@timber-js/app 0.2.0-alpha.2 → 0.2.0-alpha.200

package/dist/_chunks/fs-identity-D7vb6GdI.js

@@ -0,0 +1,208 @@
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { rm, stat, writeFile } from "node:fs/promises";
+//#region src/shared/static-platform-files.ts
+/**
+* Platform files the static build is allowed to overwrite in the output.
+*
+* The build merges two trees into the deployed directory — the client bundle
+* (which carries everything the user put in `public/`) and the pre-rendered
+* site. That merge otherwise refuses overlaps, because a silent overwrite
+* leaves one of two artifacts deployed with nothing recording which
+* (TIM-1266).
+*
+* These names are the exception, and only because the pre-rendered copy is
+* *derived from* the one it replaces rather than competing with it:
+* `plugins/static-build.ts` reads `public/_redirects` and writes the
+* generated rules plus the user's, so the winner is a superset of the loser.
+*
+* That holds only for a file the current pass produced, which is why
+* `cleanConditionalArtifacts` deletes a previous build's `_redirects` before
+* generation: written only when a pass finds redirects, it would otherwise
+* survive into a pass that produced nothing and claim an exemption it no
+* longer earns.
+*
+* `_headers` is NOT here. It is not written into the pre-rendered tree at
+* all — adapters generate it directly into the output, folding in the
+* user's copy as they go (TIM-1326).
+*
+* Declared once so the code that performs the merge and the code that
+* produces the merged file cannot disagree about which names are exempt.
+*
+* Isomorphic: no server, client, or build-time imports.
+*/
+/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */
+var REDIRECTS_FILE = "_redirects";
+/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */
+var HEADERS_FILE = "_headers";
+/**
+* Where a user authors platform files. Stated once because two modules read
+* from here — `plugins/static-build.ts` for `_redirects`, adapters for
+* `_headers` — and they must look in the same place.
+*
+* Both read the **project source**, never the build output. The generated
+* file lands under the same name in the output directory, so a reader aimed
+* there would fold the previous build's generated rules back in and compound
+* them on every rebuild.
+*/
+var USER_PLATFORM_DIR = "public";
+/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */
+var USER_MERGED_PLATFORM_FILES = [REDIRECTS_FILE];
+/**
+* Output paths the framework writes itself, which no route may claim.
+*
+* These are written outside the per-entry writer — `_redirects` after
+* generation, `_headers` by the adapter after the copy — so the collision
+* tracker never sees them and a route rendering to one of these paths is
+* overwritten with nothing recording it.
+*
+* Reserved rather than tracked, because there is no version of "serve a route
+* at `/_headers`" that works: Cloudflare Pages and Netlify read these two
+* files themselves and never serve them, so the route is unservable however
+* the conflict is resolved.
+*
+* That justification is per-file, not per-mechanism. `.nojekyll` is written
+* the same way and is deliberately NOT here: only the `github-pages` target
+* writes it, and everywhere else `/.nojekyll` is an ordinary servable path,
+* so reserving it globally would refuse a valid Cloudflare site. Its write
+* site skips the write when a file is already there instead — GitHub Pages
+* only cares that the file exists.
+*
+* Same reasoning as the synthetic 404 entry using an internal urlPath so a
+* real `/404` route cannot collide with `404.html`.
+*/
+var RESERVED_OUTPUT_PATHS = [REDIRECTS_FILE, HEADERS_FILE];
+//#endregion
+//#region src/adapters/fs-identity.ts
+/**
+* What the output filesystem considers "the same file".
+*
+* Two build steps compare paths to decide whether two artifacts would land on
+* one file — the render pass (`plugins/static-build.ts`) and the adapter's
+* tree merge (`build-output-helper.ts`). Both are predicting a filesystem
+* decision, so both ask the filesystem rather than comparing raw strings
+* (TIM-1266).
+*
+* Two properties matter, and they are independent:
+*
+* - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does
+*   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on
+*   Linux CI.
+* - **Unicode normalization.** APFS compares normalization-insensitively, so
+*   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one
+*   file. This holds even on a *case-sensitive* APFS volume, which is why it
+*   is probed separately rather than inferred from case folding.
+*
+* Probed rather than read off `process.platform`: a case-sensitive volume on
+* macOS and a case-insensitive mount on Linux are both ordinary, and the
+* answer that matters is the one for the directory being written.
+*
+* Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,
+* which `server/asset-headers.ts` re-exports from and which therefore must
+* stay free of `node:fs` for the Workers bundle.
+*/
+/** Every path comparison is exact — the conservative answer when unprobed. */
+var EXACT_FS_IDENTITY = {
+	caseInsensitive: false,
+	normalizationInsensitive: false,
+	stripsTrailingDotsAndSpaces: false
+};
+/**
+* Probe `dir` by writing one file and asking for it under other spellings.
+*
+* Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That
+* under-detects, but a directory this cannot write to is one the caller is
+* about to fail on anyway, with a clearer error than a missed collision.
+*/
+async function detectFsIdentity(dir) {
+	const name = `.timber-probe-${randomUUID()}-café`;
+	const path = join(dir, name);
+	try {
+		await writeFile(path, "");
+		const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] = await Promise.all([
+			exists(join(dir, name.toUpperCase())),
+			exists(join(dir, name.normalize("NFD"))),
+			exists(join(dir, `${name}.`))
+		]);
+		return {
+			caseInsensitive,
+			normalizationInsensitive,
+			stripsTrailingDotsAndSpaces
+		};
+	} catch {
+		return EXACT_FS_IDENTITY;
+	} finally {
+		await rm(path, { force: true }).catch(() => {});
+	}
+}
+/**
+* Fold a path to the identity the filesystem compares it under.
+*
+* Normalization first, then case: `toLowerCase()` operates per code point, so
+* folding a decomposed string first would leave the combining marks in a
+* different order than folding a precomposed one.
+*
+* An approximation of the filesystem's own algorithm — APFS and NTFS fold per
+* their own Unicode tables, which `toLowerCase()` matches for everything short
+* of the exotic. It errs toward *finding* a collision, and the cost of a false
+* positive is a build error naming two routes rather than a silent overwrite.
+*/
+function fsKey(path, identity) {
+	let key = identity.caseInsensitive ? caseFold(path) : path;
+	if (identity.normalizationInsensitive) key = key.normalize("NFC");
+	if (identity.stripsTrailingDotsAndSpaces) key = key.split("/").map(stripTrailing).join("/");
+	return key;
+}
+/**
+* Approximate Unicode case folding, which is what case-insensitive
+* filesystems actually compare under.
+*
+* `toLowerCase()` is not it. Greek `σ` and final `ς` are both already
+* lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS
+* folds `ς` to `σ` — so two routes differing only in that letter are one file
+* on both, and a lowercase key admitted them as two claims (TIM-1266).
+* Uppercasing first collapses them.
+*
+* The residual is over-folding, in these cases and a few like them:
+*
+* | pair      | folded together here | NTFS / APFS       |
+* | --------- | -------------------- | ----------------- |
+* | `σ` / `ς` | yes                  | yes — the fix     |
+* | `ß` / `ss`| yes                  | no                |
+* | `ı` / `i` | yes                  | no                |
+* | `fi` / `fi`| yes                  | no                |
+*
+* That direction is deliberate. Over-folding costs a build error naming two
+* routes, which a developer fixes by renaming one; under-folding costs a
+* payload silently overwritten by another route's, which nothing downstream
+* can detect. An exact fold would need `Intl.Collator`, which compares but
+* emits no sort key, so using it would turn a hash lookup into a pairwise
+* scan over every claimed path.
+*/
+function caseFold(value) {
+	return value.toUpperCase().toLowerCase();
+}
+/**
+* Drop trailing dots and spaces from one path segment, as Win32 does.
