@timber-js/app 0.2.0-alpha.97 → 0.2.0-alpha.99

package/dist/cookies/define-cookie.d.ts

@@ -2,53 +2,98 @@
  * defineCookie — typed cookie definitions.
  *
  * Bundles name + codec + options into a reusable CookieDefinition<T>
- * with async .getCookie(), .setCookie(), .deleteCookie() server methods
- * and a sync .useCookie() client hook.
+ * with sync .get(), .set(), .delete() isomorphic methods (server + client)
+ * and a .useCookie() client hook.
  *
- * Server methods are async to future-proof the API for v2 features
- * (signed cookies via crypto.subtle, encrypted cookies, external stores).
+ * Uses the registration pattern: server entry registers serverCookieImpl,
+ * client entry registers clientCookieImpl. This avoids top-level value
+ * imports from either environment and makes defineCookie isomorphic
+ * without `typeof window` checks.
  *
- * Reuses the SearchParamCodec protocol via fromSchema() bridge.
- * Validation on read returns the codec default (never throws).
- *
- * IMPORTANT: This module must NOT have top-level value imports from either
- * server or client modules. Server methods lazy-import request-context;
- * useCookie() lazy-imports use-cookie. This ensures:
- * - Client bundles don't pull in ALS/server code
- * - RSC bundles don't pull in useSyncExternalStore/client code
- * - Tree-shaking is not required for correctness
+ * Standard Schema objects (Zod, Valibot, ArkType) are auto-detected in
+ * the codec option — no explicit fromSchema() wrapper needed.
  *
  * See design/29-cookies.md §"Typed Cookies with Schema Validation"
  */
-import type { CookieOptions } from '../server/request-context.js';
+import type { CookieOptions } from '../server/cookie-context.js';
+import type { ClientCookieOptions } from '../client/use-cookie.js';
 import type { Codec } from '../codec.js';
+import type { StandardSchemaV1 } from '../schema-bridge.js';
 /**
  * A codec that converts between string cookie values and typed values.
  * Type alias for the shared Codec<T> protocol.
  */
 export type CookieCodec<T> = Codec<T>;
 /** Options for defineCookie: codec + CookieOptions merged. */
-export interface DefineCookieOptions<T> extends CookieOptions {
-    /** Codec for parsing/serializing the cookie value. */
-    codec: CookieCodec<T>;
+export interface DefineCookieOptions<T, HttpOnly extends boolean = boolean> extends CookieOptions {
+    /**
+     * Codec for parsing/serializing the cookie value.
+     * Accepts a Codec<T> or a Standard Schema object (Zod, Valibot, ArkType)
+     * which is auto-wrapped via fromSchema.
+     */
+    codec: CookieCodec<T> | StandardSchemaV1<T>;
+    /**
+     * Prevent client-side JS access. Default: true.
+     * When true (or omitted), client methods (useCookie, get/set/delete on
+     * client) are omitted from the return type and throw at runtime.
+     */
+    httpOnly?: HttpOnly;
 }
-/** A fully typed cookie definition with server and client methods. */
-export interface CookieDefinition<T> {
-    /** The cookie name. */
+/**
+ * Server-only cookie definition. Returned when httpOnly is true or omitted.
+ * Client methods are absent from the type — accessing them is a TS error.
+ */
+export interface ServerOnlyCookieDefinition<T> {
     readonly name: string;
-    /** The resolved cookie options (without codec). */
     readonly options: CookieOptions;
-    /** The codec used for parsing/serializing. */
     readonly codec: CookieCodec<T>;
-    /** Server: read the typed value from the current request. */
-    getCookie(): Promise<T>;
-    /** Server: set the typed value on the response. */
-    setCookie(value: T): Promise<void>;
-    /** Server: delete the cookie. */
-    deleteCookie(): Promise<void>;
+    /** Read the typed value. Sync, isomorphic (server + client). */
+    get(): T;
+    /** Set the typed value. Sync, isomorphic (server + client). */
+    set(value: T): void;
+    /** Delete the cookie. Sync, isomorphic (server + client). */
+    delete(): void;
+}
+/**
+ * Full cookie definition with client methods. Returned when httpOnly: false.
+ */
+export interface CookieDefinition<T> extends ServerOnlyCookieDefinition<T> {
     /** Client: React hook for reading/writing this cookie. Returns [value, setter, deleter]. */
     useCookie(): [T, (value: T) => void, () => void];
 }
+/** Server-side cookie impl: reads from ALS-backed cookie jar. */
+export interface ServerCookieImpl {
+    getCookieJar(): {
+        get(name: string): string | undefined;
+        set(name: string, value: string, options?: CookieOptions): void;
+        delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
+    };
+}
+/** Client-side cookie impl: reads/writes document.cookie via useCookie hook. */
+export interface ClientCookieImpl {
+    useCookie(name: string, options?: ClientCookieOptions): [string | undefined, (value: string, options?: ClientCookieOptions) => void, () => void];
+    getCookieValue(name: string): string | undefined;
+    setCookieValue(name: string, value: string, options?: ClientCookieOptions): void;
+    deleteCookieValue(name: string, options?: ClientCookieOptions): void;
+}
+/**
+ * Register the server-side cookie implementation.
+ * Called by server entry at module load time.
+ * @internal
+ */
+export declare function _registerServerCookieImpl(impl: ServerCookieImpl): void;
+/**
+ * Register the client-side cookie implementation.
+ * Called by client entry at module load time.
+ * @internal
+ */
+export declare function _registerClientCookieImpl(impl: ClientCookieImpl): void;
+/**
+ * Register the fromSchema bridge function.
+ * Called by server/client entry at module load time.
+ * @internal
+ */
+export declare function _registerFromSchema(fn: (schema: StandardSchemaV1<unknown>) => CookieCodec<unknown>): void;
 /**
  * Register the client cookie module. Called by the client entry to wire
  * up the lazy reference without a top-level import.
@@ -61,22 +106,29 @@ export declare function _registerUseCookieModule(mod: typeof import('../client/u
  *
  * ```ts
  * import { defineCookie } from '@timber-js/app/cookies';
- * import { fromSchema } from '@timber-js/app/codec';
  * import { z } from 'zod/v4';
  *
+ * // httpOnly: false — client methods available
  * export const themeCookie = defineCookie('theme', {
- *   codec: fromSchema(z.enum(['light', 'dark', 'system']).default('system')),
+ *   codec: z.enum(['light', 'dark', 'system']).default('system'),
  *   httpOnly: false,
  *   maxAge: 60 * 60 * 24 * 365,
  * });
  *
- * // Server
- * const theme = await themeCookie.getCookie();
- * await themeCookie.setCookie('dark');
+ * // Server or client
+ * const theme = themeCookie.get();
+ * themeCookie.set('dark');
  *
- * // Client
+ * // Client hook
  * const [theme, setTheme] = themeCookie.useCookie();
+ *
+ * // httpOnly: true (default) — server-only, no client methods
+ * export const sessionCookie = defineCookie('session', {
+ *   codec: z.string(),
+ * });
+ * sessionCookie.get();       // works on server
+ * sessionCookie.useCookie(); // TS error — httpOnly cookie
  * ```
  */
-export declare function defineCookie<T>(name: string, options: DefineCookieOptions<T>): CookieDefinition<T>;
+export declare function defineCookie<T, HttpOnly extends boolean = true>(name: string, options: DefineCookieOptions<T, HttpOnly>): HttpOnly extends false ? CookieDefinition<T> : ServerOnlyCookieDefinition<T>;
 //# sourceMappingURL=define-cookie.d.ts.map

