@timber-js/app 0.2.0-alpha.2 → 0.2.0-alpha.200

package/dist/_chunks/convention-lint-fRkwVwEH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convention-lint-fRkwVwEH.js","names":[],"sources":["../../src/server/utils/mdx-file.ts","../../src/routing/segment-codegen.ts","../../src/routing/codegen-write.ts","../../src/routing/export-detect.ts","../../src/routing/convention-lint.ts"],"sourcesContent":["/**\n * MDX file-path detection shared by error/deny rendering paths.\n *\n * MDX status and error files are server components — they cannot be passed\n * as function props across the RSC→client boundary (e.g. to\n * TimberErrorBoundary or ErrorReconstituter) and must be pre-rendered as\n * elements with plain props instead.\n *\n * See design/10-error-handling.md §\"Status-Code File Variants\".\n */\n\n/** MDX/markdown extensions (dotted) — the canonical list, also used by plugins/mdx.ts. */\nexport const MDX_EXTENSIONS = new Set(['.mdx', '.md']);\n\n/**\n * Check if a file path ends with an MDX/markdown extension.\n */\nexport function isMdxFilePath(filePath: string): boolean {\n  const dotIndex = filePath.lastIndexOf('.');\n  if (dotIndex === -1) return false;\n  return MDX_EXTENSIONS.has(filePath.slice(dotIndex));\n}\n","/**\n * $segment type generation and directory-to-route mapping.\n *\n * Generates per-route $segment.d.ts files in .timber/types/ that mirror\n * the app/ directory structure. TypeScript's rootDirs feature makes these\n * importable as './$segment' from route files.\n *\n * Design doc: design/41-global-params.md §The $segment Module\n */\n\nimport { writeFile, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { RouteTree, SegmentNode } from './types.ts';\n\n/** Info carried per directory for type generation. */\nexport interface SegmentInfo {\n  /** The URL route pattern (groups and slots stripped). e.g. '/[artistSlug]/[year]' */\n  route: string;\n  /** The full tree path including groups and slots — uniquely identifies a segment.\n   *  e.g. '/(browse)/[artistSlug]/@shows/[year]' */\n  segmentPath: string;\n}\n\n/**\n * Build a map of absolute filesystem directory → segment info.\n * Used by resolveId to map a $segment import's importer to the correct route,\n * and by writeSegmentTypes to generate per-route $segment.d.ts files.\n *\n * Walks every segment (not just leaves) so layouts and middleware\n * at any depth can import $segment.\n */\nexport function buildDirToRouteMap(tree: RouteTree, appDir: string): Map<string, SegmentInfo> {\n  const map = new Map<string, SegmentInfo>();\n\n  function walk(node: SegmentNode, fsPath: string, treePath: string): void {\n    map.set(fsPath, {\n      route: node.urlPath || '/',\n      segmentPath: treePath || '/',\n    });\n\n    for (const child of node.children) {\n      const childDir = join(fsPath, child.segmentName);\n      const childTreePath = `${treePath}/${child.segmentName}`;\n      walk(child, childDir, childTreePath);\n    }\n    for (const [slotName, slotNode] of Object.entries(node.slots)) {\n      const slotDir = join(fsPath, `@${slotName}`);\n      const slotTreePath = `${treePath}/@${slotName}`;\n      walk(slotNode, slotDir, slotTreePath);\n    }\n  }\n\n  walk(tree.root, appDir, '');\n  return map;\n}\n\n/**\n * Generate the full $segment.d.ts content for a segment.\n */\nexport function generateSegmentDts(info: SegmentInfo): string {\n  return [\n    `export const ROUTE: '${info.route}';`,\n    `export const SEGMENT_PATH: '${info.segmentPath}';`,\n    '',\n  ].join('\\n');\n}\n\n/**\n * Generate per-route $segment.d.ts files in .timber/types/ mirroring\n * the app/ directory structure. These files are importable via TypeScript's\n * rootDirs feature.\n */\nexport async function writeSegmentTypes(\n  routeTree: RouteTree,\n  appDir: string,\n  root: string\n): Promise<void> {\n  // Compute the relative prefix from project root to appDir.\n  // e.g. if appDir is /project/src/app, relative is 'src/app'\n  const relative = appDir.slice(root.length + 1);\n  const typesBase = join(root, '.timber', 'types', relative);\n  const map = buildDirToRouteMap(routeTree, appDir);\n\n  const writes: Promise<void>[] = [];\n  for (const [fsDir, info] of map) {\n    // Mirror the app/ structure under .timber/types/\n    const relDir = fsDir.slice(appDir.length); // e.g. '/[artistSlug]/[year]'\n    const segmentDir = join(typesBase, relDir);\n    const segmentFile = join(segmentDir, '$segment.d.ts');\n    const content = generateSegmentDts(info);\n\n    writes.push(\n      mkdir(segmentDir, { recursive: true }).then(() => writeFile(segmentFile, content, 'utf-8'))\n    );\n  }\n\n  await Promise.all(writes);\n}\n","/**\n * Route-map codegen writer.\n *\n * Materializes the generated route types on disk: `.timber/timber-routes.d.ts`,\n * `.timber/segment-types.d.ts` (via `writeSegmentTypes`), and the root\n * `timber-env.d.ts` that references them.\n *\n * Lives outside `plugins/routing.ts` because it has two callers with two\n * different failure policies: the dev/build plugin starts the write off the hot\n * path and logs failures, while `timber check` awaits it and treats a failure as\n * fatal — a type check run against absent or stale route types reports errors\n * about code that is fine. One implementation, two policies, so the bytes on\n * disk cannot drift between the two commands.\n *\n * Design docs: 09-typescript.md §\"Typed Routes\", 18-build-system.md\n */\n\nimport { writeFile, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { generateRouteMap } from './codegen.ts';\nimport { writeSegmentTypes } from './segment-codegen.ts';\nimport type { RouteTree } from './types.ts';\n\n/**\n * Path (relative to the project root) of the generated route map declaration\n * file, and the name of the root file that `/// <reference>`s it.\n *\n * Exported because `timber check` has to answer whether the user's tsconfig\n * pulls these into the program — a question about these exact paths. It derives\n * them from here rather than restating them, so a rename cannot leave the check\n * looking for a file nothing writes.\n */\nexport const CODEGEN_OUTPUT = '.timber/timber-routes.d.ts';\n\n/** Root-level file that references the generated declarations. */\nexport const ENV_DTS_FILENAME = 'timber-env.d.ts';\n\n/**\n * Content of the timber-env.d.ts file written to the project root.\n *\n * Uses a triple-slash reference so TypeScript auto-discovers the generated\n * route map without the user needing to edit tsconfig.json — same pattern\n * as Next.js's next-env.d.ts.\n *\n * Also references `vite/client` so side-effect imports like\n * `import './globals.css'` type-check without ts(2882), and so\n * `import.meta.env`, `import.meta.hot`, `import.meta.glob`, asset\n * imports (`*.png`, `*.svg`, …), CSS modules, and `?url`/`?raw`/\n * `?inline` query variants all resolve without the user editing\n * tsconfig.json themselves. Next.js's next-env.d.ts plays the same\n * role via `next/types/global`.\n *\n * `vite` is a peer dep of `@timber-js/app`, so the reference always\n * resolves in a correctly-installed project.\n */\nconst TIMBER_ENV_DTS = [\n  '// This file is auto-generated by timber.js. Do not edit.',\n  '// It ensures TypeScript picks up the generated route types and',\n  '// Vite-provided ambient types (CSS, assets, import.meta.env, HMR).',\n  '/* eslint-disable @typescript-eslint/triple-slash-reference */',\n  '/// <reference path=\".timber/timber-routes.d.ts\" />',\n  '/// <reference types=\"vite/client\" />',\n  '/// <reference types=\"react/canary\" />',\n  '/// <reference types=\"react-dom/canary\" />',\n  '',\n].join('\\n');\n\n/**\n * Codegen writes that have been started but have not yet landed on disk.\n *\n * `writeRouteCodegen` is deliberately unawaited on the dev/build hot path,\n * which leaves that caller no way to know the files exist yet. Anything that\n * tears down the project root — a build process exiting, a test removing its\n * temp root — then races the writes: `rmSync` empties a directory that a\n * pending `mkdir` immediately recreates, and the removal fails with ENOTEMPTY.\n *\n * Every started write registers here and deregisters when it settles, so\n * `flushCodegenWrites()` can await them instead of guessing at a delay.\n */\nconst pendingCodegenWrites = new Set<Promise<void>>();\n\n/**\n * Resolve once every codegen write started so far has landed on disk.\n *\n * Safe to call at any time and from anywhere — writes are tracked per process,\n * not per plugin instance, so a caller does not need a handle on the plugin\n * that started them. Never rejects: the tracked copy of each write has its\n * rejection swallowed, so a failing write cannot turn a teardown barrier into\n * an unhandled rejection. Callers that care about failure await the promise\n * `writeRouteCodegen` returned instead.\n */\nexport async function flushCodegenWrites(): Promise<void> {\n  // Loop rather than a single Promise.all: a write started while we were\n  // awaiting would otherwise be missed, and the set would still be non-empty\n  // on return.\n  //\n  // Each round drops what it awaited rather than trusting the per-write\n  // `finally` to have run, so the two removal paths are independent — a\n  // deregistration that stopped firing would leak memory in dev, but it can\n  // never turn this into a spin.\n  while (pendingCodegenWrites.size > 0) {\n    const inFlight = [...pendingCodegenWrites];\n    await Promise.all(inFlight);\n    for (const write of inFlight) pendingCodegenWrites.delete(write);\n  }\n}\n\n/**\n * Write the generated route map, segment types, and the timber-env.d.ts\n * reference file for `tree`.\n *\n * Returns a promise that **rejects** if any write fails. The dev/build plugin\n * does not await it (types are a developer convenience there, not a runtime\n * dependency) and logs instead; `timber check` awaits it and fails the command.\n * Either way the write is registered with `flushCodegenWrites()`.\n */\nexport function writeRouteCodegen(tree: RouteTree, appDir: string, root: string): Promise<void> {\n  const timberDir = join(root, '.timber');\n  const content = generateRouteMap(tree, { appDir, outputDir: timberDir });\n  const routesPath = join(root, CODEGEN_OUTPUT);\n  const envPath = join(root, ENV_DTS_FILENAME);\n\n  const done = mkdir(timberDir, { recursive: true })\n    .then(() =>\n      Promise.all([\n        writeFile(routesPath, content, 'utf-8'),\n        writeFile(envPath, TIMBER_ENV_DTS, 'utf-8'),\n        writeSegmentTypes(tree, appDir, root),\n      ])\n    )\n    .then(() => undefined);\n\n  // The tracked copy swallows rejection so `flushCodegenWrites` — a teardown\n  // barrier — never rejects and never leaves an unhandled rejection behind.\n  // The returned promise keeps its rejection for callers that want it.\n  const tracked = done.catch(() => undefined);\n  pendingCodegenWrites.add(tracked);\n  void tracked.finally(() => pendingCodegenWrites.delete(tracked));\n\n  return done;\n}\n","/**\n * AST-based export detection for route files.\n *\n * Uses Vite's `parseAst` (backed by oxc) to precisely detect named and\n * default exports, replacing the regex-based approach that was fragile\n * with TypeScript syntax (type exports, `as` aliases, comments, etc.).\n */\n\nimport { existsSync } from 'node:fs';\nimport { parseAst } from 'vite';\nimport { readFileCached } from './file-cache.ts';\n\ninterface AstNode {\n  type: string;\n  exportKind?: string;\n  declaration?: AstNode;\n  specifiers?: Array<{\n    exported?: { name: string };\n    local?: { name: string };\n    exportKind?: string;\n  }>;\n  id?: { name: string };\n  declarations?: Array<{ id?: { name: string }; init?: AstNode }>;\n  /** Set on re-exports: `export { X } from './y'`. Absent on local exports. */\n  source?: { value?: string } | null;\n  /** Set on runtime-transparent wrappers: `X as T`, `X satisfies T`, `(X)`, `X!`. */\n  expression?: AstNode;\n  /** Set on `Identifier` nodes. */\n  name?: string;\n}\n\ninterface ProgramNode {\n  body: AstNode[];\n}\n\nfunction tryParse(source: string): ProgramNode | null {\n  try {\n    return parseAst(source, { lang: 'tsx' }) as unknown as ProgramNode;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Collect all named export identifiers from a parsed program.\n * Handles: `export function X`, `export const X`, `export { X }`,\n * `export { X } from '...'`, `export { Y as X }`.\n */\nfunction collectNamedExports(program: ProgramNode): Set<string> {\n  const names = new Set<string>();\n  for (const stmt of program.body) {\n    if (stmt.type !== 'ExportNamedDeclaration') continue;\n    // Skip `export type ...` declarations — they're erased at runtime\n    if (stmt.exportKind === 'type') continue;\n\n    if (stmt.declaration) {\n      if (stmt.declaration.id?.name) {\n        names.add(stmt.declaration.id.name);\n      }\n      if (stmt.declaration.declarations) {\n        for (const decl of stmt.declaration.declarations) {\n          if (decl.id?.name) names.add(decl.id.name);\n        }\n      }\n    }\n\n    if (stmt.specifiers) {\n      for (const spec of stmt.specifiers) {\n        // Skip `export { type X }` — per-specifier type exports\n        if (spec.exportKind === 'type') continue;\n        if (spec.exported?.name && spec.exported.name !