+*
+* A segment that is nothing but dots and spaces is left alone: `.` and `..`
+* are traversal, which the caller rejects before reaching here, and emptying
+* a segment would merge two unrelated paths rather than the aliases this
+* models.
+*/
+function stripTrailing(segment) {
+	const stripped = segment.replace(/[. ]+$/, "");
+	return stripped === "" ? segment : stripped;
+}
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { REDIRECTS_FILE as a, USER_PLATFORM_DIR as c, HEADERS_FILE as i, detectFsIdentity as n, RESERVED_OUTPUT_PATHS as o, fsKey as r, USER_MERGED_PLATFORM_FILES as s, EXACT_FS_IDENTITY as t };
+
+//# sourceMappingURL=fs-identity-D7vb6GdI.js.map

package/dist/_chunks/fs-identity-D7vb6GdI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-identity-D7vb6GdI.js","names":[],"sources":["../../src/shared/static-platform-files.ts","../../src/adapters/fs-identity.ts"],"sourcesContent":["/**\n * Platform files the static build is allowed to overwrite in the output.\n *\n * The build merges two trees into the deployed directory — the client bundle\n * (which carries everything the user put in `public/`) and the pre-rendered\n * site. That merge otherwise refuses overlaps, because a silent overwrite\n * leaves one of two artifacts deployed with nothing recording which\n * (TIM-1266).\n *\n * These names are the exception, and only because the pre-rendered copy is\n * *derived from* the one it replaces rather than competing with it:\n * `plugins/static-build.ts` reads `public/_redirects` and writes the\n * generated rules plus the user's, so the winner is a superset of the loser.\n *\n * That holds only for a file the current pass produced, which is why\n * `cleanConditionalArtifacts` deletes a previous build's `_redirects` before\n * generation: written only when a pass finds redirects, it would otherwise\n * survive into a pass that produced nothing and claim an exemption it no\n * longer earns.\n *\n * `_headers` is NOT here. It is not written into the pre-rendered tree at\n * all — adapters generate it directly into the output, folding in the\n * user's copy as they go (TIM-1326).\n *\n * Declared once so the code that performs the merge and the code that\n * produces the merged file cannot disagree about which names are exempt.\n *\n * Isomorphic: no server, client, or build-time imports.\n */\n\n/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */\nexport const REDIRECTS_FILE = '_redirects';\n\n/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */\nexport const HEADERS_FILE = '_headers';\n\n/**\n * Where a user authors platform files. Stated once because two modules read\n * from here — `plugins/static-build.ts` for `_redirects`, adapters for\n * `_headers` — and they must look in the same place.\n *\n * Both read the **project source**, never the build output. The generated\n * file lands under the same name in the output directory, so a reader aimed\n * there would fold the previous build's generated rules back in and compound\n * them on every rebuild.\n */\nexport const USER_PLATFORM_DIR = 'public';\n\n/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */\nexport const USER_MERGED_PLATFORM_FILES: readonly string[] = [REDIRECTS_FILE];\n\n/**\n * Output paths the framework writes itself, which no route may claim.\n *\n * These are written outside the per-entry writer — `_redirects` after\n * generation, `_headers` by the adapter after the copy — so the collision\n * tracker never sees them and a route rendering to one of these paths is\n * overwritten with nothing recording it.\n *\n * Reserved rather than tracked, because there is no version of \"serve a route\n * at `/_headers`\" that works: Cloudflare Pages and Netlify read these two\n * files themselves and never serve them, so the route is unservable however\n * the conflict is resolved.\n *\n * That justification is per-file, not per-mechanism. `.nojekyll` is written\n * the same way and is deliberately NOT here: only the `github-pages` target\n * writes it, and everywhere else `/.nojekyll` is an ordinary servable path,\n * so reserving it globally would refuse a valid Cloudflare site. Its write\n * site skips the write when a file is already there instead — GitHub Pages\n * only cares that the file exists.\n *\n * Same reasoning as the synthetic 404 entry using an internal urlPath so a\n * real `/404` route cannot collide with `404.html`.\n */\nexport const RESERVED_OUTPUT_PATHS: readonly string[] = [REDIRECTS_FILE, HEADERS_FILE];\n","/**\n * What the output filesystem considers \"the same file\".\n *\n * Two build steps compare paths to decide whether two artifacts would land on\n * one file — the render pass (`plugins/static-build.ts`) and the adapter's\n * tree merge (`build-output-helper.ts`). Both are predicting a filesystem\n * decision, so both ask the filesystem rather than comparing raw strings\n * (TIM-1266).\n *\n * Two properties matter, and they are independent:\n *\n * - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does\n *   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on\n *   Linux CI.\n * - **Unicode normalization.** APFS compares normalization-insensitively, so\n *   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one\n *   file. This holds even on a *case-sensitive* APFS volume, which is why it\n *   is probed separately rather than inferred from case folding.\n *\n * Probed rather than read off `process.platform`: a case-sensitive volume on\n * macOS and a case-insensitive mount on Linux are both ordinary, and the\n * answer that matters is the one for the directory being written.\n *\n * Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,\n * which `server/asset-headers.ts` re-exports from and which therefore must\n * stay free of `node:fs` for the Workers bundle.\n */\n\nimport { writeFile, stat, rm } from 'node:fs/promises';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path';\n\n/** How the output filesystem decides that two paths name one file. */\nexport interface FsIdentity {\n  /** `Foo` and `foo` are the same file. */\n  caseInsensitive: boolean;\n  /** Canonically equivalent Unicode spellings are the same file. */\n  normalizationInsensitive: boolean;\n  /**\n   * Trailing dots and spaces are stripped from each segment, so `foo.` and\n   * `foo` are the same file. Win32 does this in path resolution rather than\n   * in the filesystem, which is why it is probed like the others.\n   */\n  stripsTrailingDotsAndSpaces: boolean;\n}\n\n/** Every path comparison is exact — the conservative answer when unprobed. */\nexport const EXACT_FS_IDENTITY: FsIdentity = {\n  caseInsensitive: false,\n  normalizationInsensitive: false,\n  stripsTrailingDotsAndSpaces: false,\n};\n\n/**\n * Probe `dir` by writing one file and asking for it under other spellings.\n *\n * Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That\n * under-detects, but a directory this cannot write to is one the caller is\n * about to fail on anyway, with a clearer error than a missed collision.\n */\nexport async function detectFsIdentity(dir: string): Promise<FsIdentity> {\n  // `café` — NFC, with a precomposed é. The UUID contributes the\n  // hex letters the case probe needs.\n  const name = `.timber-probe-${randomUUID()}-café`;\n  const path = join(dir, name);\n\n  try {\n    await writeFile(path, '');\n    const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] =\n      await Promise.all([\n        exists(join(dir, name.toUpperCase())),\n        // NFD spells the same string as `e` + U+0301; a filesystem that\n        // resolves it to the NFC file compares normalization-insensitively.\n        exists(join(dir, name.normalize('NFD'))),\n        // Win32 strips trailing dots and spaces during path resolution, so\n        // asking for `name.` reaches `name`.\n        exists(join(dir, `${name}.`)),\n      ]);\n    return { caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces };\n  } catch {\n    return EXACT_FS_IDENTITY;\n  } finally {\n    await rm(path, { force: true }).catch(() => {});\n  }\n}\n\n/**\n * Fold a path to the identity the filesystem compares it under.