@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/dist/_chunks/graph-cache-CYiUS2aS.js

@@ -0,0 +1,303 @@
+import { i as scanProjectSourceFiles, t as buildSourceExtensions } from "./scan-BoP17W3w.js";
+import { t as writeFileAtomic } from "./write-file-atomic-D1qWqHb4.js";
+import { dirname, isAbsolute, join } from "node:path";
+import { createRequire } from "node:module";
+import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { Server } from "node:tls";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, stat } from "node:fs/promises";
+//#region src/plugins/dev-discovery.ts
+/** Relative path of the discovery directory within the project root. */
+var DEV_DISCOVERY_DIR = join(".timber", "dev");
+/** Best-effort "is this pid alive" — signal 0 probes without killing. */
+function isPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Remove sibling records whose pid is no longer alive. Purely a
+* tidiness sweep — consumers already ignore records that fail the
+* pid + probe validation, so missing a stale record here is harmless.
+*/
+function sweepDeadRecords(dir) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.endsWith(".json")) continue;
+		const filePath = join(dir, entry);
+		try {
+			const record = JSON.parse(readFileSync(filePath, "utf8"));
+			if (typeof record.pid === "number" && !isPidAlive(record.pid)) rmSync(filePath, { force: true });
+		} catch {}
+	}
+}
+/**
+* Register discovery-record lifecycle handlers on the dev server's HTTP
+* server. Writes `.timber/dev/<pid>-<port>-<token>.json` once the server is
+* listening (the bound port is only known then) and removes exactly
+* that record on clean shutdown.
+*
+* All filesystem work is best-effort: a failure to write or remove a
+* record must never break the dev server. `httpServer` is null in
+* middleware mode — no port exists, so there is nothing to advertise.
+* Typed as `net.Server` — the common base of Vite's `http.Server` and
+* `Http2SecureServer` variants, which carries the events and `address()`.
+*/
+function registerDevDiscovery(httpServer, root, config) {
+	if (!httpServer) return;
+	const dir = join(root, DEV_DISCOVERY_DIR);
+	let recordPath = null;
+	httpServer.on("listening", () => {
+		const address = httpServer.address();
+		if (address === null || typeof address === "string") return;
+		const hmrOpts = typeof config?.server?.hmr === "object" ? config.server.hmr : void 0;
+		const wsOpts = typeof config?.server?.ws === "object" ? config.server.ws : void 0;
+		const record = {
+			port: address.port,
+			pid: process.pid,
+			host: address.address,
+			protocol: httpServer instanceof Server ? "https" : "http",
+			base: config?.base && config.base !== "/" ? config.base : void 0,
+			hmrPath: wsOpts?.path ?? hmrOpts?.path,
+			hmrHost: wsOpts?.host ?? hmrOpts?.host,
+			hmrPort: wsOpts?.clientPort || wsOpts?.port || hmrOpts?.clientPort || hmrOpts?.port || void 0,
+			hmrProtocol: wsOpts?.protocol ?? hmrOpts?.protocol,
+			webSocketToken: config?.webSocketToken,
+			configFile: typeof config?.configFile === "string" ? config.configFile : void 0
+		};
+		recordPath = join(dir, `${record.pid}-${record.port}-${randomUUID()}.json`);
+		try {
+			mkdirSync(dir, { recursive: true });
+			writeFileSync(recordPath, JSON.stringify(record));
+			sweepDeadRecords(dir);
+		} catch {}
+	});
+	httpServer.on("close", () => {
+		if (!recordPath) return;
+		try {
+			rmSync(recordPath, { force: true });
+		} catch {}
+	});
+}
+/** Cache location under the app root. */
+var CACHE_RELATIVE_PATH = join(".timber", "graph-cache.json");
+/**
+* Config/manifest files at the root that participate in the
+* fingerprint. The `.env` family is included because a Vite config
+* using `loadEnv(mode, …)` can select aliases, plugins, the app root,
+* or pageExtensions from it — the disk scan skips dot-prefixed files,
+* so without these entries an `.env.production` edit would never miss
+* the cache (codex review, PR #1056). The build resolves under mode
+* `production`; the development variants are tracked anyway — they are
+* loadable through `loadEnv` with any mode argument, and an absent
+* file contributes nothing.
+*/
+var ROOT_MANIFEST_FILES = [
+	"package.json",
+	"tsconfig.json",
+	"timber.config.ts",
+	"timber.config.js",
+	"timber.config.mjs",
+	".env",
+	".env.local",
+	".env.production",
+	".env.production.local",
+	".env.development",
+	".env.development.local"
+];
+/** Lockfile names, searched upward from the root (monorepo workspaces). */
+var LOCKFILE_NAMES = [
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb"
+];
+/**
+* Follow a tsconfig/jsconfig `extends` chain, returning every file on
+* it (the start file included). A base config outside the app —
+* `"extends": "../tsconfig.base.json"` with a `paths` mapping — can
+* reshape Vite's resolution without touching anything else the
+* fingerprint tracks. Parsing is a targeted regex, not JSONC: tsconfig
+* allows comments, and all we need is the `extends` value. Package
+* specifiers resolve through Node resolution (an approximation of
+* TypeScript's — the `.json` append covers the common shapes): a
+* WORKSPACE package like `@repo/tsconfig/base.json` is a link, so its
+* edits change neither the lockfile nor any scanned file and must be
+* fingerprinted directly; registry packages resolve too, harmlessly.
+* Cycles and unresolvable targets just end the walk (bounded at 16).
+*/
+/**
+* Strip JSONC comments so a commented-out `"extends"` line cannot
+* shadow the real one. String-aware: comment markers inside string
+* literals (a path containing `//`) survive.
+*/
+function stripJsonComments(raw) {
+	let out = "";
+	let inString = false;
+	for (let i = 0; i < raw.length; i++) {
+		const ch = raw[i];
+		if (inString) {
+			out += ch;
+			if (ch === "\\") {
+				out += raw[i + 1] ?? "";
+				i++;
+			} else if (ch === "\"") inString = false;
+		} else if (ch === "\"") {
+			inString = true;
+			out += ch;
+		} else if (ch === "/" && raw[i + 1] === "/") {
+			while (i < raw.length && raw[i] !== "\n") i++;
+			out += "\n";
+		} else if (ch === "/" && raw[i + 1] === "*") {
+			i += 2;
+			while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
+			i++;
+		} else out += ch;
+	}
+	return out;
+}
+async function collectTsconfigChain(startFile) {
+	const chain = [];
+	const queue = [startFile];
+	const seen = new Set(queue);
+	while (queue.length > 0 && chain.length < 16) {
+		const current = queue.shift();
+		let raw;
+		try {
+			raw = stripJsonComments(await readFile(current, "utf8"));
+		} catch {
+			continue;
+		}
+		chain.push(current);
+		const match = raw.match(/"extends"\s*:\s*("([^"]+)"|\[([^\]]*)\])/);
+		if (!match) continue;
+		const targets = match[2] ? [match[2]] : (match[3]?.match(/"([^"]+)"/g) ?? []).map((t) => t.slice(1, -1));
+		for (const target of targets) {
+			let next = null;
+			if (isAbsolute(target)) {
+				next = target;
+				if (!/\.json$/.test(next)) next += ".json";
+			} else if (target.startsWith(".")) {
+				next = join(dirname(current), target);
+				if (!/\.json$/.test(next)) next += ".json";
+			} else {
+				const req = createRequire(current);
+				for (const candidate of [
+					target,
+					`${target}.json`,
+					`${target}/tsconfig.json`
+				]) try {
+					next = req.resolve(candidate);
+					break;
+				} catch {}
+			}
+			if (next && !seen.has(next)) {
+				seen.add(next);
+				queue.push(next);
+			}
+		}
+	}
+	return chain;
+}
+/** Nearest lockfile at or above `root`, or null. */
+async function findLockfile(root) {
+	let dir = root;
+	for (;;) {
+		for (const name of LOCKFILE_NAMES) {
+			const candidate = join(dir, name);
+			try {
+				await stat(candidate);
+				return candidate;
+			} catch {}
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** `path\0mtime\0size` entries for a file list; absent files contribute nothing. */
+async function fingerprintEntriesForFiles(files) {
+	const entries = [];
+	for (const file of new Set(files)) try {
+		const stats = await stat(file);
+		entries.push(`${file}\0${stats.mtimeMs}\0${stats.size}`);
+	} catch {}
+	return entries;
+}
+/**
+* Entries for the scan-derived base set: project source files, the
+* config, root manifests, and the nearest lockfile. Scan failures are
+* folded into the entry list rather than thrown: an unreadable
+* directory changes the answer's completeness, so it must change the
+* key too.
