@warlock.js/web 5.2.3 → 5.2.4

package/esm/vite/gate-c-verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"gate-c-verify.mjs","names":[],"sources":["../../../../../../../web/src/vite/gate-c-verify.ts"],"sourcesContent":["/**\r\n * Gate C — emitted-output verification.\r\n *\r\n * Projection removes the six server exports before the client graph forms.\r\n * Gate A refuses forbidden import PATHS. Gate B refuses inline secret reads.\r\n * All three act BEFORE or DURING the build, on source or the module graph —\r\n * none of them ever looks at what actually came out the other end. Gate C\r\n * is that check: a build-time assertion on the EMITTED client bundle for\r\n * every page, verifying:\r\n *\r\n *   1. The emitted code contains none of the six server export names\r\n *      (`route`, `middleware`, `validation`, `loader`, `metadata`, `prefix`) as a\r\n *      top-level binding, exported or not — `findLeakedServerExports`.\r\n *   2. The emitted module graph (Rollup's `OutputBundle`, as seen in\r\n *      `generateBundle`) contains no import edge into a\r\n *      `warlock.environment: \"server\"` (or absent-defaulting-to-server)\r\n *      package — re-derived from the exact classifier Gate A uses\r\n *      (`gate-a-resolve.ts`'s `createEnvironmentClassifier`), never a second,\r\n *      independently-drifting classification scheme — `findLeakedServerImportEdges`.\r\n *\r\n * This is defense in depth: if projection or Gate A has a bug that lets\r\n * something through, Gate C is what turns \"shipped a leak\" into \"build\r\n * fails.\" Both check functions are exported as PURE functions over a bundle\r\n * object precisely so a test can construct a bundle where projection/Gate A\r\n * are bypassed entirely (a hand-built leaked chunk, never produced by a real\r\n * pipeline run) and still prove Gate C catches it independently — re-running\r\n * the D.1-D.5 happy-path fixtures through the composed pipeline only proves\r\n * the happy path, never that Gate C itself has teeth.\r\n *\r\n * Gate C also emits the inlined-`PUBLIC_*`-value manifest — see\r\n * `buildPublicEnvManifest` below — and is the only\r\n * one of the three gates that runs exclusively at `generateBundle` time: it\r\n * has nothing to say about source, only about output.\r\n */\r\nimport { parse } from \"@babel/parser\";\r\nimport type { Plugin } from \"vite\";\r\nimport {\r\n  createEnvironmentClassifier,\r\n  type EnvironmentClassifier,\r\n  type EnvironmentClassifierOptions,\r\n} from \"./gate-a-resolve\";\r\nimport { createPublicEnvTracker, type PublicEnvTracker } from \"./gate-b-secrets\";\r\nimport { SERVER_EXPORT_NAMES } from \"./projection\";\r\n\r\nexport interface ServerExportLeak {\r\n  fileName: string;\r\n  exportName: string;\r\n  line?: number;\r\n}\r\n\r\nexport interface ServerImportEdgeLeak {\r\n  fileName: string;\r\n  moduleId: string;\r\n  packageName: string;\r\n}\r\n\r\nexport interface PublicEnvManifestEntry {\r\n  key: string;\r\n  /** `null` when `redacted` is true — see `isSafeToShowValue`. */\r\n  value: string | null;\r\n  redacted: boolean;\r\n}\r\n\r\n/**\r\n * A structurally-minimal view of Rollup's `OutputBundle` — only the fields\r\n * Gate C actually reads. Deliberately NOT the real `OutputBundle`/`OutputChunk`\r\n * types: Part 1's own discipline requires proving Gate C catches a bundle\r\n * that a real pipeline could never produce (a hand-built leaked chunk), and\r\n * forcing every test fixture to satisfy Rollup's full chunk shape would\r\n * fight that requirement for no safety benefit — Vite's real `generateBundle`\r\n * hook still hands Gate C a real `OutputBundle`, which is a structural\r\n * superset of this.\r\n */\r\ntype BundleLike = Record<\r\n  string,\r\n  {\r\n    type?: string;\r\n    fileName?: string;\r\n    code?: string;\r\n    moduleIds?: readonly string[];\r\n  }\r\n>;\r\n\r\n/**\r\n * Recursively collects every top-level statement's bound name(s), matching:\r\n *   - `const route = ...` / `function loader() {}` (exported or not — the\r\n *     check is on top-level BINDINGS, not top-level exports).\r\n *   - `export const route = ...` / `export function loader() {}` (the\r\n *     `ExportNamedDeclaration` wrapper form).\r\n *   - `export { route }` (the bare re-export-specifier form Rollup sometimes\r\n *     emits instead of inlining the declaration itself).\r\n */\r\nfunction collectServerExportNames(stmt: any): Array<{ name: string; line: number }> {\r\n  const matches: Array<{ name: string; line: number }> = [];\r\n  const line = stmt.loc?.start?.line as number | undefined;\r\n\r\n  function record(name: string | undefined) {\r\n    if (name && SERVER_EXPORT_NAMES.has(name)) matches.push({ name, line: line ?? 0 });\r\n  }\r\n\r\n  if (stmt.type === \"VariableDeclaration\") {\r\n    for (const decl of stmt.declarations) {\r\n      if (decl.id?.type === \"Identifier\") record(decl.id.name);\r\n    }\r\n  } else if (stmt.type === \"FunctionDeclaration\") {\r\n    record(stmt.id?.name);\r\n  } else if (stmt.type === \"ExportNamedDeclaration\") {\r\n    if (stmt.declaration) matches.push(...collectServerExportNames(stmt.declaration));\r\n    for (const specifier of stmt.specifiers ?? []) {\r\n      record(specifier.exported?.name ?? specifier.exported?.value);\r\n    }\r\n  }\r\n\r\n  return matches;\r\n}\r\n\r\n/**\r\n * Thrown when an emitted chunk cannot be parsed, which means Gate C could not\r\n * inspect it. A gate that skips what it cannot read reports \"no violation\r\n * found\" on precisely the input it failed to look at — the one input where\r\n * that answer is worthless. So an unreadable chunk fails the build instead.\r\n */\r\nexport class UnverifiableChunkError extends Error {\r\n  readonly fileName: string;\r\n\r\n  constructor(fileName: string, cause?: unknown) {\r\n    super(\r\n      [\r\n        `Warlock stopped this build: a file in your client bundle could not be checked for server-only code.`,\r\n        ``,\r\n        `File: ${fileName}`,\r\n        `Cause: this file could not be parsed as JavaScript, so the client/server boundary check could not be performed on it. Warlock cannot confirm that the server-only exports (route, middleware, validation, loader, metadata, prefix) were kept out of it.`,\r\n        `Fix: the build is being stopped rather than passed, because a file that was never checked is not a file known to be safe. This emitted file is outside the JavaScript syntax Warlock can currently verify. Two things commonly put it there, and this error cannot tell which: the output uses syntax newer than the parser Warlock ships with, or a plugin or loader emitted non-standard syntax into the client bundle. Check the compatibility of whatever produced this file, then build again.`,\r\n      ].join(\"\\n\"),\r\n    );\r\n    this.name = \"UnverifiableChunkError\";\r\n    this.fileName = fileName;\r\n    if (cause !== undefined) (this as { cause?: unknown }).cause = cause;\r\n  }\r\n}\r\n\r\n/**\r\n * Part 1, item 1: parses each emitted chunk's ACTUAL code (never pre-transform\r\n * source) and looks for a top-level binding named one of the five server\r\n * exports. A parse failure on an emitted chunk FAILS the gate\r\n * (`UnverifiableChunkError`) — it is never skipped. Skipping would report the\r\n * bundle clean on the one chunk the gate did not actually inspect, which is a\r\n * safety check failing open; a build stopped on an unreadable chunk is\r\n * recoverable, a boundary silently unenforced is not.\r\n *\r\n * This SURVIVES real minification (pinned by the `gate-c-verify.spec.ts`\r\n * \"D.8\" describe block). A minifier (esbuild,\r\n * Vite's default) is only free to rename LOCAL bindings; the exported name\r\n * itself is part of the module's public interface and is never mangled — a\r\n * minified `export const route = ...` still emits `export { e as route }`,\r\n * with the local identifier renamed (`e`) but `route` intact as the specifier's\r\n * `exported` name, which is exactly the field `collectServerExportNames`\r\n * reads for the `ExportNamedDeclaration` specifier form. No name-independent\r\n * redesign needed here — verified against a real `build.minify: true` output,\r\n * not assumed.\r\n */\r\nexport function findLeakedServerExports(bundle: BundleLike): ServerExportLeak[] {\r\n  const leaks: ServerExportLeak[] = [];\r\n\r\n  for (const file of Object.values(bundle)) {\r\n    if (!file || file.type !== \"chunk\" || typeof file.code !== \"string\") continue;\r\n\r\n    let ast: any;\r\n    try {\r\n      ast = parse(file.code, { sourceType: \"module\", plugins: [\"typescript\", \"jsx\"] });\r\n    } catch (error) {\r\n      throw new UnverifiableChunkError(file.fileName ?? \"(unnamed chunk)\", error);\r\n    }\r\n\r\n    for (const stmt of ast.program.body as any[]) {\r\n      for (const match of collectServerExportNames(stmt)) {\r\n        leaks.push({ fileName: file.fileName as string, exportName: match.name, line: match.line });\r\n      }\r\n    }\r\n  }\r\n\r\n  return leaks;\r\n}\r\n\r\n/**\r\n * Part 1, item 2: walks every emitted chunk's `moduleIds` (the resolved,\r\n * absolute file paths of every source module Rollup actually bundled into\r\n * that chunk) and classifies each one via the SAME `EnvironmentClassifier`\r\n * Gate A's `resolveId` uses, re-derived from `gate-a-resolve.ts` rather than\r\n * hand-rolled a second time. A moduleId that maps to a governed-scope\r\n * package classified `\"server\"` is an import edge Gate A should already\r\n * have refused — if it's here anyway, the earlier gate has a bug.\r\n *\r\n * D.8 verdict: this SURVIVES real minification unconditionally, and for a\r\n * stronger reason than item 1 above — it never reads emitted code text or\r\n * identifier names at all. `moduleIds` is Rollup's own bundling metadata\r\n * (which resolved source files ended up in this chunk), untouched by\r\n * minification, which only rewrites code, not that metadata. Verified\r\n * against a real `build.minify: true` output in `gate-c-verify.spec.ts`.\r\n */\r\nexport function findLeakedServerImportEdges(\r\n  bundle: BundleLike,\r\n  classifier: Pick<EnvironmentClassifier, \"environmentOf\" | \"packageNameForFilePath\">,\r\n): ServerImportEdgeLeak[] {\r\n  const leaks: ServerImportEdgeLeak[] = [];\r\n\r\n  for (const file of Object.values(bundle)) {\r\n    if (!file || file.type !== \"chunk\") continue;\r\n\r\n    for (const moduleId of file.moduleIds ?? []) {\r\n      const packageName = classifier.packageNameForFilePath(moduleId);\r\n      if (!packageName) continue;\r\n      if (classifier.environmentOf(packageName) === \"server\") {\r\n        leaks.push({ fileName: file.fileName as string, moduleId, packageName });\r\n      }\r\n    }\r\n  }\r\n\r\n  return leaks;\r\n}\r\n\r\n/**\r\n * Conservative \"does this PUBLIC_* value look safe to print in the reviewable\r\n * manifest\" heuristic: if genuinely unsure, show the key only — never guess\r\n * that a value is safe. The whole point of this manifest is that the `PUBLIC_`\r\n * prefix rule alone is not trustworthy — someone can and will name an actual\r\n * secret `PUBLIC_STRIPE_KEY` — so a value that LOOKS like a credential is\r\n * redacted regardless of what its key is named. Non-string values (booleans,\r\n * numbers) are never secret-shaped and always shown.\r\n */\r\nconst CREDENTIALED_URL_RE = /:\\/\\/[^/\\s]+:[^/\\s@]+@/; // scheme://user:pass@host\r\nconst KNOWN_SECRET_PREFIX_RES = [\r\n  /^sk_(live|test)_/i, // Stripe secret key (pk_ publishable is a different prefix)\r\n  /^rk_(live|test)_/i, // Stripe restricted key\r\n  /^AKIA[0-9A-Z]{12,}/, // AWS access key id\r\n  /^gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub personal/OAuth/user/server tokens\r\n  /^glpat-[A-Za-z0-9_-]{20,}/, // GitLab personal access token\r\n  /^xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack tokens\r\n  /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/, // JWT (3 base64url segments)\r\n];\r\n// A long opaque token made up only of base64url/hex-ish characters, with both\r\n// letters and digits, and no separators a human-authored public value (a\r\n// URL, a short id) would normally contain — conservatively treated as a\r\n// secret-shaped random token even though it might genuinely be safe.\r\nconst HIGH_ENTROPY_TOKEN_RE = /^[A-Za-z0-9+/_=-]{32,}$/;\r\n\r\nfunction isSafeToShowValue(value: unknown): boolean {\r\n  if (typeof value !== \"string\" || value.length === 0) return true;\r\n  if (CREDENTIALED_URL_RE.test(value)) return false;\r\n  if (KNOWN_SECRET_PREFIX_RES.some((re) => re.test(value))) return false;\r\n  if (HIGH_ENTROPY_TOKEN_RE.test(value) && /[0-9]/.test(value) && /[a-zA-Z]/.test(value)) return false;\r\n  return true;\r\n}\r\n\r\nfunction stringifyEnvValue(value: unknown): string {\r\n  if (typeof value === \"string\") return value;\r\n  return JSON.stringify(value) ?? \"undefined\";\r\n}\r\n\r\n/**\r\n * The enumerated, human-reviewable list of\r\n * every `PUBLIC_*` key actually inlined into the client bundle. Built\r\n * directly from `tracker.referencedKeys` — the exact same `Set` Gate B's own\r\n * `generateBundle` unread-key check (`gate-b-secrets.ts`) reads from — so\r\n * this manifest and that exclusion logic agree BY CONSTRUCTION: they are two\r\n * readers of one Set, not two independent recomputations of \"which keys were\r\n * read\" that could drift apart. A key only reaches `referencedKeys` once\r\n * `findViolation` in `gate-b-secrets.ts` has seen a statically-resolved\r\n * `import.meta.env.PUBLIC_X` read for it, which is also precisely the\r\n * condition under which Gate B allows its value to be inlined at all — an\r\n * unread key that somehow leaked in anyway is a Gate B `generateBundle`\r\n * BUILD FAILURE (see `gate-b-secrets.ts`), never silently listed here.\r\n */\r\nexport function buildPublicEnvManifest(tracker: PublicEnvTracker): PublicEnvManifestEntry[] {\r\n  return [...tracker.referencedKeys]\r\n    .sort()\r\n    .map((key) => {\r\n      const value = tracker.declaredEnv[key];\r\n      const safe = isSafeToShowValue(value);\r\n      return { key, value: safe ? stringifyEnvValue(value) : null, redacted: !safe };\r\n    });\r\n}\r\n\r\nexport interface GateCOptions extends EnvironmentClassifierOptions {\r\n  /**\r\n   * Shared with `gateBSecrets({ tracker })` — required for the manifest to\r\n   * reflect what THIS build's Gate B pass actually saw. Defaults to a\r\n   * private, unshared tracker (always empty) if omitted, which is only ever\r\n   * correct when Gate C runs standalone in a test.\r\n   */\r\n  tracker?: PublicEnvTracker;\r\n  /** Defaults to `\"warlock-env-manifest.json\"` (Suki's suggested name). */\r\n  manifestFileName?: string;\r\n}\r\n\r\n/**\r\n * The client-build Vite plugin. Runs only at `generateBundle` — Gate C has\r\n * nothing to say about source, only about the bundle Rollup actually wrote.\r\n * Skipped for the SSR/server build, same as Gate B (`gate-b-secrets.ts`):\r\n * a page's server exports are meant to survive in that build; only the\r\n * client build is judged.\r\n */\r\nexport function gateCVerify(options: GateCOptions = {}): Plugin {\r\n  const classifier = createEnvironmentClassifier(options);\r\n  const tracker = options.tracker ?? createPublicEnvTracker();\r\n  const manifestFileName = options.manifestFileName ?? \"warlock-env-manifest.json\";\r\n\r\n  return {\r\n    name: \"warlock:gate-c-verify\",\r\n    generateBundle(_outputOptions, bundle) {\r\n      if (this.environment?.config?.consumer === \"server\") return;\r\n\r\n      const exportLeak = findLeakedServerExports(bundle)[0];\r\n      if (exportLeak) {\r\n        this.error(\r\n          [\r\n            `Gate C refused a build: a server export survived into the emitted client bundle.`,\r\n            ``,\r\n            `File: ${exportLeak.fileName}${exportLeak.line ? `:${exportLeak.line}` : \"\"}`,\r\n            `Export: ${exportLeak.exportName}`,\r\n            `Cause: \"${exportLeak.exportName}\" is one of the six server exports (route, middleware, validation, loader, metadata, prefix) and is still present as a top-level binding in the EMITTED client chunk — projection and/or Gate A should have removed or refused it before the bundle was written.`,\r\n            `Fix: this should already be impossible if projection and Gate A ran correctly — investigate why \"${exportLeak.exportName}\" reached the emitted output (a projection bug, a build config that bypasses these plugins, or a plugin ordering change) rather than assuming this build is a one-off; Gate C is defense in depth, not the primary fence.`,\r\n          ].join(\"\\n\"),\r\n        );\r\n      }\r\n\r\n      const importEdgeLeak = findLeakedServerImportEdges(bundle, classifier)[0];\r\n      if (importEdgeLeak) {\r\n        this.error(\r\n          [\r\n            `Gate C refused a build: a server-only import edge survived into the emitted client bundle's module graph.`,\r\n            ``,\r\n            `File: ${importEdgeLeak.fileName}`,\r\n            `Module: ${importEdgeLeak.moduleId}`,\r\n            `Cause: \"${importEdgeLeak.moduleId}\" belongs to ${importEdgeLeak.packageName}, a server-only package (it declares \"warlock\": { \"environment\": \"server\" } in its package.json), and is present among the bundled modules of the emitted client chunk \"${importEdgeLeak.fileName}\" — Gate A's resolveId should have refused this import before it ever reached the bundle.`,\r\n            `Fix: this should already be impossible if Gate A ran on this build — investigate why ${importEdgeLeak.packageName} reached the emitted output (a Gate A bypass, a custom resolveId/external override, or a plugin ordering change) rather than assuming this build is a one-off; Gate C is defense in depth, not the primary fence.`,\r\n          ].join(\"\\n\"),\r\n        );\r\n      }\r\n\r\n      const manifest = buildPublicEnvManifest(tracker);\r\n\r\n      // EMITTED through `this.emitFile`, not written into `bundle` by hand.\r\n      //\r\n      // This used to assign a hand-built record directly:\r\n      //\r\n      //     bundle[manifestFileName] = { type: \"asset\", fileName, name, source } as any;\r\n      //\r\n      // and the `as any` was load-bearing, which was the warning sign. A Rollup\r\n      // asset record carries `names` and `originalFileNames` ARRAYS; that object\r\n      // had neither, so it was not the shape Rollup produces — it merely\r\n      // type-asserted its way into the bundle.\r\n      //\r\n      // Nothing noticed until the production build got far enough to render\r\n      // chunks, at which point Vite's own `vite:manifest` plugin read\r\n      // `chunk.names.length` on every asset and died on `undefined`:\r\n      //\r\n      //     [vite:manifest] Cannot read properties of undefined (reading 'length')\r\n      //\r\n      // `emitFile` makes Rollup construct the record, so the shape is correct by\r\n      // construction and stays correct when Rollup adds fields. Hand-building a\r\n      // bundle entry is signing up to track someone else's internal type forever.\r\n      this.emitFile({\r\n        type: \"asset\",\r\n        fileName: manifestFileName,\r\n        source: JSON.stringify(manifest, null, 2),\r\n      });\r\n    },\r\n  };\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,yBAAyB,MAAkD;CAClF,MAAM,UAAiD,CAAC;CACxD,MAAM,OAAO,KAAK,KAAK,OAAO;CAE9B,SAAS,OAAO,MAA0B;EACxC,IAAI,QAAQ,oBAAoB,IAAI,IAAI,GAAG,QAAQ,KAAK;GAAE;GAAM,MAAM,QAAQ;EAAE,CAAC;CACnF;CAEA,IAAI,KAAK,SAAS,uBAChB;OAAK,MAAM,QAAQ,KAAK,cACtB,IAAI,KAAK,IAAI,SAAS,cAAc,OAAO,KAAK,GAAG,IAAI;CACzD,OACK,IAAI,KAAK,SAAS,uBACvB,OAAO,KAAK,IAAI,IAAI;MACf,IAAI,KAAK,SAAS,0BAA0B;EACjD,IAAI,KAAK,aAAa,QAAQ,KAAK,GAAG,yBAAyB,KAAK,WAAW,CAAC;EAChF,KAAK,MAAM,aAAa,KAAK,cAAc,CAAC,GAC1C,OAAO,UAAU,UAAU,QAAQ,UAAU,UAAU,KAAK;CAEhE;CAEA,OAAO;AACT;;;;;;;AAQA,IAAa,yBAAb,cAA4C,MAAM;CAChD,AAAS;CAET,YAAY,UAAkB,OAAiB;EAC7C,MACE;GACE;GACA;GACA,SAAS;GACT;GACA;EACF,EAAE,KAAK,IAAI,CACb;EACA,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,IAAI,UAAU,QAAW,AAAC,KAA6B,QAAQ;CACjE;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,wBAAwB,QAAwC;CAC9E,MAAM,QAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG;EACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,WAAW,OAAO,KAAK,SAAS,UAAU;EAErE,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM;IAAE,YAAY;IAAU,SAAS,CAAC,cAAc,KAAK;GAAE,CAAC;EACjF,SAAS,OAAO;GACd,MAAM,IAAI,uBAAuB,KAAK,YAAY,mBAAmB,KAAK;EAC5E;EAEA,KAAK,MAAM,QAAQ,IAAI,QAAQ,MAC7B,KAAK,MAAM,SAAS,yBAAyB,IAAI,GAC/C,MAAM,KAAK;GAAE,UAAU,KAAK;GAAoB,YAAY,MAAM;GAAM,MAAM,MAAM;EAAK,CAAC;CAGhG;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAgB,4BACd,QACA,YACwB;CACxB,MAAM,QAAgC,CAAC;CAEvC,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG;EACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,SAAS;EAEpC,KAAK,MAAM,YAAY,KAAK,aAAa,CAAC,GAAG;GAC3C,MAAM,cAAc,WAAW,uBAAuB,QAAQ;GAC9D,IAAI,CAAC,aAAa;GAClB,IAAI,WAAW,cAAc,WAAW,MAAM,UAC5C,MAAM,KAAK;IAAE,UAAU,KAAK;IAAoB;IAAU;GAAY,CAAC;EAE3E;CACF;CAEA,OAAO;AACT;;;;;;;;;;AAWA,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAKA,MAAM,wBAAwB;AAE9B,SAAS,kBAAkB,OAAyB;CAClD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,OAAO;CAC5D,IAAI,oBAAoB,KAAK,KAAK,GAAG,OAAO;CAC5C,IAAI,wBAAwB,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,OAAO;CACjE,IAAI,sBAAsB,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,KAAK,WAAW,KAAK,KAAK,GAAG,OAAO;CAC/F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC;;;;;;;;;;;;;;;AAgBA,SAAgB,uBAAuB,SAAqD;CAC1F,OAAO,CAAC,GAAG,QAAQ,cAAc,EAC9B,KAAK,EACL,KAAK,QAAQ;EACZ,MAAM,QAAQ,QAAQ,YAAY;EAClC,MAAM,OAAO,kBAAkB,KAAK;EACpC,OAAO;GAAE;GAAK,OAAO,OAAO,kBAAkB,KAAK,IAAI;GAAM,UAAU,CAAC;EAAK;CAC/E,CAAC;AACL;;;;;;;;AAqBA,SAAgB,YAAY,UAAwB,CAAC,GAAW;CAC9D,MAAM,aAAa,4BAA4B,OAAO;CACtD,MAAM,UAAU,QAAQ,WAAW,uBAAuB;CAC1D,MAAM,mBAAmB,QAAQ,oBAAoB;CAErD,OAAO;EACL,MAAM;EACN,eAAe,gBAAgB,QAAQ;GACrC,IAAI,KAAK,aAAa,QAAQ,aAAa,UAAU;GAErD,MAAM,aAAa,wBAAwB,MAAM,EAAE;GACnD,IAAI,YACF,KAAK,MACH;IACE;IACA;IACA,SAAS,WAAW,WAAW,WAAW,OAAO,IAAI,WAAW,SAAS;IACzE,WAAW,WAAW;IACtB,WAAW,WAAW,WAAW;IACjC,oGAAoG,WAAW,WAAW;GAC5H,EAAE,KAAK,IAAI,CACb;GAGF,MAAM,iBAAiB,4BAA4B,QAAQ,UAAU,EAAE;GACvE,IAAI,gBACF,KAAK,MACH;IACE;IACA;IACA,SAAS,eAAe;IACxB,WAAW,eAAe;IAC1B,WAAW,eAAe,SAAS,eAAe,eAAe,YAAY,0KAA0K,eAAe,SAAS;IAC/Q,wFAAwF,eAAe,YAAY;GACrH,EAAE,KAAK,IAAI,CACb;GAGF,MAAM,WAAW,uBAAuB,OAAO;GAsB/C,KAAK,SAAS;IACZ,MAAM;IACN,UAAU;IACV,QAAQ,KAAK,UAAU,UAAU,MAAM,CAAC;GAC1C,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"gate-c-verify.mjs","names":[],"sources":["../../../../../../../web/src/vite/gate-c-verify.ts"],"sourcesContent":["/**\r\n * Gate C — emitted-output verification.\r\n *\r\n * Projection removes the six server exports before the client graph forms.\r\n * Gate A refuses forbidden import PATHS. Gate B refuses inline secret reads.\r\n * All three act BEFORE or DURING the build, on source or the module graph —\r\n * none of them ever looks at what actually came out the other end. Gate C\r\n * is that check: a build-time assertion on the EMITTED client bundle for\r\n * every page, verifying:\r\n *\r\n *   1. The emitted code contains none of the six server export names\r\n *      (`route`, `middleware`, `validation`, `loader`, `metadata`, `prefix`) as a\r\n *      top-level binding, exported or not — `findLeakedServerExports`.\r\n *   2. The emitted module graph (Rollup's `OutputBundle`, as seen in\r\n *      `generateBundle`) contains no import edge into a\r\n *      `warlock.environment: \"server\"` (or absent-defaulting-to-server)\r\n *      package — re-derived from the exact classifier Gate A uses\r\n *      (`gate-a-resolve.ts`'s `createEnvironmentClassifier`), never a second,\r\n *      independently-drifting classification scheme — `findLeakedServerImportEdges`.\r\n *\r\n * This is defense in depth: if projection or Gate A has a bug that lets\r\n * something through, Gate C is what turns \"shipped a leak\" into \"build\r\n * fails.\" Both check functions are exported as PURE functions over a bundle\r\n * object precisely so a test can construct a bundle where projection/Gate A\r\n * are bypassed entirely (a hand-built leaked chunk, never produced by a real\r\n * pipeline run) and still prove Gate C catches it independently — re-running\r\n * the D.1-D.5 happy-path fixtures through the composed pipeline only proves\r\n * the happy path, never that Gate C itself has teeth.\r\n *\r\n * Gate C also emits the inlined-`PUBLIC_*`-value manifest — see\r\n * `buildPublicEnvManifest` below — and is the only\r\n * one of the three gates that runs exclusively at `generateBundle` time: it\r\n * has nothing to say about source, only about output.\r\n */\r\nimport { parse } from \"@babel/parser\";\r\nimport type { Plugin } from \"vite\";\r\nimport {\r\n  createEnvironmentClassifier,\r\n  type EnvironmentClassifier,\r\n  type EnvironmentClassifierOptions,\r\n} from \"./gate-a-resolve\";\r\nimport { createPublicEnvTracker, type PublicEnvTracker } from \"./gate-b-secrets\";\r\nimport { SERVER_EXPORT_NAMES } from \"./projection\";\r\n\r\nexport interface ServerExportLeak {\r\n  fileName: string;\r\n  exportName: string;\r\n  line?: number;\r\n}\r\n\r\nexport interface ServerImportEdgeLeak {\r\n  fileName: string;\r\n  moduleId: string;\r\n  packageName: string;\r\n}\r\n\r\nexport interface PublicEnvManifestEntry {\r\n  key: string;\r\n  /** `null` when `redacted` is true — see `isSafeToShowValue`. */\r\n  value: string | null;\r\n  redacted: boolean;\r\n}\r\n\r\n/**\r\n * A structurally-minimal view of Rollup's `OutputBundle` — only the fields\r\n * Gate C actually reads. Deliberately NOT the real `OutputBundle`/`OutputChunk`\r\n * types: Part 1's own discipline requires proving Gate C catches a bundle\r\n * that a real pipeline could never produce (a hand-built leaked chunk), and\r\n * forcing every test fixture to satisfy Rollup's full chunk shape would\r\n * fight that requirement for no safety benefit — Vite's real `generateBundle`\r\n * hook still hands Gate C a real `OutputBundle`, which is a structural\r\n * superset of this.\r\n */\r\ntype BundleLike = Record<\r\n  string,\r\n  {\r\n    type?: string;\r\n    fileName?: string;\r\n    code?: string;\r\n    moduleIds?: readonly string[];\r\n  }\r\n>;\r\n\r\n/**\r\n * Recursively collects every top-level statement's bound name(s), matching:\r\n *   - `const route = ...` / `function loader() {}` (exported or not — the\r\n *     check is on top-level BINDINGS, not top-level exports).\r\n *   - `export const route = ...` / `export function loader() {}` (the\r\n *     `ExportNamedDeclaration` wrapper form).\r\n *   - `export { route }` (the bare re-export-specifier form Rollup sometimes\r\n *     emits instead of inlining the declaration itself).\r\n */\r\nfunction collectServerExportNames(stmt: any): Array<{ name: string; line: number }> {\r\n  const matches: Array<{ name: string; line: number }> = [];\r\n  const line = stmt.loc?.start?.line as number | undefined;\r\n\r\n  function record(name: string | undefined) {\r\n    if (name && SERVER_EXPORT_NAMES.has(name)) matches.push({ name, line: line ?? 