\n *\n * Normalization first, then case: `toLowerCase()` operates per code point, so\n * folding a decomposed string first would leave the combining marks in a\n * different order than folding a precomposed one.\n *\n * An approximation of the filesystem's own algorithm — APFS and NTFS fold per\n * their own Unicode tables, which `toLowerCase()` matches for everything short\n * of the exotic. It errs toward *finding* a collision, and the cost of a false\n * positive is a build error naming two routes rather than a silent overwrite.\n */\nexport function fsKey(path: string, identity: FsIdentity): string {\n  let key = identity.caseInsensitive ? caseFold(path) : path;\n  if (identity.normalizationInsensitive) key = key.normalize('NFC');\n  if (identity.stripsTrailingDotsAndSpaces) key = key.split('/').map(stripTrailing).join('/');\n  return key;\n}\n\n/**\n * Approximate Unicode case folding, which is what case-insensitive\n * filesystems actually compare under.\n *\n * `toLowerCase()` is not it. Greek `σ` and final `ς` are both already\n * lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS\n * folds `ς` to `σ` — so two routes differing only in that letter are one file\n * on both, and a lowercase key admitted them as two claims (TIM-1266).\n * Uppercasing first collapses them.\n *\n * The residual is over-folding, in these cases and a few like them:\n *\n * | pair      | folded together here | NTFS / APFS       |\n * | --------- | -------------------- | ----------------- |\n * | `σ` / `ς` | yes                  | yes — the fix     |\n * | `ß` / `ss`| yes                  | no                |\n * | `ı` / `i` | yes                  | no                |\n * | `fi` / `fi`| yes                  | no                |\n *\n * That direction is deliberate. Over-folding costs a build error naming two\n * routes, which a developer fixes by renaming one; under-folding costs a\n * payload silently overwritten by another route's, which nothing downstream\n * can detect. An exact fold would need `Intl.Collator`, which compares but\n * emits no sort key, so using it would turn a hash lookup into a pairwise\n * scan over every claimed path.\n */\nfunction caseFold(value: string): string {\n  return value.toUpperCase().toLowerCase();\n}\n\n/**\n * Drop trailing dots and spaces from one path segment, as Win32 does.\n *\n * A segment that is nothing but dots and spaces is left alone: `.` and `..`\n * are traversal, which the caller rejects before reaching here, and emptying\n * a segment would merge two unrelated paths rather than the aliases this\n * models.\n */\nfunction stripTrailing(segment: string): string {\n  const stripped = segment.replace(/[. ]+$/, '');\n  return stripped === '' ? segment : stripped;\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,iBAAiB;;AAG9B,IAAa,eAAe;;;;;;;;;;;AAY5B,IAAa,oBAAoB;;AAGjC,IAAa,6BAAgD,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;AAyB5E,IAAa,wBAA2C,CAAC,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3BrF,IAAa,oBAAgC;CAC3C,iBAAiB;CACjB,0BAA0B;CAC1B,6BAA6B;AAC/B;;;;;;;;AASA,eAAsB,iBAAiB,KAAkC;CAGvE,MAAM,OAAO,iBAAiB,WAAW,EAAE;CAC3C,MAAM,OAAO,KAAK,KAAK,IAAI;CAE3B,IAAI;EACF,MAAM,UAAU,MAAM,EAAE;EACxB,MAAM,CAAC,iBAAiB,0BAA0B,+BAChD,MAAM,QAAQ,IAAI;GAChB,OAAO,KAAK,KAAK,KAAK,YAAY,CAAC,CAAC;GAGpC,OAAO,KAAK,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;GAGvC,OAAO,KAAK,KAAK,GAAG,KAAK,EAAE,CAAC;EAC9B,CAAC;EACH,OAAO;GAAE;GAAiB;GAA0B;EAA4B;CAClF,QAAQ;EACN,OAAO;CACT,UAAU;EACR,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAChD;AACF;;;;;;;;;;;;;AAcA,SAAgB,MAAM,MAAc,UAA8B;CAChE,IAAI,MAAM,SAAS,kBAAkB,SAAS,IAAI,IAAI;CACtD,IAAI,SAAS,0BAA0B,MAAM,IAAI,UAAU,KAAK;CAChE,IAAI,SAAS,6BAA6B,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG;CAC1F,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,YAAY,CAAC,CAAC,YAAY;AACzC;;;;;;;;;AAUA,SAAS,cAAc,SAAyB;CAC9C,MAAM,WAAW,QAAQ,QAAQ,UAAU,EAAE;CAC7C,OAAO,aAAa,KAAK,UAAU;AACrC;AAEA,eAAe,OAAO,MAAgC;CACpD,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/_chunks/graph-cache-CP4GEmf9.js

@@ -0,0 +1,304 @@
+import { i as scanProjectSourceFiles, t as buildSourceExtensions } from "./scan-BoP17W3w.js";
+import { dirname, isAbsolute, join } from "node:path";
+import { createRequire } from "node:module";
+import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { Server } from "node:tls";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+//#region src/plugins/dev-discovery.ts
+/** Relative path of the discovery directory within the project root. */
+var DEV_DISCOVERY_DIR = join(".timber", "dev");
+/** Best-effort "is this pid alive" — signal 0 probes without killing. */
+function isPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Remove sibling records whose pid is no longer alive. Purely a
+* tidiness sweep — consumers already ignore records that fail the
+* pid + probe validation, so missing a stale record here is harmless.
+*/
+function sweepDeadRecords(dir) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.endsWith(".json")) continue;
+		const filePath = join(dir, entry);
+		try {
+			const record = JSON.parse(readFileSync(filePath, "utf8"));
+			if (typeof record.pid === "number" && !isPidAlive(record.pid)) rmSync(filePath, { force: true });
+		} catch {}
+	}
+}
+/**
+* Register discovery-record lifecycle handlers on the dev server's HTTP
+* server. Writes `.timber/dev/<pid>-<port>-<token>.json` once the server is
+* listening (the bound port is only known then) and removes exactly
+* that record on clean shutdown.
+*
+* All filesystem work is best-effort: a failure to write or remove a
+* record must never break the dev server. `httpServer` is null in
+* middleware mode — no port exists, so there is nothing to advertise.
+* Typed as `net.Server` — the common base of Vite's `http.Server` and
+* `Http2SecureServer` variants, which carries the events and `address()`.
+*/
+function registerDevDiscovery(httpServer, root, config) {
+	if (!httpServer) return;
+	const dir = join(root, DEV_DISCOVERY_DIR);
+	let recordPath = null;
+	httpServer.on("listening", () => {
+		const address = httpServer.address();
+		if (address === null || typeof address === "string") return;
+		const hmrOpts = typeof config?.server?.hmr === "object" ? config.server.hmr : void 0;
+		const wsOpts = typeof config?.server?.ws === "object" ? config.server.ws : void 0;
+		const record = {
+			port: address.port,
+			pid: process.pid,
+			host: address.address,
+			protocol: httpServer instanceof Server ? "https" : "http",
+			base: config?.base && config.base !== "/" ? config.base : void 0,
+			hmrPath: wsOpts?.path ?? hmrOpts?.path,
+			hmrHost: wsOpts?.host ?? hmrOpts?.host,
+			hmrPort: wsOpts?.clientPort || wsOpts?.port || hmrOpts?.clientPort || hmrOpts?.port || void 0,
+			hmrProtocol: wsOpts?.protocol ?? hmrOpts?.protocol,
+			webSocketToken: config?.webSocketToken,
+			configFile: typeof config?.configFile === "string" ? config.configFile : void 0
+		};
+		recordPath = join(dir, `${record.pid}-${record.port}-${randomUUID()}.json`);
+		try {
+			mkdirSync(dir, { recursive: true });
+			writeFileSync(recordPath, JSON.stringify(record));
+			sweepDeadRecords(dir);
+		} catch {}
+	});
+	httpServer.on("close", () => {
+		if (!recordPath) return;
+		try {
+			rmSync(recordPath, { force: true });
+		} catch {}
+	});
+}
+/** Cache location under the app root. */
+var CACHE_RELATIVE_PATH = join(".timber", "graph-cache.json");
+/**
+* Config/manifest files at the root that participate in the
+* fingerprint. The `.env` family is included because a Vite config
+* using `loadEnv(mode, …)` can select aliases, plugins, the app root,
+* or pageExtensions from it — the disk scan skips dot-prefixed files,
+* so without these entries an `.env.production` edit would never miss
+* the cache (codex review, PR #1056). The build resolves under mode
+* `production`; the development variants are tracked anyway — they are
+* loadable through `loadEnv` with any mode argument, and an absent
+* file contributes nothing.