+*/
+async function collectBaseFingerprintEntries(root, configFile, pageExtensions) {
+	const extensions = buildSourceExtensions(pageExtensions);
+	const sourceFiles = [];
+	const failures = [];
+	await scanProjectSourceFiles(root, sourceFiles, (failure) => failures.push(`${failure.dir}:${failure.message}`), 0, extensions);
+	const tracked = [
+		...sourceFiles,
+		configFile,
+		...ROOT_MANIFEST_FILES.map((f) => join(root, f))
+	];
+	const configDir = dirname(configFile);
+	if (configDir !== root) tracked.push(...ROOT_MANIFEST_FILES.map((f) => join(configDir, f)));
+	for (const name of ["tsconfig.json", "jsconfig.json"]) {
+		tracked.push(...await collectTsconfigChain(join(root, name)));
+		if (configDir !== root) tracked.push(...await collectTsconfigChain(join(configDir, name)));
+	}
+	const lockfile = await findLockfile(root);
+	if (lockfile) tracked.push(lockfile);
+	return [...failures, ...await fingerprintEntriesForFiles(tracked)];
+}
+/** Hash an entry list order-independently. */
+function hashFingerprintEntries(entries) {
+	const unique = [...new Set(entries)].sort();
+	return createHash("sha256").update(unique.join("\n")).digest("hex");
+}
+/**
+* Fingerprint the project state `timber graph`'s answers depend on:
+* the scan-derived base set plus `extraFiles` (the cache's
+* trackedExtras on the hit path; config dependencies + report files on
+* the write path).
+*/
+async function computeProjectFingerprint(root, configFile, extraFiles = [], pageExtensions) {
+	const entries = await collectBaseFingerprintEntries(root, configFile, pageExtensions);
+	entries.push(...await fingerprintEntriesForFiles(extraFiles));
+	return hashFingerprintEntries(entries);
+}
+/** Read the cache file; anything unreadable or version-mismatched is a miss. */
+async function readGraphCache(root) {
+	try {
+		const raw = await readFile(join(root, CACHE_RELATIVE_PATH), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed.version !== 2 || typeof parsed.fingerprint !== "string" || typeof parsed.configFile !== "string" || !Array.isArray(parsed.trackedExtras) || typeof parsed.report !== "object" || parsed.report === null) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+/**
+* Write the cache atomically (temp file + rename) so a concurrent
+* reader — parallel agent invocations are the expected workload —
+* never sees a torn JSON file.
+*/
+async function writeGraphCache(root, cache) {
+	const target = join(root, CACHE_RELATIVE_PATH);
+	await mkdir(dirname(target), { recursive: true });
+	await writeFileAtomic(target, JSON.stringify(cache));
+}
+//#endregion
+export { readGraphCache as a, isPidAlive as c, hashFingerprintEntries as i, registerDevDiscovery as l, computeProjectFingerprint as n, writeGraphCache as o, fingerprintEntriesForFiles as r, DEV_DISCOVERY_DIR as s, collectBaseFingerprintEntries as t };
+
+//# sourceMappingURL=graph-cache-CYiUS2aS.js.map

package/dist/_chunks/graph-cache-CYiUS2aS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-cache-CYiUS2aS.js","names":[],"sources":["../../src/plugins/dev-discovery.ts","../../src/analyze/graph-cache.ts"],"sourcesContent":["/**\n * Dev-server discovery records — `.timber/dev/<pid>-<port>-<token>.json`.\n *\n * On startup each dev server writes `{ port, pid, host, protocol }` to its own record\n * file under the app's `.timber/dev/` so the `timber graph` CLI and the\n * VS Code extension can discover a running dev server for the\n * live-graph fast path.\n *\n * One record file per server, one writer per file. This is what makes\n * multi-server roots (Vite auto-increments the port across processes;\n * programmatic embeddings run several servers in one process) safe\n * without any coordination: there is no shared file to displace, no\n * ownership to arbitrate, and no shutdown-order dependency — each\n * server removes exactly its own record.\n *\n * Consumers must list the directory and trust a record only if its pid\n * is alive AND a probe request to the endpoint succeeds; anything else\n * is treated as absent (silent fallback), never an error. Stale records\n * (crashed servers) are therefore the normal case — startup sweeps\n * dead-pid records best-effort, and consumers validate the rest away.\n *\n * The directory layout and file format are implementation details, not\n * a public contract.\n *\n * Design doc: 47-module-environment-tooling.md §5, 21-dev-server.md.\n */\n\nimport type { Server } from 'node:net';\nimport { Server as TlsServer } from 'node:tls';\nimport { randomUUID } from 'node:crypto';\nimport { mkdirSync, writeFileSync, rmSync, readFileSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\n\n/** Relative path of the discovery directory within the project root. */\nexport const DEV_DISCOVERY_DIR = join('.timber', 'dev');\n\nexport interface DevRecord {\n  port: number;\n  pid: number;\n  /**\n   * The bound address, as reported by the socket. Consumers probing the\n   * endpoint need it for servers bound to non-default interfaces;\n   * wildcard addresses (`0.0.0.0`, `::`) should be probed via loopback.\n   */\n  host: string;\n  /**\n   * Probe scheme. `server.https` dev servers (including HTTP/2) answer\n   * only TLS — an http:// probe of one would fail and wrongly trigger\n   * the cold-crawl fallback.\n   */\n  protocol: 'http' | 'https';\n  /**\n   * Vite `base` path. When non-root (e.g. `/my-app/`), the WebSocket\n   * upgrade path is `base + hmrPath`.\n   */\n  base?: string;\n  /**\n   * HMR WebSocket path (from `server.ws.path` or deprecated\n   * `server.hmr.path`). Absent when no path is configured (default `/`).\n   */\n  hmrPath?: string;\n  /**\n   * Custom WebSocket host override (from `server.ws.host` or deprecated\n   * `server.hmr.host`). When set, the WS connection targets this host\n   * instead of the HTTP server's bound address.\n   */\n  hmrHost?: string;\n  /**\n   * Custom WebSocket port override (from `server.ws.clientPort` ??\n   * `server.ws.port`, or deprecated `server.hmr.clientPort` ??\n   * `server.hmr.port`). When set, the WS connection targets this port\n   * instead of the HTTP server's bound port.\n   */\n  hmrPort?: number;\n  /**\n   * Custom WebSocket protocol override (from `server.ws.protocol` or\n   * deprecated `server.hmr.protocol`). When set (e.g. `'wss'`), the\n   * upgrade request uses the corresponding HTTP scheme.