@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/dist/_chunks/error-boundary-DsNScGRM.js

@@ -0,0 +1,1024 @@
+import { n as isRscContentType, t as RSC_CONTENT_TYPE } from "./rsc-media-type-DDc7duTD.js";
+import { i as withBasePath, r as stripBasePath } from "./base-path-DaQrzbez.js";
+import { n as rscPayloadPath } from "./rsc-payload-path-dffcs4jp.js";
+import { a as randomRscCacheKey, n as RSC_KEY_PARAM, o as recordLookup, s as rscCacheKey } from "./rsc-cache-key-ClUiXQnK.js";
+import { t as StatusPageMarker } from "./status-page-marker-BRX9Ib-d.js";
+import { o as _setUnloading, p as unloading } from "./state-BhNGPsdi.js";
+import { i as getRouterOrNull, t as setHardNavigating } from "./navigation-root-BQfo1-kG.js";
+import { Component, createContext, createElement } from "react";
+//#region src/shared/payload-root.ts
+/**
+* What a reader gets when the value it was handed is not a payload root.
+*
+* In the browser this is unreachable for a real response: all four producers
+* of a route payload go through `withPublishedParams`, and a client talking to
+* a different build is answered with 204 at Stage 1c
+* (`server/pipeline-phases.ts`) before any payload exists. It is what a page
+* with no payload at all publishes — a document hydrated without an inlined
+* payload, or a prefetch entry that carries no params.
+*/
+var NO_PUBLISHED_PARAMS = {
+	params: {},
+	slotParams: null
+};
+/** True when `value` carries published params — a root, or a read of one. */
+function hasPublishedParams(value) {
+	return typeof value === "object" && value !== null && "params" in value && typeof value.params === "object" && value.params !== null;
+}
+/**
+* Read the params published beside a tree.
+*
+* Accepts a payload root *or* a `PublishedParams` already split off one, so
+* the client can pre-resolve on the navigation path and still hand the same
+* value to the same provider. Never throws.
+*/
+function readPublishedParams(source) {
+	if (!hasPublishedParams(source)) return NO_PUBLISHED_PARAMS;
+	return {
+		params: source.params,
+		slotParams: source.slotParams ?? null
+	};
+}
+/**
+* Read the renderable tree out of a payload root.
+*
+* Returns the value unchanged when it is not a root, so a malformed value
+* reaches React (and its error boundaries) rather than vanishing here.
+*/
+function readPayloadTree(root) {
+	if (typeof root === "object" && root !== null && "tree" in root && hasPublishedParams(root)) return root.tree;
+	return root;
+}
+/**
+* Split a decoded payload root into its tree and its params.
+*
+* Accepts a settled root or a thenable of one, and preserves which it was: a
+* settled root splits synchronously, so no code path gains a suspend point it
+* did not already have.
+*/
+function splitPayloadRoot(root) {
+	if (typeof root !== "object" || root === null || typeof root.then !== "function") return {
+		tree: readPayloadTree(root),
+		params: readPublishedParams(root)
+	};
+	const settled = root;
+	const tree = Promise.resolve(settled).then(readPayloadTree);
+	tree.catch(() => {});
+	return {
+		tree,
+		params: Promise.resolve(settled).then(readPublishedParams, () => NO_PUBLISHED_PARAMS)
+	};
+}
+//#endregion
+//#region src/client/rsc-fetch.ts
+/**
+* RSC Fetch — handles fetching and parsing RSC Flight payloads.
+*
+* Extracted from router.ts to keep both files under the 500-line limit.
+* This module handles:
+* - Cache-busting URL generation for RSC requests
+* - Building RSC request headers (Accept, X-Timber-State-Tree)
+* - Extracting metadata from RSC response headers
+* - Fetching and decoding RSC payloads
+*
+* See design/19-client-navigation.md §"RSC Payload Handling"
+*/
+/**
+* Append a `_rsc=<key>` query parameter to the URL (TIM-1268).
+*
+* The key is a deterministic hash of the RSC request headers, so identical
+* requests share a URL and the payload becomes cacheable. It also keeps the
+* document and the payload on different URLs, so a shared cache cannot
+* return HTML for an RSC request (or vice versa) even where `Vary` is
+* opt-in configuration rather than default behaviour — Cloudflare and
+* CloudFront both. See GHSA-wfc6-r584-vfw7, design/13-security.md.
+*
+* The origin recomputes this key from the received headers and refuses to
+* let a mismatched response be shared-cached, so a caller cannot claim
+* another client's key while sending its own headers.
+*
+* Falls back to a random value when no key can be derived — `crypto.subtle`
+* is absent in non-secure browsing contexts (plain `http://` on a LAN
+* address). Dropping the parameter instead would put the payload back on
+* the document URL, where a query-keyed cache that ignores `Vary` could
+* store a Flight response under `/about` and serve it to an HTML
+* navigation. The random parameter this feature replaced did separate those
+* representations, and the fallback must not be worse than what it
+* replaced. The origin cannot verify a random key, so it refuses to
+* share-cache the response — which is exactly the old behaviour, where a
+* unique URL was never a cache hit anyway.
