@timber-js/app 0.2.0-alpha.198 → 0.2.0-alpha.199

package/dist/_chunks/error-boundary-BvRCCmbN.js

@@ -1,353 +0,0 @@
-import { n as getSsrData, o as _setUnloading, u as unloading } from "./ssr-data-BQGhTPAK.js";
-import { n as getRouterOrNull } from "./router-ref-8gr8qsxN.js";
-import { Component, createElement } from "react";
-//#region src/client/unload-guard.ts
-/**
-* Page unload detection — suppresses spurious errors during page refresh/navigation.
-*
-* When the user refreshes the page or navigates away while React is still
-* streaming Suspense content, the aborted connection causes streaming errors.
-* These are not application errors — they're a side effect of the browser
-* tearing down the connection. This module tracks whether the page is being
-* unloaded so error boundaries and error handlers can suppress abort-related
-* errors during the unload window.
-*
-* This is the single owner of "is this document going away". Anything that
-* needs the answer imports `isPageUnloading()` — an unload flag maintained a
-* second time somewhere else is a flag that will drift out of agreement with
-* this one (TIM-1260).
-*
-* Mutable state is delegated to client/state.ts for singleton guarantees.
-* See design/18-build-system.md §"Singleton State Registry"
-*
-* See design/10-error-handling.md §"Known limitation: deny() inside Suspense and hydration"
-*/
-/**
-* Departure is *committed*: `pagehide` has fired, or this document has called
-* reload() on itself. `beforeunload` alone doesn't qualify — it is
-* speculative, and the user can still cancel out of it.
-*/
-var committed = false;
-if (typeof window !== "undefined") {
-	window.addEventListener("beforeunload", () => {
-		_setUnloading(true);
-		setTimeout(() => {
-			if (!committed) _setUnloading(false);
-		}, 0);
-	});
-	window.addEventListener("pagehide", () => {
-		committed = true;
-		_setUnloading(true);
-	});
-	window.addEventListener("pageshow", (event) => {
-		if (event.persisted) {
-			committed = false;
-			_setUnloading(false);
-		}
-	});
-}
-/**
-* Returns true if the page is currently being unloaded (user refreshed
-* or navigated away). Error boundaries should suppress errors in this state.
-*/
-function isPageUnloading() {
-	return unloading;
-}
-//#endregion
-//#region src/client/stale-client.ts
-/**
-* Stale Client — knowing when this bundle has been superseded.
-*
-* Layer 1 of version skew handling (see design/33-version-skew.md) is
-* proactive: the server compares `X-Timber-Deployment-Id` against the current
-* build and answers a stale client with `X-Timber-Reload: 1`. That covers
-* every RSC navigation and every server action — as long as there is a server
-* in the request path.
-*
-* This module is the reactive half, plus the state both halves feed. It
-* recognizes the two error shapes a stale client produces on its own:
-*
-* 1. **Stale client references** — React's Flight client throws
-*    "Could not find the module …" when an RSC payload names a client module
-*    ID that isn't in this bundle's manifest.
-* 2. **Chunk load failures** — a content-hashed chunk that no longer exists on
-*    the CDN fails to `import()`. Every engine words this differently.
-*
-* It matters most for `output: 'static'`, where there is no server to send the
-* reload header and this is the *only* skew detection that can run.
-*
-* **Nothing here reloads the page.** A stale client is recorded, not acted on;
-* the router turns the next user-initiated navigation into a full document
-* load. See design/33-version-skew.md §"Recovery on the next navigation" for
-* why — a self-issued `location.reload()` cannot tell a recovery from a bounce
-* between two live deployments, and mid-rollout it produces exactly that loop.
-*
-* See TIM-1260, TIM-1275.
-*/
-/**
-* Substrings that identify a failed dynamic import, lowercased for
-* case-insensitive matching. Engines and bundlers each word this
-* differently and none of them expose a stable error code.
-*/
-var CHUNK_LOAD_PATTERNS = [
-	"failed to fetch dynamically imported module",
-	"error loading dynamically imported module",
-	"importing a module script failed",
-	"unable to preload css for"
-];
-/** Substring React's Flight client uses when a client module ID is unknown. */
-var STALE_REFERENCE_PATTERN = "could not find the module";
-/**
-* Pull a comparable message out of an unknown thrown value. Rejections cross
-* enough boundaries (event handlers, `unhandledrejection`, Vite's preload
-* event) that the value is not reliably an `Error`.
-*/
-function messageOf(error) {
-	if (typeof error === "string") return error.toLowerCase();
-	if (error instanceof Error) return error.message.toLowerCase();
-	if (error && typeof error === "object" && "message" in error) {
-		const message = error.message;
-		if (typeof message === "string") return message.toLowerCase();
-	}
-	return "";
-}
-/**
-* True when the error is React's "client reference not in this manifest"
-* failure — the payload was produced by a build this bundle doesn't match.
-*/
-function isStaleClientReference(error) {
-	return messageOf(error).includes(STALE_REFERENCE_PATTERN);
-}
-/**
-* True when the error is a failed dynamic import or CSS preload — the
-* content-hashed chunk this bundle asks for is gone from the CDN.
-*/
-function isChunkLoadError(error) {
-	if (error instanceof Error && error.name === "ChunkLoadError") return true;
-	const message = messageOf(error);
-	return CHUNK_LOAD_PATTERNS.some((pattern) => message.includes(pattern));
-}
-/**
-* True once this client is known to be running against a superseded
-* deployment. One-way: a document that has gone stale cannot come back, since
-* the only way to get fresh code is to load a new document.
-*
-* In-memory on purpose. Persisting it would be wrong — the next document gets
-* whatever build the server hands it, and if that one is stale too it will
-* find out the same way.
-*/
-var stale = false;
-/**
-* True once {@link initStaleClient} has seen a deployment ID — i.e. this is a
-* production build. False in dev, where nothing is ever stale: HMR owns code
-* updates, and a failed dynamic import is a real error the developer needs to
-* see rather than something a page load fixes.