\n   */\n  hmrProtocol?: string;\n  /**\n   * Vite 8 WebSocket token (from `config.webSocketToken`). Required for\n   * browser WS upgrades; the extension passes it as `?token=` on the\n   * WebSocket URL.\n   */\n  webSocketToken?: string;\n  /**\n   * Absolute path to the Vite config file this server was started with.\n   * When multiple dev servers share a project root but use different\n   * configs, the fast path must only accept the record matching the\n   * config the CLI resolved (TIM-1393).\n   */\n  configFile?: string;\n}\n\n/** Best-effort \"is this pid alive\" — signal 0 probes without killing. */\nexport function isPidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    // EPERM means the process exists but is owned by someone else.\n    return (error as NodeJS.ErrnoException).code === 'EPERM';\n  }\n}\n\n/**\n * Remove sibling records whose pid is no longer alive. Purely a\n * tidiness sweep — consumers already ignore records that fail the\n * pid + probe validation, so missing a stale record here is harmless.\n */\nfunction sweepDeadRecords(dir: string): void {\n  let entries: string[];\n  try {\n    entries = readdirSync(dir);\n  } catch {\n    return;\n  }\n  for (const entry of entries) {\n    if (!entry.endsWith('.json')) continue;\n    const filePath = join(dir, entry);\n    try {\n      const record = JSON.parse(readFileSync(filePath, 'utf8')) as Partial<DevRecord>;\n      // Remove only records that parse AND name a dead pid. An\n      // unreadable file may be a sibling's record mid-write — leave it;\n      // consumers ignore records that fail validation anyway.\n      if (typeof record.pid === 'number' && !isPidAlive(record.pid)) {\n        rmSync(filePath, { force: true });\n      }\n    } catch {\n      // Unreadable — skip, never delete another writer's in-flight file.\n    }\n  }\n}\n\n/**\n * Register discovery-record lifecycle handlers on the dev server's HTTP\n * server. Writes `.timber/dev/<pid>-<port>-<token>.json` once the server is\n * listening (the bound port is only known then) and removes exactly\n * that record on clean shutdown.\n *\n * All filesystem work is best-effort: a failure to write or remove a\n * record must never break the dev server. `httpServer` is null in\n * middleware mode — no port exists, so there is nothing to advertise.\n * Typed as `net.Server` — the common base of Vite's `http.Server` and\n * `Http2SecureServer` variants, which carries the events and `address()`.\n */\nexport function registerDevDiscovery(\n  httpServer: Server | null,\n  root: string,\n  config?: {\n    configFile?: string | false;\n    base?: string;\n    server?: {\n      hmr?:\n        | { path?: string; host?: string; port?: number; clientPort?: number; protocol?: string }\n        | boolean;\n      ws?:\n        | { path?: string; host?: string; port?: number; clientPort?: number; protocol?: string }\n        | false;\n    };\n    webSocketToken?: string;\n  }\n): void {\n  if (!httpServer) return;\n\n  const dir = join(root, DEV_DISCOVERY_DIR);\n  let recordPath: string | null = null;\n\n  httpServer.on('listening', () => {\n    const address = httpServer.address();\n    // Unix-socket listeners have a string address — no port to advertise.\n    if (address === null || typeof address === 'string') return;\n    const hmrOpts = typeof config?.server?.hmr === 'object' ? config.server.hmr : undefined;\n    const wsOpts = typeof config?.server?.ws === 'object' ? config.server.ws : undefined;\n    const record: DevRecord = {\n      port: address.port,\n      pid: process.pid,\n      host: address.address,\n      // Vite's https/h2 servers are tls.Server subclasses; plain HTTP\n      // and h2c are not.\n      protocol: httpServer instanceof TlsServer ? 'https' : 'http',\n      base: config?.base && config.base !== '/' ? config.base : undefined,\n      hmrPath: wsOpts?.path ?? hmrOpts?.path,\n      hmrHost: wsOpts?.host ?? hmrOpts?.host,\n      hmrPort:\n        wsOpts?.clientPort || wsOpts?.port || hmrOpts?.clientPort || hmrOpts?.port || undefined,\n      hmrProtocol: wsOpts?.protocol ?? hmrOpts?.protocol,\n      webSocketToken: config?.webSocketToken,\n      configFile: typeof config?.configFile === 'string' ? config.configFile : undefined,\n    };\n    // pid+port alone is not a unique server identity (same port on two\n    // interfaces; worker threads and duplicate module copies share a\n    // pid but not module state, so a counter cannot disambiguate\n    // either). A random token makes the filename unique regardless of\n    // process/isolate topology; pid and port stay in the name only for\n    // human debuggability.\n    recordPath = join(dir, `${record.pid}-${record.port}-${randomUUID()}.json`);\n    try {\n      mkdirSync(dir, { recursive: true });\n      writeFileSync(recordPath, JSON.stringify(record));\n      sweepDeadRecords(dir);\n    } catch {\n      // Best-effort — consumers fall back to the cold crawl.\n    }\n  });\n\n  httpServer.on('close', () => {\n    if (!recordPath) return;\n    try {\n      // Only ever this server's own record — sibling servers' records\n      // are separate files and survive any shutdown order untouched.\n      rmSync(recordPath, { force: true });\n    } catch {\n      // Best-effort — a stale record is validated away by consumers.\n    }\n  });\n}\n","/**\n * graph-cache — the mtime-keyed output cache for `timber graph`.\n *\n * The cold crawl costs seconds (design/47 §6) and its cost is setup +\n * dependency compilation, not project-file count — so the cacheable\n * unit is the classification OUTPUT, never Vite's transforms. One\n * crawl per project state: the first question after a clone pays for\n * the crawl, every subsequent question is a cache hit until the\n * project changes.\n *\n * Validity is a fingerprint over (path, mtime, size) of every project\n * source file — the same disk walk the crawl itself uses (scan.ts), so\n * cache coverage and crawl coverage cannot drift — plus the config\n * files and the nearest lockfile, since dependency changes change\n * resolution (export conditions can flip a file's environment without\n * touching project code).\n *\n * Deliberately vite-free: a cache hit answers without importing Vite.\n *\n * Design docs: 47-module-environment-tooling.md §\"Cold-path policy\".