@timber-js/app 0.2.0-alpha.12 → 0.2.0-alpha.120

package/dist/config-validation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Config validation — validates timber.config.ts at startup.
+ *
+ * Runs in the plugin's configResolved hook (once, at startup/build).
+ * Each check produces a clear error message with the invalid value,
+ * what's expected, and how to fix it.
+ *
+ * Design doc: 18-build-system.md
+ */
+import type { TimberUserConfig } from './config-types.js';
+export interface ConfigError {
+    field: string;
+    message: string;
+    value?: unknown;
+    suggestion?: string;
+}
+/**
+ * Validate a TimberUserConfig object.
+ *
+ * Returns an array of errors. Empty array means the config is valid.
+ * Does not throw — the caller decides how to surface errors.
+ */
+export declare function validateConfig(config: TimberUserConfig): ConfigError[];
+/**
+ * Format config errors for terminal output.
+ */
+export declare function formatConfigErrors(errors: ConfigError[]): string;
+/**
+ * Add timber-specific context to an error message that references virtual modules.
+ *
+ * If the error message contains a `virtual:timber-*` ID, appends a
+ * human-readable explanation. Does not replace the original message.
+ */
+export declare function addVirtualModuleContext(errorMessage: string): string;
+interface PeerDepResult {
+    name: string;
+    status: 'ok' | 'missing';
+}
+/**
+ * Check that required peer dependencies are installed.
+ *
+ * Uses require.resolve with a try/catch — no fs scanning.
+ * Returns only the missing packages.
+ */
+export declare function checkPeerDependencies(projectRoot: string): PeerDepResult[];
+/**
+ * Format missing peer dependencies as an actionable warning.
+ */
+export declare function formatMissingPeers(results: PeerDepResult[]): string;
+export {};
+//# sourceMappingURL=config-validation.d.ts.map

package/dist/config-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-validation.d.ts","sourceRoot":"","sources":["../src/config-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAI1D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,EAAE,CA2JtE;AASD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAiBhE;AAeD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAOpE;AAID,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC;CAC1B;AAOD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,EAAE,CAmB1E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAgBnE"}

package/dist/content/index.d.ts

@@ -1,11 +1,2 @@
-/**
- * @timber-js/app/content — Public API for content collections.
- *
- * Re-exports from content-collections and provides timber-specific utilities.
- * Users can import directly from 'content-collections' for generated types,
- * or use this module for the re-exports.
- *
- * Design doc: 20-content-collections.md §"Querying Collections"
- */
-export { defineCollection, defineConfig } from '@content-collections/core';
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/content/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC"}

package/dist/content/index.js

@@ -1,2 +0,0 @@
-import { defineCollection, defineConfig } from "@content-collections/core";
-export { defineCollection, defineConfig };

package/dist/cookies/define-cookie.d.ts

@@ -2,43 +2,62 @@
  * defineCookie — typed cookie definitions.
  *
  * Bundles name + codec + options into a reusable CookieDefinition<T>
- * with .get(), .set(), .delete() server methods and a .useCookie() client hook.
+ * with sync .get(), .set(), .delete() isomorphic methods (server + client)
+ * and a .useCookie() client hook.
  *
- * Reuses the SearchParamCodec protocol via fromSchema() bridge.
- * Validation on read returns the codec default (never throws).
+ * Environment detection is call-time: on the server, getCookieJar() is
+ * used directly (ALS-backed). On the client, document.cookie helpers
+ * and the useCookie hook are used. No registration pattern — imports
+ * resolve via the shims plugin (client bundle gets a stub for
+ * @timber-js/app/server).
+ *
+ * Standard Schema objects (Zod, Valibot, ArkType) are auto-detected in
+ * the codec option — no explicit fromSchema() wrapper needed.
  *
  * See design/29-cookies.md §"Typed Cookies with Schema Validation"
  */
-import type { CookieOptions } from '#/server/request-context.js';
+import type { CookieOptions } from '../server/cookie-context.js';
+import type { Codec } from '../codec.js';
+import type { StandardSchemaV1 } from '../schema-bridge.js';
 /**
  * A codec that converts between string cookie values and typed values.
- * Intentionally identical to SearchParamCodec<T>.
+ * Type alias for the shared Codec<T> protocol.
  */
-export interface CookieCodec<T> {
-    parse(value: string | string[] | undefined): T;
-    serialize(value: T): string | null;
-}
+export type CookieCodec<T> = Codec<T>;
 /** Options for defineCookie: codec + CookieOptions merged. */
-export interface DefineCookieOptions<T> extends Omit<CookieOptions, 'signed'> {
-    /** Codec for parsing/serializing the cookie value. */
-    codec: CookieCodec<T>;
-    /** Sign the cookie with HMAC-SHA256. */
-    signed?: boolean;
+export interface DefineCookieOptions<T, HttpOnly extends boolean = boolean> extends CookieOptions {
+    /**
+     * Codec for parsing/serializing the cookie value.