-*/
-var deployed = false;
-/** Whether this client has been superseded by a newer deployment. */
-function isClientStale() {
-	return stale;
-}
-/**
-* Record that the origin has told us this client is stale — the `X-Timber-Reload`
-* header on an RSC or action response. Authoritative, so it is not gated on
-* anything: a dev server never sends the header in the first place.
-*/
-function markClientStale() {
-	stale = true;
-}
-/**
-* Record staleness if `error` is one of the shapes a superseded bundle
-* produces. Returns whether it did, so a caller mid-navigation can decide to
-* hard-navigate instead of surfacing the error.
-*
-* Inference, unlike {@link markClientStale}, so it is gated on being a
-* production build. This is the single place that gate lives — call sites
-* cannot see each other, and "remember to gate the next one too" is not a
-* guarantee.
-*/
-function markStaleFromError(error) {
-	if (!deployed) return false;
-	if (isPageUnloading()) return false;
-	if (!isStaleClientReference(error) && !isChunkLoadError(error)) return false;
-	stale = true;
-	return true;
-}
-//#endregion
-//#region src/client/error-boundary.tsx
-/**
-* Framework-injected React error boundary.
-*
-* Catches errors thrown by children and renders a fallback component
-* with the appropriate props based on error type:
-*   - DenySignal (4xx) → { status, dangerouslyPassData }
-*   - RenderError (5xx) → { error, digest, reset }
-*   - Unhandled error → { error, digest: null, reset }
-*
-* The `status` prop controls which errors this boundary catches:
-*   - Specific code (e.g. 403) → only that status
-*   - Category (400) → any 4xx
-*   - Category (500) → any 5xx
-*   - Omitted → catches everything (error.tsx behavior)
-*
-* See design/10-error-handling.md §"Status-Code Files"
-*/
-var _handledRedirects = /* @__PURE__ */ new WeakSet();
-var _pendingRedirectLocation = null;
-var TimberErrorBoundary = class extends Component {
-	constructor(props) {
-		super(props);
-		this.state = {
-			hasError: false,
-			error: null
-		};
-	}
-	static getDerivedStateFromError(error) {
-		if (isPageUnloading()) return {
-			hasError: false,
-			error: null
-		};
-		return {
-			hasError: true,
-			error
-		};
-	}
-	componentDidCatch(error) {
-		markStaleFromError(error);
-	}
-	componentDidUpdate(prevProps) {
-		if (this.state.hasError && prevProps.children !== this.props.children) this.setState({
-			hasError: false,
-			error: null
-		});
-	}
-	/** Reset the error state so children re-render. */
-	reset = () => {
-		this.setState({
-			hasError: false,
-			error: null
-		});
-	};
-	render() {
-		if (!this.state.hasError || !this.state.error) return this.props.children;
-		const error = this.state.error;
-		const parsed = parseDigest(error);
-		if (parsed?.type === "redirect") {
-			if (typeof window === "undefined") throw error;
-			if (!(_handledRedirects.has(error) || _pendingRedirectLocation === parsed.location)) {
-				_handledRedirects.add(error);
-				const router = getRouterOrNull();
-				if (router) {
-					_pendingRedirectLocation = parsed.location;
-					queueMicrotask(() => {
-						router.navigate(parsed.location, { replace: true }).catch(() => {
-							window.location.href = parsed.location;
-						}).finally(() => {
-							_pendingRedirectLocation = null;
-						});
-					});
-				} else window.location.href = parsed.location;
-			}
-			return null;
-		}
-		if (parsed?.type === "deny" && typeof parsed.ownerKey === "string" && parsed.ownerKey !== this.props.segmentKey) throw error;
-		if (this.props.status != null) {
-			const errorStatus = getErrorStatus(parsed, error);
-			if (errorStatus == null || !statusMatches(this.props.status, errorStatus)) throw error;
-		}
-		if (parsed?.type === "deny") {
-			if (this.props.fallbackElement == null || this.props.isSlotBoundary) {
-				const ssrData = getSsrData();
-				if (ssrData?._navContext) {
-					ssrData._navContext._denyHandledByBoundary = true;
-					if (!this.props.isSlotBoundary) ssrData._navContext.statusCode = parsed.status;
-				}
-			}
-		}
-		if (this.props.fallbackElement != null) return this.props.fallbackElement;
-		if (parsed?.type === "deny") {
-			if (this.props.status != null) return createElement(this.props.fallbackComponent, {
-				status: parsed.status,
-				dangerouslyPassData: parsed.data
-			});
-			return createElement(this.props.fallbackComponent, {
-				error: denyError(parsed.status, error),
-				digest: null,
-				reset: this.reset,
-				status: parsed.status,
-				dangerouslyPassData: parsed.data
-			});
-		}
-		const digest = parsed?.type === "render-error" ? {
-			code: parsed.code,
-			data: parsed.data
-		} : null;
-		return createElement(this.props.fallbackComponent, {
-			error,
-			digest,
-			reset: this.reset
-		});
-	}
-};
-/**
-* Parse the structured digest from the error.
-* React sets `error.digest` from the string returned by RSC's onError.
-*/
-function parseDigest(error) {
-	const raw = error.digest;
-	if (typeof raw !== "string") return null;
-	try {
-		const parsed = JSON.parse(raw);
-		if (parsed && typeof parsed === "object" && typeof parsed.type === "string") return parsed;
-	} catch (e) {
-		console.debug("[timber] error digest is not valid JSON:", e instanceof Error ? e.message : e);
-	}
-	return null;
-}
-/**
-* The Error an `error.tsx` serving a deny should receive.
-*
-* The error that actually arrives here is React's, not the framework's: a
-* server-thrown error crossing Flight has its message and name replaced with
-* a generic redacted string in production, by design. An `error.tsx` written
-* per the docs branches on `error.message` — so handing it the redacted error
-* gives it nothing to branch on, while the in-tree path hands the same file a
-* `DenySignal` named error reading `Access denied with status <N>` (see
-* `renderDenyEntry`). This reconstructs that shape from the digest, which is
-* where the status already is.