0 });\r\n  }\r\n\r\n  if (stmt.type === \"VariableDeclaration\") {\r\n    for (const decl of stmt.declarations) {\r\n      if (decl.id?.type === \"Identifier\") record(decl.id.name);\r\n    }\r\n  } else if (stmt.type === \"FunctionDeclaration\") {\r\n    record(stmt.id?.name);\r\n  } else if (stmt.type === \"ExportNamedDeclaration\") {\r\n    if (stmt.declaration) matches.push(...collectServerExportNames(stmt.declaration));\r\n    for (const specifier of stmt.specifiers ?? []) {\r\n      record(specifier.exported?.name ?? specifier.exported?.value);\r\n    }\r\n  }\r\n\r\n  return matches;\r\n}\r\n\r\n/**\r\n * Thrown when an emitted chunk cannot be parsed, which means Gate C could not\r\n * inspect it. A gate that skips what it cannot read reports \"no violation\r\n * found\" on precisely the input it failed to look at — the one input where\r\n * that answer is worthless. So an unreadable chunk fails the build instead.\r\n */\r\nexport class UnverifiableChunkError extends Error {\r\n  readonly fileName: string;\r\n\r\n  constructor(fileName: string, cause?: unknown) {\r\n    super(\r\n      [\r\n        `Warlock stopped this build: a file in your client bundle could not be checked for server-only code.`,\r\n        ``,\r\n        `File: ${fileName}`,\r\n        `Cause: this file could not be parsed as JavaScript, so the client/server boundary check could not be performed on it. Warlock cannot confirm that the server-only exports (route, middleware, validation, loader, metadata, prefix) were kept out of it.`,\r\n        `Fix: the build is being stopped rather than passed, because a file that was never checked is not a file known to be safe. This emitted file is outside the JavaScript syntax Warlock can currently verify. Two things commonly put it there, and this error cannot tell which: the output uses syntax newer than the parser Warlock ships with, or a plugin or loader emitted non-standard syntax into the client bundle. Check the compatibility of whatever produced this file, then build again.`,\r\n      ].join(\"\\n\"),\r\n    );\r\n    this.name = \"UnverifiableChunkError\";\r\n    this.fileName = fileName;\r\n    if (cause !== undefined) (this as { cause?: unknown }).cause = cause;\r\n  }\r\n}\r\n\r\n/**\r\n * Part 1, item 1: parses each emitted chunk's ACTUAL code (never pre-transform\r\n * source) and looks for a top-level binding named one of the five server\r\n * exports. A parse failure on an emitted chunk FAILS the gate\r\n * (`UnverifiableChunkError`) — it is never skipped. Skipping would report the\r\n * bundle clean on the one chunk the gate did not actually inspect, which is a\r\n * safety check failing open; a build stopped on an unreadable chunk is\r\n * recoverable, a boundary silently unenforced is not.\r\n *\r\n * This SURVIVES real minification (pinned by the `gate-c-verify.spec.ts`\r\n * \"D.8\" describe block). A minifier (esbuild,\r\n * Vite's default) is only free to rename LOCAL bindings; the exported name\r\n * itself is part of the module's public interface and is never mangled — a\r\n * minified `export const route = ...` still emits `export { e as route }`,\r\n * with the local identifier renamed (`e`) but `route` intact as the specifier's\r\n * `exported` name, which is exactly the field `collectServerExportNames`\r\n * reads for the `ExportNamedDeclaration` specifier form. No name-independent\r\n * redesign needed here — verified against a real `build.minify: true` output,\r\n * not assumed.\r\n */\r\nexport function findLeakedServerExports(bundle: BundleLike): ServerExportLeak[] {\r\n  const leaks: ServerExportLeak[] = [];\r\n\r\n  for (const file of Object.values(bundle)) {\r\n    if (!file || file.type !== \"chunk\" || typeof file.code !== \"string\") continue;\r\n\r\n    let ast: any;\r\n    try {\r\n      ast = parse(file.code, { sourceType: \"module\", plugins: [\"typescript\", \"jsx\"] });\r\n    } catch (error) {\r\n      throw new UnverifiableChunkError(file.fileName ?? \"(unnamed chunk)\", error);\r\n    }\r\n\r\n    for (const stmt of ast.program.body as any[]) {\r\n      for (const match of collectServerExportNames(stmt)) {\r\n        leaks.push({ fileName: file.fileName as string, exportName: match.name, line: match.line });\r\n      }\r\n    }\r\n  }\r\n\r\n  return leaks;\r\n}\r\n\r\n/**\r\n * Part 1, item 2: walks every emitted chunk's `moduleIds` (the resolved,\r\n * absolute file paths of every source module Rollup actually bundled into\r\n * that chunk) and classifies each one via the SAME `EnvironmentClassifier`\r\n * Gate A's `resolveId` uses, re-derived from `gate-a-resolve.ts` rather than\r\n * hand-rolled a second time. A moduleId that maps to a governed-scope\r\n * package classified `\"server\"` is an import edge Gate A should already\r\n * have refused — if it's here anyway, the earlier gate has a bug.\r\n *\r\n * D.8 verdict: this SURVIVES real minification unconditionally, and for a\r\n * stronger reason than item 1 above — it never reads emitted code text or\r\n * identifier names at all. `moduleIds` is Rollup's own bundling metadata\r\n * (which resolved source files ended up in this chunk), untouched by\r\n * minification, which only rewrites code, not that metadata. Verified\r\n * against a real `build.minify: true` output in `gate-c-verify.spec.ts`.\r\n */\r\nexport function findLeakedServerImportEdges(\r\n  bundle: BundleLike,\r\n  classifier: Pick<EnvironmentClassifier, \"environmentOf\" | \"packageNameForFilePath\">,\r\n): ServerImportEdgeLeak[] {\r\n  const leaks: ServerImportEdgeLeak[] = [];\r\n\r\n  for (const file of Object.values(bundle)) {\r\n    if (!file || file.type !== \"chunk\") continue;\r\n\r\n    for (const moduleId of file.moduleIds ?? []) {\r\n      const packageName = classifier.packageNameForFilePath(moduleId);\r\n      if (!packageName) continue;\r\n      if (classifier.environmentOf(packageName) === \"server\") {\r\n        leaks.push({ fileName: file.fileName as string, moduleId, packageName });\r\n      }\r\n    }\r\n  }\r\n\r\n  return leaks;\r\n}\r\n\r\n/**\r\n * Conservative \"does this PUBLIC_* value look safe to print in the reviewable\r\n * manifest\" heuristic: if genuinely unsure, show the key only — never guess\r\n * that a value is safe. The whole point of this manifest is that the `PUBLIC_`\r\n * prefix rule alone is not trustworthy — someone can and will name an actual\r\n * secret `PUBLIC_STRIPE_KEY` — so a value that LOOKS like a credential is\r\n * redacted regardless of what its key is named. Non-string values (booleans,\r\n * numbers) are never secret-shaped and always shown.\r\n */\r\nconst CREDENTIALED_URL_RE = /:\\/\\/[^/\\s]+:[^/\\s@]+@/; // scheme://user:pass@host\r\nconst KNOWN_SECRET_PREFIX_RES = [\r\n  /^sk_(live|test)_/i, // Stripe secret key (pk_ publishable is a different prefix)\r\n  /^rk_(live|test)_/i, // Stripe restricted key\r\n  /^AKIA[0-9A-Z]{12,}/, // AWS access key id\r\n  /^gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub personal/OAuth/user/server tokens\r\n  /^glpat-[A-Za-z0-9_-]{20,}/, // GitLab personal access token\r\n  /^xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack tokens\r\n  /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/, // JWT (3 base64url segments)\r\n];\r\n// A long opaque token made up only of base64url/hex-ish characters, with both\r\n// letters and digits, and no separators a human-authored public value (a\r\n// URL, a short id) would normally contain — conservatively treated as a\r\n// secret-shaped random token even though it might genuinely be safe.\r\nconst HIGH_ENTROPY_TOKEN_RE = /^[A-Za-z0-9+/_=-]{32,}$/;\r\n\r\nfunction isSafeToShowValue(value: unknown): boolean {\r\n  if (typeof value !== \"string\" || value.length === 0) return true;\r\n  if (CREDENTIALED_URL_RE.test(value)) return false;\r\n  if (KNOWN_SECRET_PREFIX_RES.some((re) => re.test(value))) return false;\r\n  if (HIGH_ENTROPY_TOKEN_RE.test(value) && /[0-9]/.test(value) && /[a-zA-Z]/.test(value)) return false;\r\n  return true;\r\n}\r\n\r\nfunction stringifyEnvValue(value: unknown): string {\r\n  if (typeof value === \"string\") return value;\r\n  return JSON.stringify(value) ?? \"undefined\";\r\n}\r\n\r\n/**\r\n * The enumerated, human-reviewable list of\r\n * every `PUBLIC_*` key actually inlined into the client bundle. Built\r\n * directly from `tracker.referencedKeys` — the exact same `Set` Gate B's own\r\n * `generateBundle` unread-key check (`gate-b-secrets.ts`) reads from — so\r\n * this manifest and that exclusion logic agree BY CONSTRUCTION: they are two\r\n * readers of one Set, not two independent recomputations of \"which keys were\r\n * read\" that could drift apart. A key only reaches `referencedKeys` once\r\n * `findViolation` in `gate-b-secrets.ts` has seen a statically-resolved\r\n * `import.meta.env.PUBLIC_X` read for it, which is also precisely the\r\n * condition under which Gate B allows its value to be inlined at all — an\r\n * unread key that somehow leaked in anyway is a Gate B `generateBundle`\r\n * BUILD FAILURE (see `gate-b-secrets.ts`), never silently listed here.\r\n */\r\nexport function buildPublicEnvManifest(tracker: PublicEnvTracker): PublicEnvManifestEntry[] {\r\n  return [...tracker.referencedKeys]\r\n    .sort()\r\n    .map((key) => {\r\n      const value = tracker.declaredEnv[key];\r\n      const safe = isSafeToShowValue(value);\r\n      return { key, value: safe ? stringifyEnvValue(value) : null, redacted: !safe };\r\n    });\r\n}\r\n\r\nexport interface GateCOptions extends EnvironmentClassifierOptions {\r\n  /**\r\n   * Shared with `gateBSecrets({ tracker })` — required for the manifest to\r\n   * reflect what THIS build's Gate B pass actually saw. Defaults to a\r\n   * private, unshared tracker (always empty) if omitted, which is only ever\r\n   * correct when Gate C runs standalone in a test.\r\n   */\r\n  tracker?: PublicEnvTracker;\r\n  /** Defaults to `\"warlock-env-manifest.json\"` (Suki's suggested name). */\r\n  manifestFileName?: string;\r\n}\r\n\r\n/**\r\n * The client-build Vite plugin. Runs only at `generateBundle` — Gate C has\r\n * nothing to say about source, only about the bundle Rollup actually wrote.\r\n * Skipped for the SSR/server build, same as Gate B (`gate-b-secrets.ts`):\r\n * a page's server exports are meant to survive in that build; only the\r\n * client build is judged.\r\n */\r\nexport function gateCVerify(options: GateCOptions = {}): Plugin {\r\n  const classifier = createEnvironmentClassifier(options);\r\n  const tracker = options.tracker ?? createPublicEnvTracker();\r\n  const manifestFileName = options.manifestFileName ?? \"warlock-env-manifest.json\";\r\n\r\n  return {\r\n    name: \"warlock:gate-c-verify\",\r\n    generateBundle(_outputOptions, bundle) {\r\n      if (this.environment?.config?.consumer === \"server\") return;\r\n\r\n      const exportLeak = findLeakedServerExports(bundle)[0];\r\n      if (exportLeak) {\r\n        this.error(\r\n          [\r\n            `Gate C refused a build: a server export survived into the emitted client bundle.`,\r\n            ``,\r\n            `File: ${exportLeak.fileName}${exportLeak.line ? `:${exportLeak.line}` : \"\"}`,\r\n            `Export: ${exportLeak.exportName}`,\r\n            `Cause: \"${exportLeak.exportName}\" is one of the six server exports (route, middleware, validation, loader, metadata, prefix) and is still present as a top-level binding in the EMITTED client chunk — projection and/or Gate A should have removed or refused it before the bundle was written.`,\r\n            `Fix: this should already be impossible if projection and Gate A ran correctly — investigate why \"${exportLeak.exportName}\" reached the emitted output (a projection bug, a build config that bypasses these plugins, or a plugin ordering change) rather than assuming this build is a one-off; Gate C is defense in depth, not the primary fence.`,\r\n          ].join(\"\\n\"),\r\n        );\r\n      }\r\n\r\n      const importEdgeLeak = findLeakedServerImportEdges(bundle, classifier)[0];\r\n      if (importEdgeLeak) {\r\n        this.error(\r\n          [\r\n            `Gate C refused a build: a server-only import edge survived into the emitted client bundle's module graph.`,\r\n            ``,\r\n            `File: ${importEdgeLeak.fileName}`,\r\n            `Module: ${importEdgeLeak.moduleId}`,\r\n            `Cause: \"${importEdgeLeak.moduleId}\" belongs to ${importEdgeLeak.packageName}, a server-only package (it declares \"warlock\": { \"environment\": \"server\" } in its package.json), and is present among the bundled modules of the emitted client chunk \"${importEdgeLeak.fileName}\" — Gate A's resolveId should have refused this import before it ever reached the bundle.`,\r\n            `Fix: this should already be impossible if Gate A ran on this build — investigate why ${importEdgeLeak.packageName} reached the emitted output (a Gate A bypass, a custom resolveId/external override, or a plugin ordering change) rather than assuming this build is a one-off; Gate C is defense in depth, not the primary fence.`,\r\n          ].join(\"\\n\"),\r\n        );\r\n      }\r\n\r\n      const manifest = buildPublicEnvManifest(tracker);\r\n\r\n      // EMITTED through `this.emitFile`, not written into `bundle` by hand.\r\n      //\r\n      // This used to assign a hand-built record directly:\r\n      //\r\n      //     bundle[manifestFileName] = { type: \"asset\", fileName, name, source } as any;\r\n      //\r\n      // and the `as any` was load-bearing, which was the warning sign. A Rollup\r\n      // asset record carries `names` and `originalFileNames` ARRAYS; that object\r\n      // had neither, so it was not the shape Rollup produces — it merely\r\n      // type-asserted its way into the bundle.\r\n      //\r\n      // Nothing noticed until the production build got far enough to render\r\n      // chunks, at which point Vite's own `vite:manifest` plugin read\r\n      // `chunk.names.length` on every asset and died on `undefined`:\r\n      //\r\n      //     [vite:manifest] Cannot read properties of undefined (reading 'length')\r\n      //\r\n      // `emitFile` makes Rollup construct the record, so the shape is correct by\r\n      // construction and stays correct when Rollup adds fields. Hand-building a\r\n      // bundle entry is signing up to track someone else's internal type forever.\r\n      this.emitFile({\r\n        type: \"asset\",\r\n        fileName: manifestFileName,\r\n        source: JSON.stringify(manifest, null, 2),\r\n      });\r\n    },\r\n  };\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,yBAAyB,MAAkD;CAClF,MAAM,UAAiD,CAAC;CACxD,MAAM,OAAO,KAAK,KAAK,OAAO;CAE9B,SAAS,OAAO,MAA0B;EACxC,IAAI,QAAQ,oBAAoB,IAAI,IAAI,GAAG,QAAQ,KAAK;GAAE;GAAM,MAAM,QAAQ;EAAE,CAAC;CACnF;CAEA,IAAI,KAAK,SAAS,uBAChB;OAAK,MAAM,QAAQ,KAAK,cACtB,IAAI,KAAK,IAAI,SAAS,cAAc,OAAO,KAAK,GAAG,IAAI;CACzD,OACK,IAAI,KAAK,SAAS,uBACvB,OAAO,KAAK,IAAI,IAAI;MACf,IAAI,KAAK,SAAS,0BAA0B;EACjD,IAAI,KAAK,aAAa,QAAQ,KAAK,GAAG,yBAAyB,KAAK,WAAW,CAAC;EAChF,KAAK,MAAM,aAAa,KAAK,cAAc,CAAC,GAC1C,OAAO,UAAU,UAAU,QAAQ,UAAU,UAAU,KAAK;CAEhE;CAEA,OAAO;AACT;;;;;;;AAQA,IAAa,yBAAb,cAA4C,MAAM;CAChD,AAAS;CAET,YAAY,UAAkB,OAAiB;EAC7C,MACE;GACE;GACA;GACA,SAAS;GACT;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;EACA,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,IAAI,UAAU,QAAW,AAAC,KAA6B,QAAQ;CACjE;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,wBAAwB,QAAwC;CAC9E,MAAM,QAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG;EACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,WAAW,OAAO,KAAK,SAAS,UAAU;EAErE,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM;IAAE,YAAY;IAAU,SAAS,CAAC,cAAc,KAAK;GAAE,CAAC;EACjF,SAAS,OAAO;GACd,MAAM,IAAI,uBAAuB,KAAK,YAAY,mBAAmB,KAAK;EAC5E;EAEA,KAAK,MAAM,QAAQ,IAAI,QAAQ,MAC7B,KAAK,MAAM,SAAS,yBAAyB,IAAI,GAC/C,MAAM,KAAK;GAAE,UAAU,KAAK;GAAoB,YAAY,MAAM;GAAM,MAAM,MAAM;EAAK,CAAC;CAGhG;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAgB,4BACd,QACA,YACwB;CACxB,MAAM,QAAgC,CAAC;CAEvC,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG;EACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,SAAS;EAEpC,KAAK,MAAM,YAAY,KAAK,aAAa,CAAC,GAAG;GAC3C,MAAM,cAAc,WAAW,uBAAuB,QAAQ;GAC9D,IAAI,CAAC,aAAa;GAClB,IAAI,WAAW,cAAc,WAAW,MAAM,UAC5C,MAAM,KAAK;IAAE,UAAU,KAAK;IAAoB;IAAU;GAAY,CAAC;EAE3E;CACF;CAEA,OAAO;AACT;;;;;;;;;;AAWA,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAKA,MAAM,wBAAwB;AAE9B,SAAS,kBAAkB,OAAyB;CAClD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,OAAO;CAC5D,IAAI,oBAAoB,KAAK,KAAK,GAAG,OAAO;CAC5C,IAAI,wBAAwB,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,OAAO;CACjE,IAAI,sBAAsB,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,KAAK,WAAW,KAAK,KAAK,GAAG,OAAO;CAC/F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAwB;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC;;;;;;;;;;;;;;;AAgBA,SAAgB,uBAAuB,SAAqD;CAC1F,OAAO,CAAC,GAAG,QAAQ,cAAc,CAAC,CAC/B,KAAK,CAAC,CACN,KAAK,QAAQ;EACZ,MAAM,QAAQ,QAAQ,YAAY;EAClC,MAAM,OAAO,kBAAkB,KAAK;EACpC,OAAO;GAAE;GAAK,OAAO,OAAO,kBAAkB,KAAK,IAAI;GAAM,UAAU,CAAC;EAAK;CAC/E,CAAC;AACL;;;;;;;;AAqBA,SAAgB,YAAY,UAAwB,CAAC,GAAW;CAC9D,MAAM,aAAa,4BAA4B,OAAO;CACtD,MAAM,UAAU,QAAQ,WAAW,uBAAuB;CAC1D,MAAM,mBAAmB,QAAQ,oBAAoB;CAErD,OAAO;EACL,MAAM;EACN,eAAe,gBAAgB,QAAQ;GACrC,IAAI,KAAK,aAAa,QAAQ,aAAa,UAAU;GAErD,MAAM,aAAa,wBAAwB,MAAM,CAAC,CAAC;GACnD,IAAI,YACF,KAAK,MACH;IACE;IACA;IACA,SAAS,WAAW,WAAW,WAAW,OAAO,IAAI,WAAW,SAAS;IACzE,WAAW,WAAW;IACtB,WAAW,WAAW,WAAW;IACjC,oGAAoG,WAAW,WAAW;GAC5H,CAAC,CAAC,KAAK,IAAI,CACb;GAGF,MAAM,iBAAiB,4BAA4B,QAAQ,UAAU,CAAC,CAAC;GACvE,IAAI,gBACF,KAAK,MACH;IACE;IACA;IACA,SAAS,eAAe;IACxB,WAAW,eAAe;IAC1B,WAAW,eAAe,SAAS,eAAe,eAAe,YAAY,0KAA0K,eAAe,SAAS;IAC/Q,wFAAwF,eAAe,YAAY;GACrH,CAAC,CAAC,KAAK,IAAI,CACb;GAGF,MAAM,WAAW,uBAAuB,OAAO;GAsB/C,KAAK,SAAS;IACZ,MAAM;IACN,UAAU;IACV,QAAQ,KAAK,UAAU,UAAU,MAAM,CAAC;GAC1C,CAAC;EACH;CACF;AACF"}

package/esm/vite/hydration-entries.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hydration-entries.mjs","names":[],"sources":["../../../../../../../web/src/vite/hydration-entries.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/** Stable Rollup/Vite entry name shared by development and production wiring. */\nexport const HYDRATION_CLIENT_ENTRY_NAME = \"hydration\";\n\nexport type HydrationClientEntry = Readonly<{\n  name: typeof HYDRATION_CLIENT_ENTRY_NAME;\n  sourcePath: string;\n  devUrl: string;\n}>;\n\nfunction normalizeFileSystemPath(filePath: string): string {\n  return filePath.replace(/\\\\/g, \"/\");\n}\n\n/**\n * Where the hydration entry lives inside an INSTALLED `@warlock.js/web`, and\n * where it lives inside this checkout — in that order of preference.\n *\n * The published tarball ships `esm/`, `skills/` and the docs files — no `src/`\n * — so `src/` is absent from every real install. (Verified against\n * `@warlock.js/web@5.0.2`: 191 files, none under `src/`. Note the published\n * `package.json` carries no `files` key at all; the release tooling rewrites\n * the manifest, so do not treat this repo's `files` field as the mechanism.)\n * Resolving the entry to `<webRoot>/src/hydration/index.ts` unconditionally\n * therefore worked in this monorepo and failed for every consumer, with\n * `warlock build` unable to emit a client bundle at all.\n *\n * The built artifact is preferred rather than the source being published,\n * because shipping `src/` beside `esm/` would put TWO instances of\n * `routing/route-table` in one client bundle — the app's own imports resolve\n * through `esm/`, the hydration entry's relative imports through `src/`.\n * `publishRouteTable()` would write to one and `<Link>` would read the other.\n */\nconst PACKAGED_ENTRY = \"esm/hydration/index.mjs\";\nconst CHECKOUT_ENTRY = \"src/hydration/index.ts\";\n\n/**\n * Describes the single framework hydration entry without importing Vite.\n * Vite's `/@fs/` prefix accepts an absolute normalized file-system path;\n * keeping the drive colon produces `/@fs/D:/...` consistently on Windows.\n */\nexport function createHydrationClientEntry(webRoot: string): HydrationClientEntry {\n  if (typeof webRoot !== \"string\" || webRoot.trim().length === 0) {\n    throw new TypeError(\"Cannot create the hydration client entry: webRoot must be a non-empty path.\");\n  }\n\n  const packagedPath = path.resolve(webRoot, PACKAGED_ENTRY);\n  const sourcePath = normalizeFileSystemPath(\n    existsSync(packagedPath) ? packagedPath : path.resolve(webRoot, CHECKOUT_ENTRY),\n  );\n\n  return {\n    name: HYDRATION_CLIENT_ENTRY_NAME,\n    sourcePath,\n    devUrl: `/@fs/${sourcePath}`,\n  };\n}\n"],"mappings":";;;;;AAIA,MAAa,8BAA8B;AAQ3C,SAAS,wBAAwB,UAA0B;CACzD,OAAO,SAAS,QAAQ,OAAO,GAAG;AACpC;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;;;;;;AAOvB,SAAgB,2BAA2B,SAAuC;CAChF,IAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,EAAE,WAAW,GAC3D,MAAM,IAAI,UAAU,6EAA6E;CAGnG,MAAM,eAAe,KAAK,QAAQ,SAAS,cAAc;CACzD,MAAM,aAAa,wBACjB,WAAW,YAAY,IAAI,eAAe,KAAK,QAAQ,SAAS,cAAc,CAChF;CAEA,OAAO;EACL,MAAM;EACN;EACA,QAAQ,QAAQ;CAClB;AACF"}
+{"version":3,"file":"hydration-entries.mjs","names":[],"sources":["../../../../../../../web/src/vite/hydration-entries.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport path from \"node:path\";\n\n/** Stable Rollup/Vite entry name shared by development and production wiring. */\nexport const HYDRATION_CLIENT_ENTRY_NAME = \"hydration\";\n\nexport type HydrationClientEntry = Readonly<{\n  name: typeof HYDRATION_CLIENT_ENTRY_NAME;\n  sourcePath: string;\n  devUrl: string;\n}>;\n\nfunction normalizeFileSystemPath(filePath: string): string {\n  return filePath.replace(/\\\\/g, \"/\");\n}\n\n/**\n * Where the hydration entry lives inside an INSTALLED `@warlock.js/web`, and\n * where it lives inside this checkout — in that order of preference.\n *\n * The published tarball ships `esm/`, `skills/` and the docs files — no `src/`\n * — so `src/` is absent from every real install. (Verified against\n * `@warlock.js/web@5.0.2`: 191 files, none under `src/`. Note the published\n * `package.json` carries no `files` key at all; the release tooling rewrites\n * the manifest, so do not treat this repo's `files` field as the mechanism.)\n * Resolving the entry to `<webRoot>/src/hydration/index.ts` unconditionally\n * therefore worked in this monorepo and failed for every consumer, with\n * `warlock build` unable to emit a client bundle at all.\n *\n * The built artifact is preferred rather than the source being published,\n * because shipping `src/` beside `esm/` would put TWO instances of\n * `routing/route-table` in one client bundle — the app's own imports resolve\n * through `esm/`, the hydration entry's relative imports through `src/`.\n * `publishRouteTable()` would write to one and `<Link>` would read the other.\n */\nconst PACKAGED_ENTRY = \"esm/hydration/index.mjs\";\nconst CHECKOUT_ENTRY = \"src/hydration/index.ts\";\n\n/**\n * Describes the single framework hydration entry without importing Vite.\n * Vite's `/@fs/` prefix accepts an absolute normalized file-system path;\n * keeping the drive colon produces `/@fs/D:/...` consistently on Windows.\n */\nexport function createHydrationClientEntry(webRoot: string): HydrationClientEntry {\n  if (typeof webRoot !== \"string\" || webRoot.trim().length === 0) {\n    throw new TypeError(\"Cannot create the hydration client entry: webRoot must be a non-empty path.\");\n  }\n\n  const packagedPath = path.resolve(webRoot, PACKAGED_ENTRY);\n  const sourcePath = normalizeFileSystemPath(\n    existsSync(packagedPath) ? packagedPath : path.resolve(webRoot, CHECKOUT_ENTRY),\n  );\n\n  return {\n    name: HYDRATION_CLIENT_ENTRY_NAME,\n    sourcePath,\n    devUrl: `/@fs/${sourcePath}`,\n  };\n}\n"],"mappings":";;;;;AAIA,MAAa,8BAA8B;AAQ3C,SAAS,wBAAwB,UAA0B;CACzD,OAAO,SAAS,QAAQ,OAAO,GAAG;AACpC;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;;;;;;AAOvB,SAAgB,2BAA2B,SAAuC;CAChF,IAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,CAAC,CAAC,WAAW,GAC3D,MAAM,IAAI,UAAU,6EAA6E;CAGnG,MAAM,eAAe,KAAK,QAAQ,SAAS,cAAc;CACzD,MAAM,aAAa,wBACjB,WAAW,YAAY,IAAI,eAAe,KAAK,QAAQ,SAAS,cAAc,CAChF;CAEA,OAAO;EACL,MAAM;EACN;EACA,QAAQ,QAAQ;CAClB;AACF"}