+*
+* Strips any #fragment before appending — fragments are client-only and
+* fetch() discards them, so _rsc would land inside the hash and be lost.
+*/
+async function appendRscParam(url, headers) {
+	const hashIndex = url.indexOf("#");
+	const urlWithoutHash = hashIndex === -1 ? url : url.slice(0, hashIndex);
+	const key = await rscCacheKey(recordLookup(headers)) ?? randomRscCacheKey();
+	return `${urlWithoutHash}${urlWithoutHash.includes("?") ? "&" : "?"}${RSC_KEY_PARAM}=${key}`;
+}
+/**
+* The client's deployment ID, set at bootstrap from the runtime config.
+* Sent with every RSC/action request for version skew detection.
+* Null in dev mode. See TIM-446.
+*/
+var clientDeploymentId = null;
+/**
+* The deployment base path (Vite's resolved `base`), normalized.
+* Set at bootstrap from `virtual:timber-config`; `'/'` unless the app is
+* deployed under a sub-path. See design/11-platform.md, TIM-1261.
+*
+* **The base is applied in exactly one place: at fetch time**
+* (`toStaticRscUrl`). The static build writes the RSC manifest with
+* root-relative keys *and* root-relative URLs, so the generated site stays
+* relocatable and there is no second copy of the base to drift from this one.
+*/
+var basePath = "/";
+/**
+* When true, RSC fetches use _rsc/*.rsc file URLs instead of
+* the route URL with Accept headers. Static hosts ignore Accept
+* headers, so the client must fetch the pre-generated .rsc files
+* directly. Set at bootstrap from virtual:timber-config output mode.
+*/
+var staticMode = false;
+/**
+* RSC manifest mapping unhashed → content-hashed `.rsc` URLs. Populated from
+* `window.__TIMBER_RSC_MANIFEST__` (injected into HTML during static
+* generation). Shape shared with the static build that writes it — see
+* `shared/rsc-manifest.ts`. See TIM-1254.
+*/
+var rscManifest = null;
+function getRscManifest() {
+	if (rscManifest) return rscManifest;
+	if (typeof window !== "undefined" && window.__TIMBER_RSC_MANIFEST__) rscManifest = window.__TIMBER_RSC_MANIFEST__;
+	return rscManifest;
+}
+/**
+* Resolve a route URL to the `_rsc/*.rsc` file to fetch. The naming rule is
+* `shared/rsc-payload-path.ts`, shared with the build that writes the files.
+*
+* When an RSC manifest is available (hashed filenames from TIM-1254),
+* the manifest is consulted to resolve to the hashed path.
+*
+*   /           → /_rsc/index.rsc (or /_rsc/index-B7YxEKdN.rsc with manifest)
+*   /about      → /_rsc/about/index.rsc (or /_rsc/about/index-C8ZzFLfO.rsc)
+*   /blog/hello → /_rsc/blog/hello/index.rsc
+*
+* The manifest is written and read in route space (no base prefix), so the
+* base is applied here — once, on the way out. See client/base-path.ts.
+*/
+function toStaticRscUrl(url) {
+	const unhashed = toUnhashedRscUrl(url);
+	const hashedUrl = manifestLookup(unhashed);
+	return {
+		url: withBasePath(basePath, hashedUrl ?? unhashed),
+		hashed: hashedUrl !== null
+	};
+}
+/**
+* Compute the unhashed `_rsc/*.rsc` path for a route URL.
+*
+* Returns a **route-space** path: the deployment base is stripped from the
+* incoming URL and is NOT re-applied, because this value doubles as the RSC
+* manifest key, and the manifest is base-less. `toStaticRscUrl` applies the
+* base to whatever is actually fetched.
+*
+* @internal Exported for testing.
+*/
+function toUnhashedRscUrl(url) {
+	const hashIndex = url.indexOf("#");
+	const queryIndex = url.indexOf("?");
+	const hashEnd = hashIndex === -1 ? url.length : hashIndex;
+	const queryEnd = queryIndex === -1 ? url.length : queryIndex;
+	const end = Math.min(hashEnd, queryEnd);
+	let pathname = stripBasePath(basePath, url.slice(0, end));
+	if (pathname.length > 1 && pathname.endsWith("/")) pathname = pathname.slice(0, -1);
+	return rscPayloadPath(pathname);
+}
+/**
+* Look up a key in the RSC manifest, falling back to percent-decoded
+* lookup for encoded browser URLs. Returns the entry or null.
+*/
+function manifestEntry(key) {
+	const manifest = getRscManifest();
+	if (!manifest) return null;
+	if (manifest[key]) return manifest[key];
+	try {
+		const decoded = decodeURIComponent(key);
+		if (decoded !== key && manifest[decoded]) return manifest[decoded];
+	} catch {}
+	return null;
+}
+/**
+* Look up the hashed URL for an unhashed RSC path.
+*/
+function manifestLookup(key) {
+	return manifestEntry(key)?.url ?? null;
+}
+/** Header name used by the server to signal a version skew reload. */
+var RELOAD_HEADER = "X-Timber-Reload";
+/** Header name for the client's deployment ID. */
+var DEPLOYMENT_ID_HEADER = "X-Timber-Deployment-Id";
+/**
+* Check if a response signals a version skew reload.
