@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/dist/server/csrf.d.ts

@@ -1,34 +1,77 @@
 /**
- * CSRF protection — Origin header validation.
+ * CSRF protection — Fetch Metadata first, Origin as the fallback.
  *
- * Auto-derived from the Host header for single-origin deployments.
- * Configurable via allowedOrigins for multi-origin setups.
- * Disable with csrf: false (not recommended outside local dev).
+ * CSRF needs a victim's browser to attach cookies, and browsers mark the
+ * requests they send: `Sec-Fetch-Site` on HTTPS (and localhost) pages in
+ * every current browser, `Origin` on cross-site POSTs everywhere else. So
+ * the check trusts those two headers in that order, and lets a request
+ * carrying neither through — a webhook, curl, or a server-to-server
+ * `fetch`. The residual risk is browsers old enough to send neither on a
+ * form POST (Firefox < 70, IE11); SameSite cookies are the defense there.
+ * See design/08-forms-and-actions.md §"CSRF Protection".
+ *
+ * Prior art: Go's `net/http.CrossOriginProtection` (Go 1.25) and the OWASP
+ * CSRF cheat sheet (Fetch Metadata as a primary defense).
+ *
+ * The per-route exemption (`export const csrf = false` in route.ts) is not
+ * decided here: the caller owns route matching and applies it to a
+ * rejection. Disable globally with csrf: false (not recommended).
  *
  * See design/08-forms-and-actions.md §"CSRF Protection"
  * See design/13-security.md §"Security Testing Checklist" #6
  */
 export interface CsrfConfig {
-    /** Explicit list of allowed origins. Replaces Host-based auto-derivation. */
+    /**
+     * Origins trusted in addition to the request's own. Canonical origins
+     * only (`new URL(x).origin === x`); `validateConfig` enforces that.
+     */
     allowedOrigins?: string[];
     /** Set to false to disable CSRF validation entirely. */
     csrf?: boolean;
 }
-export type CsrfResult = {
-    ok: true;
-} | {
+/** Why a request failed the check — one value per rejection path. */
+export type CsrfRejectReason = 'cross-origin' | 'missing-host' | 'invalid-host' | 'invalid-origin' | 'origin-mismatch';
+/**
+ * A failed check. `origin` is the request's Origin header and `fetchSite`
+ * its Sec-Fetch-Site header (null when absent); `expected` is the origin(s)
+ * `origin` was compared against: the `allowedOrigins` list, preceded on
+ * `origin-mismatch` by the origin derived from the Host header. All three are for
+ * the server log only — never the response.
+ */
+export interface CsrfRejection {
     ok: false;
     status: 403;
-};
+    reason: CsrfRejectReason;
+    origin: string | null;
+    fetchSite: string | null;
+    expected: readonly string[];
+}
+export type CsrfResult = {
+    ok: true;
+} | CsrfRejection;
 /**
- * Validate the Origin header against the request's Host.
+ * Decide whether an unsafe-method request may proceed.
  *
- * For mutation methods (POST, PUT, PATCH, DELETE):
- * - If `csrf: false`, skip validation.
- * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * In order:
+ * 1. `Sec-Fetch-Site` is `same-origin` or `none` → allow.
+ * 2. `Sec-Fetch-Site` has any other value → allow only if `Origin` is in
+ *    `allowedOrigins`.
+ * 3. No `Sec-Fetch-Site`, `Origin` present (a plain-HTTP page, or an
+ *    older browser) → `Origin` must be in `allowedOrigins` or equal the
+ *    origin derived from the scheme and `Host`.
+ * 4. Neither header → allow: not a browser, so no ambient cookies to abuse.
  *
- * Safe methods (GET, HEAD, OPTIONS) always pass.
+ * Safe methods (GET, HEAD, OPTIONS) and `csrf: false` always pass.
  */
 export declare function validateCsrf(req: Request, config: CsrfConfig): CsrfResult;
+/**
+ * Turn a failed check into the response the client sees, and log why.
+ *
+ * The response is a 403 marked as a CSRF rejection (header + plain-text
+ * body) so it cannot be mistaken for an access-control 403. It never
+ * carries the observed or expected origins — `allowedOrigins` is server
+ * configuration, and a Host-derived origin can be an internal hostname
+ * behind a proxy. The server log gets the full diagnosis.
+ */
+export declare function csrfRejectionResponse(req: Request, rejection: CsrfRejection): Response;
 //# sourceMappingURL=csrf.d.ts.map