package/esm/vite/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../web/src/vite/index.ts"],"sourcesContent":["/**\n * `@warlock.js/web/vite` — build-tooling subpath, kept separate from the\n * runtime barrel (`@warlock.js/web`) so importing it never pulls `vite` into\n * a project that doesn't build with Vite.\n */\nimport { parse } from \"@babel/parser\";\nimport path from \"node:path\";\nimport type { Plugin } from \"vite\";\nimport {\n  buildHydrationClient,\n  type BuildHydrationClientOptions,\n  type BuildHydrationClientResult,\n} from \"./build-client\";\nimport {\n  gateAResolve,\n  isAppSourcePath,\n  isRecognizedUniversalSurface,\n  isServerFile,\n  isWithinModuleWebFolder,\n} from \"./gate-a-resolve\";\nimport { createPublicEnvTracker, gateBSecrets } from \"./gate-b-secrets\";\nimport { gateCVerify } from \"./gate-c-verify\";\nimport {\n  clientPageRegistry,\n  type ClientPageRegistryPluginOptions,\n} from \"./page-registry-plugin\";\nimport { isProjectableFile, projectModule, projection } from \"./projection\";\n\nexport { buildHydrationClient } from \"./build-client\";\nexport type {\n  BuildHydrationClientOptions,\n  BuildHydrationClientResult,\n  HydrationClientBuildOutput,\n} from \"./build-client\";\nexport { gateAResolve } from \"./gate-a-resolve\";\nexport type {\n  EnvironmentClassifier,\n  EnvironmentClassifierOptions,\n  WarlockEnvironment,\n} from \"./gate-a-resolve\";\nexport { createPublicEnvTracker, gateBSecrets } from \"./gate-b-secrets\";\nexport type { PublicEnvTracker } from \"./gate-b-secrets\";\nexport {\n  buildPublicEnvManifest,\n  findLeakedServerExports,\n  findLeakedServerImportEdges,\n  gateCVerify,\n} from \"./gate-c-verify\";\nexport type {\n  GateCOptions,\n  PublicEnvManifestEntry,\n  ServerExportLeak,\n  ServerImportEdgeLeak,\n} from \"./gate-c-verify\";\nexport {\n  HYDRATION_CLIENT_ENTRY_NAME,\n  createHydrationClientEntry,\n} from \"./hydration-entries\";\nexport type { HydrationClientEntry } from \"./hydration-entries\";\nexport {\n  CLIENT_PAGE_REGISTRY_ID,\n  clientPageRegistry,\n  invalidateClientPageRegistry,\n  RESOLVED_CLIENT_PAGE_REGISTRY_ID,\n} from \"./page-registry-plugin\";\nexport type { ClientPageRegistryPluginOptions } from \"./page-registry-plugin\";\nexport { projection, ProjectionAmbiguityError } from \"./projection\";\nexport type { ProjectionResult } from \"./projection\";\n\nexport type WarlockClientBoundaryOptions = Parameters<\n  typeof gateAResolve\n>[0] & {\n  beforePageHotUpdate?: ClientPageRegistryPluginOptions[\"beforePageHotUpdate\"];\n};\n\nexport type BuildWarlockHydrationClientOptions = Readonly<{\n  appRoot: string;\n  webRoot: string;\n  /** Absolute client output dir — threaded to `buildHydrationClient` (`<outdir>/client`). */\n  outDir: string;\n  resolveAliases: BuildHydrationClientOptions[\"resolveAliases\"];\n  external?: BuildHydrationClientOptions[\"external\"];\n  /** App-configured plugins, appended after Warlock's client-boundary pipeline. */\n  plugins?: BuildHydrationClientOptions[\"plugins\"];\n}>;\n\ntype SsrBoundaryState = {\n  readonly appRoot: string;\n  readonly clientBoundModules: Set<string>;\n  readonly clientImportsByModule: Map<string, Set<string>>;\n};\n\nfunction moduleKey(id: string): string {\n  return id.split(\"?\")[0].replace(/\\\\/g, \"/\");\n}\n\nconst CODE_MODULE_EXTENSION = /\\.([cm]?[jt]sx?)$/;\n\nfunction isStatelessClientSurface(id: string, appRoot: string): boolean {\n  const bare = moduleKey(id);\n  if (!isAppSourcePath(bare, appRoot)) return false;\n  if (isServerFile(bare, appRoot)) return false;\n\n  return (\n    isProjectableFile(bare) ||\n    isRecognizedUniversalSurface(bare) ||\n    isWithinModuleWebFolder(bare, appRoot)\n  );\n}\n\nfunction collectImportSpecifiers(code: string): Set<string> {\n  const ast = parse(code, {\n    sourceType: \"module\",\n    plugins: [\"typescript\", \"jsx\"],\n  });\n  const imports = new Set<string>();\n\n  function walk(node: unknown): void {\n    if (!node || typeof node !== \"object\") return;\n    if (Array.isArray(node)) {\n      for (const child of node) walk(child);\n      return;\n    }\n\n    const record = node as Record<string, any>;\n    if (\n      (record.type === \"ImportDeclaration\" ||\n        record.type === \"ExportNamedDeclaration\" ||\n        record.type === \"ExportAllDeclaration\") &&\n      record.source?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.source.value);\n    }\n    if (\n      record.type === \"CallExpression\" &&\n      record.callee?.type === \"Import\" &&\n      record.arguments?.[0]?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.arguments[0].value);\n    }\n    if (\n      record.type === \"ImportExpression\" &&\n      record.source?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.source.value);\n    }\n\n    for (const [key, child] of Object.entries(record)) {\n      if (\n        key === \"type\" ||\n        key === \"start\" ||\n        key === \"end\" ||\n        key === \"loc\" ||\n        key === \"range\" ||\n        key.endsWith(\"Comments\") ||\n        key === \"extra\"\n      ) {\n        continue;\n      }\n      walk(child);\n    }\n  }\n\n  walk(ast.program);\n  return imports;\n}\n\nfunction clientViewOf(\n  state: SsrBoundaryState,\n  code: string,\n  id: string,\n): string | undefined {\n  const key = moduleKey(id);\n  if (\n    !state.clientBoundModules.has(key) &&\n    !isStatelessClientSurface(key, state.appRoot)\n  ) {\n    return undefined;\n  }\n\n  state.clientBoundModules.add(key);\n  if (!CODE_MODULE_EXTENSION.test(key)) {\n    state.clientImportsByModule.set(key, new Set());\n    return code;\n  }\n\n  const clientCode = isProjectableFile(key)\n    ? projectModule(code, key).code\n    : code;\n  state.clientImportsByModule.set(key, collectImportSpecifiers(clientCode));\n  return clientCode;\n}\n\nfunction markResolvedClientModule(\n  state: SsrBoundaryState,\n  resolved: { id: string } | string | null | false | void,\n): void {\n  if (!resolved) return;\n  const id = typeof resolved === \"string\" ? resolved : resolved.id;\n  if (!id.includes(\"\\0\")) state.clientBoundModules.add(moduleKey(id));\n}\n\nfunction isServerEnvironment(context: {\n  environment?: { config: { consumer?: string } };\n}): boolean {\n  return context.environment?.config.consumer === \"server\";\n}\n\n/**\n * Keeps the production/client pipeline byte-identical, while giving Gate A\n * and Gate B a validation-only view in Vite's development SSR environment.\n * SSR still evaluates the original source: only the gates receive the\n * projected client view, so loader/server exports retain their legitimate\n * server access while component-visible code is refused before evaluation.\n */\nfunction clientEnvironmentOnly(\n  plugin: Plugin,\n  ssrState: SsrBoundaryState,\n): Plugin {\n  const validatesDevSsr =\n    plugin.name === \"warlock:gate-a-resolve\" ||\n    plugin.name === \"warlock:gate-b-secrets\";\n  const originalTransform =\n    typeof plugin.transform === \"function\"\n      ? plugin.transform\n      : plugin.transform?.handler;\n  const originalResolveId =\n    typeof plugin.resolveId === \"function\"\n      ? plugin.resolveId\n      : plugin.resolveId?.handler;\n  const originalBuildStart =\n    typeof plugin.buildStart === \"function\"\n      ? plugin.buildStart\n      : plugin.buildStart?.handler;\n\n  return {\n    ...plugin,\n    applyToEnvironment(environment) {\n      return (\n        environment.config.consumer === \"client\" ||\n        (validatesDevSsr && environment.config.consumer === \"server\")\n      );\n    },\n    buildStart: originalBuildStart\n      ? function (...args) {\n          if (isServerEnvironment(this)) return;\n          return originalBuildStart.apply(this, args);\n        }\n      : undefined,\n    transform: originalTransform\n      ? async function (code, id, options) {\n          if (!isServerEnvironment(this)) {\n            return originalTransform.call(this, code, id, options);\n          }\n\n          const clientCode = clientViewOf(ssrState, code, id);\n          if (clientCode === undefined) return null;\n\n          const transformed = await originalTransform.call(\n            this,\n            clientCode,\n            id,\n            {\n              ...options,\n              ssr: false,\n            },\n          );\n\n          // Vite can externalize a package in the SSR environment before its\n          // normal resolver walk offers that edge to a plugin. Gate A cannot\n          // wait for that walk: validate every import that survived projection\n          // now, while the original TypeScript source and importer are known.\n          if (plugin.name === \"warlock:gate-a-resolve\" && originalResolveId) {\n            for (const source of ssrState.clientImportsByModule.get(\n              moduleKey(id),\n            ) ?? []) {\n              const resolved = await originalResolveId.call(this, source, id, {\n                attributes: {},\n                isEntry: false,\n                ssr: false,\n              });\n              markResolvedClientModule(ssrState, resolved);\n            }\n          }\n\n          return transformed;\n        }\n      : undefined,\n    resolveId: originalResolveId\n      ? async function (source, importer, options) {\n          if (!isServerEnvironment(this)) {\n            return originalResolveId.call(this, source, importer, options);\n          }\n\n          if (!importer) return null;\n          const importerKey = moduleKey(importer);\n          const isClientBound =\n            ssrState.clientBoundModules.has(importerKey) ||\n            isStatelessClientSurface(importerKey, ssrState.appRoot);\n          if (!isClientBound) return null;\n\n          const survivingImports =\n            ssrState.clientImportsByModule.get(importerKey);\n          if (survivingImports && !survivingImports.has(source)) return null;\n\n          const resolved = await originalResolveId.call(\n            this,\n            source,\n            importer,\n            {\n              ...options,\n              ssr: false,\n            },\n          );\n          markResolvedClientModule(ssrState, resolved);\n          return resolved;\n        }\n      : undefined,\n  };\n}\n\n/**\n * The composed client-build pipeline: projection\n * strips the 5 server exports first, THEN Gate B's `transform` checks\n * whatever source remains for inline secret reads, THEN Gate A's\n * `resolveId` judges whatever imports remain. Array order here is\n * `[projection(), gateBSecrets(), gateAResolve()]` to match Vite's own\n * pipeline shape (`transform` before `resolveId`), but array order alone\n * does not guarantee this — see the hook-ordering fact below, which is what\n * actually makes the composition correct.\n *\n * Empirically observed fact (via an instrumented real `vite.build()`, not\n * assumed from plugin array order): for a given module M, Vite/Rollup calls\n * `transform(M)` BEFORE it calls `resolveId` for any of M's own import\n * specifiers — because Rollup must parse M's post-transform source to even\n * discover which specifiers to resolve next. Concretely: `transform` ran on\n * `entry.page.tsx` first, and only after that did `resolveId(\"./dep\", ...)`\n * fire for the import statement still present in the transformed code. A\n * consequence follows directly: if projection's `transform` removes an\n * import statement from a page module entirely (e.g. `loader`'s\n * `@warlock.js/core` import, stripped because `loader` itself is removed),\n * `resolveId` is never invoked for that specifier at all — Gate A doesn't\n * \"let it pass\", it never sees it. Gate A's `resolveId` only fires for\n * imports that survive projection's `transform`, which is exactly why a\n * component-level `@warlock.js/core` import (never touched by projection)\n * still reaches and is refused by Gate A.\n *\n * This is OBSERVED Rollup behavior, not a documented contract — a future\n * Vite/Rollup upgrade could invert it. Pinned by a\n * regression test (`index.spec.ts`, \"D.3 hook ordering pin\") that fails\n * loudly if the ordering ever inverts, and by the `vite` peer floor in\n * `web/package.json` (`>=7.3.5`, the version this was verified against). If\n * that test ever fails after a Vite bump: the failure mode of the ordering\n * assumption breaking is SAFE — projection would stop removing an import\n * statement Gate A still sees, so Gate A would refuse an import it used to\n * silently let a stripped server export take with it. That is a loud build\n * failure (\"Gate A refused an import\"), never a silent client-bundle leak.\n * Do NOT \"fix\" an apparent Gate A false-positive after a Vite upgrade by\n * weakening Gate A (e.g. widening what it lets through) — investigate\n * whether this ordering assumption broke instead; loosening Gate A to work\n * around it would turn a loud failure into the exact silent leak this\n * pipeline exists to prevent.\n *\n * Gate B is placed between the two for the same reason, but for a `transform`\n * hook rather than `resolveId`: within a plugin array, Rollup runs each\n * module's registered `transform` hooks in array order, each one receiving\n * the PREVIOUS plugin's output. Running Gate B after projection means it\n * inspects the POST-projection source — a `process.env.SECRET` read inside\n * `loader` (a server export, legitimately reading a real secret server-side)\n * is invisible to Gate B once projection has already removed `loader`\n * entirely, exactly as it should be: Gate B's job is to fence client-bound\n * code, and projection is what decides what counts as client-bound. A\n * component-level secret read is untouched by projection and still reaches\n * Gate B, which refuses it. Gate B does not depend on Gate A's `resolveId`\n * output at all (orthogonal concern, raw source vs. import paths), so its\n * position relative to Gate A is not load-bearing — it is placed before Gate\n * A only to keep both `transform` hooks adjacent in the array.\n *\n * Gate C (`gate-c-verify.ts`) runs last and only at `generateBundle` — after\n * the entire `transform`/`resolveId` build phase has completed for every\n * plugin, regardless of array position (a Rollup lifecycle fact, not\n * something this array order enforces). It verifies the EMITTED output the\n * other three produced: no server export survived as a top-level binding, no\n * import edge into a server-only package survived into the module graph, and\n * it emits the reviewable `PUBLIC_*` inlined-value manifest. `gateBSecrets` and `gateCVerify` share\n * one `PublicEnvTracker` instance so the manifest and Gate B's own unread-key\n * exclusion check agree by construction, not by coincidence.\n *\n * `clientPageRegistry()` is FIRST, ahead of projection. It contributes no\n * `transform` at all — only a `resolveId`/`load` pair for one synthetic id —\n * so it cannot displace or pre-empt any gate's inspection of any real file.\n * Two reasons for the position, one of which is not load-bearing and is\n * labelled as such:\n *\n * 1. Load-bearing: it must own `virtual:warlock/pages` before Gate A's\n *    `resolveId` (also `enforce: \"pre\"`) reaches its `this.resolve(...)` call\n *    for that specifier. Gate A's nested resolve would find it anyway, but\n *    routing the id through Gate A's importer-chain bookkeeping only to have\n *    it come back means a synthetic id can surface in a user-facing \"Import\n *    chain:\" message. Resolving it first keeps ownership of the id in one\n *    place.\n * 2. NOT load-bearing: the position relative to `projection()`. Projection is\n *    `enforce: \"pre\"` and selects by file BASENAME (`projection.ts:242-248`),\n *    so it transforms every `*.page.tsx` / `layout.tsx` / `root.tsx` that\n *    enters the graph regardless of who imported it or where this plugin sits.\n *    The registry emits absolute POSIX specifiers that Rollup resolves and\n *    loads as ORDINARY file modules — they are not inlined into the virtual\n *    module — so each one is transformed exactly as a page imported from a\n *    real file would be. Projection declines the virtual module itself\n *    (`\\0virtual:warlock/pages` has no matching basename), which is correct:\n *    generated code has no server exports to strip.\n *\n * Point 2 is asserted, not assumed, by a real `vite.build()` in\n * `page-registry-plugin.spec.ts`: a fixture page whose `loader` — and only its\n * `loader` — imports a marker module that Gate A independently PERMITS, built\n * through this exact array, with the marker proven absent from every emitted\n * chunk while the page's own component text is proven present. Inspecting this\n * array's order would prove nothing about what reaches the browser.\n */\nexport function warlockClientBoundary(\n  options: WarlockClientBoundaryOptions = {},\n): Plugin[] {\n  const tracker = createPublicEnvTracker();\n  const ssrState: SsrBoundaryState = {\n    appRoot: path.resolve(options.appRoot ?? process.cwd()),\n    clientBoundModules: new Set(),\n    clientImportsByModule: new Map(),\n  };\n  return [\n    clientPageRegistry({\n      appRoot: options.appRoot,\n      beforePageHotUpdate: options.beforePageHotUpdate,\n    }),\n    projection(),\n    gateBSecrets({ tracker }),\n    gateAResolve(options),\n    gateCVerify({ ...options, tracker }),\n  ].map((plugin) => clientEnvironmentOnly(plugin, ssrState));\n}\n\n/**\n * Callable production seam: callers own their exact source aliases and the\n * app-root classification boundary, while this module owns the one canonical\n * projection/Gate B/Gate A/Gate C composition.\n */\nexport async function buildWarlockHydrationClient(\n  options: BuildWarlockHydrationClientOptions,\n): Promise<BuildHydrationClientResult> {\n  return buildHydrationClient({\n    webRoot: options.webRoot,\n    outDir: options.outDir,\n    resolveAliases: options.resolveAliases,\n    external: options.external,\n    plugins: [\n      ...warlockClientBoundary({ appRoot: options.appRoot }),\n      ...(options.plugins ?? []),\n    ],\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4FA,SAAS,UAAU,IAAoB;CACrC,OAAO,GAAG,MAAM,GAAG,EAAE,GAAG,QAAQ,OAAO,GAAG;AAC5C;AAEA,MAAM,wBAAwB;AAE9B,SAAS,yBAAyB,IAAY,SAA0B;CACtE,MAAM,OAAO,UAAU,EAAE;CACzB,IAAI,CAAC,gBAAgB,MAAM,OAAO,GAAG,OAAO;CAC5C,IAAI,aAAa,MAAM,OAAO,GAAG,OAAO;CAExC,OACE,kBAAkB,IAAI,KACtB,6BAA6B,IAAI,KACjC,wBAAwB,MAAM,OAAO;AAEzC;AAEA,SAAS,wBAAwB,MAA2B;CAC1D,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY;EACZ,SAAS,CAAC,cAAc,KAAK;CAC/B,CAAC;CACD,MAAM,0BAAU,IAAI,IAAY;CAEhC,SAAS,KAAK,MAAqB;EACjC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;GACvB,KAAK,MAAM,SAAS,MAAM,KAAK,KAAK;GACpC;EACF;EAEA,MAAM,SAAS;EACf,KACG,OAAO,SAAS,uBACf,OAAO,SAAS,4BAChB,OAAO,SAAS,2BAClB,OAAO,QAAQ,SAAS,iBAExB,QAAQ,IAAI,OAAO,OAAO,KAAK;EAEjC,IACE,OAAO,SAAS,oBAChB,OAAO,QAAQ,SAAS,YACxB,OAAO,YAAY,IAAI,SAAS,iBAEhC,QAAQ,IAAI,OAAO,UAAU,GAAG,KAAK;EAEvC,IACE,OAAO,SAAS,sBAChB,OAAO,QAAQ,SAAS,iBAExB,QAAQ,IAAI,OAAO,OAAO,KAAK;EAGjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;GACjD,IACE,QAAQ,UACR,QAAQ,WACR,QAAQ,SACR,QAAQ,SACR,QAAQ,WACR,IAAI,SAAS,UAAU,KACvB,QAAQ,SAER;GAEF,KAAK,KAAK;EACZ;CACF;CAEA,KAAK,IAAI,OAAO;CAChB,OAAO;AACT;AAEA,SAAS,aACP,OACA,MACA,IACoB;CACpB,MAAM,MAAM,UAAU,EAAE;CACxB,IACE,CAAC,MAAM,mBAAmB,IAAI,GAAG,KACjC,CAAC,yBAAyB,KAAK,MAAM,OAAO,GAE5C;CAGF,MAAM,mBAAmB,IAAI,GAAG;CAChC,IAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG;EACpC,MAAM,sBAAsB,IAAI,qBAAK,IAAI,IAAI,CAAC;EAC9C,OAAO;CACT;CAEA,MAAM,aAAa,kBAAkB,GAAG,IACpC,cAAc,MAAM,GAAG,EAAE,OACzB;CACJ,MAAM,sBAAsB,IAAI,KAAK,wBAAwB,UAAU,CAAC;CACxE,OAAO;AACT;AAEA,SAAS,yBACP,OACA,UACM;CACN,IAAI,CAAC,UAAU;CACf,MAAM,KAAK,OAAO,aAAa,WAAW,WAAW,SAAS;CAC9D,IAAI,CAAC,GAAG,SAAS,IAAI,GAAG,MAAM,mBAAmB,IAAI,UAAU,EAAE,CAAC;AACpE;AAEA,SAAS,oBAAoB,SAEjB;CACV,OAAO,QAAQ,aAAa,OAAO,aAAa;AAClD;;;;;;;;AASA,SAAS,sBACP,QACA,UACQ;CACR,MAAM,kBACJ,OAAO,SAAS,4BAChB,OAAO,SAAS;CAClB,MAAM,oBACJ,OAAO,OAAO,cAAc,aACxB,OAAO,YACP,OAAO,WAAW;CACxB,MAAM,oBACJ,OAAO,OAAO,cAAc,aACxB,OAAO,YACP,OAAO,WAAW;CACxB,MAAM,qBACJ,OAAO,OAAO,eAAe,aACzB,OAAO,aACP,OAAO,YAAY;CAEzB,OAAO;EACL,GAAG;EACH,mBAAmB,aAAa;GAC9B,OACE,YAAY,OAAO,aAAa,YAC/B,mBAAmB,YAAY,OAAO,aAAa;EAExD;EACA,YAAY,qBACR,SAAU,GAAG,MAAM;GACjB,IAAI,oBAAoB,IAAI,GAAG;GAC/B,OAAO,mBAAmB,MAAM,MAAM,IAAI;EAC5C,IACA;EACJ,WAAW,oBACP,eAAgB,MAAM,IAAI,SAAS;GACjC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,OAAO,kBAAkB,KAAK,MAAM,MAAM,IAAI,OAAO;GAGvD,MAAM,aAAa,aAAa,UAAU,MAAM,EAAE;GAClD,IAAI,eAAe,QAAW,OAAO;GAErC,MAAM,cAAc,MAAM,kBAAkB,KAC1C,MACA,YACA,IACA;IACE,GAAG;IACH,KAAK;GACP,CACF;GAMA,IAAI,OAAO,SAAS,4BAA4B,mBAC9C,KAAK,MAAM,UAAU,SAAS,sBAAsB,IAClD,UAAU,EAAE,CACd,KAAK,CAAC,GAMJ,yBAAyB,UAAU,MALZ,kBAAkB,KAAK,MAAM,QAAQ,IAAI;IAC9D,YAAY,CAAC;IACb,SAAS;IACT,KAAK;GACP,CAAC,CAC0C;GAI/C,OAAO;EACT,IACA;EACJ,WAAW,oBACP,eAAgB,QAAQ,UAAU,SAAS;GACzC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,OAAO,kBAAkB,KAAK,MAAM,QAAQ,UAAU,OAAO;GAG/D,IAAI,CAAC,UAAU,OAAO;GACtB,MAAM,cAAc,UAAU,QAAQ;GAItC,IAAI,EAFF,SAAS,mBAAmB,IAAI,WAAW,KAC3C,yBAAyB,aAAa,SAAS,OAAO,IACpC,OAAO;GAE3B,MAAM,mBACJ,SAAS,sBAAsB,IAAI,WAAW;GAChD,IAAI,oBAAoB,CAAC,iBAAiB,IAAI,MAAM,GAAG,OAAO;GAE9D,MAAM,WAAW,MAAM,kBAAkB,KACvC,MACA,QACA,UACA;IACE,GAAG;IACH,KAAK;GACP,CACF;GACA,yBAAyB,UAAU,QAAQ;GAC3C,OAAO;EACT,IACA;CACN;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoGA,SAAgB,sBACd,UAAwC,CAAC,GAC/B;CACV,MAAM,UAAU,uBAAuB;CACvC,MAAM,WAA6B;EACjC,SAAS,KAAK,QAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;EACtD,oCAAoB,IAAI,IAAI;EAC5B,uCAAuB,IAAI,IAAI;CACjC;CACA,OAAO;EACL,mBAAmB;GACjB,SAAS,QAAQ;GACjB,qBAAqB,QAAQ;EAC/B,CAAC;EACD,WAAW;EACX,aAAa,EAAE,QAAQ,CAAC;EACxB,aAAa,OAAO;EACpB,YAAY;GAAE,GAAG;GAAS;EAAQ,CAAC;CACrC,EAAE,KAAK,WAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAC3D;;;;;;AAOA,eAAsB,4BACpB,SACqC;CACrC,OAAO,qBAAqB;EAC1B,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,SAAS,CACP,GAAG,sBAAsB,EAAE,SAAS,QAAQ,QAAQ,CAAC,GACrD,GAAI,QAAQ,WAAW,CAAC,CAC1B;CACF,CAAC;AACH"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../web/src/vite/index.ts"],"sourcesContent":["/**\n * `@warlock.js/web/vite` — build-tooling subpath, kept separate from the\n * runtime barrel (`@warlock.js/web`) so importing it never pulls `vite` into\n * a project that doesn't build with Vite.\n */\nimport { parse } from \"@babel/parser\";\nimport path from \"node:path\";\nimport type { Plugin } from \"vite\";\nimport {\n  buildHydrationClient,\n  type BuildHydrationClientOptions,\n  type BuildHydrationClientResult,\n} from \"./build-client\";\nimport {\n  gateAResolve,\n  isAppSourcePath,\n  isRecognizedUniversalSurface,\n  isServerFile,\n  isWithinModuleWebFolder,\n} from \"./gate-a-resolve\";\nimport { createPublicEnvTracker, gateBSecrets } from \"./gate-b-secrets\";\nimport { gateCVerify } from \"./gate-c-verify\";\nimport {\n  clientPageRegistry,\n  type ClientPageRegistryPluginOptions,\n} from \"./page-registry-plugin\";\nimport { isProjectableFile, projectModule, projection } from \"./projection\";\n\nexport { buildHydrationClient } from \"./build-client\";\nexport type {\n  BuildHydrationClientOptions,\n  BuildHydrationClientResult,\n  HydrationClientBuildOutput,\n} from \"./build-client\";\nexport { gateAResolve } from \"./gate-a-resolve\";\nexport type {\n  EnvironmentClassifier,\n  EnvironmentClassifierOptions,\n  WarlockEnvironment,\n} from \"./gate-a-resolve\";\nexport { createPublicEnvTracker, gateBSecrets } from \"./gate-b-secrets\";\nexport type { PublicEnvTracker } from \"./gate-b-secrets\";\nexport {\n  buildPublicEnvManifest,\n  findLeakedServerExports,\n  findLeakedServerImportEdges,\n  gateCVerify,\n} from \"./gate-c-verify\";\nexport type {\n  GateCOptions,\n  PublicEnvManifestEntry,\n  ServerExportLeak,\n  ServerImportEdgeLeak,\n} from \"./gate-c-verify\";\nexport {\n  HYDRATION_CLIENT_ENTRY_NAME,\n  createHydrationClientEntry,\n} from \"./hydration-entries\";\nexport type { HydrationClientEntry } from \"./hydration-entries\";\nexport {\n  CLIENT_PAGE_REGISTRY_ID,\n  clientPageRegistry,\n  invalidateClientPageRegistry,\n  RESOLVED_CLIENT_PAGE_REGISTRY_ID,\n} from \"./page-registry-plugin\";\nexport type { ClientPageRegistryPluginOptions } from \"./page-registry-plugin\";\nexport { projection, ProjectionAmbiguityError } from \"./projection\";\nexport type { ProjectionResult } from \"./projection\";\n\nexport type WarlockClientBoundaryOptions = Parameters<\n  typeof gateAResolve\n>[0] & {\n  beforePageHotUpdate?: ClientPageRegistryPluginOptions[\"beforePageHotUpdate\"];\n};\n\nexport type BuildWarlockHydrationClientOptions = Readonly<{\n  appRoot: string;\n  webRoot: string;\n  /** Absolute client output dir — threaded to `buildHydrationClient` (`<outdir>/client`). */\n  outDir: string;\n  resolveAliases: BuildHydrationClientOptions[\"resolveAliases\"];\n  external?: BuildHydrationClientOptions[\"external\"];\n  /** App-configured plugins, appended after Warlock's client-boundary pipeline. */\n  plugins?: BuildHydrationClientOptions[\"plugins\"];\n}>;\n\ntype SsrBoundaryState = {\n  readonly appRoot: string;\n  readonly clientBoundModules: Set<string>;\n  readonly clientImportsByModule: Map<string, Set<string>>;\n};\n\nfunction moduleKey(id: string): string {\n  return id.split(\"?\")[0].replace(/\\\\/g, \"/\");\n}\n\nconst CODE_MODULE_EXTENSION = /\\.([cm]?[jt]sx?)$/;\n\nfunction isStatelessClientSurface(id: string, appRoot: string): boolean {\n  const bare = moduleKey(id);\n  if (!isAppSourcePath(bare, appRoot)) return false;\n  if (isServerFile(bare, appRoot)) return false;\n\n  return (\n    isProjectableFile(bare) ||\n    isRecognizedUniversalSurface(bare) ||\n    isWithinModuleWebFolder(bare, appRoot)\n  );\n}\n\nfunction collectImportSpecifiers(code: string): Set<string> {\n  const ast = parse(code, {\n    sourceType: \"module\",\n    plugins: [\"typescript\", \"jsx\"],\n  });\n  const imports = new Set<string>();\n\n  function walk(node: unknown): void {\n    if (!node || typeof node !== \"object\") return;\n    if (Array.isArray(node)) {\n      for (const child of node) walk(child);\n      return;\n    }\n\n    const record = node as Record<string, any>;\n    if (\n      (record.type === \"ImportDeclaration\" ||\n        record.type === \"ExportNamedDeclaration\" ||\n        record.type === \"ExportAllDeclaration\") &&\n      record.source?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.source.value);\n    }\n    if (\n      record.type === \"CallExpression\" &&\n      record.callee?.type === \"Import\" &&\n      record.arguments?.[0]?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.arguments[0].value);\n    }\n    if (\n      record.type === \"ImportExpression\" &&\n      record.source?.type === \"StringLiteral\"\n    ) {\n      imports.add(record.source.value);\n    }\n\n    for (const [key, child] of Object.entries(record)) {\n      if (\n        key === \"type\" ||\n        key === \"start\" ||\n        key === \"end\" ||\n        key === \"loc\" ||\n        key === \"range\" ||\n        key.endsWith(\"Comments\") ||\n        key === \"extra\"\n      ) {\n        continue;\n      }\n      walk(child);\n    }\n  }\n\n  walk(ast.program);\n  return imports;\n}\n\nfunction clientViewOf(\n  state: SsrBoundaryState,\n  code: string,\n  id: string,\n): string | undefined {\n  const key = moduleKey(id);\n  if (\n    !state.clientBoundModules.has(key) &&\n    !isStatelessClientSurface(key, state.appRoot)\n  ) {\n    return undefined;\n  }\n\n  state.clientBoundModules.add(key);\n  if (!CODE_MODULE_EXTENSION.test(key)) {\n    state.clientImportsByModule.set(key, new Set());\n    return code;\n  }\n\n  const clientCode = isProjectableFile(key)\n    ? projectModule(code, key).code\n    : code;\n  state.clientImportsByModule.set(key, collectImportSpecifiers(clientCode));\n  return clientCode;\n}\n\nfunction markResolvedClientModule(\n  state: SsrBoundaryState,\n  resolved: { id: string } | string | null | false | void,\n): void {\n  if (!resolved) return;\n  const id = typeof resolved === \"string\" ? resolved : resolved.id;\n  if (!id.includes(\"\\0\")) state.clientBoundModules.add(moduleKey(id));\n}\n\nfunction isServerEnvironment(context: {\n  environment?: { config: { consumer?: string } };\n}): boolean {\n  return context.environment?.config.consumer === \"server\";\n}\n\n/**\n * Keeps the production/client pipeline byte-identical, while giving Gate A\n * and Gate B a validation-only view in Vite's development SSR environment.\n * SSR still evaluates the original source: only the gates receive the\n * projected client view, so loader/server exports retain their legitimate\n * server access while component-visible code is refused before evaluation.\n */\nfunction clientEnvironmentOnly(\n  plugin: Plugin,\n  ssrState: SsrBoundaryState,\n): Plugin {\n  const validatesDevSsr =\n    plugin.name === \"warlock:gate-a-resolve\" ||\n    plugin.name === \"warlock:gate-b-secrets\";\n  const originalTransform =\n    typeof plugin.transform === \"function\"\n      ? plugin.transform\n      : plugin.transform?.handler;\n  const originalResolveId =\n    typeof plugin.resolveId === \"function\"\n      ? plugin.resolveId\n      : plugin.resolveId?.handler;\n  const originalBuildStart =\n    typeof plugin.buildStart === \"function\"\n      ? plugin.buildStart\n      : plugin.buildStart?.handler;\n\n  return {\n    ...plugin,\n    applyToEnvironment(environment) {\n      return (\n        environment.config.consumer === \"client\" ||\n        (validatesDevSsr && environment.config.consumer === \"server\")\n      );\n    },\n    buildStart: originalBuildStart\n      ? function (...args) {\n          if (isServerEnvironment(this)) return;\n          return originalBuildStart.apply(this, args);\n        }\n      : undefined,\n    transform: originalTransform\n      ? async function (code, id, options) {\n          if (!isServerEnvironment(this)) {\n            return originalTransform.call(this, code, id, options);\n          }\n\n          const clientCode = clientViewOf(ssrState, code, id);\n          if (clientCode === undefined) return null;\n\n          const transformed = await originalTransform.call(\n            this,\n            clientCode,\n            id,\n            {\n              ...options,\n              ssr: false,\n            },\n          );\n\n          // Vite can externalize a package in the SSR environment before its\n          // normal resolver walk offers that edge to a plugin. Gate A cannot\n          // wait for that walk: validate every import that survived projection\n          // now, while the original TypeScript source and importer are known.