-*
-* Derived from the status alone — no stack, no server data — so it is safe on
-* the client for the same reason the digest is. See design/13-security.md
-* §"Errors don't leak", TIM-1081.
-*/
-function denyError(status, original) {
-	if (original.name === "DenySignal") return original;
-	const error = /* @__PURE__ */ new Error(`Access denied with status ${status}`);
-	error.name = "DenySignal";
-	return error;
-}
-/**
-* Extract the HTTP status code from a parsed digest or error message.
-* Falls back to message pattern matching for errors without a digest.
-*/
-function getErrorStatus(parsed, error) {
-	if (parsed?.type === "deny") return parsed.status;
-	if (parsed?.type === "render-error") return parsed.status;
-	if (parsed?.type === "redirect") return parsed.status;
-	const match = error.message.match(/^Access denied with status (\d+)$/);
-	if (match) return parseInt(match[1], 10);
-	return 500;
-}
-/**
-* Check whether an error's status matches the boundary's status filter.
-* Category markers (400, 500) match any status in that range.
-*/
-function statusMatches(boundaryStatus, errorStatus) {
-	if (boundaryStatus === 400) return errorStatus >= 400 && errorStatus <= 499;
-	if (boundaryStatus === 500) return errorStatus >= 500 && errorStatus <= 599;
-	return boundaryStatus === errorStatus;
-}
-//#endregion
-export { markStaleFromError as i, isClientStale as n, markClientStale as r, TimberErrorBoundary as t };
-
-//# sourceMappingURL=error-boundary-BvRCCmbN.js.map

package/dist/_chunks/error-boundary-BvRCCmbN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"error-boundary-BvRCCmbN.js","names":[],"sources":["../../src/client/unload-guard.ts","../../src/client/stale-client.ts","../../src/client/error-boundary.tsx"],"sourcesContent":["/**\n * Page unload detection — suppresses spurious errors during page refresh/navigation.\n *\n * When the user refreshes the page or navigates away while React is still\n * streaming Suspense content, the aborted connection causes streaming errors.\n * These are not application errors — they're a side effect of the browser\n * tearing down the connection. This module tracks whether the page is being\n * unloaded so error boundaries and error handlers can suppress abort-related\n * errors during the unload window.\n *\n * This is the single owner of \"is this document going away\". Anything that\n * needs the answer imports `isPageUnloading()` — an unload flag maintained a\n * second time somewhere else is a flag that will drift out of agreement with\n * this one (TIM-1260).\n *\n * Mutable state is delegated to client/state.ts for singleton guarantees.\n * See design/18-build-system.md §\"Singleton State Registry\"\n *\n * See design/10-error-handling.md §\"Known limitation: deny() inside Suspense and hydration\"\n */\n\nimport { unloading, _setUnloading } from './state.ts';\n\n/**\n * Departure is *committed*: `pagehide` has fired, or this document has called\n * reload() on itself. `beforeunload` alone doesn't qualify — it is\n * speculative, and the user can still cancel out of it.\n */\nlet committed = false;\n\nif (typeof window !== 'undefined') {\n  window.addEventListener('beforeunload', () => {\n    _setUnloading(true);\n\n    // An app with an unsaved-changes prompt can have this cancelled. Nothing\n    // fires to say so, so the only signal is that the page is still running\n    // afterwards — and timers are blocked while the modal is up, so this task\n    // cannot run until the user has chosen. If they left, `pagehide` has\n    // already committed and this is a no-op.\n    setTimeout(() => {\n      if (!committed) _setUnloading(false);\n    }, 0);\n  });\n\n  // pagehide is the committed-departure event, and fires for both navigations\n  // and bfcache entry. Safari in particular may skip beforeunload entirely.\n  window.addEventListener('pagehide', () => {\n    committed = true;\n    _setUnloading(true);\n  });\n\n  window.addEventListener('pageshow', (event) => {\n    // A bfcache restore un-does the teardown `pagehide` announced: the same\n    // document is alive again, with this module's state intact. Without the\n    // reset, every consumer would go on suppressing errors on a live page.\n    if (event.persisted) {\n      committed = false;\n      _setUnloading(false);\n    }\n  });\n}\n\n/**\n * Returns true if the page is currently being unloaded (user refreshed\n * or navigated away). Error boundaries should suppress errors in this state.\n */\nexport function isPageUnloading(): boolean {\n  return unloading;\n}\n","/**\n * Stale Client — knowing when this bundle has been superseded.\n *\n * Layer 1 of version skew handling (see design/33-version-skew.md) is\n * proactive: the server compares `X-Timber-Deployment-Id` against the current\n * build and answers a stale client with `X-Timber-Reload: 1`. That covers\n * every RSC navigation and every server action — as long as there is a server\n * in the request path.\n *\n * This module is the reactive half, plus the state both halves feed. It\n * recognizes the two error shapes a stale client produces on its own:\n *\n * 1. **Stale client references** — React's Flight client throws\n *    \"Could not find the module …\" when an RSC payload names a client module\n *    ID that isn't in this bundle's manifest.\n * 2. **Chunk load failures** — a content-hashed chunk that no longer exists on\n *    the CDN fails to `import()`. Every engine words this differently.\n *\n * It matters most for `output: 'static'`, where there is no server to send the\n * reload header and this is the *only* skew detection that can run.