+* Triggers a full page reload if the server indicates the client is stale.
+*/
+function checkReloadSignal(response) {
+	return response.headers.get(RELOAD_HEADER) === "1";
+}
+/**
+* Build the headers for an RSC payload request.
+*
+* **Every header added here is hashed into the payload URL** as the `_rsc`
+* cache key (see `rscCacheKey`), and URLs are logged by proxies, CDNs, and
+* origin access logs. So: no credentials, no session identifiers, no
+* user-supplied content. `fnv1aHash` is a cache-key hash, not a KDF — a
+* low-entropy secret would be recoverable from the URL by brute force.
+* Authentication already travels on cookies, which are not part of this
+* object and never enter the key.
+*/
+function buildRscHeaders(stateTree, currentUrl) {
+	const headers = { Accept: RSC_CONTENT_TYPE };
+	if (stateTree) headers["X-Timber-State-Tree"] = JSON.stringify(stateTree);
+	if (currentUrl) headers["X-Timber-URL"] = currentUrl;
+	if (clientDeploymentId) headers[DEPLOYMENT_ID_HEADER] = clientDeploymentId;
+	return headers;
+}
+/** Dev-only warning for malformed framework headers. Tree-shaken in production. */
+function warnMalformedHeader(headerName, raw) {
+	if (process.env.NODE_ENV !== "production") {
+		const preview = raw.length > 200 ? raw.slice(0, 200) + "…" : raw;
+		console.warn(`[timber] Malformed ${headerName} header \u2014 JSON.parse failed. This indicates a framework bug or header corruption. Raw (first 200 chars): ${preview}`);
+	}
+}
+/**
+* Extract segment metadata from the X-Timber-Segments response header.
+* Returns null if the header is missing or malformed.
+*
+* Format: JSON array of {path, isRequestDependent} objects describing the rendered
+* segment chain from root to leaf. Used to populate the client-side
+* segment cache for state tree diffing on subsequent navigations.
+*/
+function extractSegmentInfo(response) {
+	const header = response.headers.get("X-Timber-Segments");
+	if (!header) return null;
+	try {
+		return JSON.parse(header);
+	} catch {
+		warnMalformedHeader("X-Timber-Segments", header);
+		return null;
+	}
+}
+/**
+* Extract skipped segment paths from the X-Timber-Skipped-Segments header.
+* Returns null if the header is missing or malformed.
+*
+* When the server skips sync layouts the client already has cached,
+* it sends this header listing the skipped segment paths (outermost first).
+* The client uses this to merge the partial payload with cached segments.
+*/
+function extractSkippedSegments(response) {
+	const header = response.headers.get("X-Timber-Skipped-Segments");
+	if (!header) return null;
+	try {
+		const parsed = JSON.parse(header);
+		return Array.isArray(parsed) ? parsed : null;
+	} catch {
+		warnMalformedHeader("X-Timber-Skipped-Segments", header);
+		return null;
+	}
+}
+/**
+* Thrown when an RSC payload response contains X-Timber-Redirect header.
+* Caught in navigate() to trigger a soft router navigation to the redirect target.
+*/
+var RedirectError = class extends Error {
+	redirectUrl;
+	constructor(url) {
+		super(`Server redirect to ${url}`);
+		this.redirectUrl = url;
+	}
+};
+/**
+* Thrown when the server signals a version skew (X-Timber-Reload header).
+* Caught in navigate() to trigger a full page reload.
+* See TIM-446.
+*/
+var VersionSkewError = class extends Error {
+	constructor() {
+		super("Version skew detected — server has been redeployed");
+	}
+};
+/**
+* Thrown when the server returns an error for an RSC payload request.
+* The server sends X-Timber-Error header and a JSON body instead of a
+* RSC stream it cannot answer in-SPA (a deny that needs a fallback page, a
+* broken first read). Caught in
+* navigate() to trigger a hard navigation so the server can render
+* the error page as HTML.
+*
+* See design/10-error-handling.md §"Error Page Rendering for Client Navigation"
+*/
+var ServerErrorResponse = class extends Error {
+	status;
+	url;
+	constructor(status, url) {
+		super(`Server error ${status} during navigation to ${url}`);
+		this.status = status;
+		this.url = url;
+	}
+};
+/**
+* Thrown when the RSC fetch response has a Content-Type that is not
+* text/x-component — e.g., a static asset (image, CSS, JS) served
+* for a same-origin URL that isn't a route. The response body is
+* cancelled immediately (headers-only cost). Caught in navigate()
+* to trigger a hard navigation; caught in prefetch() to store a
+* negative cache entry so click hard-navigates without a second fetch.
+*
+* See TIM-1231.
+*/
+var NonRscResponse = class extends Error {
+	url;
+	constructor(url) {
+		super(`Non-RSC response for ${url}`);
+		this.url = url;
+	}
+};
+/**
+* Wrap a response body stream to track when it's fully consumed.
+* Returns a new body that passes all chunks through unchanged, plus
+* a `done` promise that resolves when the last chunk is read (or
+* rejects if the stream errors).
