@timber-js/app 0.2.0-alpha.204 → 0.2.0-alpha.206

package/src/server/slot-subtree-contain.ts

@@ -65,10 +65,6 @@ interface Containment {
    * so the level below is not wrapped (and re-walked) a second time.
    */
   opaque: unknown;
-  /** Slot name (e.g. `@artists`) used as a key prefix for wrapped elements. */
-  slotName?: string;
-  /** Monotonic counter for disambiguating same-name sibling components. */
-  wrapCount: number;
 }
 
 function isThenable(value: unknown): value is Thenable<unknown> {
@@ -160,7 +156,7 @@ function ContainedSlotComponent(props: {
   fallback: ReactNode;
 }): ReactNode | Promise<ReactNode> {
   const { component: Component, componentProps, fallback } = props;
-  const containment: Containment = { fallback, opaque: undefined, wrapCount: 0 };
+  const containment: Containment = { fallback, opaque: undefined };
   let result: unknown;
   try {
     result = Component(componentProps);
@@ -208,16 +204,13 @@ function walk(node: unknown, c: Containment, seen: WeakSet<object>): unknown {
     const { type, key, props } = node;
     const component = type === ContainedSlotComponent ? undefined : serverComponentOf(type);
     if (component) {
-      const effectiveKey = key ?? (c.slotName ? `${c.slotName}:${c.wrapCount++}` : null);
       const wrapped = {
         component,
         componentProps: props as Record<string, unknown>,
         fallback: c.fallback,
+        ...(key !== null ? { key } : undefined),
       };
-      return createElement(
-        ContainedSlotComponent,
-        effectiveKey === null ? wrapped : { ...wrapped, key: effectiveKey }
-      );
+      return createElement(ContainedSlotComponent, wrapped);
     }
     // Host elements, fragments, Suspense, client references, providers, and
     // wrappers this walk already made: keep the type, contain whatever server
@@ -225,7 +218,23 @@ function walk(node: unknown, c: Containment, seen: WeakSet<object>): unknown {
     // slots).
     const nextProps = walk(props, c, seen);
     if (nextProps === props) return node;
-    return createElement(type, key === null ? nextProps : { ...(nextProps as object), key });
+    // JSX compiles `<Flex><A /><B /></Flex>` to separate createElement
+    // arguments that React does not key-validate, but the walk produces
+    // `{ children: [A, B] }` inside props — an array that React treats as
+    // dynamic and warns about missing keys. For 2+ children, spread them as
+    // separate arguments to restore the JSX calling convention. For 0–1
+    // children, pass the array as a single child argument to preserve the
+    // array shape — spreading `[x]` would collapse it to a bare element,
+    // breaking components that call `children.map()`.
+    const { children, ...rest } = nextProps as Record<string, unknown>;
+    const propsWithKey = key === null ? rest : { ...rest, key };
+    if (Array.isArray(children) && children.length > 1) {
+      return createElement(type, propsWithKey, ...(children as ReactNode[]));
+    }
+    if (children !== undefined) {
+      return createElement(type, propsWithKey, children as ReactNode);
+    }
+    return createElement(type, propsWithKey);
   }
 
   if (isPlainObject(node)) {
@@ -257,8 +266,7 @@ function walk(node: unknown, c: Containment, seen: WeakSet<object>): unknown {
 export function containSlotSubtree(
   tree: ReactNode,
   fallback: ReactNode,
-  opaque?: ReactNode,
-  slotName?: string
+  opaque?: ReactNode
 ): ReactNode {
-  return walk(tree, { fallback, opaque, slotName, wrapCount: 0 }, new WeakSet()) as ReactNode;
+  return walk(tree, { fallback, opaque }, new WeakSet()) as ReactNode;
 }

package/src/server/tree-match.ts

@@ -66,6 +66,27 @@ export function matchUrlParts<TFile>(
   return null;
 }
 
+/**
+ * Yield every match for the given URL parts, in priority order.
+ *
+ * Same matching semantics as `matchUrlParts` — static > affixed-dynamic >
+ * bare-dynamic > catch-all > optional-catch-all — but instead of returning
+ * the first match, it yields all of them. Used by the metadata route matcher,
+ * which needs to try alternate owner segments when the first match doesn't
+ * own the requested metadata file.
+ */
+export function* matchUrlPartsAll<TFile>(
+  root: SegmentNode<TFile>,
+  parts: string[],
+  options?: TreeMatchOptions
+): Generator<TreeMatchResult<TFile>> {
+  const chain: SegmentNode<TFile>[] = [];
+  const params: Record<string, string | string[]> = {};
+  const requireTerminal = options?.requireTerminal ?? true;
+
+  yield* matchNodeAll(root, parts, 0, chain, params, requireTerminal);
+}
+
 // ─── Internal ─────────────────────────────────────────────────────────────
 