package/dist/cookies/define-cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-cookie.d.ts","sourceRoot":"","sources":["../../src/cookies/define-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAEtC,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB,CAAC,CAAC,CAAE,SAAQ,aAAa;IAC3D,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,uBAAuB;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,6DAA6D;IAC7D,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,mDAAmD;IACnD,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,iCAAiC;IACjC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;CAClD;AAyBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,cAAc,yBAAyB,CAAC,GAAG,IAAI,CAE5F;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC9B,gBAAgB,CAAC,CAAC,CAAC,CAmErB"}
+{"version":3,"file":"define-cookie.d.ts","sourceRoot":"","sources":["../../src/cookies/define-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAInE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAEtC,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,OAAO,CAAE,SAAQ,aAAa;IAC/F;;;;OAIG;IACH,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,GAAG,IAAI,CAAC,CAAC;IACT,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,6DAA6D;IAC7D,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IACxE,4FAA4F;IAC5F,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;CAClD;AAQD,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,YAAY,IAAI;QACd,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACtC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;KAC9E,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,mBAAmB,GAC5B,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;IAC5F,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACjF,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACtE;AAMD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,GAC9D,IAAI,CAEN;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,cAAc,yBAAyB,CAAC,GAAG,IAAI,CAmC5F;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,IAAI,EAC7D,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,CAAC,CAAC,EAAE,QAAQ,CAAC,GACxC,QAAQ,SAAS,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAmI9E"}

package/dist/cookies/index.d.ts

@@ -1,3 +1,4 @@
 export { defineCookie } from './define-cookie.js';
-export type { CookieDefinition, CookieCodec, DefineCookieOptions } from './define-cookie.js';
+export type { CookieDefinition, ServerOnlyCookieDefinition, CookieCodec, DefineCookieOptions, } from './define-cookie.js';
+export { jsonCookieCodec } from './json-cookie.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cookies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,WAAW,EACX,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cookies/index.js