+*
+* createFromFetch's thenable resolves on shell arrival, but callers need to
+* know when the stream is fully decoded: that is what `navigateTransition`'s
+* returned promise means, and what the router's pending store, the Navigation
+* API deferred and `<Link>`'s `isPending` are all timed against.
+*/
+function trackStreamCompletion(body) {
+	let resolveDone;
+	let rejectDone;
+	const done = new Promise((res, rej) => {
+		resolveDone = res;
+		rejectDone = rej;
+	});
+	const reader = body.getReader();
+	return {
+		body: new ReadableStream({
+			async pull(controller) {
+				try {
+					const result = await reader.read();
+					if (result.done) {
+						controller.close();
+						resolveDone();
+					} else controller.enqueue(result.value);
+				} catch (error) {
+					controller.error(error);
+					rejectDone(error);
+				}
+			},
+			cancel(reason) {
+				reader.cancel(reason);
+				resolveDone();
+			}
+		}),
+		done
+	};
+}
+/**
+* Fetch an RSC payload from the server and start decoding it.
+*
+* Every response is classified here, once: a version-skew reload, a 204 or
+* 3xx redirect, a server error envelope and a non-RSC body are each turned
+* into their error before `decodeRsc` sees the body. There is no second
+* path — tests decode real Flight bytes through the same code (TIM-1541).
+*/
+async function fetchRscPayload(url, deps, stateTree, currentUrl, signal) {
+	const staticTarget = staticMode ? toStaticRscUrl(url) : null;
+	const fetchTarget = staticTarget ? staticTarget.url : url;
+	const headers = staticMode ? buildRscHeaders(void 0, void 0) : buildRscHeaders(stateTree, currentUrl);
+	const rscUrl = staticTarget?.hashed ? fetchTarget : await appendRscParam(fetchTarget, headers);
+	signal?.throwIfAborted();
+	const fetchPromise = deps.fetch(rscUrl, {
+		headers,
+		redirect: "manual",
+		signal
+	});
+	let segmentInfo = null;
+	let skippedSegments = null;
+	let streamDone = Promise.resolve();
+	const wrappedPromise = fetchPromise.then((response) => {
+		if (checkReloadSignal(response)) throw new VersionSkewError();
+		const redirectLocation = response.headers.get("X-Timber-Redirect") || (response.status >= 300 && response.status < 400 ? response.headers.get("Location") : null);
+		if (redirectLocation) throw new RedirectError(redirectLocation);
+		if (response.headers.get("X-Timber-Error") === "1") throw new ServerErrorResponse(response.status, url);
+		if (staticMode) {
+			const contentType = response.headers.get("content-type");
+			if (!response.ok || contentType && contentType.split(";")[0].trim().toLowerCase() === "text/html") {
+				response.body?.cancel();
+				throw new NonRscResponse(url);
+			}
+		} else if (!isRscContentType(response.headers.get("content-type"))) {
+			response.body?.cancel();
+			throw new NonRscResponse(url);
+		}
+		segmentInfo = extractSegmentInfo(response);
+		skippedSegments = extractSkippedSegments(response);
+		if (response.body) {
+			const tracked = trackStreamCompletion(response.body);
+			streamDone = tracked.done;
+			streamDone.catch(() => {});
+			return new Response(tracked.body, {
+				headers: response.headers,
+				status: response.status
+			});
+		}
+		return response;
+	});
+	await wrappedPromise;
+	const root = deps.decodeRsc(wrappedPromise);
+	const { tree: payload, params } = splitPayloadRoot(root);
+	const rootDecoded = Promise.resolve(root).then(() => {});
+	rootDecoded.catch(() => {});
+	const decodePromise = Promise.all([streamDone, rootDecoded]).then(() => {});
+	decodePromise.catch(() => {});
+	return {
+		payload,
+		params,
+		decodePromise,
+		segmentInfo,
+		skippedSegments
+	};
+}
+//#endregion
+//#region src/client/unload-guard.ts
+/**
+* Page unload detection — suppresses spurious errors during page refresh/navigation.
+*
+* When the user refreshes the page or navigates away while React is still
+* streaming Suspense content, the aborted connection causes streaming errors.
+* These are not application errors — they're a side effect of the browser
+* tearing down the connection. This module tracks whether the page is being
+* unloaded so error boundaries and error handlers can suppress abort-related
+* errors during the unload window.
+*
+* This is the single owner of "is this document going away". Anything that
+* needs the answer imports `isPageUnloading()` — an unload flag maintained a
+* second time somewhere else is a flag that will drift out of agreement with
+* this one (TIM-1260).
+*
+* Mutable state is delegated to client/state.ts for singleton guarantees.
+* See design/18-build-system.md §"Singleton State Registry"
+*
+* See design/10-error-handling.md §"Known limitation: deny() inside Suspense and hydration"
+*/
+/**
+* Departure is *committed*: `pagehide` has fired, or this document has called
+* reload() on itself. `beforeunload` alone doesn't qualify — it is
+* speculative, and the user can still cancel out of it.