\n *\n * **Nothing here reloads the page.** A stale client is recorded, not acted on;\n * the router turns the next user-initiated navigation into a full document\n * load. See design/33-version-skew.md §\"Recovery on the next navigation\" for\n * why — a self-issued `location.reload()` cannot tell a recovery from a bounce\n * between two live deployments, and mid-rollout it produces exactly that loop.\n *\n * See TIM-1260, TIM-1275.\n */\n\n// The only import: the shared unload state. Kept minimal because this module\n// is reached from the error boundary, a `'use client'` component evaluated in\n// the SSR graph too — a dependency on the client fetch layer would drag that\n// graph along with it.\nimport { isPageUnloading } from './unload-guard.ts';\n\n// ─── Error Shapes ────────────────────────────────────────────────\n\n/**\n * Substrings that identify a failed dynamic import, lowercased for\n * case-insensitive matching. Engines and bundlers each word this\n * differently and none of them expose a stable error code.\n */\nconst CHUNK_LOAD_PATTERNS = [\n  // Chromium\n  'failed to fetch dynamically imported module',\n  // Firefox\n  'error loading dynamically imported module',\n  // Safari\n  'importing a module script failed',\n  // Vite's preload helper, for the stylesheet of a lazily-imported chunk\n  'unable to preload css for',\n];\n\n/** Substring React's Flight client uses when a client module ID is unknown. */\nconst STALE_REFERENCE_PATTERN = 'could not find the module';\n\n/**\n * Pull a comparable message out of an unknown thrown value. Rejections cross\n * enough boundaries (event handlers, `unhandledrejection`, Vite's preload\n * event) that the value is not reliably an `Error`.\n */\nfunction messageOf(error: unknown): string {\n  if (typeof error === 'string') return error.toLowerCase();\n  if (error instanceof Error) return error.message.toLowerCase();\n  if (error && typeof error === 'object' && 'message' in error) {\n    const message = (error as { message: unknown }).message;\n    if (typeof message === 'string') return message.toLowerCase();\n  }\n  return '';\n}\n\n/**\n * True when the error is React's \"client reference not in this manifest\"\n * failure — the payload was produced by a build this bundle doesn't match.\n */\nexport function isStaleClientReference(error: unknown): boolean {\n  return messageOf(error).includes(STALE_REFERENCE_PATTERN);\n}\n\n/**\n * True when the error is a failed dynamic import or CSS preload — the\n * content-hashed chunk this bundle asks for is gone from the CDN.\n */\nexport function isChunkLoadError(error: unknown): boolean {\n  if (error instanceof Error && error.name === 'ChunkLoadError') return true;\n  const message = messageOf(error);\n  return CHUNK_LOAD_PATTERNS.some((pattern) => message.includes(pattern));\n}\n\n// ─── Staleness ───────────────────────────────────────────────────\n\n/**\n * True once this client is known to be running against a superseded\n * deployment. One-way: a document that has gone stale cannot come back, since\n * the only way to get fresh code is to load a new document.\n *\n * In-memory on purpose. Persisting it would be wrong — the next document gets\n * whatever build the server hands it, and if that one is stale too it will\n * find out the same way.\n */\nlet stale = false;\n\n/**\n * True once {@link initStaleClient} has seen a deployment ID — i.e. this is a\n * production build. False in dev, where nothing is ever stale: HMR owns code\n * updates, and a failed dynamic import is a real error the developer needs to\n * see rather than something a page load fixes.\n */\nlet deployed = false;\n\n/** Whether this client has been superseded by a newer deployment. */\nexport function isClientStale(): boolean {\n  return stale;\n}\n\n/**\n * Record that the origin has told us this client is stale — the `X-Timber-Reload`\n * header on an RSC or action response. Authoritative, so it is not gated on\n * anything: a dev server never sends the header in the first place.\n */\nexport function markClientStale(): void {\n  stale = true;\n}\n\n/**\n * Record staleness if `error` is one of the shapes a superseded bundle\n * produces. Returns whether it did, so a caller mid-navigation can decide to\n * hard-navigate instead of surfacing the error.\n *\n * Inference, unlike {@link markClientStale}, so it is gated on being a\n * production build. This is the single place that gate lives — call sites\n * cannot see each other, and \"remember to gate the next one too\" is not a\n * guarantee.\n */\nexport function markStaleFromError(error: unknown): boolean {\n  if (!deployed) return false;\n\n  // A document being torn down aborts its in-flight dynamic imports, and an\n  // aborted import reads exactly like a chunk the CDN has dropped. That is not\n  // evidence of staleness, and the bit outlives the teardown that produced it:\n  // a document entering the back-forward cache is frozen, not destroyed, so a\n  // false positive recorded on the way out would cost the *restored* page its\n  // client-side navigation for good. `unload-guard.ts` clears its own flag on\n  // a persisted `pageshow`; this one is one-way by design, so it has to not be\n  // set in the first place.\n  if (isPageUnloading()) return false;\n\n  if (!isStaleClientReference(error) && !isChunkLoadError(error)) return false;\n  stale = true;\n  return true;\n}\n\n// ─── Initialization ──────────────────────────────────────────────\n\n/**\n * The underlying error Vite attaches to a `vite:preloadError` event.