== 'default') {\n          names.add(spec.exported.name);\n        }\n      }\n    }\n  }\n  return names;\n}\n\n/**\n * The specifier exporting a *runtime* default from this statement, if any.\n *\n * Type-only exports erase, so they are not default exports at runtime — and\n * TypeScript spells that two ways, on two different nodes: `export type { X as\n * default }` marks the **statement**, `export { type X as default }` marks the\n * **specifier**. Both have to be checked, or a type alias reads as a component:\n * a status file whose only default is a type has nothing for the error boundary\n * to receive (the renderer's `mod?.default` skips it), so treating it as one\n * would fail a build over a file that cannot break anything.\n *\n * One implementation because two callers must agree on what \"has a default\n * export\" means: `hasDefaultExport` decides whether to warn that a page has\n * none, and `fileDefaultExportIsLocalValue` decides whether to fail the build.\n */\nfunction defaultSpecifier(stmt: AstNode): NonNullable<AstNode['specifiers']>[number] | null {\n  if (stmt.type !== 'ExportNamedDeclaration' || !stmt.specifiers) return null;\n  if (stmt.exportKind === 'type') return null;\n  for (const spec of stmt.specifiers) {\n    if (spec.exportKind === 'type') continue;\n    if (spec.exported?.name === 'default') return spec;\n  }\n  return null;\n}\n\n/**\n * Check whether a program has a default export.\n * Handles: `export default ...`, `export { X as default }`,\n * `export { default } from '...'`. Type-only defaults do not count —\n * see `defaultSpecifier`.\n */\nfunction hasDefaultExport(program: ProgramNode): boolean {\n  for (const stmt of program.body) {\n    if (stmt.type === 'ExportDefaultDeclaration') return true;\n    if (defaultSpecifier(stmt)) return true;\n  }\n  return false;\n}\n\n/**\n * Check whether a program has any bare `export * from '...'` declarations.\n * Excludes `export * as X from '...'` (namespace re-exports) since those\n * create a namespace object, not individual top-level exports.\n */\nfunction hasStarExport(program: ProgramNode): boolean {\n  return program.body.some(\n    (stmt) =>\n      stmt.type === 'ExportAllDeclaration' && !(stmt as any).exported && stmt.exportKind !== 'type'\n  );\n}\n\n/**\n * Check if a file exports a specific named export.\n * Returns false if the file doesn't exist or can't be parsed.\n */\nexport function fileHasExport(filePath: string, exportName: string): boolean {\n  if (!existsSync(filePath)) return false;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return false;\n    return collectNamedExports(program).has(exportName);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if a file has any of the given named exports.\n * Returns the set of matching export names.\n */\nexport function fileHasAnyExport(filePath: string, exportNames: readonly string[]): Set<string> {\n  const matches = new Set<string>();\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return matches;\n    const exports = collectNamedExports(program);\n    for (const name of exportNames) {\n      if (exports.has(name)) matches.add(name);\n    }\n  } catch {\n    // Graceful fallback: return empty set\n  }\n  return matches;\n}\n\n/**\n * Check if a file has a default export.\n * Returns false if the file doesn't exist or can't be parsed.\n */\nexport function fileHasDefaultExport(filePath: string): boolean {\n  if (!existsSync(filePath)) return false;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return false;\n    return hasDefaultExport(program);\n  } catch {\n    return false;\n  }\n}\n\n/** Node types whose value is unambiguously constructed by this module. */\nconst FUNCTION_LIKE = new Set([\n  'FunctionDeclaration',\n  'FunctionExpression',\n  'ArrowFunctionExpression',\n  'ClassDeclaration',\n  'ClassExpression',\n]);\n\n/**\n * Expression wrappers that erase at runtime and so cannot change where a value\n * was constructed: `X as T`, `X satisfies T`, `<T>X`, `X!`, `X<T>`, `(X)`.\n */\nconst TRANSPARENT_WRAPPERS = new Set([\n  'TSAsExpression',\n  'TSSatisfiesExpression',\n  'TSTypeAssertion',\n  'TSNonNullExpression',\n  'TSInstantiationExpression',\n  'ParenthesizedExpression',\n]);\n\n/**\n * Strip runtime-transparent wrappers so the node underneath can be classified.\n *\n * Without this, `(() => <h1 />) satisfies React.FC` reads as a\n * `TSSatisfiesExpression` rather than the arrow function it compiles to, and a\n * provably-local component is misread as one whose origin cannot be\n * determined — turning a build error into a warning.\n */\nfunction unwrapTransparent(node: AstNode): AstNode {\n  let current = node;\n  while (TRANSPARENT_WRAPPERS.has(current.type) && current.expression) {\n    current = current.expression;\n  }\n  return current;\n}\n\n/**\n * Whether `name` is bound at module top level to a function or class written\n * in this file. An imported binding can never match: imports are\n * `ImportDeclaration` specifiers, not function/class/variable declarations,\n * and a module-level name cannot be both.\n */\nfunction bindsLocalFunction(program: ProgramNode, name: string): boolean {\n  for (const stmt of program.body) {\n    // `export function X() {}` binds X locally too — unwrap the export.\n    const decl = stmt.type === 'ExportNamedDeclaration' ? stmt.declaration : stmt;\n    if (!decl) continue;\n    if (\n      (decl.type === 'FunctionDeclaration' || decl.type === 'ClassDeclaration') &&\n      decl.id?.name === name\n    ) {\n      return true;\n    }\n    if (decl.type === 'VariableDeclaration') {\n      for (const d of decl.declarations ?? []) {\n        if (d.id?.name === name && d.init && FUNCTION_LIKE.has(unwrapTransparent(d.init).type)) {\n          return true;\n        }\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * Whether the default export is *provably* a value constructed by this module:\n * `export default function/class/() => {}`, or a name bound to a function or\n * class declared here — whether it leaves via `export default Name` or\n * `export { Name as default }`. Both spellings are the same fact about where\n * the value was built, so both must answer the same way.\n *\n * This is the sound half of \"is this a server component?\". A file with no\n * `'use client'` directive whose default export is built here is a server\n * component, full stop. Everything else — `export { default } from\n * './client-thing'`, `export default Imported`, `export default memo(X)`,\n * an unparseable file — returns false, because the exported value may have\n * been minted in a module that *does* carry the directive. Callers must not\n * infer \"server component\" from a missing directive alone.\n */\nexport function fileDefaultExportIsLocalValue(filePath: string): boolean {\n  if (!existsSync(filePath)) return false;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return false;\n    for (const stmt of program.body) {\n      if (stmt.type === 'ExportDefaultDeclaration') {\n        const decl = stmt.declaration && unwrapTransparent(stmt.declaration);\n        if (!decl) return false;\n        if (FUNCTION_LIKE.has(decl.type)) return true;\n        if (decl.type === 'Identifier' && decl.name) {\n          return bindsLocalFunction(program, decl.name);\n        }\n        return false;\n      }\n\n      // `export { Name as default }` — the same default export by another\n      // spelling. `hasDefaultExport` already counts it, so an analysis that\n      // skipped it here would let the exact defect this powers slip through\n      // as a warning.\n      const spec = defaultSpecifier(stmt);\n      if (spec) {\n        // `export { X as default } from './client-thing'` re-exports another\n        // module's value — the directive governing it lives over there.\n        if (stmt.source) return false;\n        return spec.local?.name ? bindsLocalFunction(program, spec.local.name) : false;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if a file has any `export * from '...'` declarations.\n * Returns false if the file doesn't exist or can't be parsed.\n */\nexport function fileHasStarExport(filePath: string): boolean {\n  if (!existsSync(filePath)) return false;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return false;\n    return hasStarExport(program);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Parsed value of `export const prerender` from a route file.\n *\n * - `true` / `false` — literal boolean\n * - `{ ttl?, tags? }` — ISR options object (prerender: true is implied)\n * - `undefined` — no `export const prerender` found\n *\n * See design/45-cache-lifetimes.md §\"Route-Level Static\".\n */\nexport type PrerenderExportValue = boolean | { ttl?: number; tags?: string[] };\n\nfunction extractLiteralValue(node: AstNode): unknown {\n  if (!node) return undefined;\n  const n = node as any;\n  if (n.type === 'Literal') return n.value;\n  if (n.type === 'UnaryExpression' && n.operator === '-' && n.argument?.type === 'Literal') {\n    return -(n.argument.value as number);\n  }\n  if (n.type === 'ArrayExpression') {\n    const elements = n.elements as AstNode[] | undefined;\n    if (!elements) return undefined;\n    const result: unknown[] = [];\n    for (const el of elements) {\n      const v = extractLiteralValue(el);\n      if (v === undefined) return undefined;\n      result.push(v);\n    }\n    return result;\n  }\n  return undefined;\n}\n\nfunction extractObjectLiteral(node: AstNode): Record<string, unknown> | undefined {\n  if ((node as any).type !== 'ObjectExpression') return undefined;\n  const props = (node as any).properties as AstNode[] | undefined;\n  if (!props) return undefined;\n  const result: Record<string, unknown> = {};\n  for (const prop of props) {\n    const p = prop as any;\n    if (p.type === 'SpreadElement') return undefined;\n    if (p.type !== 'Property' || p.computed) return undefined;\n    const key =\n      p.key?.type === 'Identifier'\n        ? p.key.name\n        : p.key?.type === 'Literal'\n          ? String(p.key.value)\n          : undefined;\n    if (!key) return undefined;\n    const value = extractLiteralValue(p.value);\n    if (value === undefined) return undefined;\n    result[key] = value;\n  }\n  return result;\n}\n\n/**\n * Extract the value of `export const prerender` from a file.\n * Returns undefined if the file doesn't export `prerender` or can't be parsed.\n *\n * Supports:\n *   export const prerender = true;\n *   export const prerender = false;\n *   export const prerender = { ttl: 3600, tags: ['docs'] };\n */\nexport function getPrerenderExport(filePath: string): PrerenderExportValue | undefined {\n  if (!existsSync(filePath)) return undefined;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return undefined;\n\n    for (const stmt of program.body) {\n      if (stmt.type !== 'ExportNamedDeclaration') continue;\n      if (stmt.exportKind === 'type') continue;\n      if (!stmt.declaration) continue;\n      const decl = stmt.declaration;\n      if (decl.type !== 'VariableDeclaration') continue;\n      const declarations = decl.declarations as\n        | Array<{\n            id?: { name?: string };\n            init?: AstNode;\n          }>\n        | undefined;\n      if (!declarations) continue;\n      for (const d of declarations) {\n        if (d.id?.name !== 'prerender' || !d.init) continue;\n        const init = d.init as any;\n        if (init.type === 'Literal' && typeof init.value === 'boolean') {\n          return init.value;\n        }\n        if (init.type === 'ObjectExpression') {\n          const obj = extractObjectLiteral(init);\n          if (!obj) return undefined;\n          const result: { ttl?: number; tags?: string[] } = {};\n          if ('ttl' in obj && typeof obj.ttl === 'number') result.ttl = obj.ttl;\n          if (\n            'tags' in obj &&\n            Array.isArray(obj.tags) &&\n            obj.tags.every((t: unknown) => typeof t === 'string')\n          ) {\n            result.tags = obj.tags as string[];\n          }\n          return result;\n        }\n        return undefined;\n      }\n    }\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check if a file starts with a specific directive (e.g. \"use client\").\n * Directives are string literal expression statements at the top of the file.\n */\nexport function fileHasDirective(filePath: string, directive: string): boolean {\n  if (!existsSync(filePath)) return false;\n  try {\n    const source = readFileCached(filePath);\n    const program = tryParse(source);\n    if (!program) return false;\n    for (const stmt of program.body) {\n      if (stmt.type !