@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/dist/_chunks/actions-jNrXdzgs.js

@@ -1,346 +0,0 @@
-import { i as revalidationAls } from "./als-registry-C6kcfprT.js";
-import { o as isDenySignal, s as isRedirectSignal } from "./primitives-DLAnvsrk.js";
-import { r as canonicalize } from "./canonicalize-CgHoscYO.js";
-import { T as withSpan } from "./logger-k2DQ4EUf.js";
-import { t as cache } from "./cache-api-CUD9Ezaq.js";
-//#region src/server/form-data.ts
-/**
-* FormData preprocessing — schema-agnostic conversion of FormData to typed objects.
-*
-* FormData is all strings. Schema validation expects typed values. This module
-* bridges the gap with intelligent coercion that runs *before* schema validation.
-*
-* Inspired by zod-form-data, but schema-agnostic — works with any Standard Schema
-* library (Zod, Valibot, ArkType).
-*
-* See design/08-forms-and-actions.md §"parseFormData() and coerce helpers"
-*/
-/**
-* Convert FormData into a plain object with intelligent coercion.
-*
-* Handles:
-* - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: ["js", "ts"] }`
-* - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: "Alice" } }`
-* - **Empty strings → undefined**: Enables `.optional()` semantics in schemas
-* - **Empty Files → undefined**: File inputs with no selection become `undefined`
-* - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded
-*/
-function parseFormData(formData) {
-	const flat = {};
-	for (const key of new Set(formData.keys())) {
-		if (key.startsWith("$ACTION_")) continue;
-		if (DANGEROUS_KEYS.has(key)) continue;
-		const processed = formData.getAll(key).map(normalizeValue);
-		if (processed.length === 1) flat[key] = processed[0];
-		else flat[key] = processed.filter((v) => v !== void 0 && v !== "");
-	}
-	return expandDotPaths(flat);
-}
-/**
-* Normalize a single FormData entry value.
-* - Empty File objects (no selection) → undefined
-* - Strings pass through as-is (empty strings stay as empty strings so
-*   schema validators like `z.string().min(1, 'Required')` can produce
-*   their custom error messages instead of a generic type mismatch)
-* - Everything else passes through as-is
-*/
-function normalizeValue(value) {
-	if (value instanceof File && value.size === 0 && value.name === "") return;
-	return value;
-}
-/**
-* Expand dot-notation keys into nested objects.
-* `{ "user.name": "Alice", "user.age": "30" }` → `{ user: { name: "Alice", age: "30" } }`
-*
-* Keys without dots are left as-is. Bracket notation (e.g. `items[0]`) is NOT
-* supported — use dot notation (`items.0`) instead.
-*/
-function expandDotPaths(flat) {
-	const result = {};
-	let hasDotPaths = false;
-	for (const key of Object.keys(flat)) if (key.includes(".")) {
-		hasDotPaths = true;
-		break;
-	}
-	if (!hasDotPaths) return flat;
-	for (const [key, value] of Object.entries(flat)) {
-		const parts = key.split(".");
-		if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
-		if (parts.length === 1) {
-			result[parts[0]] = value;
-			continue;
-		}
-		let current = result;
-		for (let i = 0; i < parts.length - 1; i++) {
-			const part = parts[i];
-			if (current[part] === void 0 || current[part] === null) current[part] = {};
-			if (typeof current[part] !== "object" || current[part] instanceof File) current[part] = {};
-			current = current[part];
-		}
-		current[parts[parts.length - 1]] = value;
-	}
-	return result;
-}
-var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__"]);
-/**
-* Schema-agnostic coercion primitives for common FormData patterns.
-*
-* These are plain transform functions — they compose with any schema library's
-* `transform`/`preprocess` pipeline:
-*
-* ```ts
-* // Zod
-* z.preprocess(coerce.number, z.number())
-* // Valibot
-* v.pipe(v.unknown(), v.transform(coerce.number), v.number())
-* ```
-*/
-var coerce = {
-	/**
-	* Coerce an empty string to undefined for optional text fields.
-	* Use with `.optional()` schemas where an empty input means "not provided".
-	*
-	* ```ts
-	* // Zod
-	* z.unknown().transform(coerce.text).pipe(z.string().optional())
-	* // Valibot
-	* v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))
-	* ```
-	*/
-	text(value) {
-		if (value === void 0 || value === null || value === "") return void 0;
-		if (typeof value === "string") return value;
-	},
-	/**
-	* Coerce a string to a number.
-	* - `"42"` → `42`
-	* - `"3.14"` → `3.14`
-	* - `""` / `undefined` / `null` → `undefined`
-	* - Non-numeric strings → `undefined` (schema validation will catch this)
-	*/
-	number(value) {
-		if (value === void 0 || value === null || value === "") return void 0;
-		if (typeof value === "number") return value;
-		if (typeof value !== "string") return void 0;
-		const num = Number(value);
-		if (Number.isNaN(num)) return void 0;
-		return num;
-	},
-	/**
-	* Coerce a checkbox value to a boolean.
-	* HTML checkboxes submit "on" when checked and are absent when unchecked.
-	* - `"on"` / any truthy string → `true`
-	* - `undefined` / `null` / `""` → `false`
-	*/
-	checkbox(value) {
-		if (value === void 0 || value === null || value === "") return false;
-		if (typeof value === "boolean") return value;
-		return typeof value === "string" && value.length > 0;
-	},
-	/**
-	* Parse a JSON string into an object.
-	* - Valid JSON string → parsed object
-	* - `""` / `undefined` / `null` → `undefined`
-	* - Invalid JSON → `undefined` (schema validation will catch this)
-	*/
-	json(value) {
-		if (value === void 0 || value === null || value === "") return void 0;
-		if (typeof value !== "string") return value;
-		try {
-			return JSON.parse(value);
-		} catch {
-			return;
-		}
-	},
-	/**
-	* Coerce a date string to a Date object.
-	* Handles `<input type="date">` (`"2024-01-15"`), `<input type="datetime-local">`
-	* (`"2024-01-15T10:30"`), and full ISO 8601 strings.
-	* - Valid date string → `Date`
-	* - `""` / `undefined` / `null` → `undefined`
-	* - Invalid date strings → `undefined` (schema validation will catch this)
-	* - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`
-	*/
-	date(value) {
-		if (value === void 0 || value === null || value === "") return void 0;
-		if (value instanceof Date) return value;
-		if (typeof value !== "string") return void 0;
-		const date = new Date(value);
-		if (Number.isNaN(date.getTime())) return void 0;
-		const ymdMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})/);
-		if (ymdMatch) {
-			const inputYear = Number(ymdMatch[1]);
-			const inputMonth = Number(ymdMatch[2]);
-			const inputDay = Number(ymdMatch[3]);
-			const isUTC = value.length === 10 || value.endsWith("Z");
-			const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();
-			const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;
-			const parsedDay = isUTC ? date.getUTCDate() : date.getDate();
-			if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) return;
-		}
-		return date;
-	},
-	/**
-	* Create a File coercion function with optional size and mime type validation.
-	* Returns the File if valid, `undefined` otherwise.
-	*
-	* ```ts
-	* // Basic — just checks it's a real File
-	* z.preprocess(coerce.file(), z.instanceof(File))
-	*
-	* // With constraints
-	* z.preprocess(
-	*   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),
-	*   z.instanceof(File)
-	* )
-	* ```
-	*/
-	file(options) {
-		return (value) => {
-			if (value === void 0 || value === null || value === "") return void 0;
-			if (!(value instanceof File)) return void 0;
-			if (value.size === 0 && value.name === "") return void 0;
-			if (options?.maxSize !== void 0 && value.size > options.maxSize) return;
-			if (options?.accept !== void 0 && !options.accept.includes(value.type)) return;
-			return value;
-		};
-	}
-};
-//#endregion
-//#region src/server/actions.ts
-/**
-* Server action primitives: revalidatePath, revalidateTag, and the action handler.
-*
-* - revalidatePath(path) re-renders the route at that path and returns the RSC
-*   flight payload for inline reconciliation.
-* - revalidateTag(tag) invalidates timber.cache entries by tag.
-*
-* Both are callable from anywhere on the server — actions, API routes, handlers.
-*
-* The action handler processes incoming action requests, validates CSRF,
-* enforces body limits, executes the action, and returns the response
-* (with piggybacked RSC payload if revalidatePath was called).
-*
-* See design/08-forms-and-actions.md
-*/
-/**
-* Get the current revalidation state. Throws if called outside an action context.
-* @internal
-*/
-function getRevalidationState() {
-	const state = revalidationAls.getStore();
-	if (!state) throw new Error("revalidatePath/revalidateTag called outside of a server action context. These functions can only be called during action execution.");
-	return state;
-}
-/**
-* Re-render the route at `path` and include the RSC flight payload in the
-* action response. The client reconciles inline — no separate fetch needed.
-*
-* Can be called from server actions, API routes, or any server-side context.
-*
-* @param path - The path to re-render (e.g. '/dashboard', '/todos').
-*/
-function revalidatePath(path) {
-	const state = getRevalidationState();
-	if (!state.paths.includes(path)) state.paths.push(path);
-}
-/**
-* Invalidate all timber.cache entries tagged with `tag`.
-* Does not return a payload — the next request for an invalidated entry re-executes.
-*
-* @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
-*/
-function revalidateTag(tag) {
-	const state = getRevalidationState();
-	if (!state.tags.includes(tag)) state.tags.push(tag);
-}
-function stripFragment(path) {
-	const idx = path.indexOf("#");
-	return idx >= 0 ? path.slice(0, idx) : path;
-}
-/**
-* Execute a server action and process revalidation.
-*
-* 1. Sets up revalidation state
-* 2. Calls the action function
-* 3. Processes revalidateTag calls (invalidates cache entries)
-* 4. Processes revalidatePath calls (re-renders and captures RSC payload)
-* 5. Returns the action result + optional RSC payload
-*
-* @param actionFn - The server action function to execute.
-* @param args - Arguments to pass to the action.
-* @param config - Handler configuration (cache handler, renderer).
-*/
-async function executeAction(actionFn, args, config = {}, spanMeta) {
-	const state = {
-		paths: [],
-		tags: []
-	};
-	let actionResult;
-	let redirectTo;
-	let redirectStatus;
-	await revalidationAls.run(state, async () => {
-		try {
-			actionResult = await withSpan("timber.action", {
-				...spanMeta?.actionFile ? { "timber.action_file": spanMeta.actionFile } : {},
-				...spanMeta?.actionName ? { "timber.action_name": spanMeta.actionName } : {}
-			}, () => actionFn(...args));
-		} catch (error) {
-			if (isRedirectSignal(error)) {
-				redirectTo = error.location;
-				redirectStatus = error.status;
-			} else throw error;
-		}
-	});
-	if (state.tags.length > 0) {
-		const results = await Promise.allSettled(state.tags.map((tag) => cache.invalidate({ tag })));
-		for (const r of results) if (r.status === "rejected") console.error("[timber] revalidateTag invalidation failed:", r.reason);
-	}
-	let revalidation;
-	let invalidatedPaths;
-	if (state.paths.length > 0) {
-		const path = state.paths[0];
-		if (config.requestPathname && !revalidationPathMatches(path, config.requestPathname, config.requestSearch)) invalidatedPaths = [stripFragment(path)];
-		else if (config.renderer) try {
-			revalidation = await config.renderer(path);
-		} catch (renderError) {
-			if (isRedirectSignal(renderError)) {
-				redirectTo = renderError.location;
-				redirectStatus = renderError.status;
-			} else if (isDenySignal(renderError)) console.error(`[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`);
-			else console.error("[timber] revalidatePath render failed:", renderError);
-		}
-	}
-	return {
-		actionResult,
-		revalidation,
-		invalidatedPaths,
-		...redirectTo ? {
-			redirectTo,
-			redirectStatus
-		} : {}
-	};
-}
-/**
-* Check if a `revalidatePath(path)` argument matches the request pathname.
-/**
-* Canonicalizes the revalidated path the same way the renderer does so
-* equivalent paths compare equal. Returns true when the paths match or
-* when comparison is inconclusive (validation failure → render to be safe).
