@timber-js/app 0.2.0-alpha.101 → 0.2.0-alpha.103

package/dist/routing/index.js

@@ -1,3 +1,3 @@
-import { i as INTERCEPTION_MARKERS, n as classifyUrlSegment, r as DEFAULT_PAGE_EXTENSIONS, t as classifySegment } from "../_chunks/segment-classify-BjfuctV2.js";
-import { i as scanRoutes, n as collectInterceptionRewrites, r as generateRouteMap, t as collectLeafRoutes } from "../_chunks/walkers-Tg0Alwcg.js";
+import { i as INTERCEPTION_MARKERS, n as classifyUrlSegment, r as DEFAULT_PAGE_EXTENSIONS, t as classifySegment } from "../_chunks/segment-classify-CnfLLvir.js";
+import { i as scanRoutes, n as collectInterceptionRewrites, r as generateRouteMap, t as collectLeafRoutes } from "../_chunks/walkers-DQn5NNrf.js";
 export { DEFAULT_PAGE_EXTENSIONS, INTERCEPTION_MARKERS, classifySegment, classifyUrlSegment, collectInterceptionRewrites, collectLeafRoutes, generateRouteMap, scanRoutes };

package/dist/search-params/index.js

@@ -1,6 +1,6 @@
-import { n as registerSearchParams, t as getSearchParamsDefinition } from "../_chunks/registry-I2ss-lvy.js";
-import { i as isStandardSchema, n as fromSchema, r as isCodec } from "../_chunks/schema-bridge-Cxu4l-7p.js";
-import { n as defineSearchParams } from "../_chunks/define-B-Q_UMOD.js";
+import { n as registerSearchParams, t as getSearchParamsDefinition } from "../_chunks/registry-DB93kT5c.js";
+import { i as isStandardSchema, n as fromSchema, r as isCodec } from "../_chunks/schema-bridge-C3xl_vfb.js";
+import { n as defineSearchParams } from "../_chunks/define-Dn98bPbb.js";
 //#region src/search-params/wrappers.ts
 /**
 * Wrap a nullable codec with a default value. When the inner codec returns

package/dist/segment-params/index.js

@@ -1,2 +1,2 @@
-import { r as defineSegmentParams } from "../_chunks/define-k32T6NL2.js";
+import { r as defineSegmentParams } from "../_chunks/define-Btmz9B20.js";
 export { defineSegmentParams };

package/dist/server/index.js

@@ -1,6 +1,6 @@
-import { a as getSpanId, d as withSpan, o as getTraceId, p as formFlashAls, t as addSpanEvent, v as isDebug, y as isDevMode } from "../_chunks/tracing-C8V-YGsP.js";
-import { t as formatSize } from "../_chunks/format-Bcn-Iv1x.js";
-import { E as getCookieJar, a as revalidateTag, b as getSegmentParams, c as DenySignal, f as deny, h as waitUntil, i as revalidatePath, l as RedirectSignal, m as redirectExternal, p as redirect, s as parseFormData, u as RedirectType, v as getHeaders } from "../_chunks/actions-BsfxK6yu.js";
+import { a as getSpanId, d as withSpan, o as getTraceId, p as formFlashAls, t as addSpanEvent, v as isDebug, y as isDevMode } from "../_chunks/tracing-DvKLzCFa.js";
+import { t as formatSize } from "../_chunks/format-CYBGxKtc.js";
+import { E as getCookieJar, a as revalidateTag, b as getSegmentParams, c as DenySignal, f as deny, h as waitUntil, i as revalidatePath, l as RedirectSignal, m as redirectExternal, p as redirect, s as parseFormData, u as RedirectType, v as getHeaders } from "../_chunks/actions-n9qTlpmY.js";
 //#region src/server/sensitive-fields.ts
 /**
 * Sensitive field stripping — removes password/token/CVV-style fields