+*/
+var committed = false;
+if (typeof window !== "undefined") {
+	window.addEventListener("beforeunload", () => {
+		_setUnloading(true);
+		setTimeout(() => {
+			if (!committed) _setUnloading(false);
+		}, 0);
+	});
+	window.addEventListener("pagehide", () => {
+		committed = true;
+		_setUnloading(true);
+	});
+	window.addEventListener("pageshow", (event) => {
+		if (event.persisted) {
+			committed = false;
+			_setUnloading(false);
+		}
+	});
+}
+/**
+* Returns true if the page is currently being unloaded (user refreshed
+* or navigated away). Error boundaries should suppress errors in this state.
+*/
+function isPageUnloading() {
+	return unloading;
+}
+//#endregion
+//#region src/client/stale-client.ts
+/**
+* Stale Client — knowing when this bundle has been superseded.
+*
+* Layer 1 of version skew handling (see design/33-version-skew.md) is
+* proactive: the server compares `X-Timber-Deployment-Id` against the current
+* build and answers a stale client with `X-Timber-Reload: 1`. That covers
+* every RSC navigation and every server action — as long as there is a server
+* in the request path.
+*
+* This module is the reactive half, plus the state both halves feed. It
+* recognizes the two error shapes a stale client produces on its own:
+*
+* 1. **Stale client references** — React's Flight client throws
+*    "Could not find the module …" when an RSC payload names a client module
+*    ID that isn't in this bundle's manifest.
+* 2. **Chunk load failures** — a content-hashed chunk that no longer exists on
+*    the CDN fails to `import()`. Every engine words this differently.
+*
+* It matters most for `output: 'static'`, where there is no server to send the
+* reload header and this is the *only* skew detection that can run.
+*
+* **Nothing here reloads the page.** A stale client is recorded, not acted on;
+* the router turns the next user-initiated navigation into a full document
+* load. See design/33-version-skew.md §"Recovery on the next navigation" for
+* why — a self-issued `location.reload()` cannot tell a recovery from a bounce
+* between two live deployments, and mid-rollout it produces exactly that loop.
+*
+* See TIM-1260, TIM-1275.
+*/
+/**
+* Substrings that identify a failed dynamic import, lowercased for
+* case-insensitive matching. Engines and bundlers each word this
+* differently and none of them expose a stable error code.
+*/
+var CHUNK_LOAD_PATTERNS = [
+	"failed to fetch dynamically imported module",
+	"error loading dynamically imported module",
+	"importing a module script failed",
+	"unable to preload css for"
+];
+/** Substring React's Flight client uses when a client module ID is unknown. */
+var STALE_REFERENCE_PATTERN = "could not find the module";
+/**
+* Pull a comparable message out of an unknown thrown value. Rejections cross
+* enough boundaries (event handlers, `unhandledrejection`, Vite's preload
+* event) that the value is not reliably an `Error`.
+*/
+function messageOf(error) {
+	if (typeof error === "string") return error.toLowerCase();
+	if (error instanceof Error) return error.message.toLowerCase();
+	if (error && typeof error === "object" && "message" in error) {
+		const message = error.message;
+		if (typeof message === "string") return message.toLowerCase();
+	}
+	return "";
+}
+/**
+* True when the error is React's "client reference not in this manifest"
+* failure — the payload was produced by a build this bundle doesn't match.
+*/
+function isStaleClientReference(error) {
+	return messageOf(error).includes(STALE_REFERENCE_PATTERN);
+}
+/**
+* True when the error is a failed dynamic import or CSS preload — the
+* content-hashed chunk this bundle asks for is gone from the CDN.
+*/
+function isChunkLoadError(error) {
+	if (error instanceof Error && error.name === "ChunkLoadError") return true;
+	const message = messageOf(error);
+	return CHUNK_LOAD_PATTERNS.some((pattern) => message.includes(pattern));
+}
+/**
+* True once this client is known to be running against a superseded
+* deployment. One-way: a document that has gone stale cannot come back, since
+* the only way to get fresh code is to load a new document.
+*
+* In-memory on purpose. Persisting it would be wrong — the next document gets
+* whatever build the server hands it, and if that one is stale too it will
+* find out the same way.
+*/
+var stale = false;
+/**
+* True once {@link initStaleClient} has seen a deployment ID — i.e. this is a
+* production build. False in dev, where nothing is ever stale: HMR owns code
+* updates, and a failed dynamic import is a real error the developer needs to
+* see rather than something a page load fixes.
+*/
+var deployed = false;
+/** Whether this client has been superseded by a newer deployment. */
+function isClientStale() {
+	return stale;
+}
+/**
+* Record that the origin has told us this client is stale — the `X-Timber-Reload`
+* header on an RSC or action response. Authoritative, so it is not gated on
+* anything: a dev server never sends the header in the first place.
+*/
+function markClientStale() {
+	stale = true;
+}
+/**
+* Record staleness if `error` is one of the shapes a superseded bundle
+* produces. Returns whether it did, so a caller mid-navigation can decide to
+* hard-navigate instead of surfacing the error.
+*
+* Inference, unlike {@link markClientStale}, so it is gated on being a
+* production build. This is the single place that gate lives — call sites
+* cannot see each other, and "remember to gate the next one too" is not a
+* guarantee.