-*/
-function revalidationPathMatches(revalidatedPath, requestPathname, requestSearch) {
-	const hashIdx = revalidatedPath.indexOf("#");
-	const noFragment = hashIdx >= 0 ? revalidatedPath.slice(0, hashIdx) : revalidatedPath;
-	const queryIdx = noFragment.indexOf("?");
-	const pathnameOnly = queryIdx >= 0 ? noFragment.slice(0, queryIdx) : noFragment;
-	const search = queryIdx >= 0 ? noFragment.slice(queryIdx) : "";
-	const canonical = canonicalize(pathnameOnly, true);
-	if (!canonical.ok) return true;
-	if (canonical.pathname !== requestPathname) return false;
-	if (search && search !== (requestSearch ?? "")) return false;
-	return true;
-}
-//#endregion
-export { parseFormData as a, coerce as i, revalidatePath as n, revalidateTag as r, executeAction as t };
-
-//# sourceMappingURL=actions-jNrXdzgs.js.map

package/dist/_chunks/actions-jNrXdzgs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"actions-jNrXdzgs.js","names":[],"sources":["../../src/server/form-data.ts","../../src/server/actions.ts"],"sourcesContent":["/**\n * FormData preprocessing — schema-agnostic conversion of FormData to typed objects.\n *\n * FormData is all strings. Schema validation expects typed values. This module\n * bridges the gap with intelligent coercion that runs *before* schema validation.\n *\n * Inspired by zod-form-data, but schema-agnostic — works with any Standard Schema\n * library (Zod, Valibot, ArkType).\n *\n * See design/08-forms-and-actions.md §\"parseFormData() and coerce helpers\"\n */\n\n// ─── parseFormData ───────────────────────────────────────────────────────\n\n/**\n * Convert FormData into a plain object with intelligent coercion.\n *\n * Handles:\n * - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: [\"js\", \"ts\"] }`\n * - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: \"Alice\" } }`\n * - **Empty strings → undefined**: Enables `.optional()` semantics in schemas\n * - **Empty Files → undefined**: File inputs with no selection become `undefined`\n * - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded\n */\nexport function parseFormData(formData: FormData): Record<string, unknown> {\n  const flat: Record<string, unknown> = {};\n\n  for (const key of new Set(formData.keys())) {\n    // Skip React internal fields\n    if (key.startsWith('$ACTION_')) continue;\n\n    // Skip prototype-pollution keys at the top level — assigning to\n    // `flat['__proto__']` invokes the prototype setter and can splice\n    // attacker-controlled data into `flat`'s prototype chain.\n    // The dot-path case is filtered separately in `expandDotPaths`.\n    if (DANGEROUS_KEYS.has(key)) continue;\n\n    const values = formData.getAll(key);\n    const processed = values.map(normalizeValue);\n\n    if (processed.length === 1) {\n      flat[key] = processed[0];\n    } else {\n      // Filter out undefined (empty Files) and empty strings from multi-value fields.\n      // Multi-value fields (e.g. tags=js&tags=&tags=ts) should not include blanks.\n      flat[key] = processed.filter((v) => v !== undefined && v !== '');\n    }\n  }\n\n  // Expand dot-notation paths into nested objects\n  return expandDotPaths(flat);\n}\n\n/**\n * Normalize a single FormData entry value.\n * - Empty File objects (no selection) → undefined\n * - Strings pass through as-is (empty strings stay as empty strings so\n *   schema validators like `z.string().min(1, 'Required')` can produce\n *   their custom error messages instead of a generic type mismatch)\n * - Everything else passes through as-is\n */\nfunction normalizeValue(value: FormDataEntryValue): unknown {\n  // File input with no selection: browsers submit a File with name=\"\" and size=0\n  if (value instanceof File && value.size === 0 && value.name === '') {\n    return undefined;\n  }\n\n  return value;\n}\n\n/**\n * Expand dot-notation keys into nested objects.\n * `{ \"user.name\": \"Alice\", \"user.age\": \"30\" }` → `{ user: { name: \"Alice\", age: \"30\" } }`\n *\n * Keys without dots are left as-is. Bracket notation (e.g. `items[0]`) is NOT\n * supported — use dot notation (`items.0`) instead.\n */\nfunction expandDotPaths(flat: Record<string, unknown>): Record<string, unknown> {\n  const result: Record<string, unknown> = {};\n  let hasDotPaths = false;\n\n  // First pass: check if any keys have dots\n  for (const key of Object.keys(flat)) {\n    if (key.includes('.')) {\n      hasDotPaths = true;\n      break;\n    }\n  }\n\n  // Fast path: no dot-notation keys, return as-is.\n  // Top-level dangerous keys are already filtered in `parseFormData` above.\n  if (!hasDotPaths) return flat;\n\n  for (const [key, value] of Object.entries(flat)) {\n    // Reject any path that contains __proto__ / constructor / prototype.\n    // Without this, `__proto__.x=1` writes to Object.prototype because\n    // `result['__proto__']` resolves to the prototype object itself.\n    const parts = key.split('.');\n    if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;\n\n    if (parts.length === 1) {\n      result[parts[0]] = value;\n      continue;\n    }\n\n    let current: Record<string, unknown> = result;\n    for (let i = 0; i < parts.length - 1; i++) {\n      const part = parts[i];\n      if (current[part] === undefined || current[part] === null) {\n        current[part] = {};\n      }\n      // If current[part] is not an object (e.g., a string from a non-dotted key),\n      // the dot-path takes precedence\n      if (typeof current[part] !== 'object' || current[part] instanceof File) {\n        current[part] = {};\n      }\n      current = current[part] as Record<string, unknown>;\n    }\n\n    current[parts[parts.length - 1]] = value;\n  }\n\n  return result;\n}\n\n// `__proto__` is the only key in this parser that escapes the dot-path\n// walk's `typeof !== 'object'` reset: accessing `obj['__proto__']` returns\n// `Object.prototype` (itself an object), so the walk steps into the global\n// prototype and the leaf write mutates it. `constructor` resolves to a\n// function (reset fires) and `prototype` is undefined on fresh objects\n// (reset fires), so neither escapes the walk — they parse as legit nested\n// keys and do not mutate anything global.\nconst DANGEROUS_KEYS = new Set(['__proto__']);\n\n// ─── Coercion Helpers ────────────────────────────────────────────────────\n\n/**\n * Schema-agnostic coercion primitives for common FormData patterns.\n *\n * These are plain transform functions — they compose with any schema library's\n * `transform`/`preprocess` pipeline:\n *\n * ```ts\n * // Zod\n * z.preprocess(coerce.number, z.number())\n * // Valibot\n * v.pipe(v.unknown(), v.transform(coerce.number), v.number())\n * ```\n */\nexport const coerce = {\n  /**\n   * Coerce an empty string to undefined for optional text fields.\n   * Use with `.optional()` schemas where an empty input means \"not provided\".\n   *\n   * ```ts\n   * // Zod\n   * z.unknown().transform(coerce.text).pipe(z.string().optional())\n   * // Valibot\n   * v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))\n   * ```\n   */\n  text(value: unknown): string | undefined {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (typeof value === 'string') return value;\n    return undefined;\n  },\n\n  /**\n   * Coerce a string to a number.\n   * - `\"42\"` → `42`\n   * - `\"3.14\"` → `3.14`\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Non-numeric strings → `undefined` (schema validation will catch this)\n   */\n  number(value: unknown): number | undefined {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (typeof value === 'number') return value;\n    if (typeof value !== 'string') return undefined;\n    const num = Number(value);\n    if (Number.isNaN(num)) return undefined;\n    return num;\n  },\n\n  /**\n   * Coerce a checkbox value to a boolean.\n   * HTML checkboxes submit \"on\" when checked and are absent when unchecked.\n   * - `\"on\"` / any truthy string → `true`\n   * - `undefined` / `null` / `\"\"` → `false`\n   */\n  checkbox(value: unknown): boolean {\n    if (value === undefined || value === null || value === '') return false;\n    if (typeof value === 'boolean') return value;\n    // Any non-empty string (typically \"on\") is true\n    return typeof value === 'string' && value.length > 0;\n  },\n\n  /**\n   * Parse a JSON string into an object.\n   * - Valid JSON string → parsed object\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Invalid JSON → `undefined` (schema validation will catch this)\n   */\n  json(value: unknown): unknown {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (typeof value !== 'string') return value;\n    try {\n      return JSON.parse(value);\n    } catch {\n      return undefined;\n    }\n  },\n\n  /**\n   * Coerce a date string to a Date object.\n   * Handles `<input type=\"date\">` (`\"2024-01-15\"`), `<input type=\"datetime-local\">`\n   * (`\"2024-01-15T10:30\"`), and full ISO 8601 strings.\n   * - Valid date string → `Date`\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Invalid date strings → `undefined` (schema validation will catch this)\n   * - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`\n   */\n  date(value: unknown): Date | undefined {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (value instanceof Date) return value;\n    if (typeof value !== 'string') return undefined;\n    const date = new Date(value);\n    if (Number.isNaN(date.getTime())) return undefined;\n\n    // Overflow detection: extract Y/M/D from the input string and verify\n    // they match the parsed Date components. new Date('2024-02-31') silently\n    // normalizes to March 2nd — we reject such inputs.\n    const ymdMatch = value.match(/^(\\d{4})-(\\d{2})-(\\d{2})/);\n    if (ymdMatch) {\n      const inputYear = Number(ymdMatch[1]);\n      const inputMonth = Number(ymdMatch[2]);\n      const inputDay = Number(ymdMatch[3]);\n\n      // Use UTC methods for date-only and Z-suffixed strings to avoid\n      // timezone offset shifting the day. For datetime-local (no Z suffix),\n      // the Date constructor parses in local time, so use local methods.\n      const isUTC = value.length === 10 || value.endsWith('Z');\n      const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();\n      const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;\n      const parsedDay = isUTC ? date.getUTCDate() : date.getDate();\n\n      if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) {\n        return undefined;\n      }\n    }\n\n    return date;\n  },\n\n  /**\n   * Create a File coercion function with optional size and mime type validation.\n   * Returns the File if valid, `undefined` otherwise.\n   *\n   * ```ts\n   * // Basic — just checks it's a real File\n   * z.preprocess(coerce.file(), z.instanceof(File))\n   *\n   * // With constraints\n   * z.preprocess(\n   *   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),\n   *   z.instanceof(File)\n   * )\n   * ```\n   */\n  file(options?: { maxSize?: number; accept?: string[] }): (value: unknown) => File | undefined {\n    return (value: unknown): File | undefined => {\n      if (value === undefined || value === null || value === '') return undefined;\n      if (!(value instanceof File)) return undefined;\n\n      // Empty file input (no selection): browsers submit File with name=\"\" and size=0\n      if (value.size === 0 && value.name === '') return undefined;\n\n      if (options?.maxSize !== undefined && value.size > options.maxSize) {\n        return undefined;\n      }\n\n      if (options?.accept !== undefined && !options.accept.includes(value.type)) {\n        return undefined;\n      }\n\n      return value;\n    };\n  },\n};\n","/**\n * Server action primitives: revalidatePath, revalidateTag, and the action handler.\n *\n * - revalidatePath(path) re-renders the route at that path and returns the RSC\n *   flight payload for inline reconciliation.\n * - revalidateTag(tag) invalidates timber.cache entries by tag.\n *\n * Both are callable from anywhere on the server — actions, API routes, handlers.