package/dist/server/internal.js

@@ -1,11 +1,11 @@
-import { c as replaceTraceId, d as withSpan, f as earlyHintsSenderAls, g as timingAls, i as getOtelTraceId, l as runWithTraceId, m as requestContextAls, o as getTraceId, r as generateTraceId, u as setSpanAttribute, v as isDebug } from "../_chunks/tracing-C8V-YGsP.js";
-import { a as warnRedirectInSuspense, c as warnSuspenseWrappingChildren, i as warnRedirectInAccess, n as setViteServer, o as warnSlowSlotWithoutSuspense, r as warnDenyInSuspense, s as warnStaticRequestApi, t as WarningId } from "../_chunks/warnings-Cg47l5sk.js";
-import { n as classifyUrlSegment } from "../_chunks/segment-classify-BjfuctV2.js";
-import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-BU684ls2.js";
-import { a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, h as swallow, i as logMiddlewareShortCircuit, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest } from "../_chunks/logger-0m8MsKdc.js";
-import { C as setMutableCookieContext, D as getSetCookieHeaders, S as runWithRequestContext, T as getCookie, _ as getHeader, b as getSegmentParams, c as DenySignal, d as RenderError, g as applyRequestHeaderOverlay, l as RedirectSignal, n as executeAction, o as coerce, r as isRscActionRequest, t as buildNoJsResponse, w as setSegmentParams, x as markResponseFlushed, y as getSearchParams } from "../_chunks/actions-BsfxK6yu.js";
+import { c as replaceTraceId, d as withSpan, f as earlyHintsSenderAls, g as timingAls, i as getOtelTraceId, l as runWithTraceId, m as requestContextAls, o as getTraceId, r as generateTraceId, u as setSpanAttribute, v as isDebug } from "../_chunks/tracing-DvKLzCFa.js";
+import { a as warnRedirectInSuspense, c as warnSuspenseWrappingChildren, i as warnRedirectInAccess, n as setViteServer, o as warnSlowSlotWithoutSuspense, r as warnDenyInSuspense, s as warnStaticRequestApi, t as WarningId } from "../_chunks/warnings-B30wpfaS.js";
+import { n as classifyUrlSegment } from "../_chunks/segment-classify-CnfLLvir.js";
+import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-Cjmvi3rQ.js";
+import { a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, h as swallow, i as logMiddlewareShortCircuit, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest } from "../_chunks/logger-DDmK5skc.js";
+import { C as setMutableCookieContext, D as getSetCookieHeaders, S as runWithRequestContext, T as getCookie, _ as getHeader, b as getSegmentParams, c as DenySignal, d as RenderError, g as applyRequestHeaderOverlay, l as RedirectSignal, n as executeAction, o as coerce, r as isRscActionRequest, t as buildNoJsResponse, w as setSegmentParams, x as markResponseFlushed, y as getSearchParams } from "../_chunks/actions-n9qTlpmY.js";
 import "../client/error-boundary.js";
-import "../_chunks/segment-context-Dx_OizxD.js";
+import "../_chunks/segment-context-Dc-GbSTe.js";
 import { readFile } from "node:fs/promises";
 import { createElement } from "react";
 //#region src/server/server-timing.ts

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mBAAmB,CAAC;AAQhF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAQ7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAS5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CASjD;AAkBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAepE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mBAAmB,CAAC;AAMhF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAQ7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAS5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CASjD;AAaD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAepE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.101",
+  "version": "0.2.0-alpha.103",
   "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/client/index.ts

@@ -83,15 +83,6 @@ export { useSegmentParams } from './use-segment-params';
 // Types still exported for advanced use.
 export type { ClientCookieOptions, CookieSetter } from './use-cookie';
 