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AASnE;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAuCzE"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC;AAwCtD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAsDzE;AA+ED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,GAAG,QAAQ,CAatF"}

package/dist/server/debug.d.ts

@@ -45,7 +45,6 @@
  *
  * This is the ONLY function that should gate client-visible dev behavior:
  * - Dev error pages with stack traces
- * - Server-Timing mode default (`'detailed'` in dev, `'total'` in prod)
  * - Error messages in action `INTERNAL_ERROR` payloads
  * - Pipeline error handler wiring (Vite overlay)
  *

package/dist/server/debug.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../../src/server/debug.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,IAAI,OAAO,CAYjC"}
+{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../../src/server/debug.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,IAAI,OAAO,CAYjC"}

package/dist/server/default-logger.d.ts

@@ -0,0 +1,23 @@
+/**
+ * DefaultLogger — human-readable stderr logging when no custom logger is configured.
+ *
+ * Ships as the fallback so production deployments always have error visibility,
+ * even without an `instrumentation.ts` logger export. Output is one line per
+ * event, designed for `fly logs`, `kubectl logs`, Cloudflare dashboard tails, etc.
+ *
+ * Format:
+ *   [timber] ERROR  message  key=value key=value  trace_id=4bf92f35
+ *   [timber] WARN   message  key=value key=value  trace_id=4bf92f35
+ *   [timber] INFO   message  method=GET path=/dashboard status=200 durationMs=43  trace_id=4bf92f35
+ *
+ * Behavior:
+ * - `info` and `debug` suppressed in dev mode (dev logging handles them);
+ *   `warn` and `error` are always written (TIM-555)
+ * - `debug` suppressed unless TIMBER_DEBUG is set
+ * - Replaced entirely when a custom logger is set via `setLogger()`
+ *
+ * See design/17-logging.md §"DefaultLogger"
+ */
+import type { TimberLogger } from './logger.ts';
+export declare function createDefaultLogger(): TimberLogger;
+//# sourceMappingURL=default-logger.d.ts.map

package/dist/server/default-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-logger.d.ts","sourceRoot":"","sources":["../../src/server/default-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0ChD,wBAAgB,mBAAmB,IAAI,YAAY,CAkClD"}

package/dist/server/default-status-page.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Framework default status page — the terminal fallback of the deny chain.
+ *
+ * design/10-error-handling.md §"Fallback Chain" ends every 4xx/5xx chain in a
+ * "framework default page". Before TIM-1258 that terminal did not exist: an app
+ * with no `404.tsx` / `4xx.tsx` / `error.tsx` got `Response(null, { status })` —
+ * a correct status code with an empty body. Browsers render that as a blank
+ * page, and static generation had nothing to write to `404.html`.
+ *
+ * This page is a plain HTML string rather than a React component on purpose:
+ * it is the *last* fallback, so it must not depend on the RSC → SSR pipeline
+ * (the machinery that may already have failed by the time we get here), and it
+ * must be renderable from the static build where no render environment exists.
+ * One builder is the single source of truth for both surfaces.
+ *
+ * Security: the page interpolates nothing but the status code, and the code is
+ * clamped to a plain integer before it reaches the markup. No request URL, no
+ * error message, no stack — see design/13-security.md principle 4.
+ */
+import { statusReasonPhrase } from '../shared/status-reason-phrase.ts';
+export { statusReasonPhrase };
+/** HTML content type used for every framework default page response. */
+export declare const DEFAULT_STATUS_PAGE_CONTENT_TYPE = "text/html; charset=utf-8";
+/**
+ * Build the framework default page for a status code as a full HTML document.
+ *
+ * The document is self-contained: no scripts, no external resources, no client
+ * JavaScript. It renders identically in `server` mode, in `static` mode's
+ * generated `404.html`, and with `clientJavascript: false`.
+ */
+export declare function defaultStatusPageHtml(status: number): string;
+/**
+ * Build the framework default page as an HTTP `Response`.
+ *
+ * `responseHeaders` carries whatever middleware/proxy already set (cookies,
+ * cache directives); the content type is overwritten because the body is
+ * always HTML regardless of what the route would have produced.
+ *
+ * The body is unconditional. HEAD is not this function's problem: the pipeline
+ * strips HEAD bodies at its single exit for every response shape, so a
+ * `method` parameter here would be one renderer's private copy of a rule that
+ * now holds framework-wide (TIM-1324).
+ */
+export declare function defaultStatusPageResponse(status: number, responseHeaders: Headers): Response;
+//# sourceMappingURL=default-status-page.d.ts.map