@@ -1,2 +1,48 @@
-import { n as defineCookie } from "../_chunks/define-cookie-BowvzoP0.js";
-export { defineCookie };
+import { i as defineCookie } from "../_chunks/define-cookie-BjpIt4UC.js";
+//#region src/cookies/json-cookie.ts
+/**
+* Build a CookieCodec that JSON-encodes the value. The framework's
+* cookie write path then URL-encodes the JSON string into a valid
+* `cookie-octet` form, and the read path reverses both transforms.
+*
+* @param defaultValue - Returned by `parse` when the cookie is missing
+*   or the stored value cannot be JSON-parsed. Optional — if omitted,
+*   `parse` returns `undefined` on missing/malformed input.
+*
+*   The default is **deep-cloned** on every fallback return via
+*   `structuredClone`, so mutating the parsed result in one request
+*   cannot leak into later requests that fall back to the same
+*   default. This matters for long-lived server processes where a
+*   codec is defined once at module load and shared across all
+*   requests — without the clone, a user doing
+*   `const prefs = prefsCookie.get(); prefs.lang = 'fr'` on a missing
+*   cookie would mutate the module-level default and poison every
+*   later fallback. See the "shared mutable default" regression test
+*   in `tests/define-cookie.test.ts`.
+*/
+function jsonCookieCodec(defaultValue) {
+	const cloneDefault = () => {
+		if (defaultValue === void 0 || defaultValue === null) return defaultValue;
+		return structuredClone(defaultValue);
+	};
+	return {
+		parse(value) {
+			if (value === void 0 || value === "") return cloneDefault();
+			const raw = Array.isArray(value) ? value[value.length - 1] : value;
+			if (raw === void 0 || raw === "") return cloneDefault();
+			try {
+				return JSON.parse(raw);
+			} catch {
+				return cloneDefault();
+			}
+		},
+		serialize(value) {
+			if (value === null || value === void 0) return null;
+			return JSON.stringify(value);
+		}
+	};
+}
+//#endregion
+export { defineCookie, jsonCookieCodec };
+
+//# sourceMappingURL=index.js.map