-// Register the client cookie module with defineCookie's lazy reference.
-// This runs at module load time in the client/SSR environment, wiring up
-// the useCookie hook without a top-level import in define-cookie.ts.
-import * as _useCookieMod from './use-cookie.js';
-import { _registerUseCookieModule, _registerFromSchema } from '../cookies/define-cookie.js';
-import { fromSchema } from '../schema-bridge.js';
-_registerUseCookieModule(_useCookieMod);
-_registerFromSchema(fromSchema);
-
 // Register the client useSegmentParams hook with defineSegmentParams.
 import { useSegmentParams as _useSegmentParams } from './use-segment-params.js';
 import { _registerUseSegmentParams } from '../segment-params/define.js';

package/src/client/use-cookie.ts

@@ -39,7 +39,7 @@ type Listener = () => void;
 const listeners = new Map<string, Set<Listener>>();
 
 /** Parse a cookie name from document.cookie. */
-function getCookieValue(name: string): string | undefined {
+export function getCookieValue(name: string): string | undefined {
   if (typeof document === 'undefined') return undefined;
   const match = document.cookie.match(
     new RegExp('(?:^|;\\s*)' + name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\s*=\\s*([^;]*)')
@@ -48,7 +48,7 @@ function getCookieValue(name: string): string | undefined {
 }
 
 /** Serialize options into a cookie string suffix. */
-function serializeOptions(options?: ClientCookieOptions): string {
+export function serializeOptions(options?: ClientCookieOptions): string {
   if (!options) return '; Path=/; SameSite=Lax';
   const parts: string[] = [];
   parts.push(`Path=${options.path ?? '/'}`);

package/src/cookies/define-cookie.ts

@@ -5,10 +5,11 @@
  * with sync .get(), .set(), .delete() isomorphic methods (server + client)
  * and a .useCookie() client hook.
  *
- * Uses the registration pattern: server entry registers serverCookieImpl,
- * client entry registers clientCookieImpl. This avoids top-level value
- * imports from either environment and makes defineCookie isomorphic
- * without `typeof window` checks.
+ * Environment detection is call-time: on the server, getCookieJar() is
+ * used directly (ALS-backed). On the client, document.cookie helpers
+ * and the useCookie hook are used. No registration pattern — imports
+ * resolve via the shims plugin (client bundle gets a stub for
+ * @timber-js/app/server).
  *
  * Standard Schema objects (Zod, Valibot, ArkType) are auto-detected in
  * the codec option — no explicit fromSchema() wrapper needed.
@@ -71,119 +72,76 @@ export interface CookieDefinition<T> extends ServerOnlyCookieDefinition<T> {
   useCookie(): [T, (value: T) => void, () => void];
 }
 
-// ─── Registration Pattern ─────────────────────────────────────────────────
+// ─── Direct Imports (no registration) ─────────────────────────────────────
 //
-// Server and client entries register their implementations at module load
-// time. This avoids dynamic imports (which lose ALS context) and typeof
-// window checks (which are fragile).
-
-/** Server-side cookie impl: reads from ALS-backed cookie jar. */
-export interface ServerCookieImpl {
-  getCookieJar(): {
-    get(name: string): string | undefined;
-    set(name: string, value: string, options?: CookieOptions): void;
-    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
-  };
-}
-
-/** Client-side cookie impl: reads/writes document.cookie via useCookie hook. */
-export interface ClientCookieImpl {
-  useCookie(
-    name: string,
-    options?: ClientCookieOptions
-  ): [string | undefined, (value: string, options?: ClientCookieOptions) => void, () => void];
-  getCookieValue(name: string): string | undefined;
-  setCookieValue(name: string, value: string, options?: ClientCookieOptions): void;
-  deleteCookieValue(name: string, options?: ClientCookieOptions): void;
-}
+// Server: getCookieJar is imported from @timber-js/app/server. In the client
+// bundle, the shims plugin replaces @timber-js/app/server with a stub module
+// where getCookieJar throws on call. We detect the environment at call time
+// by trying getCookieJar() — if it throws the stub error, we fall through
+// to the client path.
+//
+// Client: useCookie, getCookieValue, notifyCookieChange
+// are imported from use-cookie.ts. These are safe in all environments (no
+// node:async_hooks dependency).
+//
+// Schema: fromSchema is a pure function — safe in all environments.
 