\n */\n\nimport { createHash } from 'node:crypto';\nimport { createRequire } from 'node:module';\nimport { mkdir, readFile, stat } from 'node:fs/promises';\nimport { dirname, isAbsolute, join } from 'node:path';\nimport { buildSourceExtensions, scanProjectSourceFiles } from './scan.ts';\nimport type { CrawlReport } from './crawl.ts';\nimport { writeFileAtomic } from '../utils/write-file-atomic.ts';\n\n/**\n * JSON contract version (design/47 §9) — one constant for every\n * frontend (CLI and dev-server endpoint), so the two cannot drift.\n * Lives here rather than graph-command.ts because this module is\n * vite-free and both frontends already depend on the analyze core.\n */\nexport const GRAPH_JSON_VERSION = 1;\n\n/** Bump when the report shape or fingerprint inputs change. */\nexport const GRAPH_CACHE_VERSION = 2;\n\n/** Cache location under the app root. */\nconst CACHE_RELATIVE_PATH = join('.timber', 'graph-cache.json');\n\n/**\n * Config/manifest files at the root that participate in the\n * fingerprint. The `.env` family is included because a Vite config\n * using `loadEnv(mode, …)` can select aliases, plugins, the app root,\n * or pageExtensions from it — the disk scan skips dot-prefixed files,\n * so without these entries an `.env.production` edit would never miss\n * the cache (codex review, PR #1056). The build resolves under mode\n * `production`; the development variants are tracked anyway — they are\n * loadable through `loadEnv` with any mode argument, and an absent\n * file contributes nothing.\n */\nconst ROOT_MANIFEST_FILES = [\n  'package.json',\n  'tsconfig.json',\n  'timber.config.ts',\n  'timber.config.js',\n  'timber.config.mjs',\n  '.env',\n  '.env.local',\n  '.env.production',\n  '.env.production.local',\n  '.env.development',\n  '.env.development.local',\n];\n\n/** Lockfile names, searched upward from the root (monorepo workspaces). */\nconst LOCKFILE_NAMES = [\n  'pnpm-lock.yaml',\n  'package-lock.json',\n  'yarn.lock',\n  'bun.lock',\n  'bun.lockb',\n];\n\nexport interface GraphCacheFile {\n  version: number;\n  fingerprint: string;\n  /** The Vite config file the cached crawl booted with. */\n  configFile: string;\n  /**\n   * The resolved pageExtensions from the timber config at crawl time.\n   * Stored so the vite-free hit path can reproduce the same scan\n   * extension set (custom extensions like 'foo' must be admitted on\n   * both the write and the hit path, or the fingerprint disagrees\n   * with what was cached).\n   */\n  pageExtensions?: string[];\n  /**\n   * Files the fingerprint tracks BEYOND the disk scan, discovered at\n   * crawl time: Vite's `configFileDependencies` (a config helper\n   * imported from outside the app root can reshape the whole app) and\n   * every file the report itself classifies (the graph can reach files\n   * the scan skips — `app/.well-known/page.tsx`, a route under a\n   * directory named `dist`). The hit path re-stats exactly this list,\n   * so an edit to any of them misses the cache.\n   */\n  trackedExtras: string[];\n  report: CrawlReport;\n}\n\n/**\n * Follow a tsconfig/jsconfig `extends` chain, returning every file on\n * it (the start file included). A base config outside the app —\n * `\"extends\": \"../tsconfig.base.json\"` with a `paths` mapping — can\n * reshape Vite's resolution without touching anything else the\n * fingerprint tracks. Parsing is a targeted regex, not JSONC: tsconfig\n * allows comments, and all we need is the `extends` value. Package\n * specifiers resolve through Node resolution (an approximation of\n * TypeScript's — the `.json` append covers the common shapes): a\n * WORKSPACE package like `@repo/tsconfig/base.json` is a link, so its\n * edits change neither the lockfile nor any scanned file and must be\n * fingerprinted directly; registry packages resolve too, harmlessly.\n * Cycles and unresolvable targets just end the walk (bounded at 16).\n */\n/**\n * Strip JSONC comments so a commented-out `\"extends\"` line cannot\n * shadow the real one. String-aware: comment markers inside string\n * literals (a path containing `//`) survive.\n */\nexport function stripJsonComments(raw: string): string {\n  let out = '';\n  let inString = false;\n  for (let i = 0; i < raw.length; i++) {\n    const ch = raw[i];\n    if (inString) {\n      out += ch;\n      if (ch === '\\\\') {\n        out += raw[i + 1] ?? '';\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n    } else if (ch === '\"') {\n      inString = true;\n      out += ch;\n    } else if (ch === '/' && raw[i + 1] === '/') {\n      while (i < raw.length && raw[i] !== '\\n') i++;\n      out += '\\n';\n    } else if (ch === '/' && raw[i + 1] === '*') {\n      i += 2;\n      while (i < raw.length && !(raw[i] === '*' && raw[i + 1] === '/')) i++;\n      i++;\n    } else {\n      out += ch;\n    }\n  }\n  return out;\n}\n\nasync function collectTsconfigChain(startFile: string): Promise<string[]> {\n  const chain: string[] = [];\n  const queue = [startFile];\n  const seen = new Set(queue);\n  while (queue.length > 0 && chain.length < 16) {\n    const current = queue.shift()!;\n    let raw: string;\n    try {\n      raw = stripJsonComments(await readFile(current, 'utf8'));\n    } catch {\n      continue;\n    }\n    chain.push(current);\n    const match = raw.match(/\"extends\"\\s*:\\s*(\"([^\"]+)\"|\\[([^\\]]*)\\])/);\n    if (!match) continue;\n    const targets = match[2]\n      ? [match[2]]\n      : (match[3]?.match(/\"([^\"]+)\"/g) ?? []).map((t) => t.slice(1, -1));\n    for (const target of targets) {\n      let next: string | null = null;\n      if (isAbsolute(target)) {\n        // An absolute extends target names the base directly — joining\n        // it under the current config's directory would fabricate a\n        // path that does not exist and drop the real base.\n        next = target;\n        if (!/\\.json$/.test(next)) next += '.json';\n      } else if (target.startsWith('.')) {\n        next = join(dirname(current), target);\n        if (!