package/dist/cookies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/cookies/json-cookie.ts"],"sourcesContent":["/**\n * jsonCookieCodec — Codec helper for storing JSON-serializable values in\n * cookies.\n *\n * The codec is intentionally minimal: `JSON.stringify` on serialize,\n * `JSON.parse` on parse. The framework handles the URL encoding /\n * decoding around it (see design/29-cookies.md §\"Encoding Contract\"):\n *\n *     defineCookie.setCookie(value)\n *       → codec.serialize: JSON.stringify       → '{\"a\":1}'\n *       → cookies().set: encodeURIComponent     → '%7B%22a%22%3A1%7D'\n *       → wire: Set-Cookie: prefs=%7B%22a%22%3A1%7D\n *\n *     defineCookie.getCookie()\n *       → wire: Cookie: prefs=%7B%22a%22%3A1%7D\n *       → parseCookieHeader: decodeURIComponent → '{\"a\":1}'\n *       → codec.parse: JSON.parse               → { a: 1 }\n *\n * The same chain works on the client: `useCookie` auto-encodes on writes\n * and auto-decodes on reads, so `jsonCookieCodec` composes with both the\n * server `defineCookie` methods and the client `useCookie` hook with no\n * environment-specific branches.\n *\n * Parsing is total: any non-JSON value (or `undefined`) returns the\n * supplied default. This matches the \"never crash on user-controlled\n * cookie input\" semantics that `fromSchema` uses for typed search params.\n *\n * ```ts\n * import { defineCookie, jsonCookieCodec } from '@timber-js/app/cookies';\n *\n * interface Prefs { lang: string; fontSize: number }\n *\n * export const prefsCookie = defineCookie('prefs', {\n *   codec: jsonCookieCodec<Prefs>({ lang: 'en', fontSize: 16 }),\n *   httpOnly: false,\n *   maxAge: 60 * 60 * 24 * 365,\n * });\n *\n * await prefsCookie.setCookie({ lang: 'fr', fontSize: 18 });\n * ```\n */\n\nimport type { Codec } from '../codec.js';\n\n/**\n * Build a CookieCodec that JSON-encodes the value. The framework's\n * cookie write path then URL-encodes the JSON string into a valid\n * `cookie-octet` form, and the read path reverses both transforms.\n *\n * @param defaultValue - Returned by `parse` when the cookie is missing\n *   or the stored value cannot be JSON-parsed. Optional — if omitted,\n *   `parse` returns `undefined` on missing/malformed input.\n *\n *   The default is **deep-cloned** on every fallback return via\n *   `structuredClone`, so mutating the parsed result in one request\n *   cannot leak into later requests that fall back to the same\n *   default. This matters for long-lived server processes where a\n *   codec is defined once at module load and shared across all\n *   requests — without the clone, a user doing\n *   `const prefs = prefsCookie.get(); prefs.lang = 'fr'` on a missing\n *   cookie would mutate the module-level default and poison every\n *   later fallback. See the \"shared mutable default\" regression test\n *   in `tests/define-cookie.test.ts`.\n */\nexport function jsonCookieCodec<T>(defaultValue?: T): Codec<T> {\n  // Resolve the fallback at call time, not capture time, so every\n  // fallback return produces a fresh deep copy. structuredClone handles\n  // nested objects, arrays, dates, maps, sets — everything\n  // JSON-serializable plus more. For primitives and undefined,\n  // structuredClone is effectively a no-op.\n  const cloneDefault = (): T => {\n    if (defaultValue === undefined || defaultValue === null) {\n      return defaultValue as T;\n    }\n    // structuredClone is a Node built-in since Node 17, available in\n    // all supported runtimes.\n    return structuredClone(defaultValue);\n  };\n\n  return {\n    parse(value: string | string[] | undefined): T {\n      if (value === undefined || value === '') {\n        return cloneDefault();\n      }\n      // Cookies are single-valued by name; defensively pick the last\n      // entry if a Codec consumer somehow passes an array.\n      const raw = Array.isArray(value) ? value[value.length - 1] : value;\n      if (raw === undefined || raw === '') {\n        return cloneDefault();\n      }\n      try {\n        return JSON.parse(raw) as T;\n      } catch {\n        return cloneDefault();\n      }\n    },\n\n    serialize(value: T): string | null {\n      if (value === null || value === undefined) {\n        return null;\n      }\n      return JSON.stringify(value);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgEA,SAAgB,gBAAmB,cAA4B;CAM7D,MAAM,qBAAwB;AAC5B,MAAI,iBAAiB,KAAA,KAAa,iBAAiB,KACjD,QAAO;AAIT,SAAO,gBAAgB,aAAa;;AAGtC,QAAO;EACL,MAAM,OAAyC;AAC7C,OAAI,UAAU,KAAA,KAAa,UAAU,GACnC,QAAO,cAAc;GAIvB,MAAM,MAAM,MAAM,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAS,KAAK;AAC7D,OAAI,QAAQ,KAAA,KAAa,QAAQ,GAC/B,QAAO,cAAc;AAEvB,OAAI;AACF,WAAO,KAAK,MAAM,IAAI;WAChB;AACN,WAAO,cAAc;;;EAIzB,UAAU,OAAyB;AACjC,OAAI,UAAU,QAAQ,UAAU,KAAA,EAC9B,QAAO;AAET,UAAO,KAAK,UAAU,MAAM;;EAE/B"}