-let _serverImpl: ServerCookieImpl | undefined;
-let _clientImpl: ClientCookieImpl | undefined;
-let _fromSchemaFn: ((schema: StandardSchemaV1<unknown>) => CookieCodec<unknown>) | undefined;
+import { getCookieJar } from '@timber-js/app/server';
+import { fromSchema } from '../schema-bridge.js';
+import {
+  useCookie as useRawCookie,
+  notifyCookieChange,
+  getCookieValue,
+} from '../client/use-cookie.js';
 
-/**
- * Register the server-side cookie implementation.
- * Called by server entry at module load time.
- * @internal
- */
-export function _registerServerCookieImpl(impl: ServerCookieImpl): void {
-  _serverImpl = impl;
-}
+// ─── Environment Detection ────────────────────────────────────────────────
 
 /**
- * Register the client-side cookie implementation.
- * Called by client entry at module load time.
- * @internal
+ * Try to get the server cookie jar. Returns null if we're in the client
+ * environment (stub throws) or if there's no request context.
+ *
+ * On the server, getCookieJar() throws "outside of a request context" if
+ * called without an ALS store — this is a real error and is re-thrown.
+ * The client stub throws a different message — that's caught and returns null.
  */
-export function _registerClientCookieImpl(impl: ClientCookieImpl): void {
-  _clientImpl = impl;
+function tryGetServerCookieJar(): ReturnType<typeof getCookieJar> | null {
+  try {
+    return getCookieJar();
+  } catch (e) {
+    // Server-side "no request context" error — re-throw as a real bug.
+    if (e instanceof Error && e.message.includes('outside of a request context')) {
+      throw e;
+    }
+    // Client stub error or other — fall through to client path.
+    return null;
+  }
 }
 
-/**
- * Register the fromSchema bridge function.
- * Called by server/client entry at module load time.
- * @internal
- */
-export function _registerFromSchema(
-  fn: (schema: StandardSchemaV1<unknown>) => CookieCodec<unknown>
-): void {
-  _fromSchemaFn = fn;
+// ─── Client Cookie Helpers ────────────────────────────────────────────────
+
+/** Write a cookie via document.cookie and notify useCookie subscribers. */
+function setClientCookie(name: string, value: string, options?: ClientCookieOptions): void {
+  const parts: string[] = [`${name}=${encodeURIComponent(value)}`];
+  const path = options?.path ?? '/';
+  parts.push(`Path=${path}`);
+  if (options?.domain) parts.push(`Domain=${options.domain}`);
+  if (options?.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);
+  if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
+  const sameSite = options?.sameSite ?? 'lax';
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+  if (options?.secure) parts.push('Secure');
+  document.cookie = parts.join('; ');
+  notifyCookieChange(name);
 }
 