\n *\n * Narrowed at runtime rather than cast: the property is Vite's, not ours, and\n * a shape change should fall back to matching the event itself rather than\n * silently reading `undefined` forever.\n */\nfunction preloadErrorPayload(event: Event): unknown {\n  return 'payload' in event ? (event as Event & { payload: unknown }).payload : event;\n}\n\n/**\n * Arm the module, and register the listeners that catch stale-client errors\n * never passing through the router: a lazily imported client component, a\n * preloaded stylesheet, anything that rejects outside a navigation.\n *\n * No-op when `deploymentId` is null — that is dev. Called from the browser\n * entry before hydration, so it precedes any render or navigation that could\n * throw.\n */\nexport function initStaleClient(deploymentId: string | null): void {\n  if (!deploymentId) return;\n  deployed = true;\n\n  // Vite dispatches this for failed chunk/CSS preloads. Note what is *not*\n  // here: `preventDefault()`. Recording staleness is not recovering from this\n  // error — the page is still broken until the user navigates — so Vite must\n  // go on rethrowing it rather than have it silently swallowed.\n  window.addEventListener('vite:preloadError', (event) => {\n    markStaleFromError(preloadErrorPayload(event));\n  });\n\n  window.addEventListener('unhandledrejection', (event: PromiseRejectionEvent) => {\n    markStaleFromError(event.reason);\n  });\n}\n","'use client';\n\n/**\n * Framework-injected React error boundary.\n *\n * Catches errors thrown by children and renders a fallback component\n * with the appropriate props based on error type:\n *   - DenySignal (4xx) → { status, dangerouslyPassData }\n *   - RenderError (5xx) → { error, digest, reset }\n *   - Unhandled error → { error, digest: null, reset }\n *\n * The `status` prop controls which errors this boundary catches:\n *   - Specific code (e.g. 403) → only that status\n *   - Category (400) → any 4xx\n *   - Category (500) → any 5xx\n *   - Omitted → catches everything (error.tsx behavior)\n *\n * See design/10-error-handling.md §\"Status-Code Files\"\n */\n\nimport { Component, createElement, type ReactNode } from 'react';\nimport { getSsrData } from './ssr-data.ts';\nimport { getRouterOrNull } from './router-ref.ts';\nimport { markStaleFromError } from './stale-client.ts';\n// Page unload detection: when the page is being torn down, error boundaries\n// suppress activation — the error is from the aborted connection, not the\n// application. unload-guard.ts is the single owner of that state; this module\n// used to keep its own copy, which drifted (TIM-1260).\nimport { isPageUnloading } from './unload-guard.ts';\n\n// ─── Digest Types ────────────────────────────────────────────────────────────\n\n/** Structured digest returned by RSC onError for DenySignal. */\ninterface DenyDigest {\n  type: 'deny';\n  status: number;\n  data: unknown;\n  /**\n   * Segment key of the segment that owns the matched deny page, present when\n   * an in-tree catch site matched a file it may not render at its own\n   * position and re-threw to reach the owner. See TIM-1356.\n   */\n  ownerKey?: string;\n}\n\n/** Structured digest returned by RSC onError for RenderError. */\ninterface RenderErrorDigest {\n  type: 'render-error';\n  code: string;\n  data: unknown;\n  status: number;\n}\n\n/** Structured digest returned by RSC onError for RedirectSignal. */\ninterface RedirectDigest {\n  type: 'redirect';\n  location: string;\n  status: number;\n}\n\ntype ParsedDigest = DenyDigest | RenderErrorDigest | RedirectDigest;\n\n// ─── Props & State ───────────────────────────────────────────────────────────\n\nexport interface TimberErrorBoundaryProps {\n  /** The component to render when an error is caught. */\n  fallbackComponent?: (...args: unknown[]) => ReactNode;\n  /**\n   * Pre-rendered fallback element. Used for MDX status files which are server\n   * components and cannot be passed as function props across the RSC→client\n   * boundary. When set, rendered directly instead of calling fallbackComponent.\n   *\n   * See design/10-error-handling.md §\"Status-Code File Variants\" — MDX status\n   * files are server components by default (zero client JS).\n   */\n  fallbackElement?: ReactNode;\n  /**\n   * Status code filter. If set, only catches errors matching this status.\n   * 400 = any 4xx, 500 = any 5xx, specific number = exact match.\n   */\n  status?: number;\n  /**\n   * When true, this boundary wraps a parallel slot. Slot denials are\n   * graceful degradation — they must NOT change the HTTP status code.\n   */\n  isSlotBoundary?: boolean;\n  /**\n   * Segment key of the segment that declared this boundary. Only meaningful\n   * against a deny digest carrying an `ownerKey`. See the decline rule in\n   * `render()` and TIM-1356.\n   */\n  segmentKey?: string;\n  children: ReactNode;\n}\n\ninterface TimberErrorBoundaryState {\n  hasError: boolean;\n  error: Error | null;\n}\n\n// Module-level guard: the first boundary to catch a given redirect digest\n// schedules the navigation and marks it handled here. Subsequent renders\n// (React retries the error-boundary render path multiple times in dev, and\n// outer boundaries that also see the error) become no-ops, preventing\n// duplicate router.navigate() calls.\nconst _handledRedirects = new WeakSet<object>();\n\n// Companion guard keyed by location: client-render redirect() (the\n// next/navigation shim) throws a FRESH error instance on every render\n// attempt, and React replays the errored render — so the WeakSet alone\n// would schedule the navigation twice. While a navigation to a location\n// is pending, further redirect errors for the same location are no-ops.