+     * Accepts a Codec<T> or a Standard Schema object (Zod, Valibot, ArkType)
+     * which is auto-wrapped via fromSchema.
+     */
+    codec: CookieCodec<T> | StandardSchemaV1<T>;
+    /**
+     * Prevent client-side JS access. Default: true.
+     * When true (or omitted), client methods (useCookie, get/set/delete on
+     * client) are omitted from the return type and throw at runtime.
+     */
+    httpOnly?: HttpOnly;
 }
-/** A fully typed cookie definition with server and client methods. */
-export interface CookieDefinition<T> {
-    /** The cookie name. */
+/**
+ * Server-only cookie definition. Returned when httpOnly is true or omitted.
+ * Client methods are absent from the type — accessing them is a TS error.
+ */
+export interface ServerOnlyCookieDefinition<T> {
     readonly name: string;
-    /** The resolved cookie options (without codec). */
     readonly options: CookieOptions;
-    /** The codec used for parsing/serializing. */
     readonly codec: CookieCodec<T>;
-    /** Server: read the typed value from the current request. */
+    /** Read the typed value. Sync, isomorphic (server + client). */
     get(): T;
-    /** Server: set the typed value on the response. */
+    /** Set the typed value. Sync, isomorphic (server + client). */
     set(value: T): void;
-    /** Server: delete the cookie. */
+    /** Delete the cookie. Sync, isomorphic (server + client). */
     delete(): void;
+}
+/**
+ * Full cookie definition with client methods. Returned when httpOnly: false.
+ */
+export interface CookieDefinition<T> extends ServerOnlyCookieDefinition<T> {
     /** Client: React hook for reading/writing this cookie. Returns [value, setter, deleter]. */
     useCookie(): [T, (value: T) => void, () => void];
 }
@@ -47,15 +66,29 @@ export interface CookieDefinition<T> {
  *
  * ```ts
  * import { defineCookie } from '@timber-js/app/cookies';
- * import { fromSchema } from '@timber-js/app/search-params';
  * import { z } from 'zod/v4';
  *
+ * // httpOnly: false — client methods available
  * export const themeCookie = defineCookie('theme', {
- *   codec: fromSchema(z.enum(['light', 'dark', 'system']).default('system')),
+ *   codec: z.enum(['light', 'dark', 'system']).default('system'),
  *   httpOnly: false,
  *   maxAge: 60 * 60 * 24 * 365,
  * });
+ *
+ * // Server or client
+ * const theme = themeCookie.get();
+ * themeCookie.set('dark');
+ *
+ * // Client hook
+ * const [theme, setTheme] = themeCookie.useCookie();
+ *
+ * // httpOnly: true (default) — server-only, no client methods
+ * export const sessionCookie = defineCookie('session', {
+ *   codec: z.string(),
+ * });
+ * sessionCookie.get();       // works on server
+ * sessionCookie.useCookie(); // TS error — httpOnly cookie
  * ```
  */
-export declare function defineCookie<T>(name: string, options: DefineCookieOptions<T>): CookieDefinition<T>;
+export declare function defineCookie<T, HttpOnly extends boolean = true>(name: string, options: DefineCookieOptions<T, HttpOnly>): HttpOnly extends false ? CookieDefinition<T> : ServerOnlyCookieDefinition<T>;
 //# sourceMappingURL=define-cookie.d.ts.map

package/dist/cookies/define-cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-cookie.d.ts","sourceRoot":"","sources":["../../src/cookies/define-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAMjE;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,CAAC,CAAC;IAC/C,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB,CAAC,CAAC,CAAE,SAAQ,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;IAC3E,sDAAsD;IACtD,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,uBAAuB;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,6DAA6D;IAC7D,GAAG,IAAI,CAAC,CAAC;IACT,mDAAmD;IACnD,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,iCAAiC;IACjC,MAAM,IAAI,IAAI,CAAC;IAEf,4FAA4F;IAC5F,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;CAClD;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC9B,gBAAgB,CAAC,CAAC,CAAC,CA4DrB"}
+{"version":3,"file":"define-cookie.d.ts","sourceRoot":"","sources":["../../src/cookies/define-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAKjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAEtC,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,OAAO,CAAE,SAAQ,aAAa;IAC/F;;;;OAIG;IACH,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,GAAG,IAAI,CAAC,CAAC;IACT,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,6DAA6D;IAC7D,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IACxE,4FAA4F;IAC5F,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;CAClD;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,IAAI,EAC7D,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,CAAC,CAAC,EAAE,QAAQ,CAAC,GACxC,QAAQ,SAAS,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAkH9E"}

package/dist/cookies/index.d.ts

@@ -1,3 +1,4 @@
 export { defineCookie } from './define-cookie.js';
-export type { CookieDefinition, CookieCodec, DefineCookieOptions } from './define-cookie.js';
+export type { CookieDefinition, ServerOnlyCookieDefinition, CookieCodec, DefineCookieOptions, } from './define-cookie.js';
+export { jsonCookieCodec } from './json-cookie.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cookies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,WAAW,EACX,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cookies/index.js

@@ -1,69 +1,240 @@
-import "../_chunks/als-registry-B7DbZ2hS.js";
-import { n as cookies } from "../_chunks/request-context-DIkVh_jG.js";
-import "../_chunks/ssr-data-MjmprTmO.js";
-import { t as useCookie } from "../_chunks/use-cookie-DX-l1_5E.js";
-//#region src/cookies/define-cookie.ts
+import { n as fromSchema } from "../_chunks/schema-bridge-eL5vQDSA.js";
+import { t as assertValidCookieName } from "../_chunks/validation-Bm3Je-09.js";
+import { n as getSsrData } from "../_chunks/ssr-data-BO5OvEvg.js";
+import { useSyncExternalStore } from "react";
+import { getCookieJar } from "@timber-js/app/server";
+//#region src/client/use-cookie.ts
+/**
+* useCookie — reactive client-side cookie hook.