-// Legacy registration for useCookie module — still used by client/index.ts
-let _useCookieModule: typeof import('../client/use-cookie.js') | undefined;
-
-function getUseCookieModule(): typeof import('../client/use-cookie.js') {
-  if (!_useCookieModule) {
-    throw new Error(
-      '[timber] defineCookie().useCookie() requires @timber-js/app/client to be loaded. ' +
-        'This hook can only be used in client components.'
-    );
-  }
-  return _useCookieModule;
-}
-
-/**
- * Register the client cookie module. Called by the client entry to wire
- * up the lazy reference without a top-level import.
- *
- * @internal — framework use only
- */
-export function _registerUseCookieModule(mod: typeof import('../client/use-cookie.js')): void {
-  _useCookieModule = mod;
-  // Also register the client impl from the module
-  _clientImpl = {
-    useCookie: mod.useCookie,
-    getCookieValue: (name: string) => {
-      if (typeof document === 'undefined') return undefined;
-      const match = document.cookie.match(
-        new RegExp('(?:^|;\\s*)' + name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\s*=\\s*([^;]*)')
-      );
-      return match ? decodeURIComponent(match[1]) : undefined;
-    },
-    setCookieValue: (name: string, value: string, options?: ClientCookieOptions) => {
-      const parts: string[] = [`${name}=${encodeURIComponent(value)}`];
-      const path = options?.path ?? '/';
-      parts.push(`Path=${path}`);
-      if (options?.domain) parts.push(`Domain=${options.domain}`);
-      if (options?.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);
-      if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
-      const sameSite = options?.sameSite ?? 'lax';
-      parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
-      if (options?.secure) parts.push('Secure');
-      document.cookie = parts.join('; ');
-      // Notify useCookie subscribers so mounted hooks re-render
-      mod.notifyCookieChange(name);
-    },
-    deleteCookieValue: (name: string, options?: ClientCookieOptions) => {
-      const path = options?.path ?? '/';
-      const domain = options?.domain;
-      let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;
-      if (domain) cookieStr += `; Domain=${domain}`;
-      document.cookie = cookieStr;
-      mod.notifyCookieChange(name);
-    },
-  };
+/** Delete a cookie via document.cookie and notify useCookie subscribers. */
+function deleteClientCookie(name: string, options?: ClientCookieOptions): void {
+  const path = options?.path ?? '/';
+  const domain = options?.domain;
+  let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;
+  if (domain) cookieStr += `; Domain=${domain}`;
+  document.cookie = cookieStr;
+  notifyCookieChange(name);
 }
 
 // ─── Standard Schema Auto-Detection ───────────────────────────────────────
@@ -199,14 +157,7 @@ function resolveCodec<T>(codecOrSchema: CookieCodec<T> | StandardSchemaV1<T>): C
 
   // Auto-detect Standard Schema
   if (typeof codecOrSchema === 'object' && codecOrSchema !== null && '~standard' in codecOrSchema) {
-    if (!_fromSchemaFn) {
-      throw new Error(
-        '[timber] defineCookie: Standard Schema auto-detection requires @timber-js/app/server or ' +
-          '@timber-js/app/client to be loaded. Pass an explicit Codec<T> with parse/serialize methods, ' +
-          'or ensure the framework entry module is imported.'
-      );
-    }
-    return _fromSchemaFn(codecOrSchema as StandardSchemaV1<unknown>) as CookieCodec<T>;
+    return fromSchema(codecOrSchema as StandardSchemaV1<unknown>) as CookieCodec<T>;
   }
 
   throw new Error(
@@ -266,88 +217,73 @@ export function defineCookie<T, HttpOnly extends boolean = true>(
     };
   }
 
-  function assertNotHttpOnlyClient(method: string): void {
-    if (isHttpOnly && !_serverImpl) {
-      throw new Error(
-        `[timber] defineCookie('${name}').${method}() cannot be used with httpOnly cookies — ` +
-          `the browser cannot access them. Set httpOnly: false to enable client access.`
-      );
-    }
-  }
-
   const base: ServerOnlyCookieDefinition<T> = {
     name,
     options: resolvedOptions,
     codec,
 
     get(): T {
-      if (_serverImpl) {
-        const jar = _serverImpl.getCookieJar();
-        const raw = jar.get(name);
-        return codec.parse(raw);
+      const serverJar = tryGetServerCookieJar();
+      if (serverJar) {
+        return codec.parse(serverJar.get(name));
       }
       // Client path
-      assertNotHttpOnlyClient('get');
-      if (_clientImpl) {
-        const raw = _clientImpl.getCookieValue(name);
-        return codec.parse(raw);
+      if (isHttpOnly) {
+        throw new Error(
+          `[timber] defineCookie('${name}').get() cannot be used with httpOnly cookies — ` +
+            `the browser cannot access them. Set httpOnly: false to enable client access.`
+        );
       }
-      throw new Error(
-        `[timber] defineCookie('${name}').get() — no environment registered. ` +
-          'Ensure @timber-js/app/server or @timber-js/app/client is imported.'
-      );
+      const raw = getCookieValue(name);
+      return codec.parse(raw);
     },
 