+*/
+var ROOT_MANIFEST_FILES = [
+	"package.json",
+	"tsconfig.json",
+	"timber.config.ts",
+	"timber.config.js",
+	"timber.config.mjs",
+	".env",
+	".env.local",
+	".env.production",
+	".env.production.local",
+	".env.development",
+	".env.development.local"
+];
+/** Lockfile names, searched upward from the root (monorepo workspaces). */
+var LOCKFILE_NAMES = [
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb"
+];
+/**
+* Follow a tsconfig/jsconfig `extends` chain, returning every file on
+* it (the start file included). A base config outside the app —
+* `"extends": "../tsconfig.base.json"` with a `paths` mapping — can
+* reshape Vite's resolution without touching anything else the
+* fingerprint tracks. Parsing is a targeted regex, not JSONC: tsconfig
+* allows comments, and all we need is the `extends` value. Package
+* specifiers resolve through Node resolution (an approximation of
+* TypeScript's — the `.json` append covers the common shapes): a
+* WORKSPACE package like `@repo/tsconfig/base.json` is a link, so its
+* edits change neither the lockfile nor any scanned file and must be
+* fingerprinted directly; registry packages resolve too, harmlessly.
+* Cycles and unresolvable targets just end the walk (bounded at 16).
+*/
+/**
+* Strip JSONC comments so a commented-out `"extends"` line cannot
+* shadow the real one. String-aware: comment markers inside string
+* literals (a path containing `//`) survive.
+*/
+function stripJsonComments(raw) {
+	let out = "";
+	let inString = false;
+	for (let i = 0; i < raw.length; i++) {
+		const ch = raw[i];
+		if (inString) {
+			out += ch;
+			if (ch === "\\") {
+				out += raw[i + 1] ?? "";
+				i++;
+			} else if (ch === "\"") inString = false;
+		} else if (ch === "\"") {
+			inString = true;
+			out += ch;
+		} else if (ch === "/" && raw[i + 1] === "/") {
+			while (i < raw.length && raw[i] !== "\n") i++;
+			out += "\n";
+		} else if (ch === "/" && raw[i + 1] === "*") {
+			i += 2;
+			while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
+			i++;
+		} else out += ch;
+	}
+	return out;
+}
+async function collectTsconfigChain(startFile) {
+	const chain = [];
+	const queue = [startFile];
+	const seen = new Set(queue);
+	while (queue.length > 0 && chain.length < 16) {
+		const current = queue.shift();
+		let raw;
+		try {
+			raw = stripJsonComments(await readFile(current, "utf8"));
+		} catch {
+			continue;
+		}
+		chain.push(current);
+		const match = raw.match(/"extends"\s*:\s*("([^"]+)"|\[([^\]]*)\])/);
+		if (!match) continue;
+		const targets = match[2] ? [match[2]] : (match[3]?.match(/"([^"]+)"/g) ?? []).map((t) => t.slice(1, -1));
+		for (const target of targets) {
+			let next = null;
+			if (isAbsolute(target)) {
+				next = target;
+				if (!/\.json$/.test(next)) next += ".json";
+			} else if (target.startsWith(".")) {
+				next = join(dirname(current), target);
+				if (!/\.json$/.test(next)) next += ".json";
+			} else {
+				const req = createRequire(current);
+				for (const candidate of [
+					target,
+					`${target}.json`,
+					`${target}/tsconfig.json`
+				]) try {
+					next = req.resolve(candidate);
+					break;
+				} catch {}
+			}
+			if (next && !seen.has(next)) {
+				seen.add(next);
+				queue.push(next);
+			}
+		}
+	}
+	return chain;
+}
+/** Nearest lockfile at or above `root`, or null. */
+async function findLockfile(root) {
+	let dir = root;
+	for (;;) {
+		for (const name of LOCKFILE_NAMES) {
+			const candidate = join(dir, name);
+			try {
+				await stat(candidate);
+				return candidate;
+			} catch {}
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** `path\0mtime\0size` entries for a file list; absent files contribute nothing. */
+async function fingerprintEntriesForFiles(files) {
+	const entries = [];
+	for (const file of new Set(files)) try {
+		const stats = await stat(file);
+		entries.push(`${file}\0${stats.mtimeMs}\0${stats.size}`);
+	} catch {}
+	return entries;
+}
+/**
+* Entries for the scan-derived base set: project source files, the
+* config, root manifests, and the nearest lockfile. Scan failures are
+* folded into the entry list rather than thrown: an unreadable
+* directory changes the answer's completeness, so it must change the
+* key too.
+*/
+async function collectBaseFingerprintEntries(root, configFile, pageExtensions) {
+	const extensions = buildSourceExtensions(pageExtensions);
+	const sourceFiles = [];
+	const failures = [];
+	await scanProjectSourceFiles(root, sourceFiles, (failure) => failures.push(`${failure.dir}:${failure.message}`), 0, extensions);
+	const tracked = [
+		...sourceFiles,
+		configFile,
+		...ROOT_MANIFEST_FILES.map((f) => join(root, f))
+	];
+	const configDir = dirname(configFile);
+	if (configDir !== root) tracked.push(...ROOT_MANIFEST_FILES.map((f) => join(configDir, f)));
+	for (const name of ["tsconfig.json", "jsconfig.json"]) {
+		tracked.push(...await collectTsconfigChain(join(root, name)));
+		if (configDir !== root) tracked.push(...await collectTsconfigChain(join(configDir, name)));
+	}
+	const lockfile = await findLockfile(root);
+	if (lockfile) tracked.push(lockfile);
+	return [...failures, ...await fingerprintEntriesForFiles(tracked)];
+}
+/** Hash an entry list order-independently. */
+function hashFingerprintEntries(entries) {
+	const unique = [...new Set(entries)].sort();
+	return createHash("sha256").update(unique.join("\n")).digest("hex");
+}
+/**
+* Fingerprint the project state `timber graph`'s answers depend on:
+* the scan-derived base set plus `extraFiles` (the cache's
+* trackedExtras on the hit path; config dependencies + report files on
+* the write path).
+*/
+async function computeProjectFingerprint(root, configFile, extraFiles = [], pageExtensions) {
+	const entries = await collectBaseFingerprintEntries(root, configFile, pageExtensions);
+	entries.push(...await fingerprintEntriesForFiles(extraFiles));
+	return hashFingerprintEntries(entries);
+}
+/** Read the cache file; anything unreadable or version-mismatched is a miss. */
+async function readGraphCache(root) {
+	try {
+		const raw = await readFile(join(root, CACHE_RELATIVE_PATH), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed.version !== 2 || typeof parsed.fingerprint !== "string" || typeof parsed.configFile !== "string" || !Array.isArray(parsed.trackedExtras) || typeof parsed.report !== "object" || parsed.report === null) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+/**
+* Write the cache atomically (temp file + rename) so a concurrent
+* reader — parallel agent invocations are the expected workload —
+* never sees a torn JSON file.