 /**
@@ -107,6 +128,59 @@ function isTerminal<TFile>(node: SegmentNode<TFile>): boolean {
   return !!(node.page || node.route);
 }
 
+/**
+ * Specificity tier for a segment. Lower = more specific. Matches the
+ * priority order in `matchNode`: static > affixed-dynamic > bare-dynamic >
+ * catch-all > optional-catch-all.
+ */
+function segmentTier<TFile>(node: SegmentNode<TFile>): number {
+  if (node.segmentType === 'static') return 0;
+  if (node.segmentType === 'dynamic' && (node.paramPrefix || node.paramSuffix)) return 1;
+  if (node.segmentType === 'dynamic') return 2;
+  if (node.segmentType === 'catch-all') return 3;
+  if (node.segmentType === 'optional-catch-all') return 4;
+  return 2;
+}
+
+/**
+ * Score a bare-dynamic candidate by running `matchNode` against its subtree
+ * with the remaining URL parts, then reading the tier of each segment in
+ * the matched chain. Returns a tier array that is compared lexicographically
+ * — the candidate whose chain has a lower tier at the first differing
+ * position is more specific.
+ *
+ * Delegates entirely to `matchNode`, so every segment type and priority
+ * rule is inherited automatically — no second copy to drift.
+ */
+function subtreeMatchScore<TFile>(
+  node: SegmentNode<TFile>,
+  parts: string[],
+  index: number,
+  requireTerminal: boolean
+): number[] {
+  const chain: SegmentNode<TFile>[] = [];
+  const params: Record<string, string | string[]> = {};
+  if (!matchNode(node, parts, index, chain, params, requireTerminal)) return [];
+  // Skip the first entry (the candidate node itself — it's the bare-dynamic
+  // we're scoring, which is the same tier for all candidates).
+  return chain.slice(1).map((seg) => segmentTier(seg));
+}
+
+/**
+ * Compare two tier arrays lexicographically. Negative means `a` is more
+ * specific (should be tried first).
+ */
+function compareTierArrays(a: number[], b: number[]): number {
+  const len = Math.max(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    // A shorter match is less specific — missing entries treated as worst tier.
+    const ta = i < a.length ? a[i] : 5;
+    const tb = i < b.length ? b[i] : 5;
+    if (ta !== tb) return ta - tb;
+  }
+  return 0;
+}
+
 /** Combined affix length for specificity ordering. */
 function affixLength<TFile>(node: SegmentNode<TFile>): number {
   return (node.paramPrefix?.length ?? 0) + (node.paramSuffix?.length ?? 0);
@@ -206,32 +280,177 @@ function matchNode<TFile>(
   }
 
