@timber-js/app 0.2.0-alpha.4 → 0.2.0-alpha.5

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE/F;AA8YD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;8BA7P3C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA+PhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE/F;AAyZD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;8BA7P3C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA+PhD,wBAAiE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.4",
+  "version": "0.2.0-alpha.5",
   "description": "Vite-native React framework for Cloudflare Workers — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/fonts/local.ts

@@ -100,18 +100,22 @@ export function generateFamilyName(sources: LocalFontSrc[]): string {
  * Generate @font-face descriptors for local font sources.
  *
  * Each source entry produces one @font-face rule. The `src` descriptor
- * uses a `url()` pointing to the resolved file path with the inferred format.
+ * uses a `url()` pointing to the served path under `/_timber/fonts/`.
+ * The `urlPrefix` defaults to `/_timber/fonts` — the path used by both
+ * the dev server middleware and the production build output.
  */
 export function generateLocalFontFaces(
   family: string,
   sources: LocalFontSrc[],
-  display: string
+  display: string,
+  urlPrefix = '/_timber/fonts'
 ): FontFaceDescriptor[] {
   return sources.map((entry) => {
     const format = inferFontFormat(entry.path);
+    const basename = entry.path.split('/').pop() ?? entry.path;
     return {
       family,
-      src: `url('${entry.path}') format('${format}')`,
+      src: `url('${urlPrefix}/${basename}') format('${format}')`,
       weight: entry.weight,
       style: entry.style,
       display,

package/src/plugins/entries.ts

@@ -130,11 +130,14 @@ function generateConfigModule(ctx: PluginContext): string {
  * Checks for instrumentation.ts, .js, and .mjs — matching the same
  * extensions as timber.config.ts detection.
  */
-function detectInstrumentationFile(root: string): string | null {
+export function detectInstrumentationFile(root: string): string | null {
   const extensions = ['.ts', '.js', '.mjs'];
-  for (const ext of extensions) {
-    const candidate = resolve(root, `instrumentation${ext}`);
-    if (existsSync(candidate)) return candidate;
+  const dirs = [root, resolve(root, 'src')];
+  for (const dir of dirs) {
+    for (const ext of extensions) {
+      const candidate = resolve(dir, `instrumentation${ext}`);
+      if (existsSync(candidate)) return candidate;
+    }
   }
   return null;
 }

package/src/plugins/fonts.ts

@@ -14,13 +14,15 @@
  * Design doc: 24-fonts.md
  */
 
-import type { Plugin } from 'vite';
+import type { Plugin, ViteDevServer } from 'vite';
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, normalize } from 'node:path';
 import type { PluginContext } from '#/index.js';
 import type { ExtractedFont, GoogleFontConfig } from '#/fonts/types.js';
 import type { ManifestFontEntry } from '#/server/build-manifest.js';
-import { generateVariableClass, generateFontFamilyClass } from '#/fonts/css.js';
+import { generateVariableClass, generateFontFamilyClass, generateFontFaces } from '#/fonts/css.js';
 import { generateFallbackCss, buildFontStack } from '#/fonts/fallbacks.js';
-import { processLocalFont } from '#/fonts/local.js';
+import { processLocalFont, generateLocalFontFaces } from '#/fonts/local.js';
 import { inferFontFormat } from '#/fonts/local.js';
 import { downloadAndCacheFonts, type CachedFont } from '#/fonts/google.js';
 import {
@@ -31,8 +33,10 @@ import {
 
 const VIRTUAL_GOOGLE = '@timber/fonts/google';
 const VIRTUAL_LOCAL = '@timber/fonts/local';
+const VIRTUAL_FONT_CSS = 'virtual:timber-fonts-css';
 const RESOLVED_GOOGLE = '\0@timber/fonts/google';
 const RESOLVED_LOCAL = '\0@timber/fonts/local';
+const RESOLVED_FONT_CSS = '\0virtual:timber-fonts-css';
 