+*/
+async function writeGraphCache(root, cache) {
+	const target = join(root, CACHE_RELATIVE_PATH);
+	await mkdir(dirname(target), { recursive: true });
+	const temp = `${target}.${process.pid}.tmp`;
+	await writeFile(temp, JSON.stringify(cache));
+	await rename(temp, target);
+}
+//#endregion
+export { readGraphCache as a, isPidAlive as c, hashFingerprintEntries as i, registerDevDiscovery as l, computeProjectFingerprint as n, writeGraphCache as o, fingerprintEntriesForFiles as r, DEV_DISCOVERY_DIR as s, collectBaseFingerprintEntries as t };
+
+//# sourceMappingURL=graph-cache-CP4GEmf9.js.map

package/dist/_chunks/graph-cache-CP4GEmf9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-cache-CP4GEmf9.js","names":[],"sources":["../../src/plugins/dev-discovery.ts","../../src/analyze/graph-cache.ts"],"sourcesContent":["/**\n * Dev-server discovery records — `.timber/dev/<pid>-<port>-<token>.json`.\n *\n * On startup each dev server writes `{ port, pid, host, protocol }` to its own record\n * file under the app's `.timber/dev/` so the `timber graph` CLI and the\n * VS Code extension can discover a running dev server for the\n * live-graph fast path.\n *\n * One record file per server, one writer per file. This is what makes\n * multi-server roots (Vite auto-increments the port across processes;\n * programmatic embeddings run several servers in one process) safe\n * without any coordination: there is no shared file to displace, no\n * ownership to arbitrate, and no shutdown-order dependency — each\n * server removes exactly its own record.\n *\n * Consumers must list the directory and trust a record only if its pid\n * is alive AND a probe request to the endpoint succeeds; anything else\n * is treated as absent (silent fallback), never an error. Stale records\n * (crashed servers) are therefore the normal case — startup sweeps\n * dead-pid records best-effort, and consumers validate the rest away.\n *\n * The directory layout and file format are implementation details, not\n * a public contract.\n *\n * Design doc: 47-module-environment-tooling.md §5, 21-dev-server.md.\n */\n\nimport type { Server } from 'node:net';\nimport { Server as TlsServer } from 'node:tls';\nimport { randomUUID } from 'node:crypto';\nimport { mkdirSync, writeFileSync, rmSync, readFileSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\n\n/** Relative path of the discovery directory within the project root. */\nexport const DEV_DISCOVERY_DIR = join('.timber', 'dev');\n\nexport interface DevRecord {\n  port: number;\n  pid: number;\n  /**\n   * The bound address, as reported by the socket. Consumers probing the\n   * endpoint need it for servers bound to non-default interfaces;\n   * wildcard addresses (`0.0.0.0`, `::`) should be probed via loopback.\n   */\n  host: string;\n  /**\n   * Probe scheme. `server.https` dev servers (including HTTP/2) answer\n   * only TLS — an http:// probe of one would fail and wrongly trigger\n   * the cold-crawl fallback.\n   */\n  protocol: 'http' | 'https';\n  /**\n   * Vite `base` path. When non-root (e.g. `/my-app/`), the WebSocket\n   * upgrade path is `base + hmrPath`.\n   */\n  base?: string;\n  /**\n   * HMR WebSocket path (from `server.ws.path` or deprecated\n   * `server.hmr.path`). Absent when no path is configured (default `/`).\n   */\n  hmrPath?: string;\n  /**\n   * Custom WebSocket host override (from `server.ws.host` or deprecated\n   * `server.hmr.host`). When set, the WS connection targets this host\n   * instead of the HTTP server's bound address.\n   */\n  hmrHost?: string;\n  /**\n   * Custom WebSocket port override (from `server.ws.clientPort` ??\n   * `server.ws.port`, or deprecated `server.hmr.clientPort` ??\n   * `server.hmr.port`). When set, the WS connection targets this port\n   * instead of the HTTP server's bound port.\n   */\n  hmrPort?: number;\n  /**\n   * Custom WebSocket protocol override (from `server.ws.protocol` or\n   * deprecated `server.hmr.protocol`). When set (e.g. `'wss'`), the\n   * upgrade request uses the corresponding HTTP scheme.\n   */\n  hmrProtocol?: string;\n  /**\n   * Vite 8 WebSocket token (from `config.webSocketToken`). Required for\n   * browser WS upgrades; the extension passes it as `?token=` on the\n   * WebSocket URL.\n   */\n  webSocketToken?: string;\n  /**\n   * Absolute path to the Vite config file this server was started with.\n   * When multiple dev servers share a project root but use different\n   * configs, the fast path must only accept the record matching the\n   * config the CLI resolved (TIM-1393).\n   */\n  configFile?: string;\n}\n\n/** Best-effort \"is this pid alive\" — signal 0 probes without killing. */\nexport function isPidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    // EPERM means the process exists but is owned by someone else.\n    return (error as NodeJS.ErrnoException).code === 'EPERM';\n  }\n}\n\n/**\n * Remove sibling records whose pid is no longer alive. Purely a\n * tidiness sweep — consumers already ignore records that fail the\n * pid + probe validation, so missing a stale record here is harmless.\n */\nfunction sweepDeadRecords(dir: string): void {\n  let entries: string[];\n  try {\n    entries = readdirSync(dir);\n  } catch {\n    return;\n  }\n  for (const entry of entries) {\n    if (!entry.endsWith('.json')) continue;\n    const filePath = join(dir, entry);\n    try {\n      const record = JSON.parse(readFileSync(filePath, 'utf8')) as Partial<DevRecord>;\n      // Remove only records that parse AND name a dead pid. An\n      // unreadable file may be a sibling's record mid-write — leave it;\n      // consumers ignore records that fail validation anyway.\n      if (typeof record.pid === 'number' && !isPidAlive(record.pid)) {\n        rmSync(filePath, { force: true });\n      }\n    } catch {\n      // Unreadable — skip, never delete another writer's in-flight file.\n    }\n  }\n}\n\n/**\n * Register discovery-record lifecycle handlers on the dev server's HTTP\n * server. Writes `.timber/dev/<pid>-<port>-<token>.json` once the server is\n * listening (the bound port is only known then) and removes exactly\n * that record on clean shutdown.\n *\n * All filesystem work is best-effort: a failure to write or remove a\n * record must never break the dev server. `httpServer` is null in\n * middleware mode — no port exists, so there is nothing to advertise.\n * Typed as `net.Server` — the common base of Vite's `http.Server` and\n * `Http2SecureServer` variants, which carries the events and `address()`.