== 'ExpressionStatement') break;\n      const expr = (stmt as any).expression;\n      if (expr?.type !== 'Literal' || typeof expr.value !== 'string') break;\n      if (expr.value === directive) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n","/**\n * Convention linter — validates common misconfigurations in the route tree.\n *\n * Runs at scan time (build and dev startup). Each check produces a warning\n * with the file path, what's wrong, and what to do about it.\n *\n * Most checks are warnings — they don't block the build. The goal is to catch\n * issues that would otherwise produce cryptic runtime behavior (silent 404s,\n * empty pages, confusing React errors).\n *\n * A check emits `level: 'error'` only when the misconfiguration is *proven*\n * (never inferred from an absence the analysis cannot see through) and fatal\n * to rendering. `plugins/routing.ts` turns those into a thrown build error,\n * so a false positive there refuses a working app — see\n * `classifyClientBoundaryFile` for how that bar is met.\n *\n * Design doc: 07-routing.md, 10-error-handling.md\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport type { RouteFile, RouteTree, SegmentNode } from './types.ts';\nimport { swallow } from '../server/logger.ts';\nimport { isMdxFilePath } from '../server/utils/mdx-file.ts';\nimport {\n  fileDefaultExportIsLocalValue,\n  fileHasAnyExport,\n  fileHasDefaultExport,\n  fileHasDirective,\n  fileHasStarExport,\n} from './export-detect.ts';\n\n// ─── Types ──────────────────────────────────────────────────────────────────\n\nexport interface ConventionWarning {\n  /** Warning ID for deduplication and filtering. */\n  id: string;\n  /** Human-readable single-line summary. */\n  summary: string;\n  /** Multi-line details with file path and fix suggestion. */\n  details: string;\n  /** Severity: 'warn' for potential issues, 'error' for definite misconfigurations. */\n  level: 'warn' | 'error';\n}\n\n// ─── Lint Rules ─────────────────────────────────────────────────────────────\n\n/**\n * Run all convention lint checks on a route tree.\n *\n * Returns an array of warnings. Empty array means everything looks good.\n */\nexport function lintConventions(tree: RouteTree, appDir: string): ConventionWarning[] {\n  const warnings: ConventionWarning[] = [];\n\n  // Check 1: app/ directory exists (caller should check before scanning,\n  // but we validate the root has at least one routable file)\n  checkEmptyApp(tree.root, appDir, warnings);\n\n  // Check 2: route.ts without recognized HTTP method exports\n  checkRouteExports(tree.root, warnings);\n\n  // Check 3: Segments with layout but no page/route anywhere in subtree\n  // (not a misconfiguration per se — layouts without pages are valid for\n  // route groups. Skip this check.)\n\n  // Check 4: Root segment has no layout.tsx (no HTML shell)\n  checkRootLayout(tree.root, warnings);\n\n  // Check 5: page.tsx / layout.tsx without default export\n  checkDefaultExports(tree.root, warnings);\n\n  // Check 6: Client layouts cannot suppress server children before Flight\n  // serializes them. They remain valid UI boundaries, but not authorization\n  // or data-hiding boundaries.\n  checkClientLayouts(tree.root, warnings);\n\n  // Check 7: error.tsx / 404.tsx / 4xx.tsx / … without 'use client' directive\n  checkClientBoundaryFiles(tree.root, warnings);\n  if (tree.globalError) {\n    checkFileUseClientDirective(tree.globalError, 'global-error', warnings);\n  }\n\n  // Check 8: Wildcard MDX status files (4xx.mdx, 5xx.mdx, error.mdx) that\n  // reference `props` — props resolve on deny and throw paths but are empty\n  // on the boundary path. See design/10-error-handling.md §\"MDX Props by Path\".\n  checkWildcardMdxProps(tree.root, warnings);\n\n  return warnings;\n}\n\nfunction checkClientLayouts(node: SegmentNode, warnings: ConventionWarning[]): void {\n  if (node.layout && isScriptExtension(node.layout.extension)) {\n    try {\n      const isClient = fileHasDirective(node.layout.filePath, 'use client');\n      const isProvablyServer = fileDefaultExportIsLocalValue(node.layout.filePath);\n      if (isClient || !isProvablyServer) {\n        const certainty = isClient\n          ? `This layout is a client component.`\n          : `Timber cannot prove this layout is a server component because its default export comes from another module or an opaque expression.`;\n        warnings.push({\n          id: `CLIENT_LAYOUT_NOT_AUTH_BOUNDARY:${node.layout.filePath}`,\n          summary: isClient\n            ? `Client layout cannot securely suppress server children: ${node.layout.filePath}`\n            : `Layout may resolve to a client component and cannot be trusted as an auth boundary: ${node.layout.filePath}`,\n          details:\n            `  File: ${node.layout.filePath}\\n\\n` +\n            `  ${certainty}\\n` +\n            `  React Flight resolves server content passed to a client layout before the layout runs in the browser.\\n` +\n            `  Conditionally omitting children here does not prevent descendant server components from executing or being serialized.\\n\\n` +\n            `  To fix: Put authorization in access.ts or a provably server layout with a locally defined default component, and keep client components inside that boundary.\\n`,\n          level: 'warn',\n        });\n      }\n    } catch (err) {\n      swallow(err, `convention-lint: unreadable layout file ${node.layout.filePath}`);\n    }\n  }\n  for (const child of node.children) checkClientLayouts(child, warnings);\n  for (const slot of Object.values(node.slots)) checkClientLayouts(slot, warnings);\n}\n\n// ─── Check: Empty App ───────────────────────────────────────────────────────\n\n/**\n * Warn when the app/ directory has no routable files at all.\n *\n * This catches the \"I created app/ but didn't add any pages\" case where\n * every request silently 404s with no guidance.\n */\nfunction checkEmptyApp(root: SegmentNode, appDir: string, warnings: ConventionWarning[]): void {\n  if (hasAnyRoutable(root)) return;\n\n  warnings.push({\n    id: 'EMPTY_APP',\n    summary: 'No pages or route handlers found in app/',\n    details:\n      `  Directory: ${appDir}\\n\\n` +\n      '  Your app/ directory has no page.tsx or route.ts files.\\n' +\n      '  Every request will return 404.\\n\\n' +\n      '  To fix: Create app/page.tsx with a default export:\\n\\n' +\n      '    export default function Home() {\\n      return <h1>Hello</h1>;\\n    }\\n',\n    level: 'warn',\n  });\n}\n\n/**\n * Check if a segment tree has any routable files (page or route) anywhere.\n */\nfunction hasAnyRoutable(node: SegmentNode): boolean {\n  if (node.page || node.route) return true;\n  for (const child of node.children) {\n    if (hasAnyRoutable(child)) return true;\n  }\n  for (const slot of Object.values(node.slots)) {\n    if (hasAnyRoutable(slot)) return true;\n  }\n  return false;\n}\n\n/**\n * Check if a segment tree has any page files (not just route handlers).\n * Used by checkRootLayout to avoid false positives for API-only apps (TIM-794).\n * API-only apps (just route.ts handlers) don't need a root layout.\n */\nfunction hasAnyPage(node: SegmentNode): boolean {\n  if (node.page) return true;\n  for (const child of node.children) {\n    if (hasAnyPage(child)) return true;\n  }\n  for (const slot of Object.values(node.slots)) {\n    if (hasAnyPage(slot)) return true;\n  }\n  return false;\n}\n\n// ─── Check: Route Exports ───────────────────────────────────────────────────\n\n/** HTTP methods that route.ts can export. */\nconst HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] as const;\n\n/**\n * Warn when a route.ts file doesn't appear to export any recognized HTTP methods.\n *\n * Uses AST-based detection via parseAst for precise matching.\n * Falls back silently when the file can't be parsed (syntax errors produce\n * no spurious warning — the TS compiler will catch those).\n */\nfunction checkRouteExports(node: SegmentNode, warnings: ConventionWarning[]): void {\n  if (node.route) {\n    const filePath = node.route.filePath;\n    try {\n      const methods = fileHasAnyExport(filePath, HTTP_METHODS);\n      if (methods.size === 0 && !fileHasStarExport(filePath)) {\n        const hasDefault = fileHasDefaultExport(filePath);\n        const hint = hasDefault\n          ? '  It looks like you have a default export. route.ts uses named exports\\n' +\n            '  for HTTP methods (GET, POST, etc.), not a default export.\\n'\n          : '';\n\n        warnings.push({\n          id: 'ROUTE_NO_METHODS',\n          summary: `route.ts has no HTTP method exports: ${filePath}`,\n          details:\n            `  File: ${filePath}\\n\\n` +\n            '  route.ts files must export named HTTP method handlers.\\n' +\n            '  Without them, the route matches but returns 405 Method Not Allowed.\\n\\n' +\n            hint +\n            '  Example:\\n\\n' +\n            '    export function GET(ctx: RouteContext) {\\n' +\n            \"      return Response.json({ hello: 'world' });\\n\" +\n            '    }\\n',\n          level: 'warn',\n        });\n      }\n    } catch (err) {\n      swallow(err, `convention-lint: unreadable route.ts ${filePath}`);\n    }\n  }\n\n  // Recurse\n  for (const child of node.children) {\n    checkRouteExports(child, warnings);\n  }\n  for (const slot of Object.values(node.slots)) {\n    checkRouteExports(slot, warnings);\n  }\n}\n\n// ─── Check: Root Layout ─────────────────────────────────────────────────────\n\n/**\n * Warn when the root segment has no layout.tsx.\n *\n * Without a root layout, there's no HTML shell (<html>, <body>).\n * The page will render but may have hydration issues or no proper document structure.\n */\nfunction checkRootLayout(root: SegmentNode, warnings: ConventionWarning[]): void {\n  if (root.layout) return;\n\n  // Only warn if there are pages — API-only apps (just route.ts handlers)\n  // don't need a root layout (TIM-794).\n  if (!hasAnyPage(root)) return;\n\n  warnings.push({\n    id: 'NO_ROOT_LAYOUT',\n    summary: 'No root layout.tsx found',\n    details:\n      '  Your app has pages but no root layout.\\n' +\n      '  Without app/layout.tsx, pages have no <html> or <body> wrapper.\\n\\n' +\n      '  To fix: Create app/layout.tsx:\\n\\n' +\n      '    export default function RootLayout({ children }: { children: React.ReactNode }) {\\n' +\n      '      return (\\n' +\n      '        <html lang=\"en\">\\n' +\n      '          <body>{children}</body>\\n' +\n      '        </html>\\n' +\n      '      );\\n' +\n      '    }\\n',\n    level: 'warn',\n  });\n}\n\n// ─── Check: Default Exports ───────────────────────────────────────────\n\n/**\n * Warn when page.tsx or layout.tsx files don't have a default export.\n *\n * Without a default export:\n * - page.tsx: the page renders nothing (empty content)\n * - layout.tsx: the layout module loads but has no component to render\n *\n * Uses AST-based detection via parseAst for precise matching. Falls back\n * silently when the file can't be parsed (no spurious warning on syntax errors).\n */\nfunction checkDefaultExports(node: SegmentNode, warnings: ConventionWarning[]): void {\n  // Check page files (tsx/ts/jsx/js only — not mdx, which is default-exported by the mdx compiler)\n  if (node.page && isScriptExtension(node.page.extension)) {\n    checkFileDefaultExport(node.page.filePath, 'page', warnings);\n  }\n\n  // Check layout files\n  if (node.layout && isScriptExtension(node.layout.extension)) {\n    checkFileDefaultExport(node.layout.filePath, 'layout', warnings);\n  }\n\n  // Recurse\n  for (const child of node.children) {\n    checkDefaultExports(child, warnings);\n  }\n  for (const slot of Object.values(node.slots)) {\n    checkDefaultExports(slot, warnings);\n  }\n}\n\nfunction isScriptExtension(ext: string): boolean {\n  return ext === 'tsx' || ext === 'ts' || ext === 'jsx' || ext === 'js';\n}\n\nfunction checkFileDefaultExport(\n  filePath: string,\n  fileType: string,\n  warnings: ConventionWarning[]\n): void {\n  try {\n    if (!fileHasDefaultExport(filePath)) {\n      warnings.push({\n        id: `NO_DEFAULT_EXPORT:${filePath}`,\n        summary: `${fileType}.tsx has no default export: ${filePath}`,\n        details:\n          `  File: ${filePath}\\n\\n` +\n          `  ${fileType}.tsx files must export a default React component.\\n` +\n          `  Without a default export, the ${fileType === 'page' ? 'page renders nothing' : 'layout has no component to wrap children'}.\\n\\n` +\n          `  To fix: Add a default export:\\n\\n` +\n          `    export default function My${fileType === 'page' ? 'Page' : 'Layout'}(${fileType === 'layout' ? '{ children }' : ''}) {\\n` +\n          `      return ${fileType === 'layout' ? '<div>{children}</div>' : '<h1>Hello</h1>'};\\n` +\n          `    }\\n`,\n        level: 'warn',\n      });\n    }\n  } catch (err) {\n    swallow(err, `convention-lint: unreadable ${fileType} file ${filePath}`);\n  }\n}\n\n// ─── Check: Client Boundary Directive ───────────────────────────────────────\n\n/**\n * Check every file the renderer hands to `TimberErrorBoundary` as a component\n * prop: `error.tsx`, `global-error.tsx`, and the status-code family\n * (`404.tsx`, `4xx.tsx`, `503.tsx`, …).