package/dist/server/default-status-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-status-page.d.ts","sourceRoot":"","sources":["../../src/server/default-status-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiB,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMtF,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgC5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAG,QAAQ,CAG5F"}

package/dist/server/deny-boundary.d.ts

@@ -0,0 +1,257 @@
+/**
+ * Deny boundary subsystem — the in-tree DenySignal flow.
+ *
+ * Three things live together here because they form a single flow:
+ *
+ * 1. **Chain construction** (`buildDenyPageChain`) — walks the matched
+ *    segment chain at element-tree build time and produces a list of
+ *    `DenyPageEntry` records ordered by specificity (specific status →
+ *    category catch-all → `error.tsx`).
+ *
+ * 2. **Runtime matching and placement** (`matchDenyEntry`, `placeDenyPage`,
+ *    `handleCaughtDeny`) — picks the first chain entry whose status filter
+ *    matches the thrown DenySignal, then decides whether the catch site may
+ *    render it where it stands. A chain spans the catcher outward to root,
+ *    so a match may belong to an ancestor segment; rendering it in place
+ *    would wrap it in every layout in between. Ancestor-owned matches are
+ *    re-thrown with `ownerKey` stamped on the signal so the error boundary
+ *    at the owning segment renders it. See TIM-1356.
+ *
+ * 3. **The page boundary itself** (`PageDenyBoundary`) — the async server
+ *    component that wraps a server-component page, calls it, and catches
+ *    `DenySignal` so the deny page renders in-tree (no throw reaches
+ *    React Flight, single render pass).
+ *
+ * Plus the ALS helpers (`setDenyStatus` / `getDenyStatus`) the boundary
+ * uses to thread the matched status code back to the pipeline so the
+ * HTTP status reflects the deny.
+ *
+ * Folded into one module from the former `deny-page-resolver.ts` and
+ * `page-deny-boundary.tsx` (TIM-853) — the names were misleading and the
+ * three pieces only made sense together.
+ *
+ * See design/04-authorization.md, design/10-error-handling.md, TIM-666.
+ */
+import { DenySignal } from './primitives.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+/** A single entry in the deny page fallback chain. */
+export interface DenyPageEntry {
+    /** Status code filter: specific (403), category (400 = any 4xx), or null (catch-all). */
+    status: number | null;
+    /** The component to render (server or client — both work). */
+    component: (...args: unknown[]) => unknown;
+    /**
+     * How the entry matched: a status-code file (404.tsx/4xx.tsx) or the
+     * error.tsx catch-all. error.tsx entries render with their documented
+     * { error, digest, reset } contract, not bare deny props. See TIM-1081.
+     */
+    kind: 'status' | 'error';
+    /**
+     * Position in the segment chain (0 = root, ascending toward leaf).
+     * Used by `matchDenyEntry` to reconstruct per-segment ordering for 5xx
+     * statuses — `resolve5xx` walks per-segment (status files then error.tsx
+     * at each segment before moving outward), while the chain is stored in
+     * the 4xx two-pass order. Without this, `deny(503)` resolves to a
+     * different file depending on which path serves it. See TIM-1360.
+     */
+    segmentIndex: number;
+    /**
+     * Segment key of the segment whose directory holds this file — where the
+     * deny page must render, which is not necessarily where it was caught.
+     *
+     * A chain flattens every segment from the catcher outward to root, so
+     * without this a catcher cannot tell a file it owns from an ancestor's,
+     * and renders both at its own position — wrapping the deny page in every
+     * layout in between (TIM-1356).
+     *
+     * A **key**, not an index: `computeSegmentKeys` produces the identity the
+     * client segment cache already navigates by, and it survives the trip
+     * through the Flight digest to a boundary the client mounted on an
+     * earlier navigation. A chain position would not — depth varies with
+     * route groups and interception.
+     *
+     * It inherits that key's known collision rather than fixing it: keys reset
+     * to `urlPath` at each URL-visible segment, so `(browse)/feed` and
+     * `(landing)/feed` are both `/feed` (see `routing/segment-keys.ts`). Two
+     * such branches are already indistinguishable to the skip decision and the