/\\.json$/.test(next)) next += '.json';\n      } else {\n        const req = createRequire(current);\n        for (const candidate of [target, `${target}.json`, `${target}/tsconfig.json`]) {\n          try {\n            next = req.resolve(candidate);\n            break;\n          } catch {\n            // try the next shape\n          }\n        }\n      }\n      if (next && !seen.has(next)) {\n        seen.add(next);\n        queue.push(next);\n      }\n    }\n  }\n  return chain;\n}\n\n/** Nearest lockfile at or above `root`, or null. */\nasync function findLockfile(root: string): Promise<string | null> {\n  let dir = root;\n  for (;;) {\n    for (const name of LOCKFILE_NAMES) {\n      const candidate = join(dir, name);\n      try {\n        await stat(candidate);\n        return candidate;\n      } catch {\n        // keep looking\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/** `path\\0mtime\\0size` entries for a file list; absent files contribute nothing. */\nexport async function fingerprintEntriesForFiles(files: Iterable<string>): Promise<string[]> {\n  const entries: string[] = [];\n  for (const file of new Set(files)) {\n    try {\n      const stats = await stat(file);\n      entries.push(`${file}\\0${stats.mtimeMs}\\0${stats.size}`);\n    } catch {\n      // Absent files simply contribute nothing; when one appears\n      // later, its entry appears and the fingerprint changes.\n    }\n  }\n  return entries;\n}\n\n/**\n * Entries for the scan-derived base set: project source files, the\n * config, root manifests, and the nearest lockfile. Scan failures are\n * folded into the entry list rather than thrown: an unreadable\n * directory changes the answer's completeness, so it must change the\n * key too.\n */\nexport async function collectBaseFingerprintEntries(\n  root: string,\n  configFile: string,\n  pageExtensions?: readonly string[]\n): Promise<string[]> {\n  const extensions = buildSourceExtensions(pageExtensions);\n  const sourceFiles: string[] = [];\n  const failures: string[] = [];\n  await scanProjectSourceFiles(\n    root,\n    sourceFiles,\n    (failure) => failures.push(`${failure.dir}:${failure.message}`),\n    0,\n    extensions\n  );\n  const tracked = [...sourceFiles, configFile, ...ROOT_MANIFEST_FILES.map((f) => join(root, f))];\n  // Manifest/.env files beside the CONFIG too, when it lives outside\n  // the app root — `loadEnv(mode, process.cwd())` in a monorepo config\n  // reads the .env next to the config, not the one under root.\n  const configDir = dirname(configFile);\n  if (configDir !== root) {\n    tracked.push(...ROOT_MANIFEST_FILES.map((f) => join(configDir, f)));\n  }\n  // ts/jsconfig extends chains: a base config outside the app can carry\n  // the `paths` mappings resolution depends on.\n  for (const name of ['tsconfig.json', 'jsconfig.json']) {\n    tracked.push(...(await collectTsconfigChain(join(root, name))));\n    if (configDir !== root) tracked.push(...(await collectTsconfigChain(join(configDir, name))));\n  }\n  const lockfile = await findLockfile(root);\n  if (lockfile) tracked.push(lockfile);\n  return [...failures, ...(await fingerprintEntriesForFiles(tracked))];\n}\n\n/** Hash an entry list order-independently. */\nexport function hashFingerprintEntries(entries: string[]): string {\n  const unique = [...new Set(entries)].sort();\n  return createHash('sha256').update(unique.join('\\n')).digest('hex');\n}\n\n/**\n * Fingerprint the project state `timber graph`'s answers depend on:\n * the scan-derived base set plus `extraFiles` (the cache's\n * trackedExtras on the hit path; config dependencies + report files on\n * the write path).\n */\nexport async function computeProjectFingerprint(\n  root: string,\n  configFile: string,\n  extraFiles: readonly string[] = [],\n  pageExtensions?: readonly string[]\n): Promise<string> {\n  const entries = await collectBaseFingerprintEntries(root, configFile, pageExtensions);\n  entries.push(...(await fingerprintEntriesForFiles(extraFiles)));\n  return hashFingerprintEntries(entries);\n}\n\n/** Read the cache file; anything unreadable or version-mismatched is a miss. */\nexport async function readGraphCache(root: string): Promise<GraphCacheFile | null> {\n  try {\n    const raw = await readFile(join(root, CACHE_RELATIVE_PATH), 'utf8');\n    const parsed = JSON.parse(raw) as Partial<GraphCacheFile>;\n    if (\n      parsed.version !== GRAPH_CACHE_VERSION ||\n      typeof parsed.fingerprint !== 'string' ||\n      typeof parsed.configFile !== 'string' ||\n      !Array.isArray(parsed.trackedExtras) ||\n      typeof parsed.report !== 'object' ||\n      parsed.report === null\n    ) {\n      return null;\n    }\n    return parsed as GraphCacheFile;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Write the cache atomically (temp file + rename) so a concurrent\n * reader — parallel agent invocations are the expected workload —\n * never sees a torn JSON file.\n */\nexport async function writeGraphCache(root: string, cache: GraphCacheFile): Promise<void> {\n  const target = join(root, CACHE_RELATIVE_PATH);\n  await mkdir(dirname(target), { recursive: true });\n  await writeFileAtomic(target, JSON.stringify(cache));\n}\n"],"mappings":";;;;;;;;;;AAkCA,IAAa,oBAAoB,KAAK,WAAW,KAAK;;AA8DtD,SAAgB,WAAW,KAAsB;CAC/C,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,OAAO;EAEd,OAAQ,MAAgC,SAAS;CACnD;AACF;;;;;;AAOA,SAAS,iBAAiB,KAAmB;CAC3C,IAAI;CACJ,IAAI;EACF,UAAU,YAAY,GAAG;CAC3B,QAAQ;EACN;CACF;CACA,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,CAAC,MAAM,SAAS,OAAO,GAAG;EAC9B,MAAM,WAAW,KAAK,KAAK,KAAK;EAChC,IAAI;GACF,MAAM,SAAS,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;GAIxD,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,WAAW,OAAO,GAAG,GAC1D,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;EAEpC,QAAQ,CAER;CACF;AACF;;;;;;;;;;;;;AAcA,SAAgB,qBACd,YACA,MACA,QAaM;CACN,IAAI,CAAC,YAAY;CAEjB,MAAM,MAAM,KAAK,MAAM,iBAAiB;CACxC,IAAI,aAA4B;CAEhC,WAAW,GAAG,mBAAmB;EAC/B,MAAM,UAAU,WAAW,QAAQ;EAEnC,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU;EACrD,MAAM,UAAU,OAAO,QAAQ,QAAQ,QAAQ,WAAW,OAAO,OAAO,MAAM,KAAA;EAC9E,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,WAAW,OAAO,OAAO,KAAK,KAAA;EAC3E,MAAM,SAAoB;GACxB,MAAM,QAAQ;GACd,KAAK,QAAQ;GACb,MAAM,QAAQ;GAGd,UAAU,sBAAsB,SAAY,UAAU;GACtD,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,OAAO,OAAO,KAAA;GAC1D,SAAS,QAAQ,QAAQ,SAAS;GAClC,SAAS,QAAQ,QAAQ,SAAS;GAClC,SACE,QAAQ,cAAc,QAAQ,QAAQ,SAAS,cAAc,SAAS,QAAQ,KAAA;GAChF,aAAa,QAAQ,YAAY,SAAS;GAC1C,gBAAgB,QAAQ;GACxB,YAAY,OAAO,QAAQ,eAAe,WAAW,OAAO,aAAa,KAAA;EAC3E;EAOA,aAAa,KAAK,KAAK,GAAG,OAAO,IAAI,GAAG,OAAO,KAAK,GAAG,WAAW,EAAE,MAAM;EAC1E,IAAI;GACF,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;GAClC,cAAc,YAAY,KAAK,UAAU,MAAM,CAAC;GAChD,iBAAiB,GAAG;EACtB,QAAQ,CAER;CACF,CAAC;CAED,WAAW,GAAG,eAAe;EAC3B,IAAI,CAAC,YAAY;EACjB,IAAI;GAGF,OAAO,YAAY,EAAE,OAAO,KAAK,CAAC;EACpC,QAAQ,CAER;CACF,CAAC;AACH;;AC/KA,IAAM,sBAAsB,KAAK,WAAW,kBAAkB;;;;;;;;;;;;AAa9D,IAAM,sBAAsB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,IAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;;;;;AA+