 /**
  * Registry of fonts extracted during transform.
@@ -245,12 +249,20 @@ function generateLocalVirtualModule(): string {
 /**
  * Generate the CSS output for all extracted fonts.
  *
- * Includes @font-face rules, fallback @font-face rules, and scoped classes.
+ * Includes @font-face rules for local fonts, fallback @font-face rules,
+ * and scoped classes.
  */
 export function generateAllFontCss(registry: FontRegistry): string {
   const cssParts: string[] = [];
 
   for (const font of registry.values()) {
+    // Generate @font-face rules for local fonts
+    if (font.provider === 'local' && font.localSources) {
+      const faces = generateLocalFontFaces(font.family, font.localSources, font.display);
+      const faceCss = generateFontFaces(faces);
+      if (faceCss) cssParts.push(faceCss);
+    }
+
     // Generate fallback @font-face if metrics are available
     const fallbackCss = generateFallbackCss(font.family);
     if (fallbackCss) cssParts.push(fallbackCss);
@@ -359,23 +371,83 @@ export function timberFonts(ctx: PluginContext): Plugin {
     name: 'timber-fonts',
 
     /**
-     * Resolve `@timber/fonts/google` and `@timber/fonts/local` to virtual modules.
+     * Resolve `@timber/fonts/google`, `@timber/fonts/local`, and the
+     * virtual font CSS module to internal IDs.
      */
     resolveId(id: string) {
       if (id === VIRTUAL_GOOGLE) return RESOLVED_GOOGLE;
       if (id === VIRTUAL_LOCAL) return RESOLVED_LOCAL;
+      if (id === VIRTUAL_FONT_CSS) return RESOLVED_FONT_CSS;
       return null;
     },
 
     /**
      * Return generated source for font virtual modules.
+     *
+     * The font CSS virtual module returns the combined @font-face rules,
+     * fallback CSS, and scoped classes for all registered fonts.
      */
     load(id: string) {
       if (id === RESOLVED_GOOGLE) return generateGoogleVirtualModule(registry);
       if (id === RESOLVED_LOCAL) return generateLocalVirtualModule();
+      if (id === RESOLVED_FONT_CSS) return generateAllFontCss(registry);
       return null;
     },
 
+    /**
+     * Serve local font files in dev mode under `/_timber/fonts/`.
+     *
+     * Only files that are registered in the font registry (via localSources)
+     * are served. Paths are validated to prevent directory traversal.
+     */
+    configureServer(server: ViteDevServer) {
+      server.middlewares.use((req, res, next) => {
+        const url = req.url;
+        if (!url || !url.startsWith('/_timber/fonts/')) return next();
+
+        const requestedFilename = url.slice('/_timber/fonts/'.length);
+        // Reject path traversal attempts
+        if (requestedFilename.includes('..') || requestedFilename.includes('/')) {
+          res.statusCode = 400;
+          res.end('Bad request');
+          return;
+        }
+
+        // Find the matching font file in the registry
+        for (const font of registry.values()) {
+          if (font.provider !== 'local' || !font.localSources) continue;
+          for (const src of font.localSources) {
+            const basename = src.path.split('/').pop() ?? '';
+            if (basename === requestedFilename) {
+              const absolutePath = normalize(resolve(src.path));
+              // Verify the resolved path hasn't escaped (extra safety)
+              if (!existsSync(absolutePath)) {
+                res.statusCode = 404;
+                res.end('Not found');
+                return;
+              }
+              const data = readFileSync(absolutePath);
+              const ext = absolutePath.split('.').pop()?.toLowerCase();
+              const mimeMap: Record<string, string> = {
+                woff2: 'font/woff2',
+                woff: 'font/woff',
+                ttf: 'font/ttf',
+                otf: 'font/otf',
+                eot: 'application/vnd.ms-fontopen',
+              };
+              res.setHeader('Content-Type', mimeMap[ext ?? ''] ?? 'application/octet-stream');
+              res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+              res.setHeader('Access-Control-Allow-Origin', '*');
+              res.end(data);
+              return;
+            }
+          }
+        }
+
+        next();
+      });
+    },
+
     /**
      * Download and cache Google Fonts during production builds.
      *
@@ -525,6 +597,35 @@ export function timberFonts(ctx: PluginContext): Plugin {
         });
       }
 
+      // Emit local font files as assets
+      for (const font of registry.values()) {
+        if (font.provider !== 'local' || !font.localSources) continue;
+        for (const src of font.localSources) {
+          const absolutePath = normalize(resolve(src.path));
+          if (!existsSync(absolutePath)) {
+            this.warn(`Local font file not found: ${absolutePath}`);
+            continue;
+          }
+          const basename = src.path.split('/').pop() ?? src.path;
+          const data = readFileSync(absolutePath);
+          this.emitFile({
+            type: 'asset',
+            fileName: `_timber/fonts/${basename}`,
+            source: data,
+          });
+        }
+      }
+
+      // Emit the combined font CSS as an asset
+      const fontCss = generateAllFontCss(registry);
+      if (fontCss) {
+        this.emitFile({
+          type: 'asset',
+          fileName: '_timber/fonts/fonts.css',
+          source: fontCss,
+        });
+      }
+
       if (!ctx.buildManifest) return;
 