\n *\n * The action handler processes incoming action requests, validates CSRF,\n * enforces body limits, executes the action, and returns the response\n * (with piggybacked RSC payload if revalidatePath was called).\n *\n * See design/08-forms-and-actions.md\n */\n\nimport { cache } from '../cache/cache-api.ts';\nimport { canonicalize } from './canonicalize.ts';\nimport { isDenySignal, isRedirectSignal } from './primitives.ts';\nimport { withSpan } from './tracing.ts';\nimport { revalidationAls, type RevalidationState } from './als-registry.ts';\n// ─── Types ───────────────────────────────────────────────────────────────\n\n/** Result of rendering a revalidation — payload root before RSC serialization. */\nexport interface RevalidationResult {\n  /**\n   * The payload root — tree plus the params it rendered with, exactly as an\n   * ordinary route payload. The client splits it in `applyActionResult`.\n   */\n  payload: unknown;\n}\n\n/** Renderer function that builds a React element tree for a given path. */\nexport type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;\n\n// Re-export the type from the registry for public API consumers.\nexport type { RevalidationState } from './als-registry.ts';\n\n/** Options for creating the action handler. */\nexport interface ActionHandlerConfig {\n  /** Renderer for producing RSC payloads during revalidation. */\n  renderer?: RevalidateRenderer;\n  /**\n   * Pathname of the page the action was submitted from. When set,\n   * revalidatePath renders are skipped for non-matching paths — the\n   * server cache is already invalidated, so the next navigation fetches\n   * fresh data. See TIM-1454.\n   */\n  requestPathname?: string;\n  /** Search string of the action request URL (e.g. `?page=1`). */\n  requestSearch?: string;\n}\n\n/** Result of handling a server action request. */\nexport interface ActionHandlerResult {\n  /** The action's return value (serialized). */\n  actionResult: unknown;\n  /** Revalidation result if revalidatePath was called (element tree, not yet serialized). */\n  revalidation?: RevalidationResult;\n  /**\n   * Paths passed to `revalidatePath()` that don't match the current page\n   * (TIM-1454). The client invalidates its caches for these so the next\n   * navigation fetches fresh data.\n   */\n  invalidatedPaths?: string[];\n  /** Redirect location if a RedirectSignal was thrown during revalidation. */\n  redirectTo?: string;\n  /** Redirect status code. */\n  redirectStatus?: number;\n}\n\n// ─── Revalidation State ──────────────────────────────────────────────────\n\n// Per-request revalidation state stored in AsyncLocalStorage (from als-registry.ts).\n// This ensures concurrent requests never share or overwrite each other's state\n// (the previous module-level global was vulnerable to cross-request pollution).\n\n/**\n * Run `fn` inside a revalidation ALS scope.\n * @internal — for tests that call revalidatePath/Tag directly without executeAction().\n */\nexport function _runWithRevalidationState<T>(state: RevalidationState, fn: () => T): T {\n  return revalidationAls.run(state, fn);\n}\n\n/**\n * Get the current revalidation state. Throws if called outside an action context.\n * @internal\n */\nfunction getRevalidationState(): RevalidationState {\n  const state = revalidationAls.getStore();\n  if (!state) {\n    throw new Error(\n      'revalidatePath/revalidateTag called outside of a server action context. ' +\n        'These functions can only be called during action execution.'\n    );\n  }\n  return state;\n}\n\n// ─── Public API ──────────────────────────────────────────────────────────\n\n/**\n * Re-render the route at `path` and include the RSC flight payload in the\n * action response. The client reconciles inline — no separate fetch needed.\n *\n * Can be called from server actions, API routes, or any server-side context.\n *\n * @param path - The path to re-render (e.g. '/dashboard', '/todos').\n */\nexport function revalidatePath(path: string): void {\n  const state = getRevalidationState();\n  if (!state.paths.includes(path)) {\n    state.paths.push(path);\n  }\n}\n\n/**\n * Invalidate all timber.cache entries tagged with `tag`.\n * Does not return a payload — the next request for an invalidated entry re-executes.\n *\n * @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').\n */\nexport function revalidateTag(tag: string): void {\n  const state = getRevalidationState();\n  if (!state.tags.includes(tag)) {\n    state.tags.push(tag);\n  }\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction stripFragment(path: string): string {\n  const idx = path.indexOf('#');\n  return idx >= 0 ? path.slice(0, idx) : path;\n}\n\n// ─── Action Handler ──────────────────────────────────────────────────────\n\n/**\n * Execute a server action and process revalidation.\n *\n * 1. Sets up revalidation state\n * 2. Calls the action function\n * 3. Processes revalidateTag calls (invalidates cache entries)\n * 4. Processes revalidatePath calls (re-renders and captures RSC payload)\n * 5. Returns the action result + optional RSC payload\n *\n * @param actionFn - The server action function to execute.\n * @param args - Arguments to pass to the action.\n * @param config - Handler configuration (cache handler, renderer).\n */\nexport async function executeAction(\n  actionFn: (...args: unknown[]) => Promise<unknown>,\n  args: unknown[],\n  config: ActionHandlerConfig = {},\n  spanMeta?: { actionFile?: string; actionName?: string }\n): Promise<ActionHandlerResult> {\n  const state: RevalidationState = { paths: [], tags: [] };\n  let actionResult: unknown;\n  let redirectTo: string | undefined;\n  let redirectStatus: number | undefined;\n\n  // Run the action inside ALS scope so revalidatePath/Tag resolve to this\n  // request's state object — concurrent requests each get their own scope.\n  await revalidationAls.run(state, async () => {\n    try {\n      actionResult = await withSpan(\n        'timber.action',\n        {\n          ...(spanMeta?.actionFile ? { 'timber.action_file': spanMeta.actionFile } : {}),\n          ...(spanMeta?.actionName ? { 'timber.action_name': spanMeta.actionName } : {}),\n        },\n        () => actionFn(...args)\n      );\n    } catch (error) {\n      if (isRedirectSignal(error)) {\n        redirectTo = error.location;\n        redirectStatus = error.status;\n      } else {\n        throw error;\n      }\n    }\n  });\n\n  // Process tag invalidation through cache.invalidate so it records the\n  // invalidation epoch — an in-flight cached fn must not re-store data this\n  // mutation just invalidated (TIM-1028). cache.invalidate resolves the\n  // module-level handler singleton: setCacheHandler() is called at boot from\n  // rsc-entry when timber.config.ts provides a cacheHandler; otherwise falls\n  // back to in-memory LRU (TIM-599).\n  if (state.tags.length > 0) {\n    // cache.invalidate handles both data-cache clearing AND component-seed\n    // tombstone writes (design/45 §ISR mechanics) — no separate tombstone\n    // step needed here.\n    // Best-effort: the action body already executed and its mutation committed.\n    // Use allSettled so all tags settle before proceeding — Promise.all would\n    // short-circuit on the first rejection, leaving other invalidations (including\n    // component-seed tombstone writes) in-flight during revalidatePath rendering.\n    const results = await Promise.allSettled(state.tags.map((tag) => cache.invalidate({ tag })));\n    for (const r of results) {\n      if (r.status === 'rejected') {\n        console.error('[timber] revalidateTag invalidation failed:', r.reason);\n      }\n    }\n  }\n\n  // Process path revalidation — build element tree (not yet serialized).\n  //\n  // TIM-1454: Only render the path if it matches the current page. Non-matching\n  // paths are collected as `invalidatedPaths` — the client evicts them from its\n  // caches so the next navigation fetches fresh data.\n  let revalidation: RevalidationResult | undefined;\n  let invalidatedPaths: string[] | undefined;\n\n  if (state.paths.length > 0) {\n    const path = state.paths[0];\n\n    if (\n      config.requestPathname &&\n      !revalidationPathMatches(path, config.requestPathname, config.requestSearch)\n    ) {\n      invalidatedPaths = [stripFragment(path)];\n    } else if (config.renderer) {\n      try {\n        revalidation = await config.renderer(path);\n      } catch (renderError) {\n        if (isRedirectSignal(renderError)) {\n          redirectTo = renderError.location;\n          redirectStatus = renderError.status;\n        } else if (isDenySignal(renderError)) {\n          console.error(\n            `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`\n          );\n        } else {\n          console.error('[timber] revalidatePath render failed:', renderError);\n        }\n      }\n    }\n  }\n\n  return {\n    actionResult,\n    revalidation,\n    invalidatedPaths,\n    ...(redirectTo ? { redirectTo, redirectStatus } : {}),\n  };\n}\n\n/**\n * Check if a `revalidatePath(path)` argument matches the request pathname.\n/**\n * Canonicalizes the revalidated path the same way the renderer does so\n * equivalent paths compare equal. Returns true when the paths match or\n * when comparison is inconclusive (validation failure → render to be safe).\n */\nfunction revalidationPathMatches(\n  revalidatedPath: string,\n  requestPathname: string,\n  requestSearch?: string\n): boolean {\n  const hashIdx = revalidatedPath.indexOf('#');\n  const noFragment = hashIdx >= 0 ? revalidatedPath.slice(0, hashIdx) : revalidatedPath;\n  const queryIdx = noFragment.indexOf('?');\n  const pathnameOnly = queryIdx >= 0 ? noFragment.slice(0, queryIdx) : noFragment;\n  const search = queryIdx >= 0 ? noFragment.slice(queryIdx) : '';\n  const canonical = canonicalize(pathnameOnly, true);\n  if (!canonical.ok) return true;\n  if (canonical.pathname !== requestPathname) return false;\n  // revalidatePath('/dashboard') (no search) matches any query variant.\n  // revalidatePath('/dashboard?tab=x') only matches that exact search.\n  if (search && search !== (requestSearch ?? '')) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,cAAc,UAA6C;CACzE,MAAM,OAAgC,CAAC;CAEvC,KAAK,MAAM,OAAO,IAAI,IAAI,SAAS,KAAK,CAAC,GAAG;EAE1C,IAAI,IAAI,WAAW,UAAU,GAAG;EAMhC,IAAI,eAAe,IAAI,GAAG,GAAG;EAG7B,MAAM,YADS,SAAS,OAAO,GACb,CAAA,CAAO,IAAI,cAAc;EAE3C,IAAI,UAAU,WAAW,GACvB,KAAK,OAAO,UAAU;OAItB,KAAK,OAAO,UAAU,QAAQ,MAAM,MAAM,KAAA,KAAa,MAAM,EAAE;CAEnE;CAGA,OAAO,eAAe,IAAI;AAC5B;;;;;;;;;AAUA,SAAS,eAAe,OAAoC;CAE1D,IAAI,iBAAiB,QAAQ,MAAM,SAAS,KAAK,MAAM,SAAS,IAC9D;CAGF,OAAO;AACT;;;;;;;;AASA,SAAS,eAAe,MAAwD;CAC9E,MAAM,SAAkC,CAAC;CACzC,IAAI,cAAc;CAGlB,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,GAChC,IAAI,IAAI,SAAS,GAAG,GAAG;EACrB,cAAc;EACd;CACF;CAKF,IAAI,CAAC,aAAa,OAAO;CAEzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;EAI/C,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,MAAM,MAAM,eAAe,IAAI,CAAC,CAAC,GAAG;EAE9C,IAAI,MAAM,WAAW,GAAG;GACtB,OAAO,MAAM,MAAM;GACnB;EACF;EAEA,IAAI,UAAmC;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,SAAS,GAAG,KAAK;GACzC,MAAM,OAAO,MAAM;GACnB,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,UAAU,MACnD,QAAQ,QAAQ,CAAC;GAInB,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,iBAAiB,MAChE,QAAQ,QAAQ,CAAC;GAEnB,UAAU,QAAQ;EACpB;EAEA,QAAQ,MAAM,MAAM,SAAS,MAAM;CACrC;CAEA,OAAO;AACT;AASA,IAAM,iCAAiB,IAAI,IAAI,CAAC,WAAW,CAAC;;;;;;;;;;;;;;AAiB5C,IAAa,SAAS;;;;;;;;;;;;CAYpB,KAAK,OAAoC;EACvC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,OAAO,UAAU,UAAU,OAAO;CAExC;;;;;;;;CASA,OAAO,OAAoC;EACzC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;EACtC,MAAM,MAAM,OAAO,KAAK;EACxB,IAAI,OAAO,MAAM,GAAG,GAAG,OAAO,KAAA;EAC9B,OAAO;CACT;;;;;;;CAQA,SAAS,OAAyB;EAChC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO;EAClE,IAAI,OAAO,UAAU,WAAW,OAAO;EAEvC,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;CACrD;;;;;;;CAQA,KAAK,OAAyB;EAC5B,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,QAAQ;GACN;EACF;CACF;;;;;;;;;;CAWA,KAAK