\n          if (plugin.name === \"warlock:gate-a-resolve\" && originalResolveId) {\n            for (const source of ssrState.clientImportsByModule.get(\n              moduleKey(id),\n            ) ?? []) {\n              const resolved = await originalResolveId.call(this, source, id, {\n                attributes: {},\n                isEntry: false,\n                ssr: false,\n              });\n              markResolvedClientModule(ssrState, resolved);\n            }\n          }\n\n          return transformed;\n        }\n      : undefined,\n    resolveId: originalResolveId\n      ? async function (source, importer, options) {\n          if (!isServerEnvironment(this)) {\n            return originalResolveId.call(this, source, importer, options);\n          }\n\n          if (!importer) return null;\n          const importerKey = moduleKey(importer);\n          const isClientBound =\n            ssrState.clientBoundModules.has(importerKey) ||\n            isStatelessClientSurface(importerKey, ssrState.appRoot);\n          if (!isClientBound) return null;\n\n          const survivingImports =\n            ssrState.clientImportsByModule.get(importerKey);\n          if (survivingImports && !survivingImports.has(source)) return null;\n\n          const resolved = await originalResolveId.call(\n            this,\n            source,\n            importer,\n            {\n              ...options,\n              ssr: false,\n            },\n          );\n          markResolvedClientModule(ssrState, resolved);\n          return resolved;\n        }\n      : undefined,\n  };\n}\n\n/**\n * The composed client-build pipeline: projection\n * strips the 5 server exports first, THEN Gate B's `transform` checks\n * whatever source remains for inline secret reads, THEN Gate A's\n * `resolveId` judges whatever imports remain. Array order here is\n * `[projection(), gateBSecrets(), gateAResolve()]` to match Vite's own\n * pipeline shape (`transform` before `resolveId`), but array order alone\n * does not guarantee this — see the hook-ordering fact below, which is what\n * actually makes the composition correct.\n *\n * Empirically observed fact (via an instrumented real `vite.build()`, not\n * assumed from plugin array order): for a given module M, Vite/Rollup calls\n * `transform(M)` BEFORE it calls `resolveId` for any of M's own import\n * specifiers — because Rollup must parse M's post-transform source to even\n * discover which specifiers to resolve next. Concretely: `transform` ran on\n * `entry.page.tsx` first, and only after that did `resolveId(\"./dep\", ...)`\n * fire for the import statement still present in the transformed code. A\n * consequence follows directly: if projection's `transform` removes an\n * import statement from a page module entirely (e.g. `loader`'s\n * `@warlock.js/core` import, stripped because `loader` itself is removed),\n * `resolveId` is never invoked for that specifier at all — Gate A doesn't\n * \"let it pass\", it never sees it. Gate A's `resolveId` only fires for\n * imports that survive projection's `transform`, which is exactly why a\n * component-level `@warlock.js/core` import (never touched by projection)\n * still reaches and is refused by Gate A.\n *\n * This is OBSERVED Rollup behavior, not a documented contract — a future\n * Vite/Rollup upgrade could invert it. Pinned by a\n * regression test (`index.spec.ts`, \"D.3 hook ordering pin\") that fails\n * loudly if the ordering ever inverts, and by the `vite` peer floor in\n * `web/package.json` (`>=7.3.5`, the version this was verified against). If\n * that test ever fails after a Vite bump: the failure mode of the ordering\n * assumption breaking is SAFE — projection would stop removing an import\n * statement Gate A still sees, so Gate A would refuse an import it used to\n * silently let a stripped server export take with it. That is a loud build\n * failure (\"Gate A refused an import\"), never a silent client-bundle leak.\n * Do NOT \"fix\" an apparent Gate A false-positive after a Vite upgrade by\n * weakening Gate A (e.g. widening what it lets through) — investigate\n * whether this ordering assumption broke instead; loosening Gate A to work\n * around it would turn a loud failure into the exact silent leak this\n * pipeline exists to prevent.\n *\n * Gate B is placed between the two for the same reason, but for a `transform`\n * hook rather than `resolveId`: within a plugin array, Rollup runs each\n * module's registered `transform` hooks in array order, each one receiving\n * the PREVIOUS plugin's output. Running Gate B after projection means it\n * inspects the POST-projection source — a `process.env.SECRET` read inside\n * `loader` (a server export, legitimately reading a real secret server-side)\n * is invisible to Gate B once projection has already removed `loader`\n * entirely, exactly as it should be: Gate B's job is to fence client-bound\n * code, and projection is what decides what counts as client-bound. A\n * component-level secret read is untouched by projection and still reaches\n * Gate B, which refuses it. Gate B does not depend on Gate A's `resolveId`\n * output at all (orthogonal concern, raw source vs. import paths), so its\n * position relative to Gate A is not load-bearing — it is placed before Gate\n * A only to keep both `transform` hooks adjacent in the array.\n *\n * Gate C (`gate-c-verify.ts`) runs last and only at `generateBundle` — after\n * the entire `transform`/`resolveId` build phase has completed for every\n * plugin, regardless of array position (a Rollup lifecycle fact, not\n * something this array order enforces). It verifies the EMITTED output the\n * other three produced: no server export survived as a top-level binding, no\n * import edge into a server-only package survived into the module graph, and\n * it emits the reviewable `PUBLIC_*` inlined-value manifest. `gateBSecrets` and `gateCVerify` share\n * one `PublicEnvTracker` instance so the manifest and Gate B's own unread-key\n * exclusion check agree by construction, not by coincidence.\n *\n * `clientPageRegistry()` is FIRST, ahead of projection. It contributes no\n * `transform` at all — only a `resolveId`/`load` pair for one synthetic id —\n * so it cannot displace or pre-empt any gate's inspection of any real file.\n * Two reasons for the position, one of which is not load-bearing and is\n * labelled as such:\n *\n * 1. Load-bearing: it must own `virtual:warlock/pages` before Gate A's\n *    `resolveId` (also `enforce: \"pre\"`) reaches its `this.resolve(...)` call\n *    for that specifier. Gate A's nested resolve would find it anyway, but\n *    routing the id through Gate A's importer-chain bookkeeping only to have\n *    it come back means a synthetic id can surface in a user-facing \"Import\n *    chain:\" message. Resolving it first keeps ownership of the id in one\n *    place.\n * 2. NOT load-bearing: the position relative to `projection()`. Projection is\n *    `enforce: \"pre\"` and selects by file BASENAME (`projection.ts:242-248`),\n *    so it transforms every `*.page.tsx` / `layout.tsx` / `root.tsx` that\n *    enters the graph regardless of who imported it or where this plugin sits.\n *    The registry emits absolute POSIX specifiers that Rollup resolves and\n *    loads as ORDINARY file modules — they are not inlined into the virtual\n *    module — so each one is transformed exactly as a page imported from a\n *    real file would be. Projection declines the virtual module itself\n *    (`\\0virtual:warlock/pages` has no matching basename), which is correct:\n *    generated code has no server exports to strip.\n *\n * Point 2 is asserted, not assumed, by a real `vite.build()` in\n * `page-registry-plugin.spec.ts`: a fixture page whose `loader` — and only its\n * `loader` — imports a marker module that Gate A independently PERMITS, built\n * through this exact array, with the marker proven absent from every emitted\n * chunk while the page's own component text is proven present. Inspecting this\n * array's order would prove nothing about what reaches the browser.\n */\nexport function warlockClientBoundary(\n  options: WarlockClientBoundaryOptions = {},\n): Plugin[] {\n  const tracker = createPublicEnvTracker();\n  const ssrState: SsrBoundaryState = {\n    appRoot: path.resolve(options.appRoot ?? process.cwd()),\n    clientBoundModules: new Set(),\n    clientImportsByModule: new Map(),\n  };\n  return [\n    clientPageRegistry({\n      appRoot: options.appRoot,\n      beforePageHotUpdate: options.beforePageHotUpdate,\n    }),\n    projection(),\n    gateBSecrets({ tracker }),\n    gateAResolve(options),\n    gateCVerify({ ...options, tracker }),\n  ].map((plugin) => clientEnvironmentOnly(plugin, ssrState));\n}\n\n/**\n * Callable production seam: callers own their exact source aliases and the\n * app-root classification boundary, while this module owns the one canonical\n * projection/Gate B/Gate A/Gate C composition.\n */\nexport async function buildWarlockHydrationClient(\n  options: BuildWarlockHydrationClientOptions,\n): Promise<BuildHydrationClientResult> {\n  return buildHydrationClient({\n    webRoot: options.webRoot,\n    outDir: options.outDir,\n    resolveAliases: options.resolveAliases,\n    external: options.external,\n    plugins: [\n      ...warlockClientBoundary({ appRoot: options.appRoot }),\n      ...(options.plugins ?? []),\n    ],\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4FA,SAAS,UAAU,IAAoB;CACrC,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,OAAO,GAAG;AAC5C;AAEA,MAAM,wBAAwB;AAE9B,SAAS,yBAAyB,IAAY,SAA0B;CACtE,MAAM,OAAO,UAAU,EAAE;CACzB,IAAI,CAAC,gBAAgB,MAAM,OAAO,GAAG,OAAO;CAC5C,IAAI,aAAa,MAAM,OAAO,GAAG,OAAO;CAExC,OACE,kBAAkB,IAAI,KACtB,6BAA6B,IAAI,KACjC,wBAAwB,MAAM,OAAO;AAEzC;AAEA,SAAS,wBAAwB,MAA2B;CAC1D,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY;EACZ,SAAS,CAAC,cAAc,KAAK;CAC/B,CAAC;CACD,MAAM,0BAAU,IAAI,IAAY;CAEhC,SAAS,KAAK,MAAqB;EACjC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;GACvB,KAAK,MAAM,SAAS,MAAM,KAAK,KAAK;GACpC;EACF;EAEA,MAAM,SAAS;EACf,KACG,OAAO,SAAS,uBACf,OAAO,SAAS,4BAChB,OAAO,SAAS,2BAClB,OAAO,QAAQ,SAAS,iBAExB,QAAQ,IAAI,OAAO,OAAO,KAAK;EAEjC,IACE,OAAO,SAAS,oBAChB,OAAO,QAAQ,SAAS,YACxB,OAAO,YAAY,EAAE,EAAE,SAAS,iBAEhC,QAAQ,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK;EAEvC,IACE,OAAO,SAAS,sBAChB,OAAO,QAAQ,SAAS,iBAExB,QAAQ,IAAI,OAAO,OAAO,KAAK;EAGjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;GACjD,IACE,QAAQ,UACR,QAAQ,WACR,QAAQ,SACR,QAAQ,SACR,QAAQ,WACR,IAAI,SAAS,UAAU,KACvB,QAAQ,SAER;GAEF,KAAK,KAAK;EACZ;CACF;CAEA,KAAK,IAAI,OAAO;CAChB,OAAO;AACT;AAEA,SAAS,aACP,OACA,MACA,IACoB;CACpB,MAAM,MAAM,UAAU,EAAE;CACxB,IACE,CAAC,MAAM,mBAAmB,IAAI,GAAG,KACjC,CAAC,yBAAyB,KAAK,MAAM,OAAO,GAE5C;CAGF,MAAM,mBAAmB,IAAI,GAAG;CAChC,IAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG;EACpC,MAAM,sBAAsB,IAAI,qBAAK,IAAI,IAAI,CAAC;EAC9C,OAAO;CACT;CAEA,MAAM,aAAa,kBAAkB,GAAG,IACpC,cAAc,MAAM,GAAG,CAAC,CAAC,OACzB;CACJ,MAAM,sBAAsB,IAAI,KAAK,wBAAwB,UAAU,CAAC;CACxE,OAAO;AACT;AAEA,SAAS,yBACP,OACA,UACM;CACN,IAAI,CAAC,UAAU;CACf,MAAM,KAAK,OAAO,aAAa,WAAW,WAAW,SAAS;CAC9D,IAAI,CAAC,GAAG,SAAS,IAAI,GAAG,MAAM,mBAAmB,IAAI,UAAU,EAAE,CAAC;AACpE;AAEA,SAAS,oBAAoB,SAEjB;CACV,OAAO,QAAQ,aAAa,OAAO,aAAa;AAClD;;;;;;;;AASA,SAAS,sBACP,QACA,UACQ;CACR,MAAM,kBACJ,OAAO,SAAS,4BAChB,OAAO,SAAS;CAClB,MAAM,oBACJ,OAAO,OAAO,cAAc,aACxB,OAAO,YACP,OAAO,WAAW;CACxB,MAAM,oBACJ,OAAO,OAAO,cAAc,aACxB,OAAO,YACP,OAAO,WAAW;CACxB,MAAM,qBACJ,OAAO,OAAO,eAAe,aACzB,OAAO,aACP,OAAO,YAAY;CAEzB,OAAO;EACL,GAAG;EACH,mBAAmB,aAAa;GAC9B,OACE,YAAY,OAAO,aAAa,YAC/B,mBAAmB,YAAY,OAAO,aAAa;EAExD;EACA,YAAY,qBACR,SAAU,GAAG,MAAM;GACjB,IAAI,oBAAoB,IAAI,GAAG;GAC/B,OAAO,mBAAmB,MAAM,MAAM,IAAI;EAC5C,IACA;EACJ,WAAW,oBACP,eAAgB,MAAM,IAAI,SAAS;GACjC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,OAAO,kBAAkB,KAAK,MAAM,MAAM,IAAI,OAAO;GAGvD,MAAM,aAAa,aAAa,UAAU,MAAM,EAAE;GAClD,IAAI,eAAe,QAAW,OAAO;GAErC,MAAM,cAAc,MAAM,kBAAkB,KAC1C,MACA,YACA,IACA;IACE,GAAG;IACH,KAAK;GACP,CACF;GAMA,IAAI,OAAO,SAAS,4BAA4B,mBAC9C,KAAK,MAAM,UAAU,SAAS,sBAAsB,IAClD,UAAU,EAAE,CACd,KAAK,CAAC,GAMJ,yBAAyB,UAAU,MALZ,kBAAkB,KAAK,MAAM,QAAQ,IAAI;IAC9D,YAAY,CAAC;IACb,SAAS;IACT,KAAK;GACP,CAAC,CAC0C;GAI/C,OAAO;EACT,IACA;EACJ,WAAW,oBACP,eAAgB,QAAQ,UAAU,SAAS;GACzC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,OAAO,kBAAkB,KAAK,MAAM,QAAQ,UAAU,OAAO;GAG/D,IAAI,CAAC,UAAU,OAAO;GACtB,MAAM,cAAc,UAAU,QAAQ;GAItC,IAAI,EAFF,SAAS,mBAAmB,IAAI,WAAW,KAC3C,yBAAyB,aAAa,SAAS,OAAO,IACpC,OAAO;GAE3B,MAAM,mBACJ,SAAS,sBAAsB,IAAI,WAAW;GAChD,IAAI,oBAAoB,CAAC,iBAAiB,IAAI,MAAM,GAAG,OAAO;GAE9D,MAAM,WAAW,MAAM,kBAAkB,KACvC,MACA,QACA,UACA;IACE,GAAG;IACH,KAAK;GACP,CACF;GACA,yBAAyB,UAAU,QAAQ;GAC3C,OAAO;EACT,IACA;CACN;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoGA,SAAgB,sBACd,UAAwC,CAAC,GAC/B;CACV,MAAM,UAAU,uBAAuB;CACvC,MAAM,WAA6B;EACjC,SAAS,KAAK,QAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;EACtD,oCAAoB,IAAI,IAAI;EAC5B,uCAAuB,IAAI,IAAI;CACjC;CACA,OAAO;EACL,mBAAmB;GACjB,SAAS,QAAQ;GACjB,qBAAqB,QAAQ;EAC/B,CAAC;EACD,WAAW;EACX,aAAa,EAAE,QAAQ,CAAC;EACxB,aAAa,OAAO;EACpB,YAAY;GAAE,GAAG;GAAS;EAAQ,CAAC;CACrC,CAAC,CAAC,KAAK,WAAW,sBAAsB,QAAQ,QAAQ,CAAC;AAC3D;;;;;;AAOA,eAAsB,4BACpB,SACqC;CACrC,OAAO,qBAAqB;EAC1B,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,SAAS,CACP,GAAG,sBAAsB,EAAE,SAAS,QAAQ,QAAQ,CAAC,GACrD,GAAI,QAAQ,WAAW,CAAC,CAC1B;CACF,CAAC;AACH"}

package/esm/vite/page-registry-plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"page-registry-plugin.mjs","names":[],"sources":["../../../../../../../web/src/vite/page-registry-plugin.ts"],"sourcesContent":["/**\n * The wire between the two halves that already existed and never met:\n * `discoverPages` (the page graph, read off disk) and `generateClientRegistry`\n * (the module SOURCE that carries that graph into the browser). Neither one\n * touches Vite; this plugin is the only place they are joined, and it joins\n * them as a VIRTUAL module so nothing is ever written to the user's tree.\n *\n * Identical in dev and build — no `apply`/`command` gating, matching the rest\n * of `warlockClientBoundary`'s composition (`index.ts`), which is also\n * mode-agnostic. A registry that differed between `vite dev` and `vite build`\n * would make every dev-only or prod-only page bug unreproducible in the other\n * mode.\n */\nimport { parse } from \"@babel/parser\";\nimport MagicString from \"magic-string\";\nimport path from \"node:path\";\nimport type { Plugin, ViteDevServer } from \"vite\";\nimport { discoverPages, toPosix } from \"../build/discover-pages\";\nimport { generateClientRegistry } from \"../build/generate-client-registry\";\nimport { SERVER_EXPORT_NAMES } from \"./projection\";\n\n/**\n * The specifier application code writes.\n *\n * Exported so the client runtime imports this constant instead of retyping the\n * string: a constant two sides must agree on is a guard, and a guard duplicated\n * at a second site fails open at the third — a typo'd re-spelling doesn't fail\n * loudly, it resolves to \"no such module\" or, worse, to a stale real file.\n */\nexport const CLIENT_PAGE_REGISTRY_ID = \"virtual:warlock/pages\";\n\n/**\n * The resolved id, `\\0`-prefixed per Vite/Rollup convention so no other plugin\n * (and no filesystem watcher) mistakes it for a real path.\n */\nexport const RESOLVED_CLIENT_PAGE_REGISTRY_ID = `\\0${CLIENT_PAGE_REGISTRY_ID}`;\n\n/**\n * Evicts the client registry so its next request re-runs page discovery, then\n * reloads the document so hydration consumes that fresh registry.\n *\n * Vite 7 keeps separate module graphs per environment. Pages are imported by\n * the browser, so only the resolved virtual module in the client graph is the\n * cache entry this operation owns.\n */\nexport function invalidateClientPageRegistry(vite: ViteDevServer): void {\n  const moduleGraph = vite.environments.client.moduleGraph;\n  const registryModule = moduleGraph.getModuleById(RESOLVED_CLIENT_PAGE_REGISTRY_ID);\n\n  if (registryModule) moduleGraph.invalidateModule(registryModule);\n\n  vite.hot.send({ type: \"full-reload\", path: \"*\" });\n}\n\nexport type ClientPageRegistryPluginOptions = {\n  /** Absolute path to the application root. Defaults to `process.cwd()`, matching Vite's own default `root` and Gate A's `appRoot` default. */\n  appRoot?: string;\n  /** Source directory name under `appRoot`; forwarded verbatim to `discoverPages`, which defaults it to `\"src\"`. */\n  srcDir?: string;\n  /**\n   * Optional server-side barrier run before this plugin decides how the browser\n   * receives a page update. `true` means the callback already published the\n   * new route graph and sent the required reload, so this hook emits no second\n   * update for the same filesystem event.\n   */\n  beforePageHotUpdate?: (context: {\n    file: string;\n    type: \"create\" | \"update\" | \"delete\";\n  }) => boolean | Promise<boolean>;\n};\n\n/**\n * The import specifiers the emitted registry names must be ABSOLUTE POSIX file\n * paths, never relative ones.\n *\n * A relative specifier resolves against its IMPORTER, and the importer here is\n * `\\0virtual:warlock/pages` — a synthetic id whose `dirname` is not a real\n * directory. `./blog.page.tsx` from that importer resolves to nonsense that\n * fails at bundle time with a path no user authored and no user can act on.\n *\n * Separator normalization is `hydration-entries.ts`'s\n * (`hydration-entries.ts:12-14`) and `discover-pages.ts`'s single\n * `.replace(/\\\\/g, \"/\")` rule, reused via the already-exported `toPosix` rather\n * than spelled a third time — keeping the drive colon (`D:/...`) is exactly\n * what Vite's resolver wants on Windows.\n */\nfunction toImportSpecifier(absoluteFilePath: string): string {\n  return toPosix(path.resolve(absoluteFilePath));\n}\n\n/**\n * Erases the generated module's TypeScript down to plain JavaScript.\n *\n * NOT optional, and not a style choice. Vite's `vite:esbuild` transform is\n * gated behind `createFilter`, which refuses ANY id containing a NUL byte\n * (`node_modules/vite/dist/node/chunks/config.js:1512` — `if\n * (id.includes(\"\\0\")) return false`). So the one module in this build that is\n * `\\0`-prefixed by convention is precisely the one module esbuild will never\n * transform, while `generateClientRegistry` always emits TypeScript (a\n * type-only `ClientPageEntry` import plus the array's type annotation). Handed\n * to Rollup verbatim, `import type { ClientPageEntry } from ...` is a\n * JavaScript syntax error.\n *\n * Done with the AST rather than a regex, using the same `@babel/parser` +\n * `MagicString` pair `projection.ts` already uses in this directory — a regex\n * over generated source is a second grammar that drifts from the generator's\n * silently. If the generator ever emits a TS construct outside these two\n * shapes, the result is a Rollup parse error naming the virtual module: loud,\n * not silent. `page-registry-plugin.spec.ts` pins that the erased output\n * re-parses as plain JavaScript with the TypeScript plugin switched OFF.\n */\nfunction eraseTypes(source: string): string {\n  const ast = parse(source, { sourceType: \"module\", plugins: [\"typescript\"] });\n  const magic = new MagicString(source);\n\n  for (const statement of ast.program.body as any[]) {\n    if (statement.type === \"ImportDeclaration\" && statement.importKind === \"type\") {\n      let end = statement.end as number;\n      if (source[end] === \"\\r\" && source[end + 1] === \"\\n\") end += 2;\n      else if (source[end] === \"\\n\") end += 1;\n      magic.remove(statement.start as number, end);\n      continue;\n    }\n\n    const declaration =\n      statement.type === \"ExportNamedDeclaration\" ? statement.declaration : statement;\n\n    if (declaration?.type !== \"VariableDeclaration\") continue;\n\n    for (const declarator of declaration.declarations as any[]) {\n      const annotation = declarator.id?.typeAnnotation;\n      if (annotation) magic.remove(annotation.start as number, annotation.end as number);\n    }\n  }\n\n  return magic.toString();\n}\n\n/**\n * The four file shapes that carry SERVER data (`metadata` chief among them)\n * and are therefore projected before the client graph forms — the exact set\n * `projection.ts`'s `isProjectableFile` matches, spelled here by BASENAME so\n * the two agree by construction on what \"a server-side page module\" is. A\n * change to one of these is the only kind of change whose SERVER half\n * (`metadata`, `loader`, …) can move without the client half moving at all.\n */\nfunction isServerPageModule(file: string): boolean {\n  const base = path.basename(file.split(\"?\")[0]);\n  if (/\\.page\\.tsx?$/.test(base)) return true;\n  if (base === \"layout.tsx\" || base === \"layout.ts\") return true;\n  if (/\\.layout\\.tsx?$/.test(base)) return true;\n  if (base === \"root.tsx\") return true;\n  return false;\n}\n\n/**\n * The server-vs-client reload seam.\n *\n * A page module carries TWO halves. The CLIENT half is the projected code the\n * browser actually runs; Fast Refresh can hot-swap it with zero reloads. The\n * SERVER half — `metadata`, `loader`, `route`, `middleware`, `validation`, `prefix`, plus\n * the imports/locals orphaned with them — is stripped by projection\n * (`projection.ts:49`) and set to `undefined` on hydration\n * (`client/hydrate-page.tsx`), so the browser never holds it and there is\n * nothing on the client to hot-swap. Its effect is felt only when SSR re-runs\n * and re-renders `<head>`; the honest way to apply a change to it is a full\n * document reload.\n *\n * THE RULING (canon `6b240682`), stated as the invariant it is:\n *\n *   FAST REFRESH ONLY WHEN THE ONLY CHANGES ARE INSIDE COMPONENT BODIES.\n *   EVERYTHING ELSE RELOADS.\n *\n * Concretely: any change to an import statement, to a module-level\n * declaration, or to a server export forces a full document reload — whether\n * or not the JSX moved in the same save.\n *\n * WHY AN OVER-APPROXIMATION, AND WHY NOBODY SHOULD \"IMPROVE\" IT BACK\n *\n * Two earlier cuts tried to name the server half EXACTLY and both shipped a\n * stale `<head>`:\n *\n *   1. Comparing only the projected CLIENT code. A save that changed the JSX\n *      *and* `metadata` moved the client half, which was read as proof that\n *      only the JSX moved. Mixed saves took the Fast Refresh branch.\n *   2. Adding the complement — the stripped server half, recovered by\n *      subsequence diff. `projection.ts:447-448` KEEPS an import when the\n *      client reads it, so an import read by BOTH `metadata` and the JSX\n *      lives in the projection and appears in NEITHER half exclusively.\n *      Change its specifier and the complement is byte-identical → Fast\n *      Refresh, stale `<title>`. Shared module-level LOCALS have the same\n *      shape, so extending the complement a third time is a third bug.\n *\n * Both failures were UNDER-approximations, and under-approximating is the\n * unsafe direction. A precise reachability analysis over shared imports and\n * locals is the correct answer and is a later refinement; getting it subtly\n * wrong reproduces this bug again. Over-approximating can only err toward\n * RELOADING. A needless reload costs component state; a missed one ships a\n * stale `<head>` and calls it a hot update.\n *\n * THE ACCEPTED COST, which is not a bug to be optimised away: editing a\n * module-level helper read only by the JSX now reloads.\n *\n * The skeleton has to be captured BEFORE the edit, because by the time\n * `hotUpdate` runs Vite has already hard-invalidated the module and cleared its\n * `transformResult` (`onFileChange` → `invalidateModule`, which runs before any\n * `hotUpdate` hook). The `transform` spy below is that capture: it runs first in\n * the client environment, records the skeleton, and returns nothing so\n * projection still performs the real transform.\n */\ntype SkeletonCache = Map<string, string>;\n\n/**\n * What replaces a refresh-safe body in the skeleton. Its content is irrelevant —\n * only that it is CONSTANT, so two sources that differ solely inside a masked\n * body serialise identically.\n */\nconst MASKED_REFRESH_BODY = \"/*warlock:refresh-body*/\";\n\n/** React's own convention, and the one `react-refresh` itself uses: components are PascalCase. */\nfunction isComponentName(name: string | undefined): boolean {\n  return typeof name === \"string\" && /^[A-Z]/.test(name);\n}\n\n/** The `body` node of a function-shaped expression/declaration, or `undefined` for anything else. */\nfunction functionBody(node: any): any | undefined {\n  if (!node) return undefined;\n  if (\n    node.type === \"FunctionDeclaration\" ||\n    node.type === \"FunctionExpression\" ||\n    node.type === \"ArrowFunctionExpression\"\n  ) {\n    return node.body;\n  }\n  return undefined;\n}\n\n/**\n * Generic duck-typed identifier walk, the same shape `projection.ts`'s\n * `collectIdentifierNames` uses (it is not exported, and re-deriving one\n * OVER-collecting walk is safe here for the same reason it is safe there).\n *\n * Over-collecting — counting an object property key or a shadowing parameter\n * as a \"read\" — can only make the reachable set BIGGER, which can only UNMASK\n * more component bodies, which can only produce more reloads. The safe\n * direction.\n */\nfunction collectIdentifierNames(node: unknown, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  if (Array.isArray(node)) {\n    for (const item of node) collectIdentifierNames(item, names);\n    return;\n  }\n  const record = node as Record<string, unknown>;\n  if (typeof record.type !== \"string\") return;\n  if (record.type === \"Identifier\" || record.type === \"JSXIdentifier\") {\n    names.add((record as any).name);\n  }\n  for (const key of Object.keys(record)) {\n    if (key === \"type\" || key === \"start\" || key === \"end\" || key === \"loc\" || key === \"range\") continue;\n    if (key === \"leadingComments\" || key === \"trailingComments\" || key === \"innerComments\" || key === \"extra\") {\n      continue;\n    }\n    collectIdentifierNames(record[key], names);\n  }\n}\n\n/** The module-scope names a top-level statement binds (the `export` wrapper looked through). */\nfunction topLevelBoundNames(stmt: any): Set<string> {\n  const names = new Set<string>();\n  const declaration = stmt.type === \"ExportNamedDeclaration\" ? stmt.declaration : stmt;\n  if (!declaration) return names;\n  if (declaration.type === \"VariableDeclaration\") {\n    for (const declarator of declaration.declarations) {\n      if (declarator.id?.type === \"Identifier\") names.add(declarator.id.name);\n    }\n  } else if (declaration.id?.type === \"Identifier\") {\n    names.add(declaration.id.name);\n  }\n  return names;\n}\n\n/**\n * Every module-scope name reachable from one of the six server exports.\n *\n * Used ONLY to UNMASK: a PascalCase function that `metadata` or `loader` can\n * reach is not a component for this purpose, it is a server-side helper that\n * merely looks like one, and a change inside its body must reload. Seeded from\n * any top-level statement binding a `SERVER_EXPORT_NAMES` name — deliberately\n * looser than `projection.ts`'s own `isServerExportDeclaration` (no export\n * requirement, no single-declarator requirement), because seeding from MORE\n * statements can only unmask more, i.e. reload more.\n *\n * Fixpoint, not one pass, for the same reason projection's is: a server-only\n * helper can be reached only through another server-only helper.