+*
+* Uses useSyncExternalStore for SSR-safe, reactive cookie access.
+* All components reading the same cookie name re-render on change.
+* No cross-tab sync (intentional — see design/29-cookies.md).
+*
+* See design/29-cookies.md §"useCookie(name) Hook"
+*/
+/** Per-name subscriber sets. */
+var listeners = /* @__PURE__ */ new Map();
+/** Parse a cookie name from document.cookie. */
+function getCookieValue(name) {
+	if (typeof document === "undefined") return void 0;
+	const match = document.cookie.match(new RegExp("(?:^|;\\s*)" + name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\s*=\\s*([^;]*)"));
+	return match ? decodeURIComponent(match[1]) : void 0;
+}
+/** Serialize options into a cookie string suffix. */
+function serializeOptions(options) {
+	if (!options) return "; Path=/; SameSite=Lax";
+	const parts = [];
+	parts.push(`Path=${options.path ?? "/"}`);
+	if (options.domain) parts.push(`Domain=${options.domain}`);
+	if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+	if (options.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
+	const sameSite = options.sameSite ?? "lax";
+	parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+	if (options.secure) parts.push("Secure");
+	return "; " + parts.join("; ");
+}
+/** Notify all subscribers for a given cookie name. */
+function notify(name) {
+	const subs = listeners.get(name);
+	if (subs) for (const fn of subs) fn();
+}
 /**
-* defineCookie — typed cookie definitions.
+* Notify useCookie subscribers that a cookie value changed.
+* Called by defineCookie's imperative client .set()/.delete() methods
+* so mounted useCookie() consumers re-render.
 *
-* Bundles name + codec + options into a reusable CookieDefinition<T>
-* with .get(), .set(), .delete() server methods and a .useCookie() client hook.
+* @internal — framework use only
+*/
+function notifyCookieChange(name) {
+	notify(name);
+}
+/**
+* Reactive hook for reading/writing a client-side cookie.
 *
-* Reuses the SearchParamCodec protocol via fromSchema() bridge.
-* Validation on read returns the codec default (never throws).
+* Returns `[value, setCookie, deleteCookie]`:
+* - `value`: current cookie value (string | undefined)
+* - `setCookie`: sets the cookie and triggers re-renders
+* - `deleteCookie`: deletes the cookie and triggers re-renders
 *
-* See design/29-cookies.md §"Typed Cookies with Schema Validation"
+* @param name - Cookie name.
+* @param defaultOptions - Default options for setCookie calls.
 */
+function useCookie(name, defaultOptions) {
+	const subscribe = (callback) => {
+		let subs = listeners.get(name);
+		if (!subs) {
+			subs = /* @__PURE__ */ new Set();
+			listeners.set(name, subs);
+		}
+		subs.add(callback);
+		return () => {
+			subs.delete(callback);
+			if (subs.size === 0) listeners.delete(name);
+		};
+	};
+	const getSnapshot = () => getCookieValue(name);
+	const getServerSnapshot = () => getSsrData()?.cookies.get(name);
+	const value = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+	assertValidCookieName(name);
+	const setCookie = (newValue, options) => {
+		if (typeof newValue !== "string") throw new Error(`[timber] useCookie(${JSON.stringify(name)}): value must be a string, got ${typeof newValue}.\n  To store a JSON-serializable value, use defineCookie + jsonCookieCodec from\n  '@timber-js/app/cookies' and call its useCookie() hook instead.`);
+		const merged = {
+			...defaultOptions,
+			...options
+		};
+		document.cookie = `${name}=${encodeURIComponent(newValue)}${serializeOptions(merged)}`;
+		notify(name);
+	};
+	const deleteCookie = () => {
+		const path = defaultOptions?.path ?? "/";
+		const domain = defaultOptions?.domain;
+		let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;
+		if (domain) cookieStr += `; Domain=${domain}`;
+		document.cookie = cookieStr;
+		notify(name);
+	};
+	return [
+		value,
+		setCookie,
+		deleteCookie
+	];
+}
+//#endregion
+//#region src/cookies/define-cookie.ts
+/**
+* Try to get the server cookie jar. Returns null if we're in the client
+* environment (stub throws) or if there's no request context.