package/dist/cookies/json-cookie.d.ts

@@ -0,0 +1,64 @@
+/**
+ * jsonCookieCodec — Codec helper for storing JSON-serializable values in
+ * cookies.
+ *
+ * The codec is intentionally minimal: `JSON.stringify` on serialize,
+ * `JSON.parse` on parse. The framework handles the URL encoding /
+ * decoding around it (see design/29-cookies.md §"Encoding Contract"):
+ *
+ *     defineCookie.setCookie(value)
+ *       → codec.serialize: JSON.stringify       → '{"a":1}'
+ *       → cookies().set: encodeURIComponent     → '%7B%22a%22%3A1%7D'
+ *       → wire: Set-Cookie: prefs=%7B%22a%22%3A1%7D
+ *
+ *     defineCookie.getCookie()
+ *       → wire: Cookie: prefs=%7B%22a%22%3A1%7D
+ *       → parseCookieHeader: decodeURIComponent → '{"a":1}'
+ *       → codec.parse: JSON.parse               → { a: 1 }
+ *
+ * The same chain works on the client: `useCookie` auto-encodes on writes
+ * and auto-decodes on reads, so `jsonCookieCodec` composes with both the
+ * server `defineCookie` methods and the client `useCookie` hook with no
+ * environment-specific branches.
+ *
+ * Parsing is total: any non-JSON value (or `undefined`) returns the
+ * supplied default. This matches the "never crash on user-controlled
+ * cookie input" semantics that `fromSchema` uses for typed search params.
+ *
+ * ```ts
+ * import { defineCookie, jsonCookieCodec } from '@timber-js/app/cookies';
+ *
+ * interface Prefs { lang: string; fontSize: number }
+ *
+ * export const prefsCookie = defineCookie('prefs', {
+ *   codec: jsonCookieCodec<Prefs>({ lang: 'en', fontSize: 16 }),
+ *   httpOnly: false,
+ *   maxAge: 60 * 60 * 24 * 365,
+ * });
+ *
+ * await prefsCookie.setCookie({ lang: 'fr', fontSize: 18 });
+ * ```
+ */
+import type { Codec } from '../codec.js';
+/**
+ * Build a CookieCodec that JSON-encodes the value. The framework's
+ * cookie write path then URL-encodes the JSON string into a valid
+ * `cookie-octet` form, and the read path reverses both transforms.
+ *
+ * @param defaultValue - Returned by `parse` when the cookie is missing
+ *   or the stored value cannot be JSON-parsed. Optional — if omitted,
+ *   `parse` returns `undefined` on missing/malformed input.
+ *
+ *   The default is **deep-cloned** on every fallback return via
+ *   `structuredClone`, so mutating the parsed result in one request
+ *   cannot leak into later requests that fall back to the same
+ *   default. This matters for long-lived server processes where a
+ *   codec is defined once at module load and shared across all
+ *   requests — without the clone, a user doing
+ *   `const prefs = prefsCookie.get(); prefs.lang = 'fr'` on a missing
+ *   cookie would mutate the module-level default and poison every
+ *   later fallback. See the "shared mutable default" regression test
+ *   in `tests/define-cookie.test.ts`.
+ */
+export declare function jsonCookieCodec<T>(defaultValue?: T): Codec<T>;
+//# sourceMappingURL=json-cookie.d.ts.map

package/dist/cookies/json-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-cookie.d.ts","sourceRoot":"","sources":["../../src/cookies/json-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAwC7D"}

package/dist/cookies/validation.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Cookie name and value validation per RFC 6265 §4.1.1.
+ *
+ * This module is pure — no server or client imports — so it can be loaded
+ * by both `server/request-context.ts` (which guards `getCookies().set()`)
+ * and `client/use-cookie.ts` (which guards `useCookie()`'s setter). The
+ * shared validator gives both sides identical encoding contracts:
+ * **the framework never silently encodes — callers emit `cookie-octet`
+ * bytes or get a developer-facing error.**
+ *
+ * Why this matters: see ONGOING_SECURITY.md H-3 (TIM-868) and
+ * design/29-cookies.md §"Cookie Name and Value Validation".
+ */
+/**
+ * Validate a cookie name against RFC 6265 §4.1.1 / RFC 7230 token rules.
+ * Throws a developer-facing error naming the offending byte and its index.
+ */
+export declare function assertValidCookieName(name: string): void;
+/**
+ * Validate a cookie value against the RFC 6265 §4.1.1 `cookie-value`
+ * production:
+ *
+ *     cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+ *     cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+ *
+ * Both the bare `*cookie-octet` form and the DQUOTE-wrapped form are
+ * valid. The wrapped form is common in upstream `Set-Cookie` headers
+ * (e.g. `sid="abc"; Path=/`) and must be forwardable through
+ * `setFromHeaders` verbatim — stripping or rejecting the surrounding
+ * quotes would corrupt the on-the-wire bytes and break value semantics
+ * for the upstream service.
+ *
+ * Excluded bytes (in either form): CTL, whitespace (CR/LF/TAB/SP),
+ * interior DQUOTE, comma, semicolon, backslash, DEL, and anything
+ * non-ASCII. The smuggling primitive (`;`) is rejected regardless of
+ * wrapping.
+ *
+ * Throws a developer-facing error naming the offending byte and its
+ * index. Callers passing user-controlled data through the default
+ * `set()` path don't need to call this — `set()` auto-encodes via
+ * `encodeURIComponent`, whose output is always valid cookie-octet.
+ * This validator is for the `{ raw: true }` opt-out and for
+ * `setFromHeaders` forwarding.
+ */
+export declare function assertValidCookieValue(name: string, value: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/cookies/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/cookies/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA+BH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAoBxD;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA2BxE"}