+*/
+function markStaleFromError(error) {
+	if (!deployed) return false;
+	if (isPageUnloading()) return false;
+	if (!isStaleClientReference(error) && !isChunkLoadError(error)) return false;
+	stale = true;
+	return true;
+}
+//#endregion
+//#region src/client/router-skew.ts
+/**
+* Router Skew Recording — turning a rejection into "this bundle is superseded".
+*
+* Detection lives in `stale-client.ts`; this is the one place the router (and
+* anything else holding an RSC rejection) turns an error into that verdict.
+* Recovery is not here: every path that gives up on client-side navigation —
+* skew or not — leaves through `createSpaExits()` in `router-effects.ts`.
+*
+* See design/33-version-skew.md §"Recovery on the next navigation"
+*/
+/**
+* Record a version skew if `error` is one, and report whether it was.
+*
+* `VersionSkewError` is the origin saying so outright; the reactive shapes are
+* inferred from the error text and are a no-op in dev.
+*
+* Closes over nothing — anywhere an RSC payload can fail needs it, including
+* places that have no router instance to hand.
+*/
+function recordSkew(error) {
+	if (error instanceof VersionSkewError) {
+		markClientStale();
+		return true;
+	}
+	return markStaleFromError(error);
+}
+//#endregion
+//#region src/client/router-effects.ts
+/**
+* Router Effects — full-page navigation and post-paint scroll.
+*
+* The two things the router does *to the document* rather than to its own
+* state: leaving the SPA entirely, and moving the scroll position once React
+* has committed. Extracted from `router.ts` to keep that file focused on
+* navigation state (see design/18-build-system.md §"No file >500 lines").
+*
+* See design/19-client-navigation.md §"Scroll Restoration"
+*/
+function createScrollEffects(deps) {
+	/** Run a callback after the next paint (after React commit). */
+	function afterPaint(callback) {
+		if (deps.afterPaint) deps.afterPaint(callback);
+		else callback();
+	}
+	function restoreScrollAfterPaint(scrollY) {
+		afterPaint(() => {
+			deps.scrollTo(0, scrollY);
+			window.dispatchEvent(new Event("timber:scroll-restored"));
+		});
+	}
+	function scrollToHashAfterPaint(hash) {
+		afterPaint(() => {
+			if (deps.scrollToHash?.(hash) !== true) deps.scrollTo(0, 0);
+			window.dispatchEvent(new Event("timber:scroll-restored"));
+		});
+	}
+	return {
+		restoreScrollAfterPaint,
+		scrollToHashAfterPaint
+	};
+}
+/**
+* Leave the SPA and never come back.
+*
+* Every router path that gives up on client-side navigation does the same
+* three things: flag the hard navigation so the Navigation API and React stop
+* acting on a dying document, perform the document load, then block forever so
+* the caller cannot carry on rendering into it. The returned promise is
+* deliberately unresolvable — `location` assignment does not stop this turn of
+* the event loop.
+*
+* Callers: server error, non-RSC response, and every version skew path
+* ([33-version-skew.md](../../../../design/33-version-skew.md)).
+*/
+function leaveSpa(url, fromUrl) {
+	setHardNavigating(true);
+	hardNavigate(url, fromUrl);
+	return new Promise(() => {});
+}
+/**
+* The two ownership-aware ways out of the SPA.
+*
+* Both wrap {@link leaveSpa} with the question "is this navigation still the
+* one the user is waiting for?" — asked before leaving on a failure, answered
+* by force on a path that decided before any navigation began. They live
+* together because every caller of `leaveSpa()` needs one or the other, and
+* an unguarded call is the bug (TIM-1275, TIM-1276).
+*/
+function createSpaExits({ currentOwner, supersede }) {
+	async function leaveSpaIfOwned(owner, url, fromUrl) {
+		if (currentOwner() !== owner) return;
+		await leaveSpa(url, fromUrl);
+	}
+	function leaveSpaSuperseding(url, fromUrl) {
+		supersede();
+		return leaveSpa(url, fromUrl);
+	}
+	return {
+		leaveSpaIfOwned,
+		leaveSpaSuperseding
+	};
+}
+/**
+* Answer the failures an RSC fetch can end on, or report that this one is not
+* ours to answer.
+*
+* Returns `true` when the error was handled; the caller rethrows on `false`.
+* Handling a failure by leaving the SPA never resolves at all — the document
+* is going away and the caller must not carry on rendering into it.
+*
+* There is exactly one family of these and one response to it, so it lives in
+* one function rather than once per fetch path. `navigate()`, `refresh()` and
+* an uncached traversal all reach it: the latter two used to rethrow instead,
+* and since nobody awaits a traversal that meant pressing Back on a 500 left
+* the user on the old document with an unhandled rejection (TIM-1277).
+*
+* Order matters in exactly one way: `recordSkew()` ends in error-*text*
+* matching, so it goes last and can never pre-empt a framework control-flow
+* signal whose message happens to read like a stale bundle. The class checks
+* above it are mutually exclusive, so their order is free.
+*
+* Must be called from inside the `runNavigation()` callback — see
+* {@link SpaExits.leaveSpaIfOwned}.