,OAAkC;EACrC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;EACtC,MAAM,OAAO,IAAI,KAAK,KAAK;EAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG,OAAO,KAAA;EAKzC,MAAM,WAAW,MAAM,MAAM,0BAA0B;EACvD,IAAI,UAAU;GACZ,MAAM,YAAY,OAAO,SAAS,EAAE;GACpC,MAAM,aAAa,OAAO,SAAS,EAAE;GACrC,MAAM,WAAW,OAAO,SAAS,EAAE;GAKnC,MAAM,QAAQ,MAAM,WAAW,MAAM,MAAM,SAAS,GAAG;GACvD,MAAM,aAAa,QAAQ,KAAK,eAAe,IAAI,KAAK,YAAY;GACpE,MAAM,cAAc,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,IAAI;GACvE,MAAM,YAAY,QAAQ,KAAK,WAAW,IAAI,KAAK,QAAQ;GAE3D,IAAI,cAAc,cAAc,eAAe,eAAe,aAAa,WACzE;EAEJ;EAEA,OAAO;CACT;;;;;;;;;;;;;;;;CAiBA,KAAK,SAAyF;EAC5F,QAAQ,UAAqC;GAC3C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;GAClE,IAAI,EAAE,iBAAiB,OAAO,OAAO,KAAA;GAGrC,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI,OAAO,KAAA;GAElD,IAAI,SAAS,YAAY,KAAA,KAAa,MAAM,OAAO,QAAQ,SACzD;GAGF,IAAI,SAAS,WAAW,KAAA,KAAa,CAAC,QAAQ,OAAO,SAAS,MAAM,IAAI,GACtE;GAGF,OAAO;EACT;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;ACtMA,SAAS,uBAA0C;CACjD,MAAM,QAAQ,gBAAgB,SAAS;CACvC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,qIAEF;CAEF,OAAO;AACT;;;;;;;;;AAYA,SAAgB,eAAe,MAAoB;CACjD,MAAM,QAAQ,qBAAqB;CACnC,IAAI,CAAC,MAAM,MAAM,SAAS,IAAI,GAC5B,MAAM,MAAM,KAAK,IAAI;AAEzB;;;;;;;AAQA,SAAgB,cAAc,KAAmB;CAC/C,MAAM,QAAQ,qBAAqB;CACnC,IAAI,CAAC,MAAM,KAAK,SAAS,GAAG,GAC1B,MAAM,KAAK,KAAK,GAAG;AAEvB;AAIA,SAAS,cAAc,MAAsB;CAC3C,MAAM,MAAM,KAAK,QAAQ,GAAG;CAC5B,OAAO,OAAO,IAAI,KAAK,MAAM,GAAG,GAAG,IAAI;AACzC;;;;;;;;;;;;;;AAiBA,eAAsB,cACpB,UACA,MACA,SAA8B,CAAC,GAC/B,UAC8B;CAC9B,MAAM,QAA2B;EAAE,OAAO,CAAC;EAAG,MAAM,CAAC;CAAE;CACvD,IAAI;CACJ,IAAI;CACJ,IAAI;CAIJ,MAAM,gBAAgB,IAAI,OAAO,YAAY;EAC3C,IAAI;GACF,eAAe,MAAM,SACnB,iBACA;IACE,GAAI,UAAU,aAAa,EAAE,sBAAsB,SAAS,WAAW,IAAI,CAAC;IAC5E,GAAI,UAAU,aAAa,EAAE,sBAAsB,SAAS,WAAW,IAAI,CAAC;GAC9E,SACM,SAAS,GAAG,IAAI,CACxB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,KAAK,GAAG;IAC3B,aAAa,MAAM;IACnB,iBAAiB,MAAM;GACzB,OACE,MAAM;EAEV;CACF,CAAC;CAQD,IAAI,MAAM,KAAK,SAAS,GAAG;EAQzB,MAAM,UAAU,MAAM,QAAQ,WAAW,MAAM,KAAK,KAAK,QAAQ,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;EAC3F,KAAK,MAAM,KAAK,SACd,IAAI,EAAE,WAAW,YACf,QAAQ,MAAM,+CAA+C,EAAE,MAAM;CAG3E;CAOA,IAAI;CACJ,IAAI;CAEJ,IAAI,MAAM,MAAM,SAAS,GAAG;EAC1B,MAAM,OAAO,MAAM,MAAM;EAEzB,IACE,OAAO,mBACP,CAAC,wBAAwB,MAAM,OAAO,iBAAiB,OAAO,aAAa,GAE3E,mBAAmB,CAAC,cAAc,IAAI,CAAC;OAClC,IAAI,OAAO,UAChB,IAAI;GACF,eAAe,MAAM,OAAO,SAAS,IAAI;EAC3C,SAAS,aAAa;GACpB,IAAI,iBAAiB,WAAW,GAAG;IACjC,aAAa,YAAY;IACzB,iBAAiB,YAAY;GAC/B,OAAO,IAAI,aAAa,WAAW,GACjC,QAAQ,MACN,sEAAsE,YAAY,OAAO,EAC3F;QAEA,QAAQ,MAAM,0CAA0C,WAAW;EAEvE;CAEJ;CAEA,OAAO;EACL;EACA;EACA;EACA,GAAI,aAAa;GAAE;GAAY;EAAe,IAAI,CAAC;CACrD;AACF;;;;;;;;AASA,SAAS,wBACP,iBACA,iBACA,eACS;CACT,MAAM,UAAU,gBAAgB,QAAQ,GAAG;CAC3C,MAAM,aAAa,WAAW,IAAI,gBAAgB,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,WAAW,WAAW,QAAQ,GAAG;CACvC,MAAM,eAAe,YAAY,IAAI,WAAW,MAAM,GAAG,QAAQ,IAAI;CACrE,MAAM,SAAS,YAAY,IAAI,WAAW,MAAM,QAAQ,IAAI;CAC5D,MAAM,YAAY,aAAa,cAAc,IAAI;CACjD,IAAI,CAAC,UAAU,IAAI,OAAO;CAC1B,IAAI,UAAU,aAAa,iBAAiB,OAAO;CAGnD,IAAI,UAAU,YAAY,iBAAiB,KAAK,OAAO;CACvD,OAAO;AACT"}

package/dist/_chunks/als-registry-C6kcfprT.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"als-registry-C6kcfprT.js","names":[],"sources":["../../src/server/als-registry.ts"],"sourcesContent":["/**\n * Centralized AsyncLocalStorage registry for server-side per-request state.\n *\n * ALL ALS instances used by the server framework live here. Individual\n * modules (request-context.ts, tracing.ts, actions.ts, etc.) import from\n * this registry and re-export public accessor functions.\n *\n * Why: ALS instances require singleton semantics — if two copies of the\n * same ALS exist (one from a relative import, one from a barrel import,\n * or the same file re-evaluated by Vite after an HMR invalidation), one\n * module writes to its copy and another reads from an empty copy.\n * Centralizing ALS creation in a single module + anchoring each instance\n * on `globalThis` under a `Symbol.for(...)` key eliminates this class of\n * bug, including the Vite-dev case where module instance split would\n * otherwise hand two copies of this file out of a single evaluation cycle.\n *\n * The `timber-shims` plugin remaps `@timber-js/app/server` to src/ in\n * RSC and SSR environments so import-specifier paths converge here, and\n * the `globalThis[SYMBOL_FOR]` anchor below closes the remaining gap: any\n * second evaluation of this module picks up the ALS the first evaluation\n * already stored rather than instantiating a fresh one. Same pattern the\n * Cloudflare bindings ALS uses in `adapters/cloudflare.ts`.\n *\n * DO NOT create ALS instances outside this file. If you need a new ALS,\n * add it here and import from `./als-registry.js` in the consuming module.\n * Inside this file, always route through `getOrCreateAls(symbol)` — a raw\n * `new AsyncLocalStorage()` reintroduces the instance-split hazard.\n *\n * See design/18-build-system.md §\"Module Singleton Strategy\" and\n * §\"Singleton State Registry\". Regression test:\n * `tests/als-registry-singleton.test.ts`.\n */\n\nimport '#server-only-guard';\nimport type { CoercedParams } from '../shared/param-value.ts';\nimport type { SlotParamsRecord } from '../shared/slot-params.ts';\nimport { AsyncLocalStorage } from 'node:async_hooks';\n/**\n * Return a process-wide singleton `AsyncLocalStorage` keyed by `symbol`.\n *\n * `Symbol.for(...)` keys live in the cross-realm symbol registry, and\n * `globalThis` is shared across every module evaluation inside the same\n * Node.js process. Together they give a stable anchor that survives\n * re-evaluation of this file — the second evaluation observes the\n * `globalThis[symbol]` slot already populated by the first and hands\n * back the identical ALS instance.\n */\nfunction getOrCreateAls<T>(symbol: symbol): AsyncLocalStorage<T> {\n  const g = globalThis as unknown as Record<symbol, unknown>;\n  const existing = g[symbol];\n  if (existing instanceof AsyncLocalStorage) {\n    return existing as AsyncLocalStorage<T>;\n  }\n  const created = new AsyncLocalStorage<T>();\n  g[symbol] = created;\n  return created;\n}\n\n// ─── Request Context ──────────────────────────────────────────────────────\n// Used by: request-context.ts (getHeaders(), getCookies(), getSearchParams())\n// Design doc: design/04-authorization.md\n\n/** @internal — import via request-context.ts public API */\nexport const requestContextAls = getOrCreateAls<RequestContextStore>(\n  Symbol.for('timber:request-context-als')\n);\n\nexport interface RequestContextStore {\n  /** Incoming request headers (read-only view). */\n  headers: Headers;\n  /** Raw cookie header string, parsed lazily into a Map on first access. */\n  cookieHeader: string;\n  /** Lazily-parsed cookie map (mutable — reflects write-overlay from set()). */\n  parsedCookies?: Map<string, string>;\n  /** Original (pre-overlay) frozen headers, kept for overlay merging. */\n  originalHeaders: Headers;\n  /**\n   * CSP nonce, created the first time middleware reads `ctx.nonce`. Read by\n   * the renderers via `getCspNonce()` and stamped on every inline script.\n   * Absent when no middleware asked for one. See server/csp-nonce.ts.\n   */\n  cspNonce?: string;\n  /**\n   * Raw URLSearchParams for the current request.\n   * To get typed parsed params, import a search params definition and\n   * call `.parse(searchParams())`.\n   */\n  searchParams: URLSearchParams;\n  /**\n   * Raw search string from the request URL (e.g. \"?foo=bar&baz=1\").\n   * Available synchronously for use in `redirect()` with `preserveSearchParams`.\n   */\n  searchString: string;\n  /**\n   * Coerced segment params for the current request.\n   * Set by the pipeline after route matching and param coercion, before\n   * middleware and rendering. Pages and layouts read params via\n   * `getSegmentParams()` instead of receiving them as a prop.\n   *\n   * See design/07-routing.md §\"params.ts — Convention File for Typed Params\"\n   */\n  segmentParams?: CoercedParams;\n  /**\n   * The matched segment path (e.g. '/(browse)/[artistSlug]/[year]').\n   * Includes route groups and parallel slots — uniquely identifies the\n   * segment in the route tree. Set by the pipeline alongside segmentParams.\n   * Used by getSegmentParams() for dev-mode validation.\n   * See design/41-global-params.md §Runtime Validation\n   */\n  matchedSegmentPath?: string;\n  /**\n   * Per-slot coerced segment params, keyed by the slot's full tree path\n   * (e.g. '/(browse)/@shows/[artistSlug]/[...year]').\n   *\n   * Each slot walks its own segment tree and may interpret URL parts\n   * differently from the main route (e.g. catch-all vs dynamic). This\n   * map stores slot-specific params so getSegmentParams(segmentPath)\n   * returns the correct types for slot pages.\n   *\n   * See design/07-routing.md §\"Parallel Slot Params\"\n   */\n  slotParams?: SlotParamsRecord;\n  /** Outgoing Set-Cookie entries (name → serialized value + options). Last write wins. */\n  cookieJar: Map<string, CookieEntry>;\n  /** Whether the response has flushed (headers committed). */\n  flushed: boolean;\n  /** Whether the current context allows cookie mutation. */\n  mutableContext: boolean;\n  /**\n   * Set by AccessGate or PageDenyBoundary when a DenySignal is caught\n   * server-side (inside the React tree, before React Flight sees it).\n   * The document path reads this after render to set the HTTP status code;\n   * the RSC payload path does not read it (a Flight payload response is always 200).\n   * See TIM-666, TIM-1495.\n   */\n  denyStatus?: number;\n  /**\n   * Index of the first segment whose AccessGate denied during render.\n   * Recorded by AccessGate when it catches a DenySignal so post-render\n   * consumers (buildSegmentInfo, X-Timber-Segments header) can bound\n   * the segment list without a pre-render access pass. Infinity when\n   * no segment denied. See TIM-1363.\n   */\n  _firstDeniedSegmentIndex?: number;\n  /**\n   * Metadata entries collected during render by MetadataCollector.\n   * Populated per-segment in tree order (root→page) during\n   * renderToReadableStream. Entries may contain promises for dynamic\n   * metadata (resolved concurrently with page rendering, TIM-1367).\n   * MetadataHead awaits all entries before merging.\n   * See TIM-1363, TIM-1367, design/16-metadata.md.\n   */\n  _metadataEntries?: Array<{\n    metadata: import('./types.ts').Metadata | Promise<import('./types.ts').Metadata | null>;\n    isPage: boolean;\n  }>;\n}\n\n/** A single outgoing cookie entry in the cookie jar. */\nexport interface CookieEntry {\n  name: string;\n  value: string;\n  options: import('./cookie-context.ts').CookieOptions;\n}\n\n// ─── Tracing ──────────────────────────────────────────────────────────────\n// Used by: tracing.ts (getTraceId(), getSpanId())\n// Design doc: design/17-logging.md\n\nexport interface TraceStore {\n  /** 32-char lowercase hex trace ID (OTEL or UUID fallback). */\n  traceId: string;\n  /** OTEL span ID if available, undefined otherwise. */\n  spanId?: string;\n  /**\n   * Innermost active native platform span (e.g. Cloudflare's `Span` from\n   * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes\n   * after span creation — the platform API has no getActiveSpan() equivalent.\n   * Saved/restored by withSpan() around each callback. See TIM-1135.