\n *\n * `TimberErrorBoundary` is a client component, so a server component passed as\n * `fallbackComponent` is a function crossing the RSC → client boundary. React\n * Flight refuses to serialize it, and because the boundary wraps the segment's\n * *children*, the failure hits every page under that segment — not just the\n * error path. The raw message (\"Functions cannot be passed directly to Client\n * Components\") names neither the file nor the fix (TIM-1329).\n *\n * MDX status files are exempt: they are server components by design and the\n * renderer pre-renders them into `fallbackElement` instead. See TIM-503 and\n * `server/error-boundary-wrapper.ts`.\n *\n * `.json` status files never reach React at all, and are not in `statusFiles`.\n */\nfunction checkClientBoundaryFiles(node: SegmentNode, warnings: ConventionWarning[]): void {\n  if (node.error) {\n    checkFileUseClientDirective(node.error, 'error', warnings);\n  }\n\n  for (const [key, file] of Object.entries(node.statusFiles ?? {})) {\n    checkFileUseClientDirective(file, key, warnings);\n  }\n\n  for (const child of node.children) {\n    checkClientBoundaryFiles(child, warnings);\n  }\n  for (const slot of Object.values(node.slots)) {\n    checkClientBoundaryFiles(slot, warnings);\n  }\n}\n\n/**\n * `'client'` — carries the directive.\n * `'server'` — proven server component: no directive, and the default export is\n *   a function or class built by this very module, so no other file's directive\n *   can be governing it.\n * `'unknown'` — no directive, but the exported value may come from elsewhere\n *   (`export { default } from './client-thing'`), or the file could not be\n *   read or parsed. Never escalated to a build error.\n */\ntype ClientBoundaryVerdict = 'client' | 'server' | 'unknown';\n\nfunction classifyClientBoundaryFile(filePath: string): ClientBoundaryVerdict {\n  if (fileHasDirective(filePath, 'use client')) return 'client';\n  if (fileDefaultExportIsLocalValue(filePath)) return 'server';\n  return 'unknown';\n}\n\n/** Example component name for the fix snippet, keyed by convention name. */\nfunction exampleComponentName(convention: string): string {\n  if (convention === 'global-error') return 'GlobalError';\n  if (convention === 'error') return 'ErrorBoundary';\n  if (convention === '404') return 'NotFound';\n  return 'StatusPage';\n}\n\n/**\n * @param file      the route file (its extension decides whether the check applies)\n * @param convention the convention name — `error`, `global-error`, `404`, `4xx`, …\n */\nfunction checkFileUseClientDirective(\n  file: RouteFile,\n  convention: string,\n  warnings: ConventionWarning[]\n): void {\n  // MDX/markdown status and error files are server components by design — the\n  // renderer pre-renders them into `fallbackElement`, so they never cross the\n  // boundary as a function.\n  //\n  // The exemption is the *complement* of the renderer's own test, using the\n  // renderer's own helper: everything `error-boundary-wrapper.ts` and\n  // `error-renderer.ts` do not treat as MDX, they pass as a component. An\n  // independent \"is this a script extension?\" list here would be a second\n  // expression of that fact, free to drift into a gap where a file is a\n  // component to the renderer and exempt to the linter.\n  if (isMdxFilePath(file.filePath)) return;\n\n  const filePath = file.filePath;\n  const label = `${convention}.${file.extension}`;\n  let verdict: ClientBoundaryVerdict;\n  try {\n    verdict = classifyClientBoundaryFile(filePath);\n  } catch (err) {\n    swallow(err, `convention-lint: unreadable ${label} file ${filePath}`);\n    return;\n  }\n  if (verdict === 'client') return;\n\n  const isError = verdict === 'server';\n  const name = exampleComponentName(convention);\n  const props =\n    convention === 'error' || convention === 'global-error' ? '{ error, reset }' : '{ status }';\n\n  warnings.push({\n    id: `NEEDS_USE_CLIENT:${filePath}`,\n    summary: isError\n      ? `${label} is a server component and must be a client component: ${filePath}`\n      : `${label} may be missing 'use client': ${filePath}`,\n    details:\n      `  File: ${filePath}\\n\\n` +\n      `  ${label} is handed to timber's error boundary — a client\\n` +\n      '  component — as a prop. A server component cannot cross that boundary:\\n' +\n      '  React fails with \"Functions cannot be passed directly to Client\\n' +\n      '  Components\", and every page under this segment fails to render.\\n\\n' +\n      (isError\n        ? \"  To fix: Add 'use client' as the first line of the file:\\n\\n\" +\n          \"    'use client';\\n\\n\" +\n          `    export default function ${name}(${props}) {\\n` +\n          '      return <h1>…</h1>;\\n' +\n          '    }\\n'\n        : // The default export comes from somewhere this analysis cannot follow\n          // — a re-export, an imported binding, a wrapper call. It may well\n          // already be a client component, so say what was checked rather than\n          // assert a break.\n          \"  This file has no 'use client' directive, and its default export\\n\" +\n          '  comes from elsewhere, so timber cannot tell which it is. If the\\n' +\n          \"  module it re-exports starts with 'use client', nothing is wrong\\n\" +\n          '  and you can ignore this. Otherwise add the directive there.\\n'),\n    level: isError ? 'error' : 'warn',\n  });\n}\n\n// ─── Check: Wildcard MDX Props ──────────────────────────────────────────────\n\n/**\n * Wildcard status file keys in `statusFiles` whose props differ by path.\n * `error` is not here — the scanner stores it in `node.error`, not\n * `node.statusFiles`, and the check handles it separately below.\n */\nconst WILDCARD_MDX_STATUS_KEYS = new Set(['4xx', '5xx']);\n\n/**\n * Warn when a wildcard MDX status file (`4xx.mdx`, `5xx.mdx`, `error.mdx`)\n * appears to reference `props` in its source.\n *\n * These files are pre-rendered into `fallbackElement` on the error-boundary\n * path, before the error happens, so they receive empty or partial props.\n * On the deny and error-renderer paths they receive the real props. An author\n * writing `{props.status}` gets the number on some paths and `undefined` on\n * others — same source, different output.\n *\n * A text scan for `props` is acceptable here because the check is `level:\n * 'warn'` — a false positive costs a printed line, not a refused build. A\n * sound check would need the MDX compiler, which is optional, async, and\n * scoped to the RSC environment. See TIM-1333.\n *\n * Exact-code MDX files (e.g. `503.mdx`) are unaffected — all four paths\n * agree on their status.\n */\nfunction checkWildcardMdxProps(node: SegmentNode, warnings: ConventionWarning[]): void {\n  if (node.statusFiles) {\n    for (const [key, file] of Object.entries(node.statusFiles)) {\n      if (WILDCARD_MDX_STATUS_KEYS.has(key) && isMdxFilePath(file.filePath)) {\n        checkMdxFileForProps(file.filePath, key, warnings);\n      }\n    }\n  }\n  if (node.error && isMdxFilePath(node.error.filePath)) {\n    checkMdxFileForProps(node.error.filePath, 'error', warnings);\n  }\n\n  for (const child of node.children) {\n    checkWildcardMdxProps(child, warnings);\n  }\n  for (const slot of Object.values(node.slots)) {\n    checkWildcardMdxProps(slot, warnings);\n  }\n}\n\n/**\n * Check if an MDX file's source appears to reference `props`.\n *\n * MDX passes a `props` object to the default export function. A reference to\n * `props.status` or `props.dangerouslyPassData` in a wildcard file works on\n * the deny/throw paths but renders `undefined` on the boundary path.\n */\nfunction checkMdxFileForProps(\n  filePath: string,\n  convention: string,\n  warnings: ConventionWarning[]\n): void {\n  let source: string;\n  try {\n    source = readFileSync(filePath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  // MDX exposes props via the default export: export default function(props) { ... }\n  // and via JSX expressions: {props.status}. A text scan is intentionally\n  // broad — false positives are cheap at warn level.\n  if (!/\\bprops\\b/.test(source)) return;\n\n  const label = `${convention}.${filePath.endsWith('.md') ? 'md' : 'mdx'}`;\n  warnings.push({\n    id: `MDX_WILDCARD_PROPS:${filePath}`,\n    summary: `${label} references props, which are empty on the error boundary path: ${filePath}`,\n    details:\n      `  File: ${filePath}\\n\\n` +\n      `  Wildcard MDX status files (${convention}.mdx) are pre-rendered into\\n` +\n      '  fallbackElement before the error occurs. On that path, props are\\n' +\n      `  empty${convention === 'error' ? '' : ' (no status, no dangerouslyPassData)'}. On the deny() and error-renderer\\n` +\n      '  paths, props.status resolves correctly.\\n\\n' +\n      '  If this file uses only static content and \"props\" appears in prose,\\n' +\n      '  this warning is a false positive — ignore it.\\n\\n' +\n      '  To fix: Use only static content in wildcard MDX status files, or\\n' +\n      '  use an exact-code file (e.g. 404.mdx) where all paths agree.\\n',\n    level: 'warn',\n  });\n}\n\n// ─── Check: App Directory Exists ────────────────────────────────────────────\n\n/**\n * Check if the app/ directory exists. Called before scanning.\n * Returns a warning if missing, or null if the directory exists.\n */\nexport function checkAppDirExists(appDir: string): ConventionWarning | null {\n  if (existsSync(appDir)) return null;\n\n  return {\n    id: 'NO_APP_DIR',\n    summary: 'No app/ directory found',\n    details:\n      `  Expected: ${appDir}\\n\\n` +\n      '  timber.js requires an app/ directory for file-system routing.\\n' +\n      '  Every request will return 404 until you create it.\\n\\n' +\n      '  To fix: Create the app/ directory with a page:\\n\\n' +\n      '    mkdir -p app\\n' +\n      '    # Create app/layout.tsx and app/page.tsx\\n',\n    level: 'error',\n  };\n}\n\n// ─── Formatting ─────────────────────────────────────────────────────────────\n\nimport type { InspectColor } from 'node:util';\nimport { styleText } from 'node:util';\n\ntype Format = InspectColor | readonly InspectColor[];\nconst noValidate = { validateStream: false } as const;\n\nexport interface FormatOptions {\n  /**\n   * Emit ANSI escapes. Off when the text becomes an `Error` message —\n   * whoever prints it decides its formatting, and colored escapes inside\n   * an exception leak into logs and stack traces.\n   */\n  color?: boolean;\n}\n\n/**\n * Format warnings for terminal output.\n *\n * Groups by severity, uses colors, and includes fix suggestions.\n */\nexport function formatConventionWarnings(\n  warnings: ConventionWarning[],\n  options: FormatOptions = {}\n): string {\n  const { color = true } = options;\n  const style = (fmt: Format, text: string) => (color ? styleText(fmt, text, noValidate) : text);\n  if (warnings.length === 0) return '';\n\n  const errors = warnings.filter((w) => w.level === 'error');\n  const warns = warnings.filter((w) => w.level === 'warn');\n\n  const lines: string[] = [];\n\n  if (errors.length > 0) {\n    lines.push(\n      `${style(['red', 'bold'], '[timber]')} ${style('red', `${errors.length} configuration error${errors.length !== 1 ? 's' : ''}:`)}`\n    );\n    for (const e of errors) {\n      lines.push('');\n      lines.push(`  ${style('red', '✗')} ${e.summary}`);\n      lines.push(style('dim', e.details));\n    }\n  }\n\n  if (warns.length > 0) {\n    if (errors.length > 0) lines.push('');\n    lines.push(\n      `${style(['yellow', 'bold'], '[timber]')} ${style('yellow', `${warns.length} configuration warning${warns.length !== 1 ? 