package/dist/{plugins/dev-404-page.d.ts → dev-tools/404-page.d.ts}

@@ -12,33 +12,23 @@
  *
  * Design doc: 21-dev-server.md, 07-routing.md
  */
+import type { SegmentNode } from '../routing/types.js';
 interface RouteInfo {
     /** URL path pattern (e.g., "/dashboard/[id]") */
     path: string;
     /** Whether this is a page route or API route handler */
     type: 'page' | 'route';
 }
-/** Minimal segment node shape — matches ManifestSegmentNode. */
-interface SegmentNode {
-    segmentName: string;
-    segmentType: string;
-    urlPath: string;
-    page?: {
-        filePath: string;
-    };
-    route?: {
-        filePath: string;
-    };
-    children: SegmentNode[];
-    slots: Record<string, SegmentNode> | Map<string, SegmentNode>;
-}
 /**
- * Collect all routable paths from the manifest tree.
+ * Collect all routable paths from a route tree (build-time scanner output
+ * or runtime route manifest).
  *
- * Walks the segment tree and collects paths for segments that have
- * a page or route handler.
+ * Wraps the shared `collectLeafRoutes` walker (TIM-848). Includes parallel
+ * slots so the dev 404 page can list slot pages too — they aren't
+ * separately addressable, but they're still useful to know about when
+ * debugging a missing route.
  */
-export declare function collectRoutes(root: SegmentNode): RouteInfo[];
+export declare function collectRoutes<TFile>(root: SegmentNode<TFile>): RouteInfo[];
 /**
  * Find routes similar to the requested path.
  *
@@ -53,4 +43,4 @@ export declare function findSimilarRoutes(requestedPath: string, routes: RouteIn
  */
 export declare function generateDev404Page(requestedPath: string, routes: RouteInfo[]): string;
 export {};
-//# sourceMappingURL=dev-404-page.d.ts.map
+//# sourceMappingURL=404-page.d.ts.map

package/dist/dev-tools/404-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"404-page.d.ts","sourceRoot":"","sources":["../../src/dev-tools/404-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD,UAAU,SAAS;IACjB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAQ1E;AAmCD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAezF;AAQD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAiFrF"}

package/dist/{plugins/dev-browser-logs.d.ts → dev-tools/browser-logs.d.ts}

@@ -81,4 +81,4 @@ export declare function generateClientScript(threshold: BrowserLogLevel | 'none'
  * Only active during `vite dev` (apply: 'serve').
  */
 export declare function timberDevBrowserLogs(ctx: PluginContext): Plugin;
-//# sourceMappingURL=dev-browser-logs.d.ts.map
+//# sourceMappingURL=browser-logs.d.ts.map

package/dist/dev-tools/browser-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-logs.d.ts","sourceRoot":"","sources":["../../src/dev-tools/browser-logs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,6CAA6C;AAC7C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gDAAgD;IAChD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AA6BD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAsBnE;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,eAAe,GAAG,MAAM,GAClC,OAAO,CAGT;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMzE;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAgEhF;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA6D/D"}

package/dist/{plugins/dev-error-page.d.ts → dev-tools/error-page.d.ts}

@@ -13,7 +13,7 @@
  *
  * Design doc: 21-dev-server.md §"Error Overlay"
  */
-import { type ErrorPhase } from './dev-error-overlay.js';
+import { type ErrorPhase } from './overlay.js';
 /**
  * HMR connection options for the dev error page auto-reload WebSocket.
  * Derived from Vite's resolved server config so the error page can
@@ -55,4 +55,4 @@ export declare function extractHmrOptions(config: {
  * - Auto-reconnect script that watches for Vite HMR and reloads
  */
 export declare function generateDevErrorPage(error: Error, phase: ErrorPhase, projectRoot: string, hmrOptions?: DevErrorHmrOptions): string;
-//# sourceMappingURL=dev-error-page.d.ts.map
+//# sourceMappingURL=error-page.d.ts.map

package/dist/dev-tools/error-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-page.d.ts","sourceRoot":"","sources":["../../src/dev-tools/error-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AA8EtB;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAeD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAA;KAAE,CAAC;IAChG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,kBAAkB,GAAG,SAAS,CAkBjC;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,kBAAkB,GAC9B,MAAM,CAoIR"}