   // 3. Bare dynamic segments ([param])
+  //    When multiple bare dynamics compete (common with route groups that
+  //    flatten into the same parent), sort by subtree specificity so a
+  //    branch containing a static match for the NEXT URL part is tried
+  //    first. Without this, the winner depends on children order and
+  //    renaming a route group can flip it — the exact shape the collision
+  //    validator exists to reject.
+  const bareDynamic = effective.filter(
+    ({ child }) =>
+      child.segmentType === 'dynamic' && child.paramName && !child.paramPrefix && !child.paramSuffix
+  );
+  if (bareDynamic.length > 1 && index + 1 < parts.length) {
+    const scores = new Map<SegmentNode<TFile>, number[]>();
+    for (const { child } of bareDynamic) {
+      scores.set(child, subtreeMatchScore(child, parts, index + 1, requireTerminal));
+    }
+    bareDynamic.sort((a, b) => compareTierArrays(scores.get(a.child)!, scores.get(b.child)!));
+  }
+  for (const { child, groupChain } of bareDynamic) {
+    chain.push(...groupChain);
+    const prev = params[child.paramName!];
+    params[child.paramName!] = part;
+    if (matchNode(child, parts, index + 1, chain, params, requireTerminal)) {
+      return true;
+    }
+    // Backtrack
+    chain.length -= groupChain.length;
+    if (prev !== undefined) {
+      params[child.paramName!] = prev;
+    } else {
+      delete params[child.paramName!];
+    }
+  }
+
+  // 4. Catch-all segments ([...param]) — must be terminal unless the
+  // caller passed requireTerminal:false (metadata route matching needs to
+  // find the owning segment even when it has no page).
   for (const { child, groupChain } of effective) {
     if (
-      child.segmentType === 'dynamic' &&
+      child.segmentType === 'catch-all' &&
       child.paramName &&
-      !child.paramPrefix &&
-      !child.paramSuffix
+      (!requireTerminal || isTerminal(child))
     ) {
-      chain.push(...groupChain);
-      const prev = params[child.paramName];
-      params[child.paramName] = part;
-      if (matchNode(child, parts, index + 1, chain, params, requireTerminal)) {
-        return true;
+      chain.push(...groupChain, child);
+      params[child.paramName] = parts.slice(index);
+      return true;
+    }
+  }
+
+  // 5. Optional catch-all segments ([[...param]]) — same terminal rule
+  for (const { child, groupChain } of effective) {
+    if (
+      child.segmentType === 'optional-catch-all' &&
+      child.paramName &&
+      (!requireTerminal || isTerminal(child))
+    ) {
+      chain.push(...groupChain, child);
+      params[child.paramName] = parts.slice(index);
+      return true;
+    }
+  }
+
+  chain.pop();
+  return false;
+}
+
+/**
+ * Generator twin of `matchNode` — yields every match instead of returning
+ * the first. Each yield snapshots `chain` and `params` so the caller gets
+ * independent results. After yielding, backtracking continues to find the
+ * next match.
+ */
+function* matchNodeAll<TFile>(
+  node: SegmentNode<TFile>,
+  parts: string[],
+  index: number,
+  chain: SegmentNode<TFile>[],
+  params: Record<string, string | string[]>,
+  requireTerminal: boolean
+): Generator<TreeMatchResult<TFile>> {
+  chain.push(node);
+
+  if (index >= parts.length) {
+    if (!requireTerminal || isTerminal(node)) {
+      yield { chain: [...chain], params: { ...params } };
+    }
+
+    for (const child of node.children) {
+      if (child.segmentType === 'group') {
+        yield* matchNodeAll(child, parts, index, chain, params, requireTerminal);
       }
-      // Backtrack
+    }
+
+    const effective = collectEffectiveChildren(node);
+    for (const { child, groupChain } of effective) {
+      if (child.segmentType === 'optional-catch-all' && (!requireTerminal || isTerminal(child))) {
+        chain.push(...groupChain, child);
+        yield { chain: [...chain], params: { ...params } };
+        chain.length -= groupChain.length + 1;
+      }
+    }
+
+    chain.pop();
+    return;
+  }
+
+  const part = parts[index];
+  const effective = collectEffectiveChildren(node);
+
+  // 1. Static segments
+  for (const { child, groupChain } of effective) {
+    if (child.segmentType === 'static' && child.segmentName === part) {
+      chain.push(...groupChain);
+      yield* matchNodeAll(child, parts, index + 1, chain, params, requireTerminal);
+      chain.length -= groupChain.length;
+    }
+  }
+
+  // 2. Affixed dynamic segments
+  const affixed = effective.filter(
+    ({ child }) =>
+      child.segmentType === 'dynamic' && child.paramName && (child.paramPrefix || child.paramSuffix)
+  );
+  affixed.sort((a, b) => affixLength(b.child) - affixLength(a.child));
+  for (const { child, groupChain } of affixed) {
+    const prefix = child.paramPrefix ?? '';
+    const suffix = child.paramSuffix ?? '';
+    if (
+      part.length > prefix.length + suffix.length &&
+      (!prefix || part.startsWith(prefix)) &&
+      (!suffix || part.endsWith(suffix))
+    ) {
+      const value = part.slice(prefix.length, part.length - (suffix.length || 0));
+      chain.push(...groupChain);
+      const prev = params[child.paramName!];
+      params[child.paramName!] = value;
+      yield* matchNodeAll(child, parts, index + 1, chain, params, requireTerminal);
       chain.length -= groupChain.length;
       if (prev !== undefined) {
-        params[child.paramName] = prev;
+        params[child.paramName!] = prev;
       } else {
-        delete params[child.paramName];
+        delete params[child.paramName!];
       }
     }
   }
 