's' : ''}:`)}`\n    );\n    for (const w of warns) {\n      lines.push('');\n      lines.push(`  ${style('yellow', '⚠')} ${w.summary}`);\n      lines.push(style('dim', w.details));\n    }\n  }\n\n  return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAYA,IAAa,iCAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;;;;AAKrD,SAAgB,cAAc,UAA2B;CACvD,MAAM,WAAW,SAAS,YAAY,GAAG;CACzC,IAAI,aAAa,IAAI,OAAO;CAC5B,OAAO,eAAe,IAAI,SAAS,MAAM,QAAQ,CAAC;AACpD;;;;;;;;;;;;;;;;;;;;ACUA,SAAgB,mBAAmB,MAAiB,QAA0C;CAC5F,MAAM,sBAAM,IAAI,IAAyB;CAEzC,SAAS,KAAK,MAAmB,QAAgB,UAAwB;EACvE,IAAI,IAAI,QAAQ;GACd,OAAO,KAAK,WAAW;GACvB,aAAa,YAAY;EAC3B,CAAC;EAED,KAAK,MAAM,SAAS,KAAK,UAGvB,KAAK,OAFY,KAAK,QAAQ,MAAM,WAExB,GAAU,GADG,SAAS,GAAG,MAAM,aACR;EAErC,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,KAAK,KAAK,GAG1D,KAAK,UAFW,KAAK,QAAQ,IAAI,UAElB,GAAS,GADA,SAAS,IAAI,UACD;CAExC;CAEA,KAAK,KAAK,MAAM,QAAQ,EAAE;CAC1B,OAAO;AACT;;;;AAKA,SAAgB,mBAAmB,MAA2B;CAC5D,OAAO;EACL,wBAAwB,KAAK,MAAM;EACnC,+BAA+B,KAAK,YAAY;EAChD;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;AAOA,eAAsB,kBACpB,WACA,QACA,MACe;CAGf,MAAM,WAAW,OAAO,MAAM,KAAK,SAAS,CAAC;CAC7C,MAAM,YAAY,KAAK,MAAM,WAAW,SAAS,QAAQ;CACzD,MAAM,MAAM,mBAAmB,WAAW,MAAM;CAEhD,MAAM,SAA0B,CAAC;CACjC,KAAK,MAAM,CAAC,OAAO,SAAS,KAAK;EAE/B,MAAM,SAAS,MAAM,MAAM,OAAO,MAAM;EACxC,MAAM,aAAa,KAAK,WAAW,MAAM;EACzC,MAAM,cAAc,KAAK,YAAY,eAAe;EACpD,MAAM,UAAU,mBAAmB,IAAI;EAEvC,OAAO,KACL,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,aAAa,SAAS,OAAO,CAAC,CAC5F;CACF;CAEA,MAAM,QAAQ,IAAI,MAAM;AAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjEA,IAAa,iBAAiB;;AAG9B,IAAa,mBAAmB;;;;;;;;;;;;;;;;;;;AAoBhC,IAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,IAAI;;;;;;;;;;;;;AAcX,IAAM,uCAAuB,IAAI,IAAmB;;;;;;;;;;;AAYpD,eAAsB,qBAAoC;CASxD,OAAO,qBAAqB,OAAO,GAAG;EACpC,MAAM,WAAW,CAAC,GAAG,oBAAoB;EACzC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,KAAK,MAAM,SAAS,UAAU,qBAAqB,OAAO,KAAK;CACjE;AACF;;;;;;;;;;AAWA,SAAgB,kBAAkB,MAAiB,QAAgB,MAA6B;CAC9F,MAAM,YAAY,KAAK,MAAM,SAAS;CACtC,MAAM,UAAU,iBAAiB,MAAM;EAAE;EAAQ,WAAW;CAAU,CAAC;CACvE,MAAM,aAAa,KAAK,MAAM,cAAc;CAC5C,MAAM,UAAU,KAAK,MAAM,gBAAgB;CAE3C,MAAM,OAAO,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC,CAAC,CAC/C,WACC,QAAQ,IAAI;EACV,UAAU,YAAY,SAAS,OAAO;EACtC,UAAU,SAAS,gBAAgB,OAAO;EAC1C,kBAAkB,MAAM,QAAQ,IAAI;CACtC,CAAC,CACH,CAAC,CACA,WAAW,KAAA,CAAS;CAKvB,MAAM,UAAU,KAAK,YAAY,KAAA,CAAS;CAC1C,qBAAqB,IAAI,OAAO;CAChC,QAAa,cAAc,qBAAqB,OAAO,OAAO,CAAC;CAE/D,OAAO;AACT;;;;;;;;;;ACzGA,SAAS,SAAS,QAAoC;CACpD,IAAI;EACF,OAAO,SAAS,QAAQ,EAAE,MAAM,MAAM,CAAC;CACzC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAS,oBAAoB,SAAmC;CAC9D,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,QAAQ,QAAQ,MAAM;EAC/B,IAAI,KAAK,SAAS,0BAA0B;EAE5C,IAAI,KAAK,eAAe,QAAQ;EAEhC,IAAI,KAAK,aAAa;GACpB,IAAI,KAAK,YAAY,IAAI,MACvB,MAAM,IAAI,KAAK,YAAY,GAAG,IAAI;GAEpC,IAAI,KAAK,YAAY,cACd;SAAA,MAAM,QAAQ,KAAK,YAAY,cAClC,IAAI,KAAK,IAAI,MAAM,MAAM,IAAI,KAAK,GAAG,IAAI;GAAA;EAG/C;EAEA,IAAI,KAAK,YACP,KAAK,MAAM,QAAQ,KAAK,YAAY;GAElC,IAAI,KAAK,eAAe,QAAQ;GAChC,IAAI,KAAK,UAAU,QAAQ,KAAK,SAAS,SAAS,WAChD,MAAM,IAAI,KAAK,SAAS,IAAI;EAEhC;CAEJ;CACA,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,SAAS,iBAAiB,MAAkE;CAC1F,IAAI,KAAK,SAAS,4BAA4B,CAAC,KAAK,YAAY,OAAO;CACvE,IAAI,KAAK,eAAe,QAAQ,OAAO;CACvC,KAAK,MAAM,QAAQ,KAAK,YAAY;EAClC,IAAI,KAAK,eAAe,QAAQ;EAChC,IAAI,KAAK,UAAU,SAAS,WAAW,OAAO;CAChD;CACA,OAAO;AACT;;;;;;;AAQA,SAAS,iBAAiB,SAA+B;CACvD,KAAK,MAAM,QAAQ,QAAQ,MAAM;EAC/B,IAAI,KAAK,SAAS,4BAA4B,OAAO;EACrD,IAAI,iBAAiB,IAAI,GAAG,OAAO;CACrC;CACA,OAAO;AACT;;;;;;AAOA,SAAS,cAAc,SAA+B;CACpD,OAAO,QAAQ,KAAK,MACjB,SACC,KAAK,SAAS,0BAA0B,CAAE,KAAa,YAAY,KAAK,eAAe,MAC3F;AACF;;;;;AAsBA,SAAgB,iBAAiB,UAAkB,aAA6C;CAC9F,MAAM,0BAAU,IAAI,IAAY;CAChC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO;EACrB,MAAM,UAAU,oBAAoB,OAAO;EAC3C,KAAK,MAAM,QAAQ,aACjB,IAAI,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI;CAE3C,QAAQ,CAER;CACA,OAAO;AACT;;;;;AAMA,SAAgB,qBAAqB,UAA2B;CAC9D,IAAI,CAAC,WAAW,QAAQ,GAAG,OAAO;CAClC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO;EACrB,OAAO,iBAAiB,OAAO;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,IAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,IAAM,uCAAuB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;;AAUD,SAAS,kBAAkB,MAAwB;CACjD,IAAI,UAAU;CACd,OAAO,qBAAqB,IAAI,QAAQ,IAAI,KAAK,QAAQ,YACvD,UAAU,QAAQ;CAEpB,OAAO;AACT;;;;;;;AAQA,SAAS,mBAAmB,SAAsB,MAAuB;CACvE,KAAK,MAAM,QAAQ,QAAQ,MAAM;EAE/B,MAAM,OAAO,KAAK,SAAS,2BAA2B,KAAK,cAAc;EACzE,IAAI,CAAC,MAAM;EACX,KACG,KAAK,SAAS,yBAAyB,KAAK,SAAS,uBACtD,KAAK,IAAI,SAAS,MAElB,OAAO;EAET,IAAI,KAAK,SAAS,uBACX;QAAA,MAAM,KAAK,KAAK,gBAAgB,CAAC,GACpC,IAAI,EAAE,IAAI,SAAS,QAAQ,EAAE,QAAQ,cAAc,IAAI,kBAAkB,EAAE,IAAI,CAAC,CAAC,IAAI,GACnF,OAAO;EAAA;CAIf;CACA,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,SAAgB,8BAA8B,UAA2B;CACvE,IAAI,CAAC,WAAW,QAAQ,GAAG,OAAO;CAClC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO;EACrB,KAAK,MAAM,QAAQ,QAAQ,MAAM;GAC/B,IAAI,KAAK,SAAS,4BAA4B;IAC5C,MAAM,OAAO,KAAK,eAAe,kBAAkB,KAAK,WAAW;IACnE,IAAI,CAAC,MAAM,OAAO;IAClB,IAAI,cAAc,IAAI,KAAK,IAAI,GAAG,OAAO;IACzC,IAAI,KAAK,SAAS,gBAAgB,KAAK,MACrC,OAAO,mBAAmB,SAAS,KAAK,IAAI;IAE9C,OAAO;GACT;GAMA,MAAM,OAAO,iBAAiB,IAAI;GAClC,IAAI,MAAM;IAGR,IAAI,KAAK,QAAQ,OAAO;IACxB,OAAO,KAAK,OAAO,OAAO,mBAAmB,SAAS,KAAK,MAAM,IAAI,IAAI;GAC3E;EACF;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;AAMA,SAAgB,kBAAkB,UAA2B;CAC3D,IAAI,CAAC,WAAW,QAAQ,GAAG,OAAO;CAClC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO;EACrB,OAAO,cAAc,OAAO;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;AAaA,SAAS,oBAAoB,MAAwB;CACnD,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,WAAW,OAAO,EAAE;CACnC,IAAI,EAAE,SAAS,qBAAqB,EAAE,aAAa,OAAO,EAAE,UAAU,SAAS,WAC7E,OAAO,CAAE,EAAE,SAAS;CAEtB,IAAI,EAAE,SAAS,mBAAmB;EAChC,MAAM,WAAW,EAAE;EACnB,IAAI,CAAC,UAAU,OAAO,KAAA;EACtB,MAAM,SAAoB,CAAC;EAC3B,KAAK,MAAM,MAAM,UAAU;GACzB,MAAM,IAAI,oBAAoB,EAAE;GAChC,IAAI,MAAM,KAAA,GAAW,OAAO,KAAA;GAC5B,OAAO,KAAK,CAAC;EACf;EACA,OAAO;CACT;AAEF;AAEA,SAAS,qBAAqB,MAAoD;CAChF,IAAK,KAAa,SAAS,oBAAoB,OAAO,KAAA;CACtD,MAAM,QAAS,KAAa;CAC5B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,IAAI;EACV,IAAI,EAAE,SAAS,iBAAiB,OAAO,KAAA;EACvC,IAAI,EAAE,SAAS,cAAc,EAAE,UAAU,OAAO,KAAA;EAChD,MAAM,MACJ,EAAE,KAAK,SAAS,eACZ,EAAE,IAAI,OACN,EAAE,KAAK,SAAS,YACd,OAAO,EAAE,IAAI,KAAK,IAClB,KAAA;EACR,IAAI,CAAC,KAAK,OAAO,KAAA;EACjB,MAAM,QAAQ,oBAAoB,EAAE,KAAK;EACzC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,OAAO,OAAO;CAChB;CACA,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,mBAAmB,UAAoD;CACrF,IAAI,CAAC,WAAW,QAAQ,GAAG,OAAO,KAAA;CAClC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO,KAAA;EAErB,KAAK,MAAM,QAAQ,QAAQ,MAAM;GAC/B,IAAI,KAAK,SAAS,0BAA0B;GAC5C,IAAI,KAAK,eAAe,QAAQ;GAChC,IAAI,CAAC,KAAK,aAAa;GACvB,MAAM,OAAO,KAAK;GAClB,IAAI,KAAK,SAAS,uBAAuB;GACzC,MAAM,eAAe,KAAK;GAM1B,IAAI,CAAC,cAAc;GACnB,KAAK,MAAM,KAAK,cAAc;IAC5B,IAAI,EAAE,IAAI,SAAS,eAAe,CAAC,EAAE,MAAM;IAC3C,MAAM,OAAO,EAAE;IACf,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,UAAU,WACnD,OAAO,KAAK;IAEd,IAAI,KAAK,SAAS,oBAAoB;KACpC,MAAM,MAAM,qBAAqB,IAAI;KACrC,IAAI,CAAC,KAAK,OAAO,KAAA;KACjB,MAAM,SAA4C,CAAC;KACnD,IAAI,SAAS,OAAO,OAAO,IAAI,QAAQ,UAAU,OAAO,MAAM,IAAI;KAClE,IACE,UAAU,OACV,MAAM,QAAQ,IAAI,IAAI,KACtB,IAAI,KAAK,OAAO,MAAe,OAAO,MAAM,QAAQ,GAEpD,OAAO,OAAO,IAAI;KAEpB,OAAO;IACT;IACA;GACF;EACF;EACA;CACF,QAAQ;EACN;CACF;AACF;;;;;AAMA,SAAgB,iBAAiB,UAAkB,WAA4B;CAC7E,IAAI,CAAC,WAAW,QAAQ,GAAG,OAAO;CAClC,IAAI;EAEF,MAAM,UAAU,SADD,eAAe,QACL,CAAM;EAC/B,IAAI,CAAC,SAAS,OAAO;EACrB,KAAK,MAAM,QAAQ,QAAQ,MAAM;GAC/B,IAAI,KAAK,SAAS,uBAAuB;GACzC,MAAM,OAAQ,KAAa;GAC3B,IAAI,MAAM,SAAS,aAAa,OAAO,KAAK,UAAU,UAAU;GAChE,IAAI,KAAK,UAAU,WAAW,OAAO;EACvC;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;AC5YA,SAAgB,gBAAgB,MAAiB,QAAqC;CACpF,MAAM,WAAgC,CAAC;CAIvC,cAAc,KAAK,MAAM,QAAQ,QAAQ;CAGzC,kBAAkB,KAAK,MAAM,QAAQ;CAOrC,gBAAgB,KAAK,MAAM,QAAQ;CAGnC,oBAAoB,KAAK,MAAM,QAAQ;CAKvC,mBAAmB,KAAK,MAAM,QAAQ;CAGtC,yBAAyB,KAAK,MAAM,QAAQ;CAC5C,IAAI,KAAK,aACP,4BAA4B,KAAK,aAAa,gBAAgB,QAAQ;CAMxE,sBAAsB,KAAK,MAAM,QAAQ;CAEzC,OAAO;AACT;AAEA,SAAS,mBAAmB,MAAmB,UAAqC;CAClF,IAAI,KAAK,UAAU,kBAAkB,KAAK,OAAO,SAAS,GACxD,IAAI;EACF,MAAM,WAAW,iBAAiB,KAAK,OAAO,UAAU,YAAY;EACpE,MAAM,mBAAmB,8BAA8B,KAAK,OAAO,QAAQ;EAC3E,IAAI,YAAY,CAAC,kBAAkB;GACjC,MAAM,YAAY,WACd,uCACA;GACJ,SAAS,KAAK;IACZ,IAAI,mCAAmC,KAAK,OAAO;IACnD,SAAS,WACL,2DAA2D,KAAK,OAAO,aACvE,uFAAuF,KAAK,OAAO;IACvG,SACE,WAAW,KAAK,OAAO,SAAS,QAC3B,UAAU;IAIjB,OAAO;GACT,CAAC;EACH;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,2CAA2C,KAAK,OAAO,UAAU;CAChF;CAEF,KAAK,MAAM,SAAS,KAAK,UAAU,mBAAmB,OAAO,QAAQ;CACrE,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GAAG,mBAAmB,MAAM,QAAQ;AACjF;;;;;;;AAUA,SAAS,cAAc,MAAmB,QAAgB,UAAqC;CAC7F,IAAI,eAAe,IAAI,GAAG;CAE1B,SAAS,KAAK;EACZ,IAAI;EACJ,SAAS;EACT,SACE,gBAAgB,OAAO;;;;;;;;;EAKzB,OAAO;CACT,CAAC;AACH;;;;AAKA,SAAS,eAAe,MAA4B;CAClD,IAAI,KAAK,QAAQ,KAAK,OAAO,OAAO;CACpC,KAAK,MAAM,SAAS,KAAK,UACvB,IAAI,eAAe,KAAK,GAAG,OAAO;CAEpC,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,IAAI,eAAe,IAAI,GAAG,OAAO;CAEnC,OAAO;AACT;;;;;;AAOA,SAAS,WAAW,MAA4B;CAC9C,IAAI,KAAK,MAAM,OAAO;CACtB,KAAK,MAAM,SAAS,KAAK,UACvB,IAAI,WAAW,KAAK,GAAG,OAAO;CAEhC,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,IAAI,WAAW,IAAI,GAAG,OAAO;CAE/B,OAAO;AACT;;AAKA,IAAM,eAAe;CAAC;CAAO;CAAQ;CAAO;CAAS;CAAU;CAAQ;AAAS;;;;;;;;AAShF,SAAS,kBAAkB,MAAmB,UAAqC;CACjF,IAAI,KAAK,OAAO;EACd,MAAM,WAAW,KAAK,MAAM;EAC5B,IAAI;GAEF,IADgB,iBAAiB,UAAU,YACvC,CAAA,CAAQ,SAAS,KAAK,CAAC,kBAAkB,QAAQ,GAAG;IAEtD,MAAM,OADa,qBAAqB,QAC3B,IACT,0IAEA;IAEJ,SAAS,KAAK;KACZ,IAAI;KACJ,SAAS,wCAAwC;KACjD,SACE,WAAW,SAAS;;;IAGpB,OACA;KAIF,OAAO;IACT,CAAC;GACH;EACF,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC,UAAU;EACjE;CACF;CAGA,KAAK,MAAM,SAAS,KAAK,UACvB,kBAAkB,OAAO,QAAQ;CAEnC,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,kBAAkB,MAAM,QAAQ;AAEpC;;;;;;;AAUA,SAAS,gBAAgB,MAAmB,UAAqC;CAC/E,IAAI,KAAK,QAAQ;CAIjB,IAAI,CAAC,WAAW,IAAI,GAAG;CAEvB,SAAS,KAAK;EACZ,IAAI;EACJ,SAAS;EACT,SACE;EAUF,OAAO;CACT,CAAC;AACH;;;;;;;;;;;AAcA,SAAS,oBAAoB,MAAmB,UAAqC;CAEnF,IAAI,KAAK,QAAQ,kBAAkB,KAAK,KAAK,SAAS,GACpD,uBAAuB,KAAK,KAAK,UAAU,QAAQ,QAAQ;CAI7D,IAAI,KAAK,UAAU,kBAAkB,KAAK,OAAO,SAAS,GACxD,uBAAuB,KAAK,OAAO,UAAU,UAAU,QAAQ;CAIjE,KAAK,MAAM,SAAS,KAAK,UACvB,oBAAoB,OAAO,QAAQ;CAErC,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,oBAAoB,MAAM,QAAQ;AAEtC;AAEA,SAAS,kBAAkB,KAAsB;CAC/C,OAAO,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,SAAS,QAAQ;AACnE;AAEA,SAAS,uBACP,UACA,UACA,UACM;CACN,IAAI;EACF,IAAI,CAAC,qBAAqB,QAAQ,GAChC,SAAS,KAAK;GACZ,IAAI,qBAAqB;GACzB,SAAS,GAAG,SAAS,8BAA8B;GACnD,SACE,WAAW,SAAS,QACf,SAAS,qFACqB,aAAa,SAAS,yBAAyB,2CAA2C,wEAE5F,aAAa,SAAS,SAAS,SAAS,GAAG,aAAa,WAAW,iBAAiB,GAAG,oBACxG,aAAa,WAAW,0BAA0B,iBAAiB;GAErF,OAAO;EACT,CAAC;CAEL,SAAS,KAAK;EACZ,QAAQ,KAAK,+BAA+B,SAAS,QAAQ,UAAU;CACzE;AACF;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,yBAAyB,MAAmB,UAAqC;CACxF,IAAI,KAAK,OACP,4BAA4B,KAAK,OAAO,SAAS,QAAQ;CAG3D,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,eAAe,CAAC,CAAC,GAC7D,4BAA4B,MAAM,KAAK,QAAQ;CAGjD,KAAK,MAAM,SAAS,KAAK,UACvB,yBAAyB,OAAO,QAAQ;CAE1C,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,yBAAyB,MAAM,QAAQ;AAE3C;AAaA,SAAS,2BAA2B,UAAyC;CAC3E,IAAI,iBAAiB,UAAU,YAAY,GAAG,OAAO;CACrD,IAAI,8BAA8B,QAAQ,GAAG,OAAO;CACpD,OAAO;AACT;;AAGA,SAAS,qBAAqB,YAA4B;CACxD,IAAI,eAAe,gBAAgB,OAAO;CAC1C,IAAI,eAAe,SAAS,OAAO;CACnC,IAAI,eAAe,OAAO,OAAO;CACjC,OAAO;AACT;;;;;AAMA,SAAS,4BACP,MACA,YACA,UACM;CAWN,IAAI,cAAc,KAAK,QAAQ,GAAG;CAElC,MAAM,WAAW,KAAK;CACtB,MAAM,QAAQ,GAAG,WAAW,GAAG,KAAK;CACpC,IAAI;CACJ,IAAI;EACF,UAAU,2BAA2B,QAAQ;CAC/C,SAAS,KAAK;EACZ,QAAQ,KAAK,+BAA+B,MAAM,QAAQ,UAAU;EACpE;CACF;CACA,IAAI,YAAY,UAAU;CAE1B,MAAM,UAAU,YAAY;CAC5B,MAAM,OAAO,qBAAqB,UAAU;CAC5C,MAAM,QACJ,eAAe,WAAW,eAAe,iBAAiB,qBAAqB;CAEjF,SAAS,KAAK;EACZ,IAAI,oBAAoB;EACxB,SAAS,UACL,GAAG,MAAM,yDAAyD,aAClE,GAAG,MAAM,gCAAgC;EAC7C,SACE,WAAW,SAAS,QACf,MAAM;;;;KAIV,UACG;;;;8BAE+B,KAAK,GAAG,MAAM;;IAO7C;EAIN,OAAO,UAAU,UAAU;CAC7B,CAAC;AACH;;;;;;AASA,IAAM,2CAA2B,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC;;;;;;;;;;;;;;;;;;;AAoBvD,SAAS,sBAAsB,MAAmB,UAAqC;CACrF,IAAI,KAAK,aACF;OAAA,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,WAAW,GACvD,IAAI,yBAAyB,IAAI,GAAG,KAAK,cAAc,KAAK,QAAQ,GAClE,qBAAqB,KAAK,UAAU,KAAK,QAAQ;CAAA;CAIvD,IAAI,KAAK,SAAS,cAAc,KAAK,MAAM,QAAQ,GACjD,qBAAqB,KAAK,MAAM,UAAU,SAAS,QAAQ;CAG7D,KAAK,MAAM,SAAS,KAAK,UACvB,sBAAsB,OAAO,QAAQ;CAEvC,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,GACzC,sBAAsB,MAAM,QAAQ;AAExC;;;;;;;;AASA,SAAS,qBACP,UACA,YACA,UACM;CACN,IAAI;CACJ,IAAI;EACF,SAAS,aAAa,UAAU,OAAO;CACzC,QAAQ;EACN;CACF;CAKA,IAAI,CAAC,YAAY,KAAK,MAAM,GAAG;CAE/B,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,SAAS,KAAK,IAAI,OAAO;CACjE,SAAS,KAAK;EACZ,IAAI,sBAAsB;EAC1B,SAAS,GAAG,MAAM,iEAAiE;EACnF,SACE,WAAW,SAAS,mCACY,WAAW;SAEjC,eAAe,UAAU,KAAK,uCAAuC;;;;;;;;EAMjF,OAAO;CACT,CAAC;AACH;;;;;AAQA,SAAgB,kBAAkB,QAA0C;CAC1E,IAAI,WAAW,MAAM,GAAG,OAAO;CAE/B,OAAO;EACL,IAAI;EACJ,SAAS;EACT,SACE,eAAe,OAAO;;;;;;;;EAMxB,OAAO;CACT;AACF;AAQA,IAAM,aAAa,EAAE,gBAAgB,MAAM;;;;;;AAgB3C,SAAgB,yBACd,UACA,UAAyB,CAAC,GAClB;CACR,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,KAAa,SAAkB,QAAQ,UAAU,KAAK,MAAM,UAAU,IAAI;CACzF,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,UAAU,OAAO;CACzD,MAAM,QAAQ,SAAS,QAAQ,MAAM,EAAE,UAAU,MAAM;CAEvD,MAAM,QAAkB,CAAC;CAEzB,IAAI,OAAO,SAAS,GAAG;EACrB,MAAM,KACJ,GAAG,MAAM,CAAC,OAAO,MAAM,GAAG,UAAU,EAAE,GAAG,MAAM,OAAO,GAAG,OAAO,OAAO,sBAAsB,OAAO,WAAW,IAAI,MAAM,GAAG,EAAE,GAChI;EACA,KAAK,MAAM,KAAK,QAAQ;GACtB,MAAM,KAAK,EAAE;GACb,MAAM,KAAK,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;GAChD,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;EACpC;CACF;CAEA,IAAI,MAAM,SAAS,GAAG;EACpB,IAAI,OAAO,SAAS,GAAG,MAAM,KAAK,EAAE;EACpC,MAAM,KACJ,GAAG,MAAM,CAAC,UAAU,MAAM,GAAG,UAAU,EAAE,GAAG,MAAM,UAAU,GAAG,MAAM,OAAO,wBAAwB,MAAM,WAAW,IAAI,MAAM,GAAG,EAAE,GACtI;EACA,KAAK,MAAM,KAAK,OAAO;GACrB,MAAM,KAAK,EAAE;GACb,MAAM,KAAK,KAAK,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,SAAS;GACnD,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;EACpC;CACF;CAEA,OAAO,MAAM,KAAK,IAAI;AACxB"}

package/dist/_chunks/dist-DtrJyBbw.js

@@ -0,0 +1,386 @@
+//#region src/cookies/validation.ts
+/**
+* Cookie name and value validation per RFC 6265 §4.1.1.