package/dist/{server/dev-holding-server.d.ts → dev-tools/holding-server.d.ts}

@@ -36,9 +36,11 @@ export interface HoldingServer {
  *
  * Usage (inside Vite plugin):
  * ```ts
- * // In config() hook — earliest point where port is known
+ * // In config() hook — earliest point where port is known.
+ * // Use bindWithBump() to honor the default-3000 + auto-bump policy
+ * // (see ../server/port-resolution.ts and TIM-842).
  * const holding = createHoldingServer();
- * holding.listen(config.server?.port ?? 5173);
+ * await bindWithBump((p) => holding.listen(p), { startPort: 3000, autoBump: true });
  *
  * // In last plugin's configureServer() — wrap listen for seamless handoff
  * const originalListen = server.listen.bind(server);
@@ -49,4 +51,4 @@ export interface HoldingServer {
  * ```
  */
 export declare function createHoldingServer(): HoldingServer;
-//# sourceMappingURL=dev-holding-server.d.ts.map
+//# sourceMappingURL=holding-server.d.ts.map

package/dist/dev-tools/holding-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holding-server.d.ts","sourceRoot":"","sources":["../../src/dev-tools/holding-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtC,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA8ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAmDnD"}

package/dist/dev-tools/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Dev tools barrel — re-exports all dev-only modules.
+ *
+ * Organized by concern, not by Vite plugin vs server module:
+ * - stack-classifier: frame classification for error display
+ * - overlay: Vite browser error overlay integration
+ * - error-page: self-contained HTML 500 page
+ * - 404-page: self-contained HTML 404 page
+ * - terminal: boxed terminal error output
+ * - logger: structured request tree logger
+ * - warnings: dev-mode footgun warnings
+ * - browser-logs: forward browser console to server
+ * - logs: forward server console to browser
+ * - holding-server: startup holding server
+ * - instrumentation: fetch tracing + OTEL span processor
+ *
+ * Dev-only: all modules in this subtree are only active during `vite dev`.
+ * They are never included in production builds.
+ */
+export { classifyFrame, classifyStack, type FrameType, type ClassifiedFrame, } from './stack-classifier.js';
+export { sendErrorToOverlay, fixErrorStacktrace, classifyErrorPhase, extractComponentStack, parseFirstAppFrame, calculateModuleRunnerOffset, formatRscDebugContext, formatTerminalError, PHASE_LABELS, type ErrorPhase, type RscDebugComponentInfo, } from './overlay.js';
+export { generateDevErrorPage, extractHmrOptions, type DevErrorHmrOptions } from './error-page.js';
+export { generateDev404Page, collectRoutes, findSimilarRoutes } from './404-page.js';
+export { formatTerminalError as formatTerminalErrorDirect } from './terminal.js';
+export { formatSpanTree, formatSpanSummary, formatJson, resolveLogMode, type DevLogMode, type DevLoggerConfig, } from './logger.js';
+export { warnSuspenseWrappingChildren, warnDenyInSuspense, warnRedirectInSuspense, warnRedirectInAccess, warnStaticRequestApi, warnSlowSlotWithoutSuspense, setViteServer, WarningId, type DevWarningConfig, _resetWarnings, _getEmitted, } from './warnings.js';
+export { timberDevBrowserLogs, type BrowserLogLevel, type DevBrowserLogsConfig, } from './browser-logs.js';
+export { timberDevLogs } from './logs.js';
+export { createHoldingServer, type HoldingServer } from './holding-server.js';
+export { instrumentDevFetch, DevSpanProcessor, type DevFetchCleanup } from './instrumentation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/dev-tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev-tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,EAAE,mBAAmB,IAAI,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAC3B,aAAa,EACb,SAAS,EACT,KAAK,gBAAgB,EACrB,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/{server/dev-span-processor.d.ts → dev-tools/instrumentation.d.ts}

@@ -1,3 +1,28 @@
+/**
+ * Dev-mode OTEL instrumentation — fetch tracing and span processing.
+ *
+ * Combines two concerns:
+ * 1. Fetch instrumentation: patches globalThis.fetch to create OTEL spans
+ *    for every fetch call, giving visibility into async data fetching in
+ *    the dev request log tree.
+ * 2. Span processing: collects completed spans per-request and drives
+ *    dev log output when the root span ends.
+ *
+ * Only activated in dev mode — zero overhead in production.
+ *
+ * Design ref: 17-logging.md §"Dev Logging", 21-dev-server.md §"Dev Logging"
+ */
+import type { SpanProcessor, ReadableSpan } from '@opentelemetry/sdk-trace-base';
+import type { Span, Context } from '@opentelemetry/api';
+import { type DevLoggerConfig } from './logger.js';
+export type DevFetchCleanup = () => void;
+/**
+ * Patch globalThis.fetch to wrap every call in an OTEL span.
+ *
+ * Returns a cleanup function that restores the original fetch.
+ * Only call this in dev mode.
+ */
+export declare function instrumentDevFetch(): DevFetchCleanup;
 /**
  * DevSpanProcessor — Custom OTEL SpanProcessor that drives dev log output.
  *
@@ -9,12 +34,7 @@
  * This replaces the old DevLogEmitter/DevLogEvents system. OTEL spans are
  * now the single source of truth for dev logging — no more parallel event
  * systems that can drift.
- *
- * Design doc: 17-logging.md §"Dev Logging", 21-dev-server.md §"Dev Logging"
  */
-import type { SpanProcessor, ReadableSpan } from '@opentelemetry/sdk-trace-base';
-import type { Span, Context } from '@opentelemetry/api';
-import { type DevLoggerConfig } from './dev-logger.js';
 export declare class DevSpanProcessor implements SpanProcessor {
     private spansByTrace;
     private mode;
@@ -26,4 +46,4 @@ export declare class DevSpanProcessor implements SpanProcessor {
     shutdown(): Promise<void>;
     forceFlush(): Promise<void>;
 }
-//# sourceMappingURL=dev-span-processor.d.ts.map
+//# sourceMappingURL=instrumentation.d.ts.map