-  // 4. Catch-all segments ([...param]) — must be terminal unless the
-  // caller passed requireTerminal:false (metadata route matching needs to
-  // find the owning segment even when it has no page).
+  // 3. Bare dynamic segments
+  const bareDynamic = effective.filter(
+    ({ child }) =>
+      child.segmentType === 'dynamic' && child.paramName && !child.paramPrefix && !child.paramSuffix
+  );
+  if (bareDynamic.length > 1 && index + 1 < parts.length) {
+    const scores = new Map<SegmentNode<TFile>, number[]>();
+    for (const { child } of bareDynamic) {
+      scores.set(child, subtreeMatchScore(child, parts, index + 1, requireTerminal));
+    }
+    bareDynamic.sort((a, b) => compareTierArrays(scores.get(a.child)!, scores.get(b.child)!));
+  }
+  for (const { child, groupChain } of bareDynamic) {
+    chain.push(...groupChain);
+    const prev = params[child.paramName!];
+    params[child.paramName!] = part;
+    yield* matchNodeAll(child, parts, index + 1, chain, params, requireTerminal);
+    chain.length -= groupChain.length;
+    if (prev !== undefined) {
+      params[child.paramName!] = prev;
+    } else {
+      delete params[child.paramName!];
+    }
+  }
+
+  // 4. Catch-all segments
   for (const { child, groupChain } of effective) {
     if (
       child.segmentType === 'catch-all' &&
@@ -239,12 +458,19 @@ function matchNode<TFile>(
       (!requireTerminal || isTerminal(child))
     ) {
       chain.push(...groupChain, child);
+      const prev = params[child.paramName];
       params[child.paramName] = parts.slice(index);
-      return true;
+      yield { chain: [...chain], params: { ...params } };
+      chain.length -= groupChain.length + 1;
+      if (prev !== undefined) {
+        params[child.paramName] = prev;
+      } else {
+        delete params[child.paramName];
+      }
     }
   }
 
-  // 5. Optional catch-all segments ([[...param]]) — same terminal rule
+  // 5. Optional catch-all segments
   for (const { child, groupChain } of effective) {
     if (
       child.segmentType === 'optional-catch-all' &&
@@ -252,11 +478,17 @@ function matchNode<TFile>(
       (!requireTerminal || isTerminal(child))
     ) {
       chain.push(...groupChain, child);
+      const prev = params[child.paramName];
       params[child.paramName] = parts.slice(index);
-      return true;
+      yield { chain: [...chain], params: { ...params } };
+      chain.length -= groupChain.length + 1;
+      if (prev !== undefined) {
+        params[child.paramName] = prev;
+      } else {
+        delete params[child.paramName];
+      }
     }
   }
 