+*
+* This module is pure — no server or client imports — so it can be loaded
+* by both `server/request-context.ts` (which guards `getCookies().set()`)
+* and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The
+* shared validator gives both sides identical encoding contracts:
+* **the framework never silently encodes — callers emit `cookie-octet`
+* bytes or get a developer-facing error.**
+*
+* Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and
+* design/29-cookies.md §"Cookie Name and Value Validation".
+*/
+/**
+* RFC 7230 §3.2.6 token characters used as the cookie-name production in
+* RFC 6265 §4.1.1. Anchored, non-empty match.
+*
+* Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.
+* Disallowed: whitespace, controls, delimiters
+* (`(` `)` `<` `>` `@` `,` `;` `:` `\` `"` `/` `[` `]` `?` `=` `{` `}`).
+*/
+var COOKIE_NAME_RE = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
+/**
+* Format a single byte for a clear error message — escape control bytes
+* and non-ASCII as `0x..` and quote printables.
+*/
+function describeChar(value, index) {
+	const code = value.charCodeAt(index);
+	if (code < 32 || code === 127 || code > 126) return `0x${code.toString(16).padStart(2, "0")}`;
+	return JSON.stringify(value[index]);
+}
+/**
+* Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.
+* Throws a developer-facing error naming the offending byte and its index.
+*/
+function assertValidCookieName(name) {
+	if (typeof name !== "string" || name.length === 0) throw new Error("[timber] cookie name must be a non-empty string.");
+	if (!COOKIE_NAME_RE.test(name)) {
+		for (let i = 0; i < name.length; i++) if (!COOKIE_NAME_RE.test(name[i])) throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — disallowed character ${describeChar(name, i)} at index ${i}. Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, and \`!#$%&'*+-.^_\`|~\`; no whitespace, controls, or delimiters).`);
+		throw new Error(`[timber] invalid cookie name ${JSON.stringify(name)} — must match RFC 6265 §4.1.1 token grammar.`);
+	}
+}
+/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */
+function isCookieOctet(code) {
+	return code === 33 || code >= 35 && code <= 43 || code >= 45 && code <= 58 || code >= 60 && code <= 91 || code >= 93 && code <= 126;
+}
+/**
+* Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`
+* production:
+*
+*     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+*     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*
+* Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are
+* valid. The wrapped form is common in upstream `Set-Cookie` headers
+* (e.g. `sid="abc"; Path=/`) and must be forwardable through
+* `setFromHeaders` verbatim — stripping or rejecting the surrounding
+* quotes would corrupt the on-the-wire bytes and break value semantics
+* for the upstream service.
+*
+* Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),
+* interior DQUOTE, comma, semicolon, backslash, DEL, and anything
+* non-ASCII. The smuggling primitive (`;`) is rejected regardless of
+* wrapping.
+*
+* Throws a developer-facing error naming the offending byte and its
+* index. Callers passing user-controlled data through the default
+* `set()` path don't need to call this — `set()` auto-encodes via
+* `encodeURIComponent`, whose output is always valid cookie-octet.
+* This validator is for the `{ raw: true }` opt-out and for
+* `setFromHeaders` forwarding.
+*/
+/**
+* Characters that must not appear in path or domain cookie attributes.
+* Semicolons delimit cookie attributes on the wire, so allowing `;` in
+* path or domain would inject extra attributes. CR/LF enable HTTP header
+* injection.
+*/
+var ATTR_INJECTION_RE = /[;\r\n]/;
+var VALID_SAME_SITE = /* @__PURE__ */ new Set([
+	"strict",
+	"lax",
+	"none"
+]);
+/**
+* Validate cookie option attributes at runtime to prevent Set-Cookie
+* header injection through unsanitized option values.
+*
+* TypeScript types enforce correct shapes at compile time, but at runtime
+* (e.g. from untyped libraries or user-controlled config) invalid values
+* could inject additional Set-Cookie attributes.
+*/
+function assertValidCookieOptions(options) {
+	if (options.sameSite !== void 0) {
+		const lower = options.sameSite.toLowerCase();
+		if (!VALID_SAME_SITE.has(lower)) throw new Error(`[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — must be 'strict', 'lax', or 'none'.`);
+	}
+	if (options.path !== void 0 && ATTR_INJECTION_RE.test(options.path)) throw new Error(`[timber] invalid cookie path ${JSON.stringify(options.path)} — path must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.domain !== void 0 && ATTR_INJECTION_RE.test(options.domain)) throw new Error(`[timber] invalid cookie domain ${JSON.stringify(options.domain)} — domain must not contain ';', CR, or LF (Set-Cookie header injection).`);
+	if (options.maxAge !== void 0 && (typeof options.maxAge !== "number" || !Number.isFinite(options.maxAge))) throw new Error(`[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — maxAge must be a finite number.`);
+}
+function assertValidCookieValue(name, value) {
+	if (typeof value !== "string") throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);
+	const wrapped = value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34;
+	const start = wrapped ? 1 : 0;
+	const end = wrapped ? value.length - 1 : value.length;
+	for (let i = start; i < end; i++) if (!isCookieOctet(value.charCodeAt(i))) throw new Error(`[timber] cookie ${JSON.stringify(name)}: invalid cookie value — disallowed character ${describeChar(value, i)} at index ${i}. Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes (US-ASCII printable, excluding whitespace, \`"\`, \`,\`, \`;\`, and \`\\\`), optionally enclosed in a single DQUOTE pair. Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/cookie@2.0.1/node_modules/cookie/dist/index.js
+/**
+* RegExp to match cookie-name in RFC 6265 sec 4.1.1
+* This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+* which has been replaced by the token definition in RFC 7230 appendix B.
+*
+* cookie-name       = token
+* token             = 1*tchar
+* tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+*                     "*" / "+" / "-" / "." / "^" / "_" /
+*                     "`" / "|" / "~" / DIGIT / ALPHA
+*
+* Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+* Allow same range as cookie value, except `=`, which delimits end of name.
+*/
+var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+/**
+* RegExp to match cookie-value in RFC 6265 sec 4.1.1
+*
+* cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+* cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*                     ; US-ASCII characters excluding CTLs,
+*                     ; whitespace DQUOTE, comma, semicolon,
+*                     ; and backslash
+*
+* Allowing more characters: https://github.com/jshttp/cookie/issues/191
+* Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+*/
+var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+/**
+* RegExp to match domain-value in RFC 6265 sec 4.1.1
+*
+* domain-value      = <subdomain>
+*                     ; defined in [RFC1034], Section 3.5, as
+*                     ; enhanced by [RFC1123], Section 2.1
+* <subdomain>       = <label> | <subdomain> "." <label>
+* <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+*                     Labels must be 63 characters or less.
+*                     'let-dig' not 'letter' in the first char, per RFC1123
+* <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+* <let-dig-hyp>     = <let-dig> | "-"
+* <let-dig>         = <letter> | <digit>
+* <letter>          = any one of the 52 alphabetic characters A through Z in
+*                     upper case and a through z in lower case
+* <digit>           = any one of the ten digits 0 through 9
+*
+* Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+*
+* > (Note that a leading %x2E ("."), if present, is ignored even though that
+* character is not permitted, but a trailing %x2E ("."), if present, will
+* cause the user agent to ignore the attribute.)
+*/
+var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/**
+* RegExp to match path-value in RFC 6265 sec 4.1.1
+*
+* path-value        = <any CHAR except CTLs or ";">
+* CHAR              = %x01-7F
+*                     ; defined in RFC 5234 appendix B.1
+*/
+var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+/**
+* RegExp to match max-age-value in RFC 6265 sec 5.6.2
+*/
+var maxAgeRegExp = /^-?\d+$/;
+/**
+* RegExp to match RFC 6265 cookie-octet values (without % to preserve roundtrip) that need no URL encoding.
+*/
+var cookieOctetRegExp = /^[!#$&'()*+\-.\/0-9:<=>?@A-Z[\]\^_`a-z{|}~]*$/;
+var NullObject = /* @__PURE__ */ (() => {
+	const C = function() {};
+	C.prototype = Object.create(null);
+	return C;
+})();
+/**
+* Parse a `Cookie` header.
+*
+* Parse the given cookie header string into an object
+* The object has the various cookies as keys(names) => values
+*/
+function parseCookie(str, options) {
+	const obj = new NullObject();
+	const len = str.length;
+	if (len < 2) return obj;
+	const dec = options?.decode || decode;
+	let index = 0;
+	do {
+		const eqIdx = eqIndex(str, index, len);
+		if (eqIdx === len) break;
+		const endIdx = endIndex(str, index, len);
+		if (eqIdx > endIdx) {
+			index = str.lastIndexOf(";", eqIdx - 1) + 1;
+			continue;
+		}
+		const key = valueSlice(str, index, eqIdx);
+		if (obj[key] === void 0) obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
+		index = endIdx + 1;
+	} while (index < len);
+	return obj;
+}
+/**
+* Serialize data into a cookie header.
+*
+* Serialize a name value pair into a cookie string suitable for
+* http headers. An optional options object specifies cookie parameters.
+*
+* stringifySetCookie({ name: 'foo', value: 'bar', httpOnly: true })
+*   => "foo=bar; HttpOnly"
+*/
+function stringifySetCookie(cookie, options) {
+	const enc = options?.encode || defaultEncode;
+	if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
+	const value = cookie.value == null ? "" : enc(cookie.value);
+	if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
+	let str = cookie.name + "=" + value;
+	if (cookie.maxAge !== void 0) {
+		if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+		str += "; Max-Age=" + cookie.maxAge;
+	}
+	if (cookie.domain) {
+		if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+		str += "; Domain=" + cookie.domain;
+	}
+	if (cookie.path) {
+		if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
+		str += "; Path=" + cookie.path;
+	}
+	if (cookie.expires) {
+		if (!Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+		str += "; Expires=" + cookie.expires.toUTCString();
+	}
+	if (cookie.httpOnly) str += "; HttpOnly";
+	if (cookie.secure) str += "; Secure";
+	if (cookie.partitioned) str += "; Partitioned";
+	if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
+		case "low":
+			str += "; Priority=Low";
+			break;
+		case "medium":
+			str += "; Priority=Medium";
+			break;
+		case "high":
+			str += "; Priority=High";
+			break;
+		default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+	}
+	if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
+		case true:
+		case "strict":
+			str += "; SameSite=Strict";
+			break;
+		case "lax":
+			str += "; SameSite=Lax";
+			break;
+		case "none":
+			str += "; SameSite=None";
+			break;
+		default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+	}
+	return str;
+}
+/**
+* Deserialize a `Set-Cookie` header into an object.
+*
+* parseSetCookie('foo=bar; HttpOnly')
+*   => { name: 'foo', value: 'bar', httpOnly: true }
+*/
+function parseSetCookie(str, options) {
+	const dec = options?.decode || decode;
+	const len = str.length;
+	const endIdx = endIndex(str, 0, len);
+	let eqIdx = eqIndex(str, 0, len);
+	const setCookie = eqIdx < endIdx ? {
+		name: valueSlice(str, 0, eqIdx),
+		value: dec(valueSlice(str, eqIdx + 1, endIdx))
+	} : {
+		name: "",
+		value: dec(valueSlice(str, 0, endIdx))
+	};
+	let index = endIdx + 1;
+	while (index < len) {
+		const endIdx = endIndex(str, index, len);
+		if (eqIdx < index) eqIdx = eqIndex(str, index, len);
+		const attr = eqIdx < endIdx ? valueSlice(str, index, eqIdx) : valueSlice(str, index, endIdx);
+		const val = eqIdx < endIdx ? valueSlice(str, eqIdx + 1, endIdx) : void 0;
+		switch (attr.toLowerCase()) {
+			case "httponly":
+				setCookie.httpOnly = true;
+				break;
+			case "secure":
+				setCookie.secure = true;
+				break;
+			case "partitioned":
+				setCookie.partitioned = true;
+				break;
+			case "domain":
+				setCookie.domain = val;
+				break;
+			case "path":
+				setCookie.path = val;
+				break;
+			case "max-age":
+				if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Number(val);
+				break;
+			case "expires":
+				if (!val) break;
+				const date = new Date(val);
+				if (Number.isFinite(date.valueOf())) setCookie.expires = date;
+				break;
+			case "priority":
+				if (!val) break;
+				const priority = val.toLowerCase();
+				if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
+				break;
+			case "samesite":
+				if (!val) break;
+				const sameSite = val.toLowerCase();
+				if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
+		}
+		index = endIdx + 1;
+	}
+	return setCookie;
+}
+/**
+* Find the next `;` character, or return `len`.
+*/
+function endIndex(str, min, len) {
+	const index = str.indexOf(";", min);
+	return index === -1 ? len : index;
+}
+/**
+* Find the next `=` character, or return `len`.
+*/
+function eqIndex(str, min, len) {
+	const index = str.indexOf("=", min);
+	return index === -1 ? len : index;
+}
+/**
+* Slice out a value between startPod to max.
+*/
+function valueSlice(str, min, max) {
+	if (min === max) return "";
+	let start = min;
+	let end = max;
+	do {
+		const code = str.charCodeAt(start);
+		if (code !== 32 && code !== 9) break;
+	} while (++start < end);
+	while (end > start) {
+		const code = str.charCodeAt(end - 1);
+		if (code !== 32 && code !== 9) break;
+		end--;
+	}
+	return str.slice(start, end);
+}
+/**
+* URL-decode string value. Optimized to skip native call when no %.
+*/
+function decode(str) {
+	if (str.indexOf("%") === -1) return str;
+	try {
+		return decodeURIComponent(str);
+	} catch (e) {
+		return str;
+	}
+}
+/**
+* URL-encode string value. Optimized to skip native call for roundtrip-safe cookie-octet values.