\n */\nexport function registerDevDiscovery(\n  httpServer: Server | null,\n  root: string,\n  config?: {\n    configFile?: string | false;\n    base?: string;\n    server?: {\n      hmr?:\n        | { path?: string; host?: string; port?: number; clientPort?: number; protocol?: string }\n        | boolean;\n      ws?:\n        | { path?: string; host?: string; port?: number; clientPort?: number; protocol?: string }\n        | false;\n    };\n    webSocketToken?: string;\n  }\n): void {\n  if (!httpServer) return;\n\n  const dir = join(root, DEV_DISCOVERY_DIR);\n  let recordPath: string | null = null;\n\n  httpServer.on('listening', () => {\n    const address = httpServer.address();\n    // Unix-socket listeners have a string address — no port to advertise.\n    if (address === null || typeof address === 'string') return;\n    const hmrOpts = typeof config?.server?.hmr === 'object' ? config.server.hmr : undefined;\n    const wsOpts = typeof config?.server?.ws === 'object' ? config.server.ws : undefined;\n    const record: DevRecord = {\n      port: address.port,\n      pid: process.pid,\n      host: address.address,\n      // Vite's https/h2 servers are tls.Server subclasses; plain HTTP\n      // and h2c are not.\n      protocol: httpServer instanceof TlsServer ? 'https' : 'http',\n      base: config?.base && config.base !== '/' ? config.base : undefined,\n      hmrPath: wsOpts?.path ?? hmrOpts?.path,\n      hmrHost: wsOpts?.host ?? hmrOpts?.host,\n      hmrPort:\n        wsOpts?.clientPort || wsOpts?.port || hmrOpts?.clientPort || hmrOpts?.port || undefined,\n      hmrProtocol: wsOpts?.protocol ?? hmrOpts?.protocol,\n      webSocketToken: config?.webSocketToken,\n      configFile: typeof config?.configFile === 'string' ? config.configFile : undefined,\n    };\n    // pid+port alone is not a unique server identity (same port on two\n    // interfaces; worker threads and duplicate module copies share a\n    // pid but not module state, so a counter cannot disambiguate\n    // either). A random token makes the filename unique regardless of\n    // process/isolate topology; pid and port stay in the name only for\n    // human debuggability.\n    recordPath = join(dir, `${record.pid}-${record.port}-${randomUUID()}.json`);\n    try {\n      mkdirSync(dir, { recursive: true });\n      writeFileSync(recordPath, JSON.stringify(record));\n      sweepDeadRecords(dir);\n    } catch {\n      // Best-effort — consumers fall back to the cold crawl.\n    }\n  });\n\n  httpServer.on('close', () => {\n    if (!recordPath) return;\n    try {\n      // Only ever this server's own record — sibling servers' records\n      // are separate files and survive any shutdown order untouched.\n      rmSync(recordPath, { force: true });\n    } catch {\n      // Best-effort — a stale record is validated away by consumers.\n    }\n  });\n}\n","/**\n * graph-cache — the mtime-keyed output cache for `timber graph`.\n *\n * The cold crawl costs seconds (design/47 §6) and its cost is setup +\n * dependency compilation, not project-file count — so the cacheable\n * unit is the classification OUTPUT, never Vite's transforms. One\n * crawl per project state: the first question after a clone pays for\n * the crawl, every subsequent question is a cache hit until the\n * project changes.\n *\n * Validity is a fingerprint over (path, mtime, size) of every project\n * source file — the same disk walk the crawl itself uses (scan.ts), so\n * cache coverage and crawl coverage cannot drift — plus the config\n * files and the nearest lockfile, since dependency changes change\n * resolution (export conditions can flip a file's environment without\n * touching project code).\n *\n * Deliberately vite-free: a cache hit answers without importing Vite.\n *\n * Design docs: 47-module-environment-tooling.md §\"Cold-path policy\".\n */\n\nimport { createHash } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';\nimport { dirname, isAbsolute, join } from 'node:path';\nimport { buildSourceExtensions, scanProjectSourceFiles } from './scan.ts';\nimport type { CrawlReport } from './crawl.ts';\n\n/**\n * JSON contract version (design/47 §9) — one constant for every\n * frontend (CLI and dev-server endpoint), so the two cannot drift.\n * Lives here rather than graph-command.ts because this module is\n * vite-free and both frontends already depend on the analyze core.\n */\nexport const GRAPH_JSON_VERSION = 1;\n\n/** Bump when the report shape or fingerprint inputs change. */\nexport const GRAPH_CACHE_VERSION = 2;\n\n/** Cache location under the app root. */\nconst CACHE_RELATIVE_PATH = join('.timber', 'graph-cache.json');\n\n/**\n * Config/manifest files at the root that participate in the\n * fingerprint. The `.env` family is included because a Vite config\n * using `loadEnv(mode, …)` can select aliases, plugins, the app root,\n * or pageExtensions from it — the disk scan skips dot-prefixed files,\n * so without these entries an `.env.production` edit would never miss\n * the cache (codex review, PR #1056). The build resolves under mode\n * `production`; the development variants are tracked anyway — they are\n * loadable through `loadEnv` with any mode argument, and an absent\n * file contributes nothing.\n */\nconst ROOT_MANIFEST_FILES = [\n  'package.json',\n  'tsconfig.json',\n  'timber.config.ts',\n  'timber.config.js',\n  'timber.config.mjs',\n  '.env',\n  '.env.local',\n  '.env.production',\n  '.env.production.local',\n  '.env.development',\n  '.env.development.local',\n];\n\n/** Lockfile names, searched upward from the root (monorepo workspaces). */\nconst LOCKFILE_NAMES = [\n  'pnpm-lock.yaml',\n  'package-lock.json',\n  'yarn.lock',\n  'bun.lock',\n  'bun.lockb',\n];\n\nexport interface GraphCacheFile {\n  version: number;\n  fingerprint: string;\n  /** The Vite config file the cached crawl booted with. */\n  configFile: string;\n  /**\n   * The resolved pageExtensions from the timber config at crawl time.\n   * Stored so the vite-free hit path can reproduce the same scan\n   * extension set (custom extensions like 'foo' must be admitted on\n   * both the write and the hit path, or the fingerprint disagrees\n   * with what was cached).\n   */\n  pageExtensions?: string[];\n  /**\n   * Files the fingerprint tracks BEYOND the disk scan, discovered at\n   * crawl time: Vite's `configFileDependencies` (a config helper\n   * imported from outside the app root can reshape the whole app) and\n   * every file the report itself classifies (the graph can reach files\n   * the scan skips — `app/.well-known/page.tsx`, a route under a\n   * directory named `dist`). The hit path re-stats exactly this list,\n   * so an edit to any of them misses the cache.