CA,SAAgB,kBAAkB,KAAqB;CACrD,IAAI,MAAM;CACV,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;EACnC,MAAM,KAAK,IAAI;EACf,IAAI,UAAU;GACZ,OAAO;GACP,IAAI,OAAO,MAAM;IACf,OAAO,IAAI,IAAI,MAAM;IACrB;GACF,OAAO,IAAI,OAAO,MAChB,WAAW;EAEf,OAAO,IAAI,OAAO,MAAK;GACrB,WAAW;GACX,OAAO;EACT,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,KAAK;GAC3C,OAAO,IAAI,IAAI,UAAU,IAAI,OAAO,MAAM;GAC1C,OAAO;EACT,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,KAAK;GAC3C,KAAK;GACL,OAAO,IAAI,IAAI,UAAU,EAAE,IAAI,OAAO,OAAO,IAAI,IAAI,OAAO,MAAM;GAClE;EACF,OACE,OAAO;CAEX;CACA,OAAO;AACT;AAEA,eAAe,qBAAqB,WAAsC;CACxE,MAAM,QAAkB,CAAC;CACzB,MAAM,QAAQ,CAAC,SAAS;CACxB,MAAM,OAAO,IAAI,IAAI,KAAK;CAC1B,OAAO,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI;EAC5C,MAAM,UAAU,MAAM,MAAM;EAC5B,IAAI;EACJ,IAAI;GACF,MAAM,kBAAkB,MAAM,SAAS,SAAS,MAAM,CAAC;EACzD,QAAQ;GACN;EACF;EACA,MAAM,KAAK,OAAO;EAClB,MAAM,QAAQ,IAAI,MAAM,0CAA0C;EAClE,IAAI,CAAC,OAAO;EACZ,MAAM,UAAU,MAAM,KAClB,CAAC,MAAM,EAAE,KACR,MAAM,EAAE,EAAE,MAAM,YAAY,KAAK,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;EACnE,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,OAAsB;GAC1B,IAAI,WAAW,MAAM,GAAG;IAItB,OAAO;IACP,IAAI,CAAC,UAAU,KAAK,IAAI,GAAG,QAAQ;GACrC,OAAO,IAAI,OAAO,WAAW,GAAG,GAAG;IACjC,OAAO,KAAK,QAAQ,OAAO,GAAG,MAAM;IACpC,IAAI,CAAC,UAAU,KAAK,IAAI,GAAG,QAAQ;GACrC,OAAO;IACL,MAAM,MAAM,cAAc,OAAO;IACjC,KAAK,MAAM,aAAa;KAAC;KAAQ,GAAG,OAAO;KAAQ,GAAG,OAAO;IAAe,GAC1E,IAAI;KACF,OAAO,IAAI,QAAQ,SAAS;KAC5B;IACF,QAAQ,CAER;GAEJ;GACA,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,GAAG;IAC3B,KAAK,IAAI,IAAI;IACb,MAAM,KAAK,IAAI;GACjB;EACF;CACF;CACA,OAAO;AACT;;AAGA,eAAe,aAAa,MAAsC;CAChE,IAAI,MAAM;CACV,SAAS;EACP,KAAK,MAAM,QAAQ,gBAAgB;GACjC,MAAM,YAAY,KAAK,KAAK,IAAI;GAChC,IAAI;IACF,MAAM,KAAK,SAAS;IACpB,OAAO;GACT,QAAQ,CAER;EACF;EACA,MAAM,SAAS,QAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;;AAGA,eAAsB,2BAA2B,OAA4C;CAC3F,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,GAC9B,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,QAAQ,KAAK,GAAG,KAAK,IAAI,MAAM,QAAQ,IAAI,MAAM,MAAM;CACzD,QAAQ,CAGR;CAEF,OAAO;AACT;;;;;;;;AASA,eAAsB,8BACpB,MACA,YACA,gBACmB;CACnB,MAAM,aAAa,sBAAsB,cAAc;CACvD,MAAM,cAAwB,CAAC;CAC/B,MAAM,WAAqB,CAAC;CAC5B,MAAM,uBACJ,MACA,cACC,YAAY,SAAS,KAAK,GAAG,QAAQ,IAAI,GAAG,QAAQ,SAAS,GAC9D,GACA,UACF;CACA,MAAM,UAAU;EAAC,GAAG;EAAa;EAAY,GAAG,oBAAoB,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC;CAAC;CAI7F,MAAM,YAAY,QAAQ,UAAU;CACpC,IAAI,cAAc,MAChB,QAAQ,KAAK,GAAG,oBAAoB,KAAK,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC;CAIpE,KAAK,MAAM,QAAQ,CAAC,iBAAiB,eAAe,GAAG;EACrD,QAAQ,KAAK,GAAI,MAAM,qBAAqB,KAAK,MAAM,IAAI,CAAC,CAAE;EAC9D,IAAI,cAAc,MAAM,QAAQ,KAAK,GAAI,MAAM,qBAAqB,KAAK,WAAW,IAAI,CAAC,CAAE;CAC7F;CACA,MAAM,WAAW,MAAM,aAAa,IAAI;CACxC,IAAI,UAAU,QAAQ,KAAK,QAAQ;CACnC,OAAO,CAAC,GAAG,UAAU,GAAI,MAAM,2BAA2B,OAAO,CAAE;AACrE;;AAGA,SAAgB,uBAAuB,SAA2B;CAChE,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK;CAC1C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;AACpE;;;;;;;AAQA,eAAsB,0BACpB,MACA,YACA,aAAgC,CAAC,GACjC,gBACiB;CACjB,MAAM,UAAU,MAAM,8BAA8B,MAAM,YAAY,cAAc;CACpF,QAAQ,KAAK,GAAI,MAAM,2BAA2B,UAAU,CAAE;CAC9D,OAAO,uBAAuB,OAAO;AACvC;;AAGA,eAAsB,eAAe,MAA8C;CACjF,IAAI;EACF,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,mBAAmB,GAAG,MAAM;EAClE,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IACE,OAAO,YAAA,KACP,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,eAAe,YAC7B,CAAC,MAAM,QAAQ,OAAO,aAAa,KACnC,OAAO,OAAO,WAAW,YACzB,OAAO,WAAW,MAElB,OAAO;EAET,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,eAAsB,gBAAgB,MAAc,OAAsC;CACxF,MAAM,SAAS,KAAK,MAAM,mBAAmB;CAC7C,MAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChD,MAAM,gBAAgB,QAAQ,KAAK,UAAU,KAAK,CAAC;AACrD"}

package/dist/_chunks/href-validation-BIrxavIy.js

@@ -0,0 +1,213 @@
+//#region src/shared/slot-params.ts
+/**
+* The params a slot sees: the main route's as a base, the slot's own on top.
+*
+* Params from segments *above* the slot are not re-derived by the slot's own
+* chain, so they have to come from the main route; params the slot does
+* re-derive may have a different type than the main route gave them, so the
+* slot's win.
+*
+* Null-prototype, like every other param record the framework hands out
+* (`coerceSegmentParams` installs one unconditionally). A spread literal would
+* inherit `Object.prototype`, so a lookup for a param the route does not
+* define would resolve to an inherited member — `params.constructor` returning
+* a function instead of `undefined` — in the one param record that was built
+* by merging. See design/13-security.md #36c.
+*/
+function mergeSlotParams(mainParams, slotParams) {
+	return Object.assign(Object.create(null), mainParams, slotParams);
+}
+/**
+* Resolve the params for a segment path against a published slot map.
+*
+* Returns the merge when `segmentPath` names a slot that published params,
+* and the main route's record otherwise — an ordinary (non-slot) segment
+* path, an unknown path, or a request with no slots at all. Mirrors the
+* server's `getSegmentParams(segmentPath)` branch exactly.
+*
+* `Object.hasOwn` rather than `in` or a truthiness test: the map arrives from
+* JSON, so a segment path of `constructor` or `toString` would otherwise
+* resolve to an inherited member of `Object.prototype`.
+*/
+function resolveSegmentParams(mainParams, slotParams, segmentPath) {
+	if (!segmentPath || !slotParams || !Object.hasOwn(slotParams, segmentPath)) return mainParams;
+	return cachedMerge(mainParams, slotParams, segmentPath);
+}
+/**
+* The merged record for one (main record, slot map, path) triple, reused until
+* one of the three changes.
+*
+* `useSegmentParams(slotPath)` calls this on every render. Returning a fresh
+* object each time makes the hook's result change by reference on renders where
+* nothing navigated, so a component using it as a `useEffect` dependency
+* re-runs the effect — and re-renders in a loop if that effect sets state —
+* while memoized children below it lose their memoization.
+*
+* Keyed on the *identities* of the two records, not their contents: both are
+* replaced rather than mutated on every navigation (`ParamsProvider`'s memoized
+* value and the server's per-request store), so identity is the correct
+* equality here and a deep comparison would be slower and no more accurate.
+*
+* A `WeakMap` chain rather than a `Map`, so a superseded navigation's records
+* and their merges become collectable as soon as nothing else holds them.