       // Build a lookup from font family → cached files for manifest entries

package/src/plugins/mdx.ts

@@ -16,19 +16,23 @@ import type { PluginContext } from '#/index.js';
 const MDX_EXTENSIONS = ['mdx', 'md'];
 
 /**
- * Check if mdx-components.tsx (or .ts, .jsx, .js) exists at the project root.
+ * Check if mdx-components.tsx (or .ts, .jsx, .js) exists at the project root
+ * or in src/. Root takes precedence, matching Next.js behavior.
  * Returns the absolute path if found, otherwise undefined.
  */
-function findMdxComponents(root: string): string | undefined {
+export function findMdxComponents(root: string): string | undefined {
   const candidates = [
     'mdx-components.tsx',
     'mdx-components.ts',
     'mdx-components.jsx',
     'mdx-components.js',
   ];
-  for (const name of candidates) {
-    const p = join(root, name);
-    if (existsSync(p)) return p;
+  const dirs = [root, join(root, 'src')];
+  for (const dir of dirs) {
+    for (const name of candidates) {
+      const p = join(dir, name);
+      if (existsSync(p)) return p;
+    }
   }
   return undefined;
 }

package/src/server/action-client.ts

@@ -184,7 +184,7 @@ async function runActionMiddleware<TCtx>(
 // Re-export parseFormData for use throughout the framework
 import { parseFormData } from './form-data.js';
 import { formatSize } from '#/utils/format.js';
-import { isDebug } from './debug.js';
+import { isDebug, isDevMode } from './debug.js';
 
 /**
  * Extract validation errors from a schema error.
@@ -247,12 +247,15 @@ export function handleActionError(error: unknown): ActionResult<never> {
     };
   }
 
-  // In dev, include the message for debugging
-  const isDev = isDebug();
+  // In dev, include the message for debugging.
+  // Uses isDevMode() — NOT isDebug() — because this data is sent to the
+  // browser. TIMBER_DEBUG must never cause error messages to leak to clients.
+  // See design/13-security.md principle 4: "Errors don't leak."
+  const devMode = isDevMode();
   return {
     serverError: {
       code: 'INTERNAL_ERROR',
-      ...(isDev && error instanceof Error ? { data: { message: error.message } } : {}),
+      ...(devMode && error instanceof Error ? { data: { message: error.message } } : {}),
     },
   };
 }

package/src/server/debug.ts

@@ -1,18 +1,30 @@
 /**
  * Runtime debug flag for timber.js.
  *
- * Provides `isDebug()` — a runtime check that returns true when timber's
- * debug/warning logging should be active. This is true in two cases:
+ * Two distinct functions for two distinct security levels:
  *
- * 1. Development mode: `process.env.NODE_ENV !== 'production'`
- *    (statically replaced and tree-shaken in production builds — zero cost)
+ * ## `isDebug()` — server-side logging only
  *
- * 2. TIMBER_DEBUG flag: A runtime environment variable that survives
- *    production builds. When set to any truthy value ("1", "true", etc.),
- *    timber's own diagnostics are re-enabled without affecting React's mode.
+ * Returns true when timber's debug/warning messages should be written to
+ * stderr / the server console. This NEVER affects what is sent to the
+ * client (no error details, no timing headers, no stack traces).
  *
- * The TIMBER_DEBUG check uses a dynamic property access pattern that
- * prevents the bundler from statically replacing or eliminating it.
+ * Active when any of:
+ * - `NODE_ENV !== 'production'` (standard dev mode)
+ * - `TIMBER_DEBUG` env var is set to a truthy value at runtime
+ * - `timber.config.ts` has `debug: true`
+ *
+ * ## `isDevMode()` — client-visible dev behavior
+ *
+ * Returns true ONLY when `NODE_ENV !== 'production'`. This gates anything
+ * that changes what clients can observe:
+ * - Dev error pages with stack traces (fallback-error.ts)
+ * - Detailed Server-Timing headers (pipeline.ts)
+ * - Error messages in action INTERNAL_ERROR payloads (action-client.ts)
+ * - Pipeline error handler wiring (Vite overlay)
+ *
+ * `isDevMode()` is statically replaced in production builds → the guarded
+ * code is tree-shaken to zero bytes. TIMBER_DEBUG cannot enable it.
  *
  * Usage:
  *   In Cloudflare Workers wrangler.toml:
@@ -25,10 +37,33 @@
  *   In timber.config.ts:
  *     export default { debug: true }
  *
+ * See design/13-security.md for the security taxonomy.
  * See design/18-build-system.md for build pipeline details.
  */
 