+     * client cache, so a deny addressed across them can land in the wrong
+     * branch's layout. Fixing that means fixing the key for every reader, not
+     * minting a second identity here.
+     */
+    ownerKey: string;
+}
+/**
+ * What `renderDenyEntry` needs to build the element: which component, and
+ * which props contract it expects. Deliberately excludes `ownerKey` — the
+ * re-render fallback path builds an entry from a `resolveStatusFile`
+ * resolution that already carries the position, and would otherwise have to
+ * invent an owner it never reads.
+ */
+export type DenyEntryShape = Pick<DenyPageEntry, 'component' | 'kind'>;
+/**
+ * Where a matched deny page must render, relative to the catcher that
+ * matched it.
+ *
+ * `render` — the catcher owns the file and is already at the right
+ * position. `hoist` — an ancestor owns it; the catcher must re-throw so the
+ * boundary at `ownerKey` renders it, outside the layouts in between.
+ */
+export type DenyPlacement = {
+    kind: 'render';
+    element: React.ReactElement;
+} | {
+    kind: 'hoist';
+    ownerKey: string;
+};
+/**
+ * Build the deny page fallback chain from the segment chain.
+ *
+ * Walks segments from `startIndex` outward (toward root) and collects
+ * status-code file components in fallback order:
+ * 1. Specific status files (403.tsx, 404.tsx) — exact match
+ * 2. Category catch-alls (4xx.tsx, 5xx.tsx) — matches any in category
+ * 3. error.tsx — catches everything
+ *
+ * The chain is stored in the 4xx two-pass order (all status files across
+ * segments, then all error.tsx), which mirrors `resolve4xx`. For 5xx,
+ * `matchDenyEntry` reconstructs the per-segment walk from each entry's
+ * `segmentIndex` — matching `resolve5xx`'s single-pass ordering where a
+ * leaf `error.tsx` beats a root `5xx.tsx`. See TIM-1360.
+ */
+export declare function buildDenyPageChain(segments: ManifestSegmentNode[], startIndex: number, segmentKeys: string[], req: Request): Promise<DenyPageEntry[]>;
+/**
+ * Find the first deny page in the chain whose status filter matches.
+ * Returns null when nothing in the chain accepts this status.
+ *
+ * For 4xx statuses, the chain's stored order is correct: every status file
+ * across all segments (inner→outer) before any error.tsx — so a root
+ * `404.tsx` beats a leaf `error.tsx`. This matches `resolve4xx`.
+ *
+ * For 5xx statuses, the match walks per-segment (inner→outer): at each
+ * segment, status files (`503.tsx` → `5xx.tsx`) then `error.tsx`, before
+ * moving to the next segment outward. A leaf `error.tsx` therefore beats a
+ * root `5xx.tsx` — the intentional inverse of the 4xx chain, matching
+ * `resolve5xx`. See TIM-1360.
+ */
+export declare function matchDenyEntry(chain: DenyPageEntry[], status: number): DenyPageEntry | null;
+/**
+ * Return ALL deny page entries whose status filter matches, in traversal
+ * order (best match first). `matchDenyEntry` returns only the first;
+ * late addressing (TIM-1450) needs the full list so the client can find
+ * the first *reachable* owner via its ancestry context.
+ */
+export declare function matchDenyEntries(chain: DenyPageEntry[], status: number): DenyPageEntry[];
+/**
+ * Decide where the deny page for `status` renders, from the perspective of
+ * the catch site at `selfKey`.
+ *
+ * The match itself is unchanged — first entry in fallback order wins, so
+ * every path picks the same file. What this adds is the position: a chain
+ * built at segment i spans i outward to root, so a matched entry is owned
+ * either by the catcher or by one of its ancestors.
+ *
+ * - Owned by the catcher → `render`. The catcher already sits at the
+ *   owning segment's position.
+ * - Owned by an ancestor → `hoist`. Rendering here would wrap the deny page
+ *   in every layout between the owner and the catcher. The caller re-throws
+ *   with `ownerKey` stamped on the signal so the boundary at that segment
+ *   renders it instead — inside the owner's layout, outside the rest.
+ *
+ * Returns null when no entry matches; the caller re-throws unannotated and
+ * the re-render fallback resolves it.
+ *
+ * See design/04-authorization.md §"Where a Deny Page Renders", TIM-1356.
+ */
+export declare function placeDenyPage(chain: DenyPageEntry[], status: number, data: unknown, selfKey: string | undefined): DenyPlacement | null;
+/**
+ * Build the element for a matched deny chain entry with the props contract
+ * the file's convention documents:
+ *
+ * - Status-code files: { status, data }