+*/
+function defaultEncode(str) {
+	return cookieOctetRegExp.test(str) ? str : encodeURIComponent(str);
+}
+//#endregion
+export { assertValidCookieOptions as a, assertValidCookieName as i, parseSetCookie as n, assertValidCookieValue as o, stringifySetCookie as r, parseCookie as t };
+
+//# sourceMappingURL=dist-DtrJyBbw.js.map

package/dist/_chunks/dist-DtrJyBbw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-DtrJyBbw.js","names":[],"sources":["../../src/cookies/validation.ts","../../../../node_modules/.pnpm/cookie@2.0.1/node_modules/cookie/dist/index.js"],"sourcesContent":["/**\n * Cookie name and value validation per RFC 6265 §4.1.1.\n *\n * This module is pure — no server or client imports — so it can be loaded\n * by both `server/request-context.ts` (which guards `getCookies().set()`)\n * and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The\n * shared validator gives both sides identical encoding contracts:\n * **the framework never silently encodes — callers emit `cookie-octet`\n * bytes or get a developer-facing error.**\n *\n * Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and\n * design/29-cookies.md §\"Cookie Name and Value Validation\".\n */\n\n// ─── RFC 6265 cookie-octet ────────────────────────────────────────────────\n//\n//   cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n//\n// Equivalently: US-ASCII printable bytes excluding whitespace, `\"` (0x22),\n// `,` (0x2C), `;` (0x3B), `\\` (0x5C), and DEL (0x7F).\n\n/**\n * RFC 7230 §3.2.6 token characters used as the cookie-name production in\n * RFC 6265 §4.1.1. Anchored, non-empty match.\n *\n * Allowed: US-ASCII letters, digits, and `!#$%&'*+-.^_` `` ` `` `|~`.\n * Disallowed: whitespace, controls, delimiters\n * (`(` `)` `<` `>` `@` `,` `;` `:` `\\` `\"` `/` `[` `]` `?` `=` `{` `}`).\n */\nconst COOKIE_NAME_RE = /^[!#$%&'*+\\-.0-9A-Z^_`a-z|~]+$/;\n\n/**\n * Format a single byte for a clear error message — escape control bytes\n * and non-ASCII as `0x..` and quote printables.\n */\nfunction describeChar(value: string, index: number): string {\n  const code = value.charCodeAt(index);\n  if (code < 0x20 || code === 0x7f || code > 0x7e) {\n    return `0x${code.toString(16).padStart(2, '0')}`;\n  }\n  return JSON.stringify(value[index]);\n}\n\n/**\n * Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.\n * Throws a developer-facing error naming the offending byte and its index.\n */\nexport function assertValidCookieName(name: string): void {\n  if (typeof name !== 'string' || name.length === 0) {\n    throw new Error('[timber] cookie name must be a non-empty string.');\n  }\n  if (!COOKIE_NAME_RE.test(name)) {\n    for (let i = 0; i < name.length; i++) {\n      if (!COOKIE_NAME_RE.test(name[i])) {\n        throw new Error(\n          `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n            `disallowed character ${describeChar(name, i)} at index ${i}. ` +\n            `Cookie names must match the RFC 6265 §4.1.1 token grammar (US-ASCII letters, digits, ` +\n            `and \\`!#$%&'*+-.^_\\`|~\\`; no whitespace, controls, or delimiters).`\n        );\n      }\n    }\n    throw new Error(\n      `[timber] invalid cookie name ${JSON.stringify(name)} — ` +\n        `must match RFC 6265 §4.1.1 token grammar.`\n    );\n  }\n}\n\n/** Single-byte test for RFC 6265 §4.1.1 cookie-octet. */\nfunction isCookieOctet(code: number): boolean {\n  return (\n    code === 0x21 ||\n    (code >= 0x23 && code <= 0x2b) ||\n    (code >= 0x2d && code <= 0x3a) ||\n    (code >= 0x3c && code <= 0x5b) ||\n    (code >= 0x5d && code <= 0x7e)\n  );\n}\n\n/**\n * Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`\n * production:\n *\n *     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n *     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *\n * Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are\n * valid. The wrapped form is common in upstream `Set-Cookie` headers\n * (e.g. `sid=\"abc\"; Path=/`) and must be forwardable through\n * `setFromHeaders` verbatim — stripping or rejecting the surrounding\n * quotes would corrupt the on-the-wire bytes and break value semantics\n * for the upstream service.\n *\n * Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),\n * interior DQUOTE, comma, semicolon, backslash, DEL, and anything\n * non-ASCII. The smuggling primitive (`;`) is rejected regardless of\n * wrapping.\n *\n * Throws a developer-facing error naming the offending byte and its\n * index. Callers passing user-controlled data through the default\n * `set()` path don't need to call this — `set()` auto-encodes via\n * `encodeURIComponent`, whose output is always valid cookie-octet.\n * This validator is for the `{ raw: true }` opt-out and for\n * `setFromHeaders` forwarding.\n */\n// ─── Cookie attribute validation ──────────────────────────────────────────\n\n/**\n * Characters that must not appear in path or domain cookie attributes.\n * Semicolons delimit cookie attributes on the wire, so allowing `;` in\n * path or domain would inject extra attributes. CR/LF enable HTTP header\n * injection.\n */\nconst ATTR_INJECTION_RE = /[;\\r\\n]/;\n\nconst VALID_SAME_SITE = new Set(['strict', 'lax', 'none']);\n\n/**\n * Validate cookie option attributes at runtime to prevent Set-Cookie\n * header injection through unsanitized option values.\n *\n * TypeScript types enforce correct shapes at compile time, but at runtime\n * (e.g. from untyped libraries or user-controlled config) invalid values\n * could inject additional Set-Cookie attributes.\n */\nexport function assertValidCookieOptions(options: {\n  sameSite?: string;\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n}): void {\n  if (options.sameSite !== undefined) {\n    const lower = options.sameSite.toLowerCase();\n    if (!VALID_SAME_SITE.has(lower)) {\n      throw new Error(\n        `[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — ` +\n          `must be 'strict', 'lax', or 'none'.`\n      );\n    }\n  }\n  if (options.path !== undefined && ATTR_INJECTION_RE.test(options.path)) {\n    throw new Error(\n      `[timber] invalid cookie path ${JSON.stringify(options.path)} — ` +\n        `path must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (options.domain !== undefined && ATTR_INJECTION_RE.test(options.domain)) {\n    throw new Error(\n      `[timber] invalid cookie domain ${JSON.stringify(options.domain)} — ` +\n        `domain must not contain ';', CR, or LF (Set-Cookie header injection).`\n    );\n  }\n  if (\n    options.maxAge !== undefined &&\n    (typeof options.maxAge !== 'number' || !Number.isFinite(options.maxAge))\n  ) {\n    throw new Error(\n      `[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — ` +\n        `maxAge must be a finite number.`\n    );\n  }\n}\n\nexport function assertValidCookieValue(name: string, value: string): void {\n  if (typeof value !== 'string') {\n    throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);\n  }\n  // Detect the DQUOTE-wrapped form: at least two characters and both\n  // endpoints are `\"`. The interior must be pure cookie-octet (no\n  // interior DQUOTEs allowed — the grammar says *cookie-octet, and\n  // cookie-octet excludes 0x22).\n  const wrapped =\n    value.length >= 2 &&\n    value.charCodeAt(0) === 0x22 &&\n    value.charCodeAt(value.length - 1) === 0x22;\n  const start = wrapped ? 1 : 0;\n  const end = wrapped ? value.length - 1 : value.length;\n  for (let i = start; i < end; i++) {\n    const code = value.charCodeAt(i);\n    if (!isCookieOctet(code)) {\n      throw new Error(\n        `[timber] cookie ${JSON.stringify(name)}: invalid cookie value — ` +\n          `disallowed character ${describeChar(value, i)} at index ${i}. ` +\n          `Cookie values must contain only RFC 6265 §4.1.1 cookie-octet bytes ` +\n          `(US-ASCII printable, excluding whitespace, \\`\"\\`, \\`,\\`, \\`;\\`, and \\`\\\\\\`), ` +\n          `optionally enclosed in a single DQUOTE pair. ` +\n          `Encode the value (e.g. encodeURIComponent or jsonCookieCodec) before storing it.`\n      );\n    }\n  }\n}\n","/**\n * RegExp to match cookie-name in RFC 6265 sec 4.1.1\n * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2\n * which has been replaced by the token definition in RFC 7230 appendix B.\n *\n * cookie-name       = token\n * token             = 1*tchar\n * tchar             = \"!\" / \"#\" / \"$\" / \"%\" / \"&\" / \"'\" /\n *                     \"*\" / \"+\" / \"-\" / \".\" / \"^\" / \"_\" /\n *                     \"`\" / \"|\" / \"~\" / DIGIT / ALPHA\n *\n * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191\n * Allow same range as cookie value, except `=`, which delimits end of name.\n */\nconst cookieNameRegExp = /^[\\u0021-\\u003A\\u003C\\u003E-\\u007E]+$/;\n/**\n * RegExp to match cookie-value in RFC 6265 sec 4.1.1\n *\n * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *                     ; US-ASCII characters excluding CTLs,\n *                     ; whitespace DQUOTE, comma, semicolon,\n *                     ; and backslash\n *\n * Allowing more characters: https://github.com/jshttp/cookie/issues/191\n * Comma, backslash, and DQUOTE are not part of the parsing algorithm.\n */\nconst cookieValueRegExp = /^[\\u0021-\\u003A\\u003C-\\u007E]*$/;\n/**\n * RegExp to match domain-value in RFC 6265 sec 4.1.1\n *\n * domain-value      = <subdomain>\n *                     ; defined in [RFC1034], Section 3.5, as\n *                     ; enhanced by [RFC1123], Section 2.1\n * <subdomain>       = <label> | <subdomain> \".\" <label>\n * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]\n *                     Labels must be 63 characters or less.\n *                     'let-dig' not 'letter' in the first char, per RFC1123\n * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>\n * <let-dig-hyp>     = <let-dig> | \"-\"\n * <let-dig>         = <letter> | <digit>\n * <letter>          = any one of the 52 alphabetic characters A through Z in\n *                     upper case and a through z in lower case\n * <digit>           = any one of the ten digits 0 through 9\n *\n * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173\n *\n * > (Note that a leading %x2E (\".\"), if present, is ignored even though that\n * character is not permitted, but a trailing %x2E (\".\"), if present, will\n * cause the user agent to ignore the attribute.)\n */\nconst domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;\n/**\n * RegExp to match path-value in RFC 6265 sec 4.1.1\n *\n * path-value        = <any CHAR except CTLs or \";\">\n * CHAR              = %x01-7F\n *                     ; defined in RFC 5234 appendix B.1\n */\nconst pathValueRegExp = /^[\\u0020-\\u003A\\u003D-\\u007E]*$/;\n/**\n * RegExp to match max-age-value in RFC 6265 sec 5.6.2\n */\nconst maxAgeRegExp = /^-?\\d+$/;\n/**\n * RegExp to match RFC 6265 cookie-octet values (without % to preserve roundtrip) that need no URL encoding.\n */\nconst cookieOctetRegExp = /^[!#$&'()*+\\-.\\/0-9:<=>?@A-Z[\\]\\^_`a-z{|}~]*$/;\nconst NullObject = /* @__PURE__ */ (() => {\n    const C = function () { };\n    C.prototype = Object.create(null);\n    return C;\n})();\n/**\n * Parse a `Cookie` header.\n *\n * Parse the given cookie header string into an object\n * The object has the various cookies as keys(names) => values\n */\nexport function parseCookie(str, options) {\n    const obj = new NullObject();\n    const len = str.length;\n    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.\n    if (len < 2)\n        return obj;\n    const dec = options?.decode || decode;\n    let index = 0;\n    do {\n        const eqIdx = eqIndex(str, index, len);\n        if (eqIdx === len)\n            break; // No more cookie pairs.\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx > endIdx) {\n            // backtrack on prior semicolon\n            index = str.lastIndexOf(\";\", eqIdx - 1) + 1;\n            continue;\n        }\n        const key = valueSlice(str, index, eqIdx);\n        // only assign once\n        if (obj[key] === undefined) {\n            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));\n        }\n        index = endIdx + 1;\n    } while (index < len);\n    return obj;\n}\n/**\n * Stringifies an object into an HTTP `Cookie` header.\n */\nexport function stringifyCookie(cookie, options) {\n    const enc = options?.encode || defaultEncode;\n    const keys = Object.keys(cookie);\n    let str = \"\";\n    for (let i = 0; i < keys.length; i++) {\n        const name = keys[i];\n        const val = cookie[name];\n        if (val === undefined)\n            continue;\n        if (!cookieNameRegExp.test(name)) {\n            throw new TypeError(`cookie name is invalid: ${name}`);\n        }\n        const value = enc(val);\n        if (!cookieValueRegExp.test(value)) {\n            throw new TypeError(`cookie val is invalid: ${val}`);\n        }\n        if (str)\n            str += \"; \";\n        str += name + \"=\" + value;\n    }\n    return str;\n}\n/**\n * Serialize data into a cookie header.\n *\n * Serialize a name value pair into a cookie string suitable for\n * http headers. An optional options object specifies cookie parameters.