   chain.pop();
-  return false;
 }

package/dist/_chunks/build-manifest-DWppEdLB.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-manifest-DWppEdLB.js","names":[],"sources":["../../src/server/build-manifest.ts"],"sourcesContent":["/**\n * Build manifest types and utilities for CSS and JS asset tracking.\n *\n * The build manifest maps route segment file paths to their output\n * chunks from Vite's client build. This enables:\n * - <link rel=\"stylesheet\"> injection in HTML <head>\n * - <script type=\"module\"> with hashed URLs in production\n * - <link rel=\"modulepreload\"> for client chunk dependencies\n * - Link preload headers for Early Hints (103)\n *\n * In dev mode, Vite's HMR client handles CSS/JS injection, so the build\n * manifest is empty. In production, it's populated from Vite's\n * .vite/manifest.json after the client build.\n *\n * Design docs: 18-build-system.md §\"Build Manifest\", 02-rendering-pipeline.md §\"Early Hints\"\n */\n\n/** A font asset entry in the build manifest. */\nexport interface ManifestFontEntry {\n  /** URL path to the font file (e.g. `/_timber/fonts/inter-latin-400-abc123.woff2`). */\n  href: string;\n  /** Font format (e.g. `woff2`). */\n  format: string;\n  /** Crossorigin attribute — always `anonymous` for fonts. */\n  crossOrigin: string;\n}\n\n/** Build manifest mapping input file paths to output asset URLs. */\nexport interface BuildManifest {\n  /** Map from input file path (relative to project root) to output CSS URLs. */\n  css: Record<string, string[]>;\n  /** Map from input file path to output JS chunk URL (hashed filename). */\n  js: Record<string, string>;\n  /** Map from input file path to transitive JS dependency URLs for modulepreload. */\n  modulepreload: Record<string, string[]>;\n  /** Map from input file path to font assets used by that module. */\n  fonts: Record<string, ManifestFontEntry[]>;\n  /**\n   * Cache-busting hashes for metadata route files (opengraph-image, etc.).\n   * Map from file path (relative to project root) to short content hash.\n   * In dev mode this is empty — a startup nonce is used instead.\n   */\n  metadataRouteHashes?: Record<string, string>;\n  /**\n   * Static request-dependency map from the Vite plugin's module-graph analysis.\n   * Map from segment entry file path to whether it's request-dependent.\n   * Used by buildSegmentInfo() for X-Timber-Segments in production.\n   */\n  requestDep?: Record<string, boolean>;\n}\n\n/**\n * Empty build manifest used in dev mode, and the single source of truth for\n * what an empty manifest contains.\n *\n * `virtual:timber-build-manifest` serializes this constant into its generated\n * source rather than restating it — one literal for the dev module, one for the\n * production module's `globalThis.__TIMBER_BUILD_MANIFEST__ ?? …` fallback.\n * They were three hand-written objects that had already drifted: this one and\n * the dev literal were missing `requestDep` while the production fallback had\n * it, so a reader who grepped the built bundle for `requestDep` found the one\n * copy that mentioned it and read the fallback as the shipped map (TIM-1300).\n * A field added here now reaches every copy.\n */\nexport const EMPTY_BUILD_MANIFEST: BuildManifest = {\n  css: {},\n  js: {},\n  modulepreload: {},\n  fonts: {},\n  metadataRouteHashes: {},\n  requestDep: {},\n};\n\n/** Segment shape expected by collectRouteCss (matches ManifestSegmentNode). */\ninterface SegmentWithFiles {\n  layout?: { filePath: string };\n  page?: { filePath: string };\n}\n\n/**\n * Collect all CSS files needed for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting CSS for each layout and page.\n * Deduplicates while preserving order (root layout CSS first).\n */\nexport function collectRouteCss(segments: SegmentWithFiles[], manifest: BuildManifest): string[] {\n  const seen = new Set<string>();\n  const result: string[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const cssFiles = manifest.css[file.filePath];\n      if (!cssFiles) continue;\n      for (const url of cssFiles) {\n        if (!seen.has(url)) {\n          seen.add(url);\n          result.push(url);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"stylesheet\"> tags for CSS URLs.