+ * - error.tsx (TSX): { error, digest, reset } via ErrorReconstituter, plus
+ *   { status, data } for dual-shape implementations. Without
+ *   the Error prop, any error.tsx written per the docs (reading
+ *   error.message) crashes — turning a clean deny(404) into a 500. TIM-1081.
+ * - error.mdx: plain { status } — server component, static content.
+ */
+export declare function renderDenyEntry(entry: DenyEntryShape, status: number, data: unknown): React.ReactElement;
+/**
+ * The whole of what an in-tree catch site does with a `DenySignal`, shared
+ * by all three of them (`PageDenyBoundary`, `TracedLayout`, `AccessGate`).
+ *
+ * Returns the deny page element when this catch site owns the matched file.
+ * Otherwise it throws — annotated with `ownerKey` when an ancestor owns the
+ * file, bare when nothing matched at all.
+ *
+ * `setDenyStatus` runs on the hoist path too, *before* the throw, for one
+ * case. Normally Flight's `onError` captures the rethrown signal within the
+ * renderer's promotion cap, and the pipeline renders the deny page with
+ * `deny.status` — the recorded status goes unread. When the signal lands
+ * after the cap but within the detection window that follows, the renderer
+ * discards it (never promoted) and streams the document it already has;
+ * `getDenyStatus()`, read once as the renderer returns, gives that document
+ * the deny's 4xx instead of a 200. A deny later than that commits 200. Pinned by
+ * `tests/late-hoisted-deny-status.test.ts`. The RSC payload path never
+ * reads it — a Flight payload response is always 200 and the row itself
+ * carries the deny (TIM-1495).
+ *
+ * Either branch leaves part of the matched chain unmounted — hoisting sends
+ * the render to a boundary that discards everything below it, and a layout
+ * that denies returns the deny page instead of its own child outlet. What the
+ * client then learns about the tree is decided by the boundary that renders
+ * the page, at the commit that puts it on screen (`navigation-commit.ts`).
+ */
+export declare function handleCaughtDeny(chain: DenyPageEntry[] | undefined, error: DenySignal, selfKey: string | undefined): React.ReactElement;
+/**
+ * Async server component that wraps a page call with DenySignal catching.
+ *
+ * Calls the page component as an async function (the same thing React
+ * Flight does internally), awaits it, and catches DenySignal. On catch,
+ * renders the matching deny page in-tree. On success, returns the page's
+ * rendered output normally.
+ *
+ * Client component pages ('use client') are NOT wrapped — they can't call
+ * deny() (server-only API) and must go through createElement normally.
+ *
+ * No error reaches React Flight — the Flight stream is clean, SSR succeeds,
+ * and the entire request uses a single renderToReadableStream call.
+ */
+export declare function PageDenyBoundary({ Page, route, denyPages, segmentKey, }: {
+    /** The page server component function. */
+    Page: (...args: unknown[]) => unknown;
+    /** Route path for OTEL tracing. */
+    route: string;
+    /** Deny page fallback chain from the segment chain. */
+    denyPages: DenyPageEntry[];
+    /**
+     * Segment key of the leaf. The page renders inside the leaf's layout, so
+     * a leaf-owned deny page is already at the right position; anything the
+     * chain matched further up is hoisted to its owner.
+     */
+    segmentKey: string;
+}): Promise<React.ReactElement>;
+/**
+ * Set the deny status in the request context ALS.
+ * Called from AccessGate / PageDenyBoundary when a DenySignal is caught.
+ * The document path reads this after render to set the HTTP status code.
+ */
+export declare function setDenyStatus(status: number): void;
+/**
+ * Read the deny status from the request context ALS.
+ * Returns undefined if no deny was caught during render.
+ */
+export declare function getDenyStatus(): number | undefined;
+/**
+ * Record the first denied segment index in the request context ALS.
+ * Called from AccessGate when a DenySignal is caught during render.
+ * Only the first (shallowest) denial is recorded — deeper denials are
+ * unreachable because the gate short-circuits the subtree.
+ * See TIM-1363.
+ */
+export declare function setFirstDeniedSegmentIndex(index: number): void;
+/**
+ * Read the first denied segment index from the request context ALS.
+ * Returns Infinity if no segment denied during render.
+ */
+export declare function getFirstDeniedSegmentIndex(): number;
+//# sourceMappingURL=deny-boundary.d.ts.map