+*
+* On the server, getCookieJar() throws "outside of a request context" if
+* called without an ALS store — this is a real error and is re-thrown.
+* The client stub throws a different message — that's caught and returns null.
+*/
+function tryGetServerCookieJar() {
+	try {
+		return getCookieJar();
+	} catch (e) {
+		if (e instanceof Error && e.message.includes("outside of a request context")) throw e;
+		return null;
+	}
+}
+/** Write a cookie via document.cookie and notify useCookie subscribers. */
+function setClientCookie(name, value, options) {
+	const parts = [`${name}=${encodeURIComponent(value)}`];
+	const path = options?.path ?? "/";
+	parts.push(`Path=${path}`);
+	if (options?.domain) parts.push(`Domain=${options.domain}`);
+	if (options?.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+	if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
+	const sameSite = options?.sameSite ?? "lax";
+	parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+	if (options?.secure) parts.push("Secure");
+	document.cookie = parts.join("; ");
+	notifyCookieChange(name);
+}
+/** Delete a cookie via document.cookie and notify useCookie subscribers. */
+function deleteClientCookie(name, options) {
+	const path = options?.path ?? "/";
+	const domain = options?.domain;
+	let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;
+	if (domain) cookieStr += `; Domain=${domain}`;
+	document.cookie = cookieStr;
+	notifyCookieChange(name);
+}
+function resolveCodec(codecOrSchema) {
+	if (typeof codecOrSchema.parse === "function" && typeof codecOrSchema.serialize === "function") return codecOrSchema;
+	if (typeof codecOrSchema === "object" && codecOrSchema !== null && "~standard" in codecOrSchema) return fromSchema(codecOrSchema);
+	throw new Error("[timber] defineCookie: codec must be a Codec<T> (with parse/serialize methods) or a Standard Schema object (Zod, Valibot, ArkType).");
+}
 /**
 * Define a typed cookie.
 *
 * ```ts
 * import { defineCookie } from '@timber-js/app/cookies';
-* import { fromSchema } from '@timber-js/app/search-params';
 * import { z } from 'zod/v4';
 *
+* // httpOnly: false — client methods available
 * export const themeCookie = defineCookie('theme', {
-*   codec: fromSchema(z.enum(['light', 'dark', 'system']).default('system')),
+*   codec: z.enum(['light', 'dark', 'system']).default('system'),
 *   httpOnly: false,
 *   maxAge: 60 * 60 * 24 * 365,
 * });
+*
+* // Server or client
+* const theme = themeCookie.get();
+* themeCookie.set('dark');
+*
+* // Client hook
+* const [theme, setTheme] = themeCookie.useCookie();
+*
+* // httpOnly: true (default) — server-only, no client methods
+* export const sessionCookie = defineCookie('session', {
+*   codec: z.string(),
+* });
+* sessionCookie.get();       // works on server
+* sessionCookie.useCookie(); // TS error — httpOnly cookie
 * ```
 */
 function defineCookie(name, options) {
-	const { codec, ...cookieOpts } = options;
+	const { codec: codecOrSchema, ...cookieOpts } = options;
+	const codec = resolveCodec(codecOrSchema);
 	const resolvedOptions = { ...cookieOpts };
-	return {
+	const isHttpOnly = options.httpOnly !== false;
+	function getClientOpts() {
+		return {
+			path: resolvedOptions.path,
+			domain: resolvedOptions.domain,
+			maxAge: resolvedOptions.maxAge,
+			expires: resolvedOptions.expires,
+			sameSite: resolvedOptions.sameSite,
+			secure: resolvedOptions.secure
+		};
+	}
+	const base = {
 		name,
 		options: resolvedOptions,
 		codec,
 		get() {
-			const jar = cookies();
-			const raw = resolvedOptions.signed ? jar.getSigned(name) : jar.get(name);
+			const serverJar = tryGetServerCookieJar();
+			if (serverJar) return codec.parse(serverJar.get(name));
+			if (isHttpOnly) throw new Error(`[timber] defineCookie('${name}').get() cannot be used with httpOnly cookies — the browser cannot access them. Set httpOnly: false to enable client access.`);
+			const raw = getCookieValue(name);
 			return codec.parse(raw);
 		},
 		set(value) {
+			const serverJar = tryGetServerCookieJar();
+			if (serverJar) {
+				const serialized = codec.serialize(value);
+				if (serialized === null) serverJar.delete(name, {
+					path: resolvedOptions.path,
+					domain: resolvedOptions.domain
+				});
+				else serverJar.set(name, serialized, resolvedOptions);
+				return;
+			}
+			if (isHttpOnly) throw new Error(`[timber] defineCookie('${name}').set() cannot be used with httpOnly cookies — the browser cannot access them. Set httpOnly: false to enable client access.`);