\n *\n * Returns an HTML string to prepend to headHtml for injection\n * via injectHead() before </head>.\n */\nexport function buildCssLinkTags(cssUrls: string[]): string {\n  // Emit only <link rel=\"stylesheet\"> — no preload tags. CSS preloading\n  // is handled by 103 Early Hints (Link header) which fires before the\n  // HTML stream. Float also emits `<link rel=\"stylesheet\" data-precedence>`\n  // at the top of <head> during Fizz rendering — the browser discovers\n  // CSS from that tag. A <link rel=\"preload\"> here would arrive *after*\n  // Float's stylesheet tag and trigger \"Preload was ignored\" warnings.\n  return cssUrls.map((url) => `<link rel=\"stylesheet\" href=\"${url}\">`).join('');\n}\n\n// ─── Font utilities ──────────────────────────────────────────────────────\n\n/**\n * Collect all font entries needed for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting fonts for each layout and page.\n * Deduplicates by href while preserving order.\n */\nexport function collectRouteFonts(\n  segments: SegmentWithFiles[],\n  manifest: BuildManifest\n): ManifestFontEntry[] {\n  const seen = new Set<string>();\n  const result: ManifestFontEntry[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const fonts = manifest.fonts[file.filePath];\n      if (!fonts) continue;\n      for (const entry of fonts) {\n        if (!seen.has(entry.href)) {\n          seen.add(entry.href);\n          result.push(entry);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"preload\"> tags for font assets.\n *\n * Font preloads use `as=font` and always include `crossorigin` (required\n * for font preloads even for same-origin resources per the spec).\n */\nexport function buildFontPreloadTags(fonts: ManifestFontEntry[]): string {\n  return fonts\n    .map(\n      (f) =>\n        `<link rel=\"preload\" href=\"${f.href}\" as=\"font\" type=\"font/${f.format}\" crossorigin=\"${f.crossOrigin}\">`\n    )\n    .join('');\n}\n\n// ─── JS chunk utilities ──────────────────────────────────────────────────\n\n/**\n * Collect modulepreload URLs for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting transitive JS dependencies\n * for each layout and page. Deduplicates across segments.\n */\nexport function collectRouteModulepreloads(\n  segments: SegmentWithFiles[],\n  manifest: BuildManifest\n): string[] {\n  const seen = new Set<string>();\n  const result: string[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const preloads = manifest.modulepreload[file.filePath];\n      if (!preloads) continue;\n      for (const url of preloads) {\n        if (!seen.has(url)) {\n          seen.add(url);\n          result.push(url);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"modulepreload\"> tags for JS dependency URLs.\n *\n * Modulepreload hints tell the browser to fetch and parse JS modules\n * before they're needed, reducing waterfall latency for dynamic imports.\n */\nexport function buildModulepreloadTags(urls: string[]): string {\n  return urls.map((url) => `<link rel=\"modulepreload\" href=\"${url}\">`).join('');\n}\n"],"mappings":";;;;;;;;;;;;;;AAgEA,IAAa,uBAAsC;CACjD,KAAK,CAAC;CACN,IAAI,CAAC;CACL,eAAe,CAAC;CAChB,OAAO,CAAC;CACR,qBAAqB,CAAC;CACtB,YAAY,CAAC;AACf;;;;;;;AAcA,SAAgB,gBAAgB,UAA8B,UAAmC;CAC/F,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAmB,CAAC;CAE1B,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,WAAW,SAAS,IAAI,KAAK;EACnC,IAAI,CAAC,UAAU;EACf,KAAK,MAAM,OAAO,UAChB,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG;GAClB,KAAK,IAAI,GAAG;GACZ,OAAO,KAAK,GAAG;EACjB;CAEJ;CAGF,OAAO;AACT;;;;;;;AA0BA,SAAgB,kBACd,UACA,UACqB;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAA8B,CAAC;CAErC,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,QAAQ,SAAS,MAAM,KAAK;EAClC,IAAI,CAAC,OAAO;EACZ,KAAK,MAAM,SAAS,OAClB,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,GAAG;GACzB,KAAK,IAAI,MAAM,IAAI;GACnB,OAAO,KAAK,KAAK;EACnB;CAEJ;CAGF,OAAO;AACT;;;;;;;AAyBA,SAAgB,2BACd,UACA,UACU;CACV,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAmB,CAAC;CAE1B,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,WAAW,SAAS,cAAc,KAAK;EAC7C,IAAI,CAAC,UAAU;EACf,KAAK,MAAM,OAAO,UAChB,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG;GAClB,KAAK,IAAI,GAAG;GACZ,OAAO,KAAK,GAAG;EACjB;CAEJ;CAGF,OAAO;AACT"}