     set(value: T): void {
-      if (_serverImpl) {
-        const jar = _serverImpl.getCookieJar();
+      const serverJar = tryGetServerCookieJar();
+      if (serverJar) {
         const serialized = codec.serialize(value);
         if (serialized === null) {
-          jar.delete(name, {
+          serverJar.delete(name, {
             path: resolvedOptions.path,
             domain: resolvedOptions.domain,
           });
         } else {
-          jar.set(name, serialized, resolvedOptions);
+          serverJar.set(name, serialized, resolvedOptions);
         }
         return;
       }
       // Client path
-      assertNotHttpOnlyClient('set');
-      if (_clientImpl) {
-        const serialized = codec.serialize(value);
-        if (serialized === null) {
-          _clientImpl.deleteCookieValue(name, getClientOpts());
-        } else {
-          _clientImpl.setCookieValue(name, serialized, getClientOpts());
-        }
-        return;
+      if (isHttpOnly) {
+        throw new Error(
+          `[timber] defineCookie('${name}').set() cannot be used with httpOnly cookies — ` +
+            `the browser cannot access them. Set httpOnly: false to enable client access.`
+        );
+      }
+      const serialized = codec.serialize(value);
+      if (serialized === null) {
+        deleteClientCookie(name, getClientOpts());
+      } else {
+        setClientCookie(name, serialized, getClientOpts());
       }
-      throw new Error(
-        `[timber] defineCookie('${name}').set() — no environment registered. ` +
-          'Ensure @timber-js/app/server or @timber-js/app/client is imported.'
-      );
     },
 
     delete(): void {
-      if (_serverImpl) {
-        const jar = _serverImpl.getCookieJar();
-        jar.delete(name, {
+      const serverJar = tryGetServerCookieJar();
+      if (serverJar) {
+        serverJar.delete(name, {
           path: resolvedOptions.path,
           domain: resolvedOptions.domain,
         });
         return;
       }
       // Client path
-      assertNotHttpOnlyClient('delete');
-      if (_clientImpl) {
-        _clientImpl.deleteCookieValue(name, getClientOpts());
-        return;
+      if (isHttpOnly) {
+        throw new Error(
+          `[timber] defineCookie('${name}').delete() cannot be used with httpOnly cookies — ` +
+            `the browser cannot access them. Set httpOnly: false to enable client access.`
+        );
       }
-      throw new Error(
-        `[timber] defineCookie('${name}').delete() — no environment registered. ` +
-          'Ensure @timber-js/app/server or @timber-js/app/client is imported.'
-      );
+      deleteClientCookie(name, getClientOpts());
     },
   };
 
@@ -360,8 +296,6 @@ export function defineCookie<T, HttpOnly extends boolean = true>(
     ...base,
 
     useCookie(): [T, (value: T) => void, () => void] {
-      const { useCookie: useRawCookie } = getUseCookieModule();
-
       const clientOpts = getClientOpts();
       const [raw, setRaw, deleteRaw] = useRawCookie(name, clientOpts);
       const parsed = codec.parse(raw);

package/src/fonts/ast.ts

@@ -590,8 +590,8 @@ interface CallExpressionNode extends PositionedNode {
 
 interface VariableDeclaratorNode extends PositionedNode {
   type: 'VariableDeclarator';
-  id: AstNode;
-  init: AstNode | null;
+  id: PositionedNode;
+  init: PositionedNode | null;
 }
 
 interface VariableDeclarationNode extends PositionedNode {
@@ -601,7 +601,43 @@ interface VariableDeclarationNode extends PositionedNode {
 