+*/
+var mergeCache = /* @__PURE__ */ new WeakMap();
+function cachedMerge(mainParams, slotParams, segmentPath) {
+	let bySlotMap = mergeCache.get(mainParams);
+	if (!bySlotMap) {
+		bySlotMap = /* @__PURE__ */ new WeakMap();
+		mergeCache.set(mainParams, bySlotMap);
+	}
+	let byPath = bySlotMap.get(slotParams);
+	if (!byPath) {
+		byPath = /* @__PURE__ */ new Map();
+		bySlotMap.set(slotParams, byPath);
+	}
+	const cached = byPath.get(segmentPath);
+	if (cached) return cached;
+	const merged = mergeSlotParams(mainParams, slotParams[segmentPath]);
+	byPath.set(segmentPath, merged);
+	return merged;
+}
+//#endregion
+//#region src/shared/merge-search-params.ts
+/**
+* Shared utility for merging preserved search params into a target URL.
+*
+* Used by both <Link> (client) and redirect() (server). Extracted to a shared
+* module to avoid importing client code ('use client') from server modules.
+*/
+/**
+* Merge preserved search params from the current URL into a target href.
+*
+* When `preserve` is `true`, all current search params are merged.
+* When `preserve` is a `string[]`, only the named params are merged.
+*
+* The target href's own search params take precedence — preserved params
+* are only added if the target doesn't already define them.
+*
+* @param targetHref - The resolved target href (may already contain query string)
+* @param currentSearch - The current URL's search string (e.g. "?private=access&page=2")
+* @param preserve - `true` to preserve all, or `string[]` to preserve specific params
+* @returns The target href with preserved search params merged in
+*/
+function mergePreservedSearchParams(targetHref, currentSearch, preserve) {
+	const currentParams = new URLSearchParams(currentSearch);
+	if (currentParams.size === 0) return targetHref;
+	const hashIdx = targetHref.indexOf("#");
+	const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;
+	const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : "";
+	const qIdx = hrefWithoutHash.indexOf("?");
+	const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;
+	const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : "");
+	const merged = new URLSearchParams(targetParams);
+	for (const [key, value] of currentParams) if (!targetParams.has(key)) {
+		if (preserve === true || preserve.includes(key)) merged.append(key, value);
+	}
+	const qs = merged.toString();
+	return (qs ? `${targetPath}?${qs}` : targetPath) + hash;
+}
+//#endregion
+//#region src/shared/href-validation.ts
+/**
+* Shared href/URL validation for all navigation sinks.
+*
+* Used by <Link>, useRouter().push/replace, and redirectExternal().
+* Single source of truth for dangerous-scheme detection — prevents
+* control-character smuggling that bypasses naive regex checks.
+*
+* See design/13-security.md §"Link scheme injection" (test #9)
+* and design/07-routing.md §"<Link> Scheme Validation".
+*/
+/**
+* All C0 control characters (U+0000–U+001F) that browsers strip during
+* URL preprocessing. Browsers and `new URL()` strip the full C0 range,
+* not just tab/LF/CR — so we must match that behavior to prevent
+* bypass vectors like `\x00javascript:alert(1)`.
+*/
+var CONTROL_CHARS_RE = /[\x00-\x1f]/g;
+var DANGEROUS_SCHEMES = /* @__PURE__ */ new Set([
+	"javascript:",
+	"data:",
+	"vbscript:"
+]);
+/**
+* Strip C0 control chars and leading whitespace, then extract the scheme.
+* Returns the lowercase scheme (e.g. "javascript:") or null if no scheme.
+*/
+function extractScheme(href) {
+	const cleaned = href.replace(CONTROL_CHARS_RE, "").trimStart();
+	const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);
+	return match ? match[1].toLowerCase() : null;
+}
+/**
+* Validate an href for navigation sinks (<Link>, useRouter, etc.).
+*
+* Rejects dangerous schemes (javascript:, data:, vbscript:) even when
+* control characters are embedded to bypass naive regex checks.
+* Also rejects protocol-relative URLs (//evil.com).
+*
+* Throws on rejection. Safe hrefs pass through silently.
+*/
+function validateNavigationHref(href) {
+	if (href.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/").startsWith("//")) throw new Error(`Navigation received a protocol-relative or backslash-prefixed URL: "${href}". Use an absolute URL with an explicit scheme or a relative path.`);
+	const scheme = extractScheme(href);
+	if (scheme && DANGEROUS_SCHEMES.has(scheme)) throw new Error(`Navigation received a dangerous href: "${href}". javascript:, data:, and vbscript: URLs are not allowed.`);
+}
+/**
+* Check if an href is internal (same-origin navigation) or external.
+*
+* Strips control characters before checking so that "java\tscript:" is
+* correctly identified as having a scheme (and thus not internal).
+*/
+function isInternalHref(href) {
+	const cleaned = href.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
+	if (cleaned.startsWith("//")) return false;
+	if (cleaned.startsWith("/") || cleaned.startsWith("#") || cleaned.startsWith("?")) return true;
+	if (extractScheme(href)) return false;
+	return true;
+}
+/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */
+var ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
+/**
+* Assert that a redirect target is a relative path — rejects absolute and
+* protocol-relative URLs. Used by both the server `redirect()` primitive and
+* the client next/navigation shim so they enforce identical semantics.
+*
+* Normalizes for validation only: strips C0 controls, trims, then replaces
+* backslashes with forward slashes. Browsers normalize \ → / during URL
+* resolution, so "/\evil.com" becomes "//evil.com" (protocol-relative open
+* redirect). See design/13-security.md tests #8, #8a–#8c.
+*/
+function assertRelativeRedirectPath(path) {
+	const cleaned = path.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
+	if (ABSOLUTE_URL_RE.test(cleaned)) throw new Error(`redirect() only accepts relative URLs. Got absolute URL: "${path}". Use redirectExternal(url, allowList) for external redirects.`);
+	if (/[\x00-\x1f]/.test(path)) throw new Error("redirect() received a path containing control characters (U+0000–U+001F). Sanitize user input before passing it to redirect().");
+}
+var SAFE_REDIRECT_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+/**
+* Validate and canonicalize an external redirect URL.
+*
+* Requires http: or https: scheme and checks origin against an allow-list.
+* Returns the parsed canonical URL string (from URL.href) to prevent
+* raw user input from reaching the Location header.
+*
+* @throws On invalid URL, dangerous scheme, or origin not in allow-list.
