR,kBAAkB,wBAAwB,cAAc;EACxD,WAAW;EACX,QAAQ,KAAK,aAAa,KAAK;EAC/B,MAAM;EACN,KAAK;EACL,MAAM;EACN,eAAe;EACf,cAAc;EACd,OAAO,mBAAmB;EAC1B,eAAe;EACf,UAAU,gBAAgB,aAAa,eAAe,QAAQ;EAC9D,aAAa,IAAI,UAAU;CAC7B;AACF;;AAKA,IAAa,oBAAoB,KAAK,WAAW,MAAM;;;;;;;;;;;AAYvD,SAAgB,gBACd,MACA,gBACA,iBACQ;CACR,IAAI,gBACF,OAAO,QAAQ,MAAM,cAAc;CAErC,IAAI,mBAAmB,oBAAoB,QACzC,OAAO,QAAQ,MAAM,eAAe;CAEtC,OAAO,KAAK,MAAM,iBAAiB;AACrC;;;;;;;;;;;;;;AAiBA,SAAgB,eAAe,YAAoB,KAA6B;CAC9E,MAAM,OAAQ,KAAsC;CACpD,MAAM,OAAO,WAAW,SAAS,KAAK;CAEtC,IAAI,QAAQ,SAAS,8BACnB,OACE;CAIJ,IAAI,SAAS,uCAAuC,SAAS,iCAC3D,OACE;CAIJ,IACE,QACA,eAAe,eACf,kFAAkF,KAChF,IAAI,OACN,GAEA,OACE;CAIJ,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAgB,qBAAqB,MAAuC;CAC1E,MAAM,cAAc;EAAC;EAAoB;EAAoB;CAAmB;CAChF,MAAM,MAAM,cAAc,KAAK,MAAM,cAAc,CAAC;CAEpD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,aAAa,KAAK,MAAM,IAAI;EAClC,IAAI,WAAW,UAAU,GACvB,IAAI;GACF,MAAM,MAAM,IAAI,UAAU;GAC1B,OAAQ,IAAI,WAAW;EACzB,SAAS,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC/D,MAAM,OAAO,eAAe,MAAM,GAAG;GACrC,MAAM,IAAI,MACR,2BAA2B,WAAW,IAAI,UAAU,OAAO,KAAK,SAAS,MACzE,EAAE,OAAO,IAAI,CACf;EACF;CAEJ;CACA,OAAO;AACT;;;;;;;;AASA,SAAgB,oBACd,QACA,YACU;CACV,MAAM,YAAsB,CAAC;CAC7B,KAAK,MAAM,OAAO,OAAO,KAAK,UAAU,GACtC,IAAI,OAAO,UAAU,OAAO,SAAS,KAAA,GACnC,UAAU,KAAK,GAAG;CAGtB,IAAI,UAAU,SAAS,GACrB,QAAQ,KACN,6BAA6B,UAAU,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,sKAIzE;CAEF,OAAO;AACT;;;;;;AAOA,SAAS,eAAiC,KAAW;CACnD,OAAO,OAAO,YAAY,OAAO,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AAClF;;;;;;;AAQA,SAAgB,gBACd,QACA,YACkB;CAClB,oBAAoB,QAAQ,UAAU;CACtC,MAAM,gBAAgB,eAAe,MAAM;CAE3C,OAAO;EACL,GAAG;EACH,GAAG;EACH,GAAI,WAAW,UAAU,cAAc,SACnC,EAAE,QAAQ;GAAE,GAAG,WAAW;GAAQ,GAAG,eAAe,cAAc,MAAM;EAAE,EAAE,IAC5E,CAAC;EACL,GAAI,WAAW,OAAO,cAAc,MAChC,EAAE,KAAK;GAAE,GAAG,WAAW;GAAK,GAAG,eAAe,cAAc,GAAG;EAAE,EAAE,IACnE,CAAC;EACL,GAAI,WAAW,OAAO,cAAc,MAChC,EAAE,KAAK;GAAE,GAAG,WAAW;GAAK,GAAG,eAAe,cAAc,GAAG;EAAE,EAAE,IACnE,CAAC;CACP;AACF"}