 interface ExpressionStatementNode extends PositionedNode {
   type: 'ExpressionStatement';
-  expression: AstNode;
+  expression: PositionedNode;
+}
+
+interface ExportNamedDeclarationNode extends PositionedNode {
+  type: 'ExportNamedDeclaration';
+  declaration: VariableDeclarationNode | ExpressionStatementNode | null;
+}
+
+// ── Type guards for AST narrowing ────────────────────────────────────────────
+//
+// OXC's parsed nodes all share the base `PositionedNode` shape with
+// `type: string`. TypeScript can't narrow a union that includes a
+// `string`-typed catch-all, so we use explicit type guards instead of
+// bare `.type ===` checks.
+
+function isImportDeclaration(node: PositionedNode): node is ImportDeclarationNode {
+  return node.type === 'ImportDeclaration';
+}
+
+function isVariableDeclaration(node: PositionedNode): node is VariableDeclarationNode {
+  return node.type === 'VariableDeclaration';
+}
+
+function isExpressionStatement(node: PositionedNode): node is ExpressionStatementNode {
+  return node.type === 'ExpressionStatement';
+}
+
+function isExportNamedDeclaration(node: PositionedNode): node is ExportNamedDeclarationNode {
+  return node.type === 'ExportNamedDeclaration';
+}
+
+function isCallExpression(node: PositionedNode): node is CallExpressionNode {
+  return node.type === 'CallExpression';
+}
+
+function isIdentifier(node: AstNode): node is IdentifierNode {
+  return node.type === 'Identifier';
 }
 
 interface ProgramNode extends PositionedNode {
@@ -627,8 +663,8 @@ export function findFontCallSites(source: string): FontAnalysis | null {
   const importNodesToRemove: Array<{ start: number; end: number }> = [];
 
   for (const stmt of program.body) {
-    if (stmt.type !== 'ImportDeclaration') continue;
-    const importDecl = stmt as unknown as ImportDeclarationNode;
+    if (!isImportDeclaration(stmt)) continue;
+    const importDecl = stmt;
     const specSource = importDecl.source.value;
 
     let provider: 'google' | 'local' | null = null;
@@ -658,7 +694,7 @@ export function findFontCallSites(source: string): FontAnalysis | null {
       // member expressions in the call-site walk.
     }
 
-    importNodesToRemove.push({ start: importDecl.start, end: importDecl.end });
+    importNodesToRemove.push({ start: stmt.start, end: stmt.end });
   }
 
   if (bindings.length === 0) return null;
@@ -669,27 +705,30 @@ export function findFontCallSites(source: string): FontAnalysis | null {
   let dynamicCall: string | null = null;
 
   for (const stmt of program.body) {
+    // Unwrap `export const roboto = Roboto(...)` — the AST wraps the
+    // VariableDeclaration inside an ExportNamedDeclaration node.
+    const effectiveStmt =
+      isExportNamedDeclaration(stmt) && stmt.declaration ? stmt.declaration : stmt;
+
     // VariableDeclaration: `const inter = Inter({ ... })`
-    if (stmt.type === 'VariableDeclaration') {
-      const varDecl = stmt as unknown as VariableDeclarationNode;
-      for (const declarator of varDecl.declarations) {
-        if (!declarator.init || declarator.init.type !== 'CallExpression') continue;
-        const call = declarator.init as unknown as CallExpressionNode;
+    if (isVariableDeclaration(effectiveStmt)) {
+      for (const declarator of effectiveStmt.declarations) {
+        if (!declarator.init) continue;
+        if (!isCallExpression(declarator.init)) continue;
+        const call = declarator.init;
         const site = matchCallExpression(call, bindingsByName, source);
         if (!site) continue;
 
         if (site === 'dynamic') {
-          if (!dynamicCall) {
-            const calleeName = (call.callee as IdentifierNode).name;
+          if (!dynamicCall && isIdentifier(call.callee)) {
             const argStart = call.arguments[0].start;
             const argEnd = call.arguments[0].end;
-            dynamicCall = `${calleeName}(${source.slice(argStart, argEnd)})`;
+            dynamicCall = `${call.callee.name}(${source.slice(argStart, argEnd)})`;
           }
           continue;
         }
 