\n   */\n  platformSpan?: import('./tracing.ts').PlatformSpan;\n}\n\n/** @internal — import via tracing.ts public API */\nexport const traceAls = getOrCreateAls<TraceStore>(Symbol.for('timber:trace-als'));\n\n// ─── Server-Timing ────────────────────────────────────────────────────────\n// Used by: server-timing.ts (recordTiming(), withTiming())\n// Design doc: (dev-only performance instrumentation)\n\nexport interface TimingStore {\n  entries: import('./server-timing.ts').TimingEntry[];\n}\n\n/** @internal — import via server-timing.ts public API */\nexport const timingAls = getOrCreateAls<TimingStore>(Symbol.for('timber:timing-als'));\n\n// ─── Revalidation ─────────────────────────────────────────────────────────\n// Used by: actions.ts (revalidatePath(), revalidateTag())\n// Design doc: design/08-forms-and-actions.md\n\nexport interface RevalidationState {\n  /** Paths to re-render (populated by revalidatePath calls). */\n  paths: string[];\n  /** Tags to invalidate (populated by revalidateTag calls). */\n  tags: string[];\n}\n\n/** @internal — import via actions.ts public API */\nexport const revalidationAls = getOrCreateAls<RevalidationState>(\n  Symbol.for('timber:revalidation-als')\n);\n\n// ─── Form Flash ───────────────────────────────────────────────────────────\n// Used by: form-flash.ts (getFormFlash())\n// Design doc: design/08-forms-and-actions.md §\"No-JS Error Round-Trip\"\n\n/** @internal — import via form-flash.ts public API */\nexport const formFlashAls = getOrCreateAls<import('./form-flash.ts').FormFlashData>(\n  Symbol.for('timber:form-flash-als')\n);\n\n// ─── Early Hints Sender ──────────────────────────────────────────────────\n// Used by: early-hints-sender.ts (sendEarlyHints103())\n// Design doc: design/02-rendering-pipeline.md §\"Early Hints (103)\"\n\n/** Function that sends Link header values as a 103 Early Hints response. */\nexport type EarlyHintsSenderFn = (links: string[]) => void;\n\n/** @internal — import via early-hints-sender.ts public API */\nexport const earlyHintsSenderAls = getOrCreateAls<EarlyHintsSenderFn>(\n  Symbol.for('timber:early-hints-sender-als')\n);\n\n// ─── waitUntil Bridge ────────────────────────────────────────────────────\n// Used by: waituntil-bridge.ts (waitUntil())\n// Design doc: design/11-platform.md §\"waitUntil()\"\n\n/** Function that extends the request lifecycle with a background promise. */\nexport type WaitUntilFn = (promise: Promise<unknown>) => void;\n\n/** @internal — import via waituntil-bridge.ts public API */\nexport const waitUntilAls = getOrCreateAls<WaitUntilFn>(Symbol.for('timber:wait-until-als'));\n\n// ─── Workers Cache Purge Bridge ─────────────────────────────────────────\n// Used by: workers-cache-bridge.ts (runWithWorkersCachePurge())\n// Design doc: design/06-caching.md, design/25-production-deployments.md\n\n/** Workers Cache purge function from Cloudflare ExecutionContext.cache. */\nexport interface WorkersCachePurgeCtx {\n  purge(opts: { tags: string[] }): Promise<void>;\n}\n\n/** @internal — import via workers-cache-bridge.ts public API */\nexport const workersCachePurgeAls = getOrCreateAls<WorkersCachePurgeCtx>(\n  Symbol.for('timber:workers-cache-purge-als')\n);\n"],"mappings":";;;;;;;;;;;;;AA+CA,SAAS,eAAkB,QAAsC;CAC/D,MAAM,IAAI;CACV,MAAM,WAAW,EAAE;CACnB,IAAI,oBAAoB,mBACtB,OAAO;CAET,MAAM,UAAU,IAAI,kBAAqB;CACzC,EAAE,UAAU;CACZ,OAAO;AACT;;AAOA,IAAa,oBAAoB,eAC/B,OAAO,IAAI,4BAA4B,CACzC;;AAuHA,IAAa,WAAW,eAA2B,OAAO,IAAI,kBAAkB,CAAC;;AAWjF,IAAa,YAAY,eAA4B,OAAO,IAAI,mBAAmB,CAAC;;AAcpF,IAAa,kBAAkB,eAC7B,OAAO,IAAI,yBAAyB,CACtC;;AAOA,IAAa,eAAe,eAC1B,OAAO,IAAI,uBAAuB,CACpC;;AAUA,IAAa,sBAAsB,eACjC,OAAO,IAAI,+BAA+B,CAC5C;;AAUA,IAAa,eAAe,eAA4B,OAAO,IAAI,uBAAuB,CAAC;;AAY3F,IAAa,uBAAuB,eAClC,OAAO,IAAI,gCAAgC,CAC7C"}

package/dist/_chunks/build-manifest-DTmSGLRz.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-manifest-DTmSGLRz.js","names":[],"sources":["../../src/server/csp-nonce.ts","../../src/server/build-manifest.ts"],"sourcesContent":["/**\n * CSP nonce — per-request, generated on demand.\n *\n * timber emits several inline `<script>` tags per HTML response — React's\n * bootstrap script and Fizz runtime, the Flight init/chunk scripts, the\n * segment-tree script, and the post-flush noindex script. Under a strict\n * `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every\n * one of them needs the request's nonce or the browser refuses to run it.\n *\n * The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it\n * in the CSP header it sets through `ctx.headers`. The first read generates\n * the value and stores it on the request context; the render pipeline reads\n * it back with `getCspNonce()` and stamps it on every inline script. A\n * request whose middleware never reads `ctx.nonce` has no nonce, and its\n * markup is byte-identical to a render without this feature. timber does\n * not parse the CSP header — the app owns the policy, timber owns the\n * markup, and `ctx.nonce` is the one value both are built from.\n *\n * `proxy.ts` cannot participate: it only sees the finished response from\n * `next()`, after the markup exists.\n *\n * See design/13-security.md §\"Content Security Policy\" (TIM-1414).\n */\n\nimport { requestContextAls } from './als-registry.ts';\n\n/**\n * Generate a CSP nonce: 128 random bits, base64. Matches CSP's\n * `base64-value` grammar, so it is valid in the header verbatim and safe\n * inside a double-quoted HTML attribute without escaping.\n */\nfunction generateNonce(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(16));\n  let binary = '';\n  for (const b of bytes) binary += String.fromCharCode(b);\n  return btoa(binary);\n}\n\n/**\n * The request's CSP nonce, creating it on first call. Backs the\n * `ctx.nonce` getter on `MiddlewareContext`. Outside a request context\n * (tests, build-time rendering) a fresh value is returned but not\n * retained, since there is no request for it to belong to.\n */\nexport function requestCspNonce(): string {\n  const store = requestContextAls.getStore();\n  if (!store) return generateNonce();\n  store.cspNonce ??= generateNonce();\n  return store.cspNonce;\n}\n\n/**\n * The request's CSP nonce if middleware asked for one, else `undefined` —\n * in which case the pipeline emits bare `<script>` tags.\n */\nexport function getCspNonce(): string | undefined {\n  return requestContextAls.getStore()?.cspNonce;\n}\n\n/**\n * The ` nonce=\"…\"` attribute fragment for a timber-generated `<script>` tag,\n * or `''` when the request has no nonce. Callers interpolate it directly\n * after the tag name: `` `<script${nonceAttr(nonce)}>` ``.\n *\n * The value comes from `generateNonce` and is base64, so no attribute\n * escaping is required.\n */\nexport function nonceAttr(nonce: string | undefined): string {\n  return nonce ? ` nonce=\"${nonce}\"` : '';\n}\n","/**\n * Build manifest types and utilities for CSS and JS asset tracking.\n *\n * The build manifest maps route segment file paths to their output\n * chunks from Vite's client build. This enables:\n * - <link rel=\"stylesheet\"> injection in HTML <head>\n * - <script type=\"module\"> with hashed URLs in production\n * - <link rel=\"modulepreload\"> for client chunk dependencies\n * - Link preload headers for Early Hints (103)\n *\n * In dev mode, Vite's HMR client handles CSS/JS injection, so the build\n * manifest is empty. In production, it's populated from Vite's\n * .vite/manifest.json after the client build.\n *\n * Design docs: 18-build-system.md §\"Build Manifest\", 02-rendering-pipeline.md §\"Early Hints\"\n */\n\n/** A font asset entry in the build manifest. */\nexport interface ManifestFontEntry {\n  /** URL path to the font file (e.g. `/_timber/fonts/inter-latin-400-abc123.woff2`). */\n  href: string;\n  /** Font format (e.g. `woff2`). */\n  format: string;\n  /** Crossorigin attribute — always `anonymous` for fonts. */\n  crossOrigin: string;\n}\n\n/** Build manifest mapping input file paths to output asset URLs. */\nexport interface BuildManifest {\n  /** Map from input file path (relative to project root) to output CSS URLs. */\n  css: Record<string, string[]>;\n  /** Map from input file path to output JS chunk URL (hashed filename). */\n  js: Record<string, string>;\n  /** Map from input file path to transitive JS dependency URLs for modulepreload. */\n  modulepreload: Record<string, string[]>;\n  /** Map from input file path to font assets used by that module. */\n  fonts: Record<string, ManifestFontEntry[]>;\n  /**\n   * Cache-busting hashes for metadata route files (opengraph-image, etc.).\n   * Map from file path (relative to project root) to short content hash.\n   * In dev mode this is empty — a startup nonce is used instead.\n   */\n  metadataRouteHashes?: Record<string, string>;\n  /**\n   * Static request-dependency map from the Vite plugin's module-graph analysis.\n   * Map from segment entry file path to whether it's request-dependent.\n   * Used by buildSegmentInfo() for X-Timber-Segments in production.\n   */\n  requestDep?: Record<string, boolean>;\n}\n\n/**\n * Empty build manifest used in dev mode, and the single source of truth for\n * what an empty manifest contains.\n *\n * `virtual:timber-build-manifest` serializes this constant into its generated\n * source rather than restating it — one literal for the dev module, one for the\n * production module's `globalThis.__TIMBER_BUILD_MANIFEST__ ?? …` fallback.\n * They were three hand-written objects that had already drifted: this one and\n * the dev literal were missing `requestDep` while the production fallback had\n * it, so a reader who grepped the built bundle for `requestDep` found the one\n * copy that mentioned it and read the fallback as the shipped map (TIM-1300).\n * A field added here now reaches every copy.\n */\nexport const EMPTY_BUILD_MANIFEST: BuildManifest = {\n  css: {},\n  js: {},\n  modulepreload: {},\n  fonts: {},\n  metadataRouteHashes: {},\n  requestDep: {},\n};\n\n/** Segment shape expected by collectRouteCss (matches ManifestSegmentNode). */\ninterface SegmentWithFiles {\n  layout?: { filePath: string };\n  page?: { filePath: string };\n}\n\n/**\n * Collect all CSS files needed for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting CSS for each layout and page.\n * Deduplicates while preserving order (root layout CSS first).\n */\nexport function collectRouteCss(segments: SegmentWithFiles[], manifest: BuildManifest): string[] {\n  const seen = new Set<string>();\n  const result: string[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const cssFiles = manifest.css[file.filePath];\n      if (!cssFiles) continue;\n      for (const url of cssFiles) {\n        if (!seen.has(url)) {\n          seen.add(url);\n          result.push(url);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"stylesheet\"> tags for CSS URLs.\n *\n * Returns an HTML string to prepend to headHtml for injection\n * via injectHead() before </head>.\n */\nexport function buildCssLinkTags(cssUrls: string[]): string {\n  // Emit only <link rel=\"stylesheet\"> — no preload tags. CSS preloading\n  // is handled by 103 Early Hints (Link header) which fires before the\n  // HTML stream. Float also emits `<link rel=\"stylesheet\" data-precedence>`\n  // at the top of <head> during Fizz rendering — the browser discovers\n  // CSS from that tag. A <link rel=\"preload\"> here would arrive *after*\n  // Float's stylesheet tag and trigger \"Preload was ignored\" warnings.\n  return cssUrls.map((url) => `<link rel=\"stylesheet\" href=\"${url}\">`).join('');\n}\n\n// ─── Font utilities ──────────────────────────────────────────────────────\n\n/**\n * Collect all font entries needed for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting fonts for each layout and page.\n * Deduplicates by href while preserving order.\n */\nexport function collectRouteFonts(\n  segments: SegmentWithFiles[],\n  manifest: BuildManifest\n): ManifestFontEntry[] {\n  const seen = new Set<string>();\n  const result: ManifestFontEntry[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const fonts = manifest.fonts[file.filePath];\n      if (!fonts) continue;\n      for (const entry of fonts) {\n        if (!seen.has(entry.href)) {\n          seen.add(entry.href);\n          result.push(entry);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"preload\"> tags for font assets.\n *\n * Font preloads use `as=font` and always include `crossorigin` (required\n * for font preloads even for same-origin resources per the spec).\n */\nexport function buildFontPreloadTags(fonts: ManifestFontEntry[]): string {\n  return fonts\n    .map(\n      (f) =>\n        `<link rel=\"preload\" href=\"${f.href}\" as=\"font\" type=\"font/${f.format}\" crossorigin=\"${f.crossOrigin}\">`\n    )\n    .join('');\n}\n\n// ─── JS chunk utilities ──────────────────────────────────────────────────\n\n/**\n * Collect modulepreload URLs for a matched route's segment chain.