package/dist/_chunks/csp-nonce-hOGniaG4.js

@@ -1,227 +0,0 @@
-import { r as requestContextAls } from "./als-registry-C6kcfprT.js";
-import { R as getSetCookieHeaders, m as setLogger, q as getTraceId } from "./logger-DqJ2VoAY.js";
-import { r as isRscRequest } from "./rsc-media-type-DDc7duTD.js";
-//#region src/server/instrumentation.ts
-/**
-* Instrumentation — loads and runs the user's instrumentation.ts file.
-*
-* instrumentation.ts is a file convention at the project root that exports:
-* - register() — called once at server startup, before the first request
-* - onRequestError() — called for every unhandled server error
-* - logger — any object with info/warn/error/debug methods
-*
-* See design/17-logging.md §"instrumentation.ts — The Entry Point"
-*/
-var _initialized = false;
-var _onRequestError = null;
-/**
-* Load and initialize the user's instrumentation.ts module.
-*
-* - Awaits register() before returning (server blocks on this).
-* - Picks up the logger export and wires it into the framework logger.
-* - Stores onRequestError for later invocation.
-*
-* @param loader - Function that dynamically imports the user's instrumentation module.
-*                 Returns null if no instrumentation.ts exists.
-*/
-async function loadInstrumentation(loader) {
-	if (_initialized) return;
-	_initialized = true;
-	let mod;
-	try {
-		mod = await loader();
-	} catch (error) {
-		console.error("[timber] Failed to load instrumentation.ts:", error);
-		return;
-	}
-	if (!mod) return;
-	if (mod.logger && typeof mod.logger.info === "function") setLogger(mod.logger);
-	if (typeof mod.onRequestError === "function") _onRequestError = mod.onRequestError;
-	if (typeof mod.register === "function") try {
-		await mod.register();
-	} catch (error) {
-		console.error("[timber] instrumentation.ts register() threw:", error);
-		throw error;
-	}
-}
-/**
-* Call the user's onRequestError hook. Catches and logs any errors thrown
-* by the hook itself — it must not affect the response.
-*/
-async function callOnRequestError(error, request, context) {
-	if (!_onRequestError) return;
-	try {
-		await _onRequestError(error, request, context);
-	} catch (hookError) {
-		console.error("[timber] onRequestError hook threw:", hookError);
-	}
-}
-/**
-* Check if onRequestError is registered.
-*/
-function hasOnRequestError() {
-	return _onRequestError !== null;
-}
-//#endregion
-//#region src/server/pipeline-helpers.ts
-/**
-* Build a proxy resolver closure from the declared source. Called exactly
-* once at `createPipeline` setup time, so the hot path sees only the branch
-* that corresponds to this pipeline's configured variant.
-*
-* Returns `null` when the app has no proxy.ts — the hot path short-circuits
-* around `runProxyPhase` entirely in that case.
-*
-* Accepts the sugar form (a bare `ProxyExport` — function or function array)
-* and normalises it to the static variant. Functions and arrays are
-* structurally distinct from the tagged `{ kind: 'lazy', loader }` object,
-* so discrimination is unambiguous.
-*/
-function makeProxyResolver(proxy) {
-	if (proxy === void 0) return null;
-	if (typeof proxy === "function" || Array.isArray(proxy)) {
-		const exp = proxy;
-		return () => exp;
-	}
-	if (proxy.kind === "static") {
-		const exp = proxy.export;
-		return () => exp;
-	}
-	const loader = proxy.loader;
-	return async () => (await loader()).default;
-}
-/**
-* Apply all Set-Cookie headers from the cookie jar to a Headers object.
-* Each cookie gets its own Set-Cookie header per RFC 6265 §4.1.
-*/
-function applyCookieJar(headers) {
-	for (const value of getSetCookieHeaders()) headers.append("Set-Cookie", value);
-}
-/**
-* Merge framework-managed response headers onto a terminal response without
-* overwriting headers the terminal response already set itself.
-*/
-function mergeMissingHeaders(target, source) {
-	const existingKeys = new Set([...target.keys()].map((key) => key.toLowerCase()));
-	for (const [key, value] of source.entries()) if (!existingKeys.has(key.toLowerCase())) target.append(key, value);
-}
-/**
-* Clone a Response into a fresh one whose header bag is guaranteed mutable.
-*
-* `Response.redirect()` and some platform-level passthrough responses (notably
-* on Cloudflare Workers) return objects with frozen header bags. Calling
-* `.set()` or `.append()` on them throws `TypeError: immutable`, which the