package/dist/server/deny-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-boundary.d.ts","sourceRoot":"","sources":["../../src/server/deny-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAM7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,MAAM,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BxC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EAAE,EACrB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,aAAa,EAAE,CAAC,CAoE1B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAUxF;AA8BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,aAAa,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,aAAa,GAAG,IAAI,CAWtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,KAAK,CAAC,YAAY,CAOpB;AA6BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,aAAa,EAAE,GAAG,SAAS,EAClC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,KAAK,CAAC,YAAY,CAYpB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,GACX,EAAE;IACD,0CAA0C;IAC1C,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IACtC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAU9B;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAK9D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}

package/dist/server/deny-renderer.d.ts

@@ -14,36 +14,42 @@
  *
  * See design/10-error-handling.md §"Status-Code Files"
  */
-import { DenySignal } from './primitives.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch } from './pipeline.js';
-import type { NavContext } from './ssr-entry.js';
-import type { ClientBootstrapConfig } from './html-injectors.js';
+import { DenySignal } from './primitives.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { NavContext, SsrRenderResult } from './ssr-bridge-types.ts';
+import type { ClientBootstrapConfig } from './html-injectors.ts';
 /** Layout component entry for deny page wrapping. */
 export interface LayoutEntry {
     component: (...args: unknown[]) => unknown;
     segment: ManifestSegmentNode;
 }
-/** Callback to create a debug channel sink for RSC rendering. */
-export type DebugChannelFactory = () => {
-    readable: ReadableStream;
-    writable: WritableStream;
-};
 /** Callback to pass RSC stream to SSR for HTML rendering. */
-export type CallSsrFn = (rscStream: ReadableStream<Uint8Array>, navContext: NavContext) => Promise<Response>;
+export type CallSsrFn = (rscStream: ReadableStream<Uint8Array>, navContext: NavContext) => Promise<SsrRenderResult>;
+/**
+ * Supplies a replacement for the framework default page at the end of the
+ * chain. Returning `null` keeps the framework default.
+ *
+ * The dev server uses this to substitute its route-listing 404 page. It is a
+ * parameter rather than a check on the produced Response because "the app
+ * authored no status page" is a fact about the *chain*, and inspecting the
+ * result for it (e.g. an empty body) stops being true the moment the chain
+ * grows a real terminal — which is exactly what TIM-1258 did.
+ */
+export type DefaultPageRenderer = (status: number, responseHeaders: Headers) => Response | null;
 /**
  * Render a status-code error page for a DenySignal.
  *
  * Resolves the appropriate status-code file from the segment chain based
- * on format preference. Returns an HTML Response (component), JSON Response,
- * or bare fallback Response.
+ * on format preference. Returns an HTML Response (component), a JSON Response,
+ * or the framework default status page.
  */
-export declare function renderDenyPage(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, createDebugChannelSink: DebugChannelFactory, callSsr: CallSsrFn): Promise<Response>;
+export declare function renderDenyPage(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, callSsr: CallSsrFn, defaultPage?: DefaultPageRenderer, firstDeniedIndex?: number): Promise<Response>;
 /**
  * Render a status-code error page as a raw RSC Flight stream for client navigation.
  *
  * Same as renderDenyPage but skips SSR — returns the RSC stream directly
  * so the client can reconcile the error page into the existing DOM.
  */
-export declare function renderDenyPageAsRsc(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], responseHeaders: Headers, createDebugChannelSink: DebugChannelFactory): Promise<Response>;
+export declare function renderDenyPageAsRsc(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, responseHeaders: Headers, firstDeniedIndex?: number): Promise<Response>;
 //# sourceMappingURL=deny-renderer.d.ts.map