\n */\nfunction serverReachableNames(body: any[]): Set<string> {\n  const reached = new Set<string>();\n  const declarations = body\n    .filter((stmt) => stmt.type !== \"ImportDeclaration\")\n    .map((stmt) => ({ stmt, names: topLevelBoundNames(stmt) }));\n\n  for (const { stmt, names } of declarations) {\n    let isServerExport = false;\n    for (const name of names) {\n      if (SERVER_EXPORT_NAMES.has(name)) isServerExport = true;\n    }\n    if (isServerExport) collectIdentifierNames(stmt, reached);\n  }\n\n  for (let changed = true; changed; ) {\n    changed = false;\n    for (const { stmt, names } of declarations) {\n      let isReached = false;\n      for (const name of names) {\n        if (reached.has(name)) isReached = true;\n      }\n      if (!isReached) continue;\n      const before = reached.size;\n      collectIdentifierNames(stmt, reached);\n      if (reached.size !== before) changed = true;\n    }\n  }\n\n  return reached;\n}\n\n/**\n * The body node to mask for a top-level statement, or `undefined` if this\n * statement is neither a component declaration nor an exported `register`\n * declaration.\n *\n * Recognised shapes, and only these:\n *   - `export default function () {…}` / `export default () => …` — the page\n *     component, whatever it is called.\n *   - `function Name() {…}` / `const Name = () => …` (PascalCase, optionally\n *     `export`ed) — a component declared alongside it.\n *   - `export function register() {…}` / `export const register = () => …` —\n *     the lifecycle hook whose replacement namespace is invoked by projection.\n *\n * Everything else — `memo(...)`/`forwardRef(...)` wrappers, classes,\n * lowercase helpers, every server export — is left UNMASKED and therefore\n * compared byte-for-byte. That costs Fast Refresh on those shapes and buys the\n * guarantee; see this seam's header.\n */\nfunction componentBodyToMask(stmt: any, serverReachable: Set<string>): any | undefined {\n  if (stmt.type === \"ExportDefaultDeclaration\") return functionBody(stmt.declaration);\n\n  if (stmt.type === \"ExportNamedDeclaration\") {\n    const exported = stmt.declaration;\n    if (exported?.type === \"FunctionDeclaration\" && exported.id?.name === \"register\") {\n      return functionBody(exported);\n    }\n    if (exported?.type === \"VariableDeclaration\" && exported.declarations.length === 1) {\n      const declarator = exported.declarations[0];\n      if (declarator.id?.type === \"Identifier\" && declarator.id.name === \"register\") {\n        return functionBody(declarator.init);\n      }\n    }\n  }\n\n  const declaration = stmt.type === \"ExportNamedDeclaration\" ? stmt.declaration : stmt;\n  if (!declaration) return undefined;\n\n  const named = (name: string | undefined, node: any) =>\n    isComponentName(name) && !serverReachable.has(name as string) ? functionBody(node) : undefined;\n\n  if (declaration.type === \"FunctionDeclaration\") {\n    return named(declaration.id?.name, declaration);\n  }\n  if (declaration.type === \"VariableDeclaration\" && declaration.declarations.length === 1) {\n    const declarator = declaration.declarations[0];\n    if (declarator.id?.type !== \"Identifier\") return undefined;\n    return named(declarator.id.name, declarator.init);\n  }\n  return undefined;\n}\n\n/**\n * The module source with every component and exported `register` body replaced\n * by a constant — the ONE value the reload decision compares across an edit.\n *\n * Everything outside those bodies survives verbatim: imports, signatures,\n * module-level declarations, all six server exports, and the comments and\n * whitespace between them. So the skeleton is unchanged iff the save touched\n * nothing but refresh-safe bodies.\n *\n * Returns `undefined` when the source does not parse — a half-typed file whose\n * error Vite is already reporting from projection's real `transform`. The\n * caller leaves the cache holding the last GOOD skeleton, so the next\n * successful save is still compared against the right baseline.\n */\nfunction captureSkeleton(code: string): string | undefined {\n  let ast: ReturnType<typeof parse>;\n  try {\n    ast = parse(code, { sourceType: \"module\", plugins: [\"typescript\", \"jsx\"] });\n  } catch {\n    return undefined;\n  }\n\n  const body = ast.program.body as any[];\n  const serverReachable = serverReachableNames(body);\n  const magic = new MagicString(code);\n\n  for (const stmt of body) {\n    const bodyNode = componentBodyToMask(stmt, serverReachable);\n    if (!bodyNode) continue;\n    const start = bodyNode.start as number;\n    const end = bodyNode.end as number;\n    if (end > start) magic.overwrite(start, end, MASKED_REFRESH_BODY);\n  }\n\n  return magic.toString();\n}\n\n/**\n * Serves the client page registry at {@link CLIENT_PAGE_REGISTRY_ID}.\n *\n * Discovery runs INSIDE `load`, once per `load` call, and its result is NOT\n * cached across builds — the plugin holds no state at all. A registry cached\n * past the moment a page file appears is a page that silently 404s until\n * someone restarts the dev server, which is a far more expensive bug than\n * re-walking a source tree. Rollup calls `load` once per module per build, and\n * in dev Vite's module graph caches the transformed result until the module is\n * invalidated, so the walk is not per-request either way. (Invalidating that\n * dev-server cache when a page file is ADDED needs a `handleHotUpdate`/watcher\n * hook that belongs with the dev provider slice — see the followup.)\n *\n * `enforce: \"pre\"` and placed FIRST in `warlockClientBoundary`'s array — see\n * that function's comment in `index.ts` for why position is what it is, and\n * `page-registry-plugin.spec.ts` for the real-build proof that the pages this\n * module names still reach `projection()`.\n */\nexport function clientPageRegistry(options: ClientPageRegistryPluginOptions = {}): Plugin {\n  const appRoot = path.resolve(options.appRoot ?? process.cwd());\n\n  // Per-plugin-instance, so two composed pipelines never cross-contaminate.\n  // Holds the last captured SKELETON (source with refresh-safe bodies masked) of\n  // each server page module the client environment transformed — the \"before\"\n  // side of the comparison in `hotUpdate`. See `captureSkeleton` above.\n  const skeletonCache: SkeletonCache = new Map();\n\n  return {\n    name: \"warlock:client-page-registry\",\n    enforce: \"pre\",\n    resolveId(source) {\n      if (source === CLIENT_PAGE_REGISTRY_ID) return RESOLVED_CLIENT_PAGE_REGISTRY_ID;\n      return undefined;\n    },\n    load(id) {\n      if (id !== RESOLVED_CLIENT_PAGE_REGISTRY_ID) return undefined;\n\n      const pages = discoverPages({ appRoot, srcDir: options.srcDir });\n\n      return eraseTypes(generateClientRegistry({ pages, toImportSpecifier }));\n    },\n    /**\n     * Capture-only spy. Records the SKELETON of every server page module the\n     * CLIENT environment transforms, and returns nothing so projection's own\n     * `transform` still does the real work. SERVE-ONLY:\n     * `this.environment.mode !== \"dev\"` skips it during `vite build`, where\n     * there is no `hotUpdate` to feed and the extra parse would be pure cost.\n     */\n    transform(code, id) {\n      if (this.environment?.mode !== \"dev\") return undefined;\n      if (!isServerPageModule(id)) return undefined;\n\n      const skeleton = captureSkeleton(code);\n      if (skeleton !== undefined) skeletonCache.set(id, skeleton);\n\n      return undefined;\n    },\n    /**\n     * Applies the ruling (canon `6b240682`): Fast Refresh ONLY when the only\n     * changes are inside component or exported `register` bodies.\n     *\n     *   - Skeleton moved (an import, a module-level declaration, ANY server\n     *     export — with or without a simultaneous JSX change) → full reload.\n     *   - Skeleton unchanged → defer to Fast Refresh, zero reloads.\n     *\n     * Note what is NOT here: no attempt to name which half a shared import or\n     * local belongs to. That question is what produced the two previous stale\n     * `<head>` bugs; this seam refuses to answer it and reloads instead.\n     * `hotUpdate` exists only on the dev server, so this is serve-only by\n     * construction.\n     */\n    async hotUpdate(context) {\n      if (isServerPageModule(context.file)) {\n        const routeGraphHandled = await options.beforePageHotUpdate?.({\n          file: context.file,\n          type: context.type,\n        });\n\n        if (routeGraphHandled) return [];\n      }\n\n      // `create`/`delete` are page graph churn, not in-place edits — leave them\n      // to Vite's normal handling (a new/removed module reloads on its own).\n      if (context.type !== \"update\") return undefined;\n      if (!isServerPageModule(context.file)) return undefined;\n\n      const nextSource = await context.read();\n      const next = captureSkeleton(nextSource);\n      const prev = skeletonCache.get(context.file);\n\n      // Refresh the cache for the next edit regardless of the decision below.\n      if (next !== undefined) skeletonCache.set(context.file, next);\n\n      // Could not parse the new source (Vite is already reporting that error),\n      // or the client environment never transformed this module — which means\n      // the browser is not holding this page, so there is no stale `<head>` to\n      // ship and nothing a reload of some OTHER page would fix.\n      if (next === undefined || prev === undefined) return undefined;\n\n      // Anything outside a component body moved: the browser cannot hot-swap\n      // it, so reload the document to re-run SSR and re-render `<head>`.\n      // `path: \"*\"` matches Vite's own middleware-mode reload.\n      if (prev !== next) {\n        this.environment.hot.send({ type: \"full-reload\", path: \"*\" });\n\n        // Empty module list: we've issued the update ourselves, so Vite should\n        // not additionally push a Fast Refresh for the client module.\n        return [];\n      }\n\n      // Only component bodies moved: defer to Vite's Fast Refresh with zero\n      // reloads. A no-op re-save falls through the same harmless path.\n      return undefined;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,0BAA0B;;;;;AAMvC,MAAa,mCAAmC,KAAK;;;;;;;;;AAUrD,SAAgB,6BAA6B,MAA2B;CACtE,MAAM,cAAc,KAAK,aAAa,OAAO;CAC7C,MAAM,iBAAiB,YAAY,cAAc,gCAAgC;CAEjF,IAAI,gBAAgB,YAAY,iBAAiB,cAAc;CAE/D,KAAK,IAAI,KAAK;EAAE,MAAM;EAAe,MAAM;CAAI,CAAC;AAClD;;;;;;;;;;;;;;;;AAkCA,SAAS,kBAAkB,kBAAkC;CAC3D,OAAO,QAAQ,KAAK,QAAQ,gBAAgB,CAAC;AAC/C;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAS,WAAW,QAAwB;CAC1C,MAAM,MAAM,MAAM,QAAQ;EAAE,YAAY;EAAU,SAAS,CAAC,YAAY;CAAE,CAAC;CAC3E,MAAM,QAAQ,IAAI,YAAY,MAAM;CAEpC,KAAK,MAAM,aAAa,IAAI,QAAQ,MAAe;EACjD,IAAI,UAAU,SAAS,uBAAuB,UAAU,eAAe,QAAQ;GAC7E,IAAI,MAAM,UAAU;GACpB,IAAI,OAAO,SAAS,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO;QACxD,IAAI,OAAO,SAAS,MAAM,OAAO;GACtC,MAAM,OAAO,UAAU,OAAiB,GAAG;GAC3C;EACF;EAEA,MAAM,cACJ,UAAU,SAAS,2BAA2B,UAAU,cAAc;EAExE,IAAI,aAAa,SAAS,uBAAuB;EAEjD,KAAK,MAAM,cAAc,YAAY,cAAuB;GAC1D,MAAM,aAAa,WAAW,IAAI;GAClC,IAAI,YAAY,MAAM,OAAO,WAAW,OAAiB,WAAW,GAAa;EACnF;CACF;CAEA,OAAO,MAAM,SAAS;AACxB;;;;;;;;;AAUA,SAAS,mBAAmB,MAAuB;CACjD,MAAM,OAAO,KAAK,SAAS,KAAK,MAAM,GAAG,EAAE,EAAE;CAC7C,IAAI,gBAAgB,KAAK,IAAI,GAAG,OAAO;CACvC,IAAI,SAAS,gBAAgB,SAAS,aAAa,OAAO;CAC1D,IAAI,kBAAkB,KAAK,IAAI,GAAG,OAAO;CACzC,IAAI,SAAS,YAAY,OAAO;CAChC,OAAO;AACT;;;;;;AAgEA,MAAM,sBAAsB;;AAG5B,SAAS,gBAAgB,MAAmC;CAC1D,OAAO,OAAO,SAAS,YAAY,SAAS,KAAK,IAAI;AACvD;;AAGA,SAAS,aAAa,MAA4B;CAChD,IAAI,CAAC,MAAM,OAAO;CAClB,IACE,KAAK,SAAS,yBACd,KAAK,SAAS,wBACd,KAAK,SAAS,2BAEd,OAAO,KAAK;AAGhB;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAe,OAA0B;CACvE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACvB,KAAK,MAAM,QAAQ,MAAM,uBAAuB,MAAM,KAAK;EAC3D;CACF;CACA,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,SAAS,UAAU;CACrC,IAAI,OAAO,SAAS,gBAAgB,OAAO,SAAS,iBAClD,MAAM,IAAK,OAAe,IAAI;CAEhC,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;EACrC,IAAI,QAAQ,UAAU,QAAQ,WAAW,QAAQ,SAAS,QAAQ,SAAS,QAAQ,SAAS;EAC5F,IAAI,QAAQ,qBAAqB,QAAQ,sBAAsB,QAAQ,mBAAmB,QAAQ,SAChG;EAEF,uBAAuB,OAAO,MAAM,KAAK;CAC3C;AACF;;AAGA,SAAS,mBAAmB,MAAwB;CAClD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,cAAc,KAAK,SAAS,2BAA2B,KAAK,cAAc;CAChF,IAAI,CAAC,aAAa,OAAO;CACzB,IAAI,YAAY,SAAS,uBACvB;OAAK,MAAM,cAAc,YAAY,cACnC,IAAI,WAAW,IAAI,SAAS,cAAc,MAAM,IAAI,WAAW,GAAG,IAAI;CACxE,OACK,IAAI,YAAY,IAAI,SAAS,cAClC,MAAM,IAAI,YAAY,GAAG,IAAI;CAE/B,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAS,qBAAqB,MAA0B;CACtD,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,eAAe,KAClB,QAAQ,SAAS,KAAK,SAAS,mBAAmB,EAClD,KAAK,UAAU;EAAE;EAAM,OAAO,mBAAmB,IAAI;CAAE,EAAE;CAE5D,KAAK,MAAM,EAAE,MAAM,WAAW,cAAc;EAC1C,IAAI,iBAAiB;EACrB,KAAK,MAAM,QAAQ,OACjB,IAAI,oBAAoB,IAAI,IAAI,GAAG,iBAAiB;EAEtD,IAAI,gBAAgB,uBAAuB,MAAM,OAAO;CAC1D;CAEA,KAAK,IAAI,UAAU,MAAM,UAAW;EAClC,UAAU;EACV,KAAK,MAAM,EAAE,MAAM,WAAW,cAAc;GAC1C,IAAI,YAAY;GAChB,KAAK,MAAM,QAAQ,OACjB,IAAI,QAAQ,IAAI,IAAI,GAAG,YAAY;GAErC,IAAI,CAAC,WAAW;GAChB,MAAM,SAAS,QAAQ;GACvB,uBAAuB,MAAM,OAAO;GACpC,IAAI,QAAQ,SAAS,QAAQ,UAAU;EACzC;CACF;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,oBAAoB,MAAW,iBAA+C;CACrF,IAAI,KAAK,SAAS,4BAA4B,OAAO,aAAa,KAAK,WAAW;CAElF,IAAI,KAAK,SAAS,0BAA0B;EAC1C,MAAM,WAAW,KAAK;EACtB,IAAI,UAAU,SAAS,yBAAyB,SAAS,IAAI,SAAS,YACpE,OAAO,aAAa,QAAQ;EAE9B,IAAI,UAAU,SAAS,yBAAyB,SAAS,aAAa,WAAW,GAAG;GAClF,MAAM,aAAa,SAAS,aAAa;GACzC,IAAI,WAAW,IAAI,SAAS,gBAAgB,WAAW,GAAG,SAAS,YACjE,OAAO,aAAa,WAAW,IAAI;EAEvC;CACF;CAEA,MAAM,cAAc,KAAK,SAAS,2BAA2B,KAAK,cAAc;CAChF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,MAA0B,SACvC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAc,IAAI,aAAa,IAAI,IAAI;CAEvF,IAAI,YAAY,SAAS,uBACvB,OAAO,MAAM,YAAY,IAAI,MAAM,WAAW;CAEhD,IAAI,YAAY,SAAS,yBAAyB,YAAY,aAAa,WAAW,GAAG;EACvF,MAAM,aAAa,YAAY,aAAa;EAC5C,IAAI,WAAW,IAAI,SAAS,cAAc,OAAO;EACjD,OAAO,MAAM,WAAW,GAAG,MAAM,WAAW,IAAI;CAClD;AAEF;;;;;;;;;;;;;;;AAgBA,SAAS,gBAAgB,MAAkC;CACzD,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,MAAM;GAAE,YAAY;GAAU,SAAS,CAAC,cAAc,KAAK;EAAE,CAAC;CAC5E,QAAQ;EACN;CACF;CAEA,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,kBAAkB,qBAAqB,IAAI;CACjD,MAAM,QAAQ,IAAI,YAAY,IAAI;CAElC,KAAK,MAAM,QAAQ,MAAM;EACvB,MAAM,WAAW,oBAAoB,MAAM,eAAe;EAC1D,IAAI,CAAC,UAAU;EACf,MAAM,QAAQ,SAAS;EACvB,MAAM,MAAM,SAAS;EACrB,IAAI,MAAM,OAAO,MAAM,UAAU,OAAO,KAAK,mBAAmB;CAClE;CAEA,OAAO,MAAM,SAAS;AACxB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,mBAAmB,UAA2C,CAAC,GAAW;CACxF,MAAM,UAAU,KAAK,QAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;CAM7D,MAAM,gCAA+B,IAAI,IAAI;CAE7C,OAAO;EACL,MAAM;EACN,SAAS;EACT,UAAU,QAAQ;GAChB,IAAI,oCAAoC,OAAO;EAEjD;EACA,KAAK,IAAI;GACP,IAAI,OAAO,kCAAkC,OAAO;GAIpD,OAAO,WAAW,uBAAuB;IAAE,OAF7B,cAAc;KAAE;KAAS,QAAQ,QAAQ;IAAO,CAEf;IAAG;GAAkB,CAAC,CAAC;EACxE;;;;;;;;EAQA,UAAU,MAAM,IAAI;GAClB,IAAI,KAAK,aAAa,SAAS,OAAO,OAAO;GAC7C,IAAI,CAAC,mBAAmB,EAAE,GAAG,OAAO;GAEpC,MAAM,WAAW,gBAAgB,IAAI;GACrC,IAAI,aAAa,QAAW,cAAc,IAAI,IAAI,QAAQ;EAG5D;;;;;;;;;;;;;;;EAeA,MAAM,UAAU,SAAS;GACvB,IAAI,mBAAmB,QAAQ,IAAI,GAMjC;QAAI,MAL4B,QAAQ,sBAAsB;KAC5D,MAAM,QAAQ;KACd,MAAM,QAAQ;IAChB,CAAC,GAEsB,OAAO,CAAC;GAAC;GAKlC,IAAI,QAAQ,SAAS,UAAU,OAAO;GACtC,IAAI,CAAC,mBAAmB,QAAQ,IAAI,GAAG,OAAO;GAG9C,MAAM,OAAO,gBAAgB,MADJ,QAAQ,KAAK,CACC;GACvC,MAAM,OAAO,cAAc,IAAI,QAAQ,IAAI;GAG3C,IAAI,SAAS,QAAW,cAAc,IAAI,QAAQ,MAAM,IAAI;GAM5D,IAAI,SAAS,UAAa,SAAS,QAAW,OAAO;GAKrD,IAAI,SAAS,MAAM;IACjB,KAAK,YAAY,IAAI,KAAK;KAAE,MAAM;KAAe,MAAM;IAAI,CAAC;IAI5D,OAAO,CAAC;GACV;EAKF;CACF;AACF"}
+{"version":3,"file":"page-registry-plugin.mjs","names":[],"sources":["../../../../../../../web/src/vite/page-registry-plugin.ts"],"sourcesContent":["/**\n * The wire between the two halves that already existed and never met:\n * `discoverPages` (the page graph, read off disk) and `generateClientRegistry`\n * (the module SOURCE that carries that graph into the browser). Neither one\n * touches Vite; this plugin is the only place they are joined, and it joins\n * them as a VIRTUAL module so nothing is ever written to the user's tree.\n *\n * Identical in dev and build — no `apply`/`command` gating, matching the rest\n * of `warlockClientBoundary`'s composition (`index.ts`), which is also\n * mode-agnostic. A registry that differed between `vite dev` and `vite build`\n * would make every dev-only or prod-only page bug unreproducible in the other\n * mode.\n */\nimport { parse } from \"@babel/parser\";\nimport MagicString from \"magic-string\";\nimport path from \"node:path\";\nimport type { Plugin, ViteDevServer } from \"vite\";\nimport { discoverPages, toPosix } from \"../build/discover-pages\";\nimport { generateClientRegistry } from \"../build/generate-client-registry\";\nimport { SERVER_EXPORT_NAMES } from \"./projection\";\n\n/**\n * The specifier application code writes.\n *\n * Exported so the client runtime imports this constant instead of retyping the\n * string: a constant two sides must agree on is a guard, and a guard duplicated\n * at a second site fails open at the third — a typo'd re-spelling doesn't fail\n * loudly, it resolves to \"no such module\" or, worse, to a stale real file.\n */\nexport const CLIENT_PAGE_REGISTRY_ID = \"virtual:warlock/pages\";\n\n/**\n * The resolved id, `\\0`-prefixed per Vite/Rollup convention so no other plugin\n * (and no filesystem watcher) mistakes it for a real path.\n */\nexport const RESOLVED_CLIENT_PAGE_REGISTRY_ID = `\\0${CLIENT_PAGE_REGISTRY_ID}`;\n\n/**\n * Evicts the client registry so its next request re-runs page discovery, then\n * reloads the document so hydration consumes that fresh registry.\n *\n * Vite 7 keeps separate module graphs per environment. Pages are imported by\n * the browser, so only the resolved virtual module in the client graph is the\n * cache entry this operation owns.\n */\nexport function invalidateClientPageRegistry(vite: ViteDevServer): void {\n  const moduleGraph = vite.environments.client.moduleGraph;\n  const registryModule = moduleGraph.getModuleById(RESOLVED_CLIENT_PAGE_REGISTRY_ID);\n\n  if (registryModule) moduleGraph.invalidateModule(registryModule);\n\n  vite.hot.send({ type: \"full-reload\", path: \"*\" });\n}\n\nexport type ClientPageRegistryPluginOptions = {\n  /** Absolute path to the application root. Defaults to `process.cwd()`, matching Vite's own default `root` and Gate A's `appRoot` default. */\n  appRoot?: string;\n  /** Source directory name under `appRoot`; forwarded verbatim to `discoverPages`, which defaults it to `\"src\"`. */\n  srcDir?: string;\n  /**\n   * Optional server-side barrier run before this plugin decides how the browser\n   * receives a page update. `true` means the callback already published the\n   * new route graph and sent the required reload, so this hook emits no second\n   * update for the same filesystem event.\n   */\n  beforePageHotUpdate?: (context: {\n    file: string;\n    type: \"create\" | \"update\" | \"delete\";\n  }) => boolean | Promise<boolean>;\n};\n\n/**\n * The import specifiers the emitted registry names must be ABSOLUTE POSIX file\n * paths, never relative ones.\n *\n * A relative specifier resolves against its IMPORTER, and the importer here is\n * `\\0virtual:warlock/pages` — a synthetic id whose `dirname` is not a real\n * directory. `./blog.page.tsx` from that importer resolves to nonsense that\n * fails at bundle time with a path no user authored and no user can act on.\n *\n * Separator normalization is `hydration-entries.ts`'s\n * (`hydration-entries.ts:12-14`) and `discover-pages.ts`'s single\n * `.replace(/\\\\/g, \"/\")` rule, reused via the already-exported `toPosix` rather\n * than spelled a third time — keeping the drive colon (`D:/...`) is exactly\n * what Vite's resolver wants on Windows.\n */\nfunction toImportSpecifier(absoluteFilePath: string): string {\n  return toPosix(path.resolve(absoluteFilePath));\n}\n\n/**\n * Erases the generated module's TypeScript down to plain JavaScript.\n *\n * NOT optional, and not a style choice. Vite's `vite:esbuild` transform is\n * gated behind `createFilter`, which refuses ANY id containing a NUL byte\n * (`node_modules/vite/dist/node/chunks/config.js:1512` — `if\n * (id.includes(\"\\0\")) return false`). So the one module in this build that is\n * `\\0`-prefixed by convention is precisely the one module esbuild will never\n * transform, while `generateClientRegistry` always emits TypeScript (a\n * type-only `ClientPageEntry` import plus the array's type annotation). Handed\n * to Rollup verbatim, `import type { ClientPageEntry } from ...` is a\n * JavaScript syntax error.\n *\n * Done with the AST rather than a regex, using the same `@babel/parser` +\n * `MagicString` pair `projection.ts` already uses in this directory — a regex\n * over generated source is a second grammar that drifts from the generator's\n * silently. If the generator ever emits a TS construct outside these two\n * shapes, the result is a Rollup parse error naming the virtual module: loud,\n * not silent. `page-registry-plugin.spec.ts` pins that the erased output\n * re-parses as plain JavaScript with the TypeScript plugin switched OFF.\n */\nfunction eraseTypes(source: string): string {\n  const ast = parse(source, { sourceType: \"module\", plugins: [\"typescript\"] });\n  const magic = new MagicString(source);\n\n  for (const statement of ast.program.body as any[]) {\n    if (statement.type === \"ImportDeclaration\" && statement.importKind === \"type\") {\n      let end = statement.end as number;\n      if (source[end] === \"\\r\" && source[end + 1] === \"\\n\") end += 2;\n      else if (source[end] === \"\\n\") end += 1;\n      magic.remove(statement.start as number, end);\n      continue;\n    }\n\n    const declaration =\n      statement.type === \"ExportNamedDeclaration\" ? statement.declaration : statement;\n\n    if (declaration?.type !== \"VariableDeclaration\") continue;\n\n    for (const declarator of declaration.declarations as any[]) {\n      const annotation = declarator.id?.typeAnnotation;\n      if (annotation) magic.remove(annotation.start as number, annotation.end as number);\n    }\n  }\n\n  return magic.toString();\n}\n\n/**\n * The four file shapes that carry SERVER data (`metadata` chief among them)\n * and are therefore projected before the client graph forms — the exact set\n * `projection.ts`'s `isProjectableFile` matches, spelled here by BASENAME so\n * the two agree by construction on what \"a server-side page module\" is. A\n * change to one of these is the only kind of change whose SERVER half\n * (`metadata`, `loader`, …) can move without the client half moving at all.\n */\nfunction isServerPageModule(file: string): boolean {\n  const base = path.basename(file.split(\"?\")[0]);\n  if (/\\.page\\.tsx?$/.test(base)) return true;\n  if (base === \"layout.tsx\" || base === \"layout.ts\") return true;\n  if (/\\.layout\\.tsx?$/.test(base)) return true;\n  if (base === \"root.tsx\") return true;\n  return false;\n}\n\n/**\n * The server-vs-client reload seam.\n *\n * A page module carries TWO halves. The CLIENT half is the projected code the\n * browser actually runs; Fast Refresh can hot-swap it with zero reloads. The\n * SERVER half — `metadata`, `loader`, `route`, `middleware`, `validation`, `prefix`, plus\n * the imports/locals orphaned with them — is stripped by projection\n * (`projection.ts:49`) and set to `undefined` on hydration\n * (`client/hydrate-page.tsx`), so the browser never holds it and there is\n * nothing on the client to hot-swap. Its effect is felt only when SSR re-runs\n * and re-renders `<head>`; the honest way to apply a change to it is a full\n * document reload.\n *\n * THE RULING (canon `6b240682`), stated as the invariant it is:\n *\n *   FAST REFRESH ONLY WHEN THE ONLY CHANGES ARE INSIDE COMPONENT BODIES.\n *   EVERYTHING ELSE RELOADS.\n *\n * Concretely: any change to an import statement, to a module-level\n * declaration, or to a server export forces a full document reload — whether\n * or not the JSX moved in the same save.\n *\n * WHY AN OVER-APPROXIMATION, AND WHY NOBODY SHOULD \"IMPROVE\" IT BACK\n *\n * Two earlier cuts tried to name the server half EXACTLY and both shipped a\n * stale `<head>`:\n *\n *   1. Comparing only the projected CLIENT code. A save that changed the JSX\n *      *and* `metadata` moved the client half, which was read as proof that\n *      only the JSX moved. Mixed saves took the Fast Refresh branch.\n *   2. Adding the complement — the stripped server half, recovered by\n *      subsequence diff. `projection.ts:447-448` KEEPS an import when the\n *      client reads it, so an import read by BOTH `metadata` and the JSX\n *      lives in the projection and appears in NEITHER half exclusively.\n *      Change its specifier and the complement is byte-identical → Fast\n *      Refresh, stale `<title>`. Shared module-level LOCALS have the same\n *      shape, so extending the complement a third time is a third bug.\n *\n * Both failures were UNDER-approximations, and under-approximating is the\n * unsafe direction. A precise reachability analysis over shared imports and\n * locals is the correct answer and is a later refinement; getting it subtly\n * wrong reproduces this bug again. Over-approximating can only err toward\n * RELOADING. A needless reload costs component state; a missed one ships a\n * stale `<head>` and calls it a hot update.\n *\n * THE ACCEPTED COST, which is not a bug to be optimised away: editing a\n * module-level helper read only by the JSX now reloads.\n *\n * The skeleton has to be captured BEFORE the edit, because by the time\n * `hotUpdate` runs Vite has already hard-invalidated the module and cleared its\n * `transformResult` (`onFileChange` → `invalidateModule`, which runs before any\n * `hotUpdate` hook). The `transform` spy below is that capture: it runs first in\n * the client environment, records the skeleton, and returns nothing so\n * projection still performs the real transform.\n */\ntype SkeletonCache = Map<string, string>;\n\n/**\n * What replaces a refresh-safe body in the skeleton. Its content is irrelevant —\n * only that it is CONSTANT, so two sources that differ solely inside a masked\n * body serialise identically.\n */\nconst MASKED_REFRESH_BODY = \"/*warlock:refresh-body*/\";\n\n/** React's own convention, and the one `react-refresh` itself uses: components are PascalCase. */\nfunction isComponentName(name: string | undefined): boolean {\n  return typeof name === \"string\" && /^[A-Z]/.test(name);\n}\n\n/** The `body` node of a function-shaped expression/declaration, or `undefined` for anything else. */\nfunction functionBody(node: any): any | undefined {\n  if (!node) return undefined;\n  if (\n    node.type === \"FunctionDeclaration\" ||\n    node.type === \"FunctionExpression\" ||\n    node.type === \"ArrowFunctionExpression\"\n  ) {\n    return node.body;\n  }\n  return undefined;\n}\n\n/**\n * Generic duck-typed identifier walk, the same shape `projection.ts`'s\n * `collectIdentifierNames` uses (it is not exported, and re-deriving one\n * OVER-collecting walk is safe here for the same reason it is safe there).\n *\n * Over-collecting — counting an object property key or a shadowing parameter\n * as a \"read\" — can only make the reachable set BIGGER, which can only UNMASK\n * more component bodies, which can only produce more reloads. The safe\n * direction.