-* pipeline can hit when it appends Set-Cookie or Server-Timing entries.
-*
-* The pipeline calls this at the producer sites where user-controlled
-* responses enter the framework — `outcomeToResponse` for all phase outcomes,
-* and `handleRequest` for metadata-route and auto-sitemap user handlers — so
-* downstream code can write headers without runtime feature-detection.
-*
-* The clone is unconditional. This is a deliberate trade: we avoid a
-* try/catch + thrown `TypeError` on every request (the previous probe-based
-* approach paid that cost on the hot path) and accept one cheap Response
-* rewrap at the framework boundary instead.
-*/
-function cloneWithMutableHeaders(response) {
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers: new Headers(response.headers)
-	});
-}
-/**
-* Build a redirect Response from a RedirectSignal.
-*
-* For RSC payload requests (client navigation), returns 204 + X-Timber-Redirect
-* so the client router can perform a soft SPA redirect. A raw 302 would be
-* turned into an opaque redirect by fetch({redirect:'manual'}), crashing
-* createFromFetch. See design/19-client-navigation.md.
-*/
-function buildRedirectResponse(signal, req, headers) {
-	if (isRscRequest(req)) {
-		headers.set("X-Timber-Redirect", signal.location);
-		return new Response(null, {
-			status: 204,
-			headers
-		});
-	}
-	headers.set("Location", signal.location);
-	return new Response(null, {
-		status: signal.status,
-		headers
-	});
-}
-/**
-* Fire the user's onRequestError hook with request context.
-* Extracts request info from the Request object and calls the instrumentation hook.
-*/
-async function fireOnRequestError(error, req, phase) {
-	const url = new URL(req.url);
-	const headersObj = {};
-	req.headers.forEach((v, k) => {
-		headersObj[k] = v;
-	});
-	await callOnRequestError(error, {
-		method: req.method,
-		path: url.pathname,
-		headers: headersObj
-	}, {
-		phase,
-		routePath: url.pathname,
-		routeType: "page",
-		traceId: getTraceId()
-	});
-}
-//#endregion
-//#region src/server/csp-nonce.ts
-/**
-* CSP nonce — per-request, generated on demand.
-*
-* timber emits several inline `<script>` tags per HTML response — React's
-* bootstrap script and Fizz runtime, the Flight init/chunk scripts, the
-* segment-tree script, and the post-flush noindex script. Under a strict
-* `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every
-* one of them needs the request's nonce or the browser refuses to run it.
-*
-* The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it
-* in the CSP header it sets through `ctx.headers`. The first read generates
-* the value and stores it on the request context; the render pipeline reads
-* it back with `getCspNonce()` and stamps it on every inline script. A
-* request whose middleware never reads `ctx.nonce` has no nonce, and its
-* markup is byte-identical to a render without this feature. timber does
-* not parse the CSP header — the app owns the policy, timber owns the
-* markup, and `ctx.nonce` is the one value both are built from.
-*
-* `proxy.ts` cannot participate: it only sees the finished response from
-* `next()`, after the markup exists.
-*
-* See design/13-security.md §"Content Security Policy" (TIM-1414).
-*/
-/**
-* Generate a CSP nonce: 128 random bits, base64. Matches CSP's
-* `base64-value` grammar, so it is valid in the header verbatim and safe
-* inside a double-quoted HTML attribute without escaping.
-*/
-function generateNonce() {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	let binary = "";
-	for (const b of bytes) binary += String.fromCharCode(b);
-	return btoa(binary);
-}
-/**
-* The request's CSP nonce, creating it on first call. Backs the
-* `ctx.nonce` getter on `MiddlewareContext`. Outside a request context
-* (tests, build-time rendering) a fresh value is returned but not
-* retained, since there is no request for it to belong to.
-*/
-function requestCspNonce() {
-	const store = requestContextAls.getStore();
-	if (!store) return generateNonce();
-	store.cspNonce ??= generateNonce();
-	return store.cspNonce;
-}
-//#endregion
-export { fireOnRequestError as a, callOnRequestError as c, cloneWithMutableHeaders as i, hasOnRequestError as l, applyCookieJar as n, makeProxyResolver as o, buildRedirectResponse as r, mergeMissingHeaders as s, requestCspNonce as t, loadInstrumentation as u };
-
-//# sourceMappingURL=csp-nonce-hOGniaG4.js.map