package/dist/dev-tools/instrumentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/dev-tools/instrumentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CA+CpD;AA4BD;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IACpD,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,IAAI,CAAa;IACzB,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,eAAe;IAKnC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAI7C,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAqB/B,OAAO,CAAC,MAAM;IAUR,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}

package/dist/{server/dev-logger.d.ts → dev-tools/logger.d.ts}

@@ -41,4 +41,4 @@ export declare function formatSpanSummary(spans: ReadableSpan[], _config?: DevLo
  * to jq or feeding into external trace analysis tools.
  */
 export declare function formatJson(spans: ReadableSpan[]): string;
-//# sourceMappingURL=dev-logger.d.ts.map
+//# sourceMappingURL=logger.d.ts.map

package/dist/dev-tools/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/dev-tools/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAIlE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,UAAU,CAMnE;AAID;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAgDtF;AAyGD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,CAc1F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,CA6BxD"}

package/dist/{plugins/dev-logs.d.ts → dev-tools/logs.d.ts}

@@ -43,4 +43,4 @@ export declare function isFrameworkInternalCaller(): boolean;
  * when the server closes. Only active during `vite dev`.
  */
 export declare function timberDevLogs(_ctx: PluginContext): Plugin;
-//# sourceMappingURL=dev-logs.d.ts.map
+//# sourceMappingURL=logs.d.ts.map

package/dist/dev-tools/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/dev-tools/logs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAIzE,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AA2ID;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAsBnD;AAoDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAiBzD"}

package/dist/{plugins/dev-error-overlay.d.ts → dev-tools/overlay.d.ts}

@@ -19,15 +19,7 @@ import type { ViteDevServer } from 'vite';
 export type ErrorPhase = 'module-transform' | 'proxy' | 'middleware' | 'access' | 'render' | 'handler';
 /** Labels for terminal output. */
 export declare const PHASE_LABELS: Record<ErrorPhase, string>;
-export type FrameType = 'app' | 'framework' | 'internal';
-/**
- * Classify a stack frame line by origin.
- *
- * - 'app': user application code (in project root, not node_modules)
- * - 'framework': timber-app internal code
- * - 'internal': node_modules, Node.js internals
- */
-export declare function classifyFrame(frameLine: string, projectRoot: string): FrameType;
+export { classifyFrame, classifyStack, type FrameType, type ClassifiedFrame } from './stack-classifier.js';
 /**
  * Extract the React component stack from an error, if present.
  * React attaches this as `componentStack` during renderToReadableStream errors.
@@ -48,7 +40,7 @@ export declare function parseFirstAppFrame(stack: string, projectRoot: string):
  * Falls back to 'render' if no specific phase can be determined.
  */
 export declare function classifyErrorPhase(error: Error, projectRoot: string): ErrorPhase;
-import { formatTerminalError as _formatTerminalError } from './dev-terminal-error.js';
+import { formatTerminalError as _formatTerminalError } from './terminal.js';
 export declare const formatTerminalError: typeof _formatTerminalError;
 /**
  * Component info extracted from the RSC debug channel.
@@ -96,5 +88,4 @@ export declare function fixErrorStacktrace(server: ViteDevServer, error: Error,
  * The dev server remains running — errors are handled, not fatal.
  */
 export declare function sendErrorToOverlay(server: ViteDevServer, error: Error, phase: ErrorPhase, projectRoot: string, rscDebugComponents?: RscDebugComponentInfo[]): void;
-export {};
-//# sourceMappingURL=dev-error-overlay.d.ts.map
+//# sourceMappingURL=overlay.d.ts.map