 			const serialized = codec.serialize(value);
-			if (serialized === null) cookies().delete(name, {
-				path: resolvedOptions.path,
-				domain: resolvedOptions.domain
-			});
-			else cookies().set(name, serialized, resolvedOptions);
+			if (serialized === null) deleteClientCookie(name, getClientOpts());
+			else setClientCookie(name, serialized, getClientOpts());
 		},
 		delete() {
-			cookies().delete(name, {
-				path: resolvedOptions.path,
-				domain: resolvedOptions.domain
-			});
-		},
+			const serverJar = tryGetServerCookieJar();
+			if (serverJar) {
+				serverJar.delete(name, {
+					path: resolvedOptions.path,
+					domain: resolvedOptions.domain
+				});
+				return;
+			}
+			if (isHttpOnly) throw new Error(`[timber] defineCookie('${name}').delete() cannot be used with httpOnly cookies — the browser cannot access them. Set httpOnly: false to enable client access.`);
+			deleteClientCookie(name, getClientOpts());
+		}
+	};
+	if (isHttpOnly) return base;
+	return {
+		...base,
 		useCookie() {
-			const [raw, setRaw, deleteRaw] = useCookie(name, {
-				path: resolvedOptions.path,
-				domain: resolvedOptions.domain,
-				maxAge: resolvedOptions.maxAge,
-				expires: resolvedOptions.expires,
-				sameSite: resolvedOptions.sameSite,
-				secure: resolvedOptions.secure
-			});
+			const [raw, setRaw, deleteRaw] = useCookie(name, getClientOpts());
 			const parsed = codec.parse(raw);
 			const setTyped = (value) => {
 				const serialized = codec.serialize(value);
@@ -79,6 +250,50 @@ function defineCookie(name, options) {
 	};
 }
 //#endregion
-export { defineCookie };
+//#region src/cookies/json-cookie.ts
+/**
+* Build a CookieCodec that JSON-encodes the value. The framework's
+* cookie write path then URL-encodes the JSON string into a valid
+* `cookie-octet` form, and the read path reverses both transforms.
+*
+* @param defaultValue - Returned by `parse` when the cookie is missing
+*   or the stored value cannot be JSON-parsed. Optional — if omitted,
+*   `parse` returns `undefined` on missing/malformed input.
+*
+*   The default is **deep-cloned** on every fallback return via
+*   `structuredClone`, so mutating the parsed result in one request
+*   cannot leak into later requests that fall back to the same
+*   default. This matters for long-lived server processes where a
+*   codec is defined once at module load and shared across all
+*   requests — without the clone, a user doing
+*   `const prefs = prefsCookie.get(); prefs.lang = 'fr'` on a missing
+*   cookie would mutate the module-level default and poison every
+*   later fallback. See the "shared mutable default" regression test
+*   in `tests/define-cookie.test.ts`.
+*/
+function jsonCookieCodec(defaultValue) {
+	const cloneDefault = () => {
+		if (defaultValue === void 0 || defaultValue === null) return defaultValue;
+		return structuredClone(defaultValue);
+	};
+	return {
+		parse(value) {
+			if (value === void 0 || value === "") return cloneDefault();
+			const raw = Array.isArray(value) ? value[value.length - 1] : value;
+			if (raw === void 0 || raw === "") return cloneDefault();
+			try {
+				return JSON.parse(raw);
+			} catch {
+				return cloneDefault();
+			}
+		},
+		serialize(value) {
+			if (value === null || value === void 0) return null;
+			return JSON.stringify(value);
+		}
+	};
+}
+//#endregion
+export { defineCookie, jsonCookieCodec };
 
 //# sourceMappingURL=index.js.map

package/dist/cookies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/cookies/define-cookie.ts"],"sourcesContent":["/**\n * defineCookie — typed cookie definitions.\n *\n * Bundles name + codec + options into a reusable CookieDefinition<T>\n * with .get(), .set(), .delete() server methods and a .useCookie() client hook.\n *\n * Reuses the SearchParamCodec protocol via fromSchema() bridge.\n * Validation on read returns the codec default (never throws).\n *\n * See design/29-cookies.md §\"Typed Cookies with Schema Validation\"\n */\n\nimport { cookies } from '#/server/request-context.js';\nimport type { CookieOptions } from '#/server/request-context.js';\nimport { useCookie as useRawCookie } from '#/client/use-cookie.js';\nimport type { ClientCookieOptions } from '#/client/use-cookie.js';\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\n/**\n * A codec that converts between string cookie values and typed values.\n * Intentionally identical to SearchParamCodec<T>.