\nlet _pendingRedirectLocation: string | null = null;\n\n// ─── Component ───────────────────────────────────────────────────────────────\n\nexport class TimberErrorBoundary extends Component<\n  TimberErrorBoundaryProps,\n  TimberErrorBoundaryState\n> {\n  constructor(props: TimberErrorBoundaryProps) {\n    super(props);\n    this.state = { hasError: false, error: null };\n  }\n\n  static getDerivedStateFromError(error: Error): TimberErrorBoundaryState {\n    // Suppress error boundaries during page unload (refresh/navigate away).\n    // The aborted connection causes React's streaming hydration to error,\n    // but the page is about to be replaced — showing an error boundary\n    // would be a jarring flash for the user.\n    if (isPageUnloading()) {\n      return { hasError: false, error: null };\n    }\n\n    return { hasError: true, error };\n  }\n\n  componentDidCatch(error: Error): void {\n    // A stale bundle most often surfaces here rather than as a rejected\n    // navigation: a client reference missing from this build's manifest, or\n    // a lazily-imported chunk the CDN no longer has, thrown during render.\n    //\n    // Recording it is all that happens — this boundary still renders its\n    // fallback, and the recovery is the user's next navigation, which the\n    // router turns into a full document load. Reloading from here would be a\n    // page load the user did not ask for, on a page that may be mid-rollout\n    // and would come back just as stale (TIM-1275).\n    markStaleFromError(error);\n  }\n\n  componentDidUpdate(prevProps: TimberErrorBoundaryProps): void {\n    // Reset error state when children change (e.g. client-side navigation).\n    // Without this, navigating from one error page to another keeps the\n    // stale error — getDerivedStateFromError doesn't re-fire for new children.\n    if (this.state.hasError && prevProps.children !== this.props.children) {\n      this.setState({ hasError: false, error: null });\n    }\n  }\n\n  /** Reset the error state so children re-render. */\n  private reset = () => {\n    this.setState({ hasError: false, error: null });\n  };\n\n  render(): ReactNode {\n    if (!this.state.hasError || !this.state.error) {\n      return this.props.children;\n    }\n\n    const error = this.state.error;\n    const parsed = parseDigest(error);\n\n    // RedirectSignal handling splits by environment:\n    //\n    // - SSR (no window): re-throw so the Fizz shell fails and the server\n    //   pipeline catch block can produce a proper HTTP 3xx response. See\n    //   design/04-authorization.md.\n    //\n    // - Client (window exists): a RedirectSignal that leaked into the RSC\n    //   Flight payload during client navigation would otherwise bubble past\n    //   every error boundary to `window.onerror`, which in dev triggers the\n    //   Vite error overlay (false positive — navigation itself works).\n    //   Instead, ask the router to perform an SPA navigation to the target\n    //   and render nothing while it takes over. The router's own catch path\n    //   handles cross-origin / hard navigations. See TIM-838.\n    if (parsed?.type === 'redirect') {\n      if (typeof window === 'undefined') {\n        throw error;\n      }\n      // Dedupe: React may render the error-boundary fallback path more\n      // than once for a single caught error (dev-mode double render, and\n      // additional boundaries above us in the tree). Only schedule the\n      // navigation on the first render that sees this error instance.\n      const alreadyHandled =\n        _handledRedirects.has(error) || _pendingRedirectLocation === parsed.location;\n      if (!alreadyHandled) {\n        _handledRedirects.add(error);\n        const router = getRouterOrNull();\n        if (router) {\n          _pendingRedirectLocation = parsed.location;\n          // Schedule the navigation outside the render phase to avoid\n          // setState-during-render warnings from router state updates.\n          queueMicrotask(() => {\n            router\n              .navigate(parsed.location, { replace: true })\n              .catch(() => {\n                // Fall back to a hard navigation if the soft navigation fails.\n                window.location.href = parsed.location;\n              })\n              .finally(() => {\n                _pendingRedirectLocation = null;\n              });\n          });\n        } else {\n          // No router available (shouldn't happen post-bootstrap) — fall\n          // back to a hard navigation so the user still ends up at the\n          // target.\n          window.location.href = parsed.location;\n        }\n      }\n      return null;\n    }\n\n    // Owner-addressed denies: an in-tree catch site already resolved the\n    // fallback chain and matched a file it may not render at its own\n    // position, so it re-threw to reach the segment that owns that file.\n    // Every boundary but that one declines — otherwise the nearest boundary\n    // whose status filter happens to match catches first and renders the\n    // deny page at its own depth, wrapped in the layouts the hoist existed\n    // to skip, and from a different file than the chain chose. (Boundary\n    // nesting is per-segment `{status} → category → error`; the 4xx chain\n    // runs status files across ALL segments before any error.tsx, so a\n    // leaf error.tsx would otherwise beat a root 404.tsx.)\n    //\n    // Declining is the default: an unkeyed boundary — a slot boundary, or\n    // one from a construction site that builds no deny chains — never\n    // claims a deny addressed to a segment. See TIM-1356.