+*/
+function createNavigationRecovery({ currentOwner, leaveSpaIfOwned, navigate }) {
+	return async function recoverFromNavigationError(error, owner, url, fromUrl, types) {
+		if (error instanceof RedirectError) {
+			if (currentOwner() !== owner) return true;
+			await navigate(error.redirectUrl, types);
+			return true;
+		}
+		if (error instanceof ServerErrorResponse || error instanceof NonRscResponse || recordSkew(error)) {
+			await leaveSpaIfOwned(owner, url, fromUrl);
+			return true;
+		}
+		return false;
+	};
+}
+/**
+* Perform the full document load.
+*
+* `fromUrl` is the URL the navigation departed from, passed explicitly
+* because the address bar may have already been updated.
+*
+* When the target differs from the departure point only by #fragment,
+* assigning `href` is a hash change, not a load — so assign first (to update
+* the address bar) and then reload (TIM-1235).
+*/
+function hardNavigate(url, fromUrl) {
+	const current = new URL(fromUrl, window.location.origin);
+	const target = new URL(url, window.location.origin);
+	if (target.pathname === current.pathname && target.search === current.search) {
+		window.location.href = url;
+		window.location.reload();
+	} else window.location.href = url;
+}
+//#endregion
+//#region src/shared/error-digest.ts
+/**
+* The correlation ID in an error's Flight digest, or `null` when the error
+* carries none — a deny or redirect row, an error that never crossed Flight,
+* or anything that is not an object.
+*/
+function errorDigestId(error) {
+	if (typeof error !== "object" || error === null) return null;
+	const digest = Reflect.get(error, "digest");
+	if (typeof digest !== "string") return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(digest);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null) return null;
+	const errorId = Reflect.get(parsed, "errorId");
+	return Reflect.get(parsed, "type") === "error" && typeof errorId === "string" ? errorId : null;
+}
+//#endregion
+//#region src/client/error-boundary.tsx
+/**
+* Framework-injected React error boundary.
+*
+* Catches errors thrown by children and renders a fallback component
+* with the appropriate props based on error type:
+*   - DenySignal (4xx) → { status, data }
+*   - Unhandled error (500) → { error, digest, reset }, where `digest` is the
+*     ID the server logged the error with (shared/error-digest.ts)
+*
+* The `status` prop controls which errors this boundary catches:
+*   - Specific code (e.g. 403) → only that status
+*   - Category (400) → any 4xx
+*   - Category (500) → any 5xx
+*   - Omitted → catches everything (error.tsx behavior)
+*
+* See design/10-error-handling.md §"Status-Code Files"
+*/
+/**
+* Tracks the chain of segment keys from root to the current boundary.
+* Each keyed `TimberErrorBoundary` appends its `segmentKey`; unkeyed
+* slot boundaries pass the parent value through. The claim rule uses
+* this to find the first *reachable* owner from the `owners` list,
+* eliminating the owner-below-throw-site escape. See TIM-1450.
+*/
+var DenyAncestryContext = createContext([]);
+var _handledRedirects = /* @__PURE__ */ new WeakSet();
+var _handledExits = /* @__PURE__ */ new WeakSet();
+var _pendingRedirectLocation = null;
+var TimberErrorBoundary = class extends Component {
+	constructor(props) {
+		super(props);
+		this.state = {
+			hasError: false,
+			error: null
+		};
+	}
+	static getDerivedStateFromError(error) {
+		if (isPageUnloading()) return {
+			hasError: false,
+			error: null
+		};
+		return {
+			hasError: true,
+			error
+		};
+	}
+	componentDidCatch(error) {
+		markStaleFromError(error);
+	}
+	componentDidUpdate(prevProps) {
+		if (this.state.hasError && prevProps.children !== this.props.children) this.setState({
+			hasError: false,
+			error: null
+		});
+	}
+	/** Reset the error state so children re-render. */
+	reset = () => {
+		this.setState({
+			hasError: false,
+			error: null
+		});
+	};
+	static contextType = DenyAncestryContext;
+	get childAncestry() {
+		const parent = this.context ?? [];
+		const key = this.props.segmentKey;
+		return key && !parent.includes(key) ? [...parent, key] : parent;
+	}
+	render() {
+		if (!this.state.hasError || !this.state.error) return createElement(DenyAncestryContext.Provider, { value: this.childAncestry }, this.props.children);
+		const error = this.state.error;
+		const parsed = parseDigest(error);
+		if (parsed?.type === "redirect") {
+			if (typeof window === "undefined") throw error;
+			if (!(_handledRedirects.has(error) || _pendingRedirectLocation === parsed.location)) {
+				_handledRedirects.add(error);
+				const router = getRouterOrNull();
+				if (router) {
+					_pendingRedirectLocation = parsed.location;
+					queueMicrotask(() => {
+						router.navigate(parsed.location, { replace: true }).catch(() => {
+							window.location.href = parsed.location;
+						}).finally(() => {
+							_pendingRedirectLocation = null;
+						});
+					});
+				} else window.location.href = parsed.location;
+			}
+			return this.markStatusPage(null);
+		}
+		if (parsed?.type === "deny" && Array.isArray(parsed.owners) && parsed.owners.length > 0) {
+			if (!this.props.lastResort && !this.props.isSlotBoundary) {
+				const reachable = parsed.owners.find((k) => this.childAncestry.includes(k));
+				if (!this.props.segmentKey || reachable !== this.props.segmentKey) throw error;
+			}
+		}
+		if (this.props.denyOnly && !this.props.lastResort && parsed?.type !== "deny") throw error;
+		if (this.props.lastResort && parsed?.type !== "deny") {
+			if (typeof window === "undefined") throw error;
+			if (!_handledExits.has(error)) {
+				_handledExits.add(error);
+				const router = getRouterOrNull();
+				const current = window.location.pathname + window.location.search;
+				const target = router?.getPendingUrl() ?? current;
+				queueMicrotask(() => {
+					leaveSpa(target, current);
+				});
+			}
+			return null;
+		}
+		if (this.props.status != null) {
+			const errorStatus = getErrorStatus(parsed, error);
+			if (errorStatus == null || !statusMatches(this.props.status, errorStatus)) throw error;
+		}
+		return this.markStatusPage(this.renderFallback(parsed, error));
+	}
+	/**
+	* The status page this boundary shows for a row it claimed. Its shape is
+	* the file's documented contract: TSX status files get `{ status,
+	* data }`, `error.tsx` gets `{ error, digest, reset }` (plus
+	* the deny extras for dual-shape implementations — without the error prop,
+	* an error.tsx reading error.message crashes on deny fall-through, TIM-1081).