package/dist/server/deny-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deny-renderer.d.ts","sourceRoot":"","sources":["../../src/server/deny-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAMjE,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM;IACtC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CACtB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,KACnB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAUvB;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,sBAAsB,EAAE,mBAAmB,EAC3C,OAAO,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CA6GnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,eAAe,EAAE,OAAO,EACxB,sBAAsB,EAAE,mBAAmB,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAgDnB"}
+{"version":3,"file":"deny-renderer.d.ts","sourceRoot":"","sources":["../../src/server/deny-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAa7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAKjE,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CACtB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,KACnB,OAAO,CAAC,eAAe,CAAC,CAAC;AAuB9B;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC;AAEhG;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,OAAO,EAAE,SAAS,EAClB,WAAW,CAAC,EAAE,mBAAmB,EACjC,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA0InB;AAgBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAgDnB"}

package/dist/server/early-hints-sender.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"early-hints-sender.d.ts","sourceRoot":"","sources":["../../src/server/early-hints-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD"}
+{"version":3,"file":"early-hints-sender.d.ts","sourceRoot":"","sources":["../../src/server/early-hints-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD"}

package/dist/server/early-hints.d.ts

@@ -14,7 +14,7 @@
  *
  * Design docs: 02-rendering-pipeline.md §"Early Hints (103)"
  */
-import type { BuildManifest } from './build-manifest.js';
+import type { BuildManifest } from './build-manifest.ts';
 /** Minimal segment shape needed for early hint collection. */
 interface SegmentWithFiles {
     layout?: {
@@ -49,9 +49,17 @@ export interface EarlyHint {
 /**
  * Format a single EarlyHint as a Link header value.
  *
+ * Attribute order: `as` before `rel` to match Cloudflare CDN's cached
+ * Early Hints format. Cloudflare caches Link headers from 200 responses
+ * and re-emits them as 103 Early Hints on subsequent requests. If our
+ * attribute order differs from Cloudflare's cached copy, the browser
+ * sees two preload headers for the same URL (different attribute order)
+ * and warns "Preload was ignored." Matching the order ensures the
+ * browser deduplicates them correctly.
+ *
  * Examples:
- *   `</styles/root.css>; rel=preload; as=style`
- *   `</fonts/inter.woff2>; rel=preload; as=font; crossorigin=anonymous`
+ *   `</styles/root.css>; as=style; rel=preload`
+ *   `</fonts/inter.woff2>; as=font; rel=preload; crossorigin=anonymous`
  *   `</_timber/client.js>; rel=modulepreload`
  *   `<https://fonts.googleapis.com>; rel=preconnect`
  */
@@ -65,17 +73,11 @@ export interface EarlyHintOptions {
  * Collect all Link header strings for a matched route's segment chain.
  *
  * Walks the build manifest to emit hints for:
- * - CSS stylesheets (rel=preload; as=style)
- * - Font assets (rel=preload; as=font; crossorigin)
+ * - CSS stylesheets (as=style; rel=preload)
+ * - Font assets (as=font; rel=preload; crossorigin)
  * - JS modulepreload hints (rel=modulepreload) — unless skipJs is set
  *
- * Also emits global CSS from the `_global` manifest key. Route files
- * are server components that don't appear in the client bundle, so
- * per-route CSS keying doesn't work with the RSC plugin. The `_global`
- * key contains all CSS assets from the client build — fine for early
- * hints since they're just prefetch signals.
- *
- * Returns formatted Link header strings, deduplicated, root → leaf order.
+ * Returns formatted Link header strings, deduplicated by URL, root → leaf order.
  * Returns an empty array in dev mode (manifest is empty).
  */
 export declare function collectEarlyHintHeaders(segments: SegmentWithFiles[], manifest: BuildManifest, options?: EarlyHintOptions): string[];

package/dist/server/early-hints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"early-hints.d.ts","sourceRoot":"","sources":["../../src/server/early-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,8DAA8D;AAC9D,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,GAAG,EAAE,SAAS,GAAG,eAAe,GAAG,YAAY,CAAC;IAChD,mFAAmF;IACnF,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAClE,mEAAmE;IACnE,WAAW,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAC9C,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAMxD;AAID,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,EAAE,CAsCV"}
+{"version":3,"file":"early-hints.d.ts","sourceRoot":"","sources":["../../src/server/early-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,8DAA8D;AAC9D,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAID;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,GAAG,EAAE,SAAS,GAAG,eAAe,GAAG,YAAY,CAAC;IAChD,mFAAmF;IACnF,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAClE,mEAAmE;IACnE,WAAW,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAC9C,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;CACzC;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAcxD;AAID,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,EAAE,CAsCV"}