\n    // `typeof === 'string'`, not a null check: the digest is untrusted JSON —\n    // `parseDigest` validates only `type`, and any component can set\n    // `error.digest` itself. A non-string `ownerKey` is unequal to every\n    // boundary's key, so a truthiness test would let one error decline its\n    // way past the entire tree and blank the page, where it would otherwise\n    // have hit the nearest matching boundary.\n    if (\n      parsed?.type === 'deny' &&\n      typeof parsed.ownerKey === 'string' &&\n      parsed.ownerKey !== this.props.segmentKey\n    ) {\n      throw error;\n    }\n\n    // If this boundary has a status filter, check whether the error matches.\n    // Non-matching errors re-throw so an outer boundary can catch them.\n    if (this.props.status != null) {\n      const errorStatus = getErrorStatus(parsed, error);\n      if (errorStatus == null || !statusMatches(this.props.status, errorStatus)) {\n        // Re-throw: this boundary doesn't handle this error.\n        throw error;\n      }\n    }\n\n    // Report DenySignal handling so the pipeline skips the redundant\n    // renderDenyPage() re-render — but ONLY when this boundary can fully\n    // handle the deny in-tree:\n    //\n    // ✅ TSX boundaries (fallbackComponent) — can receive runtime props\n    //    (status, dangerouslyPassData) dynamically in render()\n    // ❌ MDX boundaries (fallbackElement) — pre-rendered at tree-build time,\n    //    cannot receive runtime deny props. Must fall through to re-render.\n    //\n    // For qualifying segment boundaries: also set the HTTP status code from\n    // the DenySignal so the Response has the correct 4xx status. This runs\n    // synchronously during Fizz rendering, BEFORE onShellReady.\n    //\n    // For slot boundaries: set _denyHandledByBoundary but do NOT change\n    // statusCode — slot denials are graceful degradation.\n    //\n    // See TIM-664, LOCAL-298.\n    if (parsed?.type === 'deny') {\n      const canHandleInTree = this.props.fallbackElement == null;\n\n      if (canHandleInTree || this.props.isSlotBoundary) {\n        const ssrData = getSsrData();\n        if (ssrData?._navContext) {\n          ssrData._navContext._denyHandledByBoundary = true;\n          if (!this.props.isSlotBoundary) {\n            ssrData._navContext.statusCode = parsed.status;\n          }\n        }\n      }\n    }\n\n    // Pre-rendered fallback element (MDX status files) — render directly.\n    // MDX components are server components that cannot be passed as function\n    // props across the RSC→client boundary. Instead, they are pre-rendered\n    // as elements in the RSC environment and passed here as fallbackElement.\n    if (this.props.fallbackElement != null) {\n      return this.props.fallbackElement;\n    }\n\n    // Render the fallback component with the right props shape.\n    if (parsed?.type === 'deny') {\n      // Status-code file boundaries (404.tsx, 4xx.tsx, …) get the documented\n      // 4xx props. error.tsx boundaries (no status filter) get their\n      // documented { error, digest, reset } contract — plus the deny extras\n      // for dual-shape implementations. Without the error prop, an error.tsx\n      // reading error.message crashes on deny fall-through. See TIM-1081.\n      if (this.props.status != null) {\n        return createElement(this.props.fallbackComponent as never, {\n          status: parsed.status,\n          dangerouslyPassData: parsed.data,\n        });\n      }\n      return createElement(this.props.fallbackComponent as never, {\n        error: denyError(parsed.status, error),\n        digest: null,\n        reset: this.reset,\n        status: parsed.status,\n        dangerouslyPassData: parsed.data,\n      });\n    }\n\n    // 5xx / RenderError / unhandled error\n    const digest =\n      parsed?.type === 'render-error' ? { code: parsed.code, data: parsed.data } : null;\n\n    return createElement(this.props.fallbackComponent as never, {\n      error,\n      digest,\n      reset: this.reset,\n    });\n  }\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Parse the structured digest from the error.\n * React sets `error.digest` from the string returned by RSC's onError.\n */\nfunction parseDigest(error: Error): ParsedDigest | null {\n  const raw = (error as { digest?: string }).digest;\n  if (typeof raw !== 'string') return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (parsed && typeof parsed === 'object' && typeof parsed.type === 'string') {\n      return parsed as ParsedDigest;\n    }\n  } catch (e) {\n    console.debug('[timber] error digest is not valid JSON:', e instanceof Error ? e.message : e);\n  }\n  return null;\n}\n\n/**\n * The Error an `error.tsx` serving a deny should receive.\n *\n * The error that actually arrives here is React's, not the framework's: a\n * server-thrown error crossing Flight has its message and name replaced with\n * a generic redacted string in production, by design. An `error.tsx` written\n * per the docs branches on `error.message` — so handing it the redacted error\n * gives it nothing to branch on, while the in-tree path hands the same file a\n * `DenySignal` named error reading `Access denied with status <N>` (see\n * `renderDenyEntry`). This reconstructs that shape from the digest, which is\n * where the status already is.\n *\n * Derived from the status alone — no stack, no server data — so it is safe on\n * the client for the same reason the digest is. See design/13-security.md\n * §\"Errors don't leak\", TIM-1081.