\n *\n * Walks segments root → leaf, collecting transitive JS dependencies\n * for each layout and page. Deduplicates across segments.\n */\nexport function collectRouteModulepreloads(\n  segments: SegmentWithFiles[],\n  manifest: BuildManifest\n): string[] {\n  const seen = new Set<string>();\n  const result: string[] = [];\n\n  for (const segment of segments) {\n    for (const file of [segment.layout, segment.page]) {\n      if (!file) continue;\n      const preloads = manifest.modulepreload[file.filePath];\n      if (!preloads) continue;\n      for (const url of preloads) {\n        if (!seen.has(url)) {\n          seen.add(url);\n          result.push(url);\n        }\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Generate <link rel=\"modulepreload\"> tags for JS dependency URLs.\n *\n * Modulepreload hints tell the browser to fetch and parse JS modules\n * before they're needed, reducing waterfall latency for dynamic imports.\n */\nexport function buildModulepreloadTags(urls: string[]): string {\n  return urls.map((url) => `<link rel=\"modulepreload\" href=\"${url}\">`).join('');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,gBAAwB;CAC/B,MAAM,QAAQ,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CACvD,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;;;;;;;AAQA,SAAgB,kBAA0B;CACxC,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OAAO,OAAO,cAAc;CACjC,MAAM,aAAa,cAAc;CACjC,OAAO,MAAM;AACf;;;;;;;;;;;;;;;;ACeA,IAAa,uBAAsC;CACjD,KAAK,CAAC;CACN,IAAI,CAAC;CACL,eAAe,CAAC;CAChB,OAAO,CAAC;CACR,qBAAqB,CAAC;CACtB,YAAY,CAAC;AACf;;;;;;;AAcA,SAAgB,gBAAgB,UAA8B,UAAmC;CAC/F,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAmB,CAAC;CAE1B,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,WAAW,SAAS,IAAI,KAAK;EACnC,IAAI,CAAC,UAAU;EACf,KAAK,MAAM,OAAO,UAChB,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG;GAClB,KAAK,IAAI,GAAG;GACZ,OAAO,KAAK,GAAG;EACjB;CAEJ;CAGF,OAAO;AACT;;;;;;;AA0BA,SAAgB,kBACd,UACA,UACqB;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAA8B,CAAC;CAErC,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,QAAQ,SAAS,MAAM,KAAK;EAClC,IAAI,CAAC,OAAO;EACZ,KAAK,MAAM,SAAS,OAClB,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,GAAG;GACzB,KAAK,IAAI,MAAM,IAAI;GACnB,OAAO,KAAK,KAAK;EACnB;CAEJ;CAGF,OAAO;AACT;;;;;;;AAyBA,SAAgB,2BACd,UACA,UACU;CACV,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAmB,CAAC;CAE1B,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,IAAI,GAAG;EACjD,IAAI,CAAC,MAAM;EACX,MAAM,WAAW,SAAS,cAAc,KAAK;EAC7C,IAAI,CAAC,UAAU;EACf,KAAK,MAAM,OAAO,UAChB,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG;GAClB,KAAK,IAAI,GAAG;GACZ,OAAO,KAAK,GAAG;EACjB;CAEJ;CAGF,OAAO;AACT"}

package/dist/_chunks/build-output-helper-9dqCv1pZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-output-helper-9dqCv1pZ.js","names":[],"sources":["../../src/adapters/shared.ts","../../src/adapters/build-output-helper.ts"],"sourcesContent":["// Shared adapter utilities — leaf module with zero deps on server/, client/,\n// or any Vite-dependent code.\n//\n// Adapters are loaded by Node at Vite startup time, before Vite's module\n// resolver is available. This module uses only Node built-ins and can be\n// imported by both adapters via a relative path.\n//\n// IMPORTANT: Do NOT add imports from ../server/, ../client/, ../plugins/,\n// or any module that transitively depends on Vite. A test in\n// tests/adapters/shared-no-forbidden-imports.test.ts enforces this.\n// ../shared/ is exempt: it is dependency-free by the same rule.\n\nimport { withBasePath } from '../shared/base-path.ts';\n\n/**\n * The deployment base an adapter should write platform rules against.\n *\n * `config.base` is optional on `TimberConfig` because adapters can be invoked\n * by callers that predate it (a hand-written adapter, a test harness). Falling\n * back to `'/'` reproduces the pre-TIM-1274 output exactly, which is correct\n * for the only deployments those callers can have: a build under a non-root\n * base always goes through `plugins/adapter-build.ts`, which populates it.\n *\n * Typed structurally rather than as `TimberConfig` so this module keeps no\n * import of `./types.js` at runtime.\n */\nexport function adapterBase(config: { base?: string }): string {\n  return config.base ?? '/';\n}\n\n// ─── Static asset cache headers ──────────────────────────────────────────\n\n/** Cache-Control value for hashed (immutable) assets. */\nexport const IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';\n\n/** Cache-Control value for unhashed static assets. */\nexport const STATIC_CACHE = 'public, max-age=3600, must-revalidate';\n\n/**\n * Generate a `_headers` file for static asset cache control.\n *\n * The `_headers` file is a platform convention supported by Cloudflare Workers\n * Static Assets, Cloudflare Pages, and Netlify. It maps URL patterns to\n * HTTP response headers.\n *\n * Only hashed (immutable) asset paths are listed here by default. When\n * `unhashedPaths` is provided, per-file rules are appended for unhashed\n * static assets (favicon.ico, robots.txt, etc.) so they get Cache-Control\n * on platforms like Cloudflare Workers Static Assets where the server\n * handler never sees static file requests.\n *\n * A `/*` catch-all is NOT used — it would be additive on Cloudflare,\n * producing duplicate Cache-Control directives on hashed assets\n * (invalid per RFC 9111).\n *\n * **Every rule path is written in deployed-URL space** (TIM-1274). The\n * platform matches these patterns against the request path, which under a\n * non-root `base` sits below the prefix: with `base: '/repo/'` the assets are\n * at `/repo/assets/*`, so a rule saying `/assets/*` matches nothing. Silent\n * for the cache rules (slower, still correct) and not silent for the\n * Content-Type rules — an extensionless API route output is unreadable on\n * Cloudflare Workers Static Assets without one.\n *\n * The prefix is applied at exactly one point, `rulePath()`, which every rule\n * in this function goes through. Prefixing the three wildcards and\n * hand-checking that the per-file rules agree is how the next rule gets\n * missed.\n */\n// Cloudflare Workers Static Assets caps _headers at 100 rules.\n// Reserve 3 for the wildcard hashed-asset rules (/assets/*, /_timber/fonts/*, /_rsc/*).\nconst MAX_PER_FILE_RULES = 97;\n\nexport interface HeadersFileOptions {\n  /**\n   * The deployment base, already normalized by `normalizeBasePath()` —\n   * leading and trailing slash, `'/'` at the domain root.\n   *\n   * Required rather than defaulted: a caller that forgets it would emit\n   * root-relative rules that match nothing, which is the bug this closes.\n   */\n  base: string;\n  /** Unhashed static files (route-space paths) needing per-file cache rules. */\n  unhashedPaths?: string[];\n  /** Route-space path → Content-Type, for extensionless API route outputs. */\n  contentTypes?: Record<string, string>;\n  /**\n   * Verbatim contents of the user's `public/_headers`, appended after the\n   * generated rules. See `mergeUserHeaders` for why it goes last.\n   */\n  userRules?: string;\n}\n\n/**\n * Count the rules in a `_headers` file — a rule is a path line, which is any\n * line that is neither blank, a comment, nor an indented header.\n *\n * @internal Exported for testing.\n */\nexport function countHeaderRules(content: string): number {\n  return content\n    .split('\\n')\n    .filter((line) => line.trim() !== '' && !line.startsWith('#') && !/^\\s/.test(line)).length;\n}\n\n/** One `_headers` block: a path pattern and the headers it sets. */\nexport interface HeaderRule {\n  pattern: string;\n  headers: Array<{ name: string; value: string }>;\n}\n\n/**\n * Parse a `_headers` file. A non-indented, non-comment line opens a rule; the\n * indented `Name: value` lines beneath it belong to that rule.\n *\n * @internal Exported for testing.\n */\nexport function parseHeaderRules(content: string): HeaderRule[] {\n  const rules: HeaderRule[] = [];\n  for (const raw of content.split('\\n')) {\n    const line = raw.replace(/\\r$/, '');\n    if (line.trim() === '' || line.trimStart().startsWith('#')) continue;\n    if (/^\\s/.test(line)) {\n      const current = rules[rules.length - 1];\n      if (!current) continue; // header with no rule above it — not ours to fix\n      const colon = line.indexOf(':');\n      if (colon === -1) continue;\n      current.headers.push({\n        name: line.slice(0, colon).trim(),\n        value: line.slice(colon + 1).trim(),\n      });\n    } else {\n      rules.push({ pattern: line.trim(), headers: [] });\n    }\n  }\n  return rules;\n}\n\n/**\n * Whether a user pattern can match paths a generated pattern also matches.\n *\n * Deliberately narrow: equality, or a prefix-glob (`/x/*`, `/*`) whose literal\n * prefix contains the other's. Anything cleverer risks claiming an overlap\n * that is not there, and the only thing this drives is a warning — a false\n * positive is noise a developer cannot act on.\n */\nfunction patternsOverlap(a: string, b: string): boolean {\n  if (a === b) return true;\n  const prefixOf = (p: string) => (p.endsWith('*') ? p.slice(0, -1) : null);\n  const [pa, pb] = [prefixOf(a), prefixOf(b)];\n  if (pa !== null && (b.startsWith(pa) || pa === '')) return true;\n  if (pb !== null && (a.startsWith(pb) || pb === '')) return true;\n  return false;\n}\n\nexport function generateHeadersFile({\n  base,\n  unhashedPaths,\n  contentTypes,\n  userRules,\n}: HeadersFileOptions): string {\n  /** Route-space rule path → deployed-URL rule path. */\n  const rulePath = (path: string) => withBasePath(base, path);\n\n  // Cloudflare and Netlify apply *every* matching rule, so emitting a header\n  // the user also sets on the same path yields two definitions of it — a\n  // comma-joined `Cache-Control` that is invalid per RFC 9111, and neither\n  // side's intent. This module already refuses to emit a `/*` catch-all for\n  // that reason; appending the user's file verbatim reintroduced it through\n  // the back door (TIM-1326).\n  //\n  // An explicit app rule beats a framework default, so where the user names\n  // the same pattern and the same header, ours is dropped. Only exact pattern\n  // matches are resolved this way: silently dropping asset immutability\n  // because a `/*` rule *might* subsume it would be a worse surprise than the\n  // duplicate, so overlapping-but-different patterns warn instead.\n  const userRuleList = userRules ? parseHeaderRules(userRules) : [];\n  const overriddenExactly = new Set(\n    userRuleList.flatMap((rule) =>\n      rule.headers.map((h) => `${rule.pattern}\\0${h.name.toLowerCase()}`)\n    )\n  );\n  const overridden = (pattern: string, header: string) =>\n    overriddenExactly.has(`${pattern}\\0${header.toLowerCase()}`);\n\n  const warnedOverlaps = new Set<string>();\n  const emit = (pattern: string, header: string, value: string): string => {\n    if (overridden(pattern, header)) return '';\n    for (const rule of userRuleList) {\n      if (rule.pattern === pattern) continue;\n      if (!patternsOverlap(rule.pattern, pattern)) continue;\n      for (const h of rule.headers) {\n        if (h.name.toLowerCase() !== header.toLowerCase()) continue;\n        const key = `${rule.pattern}\\0${pattern}\\0${header.toLowerCase()}`;\n        if (warnedOverlaps.has(key)) continue;\n        warnedOverlaps.add(key);\n        console.warn(\n          `[timber] _headers: your rule \"${rule.pattern}\" sets ${header}, which ` +\n            `timber also sets on \"${pattern}\". Cloudflare and Netlify apply both, ` +\n            `so the response gets two ${header} values. Use the exact pattern ` +\n            `\"${pattern}\" to replace timber's rule, or narrow yours so they do ` +\n            `not overlap.`\n        );\n      }\n    }\n    return `\\n${pattern}\\n  ${header}: ${value}\\n`;\n  };\n\n  let content = `# Auto-generated by @timber-js/app — static asset cache headers.