\n *\n * stringifySetCookie({ name: 'foo', value: 'bar', httpOnly: true })\n *   => \"foo=bar; HttpOnly\"\n */\nexport function stringifySetCookie(cookie, options) {\n    const enc = options?.encode || defaultEncode;\n    if (!cookieNameRegExp.test(cookie.name)) {\n        throw new TypeError(`argument name is invalid: ${cookie.name}`);\n    }\n    const value = cookie.value == null ? \"\" : enc(cookie.value);\n    if (!cookieValueRegExp.test(value)) {\n        throw new TypeError(`argument val is invalid: ${cookie.value}`);\n    }\n    let str = cookie.name + \"=\" + value;\n    if (cookie.maxAge !== undefined) {\n        if (!Number.isInteger(cookie.maxAge)) {\n            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);\n        }\n        str += \"; Max-Age=\" + cookie.maxAge;\n    }\n    if (cookie.domain) {\n        if (!domainValueRegExp.test(cookie.domain)) {\n            throw new TypeError(`option domain is invalid: ${cookie.domain}`);\n        }\n        str += \"; Domain=\" + cookie.domain;\n    }\n    if (cookie.path) {\n        if (!pathValueRegExp.test(cookie.path)) {\n            throw new TypeError(`option path is invalid: ${cookie.path}`);\n        }\n        str += \"; Path=\" + cookie.path;\n    }\n    if (cookie.expires) {\n        if (!Number.isFinite(cookie.expires.valueOf())) {\n            throw new TypeError(`option expires is invalid: ${cookie.expires}`);\n        }\n        str += \"; Expires=\" + cookie.expires.toUTCString();\n    }\n    if (cookie.httpOnly) {\n        str += \"; HttpOnly\";\n    }\n    if (cookie.secure) {\n        str += \"; Secure\";\n    }\n    if (cookie.partitioned) {\n        str += \"; Partitioned\";\n    }\n    if (cookie.priority) {\n        const priority = typeof cookie.priority === \"string\"\n            ? cookie.priority.toLowerCase()\n            : undefined;\n        switch (priority) {\n            case \"low\":\n                str += \"; Priority=Low\";\n                break;\n            case \"medium\":\n                str += \"; Priority=Medium\";\n                break;\n            case \"high\":\n                str += \"; Priority=High\";\n                break;\n            default:\n                throw new TypeError(`option priority is invalid: ${cookie.priority}`);\n        }\n    }\n    if (cookie.sameSite) {\n        const sameSite = typeof cookie.sameSite === \"string\"\n            ? cookie.sameSite.toLowerCase()\n            : cookie.sameSite;\n        switch (sameSite) {\n            case true:\n            case \"strict\":\n                str += \"; SameSite=Strict\";\n                break;\n            case \"lax\":\n                str += \"; SameSite=Lax\";\n                break;\n            case \"none\":\n                str += \"; SameSite=None\";\n                break;\n            default:\n                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);\n        }\n    }\n    return str;\n}\n/**\n * Deserialize a `Set-Cookie` header into an object.\n *\n * parseSetCookie('foo=bar; HttpOnly')\n *   => { name: 'foo', value: 'bar', httpOnly: true }\n */\nexport function parseSetCookie(str, options) {\n    const dec = options?.decode || decode;\n    const len = str.length;\n    const endIdx = endIndex(str, 0, len);\n    let eqIdx = eqIndex(str, 0, len);\n    const setCookie = eqIdx < endIdx\n        ? {\n            name: valueSlice(str, 0, eqIdx),\n            value: dec(valueSlice(str, eqIdx + 1, endIdx)),\n        }\n        : { name: \"\", value: dec(valueSlice(str, 0, endIdx)) };\n    let index = endIdx + 1;\n    while (index < len) {\n        const endIdx = endIndex(str, index, len);\n        if (eqIdx < index)\n            eqIdx = eqIndex(str, index, len);\n        const attr = eqIdx < endIdx\n            ? valueSlice(str, index, eqIdx)\n            : valueSlice(str, index, endIdx);\n        const val = eqIdx < endIdx ? valueSlice(str, eqIdx + 1, endIdx) : undefined;\n        switch (attr.toLowerCase()) {\n            case \"httponly\":\n                setCookie.httpOnly = true;\n                break;\n            case \"secure\":\n                setCookie.secure = true;\n                break;\n            case \"partitioned\":\n                setCookie.partitioned = true;\n                break;\n            case \"domain\":\n                setCookie.domain = val;\n                break;\n            case \"path\":\n                setCookie.path = val;\n                break;\n            case \"max-age\":\n                if (val && maxAgeRegExp.test(val))\n                    setCookie.maxAge = Number(val);\n                break;\n            case \"expires\":\n                if (!val)\n                    break;\n                const date = new Date(val);\n                if (Number.isFinite(date.valueOf()))\n                    setCookie.expires = date;\n                break;\n            case \"priority\":\n                if (!val)\n                    break;\n                const priority = val.toLowerCase();\n                if (priority === \"low\" ||\n                    priority === \"medium\" ||\n                    priority === \"high\") {\n                    setCookie.priority = priority;\n                }\n                break;\n            case \"samesite\":\n                if (!val)\n                    break;\n                const sameSite = val.toLowerCase();\n                if (sameSite === \"lax\" ||\n                    sameSite === \"strict\" ||\n                    sameSite === \"none\") {\n                    setCookie.sameSite = sameSite;\n                }\n                break;\n        }\n        index = endIdx + 1;\n    }\n    return setCookie;\n}\n/**\n * Find the next `;` character, or return `len`.\n */\nfunction endIndex(str, min, len) {\n    const index = str.indexOf(\";\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Find the next `=` character, or return `len`.\n */\nfunction eqIndex(str, min, len) {\n    const index = str.indexOf(\"=\", min);\n    return index === -1 ? len : index;\n}\n/**\n * Slice out a value between startPod to max.\n */\nfunction valueSlice(str, min, max) {\n    if (min === max)\n        return \"\";\n    let start = min;\n    let end = max;\n    do {\n        const code = str.charCodeAt(start);\n        if (code !== 32 /*   */ && code !== 9 /* \\t */)\n            break;\n    } while (++start < end);\n    while (end > start) {\n        const code = str.charCodeAt(end - 1);\n        if (code !== 32 /*   */ && code !== 9 /* \\t */)\n            break;\n        end--;\n    }\n    return str.slice(start, end);\n}\n/**\n * URL-decode string value. Optimized to skip native call when no %.\n */\nfunction decode(str) {\n    if (str.indexOf(\"%\") === -1)\n        return str;\n    try {\n        return decodeURIComponent(str);\n    }\n    catch (e) {\n        return str;\n    }\n}\n/**\n * URL-encode string value. Optimized to skip native call for roundtrip-safe cookie-octet values.\n */\nfunction defaultEncode(str) {\n    return cookieOctetRegExp.test(str) ? str : encodeURIComponent(str);\n}\n//# sourceMappingURL=index.js.map"],"x_google_ignoreList":[1],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,iBAAiB;;;;;AAMvB,SAAS,aAAa,OAAe,OAAuB;CAC1D,MAAM,OAAO,MAAM,WAAW,KAAK;CACnC,IAAI,OAAO,MAAQ,SAAS,OAAQ,OAAO,KACzC,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CAE/C,OAAO,KAAK,UAAU,MAAM,MAAM;AACpC;;;;;AAMA,SAAgB,sBAAsB,MAAoB;CACxD,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,CAAC,eAAe,KAAK,IAAI,GAAG;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,GAC9B,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,0BAC3B,aAAa,MAAM,CAAC,EAAE,YAAY,EAAE,0JAGhE;EAGJ,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,IAAI,EAAE,6CAEvD;CACF;AACF;;AAGA,SAAS,cAAc,MAAuB;CAC5C,OACE,SAAS,MACR,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ,MACxB,QAAQ,MAAQ,QAAQ;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAoB;AAE1B,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAU;CAAO;AAAM,CAAC;;;;;;;;;AAUzD,SAAgB,yBAAyB,SAKhC;CACP,IAAI,QAAQ,aAAa,KAAA,GAAW;EAClC,MAAM,QAAQ,QAAQ,SAAS,YAAY;EAC3C,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAC5B,MAAM,IAAI,MACR,0CAA0C,KAAK,UAAU,QAAQ,QAAQ,EAAE,uCAE7E;CAEJ;CACA,IAAI,QAAQ,SAAS,KAAA,KAAa,kBAAkB,KAAK,QAAQ,IAAI,GACnE,MAAM,IAAI,MACR,gCAAgC,KAAK,UAAU,QAAQ,IAAI,EAAE,uEAE/D;CAEF,IAAI,QAAQ,WAAW,KAAA,KAAa,kBAAkB,KAAK,QAAQ,MAAM,GACvE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,yEAEnE;CAEF,IACE,QAAQ,WAAW,KAAA,MAClB,OAAO,QAAQ,WAAW,YAAY,CAAC,OAAO,SAAS,QAAQ,MAAM,IAEtE,MAAM,IAAI,MACR,kCAAkC,KAAK,UAAU,QAAQ,MAAM,EAAE,mCAEnE;AAEJ;AAEA,SAAgB,uBAAuB,MAAc,OAAqB;CACxE,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,IAAI,EAAE,iCAAiC;CAM3F,MAAM,UACJ,MAAM,UAAU,KAChB,MAAM,WAAW,CAAC,MAAM,MACxB,MAAM,WAAW,MAAM,SAAS,CAAC,MAAM;CACzC,MAAM,QAAQ,UAAU,IAAI;CAC5B,MAAM,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM;CAC/C,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,KAE3B,IAAI,CAAC,cADQ,MAAM,WAAW,CACX,CAAI,GACrB,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,IAAI,EAAE,gDACd,aAAa,OAAO,CAAC,EAAE,YAAY,EAAE,gRAKjE;AAGN;;;;;;;;;;;;;;;;;ACjLA,IAAM,mBAAmB;;;;;;;;;;;;;AAazB,IAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;AAwB1B,IAAM,oBAAoB;;;;;;;;AAQ1B,IAAM,kBAAkB;;;;AAIxB,IAAM,eAAe;;;;AAIrB,IAAM,oBAAoB;AAC1B,IAAM,aAA6B,uBAAO;CACtC,MAAM,IAAI,WAAY,CAAE;CACxB,EAAE,YAAY,OAAO,OAAO,IAAI;CAChC,OAAO;AACX,EAAA,CAAG;;;;;;;AAOH,SAAgB,YAAY,KAAK,SAAS;CACtC,MAAM,MAAM,IAAI,WAAW;CAC3B,MAAM,MAAM,IAAI;CAEhB,IAAI,MAAM,GACN,OAAO;CACX,MAAM,MAAM,SAAS,UAAU;CAC/B,IAAI,QAAQ;CACZ,GAAG;EACC,MAAM,QAAQ,QAAQ,KAAK,OAAO,GAAG;EACrC,IAAI,UAAU,KACV;EACJ,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;EACvC,IAAI,QAAQ,QAAQ;GAEhB,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC,IAAI;GAC1C;EACJ;EACA,MAAM,MAAM,WAAW,KAAK,OAAO,KAAK;EAExC,IAAI,IAAI,SAAS,KAAA,GACb,IAAI,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;EAErD,QAAQ,SAAS;CACrB,SAAS,QAAQ;CACjB,OAAO;AACX;;;;;;;;;;AAmCA,SAAgB,mBAAmB,QAAQ,SAAS;CAChD,MAAM,MAAM,SAAS,UAAU;CAC/B,IAAI,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAClC,MAAM,IAAI,UAAU,6BAA6B,OAAO,MAAM;CAElE,MAAM,QAAQ,OAAO,SAAS,OAAO,KAAK,IAAI,OAAO,KAAK;CAC1D,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC7B,MAAM,IAAI,UAAU,4BAA4B,OAAO,OAAO;CAElE,IAAI,MAAM,OAAO,OAAO,MAAM;CAC9B,IAAI,OAAO,WAAW,KAAA,GAAW;EAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,MAAM,GAC/B,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAEpE,OAAO,eAAe,OAAO;CACjC;CACA,IAAI,OAAO,QAAQ;EACf,IAAI,CAAC,kBAAkB,KAAK,OAAO,MAAM,GACrC,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAEpE,OAAO,cAAc,OAAO;CAChC;CACA,IAAI,OAAO,MAAM;EACb,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,GACjC,MAAM,IAAI,UAAU,2BAA2B,OAAO,MAAM;EAEhE,OAAO,YAAY,OAAO;CAC9B;CACA,IAAI,OAAO,SAAS;EAChB,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC,GACzC,MAAM,IAAI,UAAU,8BAA8B,OAAO,SAAS;EAEtE,OAAO,eAAe,OAAO,QAAQ,YAAY;CACrD;CACA,IAAI,OAAO,UACP,OAAO;CAEX,IAAI,OAAO,QACP,OAAO;CAEX,IAAI,OAAO,aACP,OAAO;CAEX,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,KAAA,GACN;EACI,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAC5E;CAEJ,IAAI,OAAO,UAIP,QAHiB,OAAO,OAAO,aAAa,WACtC,OAAO,SAAS,YAAY,IAC5B,OAAO,UACb;EACI,KAAK;EACL,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,KAAK;GACD,OAAO;GACP;EACJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAC5E;CAEJ,OAAO;AACX;;;;;;;AAOA,SAAgB,eAAe,KAAK,SAAS;CACzC,MAAM,MAAM,SAAS,UAAU;CAC/B,MAAM,MAAM,IAAI;CAChB,MAAM,SAAS,SAAS,KAAK,GAAG,GAAG;CACnC,IAAI,QAAQ,QAAQ,KAAK,GAAG,GAAG;CAC/B,MAAM,YAAY,QAAQ,SACpB;EACE,MAAM,WAAW,KAAK,GAAG,KAAK;EAC9B,OAAO,IAAI,WAAW,KAAK,QAAQ,GAAG,MAAM,CAAC;CACjD,IACE;EAAE,MAAM;EAAI,OAAO,IAAI,WAAW,KAAK,GAAG,MAAM,CAAC;CAAE;CACzD,IAAI,QAAQ,SAAS;CACrB,OAAO,QAAQ,KAAK;EAChB,MAAM,SAAS,SAAS,KAAK,OAAO,GAAG;EACvC,IAAI,QAAQ,OACR,QAAQ,QAAQ,KAAK,OAAO,GAAG;EACnC,MAAM,OAAO,QAAQ,SACf,WAAW,KAAK,OAAO,KAAK,IAC5B,WAAW,KAAK,OAAO,MAAM;EACnC,MAAM,MAAM,QAAQ,SAAS,WAAW,KAAK,QAAQ,GAAG,MAAM,IAAI,KAAA;EAClE,QAAQ,KAAK,YAAY,GAAzB;GACI,KAAK;IACD,UAAU,WAAW;IACrB;GACJ,KAAK;IACD,UAAU,SAAS;IACnB;GACJ,KAAK;IACD,UAAU,cAAc;IACxB;GACJ,KAAK;IACD,UAAU,SAAS;IACnB;GACJ,KAAK;IACD,UAAU,OAAO;IACjB;GACJ,KAAK;IACD,IAAI,OAAO,aAAa,KAAK,GAAG,GAC5B,UAAU,SAAS,OAAO,GAAG;IACjC;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,OAAO,IAAI,KAAK,GAAG;IACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,GAC9B,UAAU,UAAU;IACxB;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,WAAW,IAAI,YAAY;IACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;IAEzB;GACJ,KAAK;IACD,IAAI,CAAC,KACD;IACJ,MAAM,WAAW,IAAI,YAAY;IACjC,IAAI,aAAa,SACb,aAAa,YACb,aAAa,QACb,UAAU,WAAW;EAGjC;EACA,QAAQ,SAAS;CACrB;CACA,OAAO;AACX;;;;AAIA,SAAS,SAAS,KAAK,KAAK,KAAK;CAC7B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;CAClC,OAAO,UAAU,KAAK,MAAM;AAChC;;;;AAIA,SAAS,QAAQ,KAAK,KAAK,KAAK;CAC5B,MAAM,QAAQ,IAAI,QAAQ,KAAK,GAAG;CAClC,OAAO,UAAU,KAAK,MAAM;AAChC;;;;AAIA,SAAS,WAAW,KAAK,KAAK,KAAK;CAC/B,IAAI,QAAQ,KACR,OAAO;CACX,IAAI,QAAQ;CACZ,IAAI,MAAM;CACV,GAAG;EACC,MAAM,OAAO,IAAI,WAAW,KAAK;EACjC,IAAI,SAAS,MAAc,SAAS,GAChC;CACR,SAAS,EAAE,QAAQ;CACnB,OAAO,MAAM,OAAO;EAChB,MAAM,OAAO,IAAI,WAAW,MAAM,CAAC;EACnC,IAAI,SAAS,MAAc,SAAS,GAChC;EACJ;CACJ;CACA,OAAO,IAAI,MAAM,OAAO,GAAG;AAC/B;;;;AAIA,SAAS,OAAO,KAAK;CACjB,IAAI,IAAI,QAAQ,GAAG,MAAM,IACrB,OAAO;CACX,IAAI;EACA,OAAO,mBAAmB,GAAG;CACjC,SACO,GAAG;EACN,OAAO;CACX;AACJ;;;;AAIA,SAAS,cAAc,KAAK;CACxB,OAAO,kBAAkB,KAAK,GAAG,IAAI,MAAM,mBAAmB,GAAG;AACrE"}