\n */\nexport interface CookieCodec<T> {\n  parse(value: string | string[] | undefined): T;\n  serialize(value: T): string | null;\n}\n\n/** Options for defineCookie: codec + CookieOptions merged. */\nexport interface DefineCookieOptions<T> extends Omit<CookieOptions, 'signed'> {\n  /** Codec for parsing/serializing the cookie value. */\n  codec: CookieCodec<T>;\n  /** Sign the cookie with HMAC-SHA256. */\n  signed?: boolean;\n}\n\n/** A fully typed cookie definition with server and client methods. */\nexport interface CookieDefinition<T> {\n  /** The cookie name. */\n  readonly name: string;\n  /** The resolved cookie options (without codec). */\n  readonly options: CookieOptions;\n  /** The codec used for parsing/serializing. */\n  readonly codec: CookieCodec<T>;\n\n  /** Server: read the typed value from the current request. */\n  get(): T;\n  /** Server: set the typed value on the response. */\n  set(value: T): void;\n  /** Server: delete the cookie. */\n  delete(): void;\n\n  /** Client: React hook for reading/writing this cookie. Returns [value, setter, deleter]. */\n  useCookie(): [T, (value: T) => void, () => void];\n}\n\n// ─── Factory ──────────────────────────────────────────────────────────────\n\n/**\n * Define a typed cookie.\n *\n * ```ts\n * import { defineCookie } from '@timber-js/app/cookies';\n * import { fromSchema } from '@timber-js/app/search-params';\n * import { z } from 'zod/v4';\n *\n * export const themeCookie = defineCookie('theme', {\n *   codec: fromSchema(z.enum(['light', 'dark', 'system']).default('system')),\n *   httpOnly: false,\n *   maxAge: 60 * 60 * 24 * 365,\n * });\n * ```\n */\nexport function defineCookie<T>(\n  name: string,\n  options: DefineCookieOptions<T>\n): CookieDefinition<T> {\n  const { codec, ...cookieOpts } = options;\n  const resolvedOptions: CookieOptions = { ...cookieOpts };\n\n  return {\n    name,\n    options: resolvedOptions,\n    codec,\n\n    get(): T {\n      const jar = cookies();\n      const raw = resolvedOptions.signed ? jar.getSigned(name) : jar.get(name);\n      return codec.parse(raw);\n    },\n\n    set(value: T): void {\n      const serialized = codec.serialize(value);\n      if (serialized === null) {\n        cookies().delete(name, {\n          path: resolvedOptions.path,\n          domain: resolvedOptions.domain,\n        });\n      } else {\n        cookies().set(name, serialized, resolvedOptions);\n      }\n    },\n\n    delete(): void {\n      cookies().delete(name, {\n        path: resolvedOptions.path,\n        domain: resolvedOptions.domain,\n      });\n    },\n\n    useCookie(): [T, (value: T) => void, () => void] {\n      // Extract client-safe options (no httpOnly — client cookies can't be httpOnly)\n      const clientOpts: ClientCookieOptions = {\n        path: resolvedOptions.path,\n        domain: resolvedOptions.domain,\n        maxAge: resolvedOptions.maxAge,\n        expires: resolvedOptions.expires,\n        sameSite: resolvedOptions.sameSite,\n        secure: resolvedOptions.secure,\n      };\n\n      const [raw, setRaw, deleteRaw] = useRawCookie(name, clientOpts);\n      const parsed = codec.parse(raw);\n\n      const setTyped = (value: T): void => {\n        const serialized = codec.serialize(value);\n        if (serialized === null) {\n          deleteRaw();\n        } else {\n          setRaw(serialized);\n        }\n      };\n\n      return [parsed, setTyped, deleteRaw];\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,SAAgB,aACd,MACA,SACqB;CACrB,MAAM,EAAE,OAAO,GAAG,eAAe;CACjC,MAAM,kBAAiC,EAAE,GAAG,YAAY;AAExD,QAAO;EACL;EACA,SAAS;EACT;EAEA,MAAS;GACP,MAAM,MAAM,SAAS;GACrB,MAAM,MAAM,gBAAgB,SAAS,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK;AACxE,UAAO,MAAM,MAAM,IAAI;;EAGzB,IAAI,OAAgB;GAClB,MAAM,aAAa,MAAM,UAAU,MAAM;AACzC,OAAI,eAAe,KACjB,UAAS,CAAC,OAAO,MAAM;IACrB,MAAM,gBAAgB;IACtB,QAAQ,gBAAgB;IACzB,CAAC;OAEF,UAAS,CAAC,IAAI,MAAM,YAAY,gBAAgB;;EAIpD,SAAe;AACb,YAAS,CAAC,OAAO,MAAM;IACrB,MAAM,gBAAgB;IACtB,QAAQ,gBAAgB;IACzB,CAAC;;EAGJ,YAAiD;GAW/C,MAAM,CAAC,KAAK,QAAQ,aAAa,UAAa,MATN;IACtC,MAAM,gBAAgB;IACtB,QAAQ,gBAAgB;IACxB,QAAQ,gBAAgB;IACxB,SAAS,gBAAgB;IACzB,UAAU,gBAAgB;IAC1B,QAAQ,gBAAgB;IACzB,CAE8D;GAC/D,MAAM,SAAS,MAAM,MAAM,IAAI;GAE/B,MAAM,YAAY,UAAmB;IACnC,MAAM,aAAa,MAAM,UAAU,MAAM;AACzC,QAAI,eAAe,KACjB,YAAW;QAEX,QAAO,WAAW;;AAItB,UAAO;IAAC;IAAQ;IAAU;IAAU;;EAEvC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/client/use-cookie.ts","../../src/cookies/define-cookie.ts","../../src/cookies/json-cookie.ts"],"sourcesContent":["/**\n * useCookie — reactive client-side cookie hook.\n *\n * Uses useSyncExternalStore for SSR-safe, reactive cookie access.