\n */\nfunction collectIdentifierNames(node: unknown, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  if (Array.isArray(node)) {\n    for (const item of node) collectIdentifierNames(item, names);\n    return;\n  }\n  const record = node as Record<string, unknown>;\n  if (typeof record.type !== \"string\") return;\n  if (record.type === \"Identifier\" || record.type === \"JSXIdentifier\") {\n    names.add((record as any).name);\n  }\n  for (const key of Object.keys(record)) {\n    if (key === \"type\" || key === \"start\" || key === \"end\" || key === \"loc\" || key === \"range\") continue;\n    if (key === \"leadingComments\" || key === \"trailingComments\" || key === \"innerComments\" || key === \"extra\") {\n      continue;\n    }\n    collectIdentifierNames(record[key], names);\n  }\n}\n\n/** The module-scope names a top-level statement binds (the `export` wrapper looked through). */\nfunction topLevelBoundNames(stmt: any): Set<string> {\n  const names = new Set<string>();\n  const declaration = stmt.type === \"ExportNamedDeclaration\" ? stmt.declaration : stmt;\n  if (!declaration) return names;\n  if (declaration.type === \"VariableDeclaration\") {\n    for (const declarator of declaration.declarations) {\n      if (declarator.id?.type === \"Identifier\") names.add(declarator.id.name);\n    }\n  } else if (declaration.id?.type === \"Identifier\") {\n    names.add(declaration.id.name);\n  }\n  return names;\n}\n\n/**\n * Every module-scope name reachable from one of the six server exports.\n *\n * Used ONLY to UNMASK: a PascalCase function that `metadata` or `loader` can\n * reach is not a component for this purpose, it is a server-side helper that\n * merely looks like one, and a change inside its body must reload. Seeded from\n * any top-level statement binding a `SERVER_EXPORT_NAMES` name — deliberately\n * looser than `projection.ts`'s own `isServerExportDeclaration` (no export\n * requirement, no single-declarator requirement), because seeding from MORE\n * statements can only unmask more, i.e. reload more.\n *\n * Fixpoint, not one pass, for the same reason projection's is: a server-only\n * helper can be reached only through another server-only helper.\n */\nfunction serverReachableNames(body: any[]): Set<string> {\n  const reached = new Set<string>();\n  const declarations = body\n    .filter((stmt) => stmt.type !== \"ImportDeclaration\")\n    .map((stmt) => ({ stmt, names: topLevelBoundNames(stmt) }));\n\n  for (const { stmt, names } of declarations) {\n    let isServerExport = false;\n    for (const name of names) {\n      if (SERVER_EXPORT_NAMES.has(name)) isServerExport = true;\n    }\n    if (isServerExport) collectIdentifierNames(stmt, reached);\n  }\n\n  for (let changed = true; changed; ) {\n    changed = false;\n    for (const { stmt, names } of declarations) {\n      let isReached = false;\n      for (const name of names) {\n        if (reached.has(name)) isReached = true;\n      }\n      if (!isReached) continue;\n      const before = reached.size;\n      collectIdentifierNames(stmt, reached);\n      if (reached.size !== before) changed = true;\n    }\n  }\n\n  return reached;\n}\n\n/**\n * The body node to mask for a top-level statement, or `undefined` if this\n * statement is neither a component declaration nor an exported `register`\n * declaration.\n *\n * Recognised shapes, and only these:\n *   - `export default function () {…}` / `export default () => …` — the page\n *     component, whatever it is called.\n *   - `function Name() {…}` / `const Name = () => …` (PascalCase, optionally\n *     `export`ed) — a component declared alongside it.\n *   - `export function register() {…}` / `export const register = () => …` —\n *     the lifecycle hook whose replacement namespace is invoked by projection.\n *\n * Everything else — `memo(...)`/`forwardRef(...)` wrappers, classes,\n * lowercase helpers, every server export — is left UNMASKED and therefore\n * compared byte-for-byte. That costs Fast Refresh on those shapes and buys the\n * guarantee; see this seam's header.\n */\nfunction componentBodyToMask(stmt: any, serverReachable: Set<string>): any | undefined {\n  if (stmt.type === \"ExportDefaultDeclaration\") return functionBody(stmt.declaration);\n\n  if (stmt.type === \"ExportNamedDeclaration\") {\n    const exported = stmt.declaration;\n    if (exported?.type === \"FunctionDeclaration\" && exported.id?.name === \"register\") {\n      return functionBody(exported);\n    }\n    if (exported?.type === \"VariableDeclaration\" && exported.declarations.length === 1) {\n      const declarator = exported.declarations[0];\n      if (declarator.id?.type === \"Identifier\" && declarator.id.name === \"register\") {\n        return functionBody(declarator.init);\n      }\n    }\n  }\n\n  const declaration = stmt.type === \"ExportNamedDeclaration\" ? stmt.declaration : stmt;\n  if (!declaration) return undefined;\n\n  const named = (name: string | undefined, node: any) =>\n    isComponentName(name) && !serverReachable.has(name as string) ? functionBody(node) : undefined;\n\n  if (declaration.type === \"FunctionDeclaration\") {\n    return named(declaration.id?.name, declaration);\n  }\n  if (declaration.type === \"VariableDeclaration\" && declaration.declarations.length === 1) {\n    const declarator = declaration.declarations[0];\n    if (declarator.id?.type !== \"Identifier\") return undefined;\n    return named(declarator.id.name, declarator.init);\n  }\n  return undefined;\n}\n\n/**\n * The module source with every component and exported `register` body replaced\n * by a constant — the ONE value the reload decision compares across an edit.\n *\n * Everything outside those bodies survives verbatim: imports, signatures,\n * module-level declarations, all six server exports, and the comments and\n * whitespace between them. So the skeleton is unchanged iff the save touched\n * nothing but refresh-safe bodies.\n *\n * Returns `undefined` when the source does not parse — a half-typed file whose\n * error Vite is already reporting from projection's real `transform`. The\n * caller leaves the cache holding the last GOOD skeleton, so the next\n * successful save is still compared against the right baseline.\n */\nfunction captureSkeleton(code: string): string | undefined {\n  let ast: ReturnType<typeof parse>;\n  try {\n    ast = parse(code, { sourceType: \"module\", plugins: [\"typescript\", \"jsx\"] });\n  } catch {\n    return undefined;\n  }\n\n  const body = ast.program.body as any[];\n  const serverReachable = serverReachableNames(body);\n  const magic = new MagicString(code);\n\n  for (const stmt of body) {\n    const bodyNode = componentBodyToMask(stmt, serverReachable);\n    if (!bodyNode) continue;\n    const start = bodyNode.start as number;\n    const end = bodyNode.end as number;\n    if (end > start) magic.overwrite(start, end, MASKED_REFRESH_BODY);\n  }\n\n  return magic.toString();\n}\n\n/**\n * Serves the client page registry at {@link CLIENT_PAGE_REGISTRY_ID}.\n *\n * Discovery runs INSIDE `load`, once per `load` call, and its result is NOT\n * cached across builds — the plugin holds no state at all. A registry cached\n * past the moment a page file appears is a page that silently 404s until\n * someone restarts the dev server, which is a far more expensive bug than\n * re-walking a source tree. Rollup calls `load` once per module per build, and\n * in dev Vite's module graph caches the transformed result until the module is\n * invalidated, so the walk is not per-request either way. (Invalidating that\n * dev-server cache when a page file is ADDED needs a `handleHotUpdate`/watcher\n * hook that belongs with the dev provider slice — see the followup.)\n *\n * `enforce: \"pre\"` and placed FIRST in `warlockClientBoundary`'s array — see\n * that function's comment in `index.ts` for why position is what it is, and\n * `page-registry-plugin.spec.ts` for the real-build proof that the pages this\n * module names still reach `projection()`.\n */\nexport function clientPageRegistry(options: ClientPageRegistryPluginOptions = {}): Plugin {\n  const appRoot = path.resolve(options.appRoot ?? process.cwd());\n\n  // Per-plugin-instance, so two composed pipelines never cross-contaminate.\n  // Holds the last captured SKELETON (source with refresh-safe bodies masked) of\n  // each server page module the client environment transformed — the \"before\"\n  // side of the comparison in `hotUpdate`. See `captureSkeleton` above.\n  const skeletonCache: SkeletonCache = new Map();\n\n  return {\n    name: \"warlock:client-page-registry\",\n    enforce: \"pre\",\n    resolveId(source) {\n      if (source === CLIENT_PAGE_REGISTRY_ID) return RESOLVED_CLIENT_PAGE_REGISTRY_ID;\n      return undefined;\n    },\n    load(id) {\n      if (id !== RESOLVED_CLIENT_PAGE_REGISTRY_ID) return undefined;\n\n      const pages = discoverPages({ appRoot, srcDir: options.srcDir });\n\n      return eraseTypes(generateClientRegistry({ pages, toImportSpecifier }));\n    },\n    /**\n     * Capture-only spy. Records the SKELETON of every server page module the\n     * CLIENT environment transforms, and returns nothing so projection's own\n     * `transform` still does the real work. SERVE-ONLY:\n     * `this.environment.mode !== \"dev\"` skips it during `vite build`, where\n     * there is no `hotUpdate` to feed and the extra parse would be pure cost.\n     */\n    transform(code, id) {\n      if (this.environment?.mode !== \"dev\") return undefined;\n      if (!isServerPageModule(id)) return undefined;\n\n      const skeleton = captureSkeleton(code);\n      if (skeleton !== undefined) skeletonCache.set(id, skeleton);\n\n      return undefined;\n    },\n    /**\n     * Applies the ruling (canon `6b240682`): Fast Refresh ONLY when the only\n     * changes are inside component or exported `register` bodies.\n     *\n     *   - Skeleton moved (an import, a module-level declaration, ANY server\n     *     export — with or without a simultaneous JSX change) → full reload.\n     *   - Skeleton unchanged → defer to Fast Refresh, zero reloads.\n     *\n     * Note what is NOT here: no attempt to name which half a shared import or\n     * local belongs to. That question is what produced the two previous stale\n     * `<head>` bugs; this seam refuses to answer it and reloads instead.\n     * `hotUpdate` exists only on the dev server, so this is serve-only by\n     * construction.\n     */\n    async hotUpdate(context) {\n      if (isServerPageModule(context.file)) {\n        const routeGraphHandled = await options.beforePageHotUpdate?.({\n          file: context.file,\n          type: context.type,\n        });\n\n        if (routeGraphHandled) return [];\n      }\n\n      // `create`/`delete` are page graph churn, not in-place edits — leave them\n      // to Vite's normal handling (a new/removed module reloads on its own).\n      if (context.type !== \"update\") return undefined;\n      if (!isServerPageModule(context.file)) return undefined;\n\n      const nextSource = await context.read();\n      const next = captureSkeleton(nextSource);\n      const prev = skeletonCache.get(context.file);\n\n      // Refresh the cache for the next edit regardless of the decision below.\n      if (next !== undefined) skeletonCache.set(context.file, next);\n\n      // Could not parse the new source (Vite is already reporting that error),\n      // or the client environment never transformed this module — which means\n      // the browser is not holding this page, so there is no stale `<head>` to\n      // ship and nothing a reload of some OTHER page would fix.\n      if (next === undefined || prev === undefined) return undefined;\n\n      // Anything outside a component body moved: the browser cannot hot-swap\n      // it, so reload the document to re-run SSR and re-render `<head>`.\n      // `path: \"*\"` matches Vite's own middleware-mode reload.\n      if (prev !== next) {\n        this.environment.hot.send({ type: \"full-reload\", path: \"*\" });\n\n        // Empty module list: we've issued the update ourselves, so Vite should\n        // not additionally push a Fast Refresh for the client module.\n        return [];\n      }\n\n      // Only component bodies moved: defer to Vite's Fast Refresh with zero\n      // reloads. A no-op re-save falls through the same harmless path.\n      return undefined;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,0BAA0B;;;;;AAMvC,MAAa,mCAAmC,KAAK;;;;;;;;;AAUrD,SAAgB,6BAA6B,MAA2B;CACtE,MAAM,cAAc,KAAK,aAAa,OAAO;CAC7C,MAAM,iBAAiB,YAAY,cAAc,gCAAgC;CAEjF,IAAI,gBAAgB,YAAY,iBAAiB,cAAc;CAE/D,KAAK,IAAI,KAAK;EAAE,MAAM;EAAe,MAAM;CAAI,CAAC;AAClD;;;;;;;;;;;;;;;;AAkCA,SAAS,kBAAkB,kBAAkC;CAC3D,OAAO,QAAQ,KAAK,QAAQ,gBAAgB,CAAC;AAC/C;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAS,WAAW,QAAwB;CAC1C,MAAM,MAAM,MAAM,QAAQ;EAAE,YAAY;EAAU,SAAS,CAAC,YAAY;CAAE,CAAC;CAC3E,MAAM,QAAQ,IAAI,YAAY,MAAM;CAEpC,KAAK,MAAM,aAAa,IAAI,QAAQ,MAAe;EACjD,IAAI,UAAU,SAAS,uBAAuB,UAAU,eAAe,QAAQ;GAC7E,IAAI,MAAM,UAAU;GACpB,IAAI,OAAO,SAAS,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO;QACxD,IAAI,OAAO,SAAS,MAAM,OAAO;GACtC,MAAM,OAAO,UAAU,OAAiB,GAAG;GAC3C;EACF;EAEA,MAAM,cACJ,UAAU,SAAS,2BAA2B,UAAU,cAAc;EAExE,IAAI,aAAa,SAAS,uBAAuB;EAEjD,KAAK,MAAM,cAAc,YAAY,cAAuB;GAC1D,MAAM,aAAa,WAAW,IAAI;GAClC,IAAI,YAAY,MAAM,OAAO,WAAW,OAAiB,WAAW,GAAa;EACnF;CACF;CAEA,OAAO,MAAM,SAAS;AACxB;;;;;;;;;AAUA,SAAS,mBAAmB,MAAuB;CACjD,MAAM,OAAO,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE;CAC7C,IAAI,gBAAgB,KAAK,IAAI,GAAG,OAAO;CACvC,IAAI,SAAS,gBAAgB,SAAS,aAAa,OAAO;CAC1D,IAAI,kBAAkB,KAAK,IAAI,GAAG,OAAO;CACzC,IAAI,SAAS,YAAY,OAAO;CAChC,OAAO;AACT;;;;;;AAgEA,MAAM,sBAAsB;;AAG5B,SAAS,gBAAgB,MAAmC;CAC1D,OAAO,OAAO,SAAS,YAAY,SAAS,KAAK,IAAI;AACvD;;AAGA,SAAS,aAAa,MAA4B;CAChD,IAAI,CAAC,MAAM,OAAO;CAClB,IACE,KAAK,SAAS,yBACd,KAAK,SAAS,wBACd,KAAK,SAAS,2BAEd,OAAO,KAAK;AAGhB;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAe,OAA0B;CACvE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACvB,KAAK,MAAM,QAAQ,MAAM,uBAAuB,MAAM,KAAK;EAC3D;CACF;CACA,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,SAAS,UAAU;CACrC,IAAI,OAAO,SAAS,gBAAgB,OAAO,SAAS,iBAClD,MAAM,IAAK,OAAe,IAAI;CAEhC,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;EACrC,IAAI,QAAQ,UAAU,QAAQ,WAAW,QAAQ,SAAS,QAAQ,SAAS,QAAQ,SAAS;EAC5F,IAAI,QAAQ,qBAAqB,QAAQ,sBAAsB,QAAQ,mBAAmB,QAAQ,SAChG;EAEF,uBAAuB,OAAO,MAAM,KAAK;CAC3C;AACF;;AAGA,SAAS,mBAAmB,MAAwB;CAClD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,cAAc,KAAK,SAAS,2BAA2B,KAAK,cAAc;CAChF,IAAI,CAAC,aAAa,OAAO;CACzB,IAAI,YAAY,SAAS,uBACvB;OAAK,MAAM,cAAc,YAAY,cACnC,IAAI,WAAW,IAAI,SAAS,cAAc,MAAM,IAAI,WAAW,GAAG,IAAI;CACxE,OACK,IAAI,YAAY,IAAI,SAAS,cAClC,MAAM,IAAI,YAAY,GAAG,IAAI;CAE/B,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAS,qBAAqB,MAA0B;CACtD,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,eAAe,KAClB,QAAQ,SAAS,KAAK,SAAS,mBAAmB,CAAC,CACnD,KAAK,UAAU;EAAE;EAAM,OAAO,mBAAmB,IAAI;CAAE,EAAE;CAE5D,KAAK,MAAM,EAAE,MAAM,WAAW,cAAc;EAC1C,IAAI,iBAAiB;EACrB,KAAK,MAAM,QAAQ,OACjB,IAAI,oBAAoB,IAAI,IAAI,GAAG,iBAAiB;EAEtD,IAAI,gBAAgB,uBAAuB,MAAM,OAAO;CAC1D;CAEA,KAAK,IAAI,UAAU,MAAM,UAAW;EAClC,UAAU;EACV,KAAK,MAAM,EAAE,MAAM,WAAW,cAAc;GAC1C,IAAI,YAAY;GAChB,KAAK,MAAM,QAAQ,OACjB,IAAI,QAAQ,IAAI,IAAI,GAAG,YAAY;GAErC,IAAI,CAAC,WAAW;GAChB,MAAM,SAAS,QAAQ;GACvB,uBAAuB,MAAM,OAAO;GACpC,IAAI,QAAQ,SAAS,QAAQ,UAAU;EACzC;CACF;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,oBAAoB,MAAW,iBAA+C;CACrF,IAAI,KAAK,SAAS,4BAA4B,OAAO,aAAa,KAAK,WAAW;CAElF,IAAI,KAAK,SAAS,0BAA0B;EAC1C,MAAM,WAAW,KAAK;EACtB,IAAI,UAAU,SAAS,yBAAyB,SAAS,IAAI,SAAS,YACpE,OAAO,aAAa,QAAQ;EAE9B,IAAI,UAAU,SAAS,yBAAyB,SAAS,aAAa,WAAW,GAAG;GAClF,MAAM,aAAa,SAAS,aAAa;GACzC,IAAI,WAAW,IAAI,SAAS,gBAAgB,WAAW,GAAG,SAAS,YACjE,OAAO,aAAa,WAAW,IAAI;EAEvC;CACF;CAEA,MAAM,cAAc,KAAK,SAAS,2BAA2B,KAAK,cAAc;CAChF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,MAA0B,SACvC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAc,IAAI,aAAa,IAAI,IAAI;CAEvF,IAAI,YAAY,SAAS,uBACvB,OAAO,MAAM,YAAY,IAAI,MAAM,WAAW;CAEhD,IAAI,YAAY,SAAS,yBAAyB,YAAY,aAAa,WAAW,GAAG;EACvF,MAAM,aAAa,YAAY,aAAa;EAC5C,IAAI,WAAW,IAAI,SAAS,cAAc,OAAO;EACjD,OAAO,MAAM,WAAW,GAAG,MAAM,WAAW,IAAI;CAClD;AAEF;;;;;;;;;;;;;;;AAgBA,SAAS,gBAAgB,MAAkC;CACzD,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,MAAM;GAAE,YAAY;GAAU,SAAS,CAAC,cAAc,KAAK;EAAE,CAAC;CAC5E,QAAQ;EACN;CACF;CAEA,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,kBAAkB,qBAAqB,IAAI;CACjD,MAAM,QAAQ,IAAI,YAAY,IAAI;CAElC,KAAK,MAAM,QAAQ,MAAM;EACvB,MAAM,WAAW,oBAAoB,MAAM,eAAe;EAC1D,IAAI,CAAC,UAAU;EACf,MAAM,QAAQ,SAAS;EACvB,MAAM,MAAM,SAAS;EACrB,IAAI,MAAM,OAAO,MAAM,UAAU,OAAO,KAAK,mBAAmB;CAClE;CAEA,OAAO,MAAM,SAAS;AACxB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,mBAAmB,UAA2C,CAAC,GAAW;CACxF,MAAM,UAAU,KAAK,QAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;CAM7D,MAAM,gCAA+B,IAAI,IAAI;CAE7C,OAAO;EACL,MAAM;EACN,SAAS;EACT,UAAU,QAAQ;GAChB,IAAI,oCAAoC,OAAO;EAEjD;EACA,KAAK,IAAI;GACP,IAAI,OAAO,kCAAkC,OAAO;GAIpD,OAAO,WAAW,uBAAuB;IAAE,OAF7B,cAAc;KAAE;KAAS,QAAQ,QAAQ;IAAO,CAEf;IAAG;GAAkB,CAAC,CAAC;EACxE;;;;;;;;EAQA,UAAU,MAAM,IAAI;GAClB,IAAI,KAAK,aAAa,SAAS,OAAO,OAAO;GAC7C,IAAI,CAAC,mBAAmB,EAAE,GAAG,OAAO;GAEpC,MAAM,WAAW,gBAAgB,IAAI;GACrC,IAAI,aAAa,QAAW,cAAc,IAAI,IAAI,QAAQ;EAG5D;;;;;;;;;;;;;;;EAeA,MAAM,UAAU,SAAS;GACvB,IAAI,mBAAmB,QAAQ,IAAI,GAMjC;QAAI,MAL4B,QAAQ,sBAAsB;KAC5D,MAAM,QAAQ;KACd,MAAM,QAAQ;IAChB,CAAC,GAEsB,OAAO,CAAC;GAAC;GAKlC,IAAI,QAAQ,SAAS,UAAU,OAAO;GACtC,IAAI,CAAC,mBAAmB,QAAQ,IAAI,GAAG,OAAO;GAG9C,MAAM,OAAO,gBAAgB,MADJ,QAAQ,KAAK,CACC;GACvC,MAAM,OAAO,cAAc,IAAI,QAAQ,IAAI;GAG3C,IAAI,SAAS,QAAW,cAAc,IAAI,QAAQ,MAAM,IAAI;GAM5D,IAAI,SAAS,UAAa,SAAS,QAAW,OAAO;GAKrD,IAAI,SAAS,MAAM;IACjB,KAAK,YAAY,IAAI,KAAK;KAAE,MAAM;KAAe,MAAM;IAAI,CAAC;IAI5D,OAAO,CAAC;GACV;EAKF;CACF;AACF"}

package/esm/vite/projection.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"projection.mjs","names":[],"sources":["../../../../../../../web/src/vite/projection.ts"],"sourcesContent":["/**\n * Projection — the compile-time AST transform that strips a page module's\n * six server exports before the CLIENT graph forms.\n *\n * Removes `export const route/middleware/validation/loader/metadata/prefix = ...`\n * (const-arrow form) and `export async function loader(...) {...}`\n * (function-declaration form — a page declares these as separate named\n * exports, not one fused object, so both forms are real), plus any import\n * OR top-level declaration that becomes\n * unreferenced ONLY as a result of that removal. The default export (the\n * page component) and every other non-server-named export — including the\n * synchronous, no-argument `register()` lifecycle hook — survive\n * unconditionally, regardless of what they reference — classification is by\n * FILE, not by what an export does with data (`c604f0bc` §9).\n *\n * ATTRIBUTION APPLIES TO LOCAL DECLARATIONS, NOT JUST IMPORTS. A page or\n * layout hoists things to module scope for two ordinary reasons, and the\n * reference graph tells them apart without guessing:\n *\n *   `const publishCart: Middleware = ...` + `export const middleware =\n *   [publishCart]` (`v5/app/.../products/web/layout.tsx:30,43`) — the only\n *   reader is a server export being removed, so the binding goes with it.\n *\n *   `const COMMON_TIMEZONES = [...]` read by the default export\n *   (`v5/app/.../account/settings.page.tsx:118,129`) — a surviving reader, so\n *   it survives.\n *\n * That is the SAME rule already applied to import bindings, extended to the\n * other binding kind. It is deliberately not a widening of\n * `SERVER_EXPORT_NAMES`, and not \"accept what I don't recognise\": a\n * declaration is kept when something the client keeps reads it, dropped when\n * nothing does AND dropping it cannot delete a side effect, and REFUSED\n * otherwise — see `isDefinitionShapedInit`.\n *\n * This is NOT Gate A (`resolveId` path refusal), Gate B (inline secret\n * reads) or Gate C (emitted-output verification) — those are separate,\n * later slices. Projection runs first; the gates enforce after.\n */\nimport { parse } from \"@babel/parser\";\nimport MagicString from \"magic-string\";\nimport path from \"node:path\";\nimport type { Plugin } from \"vite\";\n\n/**\n * Exported so Gate C (`gate-c-verify.ts`) can re-derive \"does the emitted\n * bundle contain a server export as a top-level binding\" from this exact set\n * rather than hand-typing a second copy that could drift from projection's\n * own list.\n */\nexport const SERVER_EXPORT_NAMES = new Set([\n  \"route\",\n  \"middleware\",\n  \"validation\",\n  \"loader\",\n  \"metadata\",\n  \"prefix\",\n]);\n\n/**\n * Recognized client-safe assets that always survive projection untouched,\n * whether imported bare (`import \"./x.css\"`) or with specifiers\n * (`import styles from \"./x.module.css\"`) — `c604f0bc` §3 names CSS\n * explicitly; the rest of this list is the same \"never guess, but a known\n * asset extension is not ambiguous\" reasoning extended to the other static\n * asset kinds Vite treats as URL/asset imports, not executable code.\n */\nconst ASSET_EXTENSION_RE =\n  /\\.(css|scss|sass|less|styl|stylus|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|eot|otf)(\\?.*)?$/i;\n\n/**\n * Top-level statement types that need no ambiguity check and are never\n * touched by removal: import declarations are handled by their own\n * survives/orphaned logic below, and every export (other than the 6 server\n * names) plus type-only declarations survive unconditionally per\n * `c604f0bc` §9 (\"classify FILES, not the data they touch\").\n *\n * `ExportAllDeclaration` (`export * from \"./x\"` / `export * as ns from\n * \"./x\"`) is deliberately NOT in this set — it can forward ANY name from its\n * source module, including a server export, and is refused explicitly below\n * rather than assumed safe.\n */\nconst ALWAYS_SAFE_STATEMENT_TYPES = new Set([\n  \"ExportNamedDeclaration\",\n  \"ExportDefaultDeclaration\",\n  \"TSInterfaceDeclaration\",\n  \"TSTypeAliasDeclaration\",\n  \"EmptyStatement\",\n]);\n\n/**\n * Thrown when projection encounters an attribution-ambiguous top-level\n * statement (`c604f0bc` §3: \"the compiler must not guess\"). Carries the\n * file/statement/fix fields the plugin's `transform` hook formats into the\n * build-failure message — never silently kept or silently dropped.\n */\nexport class ProjectionAmbiguityError extends Error {\n  constructor(\n    public readonly file: string,\n    public readonly statement: string,\n    public readonly line: number,\n    public readonly explanation: string,\n    public readonly fix: string,\n  ) {\n    super(\n      [\n        `Projection refused to guess: an ambiguous top-level statement in the client build.`,\n        ``,\n        `File: ${file}:${line}`,\n        `Statement: ${statement}`,\n        `Cause: ${explanation}`,\n        `Fix: ${fix}`,\n      ].join(\"\\n\"),\n    );\n    this.name = \"ProjectionAmbiguityError\";\n  }\n}\n\nexport interface ProjectionResult {\n  code: string;\n  map: ReturnType<MagicString[\"generateMap\"]>;\n}\n\n/** A top-level `const`/`function`/`class` awaiting attribution by reference. */\ninterface LocalDeclaration {\n  stmt: any;\n  /** The module-scope names it binds. */\n  names: Set<string>;\n  /** Whether removing it could delete a side effect — see `isDefinitionShapedInit`. */\n  definitionShaped: boolean;\n  removed: boolean;\n}\n\nfunction hasSurvivingReader(\n  local: LocalDeclaration,\n  survivingNames: Set<string>,\n): boolean {\n  for (const name of local.names) {\n    if (survivingNames.has(name)) return true;\n  }\n  return false;\n}\n\nfunction isKnownSafeAsset(source: string): boolean {\n  return ASSET_EXTENSION_RE.test(source);\n}\n\n/**\n * Matches `export const <name> = ...` only when the declaration has exactly\n * one declarator — every server export in every fixture and v5/app page is\n * written one-const-per-export (`product-details.page.tsx:15-18,42-69,71-74`);\n * a multi-declarator `export const a = 1, b = 2` is left to the ambiguity\n * path below rather than guessing which half is server-only.\n */\nfunction isServerExportDeclaration(stmt: any): boolean {\n  if (stmt.type !== \"ExportNamedDeclaration\" || !stmt.declaration) return false;\n  const decl = stmt.declaration;\n  if (decl.type === \"VariableDeclaration\" && decl.declarations.length === 1) {\n    const id = decl.declarations[0].id;\n    return id?.type === \"Identifier\" && SERVER_EXPORT_NAMES.has(id.name);\n  }\n  if (decl.type === \"FunctionDeclaration\") {\n    return !!decl.id && SERVER_EXPORT_NAMES.has(decl.id.name);\n  }\n  return false;\n}\n\n/**\n * Generic duck-typed AST walk (no `@babel/traverse` dependency — this\n * package only needs `@babel/parser` + `@babel/types`-shaped nodes).\n * Collects every `Identifier`/`JSXIdentifier` name reachable from `node`,\n * used to decide whether an import binding still has a reader once the 6\n * server exports are gone. Over-collecting (e.g. counting an object\n * property key as a \"use\") only ever biases toward KEEPING an import, never\n * toward dropping one that is still needed — the safe direction for a\n * heuristic that must not guess in the removal direction.\n */\nfunction collectIdentifierNames(node: unknown, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  if (Array.isArray(node)) {\n    for (const item of node) collectIdentifierNames(item, names);\n    return;\n  }\n  const record = node as Record<string, unknown>;\n  if (typeof record.type !== \"string\") return;\n  if (record.type === \"Identifier\" || record.type === \"JSXIdentifier\") {\n    names.add((record as any).name);\n  }\n  for (const key of Object.keys(record)) {\n    if (\n      key === \"type\" ||\n      key === \"start\" ||\n      key === \"end\" ||\n      key === \"loc\" ||\n      key === \"range\"\n    )\n      continue;\n    if (\n      key === \"leadingComments\" ||\n      key === \"trailingComments\" ||\n      key === \"innerComments\" ||\n      key === \"extra\"\n    ) {\n      continue;\n    }\n    collectIdentifierNames(record[key], names);\n  }\n}\n\n/**\n * Top-level statements that BIND a name, and are therefore attributable by the\n * reference graph rather than by guessing. Everything outside this set and\n * `ALWAYS_SAFE_STATEMENT_TYPES` declares nothing — a bare `console.log(\"boot\")`\n * has no binding to trace a reader from, which is why it stays a hard refusal.\n */\nconst DECLARATION_STATEMENT_TYPES = new Set([\n  \"VariableDeclaration\",\n  \"FunctionDeclaration\",\n  \"ClassDeclaration\",\n]);\n\nfunction collectPatternNames(node: any, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  switch (node.type) {\n    case \"Identifier\":\n      names.add(node.name);\n      return;\n    case \"ObjectPattern\":\n      for (const property of node.properties) {\n        collectPatternNames(\n          property.type === \"RestElement\" ? property.argument : property.value,\n          names,\n        );\n      }\n      return;\n    case \"ArrayPattern\":\n      for (const element of node.elements) collectPatternNames(element, names);\n      return;\n    case \"AssignmentPattern\":\n      collectPatternNames(node.left, names);\n      return;\n    case \"RestElement\":\n      collectPatternNames(node.argument, names);\n      return;\n  }\n}\n\n/** The names a top-level declaration introduces into module scope. */\nfunction declaredNames(stmt: any): Set<string> {\n  const names = new Set<string>();\n  if (stmt.type === \"VariableDeclaration\") {\n    for (const declarator of stmt.declarations)\n      collectPatternNames(declarator.id, names);\n  } else if (stmt.id?.type === \"Identifier\") {\n    names.add(stmt.id.name);\n  }\n  return names;\n}\n\n/**\n * Whether EVALUATING this initializer can run anything.