\n# See design/25-production-deployments.md §\"CDN / Edge Cache\"\n`;\n  for (const path of ['/assets/*', '/_timber/fonts/*', '/_rsc/*']) {\n    content += emit(rulePath(path), 'Cache-Control', IMMUTABLE_CACHE);\n  }\n\n  // Content-Type rules are higher priority than cache headers for\n  // extensionless files — without them the file is unreadable.\n  const allCtEntries = contentTypes\n    ? Object.entries(contentTypes).sort(([a], [b]) => a.localeCompare(b))\n    : [];\n  const ctEntries = allCtEntries.slice(0, MAX_PER_FILE_RULES);\n  if (allCtEntries.length > MAX_PER_FILE_RULES) {\n    console.warn(\n      `[timber] _headers: ${allCtEntries.length} content-type rules exceed ` +\n        `Cloudflare's 100-rule limit. Only the first ${MAX_PER_FILE_RULES} ` +\n        `extensionless API routes will get Content-Type headers.`\n    );\n  }\n  const remainingBudget = MAX_PER_FILE_RULES - ctEntries.length;\n\n  if (unhashedPaths && unhashedPaths.length > 0) {\n    const capped = unhashedPaths.slice(0, Math.max(0, remainingBudget));\n    if (unhashedPaths.length > remainingBudget) {\n      console.warn(\n        `[timber] _headers: ${unhashedPaths.length} unhashed static files + ` +\n          `${ctEntries.length} content-type rules found, but Cloudflare limits ` +\n          `_headers to 100 rules. Only the first ${capped.length} unhashed ` +\n          `files will get Cache-Control headers.`\n      );\n    }\n    // Section bodies are built before their comment header so a section the\n    // user has overridden entirely does not leave a heading over nothing.\n    const body = capped.map((p) => emit(rulePath(p), 'Cache-Control', STATIC_CACHE)).join('');\n    if (body !== '') {\n      content += `\\n# Unhashed static assets — short-lived cache with revalidation\\n${body}`;\n    }\n  }\n\n  const ctBody = ctEntries\n    .map(([urlPath, ct]) => emit(rulePath(urlPath), 'Content-Type', ct))\n    .join('');\n  if (ctBody !== '') {\n    content += `\\n# Content-Type for extensionless API routes\\n${ctBody}`;\n  }\n\n  // User rules last, matching the `_redirects` merge. Their paths are left\n  // verbatim: `_redirects` prefixes the rules it generates because it wrote\n  // them in route space, but these are the user's own text, already authored\n  // against the URLs the site is deployed at.\n  if (userRules && userRules.trim() !== '') {\n    content += `\\n# User-authored rules from public/_headers\\n\\n${userRules.trim()}\\n`;\n\n    const total = countHeaderRules(content);\n    if (total > MAX_PER_FILE_RULES + 3) {\n      console.warn(\n        `[timber] _headers: ${total} rules after merging public/_headers, over ` +\n          `Cloudflare's ${MAX_PER_FILE_RULES + 3}-rule limit. Rules past the ` +\n          `limit are dropped by the platform — remove some, or move static ` +\n          `assets under a directory the wildcard rules already cover.`\n      );\n    }\n  }\n\n  return content;\n}\n","// Shared build-output helper for adapter buildOutput() methods.\n//\n// Steps 1–5 of every adapter's buildOutput are platform-agnostic:\n//   1. Copy client assets to the public/static directory\n//   2. Write _headers file for static asset cache control\n//   3. Copy RSC + SSR server bundles\n//   4. Write manifest-init module (if present)\n//\n// Only the final steps (entry codegen, platform config) vary per adapter.\n//\n// IMPORTANT: This module must remain a leaf — no imports from ../server/,\n// ../client/, or Vite-dependent code. See adapters/shared.ts header.\n\nimport { writeFile, mkdir, cp, rm, readdir, readFile } from 'node:fs/promises';\nimport { join, basename, relative } from 'node:path';\nimport { adapterBase, generateHeadersFile } from './shared.ts';\n// Isomorphic, zero-import module — safe to load from an adapter, which Node's\n// native ESM loader evaluates before Vite's resolver exists. Same precedent as\n// `adapters/shared.ts` importing `../shared/base-path.js`.\nimport {\n  HEADERS_FILE,\n  USER_MERGED_PLATFORM_FILES,\n  USER_PLATFORM_DIR,\n} from '../shared/static-platform-files.ts';\nimport { detectFsIdentity, fsKey } from './fs-identity.ts';\nimport type { TimberConfig } from './types.ts';\n\n/** Options for the shared build output steps. */\nexport interface BuildOutputBaseOptions {\n  /** Resolved timber config. */\n  config: TimberConfig;\n  /** Root build directory (e.g. `.timber/build`). */\n  buildDir: string;\n  /** Adapter-specific output directory (e.g. `.timber/build/nitro`). */\n  outDir: string;\n  /**\n   * Name of the public/static directory within outDir.\n   * Nitro uses 'public', Cloudflare uses 'static'.\n   */\n  publicDirName: string;\n}\n\n/**\n * Run the platform-agnostic build output steps shared by all adapters:\n *\n * 1. Create the output directory\n * 2. Copy client assets to the public/static directory\n * 3. Write the `_headers` file for static asset cache control\n * 4. Copy RSC and SSR server bundles into the output directory\n * 5. Write the manifest-init module if present\n *\n * Returns the resolved public directory path for further adapter-specific use.\n */\nexport async function runSharedBuildSteps(opts: BuildOutputBaseOptions): Promise<string> {\n  const { config, buildDir, outDir, publicDirName } = opts;\n\n  // 1. Create the output directory.\n  await mkdir(outDir, { recursive: true });\n\n  // 2. Copy client assets to public/static directory.\n  // When client JavaScript is disabled, skip .js files — only CSS,\n  // fonts, images, and other static assets are needed.\n  const clientDir = join(buildDir, 'client');\n  const publicDir = join(outDir, publicDirName);\n  await mkdir(publicDir, { recursive: true });\n  // Find WASM files that are referenced by client JS (legitimate client WASM)\n  // vs orphaned server-only WASM (e.g. @takumi-rs for OG image generation).\n  // Only strip orphaned WASM to avoid breaking client-side WASM usage.\n  const referencedWasm = await findReferencedWasm(clientDir);\n\n  await cp(clientDir, publicDir, {\n    recursive: true,\n    filter: (src: string) => {\n      if (src.endsWith('.wasm') && !referencedWasm.has(basename(src))) {\n        return false;\n      }\n      if (config.clientJavascriptDisabled && src.endsWith('.js')) return false;\n      return true;\n    },\n  }).catch((e: NodeJS.ErrnoException) => {\n    // Client dir may not exist when client JavaScript is disabled\n    if (e.code !== 'ENOENT') throw e;\n  });\n\n  // 3. Write _headers file for static asset cache control.\n  // Scan for unhashed files so they get per-file Cache-Control rules in the\n  // _headers file. On platforms like Cloudflare Workers Static Assets, the\n  // worker never sees static file requests — _headers is the only mechanism.\n  await writeHeadersFile(publicDir, config, await findUnhashedStaticFiles(publicDir));\n\n  // 4. Copy RSC + SSR server bundles into the output directory.\n  await cp(join(buildDir, 'rsc'), join(outDir, 'rsc'), { recursive: true });\n  await cp(join(buildDir, 'ssr'), join(outDir, 'ssr'), { recursive: true }).catch(\n    (e: NodeJS.ErrnoException) => {\n      // SSR dir may not exist for static-only builds\n      if (e.code !== 'ENOENT') throw e;\n    }\n  );\n\n  // 4b. Copy prebuilt/ flight payloads if present (cache.component artifacts).\n  // These are produced by the post-build capture pass (design/44) and read\n  // at request time via the adapter's PrebuiltPayloadSource.\n  await cp(join(buildDir, 'prebuilt'), join(outDir, 'prebuilt'), { recursive: true }).catch(\n    (e: NodeJS.ErrnoException) => {\n      // No prebuilt dir when the app has no cache.component calls\n      if (e.code !== 'ENOENT') throw e;\n    }\n  );\n\n  // 5. Write manifest-init module if present.\n  if (config.manifestInit) {\n    await writeFile(join(outDir, '_timber-manifest-init.js'), config.manifestInit);\n  }\n\n  return publicDir;\n}\n\n/**\n * Find unhashed static files in the public directory that need per-file\n * Cache-Control rules in the `_headers` file.\n *\n * Excludes:\n * - Files under `assets/` and `_timber/` (covered by wildcard rules)\n * - Underscore-prefixed files (`_headers`, `_worker.js`, etc.)\n *\n * @internal Exported for testing.\n */\n// Well-known metadata files that should be prioritized when capping\n// _headers rules, so they're never dropped in favor of less important files.\nconst PRIORITY_FILES = new Set([\n  '/favicon.ico',\n  '/robots.txt',\n  '/sitemap.xml',\n  '/manifest.json',\n  '/manifest.webmanifest',\n  '/apple-touch-icon.png',\n]);\n\nexport async function findUnhashedStaticFiles(publicDir: string): Promise<string[]> {\n  let files: string[];\n  try {\n    files = await collectFiles(publicDir);\n  } catch {\n    return [];\n  }\n\n  const priority: string[] = [];\n  const rest: string[] = [];\n  for (const file of files) {\n    const rel = relative(publicDir, file).replace(/\\\\/g, '/');\n    if (rel.startsWith('assets/') || rel.startsWith('_timber/')) continue;\n    if (rel.startsWith('rsc/') || rel.startsWith('ssr/') || rel.startsWith('_rsc/')) continue;\n    if (basename(rel).startsWith('_')) continue;\n    const urlPath = '/' + rel;\n    if (PRIORITY_FILES.has(urlPath)) {\n      priority.push(urlPath);\n    } else {\n      rest.push(urlPath);\n    }\n  }\n\n  return [...priority.sort(), ...rest.sort()];\n}\n\n/**\n * Scan client JS files for references to .wasm filenames.\n * Returns the set of WASM basenames that are actually imported/referenced\n * by client code and must be preserved in the static output.\n */\nasync function findReferencedWasm(clientDir: string): Promise<Set<string>> {\n  const referenced = new Set<string>();\n\n  let files: string[];\n  try {\n    files = await collectFiles(clientDir);\n  } catch {\n    return referenced;\n  }\n\n  const jsFiles = files.filter((f) => f.endsWith('.js'));\n  const wasmFiles = files.filter((f) => f.endsWith('.wasm')).map((f) => basename(f));\n  if (wasmFiles.length === 0) return referenced;\n\n  for (const jsFile of jsFiles) {\n    const content = await readFile(jsFile, 'utf-8');\n    for (const wasmName of wasmFiles) {\n      if (content.includes(wasmName)) {\n        referenced.add(wasmName);\n      }\n    }\n  }\n\n  return referenced;\n}\n\n/**\n * Build a static-only output directory (no server entry). Copies client\n * assets and pre-rendered HTML/RSC/API files into `outDir/publicDirName`.\n * Used by both Cloudflare and Nitro adapters in `output: 'static'` mode.\n */\nexport async function buildStaticDirectoryOutput(\n  config: TimberConfig,\n  buildDir: string,\n  outDir: string,\n  publicDirName: string\n): Promise<void> {\n  // Clean stale artifacts from prior builds (e.g. server-mode builds that\n  // left rsc/, ssr/, _worker.js in the outDir). Without this, a static\n  // build after a server build inherits 140+ unused server chunks.\n  await rm(outDir, { recursive: true, force: true }).catch(() => {});\n  await mkdir(outDir, { recursive: true });\n\n  const publicDir = join(outDir, publicDirName);\n  await mkdir(publicDir, { recursive: true });\n\n  // Copy client assets (JS, CSS, fonts, images).\n  const clientDir = join(buildDir, 'client');\n  await cp(clientDir, publicDir, {\n    recursive: true,\n    filter: (src: string) => {\n      if (config.clientJavascriptDisabled && src.endsWith('.js')) return false;\n      return true;\n    },\n  }).catch((e: NodeJS.ErrnoException) => {\n    if (e.code !== 'ENOENT') throw e;\n  });\n\n  // Copy pre-rendered static pages (HTML + RSC flight + API routes).\n  //\n  // This is the one place the build merges two independently-produced trees\n  // into a single directory, and `cp` resolves an overlap by overwriting with\n  // no diagnostic — the deployment then contains one of the two artifacts and\n  // nothing recorded which. Refuse instead (TIM-1266).\n  if (config.staticPagesDir) {\n    await assertNoTreeCollision(config.staticPagesDir, publicDir);\n    await cp(config.staticPagesDir, publicDir, { recursive: true });\n  }\n}\n\n/**\n * Write the `_headers` file, folding in the user's `public/_headers`.