+*/
+function validateExternalRedirectUrl(url, allowList) {
+	const cleaned = url.replace(CONTROL_CHARS_RE, "").trimStart();
+	if (cleaned.startsWith("//")) throw new Error(`redirectExternal() received a protocol-relative URL: "${url}". Use an absolute URL with http: or https: scheme.`);
+	let parsed;
+	try {
+		parsed = new URL(cleaned);
+	} catch {
+		throw new Error(`redirectExternal() received an invalid URL: "${url}"`);
+	}
+	if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) throw new Error(`redirectExternal() received a non-http(s) URL: "${url}". Only http: and https: schemes are allowed for external redirects.`);
+	if (!allowList.includes(parsed.origin)) throw new Error(`redirectExternal() target "${parsed.origin}" is not in the allow-list. Allowed: [${allowList.join(", ")}]`);
+	return parsed.href;
+}
+//#endregion
+export { mergePreservedSearchParams as a, validateNavigationHref as i, isInternalHref as n, resolveSegmentParams as o, validateExternalRedirectUrl as r, assertRelativeRedirectPath as t };
+
+//# sourceMappingURL=href-validation-BIrxavIy.js.map

package/dist/_chunks/href-validation-BIrxavIy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"href-validation-BIrxavIy.js","names":[],"sources":["../../src/shared/slot-params.ts","../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Per-slot segment params — the one definition both halves of the API read.\n *\n * A parallel slot matches the URL through its *own* sub-tree, so it can derive\n * a param the main route never had, or derive the same name with a different\n * type (`[...year]` → `string[]` where the main route's `[year]` gave\n * `string`). The server answers `getSegmentParams(slotPath)` from a per-slot\n * map; the client answers `useSegmentParams(slotPath)` from the same map,\n * published on the RSC payload (TIM-1285).\n *\n * The merge lives here rather than in either half because the two must agree\n * about what \"the slot's params\" are — a divergence is invisible until\n * somebody reads a param of the wrong type, which is exactly the class of bug\n * this module closes.\n *\n * Isomorphic: no server or client imports.\n *\n * See design/41-global-params.md §\"Params in a parallel slot\".\n */\n\nimport type { CoercedParams } from './param-value.ts';\n\n/** Slot tree path → that slot's own coerced params. */\nexport type SlotParamsRecord = Record<string, CoercedParams>;\n\n/**\n * The params a slot sees: the main route's as a base, the slot's own on top.\n *\n * Params from segments *above* the slot are not re-derived by the slot's own\n * chain, so they have to come from the main route; params the slot does\n * re-derive may have a different type than the main route gave them, so the\n * slot's win.\n *\n * Null-prototype, like every other param record the framework hands out\n * (`coerceSegmentParams` installs one unconditionally). A spread literal would\n * inherit `Object.prototype`, so a lookup for a param the route does not\n * define would resolve to an inherited member — `params.constructor` returning\n * a function instead of `undefined` — in the one param record that was built\n * by merging. See design/13-security.md #36c.\n */\nexport function mergeSlotParams(\n  mainParams: CoercedParams,\n  slotParams: CoercedParams\n): CoercedParams {\n  return Object.assign(Object.create(null), mainParams, slotParams);\n}\n\n/**\n * Resolve the params for a segment path against a published slot map.\n *\n * Returns the merge when `segmentPath` names a slot that published params,\n * and the main route's record otherwise — an ordinary (non-slot) segment\n * path, an unknown path, or a request with no slots at all. Mirrors the\n * server's `getSegmentParams(segmentPath)` branch exactly.\n *\n * `Object.hasOwn` rather than `in` or a truthiness test: the map arrives from\n * JSON, so a segment path of `constructor` or `toString` would otherwise\n * resolve to an inherited member of `Object.prototype`.\n */\nexport function resolveSegmentParams(\n  mainParams: CoercedParams,\n  slotParams: SlotParamsRecord | null | undefined,\n  segmentPath: string | undefined\n): CoercedParams {\n  if (!segmentPath || !slotParams || !Object.hasOwn(slotParams, segmentPath)) return mainParams;\n  return cachedMerge(mainParams, slotParams, segmentPath);\n}\n\n/**\n * The merged record for one (main record, slot map, path) triple, reused until\n * one of the three changes.\n *\n * `useSegmentParams(slotPath)` calls this on every render. Returning a fresh\n * object each time makes the hook's result change by reference on renders where\n * nothing navigated, so a component using it as a `useEffect` dependency\n * re-runs the effect — and re-renders in a loop if that effect sets state —\n * while memoized children below it lose their memoization.\n *\n * Keyed on the *identities* of the two records, not their contents: both are\n * replaced rather than mutated on every navigation (`ParamsProvider`'s memoized\n * value and the server's per-request store), so identity is the correct\n * equality here and a deep comparison would be slower and no more accurate.\n *\n * A `WeakMap` chain rather than a `Map`, so a superseded navigation's records\n * and their merges become collectable as soon as nothing else holds them.\n */\nconst mergeCache = new WeakMap<object, WeakMap<object, Map<string, CoercedParams>>>();\n\nfunction cachedMerge(\n  mainParams: CoercedParams,\n  slotParams: SlotParamsRecord,\n  segmentPath: string\n): CoercedParams {\n  let bySlotMap = mergeCache.get(mainParams);\n  if (!bySlotMap) {\n    bySlotMap = new WeakMap();\n    mergeCache.set(mainParams, bySlotMap);\n  }\n  let byPath = bySlotMap.get(slotParams);\n  if (!byPath) {\n    byPath = new Map();\n    bySlotMap.set(slotParams, byPath);\n  }\n  const cached = byPath.get(segmentPath);\n  if (cached) return cached;\n  const merged = mergeSlotParams(mainParams, slotParams[segmentPath]);\n  byPath.set(segmentPath, merged);\n  return merged;\n}\n","/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\n/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */\nconst ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\\d+\\-.]*:|\\/\\/)/;\n\n/**\n * Assert that a redirect target is a relative path — rejects absolute and\n * protocol-relative URLs. Used by both the server `redirect()` primitive and\n * the client next/navigation shim so they enforce identical semantics.\n *\n * Normalizes for validation only: strips C0 controls, trims, then replaces\n * backslashes with forward slashes. Browsers normalize \\ → / during URL\n * resolution, so \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open\n * redirect). See design/13-security.md tests #8, #8a–#8c.\n */\nexport function assertRelativeRedirectPath(path: string): void {\n  const cleaned = path.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (ABSOLUTE_URL_RE.test(cleaned)) {\n    throw new Error(\n      `redirect() only accepts relative URLs. Got absolute URL: \"${path}\". ` +\n        'Use redirectExternal(url, allowList) for external redirects.'\n    );\n  }\n\n  // eslint-disable-next-line no-control-regex -- intentional: must match C0 controls\n  if (/[\\x00-\\x1f]/.test(path)) {\n    throw new Error(\n      `redirect() received a path containing control characters (U+0000–U+001F). ` +\n        'Sanitize user input before passing it to redirect().'\n    );\n  }\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwCA,SAAgB,gBACd,YACA,YACe;CACf,OAAO,OAAO,OAAO,OAAO,OAAO,IAAI,GAAG,YAAY,UAAU;AAClE;;;;;;;;;;;;;AAcA,SAAgB,qBACd,YACA,YACA,aACe;CACf,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,OAAO,YAAY,WAAW,GAAG,OAAO;CACnF,OAAO,YAAY,YAAY,YAAY,WAAW;AACxD;;;;;;;;;;;;;;;;;;;AAoBA,IAAM,6BAAa,IAAI,QAA6D;AAEpF,SAAS,YACP,YACA,YACA,aACe;CACf,IAAI,YAAY,WAAW,IAAI,UAAU;CACzC,IAAI,CAAC,WAAW;EACd,4BAAY,IAAI,QAAQ;EACxB,WAAW,IAAI,YAAY,SAAS;CACtC;CACA,IAAI,SAAS,UAAU,IAAI,UAAU;CACrC,IAAI,CAAC,QAAQ;EACX,yBAAS,IAAI,IAAI;EACjB,UAAU,IAAI,YAAY,MAAM;CAClC;CACA,MAAM,SAAS,OAAO,IAAI,WAAW;CACrC,IAAI,QAAQ,OAAO;CACnB,MAAM,SAAS,gBAAgB,YAAY,WAAW,YAAY;CAClE,OAAO,IAAI,aAAa,MAAM;CAC9B,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;ACvFA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG,GACnB;MAAA,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oCAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAG5E,CAAA,CAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,2BAA2B,MAAoB;CAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,MAAM,GAAG;CAEnF,IAAI,gBAAgB,KAAK,OAAO,GAC9B,MAAM,IAAI,MACR,6DAA6D,KAAK,gEAEpE;CAIF,IAAI,cAAc,KAAK,IAAI,GACzB,MAAM,IAAI,MACR,gIAEF;AAEJ;AAEA,IAAM,wCAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,CAAC,CAAC,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}