\n * All components reading the same cookie name re-render on change.\n * No cross-tab sync (intentional — see design/29-cookies.md).\n *\n * See design/29-cookies.md §\"useCookie(name) Hook\"\n */\n\nimport { useSyncExternalStore } from 'react';\nimport { getSsrData } from './ssr-data.js';\nimport { assertValidCookieName } from '../cookies/validation.js';\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\nexport interface ClientCookieOptions {\n  /** URL path scope. Default: '/'. */\n  path?: string;\n  /** Domain scope. Default: omitted (current domain). */\n  domain?: string;\n  /** Max age in seconds. */\n  maxAge?: number;\n  /** Expiration date. */\n  expires?: Date;\n  /** Cross-site policy. Default: 'lax'. */\n  sameSite?: 'strict' | 'lax' | 'none';\n  /** Only send over HTTPS. Default: true in production. */\n  secure?: boolean;\n}\n\nexport type CookieSetter = (value: string, options?: ClientCookieOptions) => void;\n\n// ─── Module-Level Cookie Store ────────────────────────────────────────────\n\ntype Listener = () => void;\n\n/** Per-name subscriber sets. */\nconst listeners = new Map<string, Set<Listener>>();\n\n/** Parse a cookie name from document.cookie. */\nexport function getCookieValue(name: string): string | undefined {\n  if (typeof document === 'undefined') return undefined;\n  const match = document.cookie.match(\n    new RegExp('(?:^|;\\\\s*)' + name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&') + '\\\\s*=\\\\s*([^;]*)')\n  );\n  return match ? decodeURIComponent(match[1]) : undefined;\n}\n\n/** Serialize options into a cookie string suffix. */\nexport function serializeOptions(options?: ClientCookieOptions): string {\n  if (!options) return '; Path=/; SameSite=Lax';\n  const parts: string[] = [];\n  parts.push(`Path=${options.path ?? '/'}`);\n  if (options.domain) parts.push(`Domain=${options.domain}`);\n  if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);\n  if (options.expires) parts.push(`Expires=${options.expires.toUTCString()}`);\n  const sameSite = options.sameSite ?? 'lax';\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  if (options.secure) parts.push('Secure');\n  return '; ' + parts.join('; ');\n}\n\n/** Notify all subscribers for a given cookie name. */\nfunction notify(name: string): void {\n  const subs = listeners.get(name);\n  if (subs) {\n    for (const fn of subs) fn();\n  }\n}\n\n/**\n * Notify useCookie subscribers that a cookie value changed.\n * Called by defineCookie's imperative client .set()/.delete() methods\n * so mounted useCookie() consumers re-render.\n *\n * @internal — framework use only\n */\nexport function notifyCookieChange(name: string): void {\n  notify(name);\n}\n\n// ─── Hook ─────────────────────────────────────────────────────────────────\n\n/**\n * Reactive hook for reading/writing a client-side cookie.\n *\n * Returns `[value, setCookie, deleteCookie]`:\n * - `value`: current cookie value (string | undefined)\n * - `setCookie`: sets the cookie and triggers re-renders\n * - `deleteCookie`: deletes the cookie and triggers re-renders\n *\n * @param name - Cookie name.\n * @param defaultOptions - Default options for setCookie calls.\n */\nexport function useCookie(\n  name: string,\n  defaultOptions?: ClientCookieOptions\n): [value: string | undefined, setCookie: CookieSetter, deleteCookie: () => void] {\n  const subscribe = (callback: Listener): (() => void) => {\n    let subs = listeners.get(name);\n    if (!subs) {\n      subs = new Set();\n      listeners.set(name, subs);\n    }\n    subs.add(callback);\n    return () => {\n      subs!.delete(callback);\n      if (subs!.size === 0) listeners.delete(name);\n    };\n  };\n\n  const getSnapshot = (): string | undefined => getCookieValue(name);\n  const getServerSnapshot = (): string | undefined => getSsrData()?.cookies.get(name);\n\n  const value = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);\n\n  // Validate the name once per hook instance — names are typically\n  // stable string literals, so this catches the bug at first render\n  // rather than on every write. Throws via `assertValidCookieName` with\n  // a precise error if the name violates RFC 7230 token rules.\n  assertValidCookieName(name);\n\n  const setCookie: CookieSetter = (newValue: string, options?: ClientCookieOptions) => {\n    if (typeof newValue !== 'string') {\n      throw new Error(\n        `[timber] useCookie(${JSON.stringify(name)}): value must be a string, got ${typeof newValue}.