+	*/
+	renderFallback(parsed, error) {
+		if (parsed?.type === "deny") {
+			if (this.props.status != null) return createElement(this.props.fallbackComponent, {
+				status: parsed.status,
+				data: parsed.data
+			});
+			return createElement(this.props.fallbackComponent, {
+				error: denyError(parsed.status, error),
+				digest: null,
+				reset: this.reset,
+				status: parsed.status,
+				data: parsed.data
+			});
+		}
+		return createElement(this.props.fallbackComponent, {
+			error,
+			digest: errorDigestId(error),
+			reset: this.reset
+		});
+	}
+	/**
+	* A status page (or, for a redirect row, nothing at all) replaced part of
+	* the main route, and the segment cache must not learn a chain that never
+	* mounted; the marker tells the navigation that commits this tree. A boundary that declined in `render()` re-threw
+	* before getting here, so only the boundary that put a page on screen
+	* speaks. A slot degrading leaves the page and its chain intact, so slot
+	* boundaries stay silent. See `status-page-marker.tsx` (TIM-1495).
+	*/
+	markStatusPage(page) {
+		if (this.props.isSlotBoundary) return page;
+		return createElement(StatusPageMarker, null, page);
+	}
+};
+/**
+* Parse the structured digest from the error.
+* React sets `error.digest` from the string returned by RSC's onError.
+*/
+function parseDigest(error) {
+	const raw = error.digest;
+	if (typeof raw !== "string") return null;
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && typeof parsed.type === "string") return parsed;
+	} catch (e) {
+		console.debug("[timber] error digest is not valid JSON:", e instanceof Error ? e.message : e);
+	}
+	return null;
+}
+/**
+* The Error an `error.tsx` serving a deny should receive.
+*
+* The error that actually arrives here is React's, not the framework's: a
+* server-thrown error crossing Flight has its message and name replaced with
+* a generic redacted string in production, by design. An `error.tsx` written
+* per the docs branches on `error.message` — so handing it the redacted error
+* gives it nothing to branch on, while the in-tree path hands the same file a
+* `DenySignal` named error reading `Access denied with status <N>` (see
+* `renderDenyEntry`). This reconstructs that shape from the digest, which is
+* where the status already is.
+*
+* Derived from the status alone — no stack, no server data — so it is safe on
+* the client for the same reason the digest is. See design/13-security.md
+* §"Errors don't leak", TIM-1081.
+*/
+function denyError(status, original) {
+	if (original.name === "DenySignal") return original;
+	const error = /* @__PURE__ */ new Error(`Access denied with status ${status}`);
+	error.name = "DenySignal";
+	return error;
+}
+/**
+* Extract the HTTP status code from a parsed digest or error message.
+* Falls back to message pattern matching for errors without a digest.
+*/
+function getErrorStatus(parsed, error) {
+	if (parsed?.type === "deny") return parsed.status;
+	if (parsed?.type === "redirect") return parsed.status;
+	const match = error.message.match(/^Access denied with status (\d+)$/);
+	if (match) return parseInt(match[1], 10);
+	return 500;
+}
+/**
+* Check whether an error's status matches the boundary's status filter.
+* Category markers (400, 500) match any status in that range.
+*/
+function statusMatches(boundaryStatus, errorStatus) {
+	if (boundaryStatus === 400) return errorStatus >= 400 && errorStatus <= 499;
+	if (boundaryStatus === 500) return errorStatus >= 500 && errorStatus <= 599;
+	return boundaryStatus === errorStatus;
+}
+//#endregion
+export { createSpaExits as a, NonRscResponse as c, readPublishedParams as d, createScrollEffects as i, fetchRscPayload as l, TimberErrorBoundary as n, recordSkew as o, createNavigationRecovery as r, isClientStale as s, DenyAncestryContext as t, readPayloadTree as u };
+
+//# sourceMappingURL=error-boundary-DsNScGRM.js.map