-// ─── Debug Flag ─────────────────────────────────────────────────────────────
+// ─── Dev Mode (client-visible) ──────────────────────────────────────────────
+
+/**
+ * Check if the application is running in development mode.
+ *
+ * This is the ONLY function that should gate client-visible dev behavior:
+ * - Dev error pages with stack traces
+ * - Detailed Server-Timing response headers
+ * - Error messages in action `INTERNAL_ERROR` payloads
+ * - Pipeline error handler wiring (Vite overlay)
+ *
+ * Returns `process.env.NODE_ENV !== 'production'`, which is statically
+ * replaced by the bundler in production builds. Code guarded by this
+ * function is tree-shaken to zero bytes in production.
+ *
+ * TIMBER_DEBUG does NOT enable this — that would leak server internals
+ * to clients. Use `isDebug()` for server-side-only logging.
+ */
+export function isDevMode(): boolean {
+  return process.env.NODE_ENV !== 'production';
+}
+
+// ─── Debug Flag (server-side logging only) ──────────────────────────────────
 
 /**
  * Config-level debug override. Set via `setDebugFromConfig()` during
@@ -45,19 +80,20 @@ export function setDebugFromConfig(debug: boolean): void {
 }
 
 /**
- * Check if timber debug logging is active.
+ * Check if timber debug logging is active (server-side only).
  *
  * Returns true if ANY of these conditions hold:
  * - NODE_ENV is not 'production' (standard dev mode)
  * - TIMBER_DEBUG environment variable is set to a truthy value at runtime
  * - timber.config.ts has `debug: true`
  *
- * The TIMBER_DEBUG check is deliberately written as a dynamic property
- * access so bundlers cannot statically replace it. The `_envKey` variable
- * prevents the bundler from seeing `process.env.TIMBER_DEBUG` as a
- * compile-time constant.
+ * This function controls ONLY server-side logging — messages written to
+ * stderr or the server console. It NEVER affects client-visible behavior
+ * (error pages, response headers, action payloads). For client-visible
+ * behavior, use `isDevMode()`.
  *
- * This function is intentionally NOT inlineable — it reads runtime state.
+ * The TIMBER_DEBUG check is deliberately written as a dynamic property
+ * access so bundlers cannot statically replace it.
  */
 export function isDebug(): boolean {
   // Fast path: dev mode (statically replaced to `true` in dev, `false` in prod)
@@ -89,7 +125,9 @@ function _readTimberDebugEnv(): boolean {
   try {
     const key = 'TIMBER_DEBUG';
     const val =
-      typeof process !== 'undefined' && process.env ? (process.env as Record<string, string | undefined>)[key] : undefined;
+      typeof process !== 'undefined' && process.env
+        ? (process.env as Record<string, string | undefined>)[key]
+        : undefined;
     if (val && val !== '0' && val !== 'false') return true;
   } catch {
     // process may not exist or env may throw — safe to ignore

package/src/server/rsc-entry/index.ts

@@ -72,7 +72,7 @@ import { buildRscPayloadResponse } from './rsc-payload.js';
 import { renderRscStream } from './rsc-stream.js';
 import { renderSsrResponse } from './ssr-renderer.js';
 import { callSsr } from './ssr-bridge.js';
-import { isDebug, setDebugFromConfig } from '#/server/debug.js';
+import { isDebug, isDevMode, setDebugFromConfig } from '#/server/debug.js';
 
 // Dev-only pipeline error handler, set by the dev server after import.
 // In production this is always undefined — no overhead.
@@ -127,9 +127,6 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     buildManifest: buildManifest as BuildManifest,
   });
 
-  // Dev logging — initialize OTEL-based dev tracing once at handler creation.
-  // In production, isDev is false — no tracing, no overhead.
-  // The DevSpanProcessor handles all formatting and stderr output.
   // Initialize debug flag from config before anything else.
   // This allows timber.config.ts `debug: true` to enable debug logging
   // in production without the TIMBER_DEBUG env var.
@@ -137,10 +134,24 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     setDebugFromConfig(true);
   }
 