\n *\n * This is the whole safety argument for removing an unreferenced declaration.\n * A function definition or a literal only creates a value, so dropping it can\n * only drop a binding nothing reads. A call, a `new`, an `await`, a member\n * access (a getter) — those can do work, and \"was that work for the server or\n * for the client?\" is precisely the question projection must not answer by\n * guessing (`c604f0bc` §3). `const _ = installPolyfill()` with no reader at all\n * is the shape this predicate exists to refuse rather than silently delete.\n *\n * Conservative by construction: an unrecognized node type is NOT\n * definition-shaped, so a new syntax form arrives as a refusal with a message,\n * never as a silent removal.\n */\nfunction isDefinitionShapedInit(node: any): boolean {\n  // `let x;` — a bare binding with nothing to evaluate.\n  if (!node) return true;\n\n  switch (node.type) {\n    case \"ArrowFunctionExpression\":\n    case \"FunctionExpression\":\n    case \"StringLiteral\":\n    case \"NumericLiteral\":\n    case \"BooleanLiteral\":\n    case \"NullLiteral\":\n    case \"BigIntLiteral\":\n    case \"RegExpLiteral\":\n    // A bare identifier read is a binding lookup, not a computation.\n    case \"Identifier\":\n      return true;\n    case \"TemplateLiteral\":\n      return node.expressions.every((expression: any) =>\n        isDefinitionShapedInit(expression),\n      );\n    case \"UnaryExpression\":\n      return (\n        node.operator !== \"delete\" && isDefinitionShapedInit(node.argument)\n      );\n    case \"ArrayExpression\":\n      return node.elements.every(\n        (element: any) =>\n          element === null ||\n          (element.type !== \"SpreadElement\" && isDefinitionShapedInit(element)),\n      );\n    case \"ObjectExpression\":\n      // Spread and computed keys both evaluate arbitrary expressions; a getter\n      // or setter defines a body that runs on ACCESS, which the surviving half\n      // could still trigger — none of them are definitions.\n      return node.properties.every(\n        (property: any) =>\n          property.type === \"ObjectProperty\" &&\n          !property.computed &&\n          isDefinitionShapedInit(property.value),\n      );\n    // TS-only wrappers erase at compile time; look through them.\n    case \"TSAsExpression\":\n    case \"TSSatisfiesExpression\":\n    case \"TSNonNullExpression\":\n    case \"TSTypeAssertion\":\n    case \"TSInstantiationExpression\":\n    case \"ParenthesizedExpression\":\n      return isDefinitionShapedInit(node.expression);\n    default:\n      return false;\n  }\n}\n\n/**\n * Statement-level form of the above. A `class` is excluded on purpose: static\n * blocks, decorators and computed member keys all run at class-definition time,\n * so a class is only ever kept or refused, never silently removed.\n */\nfunction isDefinitionShapedStatement(stmt: any): boolean {\n  if (stmt.type === \"FunctionDeclaration\") return true;\n  if (stmt.type !== \"VariableDeclaration\") return false;\n  return stmt.declarations.every((declarator: any) =>\n    isDefinitionShapedInit(declarator.init),\n  );\n}\n\nfunction removeStatement(s: MagicString, code: string, node: any): void {\n  let end = node.end as number;\n  // Swallow one trailing newline so a removed statement doesn't leave a\n  // blank line behind — cosmetic only, the output's correctness never\n  // depends on it.\n  if (code[end] === \"\\r\" && code[end + 1] === \"\\n\") end += 2;\n  else if (code[end] === \"\\n\") end += 1;\n  s.remove(node.start as number, end);\n}\n\nfunction statementSnippet(code: string, node: any): string {\n  return code\n    .slice(node.start as number, node.end as number)\n    .split(\"\\n\")[0]\n    .trim();\n}\n\n/**\n * The transform itself: parse, remove the 6 server exports and every import\n * orphaned only by that removal, fail closed on anything attribution-\n * ambiguous. `filePath` is only used for error messages (`c604f0bc` §7 —\n * fence errors must name the file).\n */\nexport function projectModule(\n  code: string,\n  filePath: string,\n): ProjectionResult {\n  const ast = parse(code, {\n    sourceType: \"module\",\n    plugins: [\"typescript\", \"jsx\"],\n  });\n\n  const s = new MagicString(code);\n  const body = ast.program.body as any[];\n\n  const removedServerExports: any[] = [];\n  const importDeclarations: any[] = [];\n  const localDeclarations: LocalDeclaration[] = [];\n\n  for (const stmt of body) {\n    if (stmt.type === \"ImportDeclaration\") {\n      importDeclarations.push(stmt);\n      continue;\n    }\n    const isNamespaceReexport =\n      stmt.type === \"ExportNamedDeclaration\" &&\n      stmt.source != null &&\n      (stmt.specifiers as any[] | undefined)?.some(\n        (specifier) => specifier.type === \"ExportNamespaceSpecifier\",\n      );\n\n    if (stmt.type === \"ExportAllDeclaration\" || isNamespaceReexport) {\n      // `export * from \"./source\"` (and `export * as ns from \"./source\"`,\n      // which Babel parses as an `ExportNamedDeclaration` carrying an\n      // `ExportNamespaceSpecifier` rather than as `ExportAllDeclaration` —\n      // hence the second check above) re-exports every name the source\n      // module exports, sight unseen.\n      // Projection classifies by file (`c604f0bc` §9) and never opens a\n      // second file to resolve what a re-export actually forwards — doing so\n      // would mean parsing and walking the source module too, i.e. a second\n      // parser. Whether the source exports one of the 6 server names is\n      // therefore unknowable here, so this is attribution-ambiguous the same\n      // way an unrecognized top-level statement is, and gets the same\n      // refusal rather than an assumption that it is safe.\n      throw new ProjectionAmbiguityError(\n        filePath,\n        statementSnippet(code, stmt),\n        stmt.loc.start.line,\n        `a star re-export forwards every name the source module exports, including possibly one of the 6 known server exports (route, middleware, validation, loader, metadata, prefix) — projection cannot inspect the source module's exports without parsing a second file, so it can't tell whether this leaks a server-only binding into the client bundle`,\n        `replace the star re-export with explicit named re-exports (export { ComponentA, ComponentB } from \"./source\"), listing only the client-safe names`,\n      );\n    }\n    if (isServerExportDeclaration(stmt)) {\n      removedServerExports.push(stmt);\n      continue;\n    }\n    if (ALWAYS_SAFE_STATEMENT_TYPES.has(stmt.type)) continue;\n    if (DECLARATION_STATEMENT_TYPES.has(stmt.type)) {\n      // Attributable by the reference graph — decided below, once it is known\n      // which statements survive. NOT accepted here.\n      localDeclarations.push({\n        stmt,\n        names: declaredNames(stmt),\n        definitionShaped: isDefinitionShapedStatement(stmt),\n        removed: false,\n      });\n      continue;\n    }\n\n    // Attribution-IMPOSSIBLE: not an import, not one of the 6 known server\n    // exports, not another export, not a type-only declaration, and it binds\n    // no name for a reader to point at. Fail closed rather than guess which\n    // side of the fence it belongs on (`c604f0bc` §3).\n    throw new ProjectionAmbiguityError(\n      filePath,\n      statementSnippet(code, stmt),\n      stmt.loc.start.line,\n      `top-level executable code that declares nothing — outside the 6 known server exports (route, middleware, validation, loader, metadata, prefix), and binding no name, so projection has no reader to attribute it by and can't tell whether it belongs to the server or the client`,\n      `move universal static declarations and their imports into export function register(), or mark the code with an explicit .server/.client file; server-only work can instead move inside one of the 6 declared server exports`,\n    );\n  }\n\n  const removedLocals = new Set<any>();\n\n  /**\n   * Every name READ by something that survives projection. Imports are excluded\n   * so an import specifier never counts as a use of itself, and a local\n   * declaration does not count as a use of ITSELF either — otherwise a\n   * self-recursive server-only helper would pin its own binding alive forever.\n   *\n   * Over-collecting (an object property key, a shadowing parameter) only ever\n   * biases toward KEEPING, never toward dropping something still needed — the\n   * safe direction for a heuristic that must not guess in the removal\n   * direction.\n   */\n  function collectSurvivingNames(): Set<string> {\n    const names = new Set<string>();\n    for (const stmt of body) {\n      if (stmt.type === \"ImportDeclaration\") continue;\n      if (removedServerExports.includes(stmt) || removedLocals.has(stmt))\n        continue;\n      const own = new Set<string>();\n      collectIdentifierNames(stmt, own);\n      if (DECLARATION_STATEMENT_TYPES.has(stmt.type)) {\n        for (const name of declaredNames(stmt)) own.delete(name);\n      }\n      for (const name of own) names.add(name);\n    }\n    return names;\n  }\n\n  // Fixpoint, not one pass: a server-only helper can be reached only through\n  // ANOTHER server-only helper, and dropping the first orphans the second.\n  let survivingNames = collectSurvivingNames();\n  for (let changed = true; changed;) {\n    changed = false;\n    for (const local of localDeclarations) {\n      if (local.removed || !local.definitionShaped) continue;\n      if (hasSurvivingReader(local, survivingNames)) continue;\n      local.removed = true;\n      removedLocals.add(local.stmt);\n      changed = true;\n    }\n    if (changed) survivingNames = collectSurvivingNames();\n  }\n\n  for (const local of localDeclarations) {\n    if (local.removed || hasSurvivingReader(local, survivingNames)) continue;\n\n    // Nothing the client keeps reads it, so it belongs to the server exports\n    // being removed — but its initializer can RUN, and a side effect is not\n    // attributable by the reference graph. Keeping it ships server work to the\n    // browser; dropping it deletes a side effect the client may depend on.\n    // Refuse rather than pick one (`c604f0bc` §3).\n    throw new ProjectionAmbiguityError(\n      filePath,\n      statementSnippet(code, local.stmt),\n      local.stmt.loc.start.line,\n      `a top-level declaration read only by the server exports being removed, but whose initializer executes code rather than just defining a value — projection can't tell whether that work is server-only or a side effect the client depends on`,\n      `move universal static declarations and their imports into export function register(), move a server-only initializer inside the export that reads it, or split it into an explicit .server/.client file`,\n    );\n  }\n\n  for (const decl of importDeclarations) {\n    const source = decl.source.value as string;\n    if (isKnownSafeAsset(source)) continue; // always survives, no orphan check\n\n    if (decl.specifiers.length === 0) {\n      // A bare side-effect import that isn't a recognized asset extension is\n      // just as attribution-ambiguous as an executable statement — could be\n      // a server-only side effect or something the client genuinely needs.\n      throw new ProjectionAmbiguityError(\n        filePath,\n        statementSnippet(code, decl),\n        decl.loc.start.line,\n        `a bare side-effect import with no recognized client-safe asset extension — projection can't tell if it belongs only to the server exports being removed or must ship to the client`,\n        `move universal static declarations and their imports into export function register(), or mark it with an explicit .server/.client file; server-only work can instead move inside one of the 6 declared server exports`,\n      );\n    }\n\n    const isUsed = decl.specifiers.some((spec: any) =>\n      survivingNames.has(spec.local.name),\n    );\n    if (!isUsed) removeStatement(s, code, decl);\n  }\n\n  for (const stmt of removedServerExports) {\n    removeStatement(s, code, stmt);\n  }\n\n  for (const stmt of removedLocals) {\n    removeStatement(s, code, stmt);\n  }\n\n  return {\n    code: s.toString(),\n    map: s.generateMap({ hires: true, source: filePath }),\n  };\n}\n\nexport function isProjectableFile(id: string): boolean {\n  const base = path.basename(id.split(\"?\")[0]);\n  if (/\\.page\\.tsx?$/.test(base)) return true;\n  if (base === \"layout.tsx\" || base === \"layout.ts\") return true;\n  // NAMED layouts — `dashboard.layout.tsx` and friends — are subjects too.\n  //\n  // Only the exact name `layout.tsx` is POSITIONAL (discovered by its folder).\n  // A named layout is addressed by import instead, which is a documented part of\n  // the contract: `v5/app/src/web/layouts/dashboard.layout.tsx` says so in its\n  // own header, and modules opt in with two re-export lines.\n  //\n  // Projection did not recognise them, and the consequence was not cosmetic.\n  // `dashboard.layout.tsx` calls `navService.forUser()` INSIDE its `loader` —\n  // exactly where server work belongs. But because the file was not a subject,\n  // the loader was never stripped, so its `navService` import survived into the\n  // client graph and dragged auth, the user model and three Node builtins with\n  // it. The app was right and the subject test was wrong.\n  //\n  // Matching `*.layout.tsx` rather than a list of known layout names is\n  // deliberate: an enumerated list is the shape that has produced every other\n  // boundary defect here (canon `eb0c5ee8`).\n  if (/\\.layout\\.tsx?$/.test(base)) return true;\n  if (base === \"root.tsx\") return true;\n  return false;\n}\n\nconst HMR_RUNTIME_SPECIFIER = \"@warlock.js/web/client/runtime\";\n\n/**\n * The projected module shares its scope with application source, so the helper\n * import must not redeclare a name the application already owns. A suffix is\n * only needed for the deliberately unlikely collision, but making it\n * deterministic keeps the generated HMR module valid for every page shape.\n */\nfunction hmrRegisterModulesBinding(code: string): string {\n  const base = \"__warlockRegisterModules\";\n  let binding = base;\n  let index = 2;\n\n  while (new RegExp(`\\\\b${binding}\\\\b`).test(code)) {\n    binding = `${base}${index++}`;\n  }\n\n  return binding;\n}\n\n/**\n * The client-build Vite plugin. Scoped to `*.page.tsx`/`layout.tsx`/`root.tsx`\n * and skipped entirely for the SSR build (`options.ssr`) — the server still\n * needs `route`/`middleware`/`validation`/`loader`/`metadata`/`prefix` intact.\n */\nexport function projection(): Plugin {\n  return {\n    name: \"warlock:projection\",\n    enforce: \"pre\",\n    transform(code, id, options) {\n      if (options?.ssr) return null;\n      if (!isProjectableFile(id)) return null;\n\n      try {\n        const { code: transformed, map } = projectModule(code, id);\n        const registerModules = hmrRegisterModulesBinding(transformed);\n        return {\n          code:\n            `import { registerModules as ${registerModules} } from \"${HMR_RUNTIME_SPECIFIER}\";\\n` +\n            `${transformed}\\n` +\n            `if (import.meta.hot) import.meta.hot.accept((replacement) => { if (replacement) ${registerModules}([replacement]); });\\n`,\n          map,\n        };\n      } catch (error) {\n        if (error instanceof ProjectionAmbiguityError) {\n          this.error(error.message);\n        }\n        throw error;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAa,sBAAsB,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;;AAUD,MAAM,qBACJ;;;;;;;;;;;;;AAcF,MAAM,8BAA8B,IAAI,IAAI;CAC1C;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAQD,IAAa,2BAAb,cAA8C,MAAM;CAEhC;CACA;CACA;CACA;CACA;CALlB,YACE,AAAgB,MAChB,AAAgB,WAChB,AAAgB,MAChB,AAAgB,aAChB,AAAgB,KAChB;EACA,MACE;GACE;GACA;GACA,SAAS,KAAK,GAAG;GACjB,cAAc;GACd,UAAU;GACV,QAAQ;EACV,EAAE,KAAK,IAAI,CACb;EAfgB;EACA;EACA;EACA;EACA;EAYhB,KAAK,OAAO;CACd;AACF;AAiBA,SAAS,mBACP,OACA,gBACS;CACT,KAAK,MAAM,QAAQ,MAAM,OACvB,IAAI,eAAe,IAAI,IAAI,GAAG,OAAO;CAEvC,OAAO;AACT;AAEA,SAAS,iBAAiB,QAAyB;CACjD,OAAO,mBAAmB,KAAK,MAAM;AACvC;;;;;;;;AASA,SAAS,0BAA0B,MAAoB;CACrD,IAAI,KAAK,SAAS,4BAA4B,CAAC,KAAK,aAAa,OAAO;CACxE,MAAM,OAAO,KAAK;CAClB,IAAI,KAAK,SAAS,yBAAyB,KAAK,aAAa,WAAW,GAAG;EACzE,MAAM,KAAK,KAAK,aAAa,GAAG;EAChC,OAAO,IAAI,SAAS,gBAAgB,oBAAoB,IAAI,GAAG,IAAI;CACrE;CACA,IAAI,KAAK,SAAS,uBAChB,OAAO,CAAC,CAAC,KAAK,MAAM,oBAAoB,IAAI,KAAK,GAAG,IAAI;CAE1D,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAe,OAA0B;CACvE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACvB,KAAK,MAAM,QAAQ,MAAM,uBAAuB,MAAM,KAAK;EAC3D;CACF;CACA,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,SAAS,UAAU;CACrC,IAAI,OAAO,SAAS,gBAAgB,OAAO,SAAS,iBAClD,MAAM,IAAK,OAAe,IAAI;CAEhC,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;EACrC,IACE,QAAQ,UACR,QAAQ,WACR,QAAQ,SACR,QAAQ,SACR,QAAQ,SAER;EACF,IACE,QAAQ,qBACR,QAAQ,sBACR,QAAQ,mBACR,QAAQ,SAER;EAEF,uBAAuB,OAAO,MAAM,KAAK;CAC3C;AACF;;;;;;;AAQA,MAAM,8BAA8B,IAAI,IAAI;CAC1C;CACA;CACA;AACF,CAAC;AAED,SAAS,oBAAoB,MAAW,OAA0B;CAChE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,MAAM,IAAI,KAAK,IAAI;GACnB;EACF,KAAK;GACH,KAAK,MAAM,YAAY,KAAK,YAC1B,oBACE,SAAS,SAAS,gBAAgB,SAAS,WAAW,SAAS,OAC/D,KACF;GAEF;EACF,KAAK;GACH,KAAK,MAAM,WAAW,KAAK,UAAU,oBAAoB,SAAS,KAAK;GACvE;EACF,KAAK;GACH,oBAAoB,KAAK,MAAM,KAAK;GACpC;EACF,KAAK;GACH,oBAAoB,KAAK,UAAU,KAAK;GACxC;CACJ;AACF;;AAGA,SAAS,cAAc,MAAwB;CAC7C,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,KAAK,SAAS,uBAChB,KAAK,MAAM,cAAc,KAAK,cAC5B,oBAAoB,WAAW,IAAI,KAAK;MACrC,IAAI,KAAK,IAAI,SAAS,cAC3B,MAAM,IAAI,KAAK,GAAG,IAAI;CAExB,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,MAAoB;CAElD,IAAI,CAAC,MAAM,OAAO;CAElB,QAAQ,KAAK,MAAb;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EAEL,KAAK,cACH,OAAO;EACT,KAAK,mBACH,OAAO,KAAK,YAAY,OAAO,eAC7B,uBAAuB,UAAU,CACnC;EACF,KAAK,mBACH,OACE,KAAK,aAAa,YAAY,uBAAuB,KAAK,QAAQ;EAEtE,KAAK,mBACH,OAAO,KAAK,SAAS,OAClB,YACC,YAAY,QACX,QAAQ,SAAS,mBAAmB,uBAAuB,OAAO,CACvE;EACF,KAAK,oBAIH,OAAO,KAAK,WAAW,OACpB,aACC,SAAS,SAAS,oBAClB,CAAC,SAAS,YACV,uBAAuB,SAAS,KAAK,CACzC;EAEF,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,2BACH,OAAO,uBAAuB,KAAK,UAAU;EAC/C,SACE,OAAO;CACX;AACF;;;;;;AAOA,SAAS,4BAA4B,MAAoB;CACvD,IAAI,KAAK,SAAS,uBAAuB,OAAO;CAChD,IAAI,KAAK,SAAS,uBAAuB,OAAO;CAChD,OAAO,KAAK,aAAa,OAAO,eAC9B,uBAAuB,WAAW,IAAI,CACxC;AACF;AAEA,SAAS,gBAAgB,GAAgB,MAAc,MAAiB;CACtE,IAAI,MAAM,KAAK;CAIf,IAAI,KAAK,SAAS,QAAQ,KAAK,MAAM,OAAO,MAAM,OAAO;MACpD,IAAI,KAAK,SAAS,MAAM,OAAO;CACpC,EAAE,OAAO,KAAK,OAAiB,GAAG;AACpC;AAEA,SAAS,iBAAiB,MAAc,MAAmB;CACzD,OAAO,KACJ,MAAM,KAAK,OAAiB,KAAK,GAAa,EAC9C,MAAM,IAAI,EAAE,GACZ,KAAK;AACV;;;;;;;AAQA,SAAgB,cACd,MACA,UACkB;CAClB,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY;EACZ,SAAS,CAAC,cAAc,KAAK;CAC/B,CAAC;CAED,MAAM,IAAI,IAAI,YAAY,IAAI;CAC9B,MAAM,OAAO,IAAI,QAAQ;CAEzB,MAAM,uBAA8B,CAAC;CACrC,MAAM,qBAA4B,CAAC;CACnC,MAAM,oBAAwC,CAAC;CAE/C,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,KAAK,SAAS,qBAAqB;GACrC,mBAAmB,KAAK,IAAI;GAC5B;EACF;EACA,MAAM,sBACJ,KAAK,SAAS,4BACd,KAAK,UAAU,QACd,KAAK,YAAkC,MACrC,cAAc,UAAU,SAAS,0BACpC;EAEF,IAAI,KAAK,SAAS,0BAA0B,qBAa1C,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,0VACA,mJACF;EAEF,IAAI,0BAA0B,IAAI,GAAG;GACnC,qBAAqB,KAAK,IAAI;GAC9B;EACF;EACA,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAAG;EAChD,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAAG;GAG9C,kBAAkB,KAAK;IACrB;IACA,OAAO,cAAc,IAAI;IACzB,kBAAkB,4BAA4B,IAAI;IAClD,SAAS;GACX,CAAC;GACD;EACF;EAMA,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,qRACA,6NACF;CACF;CAEA,MAAM,gCAAgB,IAAI,IAAS;;;;;;;;;;;;CAanC,SAAS,wBAAqC;EAC5C,MAAM,wBAAQ,IAAI,IAAY;EAC9B,KAAK,MAAM,QAAQ,MAAM;GACvB,IAAI,KAAK,SAAS,qBAAqB;GACvC,IAAI,qBAAqB,SAAS,IAAI,KAAK,cAAc,IAAI,IAAI,GAC/D;GACF,MAAM,sBAAM,IAAI,IAAY;GAC5B,uBAAuB,MAAM,GAAG;GAChC,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAC3C,KAAK,MAAM,QAAQ,cAAc,IAAI,GAAG,IAAI,OAAO,IAAI;GAEzD,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAI;EACxC;EACA,OAAO;CACT;CAIA,IAAI,iBAAiB,sBAAsB;CAC3C,KAAK,IAAI,UAAU,MAAM,UAAU;EACjC,UAAU;EACV,KAAK,MAAM,SAAS,mBAAmB;GACrC,IAAI,MAAM,WAAW,CAAC,MAAM,kBAAkB;GAC9C,IAAI,mBAAmB,OAAO,cAAc,GAAG;GAC/C,MAAM,UAAU;GAChB,cAAc,IAAI,MAAM,IAAI;GAC5B,UAAU;EACZ;EACA,IAAI,SAAS,iBAAiB,sBAAsB;CACtD;CAEA,KAAK,MAAM,SAAS,mBAAmB;EACrC,IAAI,MAAM,WAAW,mBAAmB,OAAO,cAAc,GAAG;EAOhE,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,MAAM,IAAI,GACjC,MAAM,KAAK,IAAI,MAAM,MACrB,gPACA,yMACF;CACF;CAEA,KAAK,MAAM,QAAQ,oBAAoB;EACrC,MAAM,SAAS,KAAK,OAAO;EAC3B,IAAI,iBAAiB,MAAM,GAAG;EAE9B,IAAI,KAAK,WAAW,WAAW,GAI7B,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,sLACA,uNACF;EAMF,IAAI,CAHW,KAAK,WAAW,MAAM,SACnC,eAAe,IAAI,KAAK,MAAM,IAAI,CAE1B,GAAG,gBAAgB,GAAG,MAAM,IAAI;CAC5C;CAEA,KAAK,MAAM,QAAQ,sBACjB,gBAAgB,GAAG,MAAM,IAAI;CAG/B,KAAK,MAAM,QAAQ,eACjB,gBAAgB,GAAG,MAAM,IAAI;CAG/B,OAAO;EACL,MAAM,EAAE,SAAS;EACjB,KAAK,EAAE,YAAY;GAAE,OAAO;GAAM,QAAQ;EAAS,CAAC;CACtD;AACF;AAEA,SAAgB,kBAAkB,IAAqB;CACrD,MAAM,OAAO,KAAK,SAAS,GAAG,MAAM,GAAG,EAAE,EAAE;CAC3C,IAAI,gBAAgB,KAAK,IAAI,GAAG,OAAO;CACvC,IAAI,SAAS,gBAAgB,SAAS,aAAa,OAAO;CAkB1D,IAAI,kBAAkB,KAAK,IAAI,GAAG,OAAO;CACzC,IAAI,SAAS,YAAY,OAAO;CAChC,OAAO;AACT;AAEA,MAAM,wBAAwB;;;;;;;AAQ9B,SAAS,0BAA0B,MAAsB;CACvD,MAAM,OAAO;CACb,IAAI,UAAU;CACd,IAAI,QAAQ;CAEZ,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI,EAAE,KAAK,IAAI,GAC7C,UAAU,GAAG,OAAO;CAGtB,OAAO;AACT;;;;;;AAOA,SAAgB,aAAqB;CACnC,OAAO;EACL,MAAM;EACN,SAAS;EACT,UAAU,MAAM,IAAI,SAAS;GAC3B,IAAI,SAAS,KAAK,OAAO;GACzB,IAAI,CAAC,kBAAkB,EAAE,GAAG,OAAO;GAEnC,IAAI;IACF,MAAM,EAAE,MAAM,aAAa,QAAQ,cAAc,MAAM,EAAE;IACzD,MAAM,kBAAkB,0BAA0B,WAAW;IAC7D,OAAO;KACL,MACE,+BAA+B,gBAAgB,WAAW,sBAAsB,MAC7E,YAAY,oFACoE,gBAAgB;KACrG;IACF;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,0BACnB,KAAK,MAAM,MAAM,OAAO;IAE1B,MAAM;GACR;EACF;CACF;AACF"}
+{"version":3,"file":"projection.mjs","names":[],"sources":["../../../../../../../web/src/vite/projection.ts"],"sourcesContent":["/**\n * Projection — the compile-time AST transform that strips a page module's\n * six server exports before the CLIENT graph forms.\n *\n * Removes `export const route/middleware/validation/loader/metadata/prefix = ...`\n * (const-arrow form) and `export async function loader(...) {...}`\n * (function-declaration form — a page declares these as separate named\n * exports, not one fused object, so both forms are real), plus any import\n * OR top-level declaration that becomes\n * unreferenced ONLY as a result of that removal. The default export (the\n * page component) and every other non-server-named export — including the\n * synchronous, no-argument `register()` lifecycle hook — survive\n * unconditionally, regardless of what they reference — classification is by\n * FILE, not by what an export does with data (`c604f0bc` §9).\n *\n * ATTRIBUTION APPLIES TO LOCAL DECLARATIONS, NOT JUST IMPORTS. A page or\n * layout hoists things to module scope for two ordinary reasons, and the\n * reference graph tells them apart without guessing:\n *\n *   `const publishCart: Middleware = ...` + `export const middleware =\n *   [publishCart]` (`v5/app/.../products/web/layout.tsx:30,43`) — the only\n *   reader is a server export being removed, so the binding goes with it.\n *\n *   `const COMMON_TIMEZONES = [...]` read by the default export\n *   (`v5/app/.../account/settings.page.tsx:118,129`) — a surviving reader, so\n *   it survives.\n *\n * That is the SAME rule already applied to import bindings, extended to the\n * other binding kind. It is deliberately not a widening of\n * `SERVER_EXPORT_NAMES`, and not \"accept what I don't recognise\": a\n * declaration is kept when something the client keeps reads it, dropped when\n * nothing does AND dropping it cannot delete a side effect, and REFUSED\n * otherwise — see `isDefinitionShapedInit`.\n *\n * This is NOT Gate A (`resolveId` path refusal), Gate B (inline secret\n * reads) or Gate C (emitted-output verification) — those are separate,\n * later slices. Projection runs first; the gates enforce after.\n */\nimport { parse } from \"@babel/parser\";\nimport MagicString from \"magic-string\";\nimport path from \"node:path\";\nimport type { Plugin } from \"vite\";\n\n/**\n * Exported so Gate C (`gate-c-verify.ts`) can re-derive \"does the emitted\n * bundle contain a server export as a top-level binding\" from this exact set\n * rather than hand-typing a second copy that could drift from projection's\n * own list.\n */\nexport const SERVER_EXPORT_NAMES = new Set([\n  \"route\",\n  \"middleware\",\n  \"validation\",\n  \"loader\",\n  \"metadata\",\n  \"prefix\",\n]);\n\n/**\n * Recognized client-safe assets that always survive projection untouched,\n * whether imported bare (`import \"./x.css\"`) or with specifiers\n * (`import styles from \"./x.module.css\"`) — `c604f0bc` §3 names CSS\n * explicitly; the rest of this list is the same \"never guess, but a known\n * asset extension is not ambiguous\" reasoning extended to the other static\n * asset kinds Vite treats as URL/asset imports, not executable code.\n */\nconst ASSET_EXTENSION_RE =\n  /\\.(css|scss|sass|less|styl|stylus|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|eot|otf)(\\?.*)?$/i;\n\n/**\n * Top-level statement types that need no ambiguity check and are never\n * touched by removal: import declarations are handled by their own\n * survives/orphaned logic below, and every export (other than the 6 server\n * names) plus type-only declarations survive unconditionally per\n * `c604f0bc` §9 (\"classify FILES, not the data they touch\").\n *\n * `ExportAllDeclaration` (`export * from \"./x\"` / `export * as ns from\n * \"./x\"`) is deliberately NOT in this set — it can forward ANY name from its\n * source module, including a server export, and is refused explicitly below\n * rather than assumed safe.\n */\nconst ALWAYS_SAFE_STATEMENT_TYPES = new Set([\n  \"ExportNamedDeclaration\",\n  \"ExportDefaultDeclaration\",\n  \"TSInterfaceDeclaration\",\n  \"TSTypeAliasDeclaration\",\n  \"EmptyStatement\",\n]);\n\n/**\n * Thrown when projection encounters an attribution-ambiguous top-level\n * statement (`c604f0bc` §3: \"the compiler must not guess\"). Carries the\n * file/statement/fix fields the plugin's `transform` hook formats into the\n * build-failure message — never silently kept or silently dropped.\n */\nexport class ProjectionAmbiguityError extends Error {\n  constructor(\n    public readonly file: string,\n    public readonly statement: string,\n    public readonly line: number,\n    public readonly explanation: string,\n    public readonly fix: string,\n  ) {\n    super(\n      [\n        `Projection refused to guess: an ambiguous top-level statement in the client build.