\n   */\n  trackedExtras: string[];\n  report: CrawlReport;\n}\n\n/**\n * Follow a tsconfig/jsconfig `extends` chain, returning every file on\n * it (the start file included). A base config outside the app —\n * `\"extends\": \"../tsconfig.base.json\"` with a `paths` mapping — can\n * reshape Vite's resolution without touching anything else the\n * fingerprint tracks. Parsing is a targeted regex, not JSONC: tsconfig\n * allows comments, and all we need is the `extends` value. Package\n * specifiers resolve through Node resolution (an approximation of\n * TypeScript's — the `.json` append covers the common shapes): a\n * WORKSPACE package like `@repo/tsconfig/base.json` is a link, so its\n * edits change neither the lockfile nor any scanned file and must be\n * fingerprinted directly; registry packages resolve too, harmlessly.\n * Cycles and unresolvable targets just end the walk (bounded at 16).\n */\n/**\n * Strip JSONC comments so a commented-out `\"extends\"` line cannot\n * shadow the real one. String-aware: comment markers inside string\n * literals (a path containing `//`) survive.\n */\nexport function stripJsonComments(raw: string): string {\n  let out = '';\n  let inString = false;\n  for (let i = 0; i < raw.length; i++) {\n    const ch = raw[i];\n    if (inString) {\n      out += ch;\n      if (ch === '\\\\') {\n        out += raw[i + 1] ?? '';\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n    } else if (ch === '\"') {\n      inString = true;\n      out += ch;\n    } else if (ch === '/' && raw[i + 1] === '/') {\n      while (i < raw.length && raw[i] !== '\\n') i++;\n      out += '\\n';\n    } else if (ch === '/' && raw[i + 1] === '*') {\n      i += 2;\n      while (i < raw.length && !(raw[i] === '*' && raw[i + 1] === '/')) i++;\n      i++;\n    } else {\n      out += ch;\n    }\n  }\n  return out;\n}\n\nasync function collectTsconfigChain(startFile: string): Promise<string[]> {\n  const chain: string[] = [];\n  const queue = [startFile];\n  const seen = new Set(queue);\n  while (queue.length > 0 && chain.length < 16) {\n    const current = queue.shift()!;\n    let raw: string;\n    try {\n      raw = stripJsonComments(await readFile(current, 'utf8'));\n    } catch {\n      continue;\n    }\n    chain.push(current);\n    const match = raw.match(/\"extends\"\\s*:\\s*(\"([^\"]+)\"|\\[([^\\]]*)\\])/);\n    if (!match) continue;\n    const targets = match[2]\n      ? [match[2]]\n      : (match[3]?.match(/\"([^\"]+)\"/g) ?? []).map((t) => t.slice(1, -1));\n    for (const target of targets) {\n      let next: string | null = null;\n      if (isAbsolute(target)) {\n        // An absolute extends target names the base directly — joining\n        // it under the current config's directory would fabricate a\n        // path that does not exist and drop the real base.\n        next = target;\n        if (!/\\.json$/.test(next)) next += '.json';\n      } else if (target.startsWith('.')) {\n        next = join(dirname(current), target);\n        if (!/\\.json$/.test(next)) next += '.json';\n      } else {\n        const req = createRequire(current);\n        for (const candidate of [target, `${target}.json`, `${target}/tsconfig.json`]) {\n          try {\n            next = req.resolve(candidate);\n            break;\n          } catch {\n            // try the next shape\n          }\n        }\n      }\n      if (next && !seen.has(next)) {\n        seen.add(next);\n        queue.push(next);\n      }\n    }\n  }\n  return chain;\n}\n\n/** Nearest lockfile at or above `root`, or null. */\nasync function findLockfile(root: string): Promise<string | null> {\n  let dir = root;\n  for (;;) {\n    for (const name of LOCKFILE_NAMES) {\n      const candidate = join(dir, name);\n      try {\n        await stat(candidate);\n        return candidate;\n      } catch {\n        // keep looking\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/** `path\\0mtime\\0size` entries for a file list; absent files contribute nothing. */\nexport async function fingerprintEntriesForFiles(files: Iterable<string>): Promise<string[]> {\n  const entries: string[] = [];\n  for (const file of new Set(files)) {\n    try {\n      const stats = await stat(file);\n      entries.push(`${file}\\0${stats.mtimeMs}\\0${stats.size}`);\n    } catch {\n      // Absent files simply contribute nothing; when one appears\n      // later, its entry appears and the fingerprint changes.\n    }\n  }\n  return entries;\n}\n\n/**\n * Entries for the scan-derived base set: project source files, the\n * config, root manifests, and the nearest lockfile. Scan failures are\n * folded into the entry list rather than thrown: an unreadable\n * directory changes the answer's completeness, so it must change the\n * key too.\n */\nexport async function collectBaseFingerprintEntries(\n  root: string,\n  configFile: string,\n  pageExtensions?: readonly string[]\n): Promise<string[]> {\n  const extensions = buildSourceExtensions(pageExtensions);\n  const sourceFiles: string[] = [];\n  const failures: string[] = [];\n  await scanProjectSourceFiles(\n    root,\n    sourceFiles,\n    (failure) => failures.push(`${failure.dir}:${failure.message}`),\n    0,\n    extensions\n  );\n  const tracked = [...sourceFiles, configFile, ...ROOT_MANIFEST_FILES.map((f) => join(root, f))];\n  // Manifest/.env files beside the CONFIG too, when it lives outside\n  // the app root — `loadEnv(mode, process.cwd())` in a monorepo config\n  // reads the .env next to the config, not the one under root.\n  const configDir = dirname(configFile);\n  if (configDir !== root) {\n    tracked.push(...ROOT_MANIFEST_FILES.map((f) => join(configDir, f)));\n  }\n  // ts/jsconfig extends chains: a base config outside the app can carry\n  // the `paths` mappings resolution depends on.\n  for (const name of ['tsconfig.json', 'jsconfig.json']) {\n    tracked.push(...(await collectTsconfigChain(join(root, name))));\n    if (configDir !== root) tracked.push(...(await collectTsconfigChain(join(configDir, name))));\n  }\n  const lockfile = await findLockfile(root);\n  if (lockfile) tracked.push(lockfile);\n  return [...failures, ...(await fingerprintEntriesForFiles(tracked))];\n}\n\n/** Hash an entry list order-independently. */\nexport function hashFingerprintEntries(entries: string[]): string {\n  const unique = [...new Set(entries)].sort();\n  return createHash('sha256').update(unique.join('\\n')).digest('hex');\n}\n\n/**\n * Fingerprint the project state `timber graph`'s answers depend on:\n * the scan-derived base set plus `extraFiles` (the cache's\n * trackedExtras on the hit path; config dependencies + report files on\n * the write path).\n */\nexport async function computeProjectFingerprint(\n  root: string,\n  configFile: string,\n  extraFiles: readonly string[] = [],\n  pageExtensions?: readonly string[]\n): Promise<string> {\n  const entries = await collectBaseFingerprintEntries(root, configFile, pageExtensions);\n  entries.push(...