-  const isDev = isDebug();
+  // Two separate flags for two different security levels:
+  //
+  // isDev (isDevMode) — gates client-visible behavior: dev error pages with
+  //   stack traces, detailed Server-Timing headers, error messages in action
+  //   payloads. Statically replaced in production → tree-shaken to zero.
+  //   TIMBER_DEBUG cannot enable this.
+  //
+  // debugEnabled (isDebug) — gates server-side logging only: stderr warnings,
+  //   OTEL dev tracing, console.error fallbacks. TIMBER_DEBUG enables this.
+  //   Never affects what clients see.
+  const isDev = isDevMode();
+  const debugEnabled = isDebug();
   const slowPhaseMs = (runtimeConfig as Record<string, unknown>).slowPhaseMs as number | undefined;
 
-  if (isDev) {
+  // Dev logging — initialize OTEL-based dev tracing once at handler creation.
+  // In production with TIMBER_DEBUG, this enables server-side tracing output
+  // without exposing anything to clients.
+  if (debugEnabled) {
     const devLogMode = resolveLogMode();
     if (devLogMode !== 'quiet') {
       await initDevTracing({ mode: devLogMode, slowPhaseMs });

package/dist/_chunks/debug-B4WUeqJ-.js

@@ -1,75 +0,0 @@
-//#region src/server/debug.ts
-/**
-* Runtime debug flag for timber.js.
-*
-* Provides `isDebug()` — a runtime check that returns true when timber's
-* debug/warning logging should be active. This is true in two cases:
-*
-* 1. Development mode: `process.env.NODE_ENV !== 'production'`
-*    (statically replaced and tree-shaken in production builds — zero cost)
-*
-* 2. TIMBER_DEBUG flag: A runtime environment variable that survives
-*    production builds. When set to any truthy value ("1", "true", etc.),
-*    timber's own diagnostics are re-enabled without affecting React's mode.
-*
-* The TIMBER_DEBUG check uses a dynamic property access pattern that
-* prevents the bundler from statically replacing or eliminating it.
-*
-* Usage:
-*   In Cloudflare Workers wrangler.toml:
-*     [vars]
-*     TIMBER_DEBUG = "1"
-*
-*   In Node.js:
-*     TIMBER_DEBUG=1 node server.js
-*
-*   In timber.config.ts:
-*     export default { debug: true }
-*
-* See design/18-build-system.md for build pipeline details.
-*/
-/**
-* Config-level debug override. Set via `setDebugFromConfig()` during
-* initialization when timber.config.ts has `debug: true`.
-*/
-var _configDebug = false;
-/**
-* Check if timber debug logging is active.
-*
-* Returns true if ANY of these conditions hold:
-* - NODE_ENV is not 'production' (standard dev mode)
-* - TIMBER_DEBUG environment variable is set to a truthy value at runtime
-* - timber.config.ts has `debug: true`
-*
-* The TIMBER_DEBUG check is deliberately written as a dynamic property
-* access so bundlers cannot statically replace it. The `_envKey` variable
-* prevents the bundler from seeing `process.env.TIMBER_DEBUG` as a
-* compile-time constant.
-*
-* This function is intentionally NOT inlineable — it reads runtime state.
-*/
-function isDebug() {
-	if (process.env.NODE_ENV !== "production") return true;
-	if (_configDebug) return true;
-	return _readTimberDebugEnv();
-}
-/**
-* Read TIMBER_DEBUG from the environment at runtime.
-*
-* Extracted to a separate function to:
-* 1. Prevent bundler inlining (cross-module function calls are not inlined)
-* 2. Handle platforms where `process` may not exist (Cloudflare Workers)
-* 3. Support globalThis.__TIMBER_DEBUG for programmatic control
-*/
-function _readTimberDebugEnv() {
-	if (globalThis.__TIMBER_DEBUG) return true;
-	try {
-		const val = typeof process !== "undefined" && process.env ? process.env["TIMBER_DEBUG"] : void 0;
-		if (val && val !== "0" && val !== "false") return true;
-	} catch {}
-	return false;
-}
-//#endregion
-export { isDebug as t };
-
-//# sourceMappingURL=debug-B4WUeqJ-.js.map