`,\n        ``,\n        `File: ${file}:${line}`,\n        `Statement: ${statement}`,\n        `Cause: ${explanation}`,\n        `Fix: ${fix}`,\n      ].join(\"\\n\"),\n    );\n    this.name = \"ProjectionAmbiguityError\";\n  }\n}\n\nexport interface ProjectionResult {\n  code: string;\n  map: ReturnType<MagicString[\"generateMap\"]>;\n}\n\n/** A top-level `const`/`function`/`class` awaiting attribution by reference. */\ninterface LocalDeclaration {\n  stmt: any;\n  /** The module-scope names it binds. */\n  names: Set<string>;\n  /** Whether removing it could delete a side effect — see `isDefinitionShapedInit`. */\n  definitionShaped: boolean;\n  removed: boolean;\n}\n\nfunction hasSurvivingReader(\n  local: LocalDeclaration,\n  survivingNames: Set<string>,\n): boolean {\n  for (const name of local.names) {\n    if (survivingNames.has(name)) return true;\n  }\n  return false;\n}\n\nfunction isKnownSafeAsset(source: string): boolean {\n  return ASSET_EXTENSION_RE.test(source);\n}\n\n/**\n * Matches `export const <name> = ...` only when the declaration has exactly\n * one declarator — every server export in every fixture and v5/app page is\n * written one-const-per-export (`product-details.page.tsx:15-18,42-69,71-74`);\n * a multi-declarator `export const a = 1, b = 2` is left to the ambiguity\n * path below rather than guessing which half is server-only.\n */\nfunction isServerExportDeclaration(stmt: any): boolean {\n  if (stmt.type !== \"ExportNamedDeclaration\" || !stmt.declaration) return false;\n  const decl = stmt.declaration;\n  if (decl.type === \"VariableDeclaration\" && decl.declarations.length === 1) {\n    const id = decl.declarations[0].id;\n    return id?.type === \"Identifier\" && SERVER_EXPORT_NAMES.has(id.name);\n  }\n  if (decl.type === \"FunctionDeclaration\") {\n    return !!decl.id && SERVER_EXPORT_NAMES.has(decl.id.name);\n  }\n  return false;\n}\n\n/**\n * Generic duck-typed AST walk (no `@babel/traverse` dependency — this\n * package only needs `@babel/parser` + `@babel/types`-shaped nodes).\n * Collects every `Identifier`/`JSXIdentifier` name reachable from `node`,\n * used to decide whether an import binding still has a reader once the 6\n * server exports are gone. Over-collecting (e.g. counting an object\n * property key as a \"use\") only ever biases toward KEEPING an import, never\n * toward dropping one that is still needed — the safe direction for a\n * heuristic that must not guess in the removal direction.\n */\nfunction collectIdentifierNames(node: unknown, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  if (Array.isArray(node)) {\n    for (const item of node) collectIdentifierNames(item, names);\n    return;\n  }\n  const record = node as Record<string, unknown>;\n  if (typeof record.type !== \"string\") return;\n  if (record.type === \"Identifier\" || record.type === \"JSXIdentifier\") {\n    names.add((record as any).name);\n  }\n  for (const key of Object.keys(record)) {\n    if (\n      key === \"type\" ||\n      key === \"start\" ||\n      key === \"end\" ||\n      key === \"loc\" ||\n      key === \"range\"\n    )\n      continue;\n    if (\n      key === \"leadingComments\" ||\n      key === \"trailingComments\" ||\n      key === \"innerComments\" ||\n      key === \"extra\"\n    ) {\n      continue;\n    }\n    collectIdentifierNames(record[key], names);\n  }\n}\n\n/**\n * Top-level statements that BIND a name, and are therefore attributable by the\n * reference graph rather than by guessing. Everything outside this set and\n * `ALWAYS_SAFE_STATEMENT_TYPES` declares nothing — a bare `console.log(\"boot\")`\n * has no binding to trace a reader from, which is why it stays a hard refusal.\n */\nconst DECLARATION_STATEMENT_TYPES = new Set([\n  \"VariableDeclaration\",\n  \"FunctionDeclaration\",\n  \"ClassDeclaration\",\n]);\n\nfunction collectPatternNames(node: any, names: Set<string>): void {\n  if (!node || typeof node !== \"object\") return;\n  switch (node.type) {\n    case \"Identifier\":\n      names.add(node.name);\n      return;\n    case \"ObjectPattern\":\n      for (const property of node.properties) {\n        collectPatternNames(\n          property.type === \"RestElement\" ? property.argument : property.value,\n          names,\n        );\n      }\n      return;\n    case \"ArrayPattern\":\n      for (const element of node.elements) collectPatternNames(element, names);\n      return;\n    case \"AssignmentPattern\":\n      collectPatternNames(node.left, names);\n      return;\n    case \"RestElement\":\n      collectPatternNames(node.argument, names);\n      return;\n  }\n}\n\n/** The names a top-level declaration introduces into module scope. */\nfunction declaredNames(stmt: any): Set<string> {\n  const names = new Set<string>();\n  if (stmt.type === \"VariableDeclaration\") {\n    for (const declarator of stmt.declarations)\n      collectPatternNames(declarator.id, names);\n  } else if (stmt.id?.type === \"Identifier\") {\n    names.add(stmt.id.name);\n  }\n  return names;\n}\n\n/**\n * Whether EVALUATING this initializer can run anything.\n *\n * This is the whole safety argument for removing an unreferenced declaration.\n * A function definition or a literal only creates a value, so dropping it can\n * only drop a binding nothing reads. A call, a `new`, an `await`, a member\n * access (a getter) — those can do work, and \"was that work for the server or\n * for the client?\" is precisely the question projection must not answer by\n * guessing (`c604f0bc` §3). `const _ = installPolyfill()` with no reader at all\n * is the shape this predicate exists to refuse rather than silently delete.\n *\n * Conservative by construction: an unrecognized node type is NOT\n * definition-shaped, so a new syntax form arrives as a refusal with a message,\n * never as a silent removal.\n */\nfunction isDefinitionShapedInit(node: any): boolean {\n  // `let x;` — a bare binding with nothing to evaluate.\n  if (!node) return true;\n\n  switch (node.type) {\n    case \"ArrowFunctionExpression\":\n    case \"FunctionExpression\":\n    case \"StringLiteral\":\n    case \"NumericLiteral\":\n    case \"BooleanLiteral\":\n    case \"NullLiteral\":\n    case \"BigIntLiteral\":\n    case \"RegExpLiteral\":\n    // A bare identifier read is a binding lookup, not a computation.\n    case \"Identifier\":\n      return true;\n    case \"TemplateLiteral\":\n      return node.expressions.every((expression: any) =>\n        isDefinitionShapedInit(expression),\n      );\n    case \"UnaryExpression\":\n      return (\n        node.operator !== \"delete\" && isDefinitionShapedInit(node.argument)\n      );\n    case \"ArrayExpression\":\n      return node.elements.every(\n        (element: any) =>\n          element === null ||\n          (element.type !== \"SpreadElement\" && isDefinitionShapedInit(element)),\n      );\n    case \"ObjectExpression\":\n      // Spread and computed keys both evaluate arbitrary expressions; a getter\n      // or setter defines a body that runs on ACCESS, which the surviving half\n      // could still trigger — none of them are definitions.\n      return node.properties.every(\n        (property: any) =>\n          property.type === \"ObjectProperty\" &&\n          !property.computed &&\n          isDefinitionShapedInit(property.value),\n      );\n    // TS-only wrappers erase at compile time; look through them.\n    case \"TSAsExpression\":\n    case \"TSSatisfiesExpression\":\n    case \"TSNonNullExpression\":\n    case \"TSTypeAssertion\":\n    case \"TSInstantiationExpression\":\n    case \"ParenthesizedExpression\":\n      return isDefinitionShapedInit(node.expression);\n    default:\n      return false;\n  }\n}\n\n/**\n * Statement-level form of the above. A `class` is excluded on purpose: static\n * blocks, decorators and computed member keys all run at class-definition time,\n * so a class is only ever kept or refused, never silently removed.\n */\nfunction isDefinitionShapedStatement(stmt: any): boolean {\n  if (stmt.type === \"FunctionDeclaration\") return true;\n  if (stmt.type !== \"VariableDeclaration\") return false;\n  return stmt.declarations.every((declarator: any) =>\n    isDefinitionShapedInit(declarator.init),\n  );\n}\n\nfunction removeStatement(s: MagicString, code: string, node: any): void {\n  let end = node.end as number;\n  // Swallow one trailing newline so a removed statement doesn't leave a\n  // blank line behind — cosmetic only, the output's correctness never\n  // depends on it.\n  if (code[end] === \"\\r\" && code[end + 1] === \"\\n\") end += 2;\n  else if (code[end] === \"\\n\") end += 1;\n  s.remove(node.start as number, end);\n}\n\nfunction statementSnippet(code: string, node: any): string {\n  return code\n    .slice(node.start as number, node.end as number)\n    .split(\"\\n\")[0]\n    .trim();\n}\n\n/**\n * The transform itself: parse, remove the 6 server exports and every import\n * orphaned only by that removal, fail closed on anything attribution-\n * ambiguous. `filePath` is only used for error messages (`c604f0bc` §7 —\n * fence errors must name the file).\n */\nexport function projectModule(\n  code: string,\n  filePath: string,\n): ProjectionResult {\n  const ast = parse(code, {\n    sourceType: \"module\",\n    plugins: [\"typescript\", \"jsx\"],\n  });\n\n  const s = new MagicString(code);\n  const body = ast.program.body as any[];\n\n  const removedServerExports: any[] = [];\n  const importDeclarations: any[] = [];\n  const localDeclarations: LocalDeclaration[] = [];\n\n  for (const stmt of body) {\n    if (stmt.type === \"ImportDeclaration\") {\n      importDeclarations.push(stmt);\n      continue;\n    }\n    const isNamespaceReexport =\n      stmt.type === \"ExportNamedDeclaration\" &&\n      stmt.source != null &&\n      (stmt.specifiers as any[] | undefined)?.some(\n        (specifier) => specifier.type === \"ExportNamespaceSpecifier\",\n      );\n\n    if (stmt.type === \"ExportAllDeclaration\" || isNamespaceReexport) {\n      // `export * from \"./source\"` (and `export * as ns from \"./source\"`,\n      // which Babel parses as an `ExportNamedDeclaration` carrying an\n      // `ExportNamespaceSpecifier` rather than as `ExportAllDeclaration` —\n      // hence the second check above) re-exports every name the source\n      // module exports, sight unseen.\n      // Projection classifies by file (`c604f0bc` §9) and never opens a\n      // second file to resolve what a re-export actually forwards — doing so\n      // would mean parsing and walking the source module too, i.e. a second\n      // parser. Whether the source exports one of the 6 server names is\n      // therefore unknowable here, so this is attribution-ambiguous the same\n      // way an unrecognized top-level statement is, and gets the same\n      // refusal rather than an assumption that it is safe.\n      throw new ProjectionAmbiguityError(\n        filePath,\n        statementSnippet(code, stmt),\n        stmt.loc.start.line,\n        `a star re-export forwards every name the source module exports, including possibly one of the 6 known server exports (route, middleware, validation, loader, metadata, prefix) — projection cannot inspect the source module's exports without parsing a second file, so it can't tell whether this leaks a server-only binding into the client bundle`,\n        `replace the star re-export with explicit named re-exports (export { ComponentA, ComponentB } from \"./source\"), listing only the client-safe names`,\n      );\n    }\n    if (isServerExportDeclaration(stmt)) {\n      removedServerExports.push(stmt);\n      continue;\n    }\n    if (ALWAYS_SAFE_STATEMENT_TYPES.has(stmt.type)) continue;\n    if (DECLARATION_STATEMENT_TYPES.has(stmt.type)) {\n      // Attributable by the reference graph — decided below, once it is known\n      // which statements survive. NOT accepted here.\n      localDeclarations.push({\n        stmt,\n        names: declaredNames(stmt),\n        definitionShaped: isDefinitionShapedStatement(stmt),\n        removed: false,\n      });\n      continue;\n    }\n\n    // Attribution-IMPOSSIBLE: not an import, not one of the 6 known server\n    // exports, not another export, not a type-only declaration, and it binds\n    // no name for a reader to point at. Fail closed rather than guess which\n    // side of the fence it belongs on (`c604f0bc` §3).\n    throw new ProjectionAmbiguityError(\n      filePath,\n      statementSnippet(code, stmt),\n      stmt.loc.start.line,\n      `top-level executable code that declares nothing — outside the 6 known server exports (route, middleware, validation, loader, metadata, prefix), and binding no name, so projection has no reader to attribute it by and can't tell whether it belongs to the server or the client`,\n      `move universal static declarations and their imports into export function register(), or mark the code with an explicit .server/.client file; server-only work can instead move inside one of the 6 declared server exports`,\n    );\n  }\n\n  const removedLocals = new Set<any>();\n\n  /**\n   * Every name READ by something that survives projection. Imports are excluded\n   * so an import specifier never counts as a use of itself, and a local\n   * declaration does not count as a use of ITSELF either — otherwise a\n   * self-recursive server-only helper would pin its own binding alive forever.\n   *\n   * Over-collecting (an object property key, a shadowing parameter) only ever\n   * biases toward KEEPING, never toward dropping something still needed — the\n   * safe direction for a heuristic that must not guess in the removal\n   * direction.\n   */\n  function collectSurvivingNames(): Set<string> {\n    const names = new Set<string>();\n    for (const stmt of body) {\n      if (stmt.type === \"ImportDeclaration\") continue;\n      if (removedServerExports.includes(stmt) || removedLocals.has(stmt))\n        continue;\n      const own = new Set<string>();\n      collectIdentifierNames(stmt, own);\n      if (DECLARATION_STATEMENT_TYPES.has(stmt.type)) {\n        for (const name of declaredNames(stmt)) own.delete(name);\n      }\n      for (const name of own) names.add(name);\n    }\n    return names;\n  }\n\n  // Fixpoint, not one pass: a server-only helper can be reached only through\n  // ANOTHER server-only helper, and dropping the first orphans the second.\n  let survivingNames = collectSurvivingNames();\n  for (let changed = true; changed;) {\n    changed = false;\n    for (const local of localDeclarations) {\n      if (local.removed || !local.definitionShaped) continue;\n      if (hasSurvivingReader(local, survivingNames)) continue;\n      local.removed = true;\n      removedLocals.add(local.stmt);\n      changed = true;\n    }\n    if (changed) survivingNames = collectSurvivingNames();\n  }\n\n  for (const local of localDeclarations) {\n    if (local.removed || hasSurvivingReader(local, survivingNames)) continue;\n\n    // Nothing the client keeps reads it, so it belongs to the server exports\n    // being removed — but its initializer can RUN, and a side effect is not\n    // attributable by the reference graph. Keeping it ships server work to the\n    // browser; dropping it deletes a side effect the client may depend on.\n    // Refuse rather than pick one (`c604f0bc` §3).\n    throw new ProjectionAmbiguityError(\n      filePath,\n      statementSnippet(code, local.stmt),\n      local.stmt.loc.start.line,\n      `a top-level declaration read only by the server exports being removed, but whose initializer executes code rather than just defining a value — projection can't tell whether that work is server-only or a side effect the client depends on`,\n      `move universal static declarations and their imports into export function register(), move a server-only initializer inside the export that reads it, or split it into an explicit .server/.client file`,\n    );\n  }\n\n  for (const decl of importDeclarations) {\n    const source = decl.source.value as string;\n    if (isKnownSafeAsset(source)) continue; // always survives, no orphan check\n\n    if (decl.specifiers.length === 0) {\n      // A bare side-effect import that isn't a recognized asset extension is\n      // just as attribution-ambiguous as an executable statement — could be\n      // a server-only side effect or something the client genuinely needs.\n      throw new ProjectionAmbiguityError(\n        filePath,\n        statementSnippet(code, decl),\n        decl.loc.start.line,\n        `a bare side-effect import with no recognized client-safe asset extension — projection can't tell if it belongs only to the server exports being removed or must ship to the client`,\n        `move universal static declarations and their imports into export function register(), or mark it with an explicit .server/.client file; server-only work can instead move inside one of the 6 declared server exports`,\n      );\n    }\n\n    const isUsed = decl.specifiers.some((spec: any) =>\n      survivingNames.has(spec.local.name),\n    );\n    if (!isUsed) removeStatement(s, code, decl);\n  }\n\n  for (const stmt of removedServerExports) {\n    removeStatement(s, code, stmt);\n  }\n\n  for (const stmt of removedLocals) {\n    removeStatement(s, code, stmt);\n  }\n\n  return {\n    code: s.toString(),\n    map: s.generateMap({ hires: true, source: filePath }),\n  };\n}\n\nexport function isProjectableFile(id: string): boolean {\n  const base = path.basename(id.split(\"?\")[0]);\n  if (/\\.page\\.tsx?$/.test(base)) return true;\n  if (base === \"layout.tsx\" || base === \"layout.ts\") return true;\n  // NAMED layouts — `dashboard.layout.tsx` and friends — are subjects too.\n  //\n  // Only the exact name `layout.tsx` is POSITIONAL (discovered by its folder).\n  // A named layout is addressed by import instead, which is a documented part of\n  // the contract: `v5/app/src/web/layouts/dashboard.layout.tsx` says so in its\n  // own header, and modules opt in with two re-export lines.\n  //\n  // Projection did not recognise them, and the consequence was not cosmetic.\n  // `dashboard.layout.tsx` calls `navService.forUser()` INSIDE its `loader` —\n  // exactly where server work belongs. But because the file was not a subject,\n  // the loader was never stripped, so its `navService` import survived into the\n  // client graph and dragged auth, the user model and three Node builtins with\n  // it. The app was right and the subject test was wrong.\n  //\n  // Matching `*.layout.tsx` rather than a list of known layout names is\n  // deliberate: an enumerated list is the shape that has produced every other\n  // boundary defect here (canon `eb0c5ee8`).\n  if (/\\.layout\\.tsx?$/.test(base)) return true;\n  if (base === \"root.tsx\") return true;\n  return false;\n}\n\nconst HMR_RUNTIME_SPECIFIER = \"@warlock.js/web/client/runtime\";\n\n/**\n * The projected module shares its scope with application source, so the helper\n * import must not redeclare a name the application already owns. A suffix is\n * only needed for the deliberately unlikely collision, but making it\n * deterministic keeps the generated HMR module valid for every page shape.\n */\nfunction hmrRegisterModulesBinding(code: string): string {\n  const base = \"__warlockRegisterModules\";\n  let binding = base;\n  let index = 2;\n\n  while (new RegExp(`\\\\b${binding}\\\\b`).test(code)) {\n    binding = `${base}${index++}`;\n  }\n\n  return binding;\n}\n\n/**\n * The client-build Vite plugin. Scoped to `*.page.tsx`/`layout.tsx`/`root.tsx`\n * and skipped entirely for the SSR build (`options.ssr`) — the server still\n * needs `route`/`middleware`/`validation`/`loader`/`metadata`/`prefix` intact.\n */\nexport function projection(): Plugin {\n  return {\n    name: \"warlock:projection\",\n    enforce: \"pre\",\n    transform(code, id, options) {\n      if (options?.ssr) return null;\n      if (!isProjectableFile(id)) return null;\n\n      try {\n        const { code: transformed, map } = projectModule(code, id);\n        const registerModules = hmrRegisterModulesBinding(transformed);\n        return {\n          code:\n            `import { registerModules as ${registerModules} } from \"${HMR_RUNTIME_SPECIFIER}\";\\n` +\n            `${transformed}\\n` +\n            `if (import.meta.hot) import.meta.hot.accept((replacement) => { if (replacement) ${registerModules}([replacement]); });\\n`,\n          map,\n        };\n      } catch (error) {\n        if (error instanceof ProjectionAmbiguityError) {\n          this.error(error.message);\n        }\n        throw error;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAa,sBAAsB,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;;AAUD,MAAM,qBACJ;;;;;;;;;;;;;AAcF,MAAM,8BAA8B,IAAI,IAAI;CAC1C;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAQD,IAAa,2BAAb,cAA8C,MAAM;CAEhC;CACA;CACA;CACA;CACA;CALlB,YACE,AAAgB,MAChB,AAAgB,WAChB,AAAgB,MAChB,AAAgB,aAChB,AAAgB,KAChB;EACA,MACE;GACE;GACA;GACA,SAAS,KAAK,GAAG;GACjB,cAAc;GACd,UAAU;GACV,QAAQ;EACV,CAAC,CAAC,KAAK,IAAI,CACb;EAfgB;EACA;EACA;EACA;EACA;EAYhB,KAAK,OAAO;CACd;AACF;AAiBA,SAAS,mBACP,OACA,gBACS;CACT,KAAK,MAAM,QAAQ,MAAM,OACvB,IAAI,eAAe,IAAI,IAAI,GAAG,OAAO;CAEvC,OAAO;AACT;AAEA,SAAS,iBAAiB,QAAyB;CACjD,OAAO,mBAAmB,KAAK,MAAM;AACvC;;;;;;;;AASA,SAAS,0BAA0B,MAAoB;CACrD,IAAI,KAAK,SAAS,4BAA4B,CAAC,KAAK,aAAa,OAAO;CACxE,MAAM,OAAO,KAAK;CAClB,IAAI,KAAK,SAAS,yBAAyB,KAAK,aAAa,WAAW,GAAG;EACzE,MAAM,KAAK,KAAK,aAAa,EAAE,CAAC;EAChC,OAAO,IAAI,SAAS,gBAAgB,oBAAoB,IAAI,GAAG,IAAI;CACrE;CACA,IAAI,KAAK,SAAS,uBAChB,OAAO,CAAC,CAAC,KAAK,MAAM,oBAAoB,IAAI,KAAK,GAAG,IAAI;CAE1D,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAe,OAA0B;CACvE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,IAAI,MAAM,QAAQ,IAAI,GAAG;EACvB,KAAK,MAAM,QAAQ,MAAM,uBAAuB,MAAM,KAAK;EAC3D;CACF;CACA,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,SAAS,UAAU;CACrC,IAAI,OAAO,SAAS,gBAAgB,OAAO,SAAS,iBAClD,MAAM,IAAK,OAAe,IAAI;CAEhC,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;EACrC,IACE,QAAQ,UACR,QAAQ,WACR,QAAQ,SACR,QAAQ,SACR,QAAQ,SAER;EACF,IACE,QAAQ,qBACR,QAAQ,sBACR,QAAQ,mBACR,QAAQ,SAER;EAEF,uBAAuB,OAAO,MAAM,KAAK;CAC3C;AACF;;;;;;;AAQA,MAAM,8BAA8B,IAAI,IAAI;CAC1C;CACA;CACA;AACF,CAAC;AAED,SAAS,oBAAoB,MAAW,OAA0B;CAChE,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;CACvC,QAAQ,KAAK,MAAb;EACE,KAAK;GACH,MAAM,IAAI,KAAK,IAAI;GACnB;EACF,KAAK;GACH,KAAK,MAAM,YAAY,KAAK,YAC1B,oBACE,SAAS,SAAS,gBAAgB,SAAS,WAAW,SAAS,OAC/D,KACF;GAEF;EACF,KAAK;GACH,KAAK,MAAM,WAAW,KAAK,UAAU,oBAAoB,SAAS,KAAK;GACvE;EACF,KAAK;GACH,oBAAoB,KAAK,MAAM,KAAK;GACpC;EACF,KAAK;GACH,oBAAoB,KAAK,UAAU,KAAK;GACxC;CACJ;AACF;;AAGA,SAAS,cAAc,MAAwB;CAC7C,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,KAAK,SAAS,uBAChB,KAAK,MAAM,cAAc,KAAK,cAC5B,oBAAoB,WAAW,IAAI,KAAK;MACrC,IAAI,KAAK,IAAI,SAAS,cAC3B,MAAM,IAAI,KAAK,GAAG,IAAI;CAExB,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,MAAoB;CAElD,IAAI,CAAC,MAAM,OAAO;CAElB,QAAQ,KAAK,MAAb;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EAEL,KAAK,cACH,OAAO;EACT,KAAK,mBACH,OAAO,KAAK,YAAY,OAAO,eAC7B,uBAAuB,UAAU,CACnC;EACF,KAAK,mBACH,OACE,KAAK,aAAa,YAAY,uBAAuB,KAAK,QAAQ;EAEtE,KAAK,mBACH,OAAO,KAAK,SAAS,OAClB,YACC,YAAY,QACX,QAAQ,SAAS,mBAAmB,uBAAuB,OAAO,CACvE;EACF,KAAK,oBAIH,OAAO,KAAK,WAAW,OACpB,aACC,SAAS,SAAS,oBAClB,CAAC,SAAS,YACV,uBAAuB,SAAS,KAAK,CACzC;EAEF,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,2BACH,OAAO,uBAAuB,KAAK,UAAU;EAC/C,SACE,OAAO;CACX;AACF;;;;;;AAOA,SAAS,4BAA4B,MAAoB;CACvD,IAAI,KAAK,SAAS,uBAAuB,OAAO;CAChD,IAAI,KAAK,SAAS,uBAAuB,OAAO;CAChD,OAAO,KAAK,aAAa,OAAO,eAC9B,uBAAuB,WAAW,IAAI,CACxC;AACF;AAEA,SAAS,gBAAgB,GAAgB,MAAc,MAAiB;CACtE,IAAI,MAAM,KAAK;CAIf,IAAI,KAAK,SAAS,QAAQ,KAAK,MAAM,OAAO,MAAM,OAAO;MACpD,IAAI,KAAK,SAAS,MAAM,OAAO;CACpC,EAAE,OAAO,KAAK,OAAiB,GAAG;AACpC;AAEA,SAAS,iBAAiB,MAAc,MAAmB;CACzD,OAAO,KACJ,MAAM,KAAK,OAAiB,KAAK,GAAa,CAAC,CAC/C,MAAM,IAAI,CAAC,CAAC,EAAE,CACd,KAAK;AACV;;;;;;;AAQA,SAAgB,cACd,MACA,UACkB;CAClB,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY;EACZ,SAAS,CAAC,cAAc,KAAK;CAC/B,CAAC;CAED,MAAM,IAAI,IAAI,YAAY,IAAI;CAC9B,MAAM,OAAO,IAAI,QAAQ;CAEzB,MAAM,uBAA8B,CAAC;CACrC,MAAM,qBAA4B,CAAC;CACnC,MAAM,oBAAwC,CAAC;CAE/C,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,KAAK,SAAS,qBAAqB;GACrC,mBAAmB,KAAK,IAAI;GAC5B;EACF;EACA,MAAM,sBACJ,KAAK,SAAS,4BACd,KAAK,UAAU,QACd,KAAK,YAAkC,MACrC,cAAc,UAAU,SAAS,0BACpC;EAEF,IAAI,KAAK,SAAS,0BAA0B,qBAa1C,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,0VACA,mJACF;EAEF,IAAI,0BAA0B,IAAI,GAAG;GACnC,qBAAqB,KAAK,IAAI;GAC9B;EACF;EACA,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAAG;EAChD,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAAG;GAG9C,kBAAkB,KAAK;IACrB;IACA,OAAO,cAAc,IAAI;IACzB,kBAAkB,4BAA4B,IAAI;IAClD,SAAS;GACX,CAAC;GACD;EACF;EAMA,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,qRACA,6NACF;CACF;CAEA,MAAM,gCAAgB,IAAI,IAAS;;;;;;;;;;;;CAanC,SAAS,wBAAqC;EAC5C,MAAM,wBAAQ,IAAI,IAAY;EAC9B,KAAK,MAAM,QAAQ,MAAM;GACvB,IAAI,KAAK,SAAS,qBAAqB;GACvC,IAAI,qBAAqB,SAAS,IAAI,KAAK,cAAc,IAAI,IAAI,GAC/D;GACF,MAAM,sBAAM,IAAI,IAAY;GAC5B,uBAAuB,MAAM,GAAG;GAChC,IAAI,4BAA4B,IAAI,KAAK,IAAI,GAC3C,KAAK,MAAM,QAAQ,cAAc,IAAI,GAAG,IAAI,OAAO,IAAI;GAEzD,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAI;EACxC;EACA,OAAO;CACT;CAIA,IAAI,iBAAiB,sBAAsB;CAC3C,KAAK,IAAI,UAAU,MAAM,UAAU;EACjC,UAAU;EACV,KAAK,MAAM,SAAS,mBAAmB;GACrC,IAAI,MAAM,WAAW,CAAC,MAAM,kBAAkB;GAC9C,IAAI,mBAAmB,OAAO,cAAc,GAAG;GAC/C,MAAM,UAAU;GAChB,cAAc,IAAI,MAAM,IAAI;GAC5B,UAAU;EACZ;EACA,IAAI,SAAS,iBAAiB,sBAAsB;CACtD;CAEA,KAAK,MAAM,SAAS,mBAAmB;EACrC,IAAI,MAAM,WAAW,mBAAmB,OAAO,cAAc,GAAG;EAOhE,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,MAAM,IAAI,GACjC,MAAM,KAAK,IAAI,MAAM,MACrB,gPACA,yMACF;CACF;CAEA,KAAK,MAAM,QAAQ,oBAAoB;EACrC,MAAM,SAAS,KAAK,OAAO;EAC3B,IAAI,iBAAiB,MAAM,GAAG;EAE9B,IAAI,KAAK,WAAW,WAAW,GAI7B,MAAM,IAAI,yBACR,UACA,iBAAiB,MAAM,IAAI,GAC3B,KAAK,IAAI,MAAM,MACf,sLACA,uNACF;EAMF,IAAI,CAHW,KAAK,WAAW,MAAM,SACnC,eAAe,IAAI,KAAK,MAAM,IAAI,CAE1B,GAAG,gBAAgB,GAAG,MAAM,IAAI;CAC5C;CAEA,KAAK,MAAM,QAAQ,sBACjB,gBAAgB,GAAG,MAAM,IAAI;CAG/B,KAAK,MAAM,QAAQ,eACjB,gBAAgB,GAAG,MAAM,IAAI;CAG/B,OAAO;EACL,MAAM,EAAE,SAAS;EACjB,KAAK,EAAE,YAAY;GAAE,OAAO;GAAM,QAAQ;EAAS,CAAC;CACtD;AACF;AAEA,SAAgB,kBAAkB,IAAqB;CACrD,MAAM,OAAO,KAAK,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE;CAC3C,IAAI,gBAAgB,KAAK,IAAI,GAAG,OAAO;CACvC,IAAI,SAAS,gBAAgB,SAAS,aAAa,OAAO;CAkB1D,IAAI,kBAAkB,KAAK,IAAI,GAAG,OAAO;CACzC,IAAI,SAAS,YAAY,OAAO;CAChC,OAAO;AACT;AAEA,MAAM,wBAAwB;;;;;;;AAQ9B,SAAS,0BAA0B,MAAsB;CACvD,MAAM,OAAO;CACb,IAAI,UAAU;CACd,IAAI,QAAQ;CAEZ,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,GAC7C,UAAU,GAAG,OAAO;CAGtB,OAAO;AACT;;;;;;AAOA,SAAgB,aAAqB;CACnC,OAAO;EACL,MAAM;EACN,SAAS;EACT,UAAU,MAAM,IAAI,SAAS;GAC3B,IAAI,SAAS,KAAK,OAAO;GACzB,IAAI,CAAC,kBAAkB,EAAE,GAAG,OAAO;GAEnC,IAAI;IACF,MAAM,EAAE,MAAM,aAAa,QAAQ,cAAc,MAAM,EAAE;IACzD,MAAM,kBAAkB,0BAA0B,WAAW;IAC7D,OAAO;KACL,MACE,+BAA+B,gBAAgB,WAAW,sBAAsB,MAC7E,YAAY,oFACoE,gBAAgB;KACrG;IACF;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,0BACnB,KAAK,MAAM,MAAM,OAAO;IAE1B,MAAM;GACR;EACF;CACF;AACF"}

package/package.json

@@ -11,8 +11,8 @@
   },
   "peerDependencies": {
     "@vitejs/plugin-react": "^5.2.0",
-    "@warlock.js/core": "5.2.3",
-    "@warlock.js/seal": "5.2.3",
+    "@warlock.js/core": "5.2.4",
+    "@warlock.js/seal": "5.2.4",
     "react": "*",
     "react-dom": "*",
     "vite": ">=7.3.5 <8"
@@ -37,7 +37,7 @@
   ],
   "author": "hassanzohdy",
   "license": "MIT",
-  "version": "5.2.3",
+  "version": "5.2.4",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",