-        const assignedName =
-          declarator.id.type === 'Identifier' ? (declarator.id as IdentifierNode).name : null;
+        const assignedName = isIdentifier(declarator.id) ? declarator.id.name : null;
 
         const { line, column } = offsetToLineColumn(source, call.start);
         callSites.push({
@@ -705,10 +744,9 @@ export function findFontCallSites(source: string): FontAnalysis | null {
     }
 
     // ExpressionStatement: `Inter({ ... })` as a bare call
-    if (stmt.type === 'ExpressionStatement') {
-      const exprStmt = stmt as unknown as ExpressionStatementNode;
-      if (exprStmt.expression.type === 'CallExpression') {
-        const call = exprStmt.expression as unknown as CallExpressionNode;
+    if (isExpressionStatement(effectiveStmt)) {
+      if (isCallExpression(effectiveStmt.expression)) {
+        const call = effectiveStmt.expression;
         const site = matchCallExpression(call, bindingsByName, source);
         if (site && site !== 'dynamic') {
           const { line, column } = offsetToLineColumn(source, call.start);
@@ -716,16 +754,15 @@ export function findFontCallSites(source: string): FontAnalysis | null {
             binding: site.binding,
             assignedName: null,
             configNode: site.configNode,
-            replaceStart: (exprStmt as PositionedNode).start,
-            replaceEnd: (exprStmt as PositionedNode).end,
+            replaceStart: effectiveStmt.start,
+            replaceEnd: effectiveStmt.end,
             line,
             column,
           });
-        } else if (site === 'dynamic' && !dynamicCall) {
-          const calleeName = (call.callee as IdentifierNode).name;
+        } else if (site === 'dynamic' && !dynamicCall && isIdentifier(call.callee)) {
           const argStart = call.arguments[0].start;
           const argEnd = call.arguments[0].end;
-          dynamicCall = `${calleeName}(${source.slice(argStart, argEnd)})`;
+          dynamicCall = `${call.callee.name}(${source.slice(argStart, argEnd)})`;
         }
       }
     }
@@ -817,8 +854,8 @@ function matchCallExpression(
   bindings: Map<string, FontBinding>,
   _source: string
 ): { binding: FontBinding; configNode: AstNode } | 'dynamic' | null {
-  if (call.callee.type !== 'Identifier') return null;
-  const calleeName = (call.callee as IdentifierNode).name;
+  if (!isIdentifier(call.callee)) return null;
+  const calleeName = call.callee.name;
   const binding = bindings.get(calleeName);
   if (!binding) return null;
 

package/src/server/request-context.ts

@@ -17,9 +17,7 @@
 import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { _setGetSearchParamsFn } from '../search-params/define.js';
 import { _setGetSegmentParamsFn } from '../segment-params/define.js';
-import { consumeSeededCookies, getCookieJar } from './cookie-context.js';
-import { _registerServerCookieImpl, _registerFromSchema } from '../cookies/define-cookie.js';
-import { fromSchema } from '../schema-bridge.js';
+import { consumeSeededCookies } from './cookie-context.js';
 
 // Re-export the ALS for framework-internal consumers that need direct access.
 export { requestContextAls };
@@ -87,11 +85,6 @@ _setGetSearchParamsFn(getSearchParams);
 // Same pattern as search params — dynamic imports lose ALS context. See TIM-523.
 _setGetSegmentParamsFn(getSegmentParams);
 
-// Eagerly register the server cookie impl with defineCookie so
-// .get()/.set()/.delete() are sync without dynamic imports.
-_registerServerCookieImpl({ getCookieJar });
-_registerFromSchema(fromSchema);
-
 /**
  * Returns the current request's coerced segment params.
  *