(await fingerprintEntriesForFiles(extraFiles)));\n  return hashFingerprintEntries(entries);\n}\n\n/** Read the cache file; anything unreadable or version-mismatched is a miss. */\nexport async function readGraphCache(root: string): Promise<GraphCacheFile | null> {\n  try {\n    const raw = await readFile(join(root, CACHE_RELATIVE_PATH), 'utf8');\n    const parsed = JSON.parse(raw) as Partial<GraphCacheFile>;\n    if (\n      parsed.version !== GRAPH_CACHE_VERSION ||\n      typeof parsed.fingerprint !== 'string' ||\n      typeof parsed.configFile !== 'string' ||\n      !Array.isArray(parsed.trackedExtras) ||\n      typeof parsed.report !== 'object' ||\n      parsed.report === null\n    ) {\n      return null;\n    }\n    return parsed as GraphCacheFile;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Write the cache atomically (temp file + rename) so a concurrent\n * reader — parallel agent invocations are the expected workload —\n * never sees a torn JSON file.\n */\nexport async function writeGraphCache(root: string, cache: GraphCacheFile): Promise<void> {\n  const target = join(root, CACHE_RELATIVE_PATH);\n  await mkdir(dirname(target), { recursive: true });\n  const temp = `${target}.${process.pid}.tmp`;\n  await writeFile(temp, JSON.stringify(cache));\n  await rename(temp, target);\n}\n"],"mappings":";;;;;;;;;AAkCA,IAAa,oBAAoB,KAAK,WAAW,KAAK;;AA8DtD,SAAgB,WAAW,KAAsB;CAC/C,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,OAAO;EAEd,OAAQ,MAAgC,SAAS;CACnD;AACF;;;;;;AAOA,SAAS,iBAAiB,KAAmB;CAC3C,IAAI;CACJ,IAAI;EACF,UAAU,YAAY,GAAG;CAC3B,QAAQ;EACN;CACF;CACA,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,CAAC,MAAM,SAAS,OAAO,GAAG;EAC9B,MAAM,WAAW,KAAK,KAAK,KAAK;EAChC,IAAI;GACF,MAAM,SAAS,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;GAIxD,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,WAAW,OAAO,GAAG,GAC1D,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;EAEpC,QAAQ,CAER;CACF;AACF;;;;;;;;;;;;;AAcA,SAAgB,qBACd,YACA,MACA,QAaM;CACN,IAAI,CAAC,YAAY;CAEjB,MAAM,MAAM,KAAK,MAAM,iBAAiB;CACxC,IAAI,aAA4B;CAEhC,WAAW,GAAG,mBAAmB;EAC/B,MAAM,UAAU,WAAW,QAAQ;EAEnC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU;EACrD,MAAM,UAAU,OAAO,QAAQ,QAAQ,QAAQ,WAAW,OAAO,OAAO,MAAM,KAAA;EAC9E,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,WAAW,OAAO,OAAO,KAAK,KAAA;EAC3E,MAAM,SAAoB;GACxB,MAAM,QAAQ;GACd,KAAK,QAAQ;GACb,MAAM,QAAQ;GAGd,UAAU,sBAAsB,SAAY,UAAU;GACtD,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,OAAO,OAAO,KAAA;GAC1D,SAAS,QAAQ,QAAQ,SAAS;GAClC,SAAS,QAAQ,QAAQ,SAAS;GAClC,SACE,QAAQ,cAAc,QAAQ,QAAQ,SAAS,cAAc,SAAS,QAAQ,KAAA;GAChF,aAAa,QAAQ,YAAY,SAAS;GAC1C,gBAAgB,QAAQ;GACxB,YAAY,OAAO,QAAQ,eAAe,WAAW,OAAO,aAAa,KAAA;EAC3E;EAOA,aAAa,KAAK,KAAK,GAAG,OAAO,IAAI,GAAG,OAAO,KAAK,GAAG,WAAW,EAAE,MAAM;EAC1E,IAAI;GACF,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;GAClC,cAAc,YAAY,KAAK,UAAU,MAAM,CAAC;GAChD,iBAAiB,GAAG;EACtB,QAAQ,CAER;CACF,CAAC;CAED,WAAW,GAAG,eAAe;EAC3B,IAAI,CAAC,YAAY;EACjB,IAAI;GAGF,OAAO,YAAY,EAAE,OAAO,KAAK,CAAC;EACpC,QAAQ,CAER;CACF,CAAC;AACH;;AChLA,IAAM,sBAAsB,KAAK,WAAW,kBAAkB;;;;;;;;;;;;AAa9D,IAAM,sBAAsB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,IAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;;;AA+CA,SAAgB,kBAAkB,KAAqB;CACrD,IAAI,MAAM;CACV,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;EACnC,MAAM,KAAK,IAAI;EACf,IAAI,UAAU;GACZ,OAAO;GACP,IAAI,OAAO,MAAM;IACf,OAAO,IAAI,IAAI,MAAM;IACrB;GACF,OAAO,IAAI,OAAO,MAChB,WAAW;EAEf,OAAO,IAAI,OAAO,MAAK;GACrB,WAAW;GACX,OAAO;EACT,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,KAAK;GAC3C,OAAO,IAAI,IAAI,UAAU,IAAI,OAAO,MAAM;GAC1C,OAAO;EACT,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,KAAK;GAC3C,KAAK;GACL,OAAO,IAAI,IAAI,UAAU,EAAE,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,MAAM;GAClE;EACF,OACE,OAAO;CAEX;CACA,OAAO;AACT;AAEA,eAAe,qBAAqB,WAAsC;CACxE,MAAM,QAAkB,CAAC;CACzB,MAAM,QAAQ,CAAC,SAAS;CACxB,MAAM,OAAO,IAAI,IAAI,KAAK;CAC1B,OAAO,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI;EAC5C,MAAM,UAAU,MAAM,MAAM;EAC5B,IAAI;EACJ,IAAI;GACF,MAAM,kBAAkB,MAAM,SAAS,SAAS,MAAM,CAAC;EACzD,QAAQ;GACN;EACF;EACA,MAAM,KAAK,OAAO;EAClB,MAAM,QAAQ,IAAI,MAAM,0CAA0C;EAClE,IAAI,CAAC,OAAO;EACZ,MAAM,UAAU,MAAM,KAClB,CAAC,MAAM,EAAE,KACR,MAAM,EAAE,EAAE,MAAM,YAAY,KAAK,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;EACnE,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,OAAsB;GAC1B,IAAI,WAAW,MAAM,GAAG;IAItB,OAAO;IACP,IAAI,CAAC,UAAU,KAAK,IAAI,GAAG,QAAQ;GACrC,OAAO,IAAI,OAAO,WAAW,GAAG,GAAG;IACjC,OAAO,KAAK,QAAQ,OAAO,GAAG,MAAM;IACpC,IAAI,CAAC,UAAU,KAAK,IAAI,GAAG,QAAQ;GACrC,OAAO;IACL,MAAM,MAAM,cAAc,OAAO;IACjC,KAAK,MAAM,aAAa;KAAC;KAAQ,GAAG,OAAO;KAAQ,GAAG,OAAO;IAAe,GAC1E,IAAI;KACF,OAAO,IAAI,QAAQ,SAAS;KAC5B;IACF,QAAQ,CAER;GAEJ;GACA,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,GAAG;IAC3B,KAAK,IAAI,IAAI;IACb,MAAM,KAAK,IAAI;GACjB;EACF;CACF;CACA,OAAO;AACT;;AAGA,eAAe,aAAa,MAAsC;CAChE,IAAI,MAAM;CACV,SAAS;EACP,KAAK,MAAM,QAAQ,gBAAgB;GACjC,MAAM,YAAY,KAAK,KAAK,IAAI;GAChC,IAAI;IACF,MAAM,KAAK,SAAS;IACpB,OAAO;GACT,QAAQ,CAER;EACF;EACA,MAAM,SAAS,QAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;;AAGA,eAAsB,2BAA2B,OAA4C;CAC3F,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,GAC9B,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,QAAQ,KAAK,GAAG,KAAK,IAAI,MAAM,QAAQ,IAAI,MAAM,MAAM;CACzD,QAAQ,CAGR;CAEF,OAAO;AACT;;;;;;;;AASA,eAAsB,8BACpB,MACA,YACA,gBACmB;CACnB,MAAM,aAAa,sBAAsB,cAAc;CACvD,MAAM,cAAwB,CAAC;CAC/B,MAAM,WAAqB,CAAC;CAC5B,MAAM,uBACJ,MACA,cACC,YAAY,SAAS,KAAK,GAAG,QAAQ,IAAI,GAAG,QAAQ,SAAS,GAC9D,GACA,UACF;CACA,MAAM,UAAU;EAAC,GAAG;EAAa;EAAY,GAAG,oBAAoB,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC;CAAC;CAI7F,MAAM,YAAY,QAAQ,UAAU;CACpC,IAAI,cAAc,MAChB,QAAQ,KAAK,GAAG,oBAAoB,KAAK,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC;CAIpE,KAAK,MAAM,QAAQ,CAAC,iBAAiB,eAAe,GAAG;EACrD,QAAQ,KAAK,GAAI,MAAM,qBAAqB,KAAK,MAAM,IAAI,CAAC,CAAE;EAC9D,IAAI,cAAc,MAAM,QAAQ,KAAK,GAAI,MAAM,qBAAqB,KAAK,WAAW,IAAI,CAAC,CAAE;CAC7F;CACA,MAAM,WAAW,MAAM,aAAa,IAAI;CACxC,IAAI,UAAU,QAAQ,KAAK,QAAQ;CACnC,OAAO,CAAC,GAAG,UAAU,GAAI,MAAM,2BAA2B,OAAO,CAAE;AACrE;;AAGA,SAAgB,uBAAuB,SAA2B;CAChE,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK;CAC1C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;AACpE;;;;;;;AAQA,eAAsB,0BACpB,MACA,YACA,aAAgC,CAAC,GACjC,gBACiB;CACjB,MAAM,UAAU,MAAM,8BAA8B,MAAM,YAAY,cAAc;CACpF,QAAQ,KAAK,GAAI,MAAM,2BAA2B,UAAU,CAAE;CAC9D,OAAO,uBAAuB,OAAO;AACvC;;AAGA,eAAsB,eAAe,MAA8C;CACjF,IAAI;EACF,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,mBAAmB,GAAG,MAAM;EAClE,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IACE,OAAO,YAAA,KACP,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,eAAe,YAC7B,CAAC,MAAM,QAAQ,OAAO,aAAa,KACnC,OAAO,OAAO,WAAW,YACzB,OAAO,WAAW,MAElB,OAAO;EAET,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,eAAsB,gBAAgB,MAAc,OAAsC;CACxF,MAAM,SAAS,KAAK,MAAM,mBAAmB;CAC7C,MAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChD,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,IAAI;CACtC,MAAM,UAAU,MAAM,KAAK,UAAU,KAAK,CAAC;CAC3C,MAAM,OAAO,MAAM,MAAM;AAC3B"}