\n */\nfunction denyError(status: number, original: Error): Error {\n  // A dev build may have preserved something more useful than the redaction.\n  if (original.name === 'DenySignal') return original;\n  const error = new Error(`Access denied with status ${status}`);\n  error.name = 'DenySignal';\n  return error;\n}\n\n/**\n * Extract the HTTP status code from a parsed digest or error message.\n * Falls back to message pattern matching for errors without a digest.\n */\nfunction getErrorStatus(parsed: ParsedDigest | null, error: Error): number | null {\n  if (parsed?.type === 'deny') return parsed.status;\n  if (parsed?.type === 'render-error') return parsed.status;\n  if (parsed?.type === 'redirect') return parsed.status;\n\n  // Fallback: parse DenySignal message pattern for errors that lost their digest\n  const match = error.message.match(/^Access denied with status (\\d+)$/);\n  if (match) return parseInt(match[1], 10);\n\n  // Unhandled errors are implicitly 500\n  return 500;\n}\n\n/**\n * Check whether an error's status matches the boundary's status filter.\n * Category markers (400, 500) match any status in that range.\n */\nfunction statusMatches(boundaryStatus: number, errorStatus: number): boolean {\n  // Category catch-all: 400 matches any 4xx, 500 matches any 5xx\n  if (boundaryStatus === 400) return errorStatus >= 400 && errorStatus <= 499;\n  if (boundaryStatus === 500) return errorStatus >= 500 && errorStatus <= 599;\n  // Exact match\n  return boundaryStatus === errorStatus;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAI,YAAY;AAEhB,IAAI,OAAO,WAAW,aAAa;CACjC,OAAO,iBAAiB,sBAAsB;EAC5C,cAAc,IAAI;EAOlB,iBAAiB;GACf,IAAI,CAAC,WAAW,cAAc,KAAK;EACrC,GAAG,CAAC;CACN,CAAC;CAID,OAAO,iBAAiB,kBAAkB;EACxC,YAAY;EACZ,cAAc,IAAI;CACpB,CAAC;CAED,OAAO,iBAAiB,aAAa,UAAU;EAI7C,IAAI,MAAM,WAAW;GACnB,YAAY;GACZ,cAAc,KAAK;EACrB;CACF,CAAC;AACH;;;;;AAMA,SAAgB,kBAA2B;CACzC,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzBA,IAAM,sBAAsB;CAE1B;CAEA;CAEA;CAEA;AACF;;AAGA,IAAM,0BAA0B;;;;;;AAOhC,SAAS,UAAU,OAAwB;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,YAAY;CACxD,IAAI,iBAAiB,OAAO,OAAO,MAAM,QAAQ,YAAY;CAC7D,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,OAAO;EAC5D,MAAM,UAAW,MAA+B;EAChD,IAAI,OAAO,YAAY,UAAU,OAAO,QAAQ,YAAY;CAC9D;CACA,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,OAAyB;CAC9D,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,uBAAuB;AAC1D;;;;;AAMA,SAAgB,iBAAiB,OAAyB;CACxD,IAAI,iBAAiB,SAAS,MAAM,SAAS,kBAAkB,OAAO;CACtE,MAAM,UAAU,UAAU,KAAK;CAC/B,OAAO,oBAAoB,MAAM,YAAY,QAAQ,SAAS,OAAO,CAAC;AACxE;;;;;;;;;;AAaA,IAAI,QAAQ;;;;;;;AAQZ,IAAI,WAAW;;AAGf,SAAgB,gBAAyB;CACvC,OAAO;AACT;;;;;;AAOA,SAAgB,kBAAwB;CACtC,QAAQ;AACV;;;;;;;;;;;AAYA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,CAAC,UAAU,OAAO;CAUtB,IAAI,gBAAgB,GAAG,OAAO;CAE9B,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC,iBAAiB,KAAK,GAAG,OAAO;CACvE,QAAQ;CACR,OAAO;AACT;;;;;;;;;;;;;;;;;;;;AC9CA,IAAM,oCAAoB,IAAI,QAAgB;AAO9C,IAAI,2BAA0C;AAI9C,IAAa,sBAAb,cAAyC,UAGvC;CACA,YAAY,OAAiC;EAC3C,MAAM,KAAK;EACX,KAAK,QAAQ;GAAE,UAAU;GAAO,OAAO;EAAK;CAC9C;CAEA,OAAO,yBAAyB,OAAwC;EAKtE,IAAI,gBAAgB,GAClB,OAAO;GAAE,UAAU;GAAO,OAAO;EAAK;EAGxC,OAAO;GAAE,UAAU;GAAM;EAAM;CACjC;CAEA,kBAAkB,OAAoB;EAUpC,mBAAmB,KAAK;CAC1B;CAEA,mBAAmB,WAA2C;EAI5D,IAAI,KAAK,MAAM,YAAY,UAAU,aAAa,KAAK,MAAM,UAC3D,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAElD;;CAGA,cAAsB;EACpB,KAAK,SAAS;GAAE,UAAU;GAAO,OAAO;EAAK,CAAC;CAChD;CAEA,SAAoB;EAClB,IAAI,CAAC,KAAK,MAAM,YAAY,CAAC,KAAK,MAAM,OACtC,OAAO,KAAK,MAAM;EAGpB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,SAAS,YAAY,KAAK;EAehC,IAAI,QAAQ,SAAS,YAAY;GAC/B,IAAI,OAAO,WAAW,aACpB,MAAM;GAQR,IAAI,EADF,kBAAkB,IAAI,KAAK,KAAK,6BAA6B,OAAO,WACjD;IACnB,kBAAkB,IAAI,KAAK;IAC3B,MAAM,SAAS,gBAAgB;IAC/B,IAAI,QAAQ;KACV,2BAA2B,OAAO;KAGlC,qBAAqB;MACnB,OACG,SAAS,OAAO,UAAU,EAAE,SAAS,KAAK,CAAC,CAAC,CAC5C,YAAY;OAEX,OAAO,SAAS,OAAO,OAAO;MAChC,CAAC,CAAC,CACD,cAAc;OACb,2BAA2B;MAC7B,CAAC;KACL,CAAC;IACH,OAIE,OAAO,SAAS,OAAO,OAAO;GAElC;GACA,OAAO;EACT;EAsBA,IACE,QAAQ,SAAS,UACjB,OAAO,OAAO,aAAa,YAC3B,OAAO,aAAa,KAAK,MAAM,YAE/B,MAAM;EAKR,IAAI,KAAK,MAAM,UAAU,MAAM;GAC7B,MAAM,cAAc,eAAe,QAAQ,KAAK;GAChD,IAAI,eAAe,QAAQ,CAAC,cAAc,KAAK,MAAM,QAAQ,WAAW,GAEtE,MAAM;EAEV;EAmBA,IAAI,QAAQ,SAAS,QACK;OAAA,KAAK,MAAM,mBAAmB,QAE/B,KAAK,MAAM,gBAAgB;IAChD,MAAM,UAAU,WAAW;IAC3B,IAAI,SAAS,aAAa;KACxB,QAAQ,YAAY,yBAAyB;KAC7C,IAAI,CAAC,KAAK,MAAM,gBACd,QAAQ,YAAY,aAAa,OAAO;IAE5C;GACF;;EAOF,IAAI,KAAK,MAAM,mBAAmB,MAChC,OAAO,KAAK,MAAM;EAIpB,IAAI,QAAQ,SAAS,QAAQ;GAM3B,IAAI,KAAK,MAAM,UAAU,MACvB,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;GAEH,OAAO,cAAc,KAAK,MAAM,mBAA4B;IAC1D,OAAO,UAAU,OAAO,QAAQ,KAAK;IACrC,QAAQ;IACR,OAAO,KAAK;IACZ,QAAQ,OAAO;IACf,qBAAqB,OAAO;GAC9B,CAAC;EACH;EAGA,MAAM,SACJ,QAAQ,SAAS,iBAAiB;GAAE,MAAM,OAAO;GAAM,MAAM,OAAO;EAAK,IAAI;EAE/E,OAAO,cAAc,KAAK,MAAM,mBAA4B;GAC1D;GACA;GACA,OAAO,KAAK;EACd,CAAC;CACH;AACF;;;;;AAQA,SAAS,YAAY,OAAmC;CACtD,MAAM,MAAO,MAA8B;CAC3C,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,UACjE,OAAO;CAEX,SAAS,GAAG;EACV,QAAQ,MAAM,4CAA4C,aAAa,QAAQ,EAAE,UAAU,CAAC;CAC9F;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAS,UAAU,QAAgB,UAAwB;CAEzD,IAAI,SAAS,SAAS,cAAc,OAAO;CAC3C,MAAM,wBAAQ,IAAI,MAAM,6BAA6B,QAAQ;CAC7D,MAAM,OAAO;CACb,OAAO;AACT;;;;;AAMA,SAAS,eAAe,QAA6B,OAA6B;CAChF,IAAI,QAAQ,SAAS,QAAQ,OAAO,OAAO;CAC3C,IAAI,QAAQ,SAAS,gBAAgB,OAAO,OAAO;CACnD,IAAI,QAAQ,SAAS,YAAY,OAAO,OAAO;CAG/C,MAAM,QAAQ,MAAM,QAAQ,MAAM,mCAAmC;CACrE,IAAI,OAAO,OAAO,SAAS,MAAM,IAAI,EAAE;CAGvC,OAAO;AACT;;;;;AAMA,SAAS,cAAc,gBAAwB,aAA8B;CAE3E,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CACxE,IAAI,mBAAmB,KAAK,OAAO,eAAe,OAAO,eAAe;CAExE,OAAO,mBAAmB;AAC5B"}