\n *\n * Every adapter used to `writeFile` a generated `_headers` over whatever\n * Vite had copied out of `public/`, so an app shipping its own CSP, CORS, or\n * cache rules deployed without them and without a word (TIM-1326). The\n * generated rules and the user's are not competitors — they address different\n * paths — so this merges rather than refusing, the way `_redirects` has since\n * TIM-1249.\n *\n * **Read from the project, not the output.** The generated file lands under\n * the same name in the output directory, and `runSharedBuildSteps` does not\n * clean `outDir`; a reader aimed there would fold the previous build's\n * generated rules back in and compound them on every rebuild — the defect\n * this pass fixed for `_redirects`.\n *\n * User rules go last. On Cloudflare and Netlify a `_headers` file applies\n * every matching rule, so appending means the user's rules take effect; where\n * a platform resolves a conflict in favour of the earlier rule instead, the\n * framework keeps the paths it owns and the user keeps the rest. Under either\n * reading this is no worse than the previous behaviour, which was to drop the\n * user's rules entirely.\n *\n * @internal Exported for testing.\n */\nexport async function writeHeadersFile(\n  dir: string,\n  config: TimberConfig,\n  unhashedPaths: string[]\n): Promise<void> {\n  const userRules = await readUserPlatformFile(config.root, HEADERS_FILE);\n  await writeFile(\n    join(dir, HEADERS_FILE),\n    generateHeadersFile({\n      base: adapterBase(config),\n      unhashedPaths,\n      contentTypes: config.staticContentTypes,\n      userRules: userRules ?? undefined,\n    })\n  );\n}\n\n/**\n * Read a user-authored platform file from the project's `public/` directory.\n * Returns null when the project has none, or when no root is configured —\n * a caller without a root cannot locate the project at all, and inventing\n * one from `process.cwd()` would read a different project's file.\n */\nasync function readUserPlatformFile(\n  root: string | undefined,\n  name: string\n): Promise<string | null> {\n  if (!root) return null;\n  try {\n    return await readFile(join(root, USER_PLATFORM_DIR, name), 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Throw if copying `srcDir` over `destDir` would overwrite an existing file.\n *\n * Compared against the destination **as it stands**, not against the other\n * source tree: the first copy is filtered (client JS is dropped when client\n * JavaScript is disabled), so the files that are actually there are the only\n * ones a second copy can clobber.\n *\n * @internal Exported for testing.\n */\nexport async function assertNoTreeCollision(srcDir: string, destDir: string): Promise<void> {\n  const [srcFiles, destFiles, identity] = await Promise.all([\n    collectFiles(srcDir).catch(() => [] as string[]),\n    collectFiles(destDir).catch(() => [] as string[]),\n    // `cp` will resolve these paths the way the destination filesystem does,\n    // so the comparison predicting it has to as well: on macOS a hand-written\n    // `public/About/index.html` and a generated `about/index.html` are one\n    // file, and an exact-string set waves the overwrite through (TIM-1266).\n    detectFsIdentity(destDir),\n  ]);\n\n  const key = (p: string) => fsKey(p, identity);\n  const existing = new Set(destFiles.map((f) => key(relative(destDir, f).replace(/\\\\/g, '/'))));\n  const exempt = new Set(USER_MERGED_PLATFORM_FILES.map(key));\n  const collisions = srcFiles\n    .map((f) => relative(srcDir, f).replace(/\\\\/g, '/'))\n    .filter((rel) => existing.has(key(rel)) && !exempt.has(key(rel)))\n    .sort();\n\n  if (collisions.length === 0) return;\n\n  throw new Error(\n    `[timber] Build output: ${collisions.length} file(s) in the pre-rendered site ` +\n      `collide with files already in the output directory. Copying would silently ` +\n      `overwrite them — a generated page and a file in public/ cannot share a path:\\n` +\n      collisions.map((c) => `  - ${c}`).join('\\n')\n  );\n}\n\nasync function collectFiles(dir: string): Promise<string[]> {\n  const result: string[] = [];\n  const entries = await readdir(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    const fullPath = join(dir, entry.name);\n    if (entry.isDirectory()) {\n      result.push(...(await collectFiles(fullPath)));\n    } else {\n      result.push(fullPath);\n    }\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA0BA,SAAgB,YAAY,QAAmC;CAC7D,OAAO,OAAO,QAAQ;AACxB;;AAKA,IAAa,kBAAkB;;AAG/B,IAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkC5B,IAAM,qBAAqB;;;;;;;AA4B3B,SAAgB,iBAAiB,SAAyB;CACxD,OAAO,QACJ,MAAM,IAAI,CAAC,CACX,QAAQ,SAAS,KAAK,KAAK,MAAM,MAAM,CAAC,KAAK,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;AACxF;;;;;;;AAcA,SAAgB,iBAAiB,SAA+B;CAC9D,MAAM,QAAsB,CAAC;CAC7B,KAAK,MAAM,OAAO,QAAQ,MAAM,IAAI,GAAG;EACrC,MAAM,OAAO,IAAI,QAAQ,OAAO,EAAE;EAClC,IAAI,KAAK,KAAK,MAAM,MAAM,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GAAG;EAC5D,IAAI,MAAM,KAAK,IAAI,GAAG;GACpB,MAAM,UAAU,MAAM,MAAM,SAAS;GACrC,IAAI,CAAC,SAAS;GACd,MAAM,QAAQ,KAAK,QAAQ,GAAG;GAC9B,IAAI,UAAU,IAAI;GAClB,QAAQ,QAAQ,KAAK;IACnB,MAAM,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK;IAChC,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK;GACpC,CAAC;EACH,OACE,MAAM,KAAK;GAAE,SAAS,KAAK,KAAK;GAAG,SAAS,CAAC;EAAE,CAAC;CAEpD;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAS,gBAAgB,GAAW,GAAoB;CACtD,IAAI,MAAM,GAAG,OAAO;CACpB,MAAM,YAAY,MAAe,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI;CACpE,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,CAAC;CAC1C,IAAI,OAAO,SAAS,EAAE,WAAW,EAAE,KAAK,OAAO,KAAK,OAAO;CAC3D,IAAI,OAAO,SAAS,EAAE,WAAW,EAAE,KAAK,OAAO,KAAK,OAAO;CAC3D,OAAO;AACT;AAEA,SAAgB,oBAAoB,EAClC,MACA,eACA,cACA,aAC6B;;CAE7B,MAAM,YAAY,SAAiB,aAAa,MAAM,IAAI;CAc1D,MAAM,eAAe,YAAY,iBAAiB,SAAS,IAAI,CAAC;CAChE,MAAM,oBAAoB,IAAI,IAC5B,aAAa,SAAS,SACpB,KAAK,QAAQ,KAAK,MAAM,GAAG,KAAK,QAAQ,IAAI,EAAE,KAAK,YAAY,GAAG,CACpE,CACF;CACA,MAAM,cAAc,SAAiB,WACnC,kBAAkB,IAAI,GAAG,QAAQ,IAAI,OAAO,YAAY,GAAG;CAE7D,MAAM,iCAAiB,IAAI,IAAY;CACvC,MAAM,QAAQ,SAAiB,QAAgB,UAA0B;EACvE,IAAI,WAAW,SAAS,MAAM,GAAG,OAAO;EACxC,KAAK,MAAM,QAAQ,cAAc;GAC/B,IAAI,KAAK,YAAY,SAAS;GAC9B,IAAI,CAAC,gBAAgB,KAAK,SAAS,OAAO,GAAG;GAC7C,KAAK,MAAM,KAAK,KAAK,SAAS;IAC5B,IAAI,EAAE,KAAK,YAAY,MAAM,OAAO,YAAY,GAAG;IACnD,MAAM,MAAM,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,OAAO,YAAY;IAC/D,IAAI,eAAe,IAAI,GAAG,GAAG;IAC7B,eAAe,IAAI,GAAG;IACtB,QAAQ,KACN,iCAAiC,KAAK,QAAQ,SAAS,OAAO,+BACpC,QAAQ,iEACJ,OAAO,kCAC/B,QAAQ,oEAEhB;GACF;EACF;EACA,OAAO,KAAK,QAAQ,MAAM,OAAO,IAAI,MAAM;CAC7C;CAEA,IAAI,UAAU;;;CAGd,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAoB;CAAS,GAC5D,WAAW,KAAK,SAAS,IAAI,GAAG,iBAAiB,eAAe;CAKlE,MAAM,eAAe,eACjB,OAAO,QAAQ,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,IAClE,CAAC;CACL,MAAM,YAAY,aAAa,MAAM,GAAG,kBAAkB;CAC1D,IAAI,aAAa,SAAS,oBACxB,QAAQ,KACN,sBAAsB,aAAa,OAAO,yEACO,mBAAmB,yDAEtE;CAEF,MAAM,kBAAkB,qBAAqB,UAAU;CAEvD,IAAI,iBAAiB,cAAc,SAAS,GAAG;EAC7C,MAAM,SAAS,cAAc,MAAM,GAAG,KAAK,IAAI,GAAG,eAAe,CAAC;EAClE,IAAI,cAAc,SAAS,iBACzB,QAAQ,KACN,sBAAsB,cAAc,OAAO,2BACtC,UAAU,OAAO,yFACqB,OAAO,OAAO,gDAE3D;EAIF,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG,iBAAiB,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE;EACxF,IAAI,SAAS,IACX,WAAW,qEAAqE;CAEpF;CAEA,MAAM,SAAS,UACZ,KAAK,CAAC,SAAS,QAAQ,KAAK,SAAS,OAAO,GAAG,gBAAgB,EAAE,CAAC,CAAC,CACnE,KAAK,EAAE;CACV,IAAI,WAAW,IACb,WAAW,kDAAkD;CAO/D,IAAI,aAAa,UAAU,KAAK,MAAM,IAAI;EACxC,WAAW,mDAAmD,UAAU,KAAK,EAAE;EAE/E,MAAM,QAAQ,iBAAiB,OAAO;EACtC,IAAI,QAAQ,KACV,QAAQ,KACN,sBAAsB,MAAM,kNAI9B;CAEJ;CAEA,OAAO;AACT;;;;;;;;;;;;;;AC5NA,eAAsB,oBAAoB,MAA+C;CACvF,MAAM,EAAE,QAAQ,UAAU,QAAQ,kBAAkB;CAGpD,MAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;CAKvC,MAAM,YAAY,KAAK,UAAU,QAAQ;CACzC,MAAM,YAAY,KAAK,QAAQ,aAAa;CAC5C,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAI1C,MAAM,iBAAiB,MAAM,mBAAmB,SAAS;CAEzD,MAAM,GAAG,WAAW,WAAW;EAC7B,WAAW;EACX,SAAS,QAAgB;GACvB,IAAI,IAAI,SAAS,OAAO,KAAK,CAAC,eAAe,IAAI,SAAS,GAAG,CAAC,GAC5D,OAAO;GAET,IAAI,OAAO,4BAA4B,IAAI,SAAS,KAAK,GAAG,OAAO;GACnE,OAAO;EACT;CACF,CAAC,CAAC,CAAC,OAAO,MAA6B;EAErC,IAAI,EAAE,SAAS,UAAU,MAAM;CACjC,CAAC;CAMD,MAAM,iBAAiB,WAAW,QAAQ,MAAM,wBAAwB,SAAS,CAAC;CAGlF,MAAM,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,QAAQ,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC;CACxE,MAAM,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,QAAQ,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OACvE,MAA6B;EAE5B,IAAI,EAAE,SAAS,UAAU,MAAM;CACjC,CACF;CAKA,MAAM,GAAG,KAAK,UAAU,UAAU,GAAG,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OACjF,MAA6B;EAE5B,IAAI,EAAE,SAAS,UAAU,MAAM;CACjC,CACF;CAGA,IAAI,OAAO,cACT,MAAM,UAAU,KAAK,QAAQ,0BAA0B,GAAG,OAAO,YAAY;CAG/E,OAAO;AACT;;;;;;;;;;;AAcA,IAAM,iCAAiB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,eAAsB,wBAAwB,WAAsC;CAClF,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,aAAa,SAAS;CACtC,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,MAAM,WAAqB,CAAC;CAC5B,MAAM,OAAiB,CAAC;CACxB,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,SAAS,WAAW,IAAI,CAAC,CAAC,QAAQ,OAAO,GAAG;EACxD,IAAI,IAAI,WAAW,SAAS,KAAK,IAAI,WAAW,UAAU,GAAG;EAC7D,IAAI,IAAI,WAAW,MAAM,KAAK,IAAI,WAAW,MAAM,KAAK,IAAI,WAAW,OAAO,GAAG;EACjF,IAAI,SAAS,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG;EACnC,MAAM,UAAU,MAAM;EACtB,IAAI,eAAe,IAAI,OAAO,GAC5B,SAAS,KAAK,OAAO;OAErB,KAAK,KAAK,OAAO;CAErB;CAEA,OAAO,CAAC,GAAG,SAAS,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC;AAC5C;;;;;;AAOA,eAAe,mBAAmB,WAAyC;CACzE,MAAM,6BAAa,IAAI,IAAY;CAEnC,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,aAAa,SAAS;CACtC,QAAQ;EACN,OAAO;CACT;CAEA,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC;CACrD,MAAM,YAAY,MAAM,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,CAAC,CAAC;CACjF,IAAI,UAAU,WAAW,GAAG,OAAO;CAEnC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,UAAU,MAAM,SAAS,QAAQ,OAAO;EAC9C,KAAK,MAAM,YAAY,WACrB,IAAI,QAAQ,SAAS,QAAQ,GAC3B,WAAW,IAAI,QAAQ;CAG7B;CAEA,OAAO;AACT;;;;;;AAOA,eAAsB,2BACpB,QACA,UACA,QACA,eACe;CAIf,MAAM,GAAG,QAAQ;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CACjE,MAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;CAEvC,MAAM,YAAY,KAAK,QAAQ,aAAa;CAC5C,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAG1C,MAAM,YAAY,KAAK,UAAU,QAAQ;CACzC,MAAM,GAAG,WAAW,WAAW;EAC7B,WAAW;EACX,SAAS,QAAgB;GACvB,IAAI,OAAO,4BAA4B,IAAI,SAAS,KAAK,GAAG,OAAO;GACnE,OAAO;EACT;CACF,CAAC,CAAC,CAAC,OAAO,MAA6B;EACrC,IAAI,EAAE,SAAS,UAAU,MAAM;CACjC,CAAC;CAQD,IAAI,OAAO,gBAAgB;EACzB,MAAM,sBAAsB,OAAO,gBAAgB,SAAS;EAC5D,MAAM,GAAG,OAAO,gBAAgB,WAAW,EAAE,WAAW,KAAK,CAAC;CAChE;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,eAAsB,iBACpB,KACA,QACA,eACe;CACf,MAAM,YAAY,MAAM,qBAAqB,OAAO,MAAM,YAAY;CACtE,MAAM,UACJ,KAAK,KAAK,YAAY,GACtB,oBAAoB;EAClB,MAAM,YAAY,MAAM;EACxB;EACA,cAAc,OAAO;EACrB,WAAW,aAAa,KAAA;CAC1B,CAAC,CACH;AACF;;;;;;;AAQA,eAAe,qBACb,MACA,MACwB;CACxB,IAAI,CAAC,MAAM,OAAO;CAClB,IAAI;EACF,OAAO,MAAM,SAAS,KAAK,MAAM,mBAAmB,IAAI,GAAG,OAAO;CACpE,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;AAYA,eAAsB,sBAAsB,QAAgB,SAAgC;CAC1F,MAAM,CAAC,UAAU,WAAW,YAAY,MAAM,QAAQ,IAAI;EACxD,aAAa,MAAM,CAAC,CAAC,YAAY,CAAC,CAAa;EAC/C,aAAa,OAAO,CAAC,CAAC,YAAY,CAAC,CAAa;EAKhD,iBAAiB,OAAO;CAC1B,CAAC;CAED,MAAM,OAAO,MAAc,MAAM,GAAG,QAAQ;CAC5C,MAAM,WAAW,IAAI,IAAI,UAAU,KAAK,MAAM,IAAI,SAAS,SAAS,CAAC,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,CAAC;CAC5F,MAAM,SAAS,IAAI,IAAI,2BAA2B,IAAI,GAAG,CAAC;CAC1D,MAAM,aAAa,SAChB,KAAK,MAAM,SAAS,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,CACnD,QAAQ,QAAQ,SAAS,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAChE,KAAK;CAER,IAAI,WAAW,WAAW,GAAG;CAE7B,MAAM,IAAI,MACR,0BAA0B,WAAW,OAAO,+LAG1C,WAAW,KAAK,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAC/C;AACF;AAEA,eAAe,aAAa,KAAgC;CAC1D,MAAM,SAAmB,CAAC;CAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CAC1D,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,WAAW,KAAK,KAAK,MAAM,IAAI;EACrC,IAAI,MAAM,YAAY,GACpB,OAAO,KAAK,GAAI,MAAM,aAAa,QAAQ,CAAE;OAE7C,OAAO,KAAK,QAAQ;CAExB;CACA,OAAO;AACT"}