package/dist/_chunks/debug-B4WUeqJ-.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"debug-B4WUeqJ-.js","names":[],"sources":["../../src/server/debug.ts"],"sourcesContent":["/**\n * Runtime debug flag for timber.js.\n *\n * Provides `isDebug()` — a runtime check that returns true when timber's\n * debug/warning logging should be active. This is true in two cases:\n *\n * 1. Development mode: `process.env.NODE_ENV !== 'production'`\n *    (statically replaced and tree-shaken in production builds — zero cost)\n *\n * 2. TIMBER_DEBUG flag: A runtime environment variable that survives\n *    production builds. When set to any truthy value (\"1\", \"true\", etc.),\n *    timber's own diagnostics are re-enabled without affecting React's mode.\n *\n * The TIMBER_DEBUG check uses a dynamic property access pattern that\n * prevents the bundler from statically replacing or eliminating it.\n *\n * Usage:\n *   In Cloudflare Workers wrangler.toml:\n *     [vars]\n *     TIMBER_DEBUG = \"1\"\n *\n *   In Node.js:\n *     TIMBER_DEBUG=1 node server.js\n *\n *   In timber.config.ts:\n *     export default { debug: true }\n *\n * See design/18-build-system.md for build pipeline details.\n */\n\n// ─── Debug Flag ─────────────────────────────────────────────────────────────\n\n/**\n * Config-level debug override. Set via `setDebugFromConfig()` during\n * initialization when timber.config.ts has `debug: true`.\n */\nlet _configDebug = false;\n\n/**\n * Set the debug flag from timber.config.ts.\n * Called during handler initialization.\n */\nexport function setDebugFromConfig(debug: boolean): void {\n  _configDebug = debug;\n}\n\n/**\n * Check if timber debug logging is active.\n *\n * Returns true if ANY of these conditions hold:\n * - NODE_ENV is not 'production' (standard dev mode)\n * - TIMBER_DEBUG environment variable is set to a truthy value at runtime\n * - timber.config.ts has `debug: true`\n *\n * The TIMBER_DEBUG check is deliberately written as a dynamic property\n * access so bundlers cannot statically replace it. The `_envKey` variable\n * prevents the bundler from seeing `process.env.TIMBER_DEBUG` as a\n * compile-time constant.\n *\n * This function is intentionally NOT inlineable — it reads runtime state.\n */\nexport function isDebug(): boolean {\n  // Fast path: dev mode (statically replaced to `true` in dev, `false` in prod)\n  if (process.env.NODE_ENV !== 'production') return true;\n\n  // Config override\n  if (_configDebug) return true;\n\n  // Runtime env var check — uses dynamic access to prevent static replacement.\n  // In production builds, process.env.NODE_ENV is statically replaced, but\n  // TIMBER_DEBUG must survive as a runtime check. The dynamic key access\n  // pattern ensures the bundler treats this as opaque.\n  return _readTimberDebugEnv();\n}\n\n/**\n * Read TIMBER_DEBUG from the environment at runtime.\n *\n * Extracted to a separate function to:\n * 1. Prevent bundler inlining (cross-module function calls are not inlined)\n * 2. Handle platforms where `process` may not exist (Cloudflare Workers)\n * 3. Support globalThis.__TIMBER_DEBUG for programmatic control\n */\nfunction _readTimberDebugEnv(): boolean {\n  // globalThis override — useful for programmatic control and testing\n  if ((globalThis as Record<string, unknown>).__TIMBER_DEBUG) return true;\n\n  // process.env — works in Node.js and platforms that polyfill process\n  try {\n    const key = 'TIMBER_DEBUG';\n    const val =\n      typeof process !== 'undefined' && process.env ? (process.env as Record<string, string | undefined>)[key] : undefined;\n    if (val && val !== '0' && val !== 'false') return true;\n  } catch {\n    // process may not exist or env may throw — safe to ignore\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAI,eAAe;;;;;;;;;;;;;;;;AAyBnB,SAAgB,UAAmB;AAEjC,KAAA,QAAA,IAAA,aAA6B,aAAc,QAAO;AAGlD,KAAI,aAAc,QAAO;AAMzB,QAAO,qBAAqB;;;;;;;;;;AAW9B,SAAS,sBAA+B;AAEtC,KAAK,WAAuC,eAAgB,QAAO;AAGnE,KAAI;EAEF,MAAM,MACJ,OAAO,YAAY,eAAe,QAAQ,MAAO,QAAQ,IAF/C,kBAEiG,KAAA;AAC7G,MAAI,OAAO,QAAQ,OAAO,QAAQ,QAAS,QAAO;SAC5C;AAIR,QAAO"}