\\n` +\n          `  To store a JSON-serializable value, use defineCookie + jsonCookieCodec from\\n` +\n          `  '@timber-js/app/cookies' and call its useCookie() hook instead.`\n      );\n    }\n    const merged = { ...defaultOptions, ...options };\n    // Auto-encode mirrors the server's `cookies().set()` contract:\n    // values are URL-encoded on write, URL-decoded on read, so the\n    // logical bytes round-trip losslessly. See design/29-cookies.md\n    // §\"Encoding Contract\".\n    document.cookie = `${name}=${encodeURIComponent(newValue)}${serializeOptions(merged)}`;\n    notify(name);\n  };\n\n  const deleteCookie = (): void => {\n    const path = defaultOptions?.path ?? '/';\n    const domain = defaultOptions?.domain;\n    let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;\n    if (domain) cookieStr += `; Domain=${domain}`;\n    document.cookie = cookieStr;\n    notify(name);\n  };\n\n  return [value, setCookie, deleteCookie];\n}\n","/**\n * defineCookie — typed cookie definitions.\n *\n * Bundles name + codec + options into a reusable CookieDefinition<T>\n * with sync .get(), .set(), .delete() isomorphic methods (server + client)\n * and a .useCookie() client hook.\n *\n * Environment detection is call-time: on the server, getCookieJar() is\n * used directly (ALS-backed). On the client, document.cookie helpers\n * and the useCookie hook are used. No registration pattern — imports\n * resolve via the shims plugin (client bundle gets a stub for\n * @timber-js/app/server).\n *\n * Standard Schema objects (Zod, Valibot, ArkType) are auto-detected in\n * the codec option — no explicit fromSchema() wrapper needed.\n *\n * See design/29-cookies.md §\"Typed Cookies with Schema Validation\"\n */\n\nimport type { CookieOptions } from '../server/cookie-context.js';\nimport type { ClientCookieOptions } from '../client/use-cookie.js';\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\nimport type { Codec } from '../codec.js';\nimport type { StandardSchemaV1 } from '../schema-bridge.js';\n\n/**\n * A codec that converts between string cookie values and typed values.\n * Type alias for the shared Codec<T> protocol.\n */\nexport type CookieCodec<T> = Codec<T>;\n\n/** Options for defineCookie: codec + CookieOptions merged. */\nexport interface DefineCookieOptions<T, HttpOnly extends boolean = boolean> extends CookieOptions {\n  /**\n   * Codec for parsing/serializing the cookie value.\n   * Accepts a Codec<T> or a Standard Schema object (Zod, Valibot, ArkType)\n   * which is auto-wrapped via fromSchema.\n   */\n  codec: CookieCodec<T> | StandardSchemaV1<T>;\n  /**\n   * Prevent client-side JS access. Default: true.\n   * When true (or omitted), client methods (useCookie, get/set/delete on\n   * client) are omitted from the return type and throw at runtime.\n   */\n  httpOnly?: HttpOnly;\n}\n\n/**\n * Server-only cookie definition. Returned when httpOnly is true or omitted.\n * Client methods are absent from the type — accessing them is a TS error.\n */\nexport interface ServerOnlyCookieDefinition<T> {\n  readonly name: string;\n  readonly options: CookieOptions;\n  readonly codec: CookieCodec<T>;\n\n  /** Read the typed value. Sync, isomorphic (server + client). */\n  get(): T;\n  /** Set the typed value. Sync, isomorphic (server + client). */\n  set(value: T): void;\n  /** Delete the cookie. Sync, isomorphic (server + client). */\n  delete(): void;\n}\n\n/**\n * Full cookie definition with client methods. Returned when httpOnly: false.\n */\nexport interface CookieDefinition<T> extends ServerOnlyCookieDefinition<T> {\n  /** Client: React hook for reading/writing this cookie. Returns [value, setter, deleter]. */\n  useCookie(): [T, (value: T) => void, () => void];\n}\n\n// ─── Direct Imports (no registration) ─────────────────────────────────────\n//\n// Server: getCookieJar is imported from @timber-js/app/server. In the client\n// bundle, the shims plugin replaces @timber-js/app/server with a stub module\n// where getCookieJar throws on call. We detect the environment at call time\n// by trying getCookieJar() — if it throws the stub error, we fall through\n// to the client path.\n//\n// Client: useCookie, getCookieValue, notifyCookieChange\n// are imported from use-cookie.ts. These are safe in all environments (no\n// node:async_hooks dependency).\n//\n// Schema: fromSchema is a pure function — safe in all environments.\n\nimport { getCookieJar } from '@timber-js/app/server';\nimport { fromSchema } from '../schema-bridge.js';\nimport {\n  useCookie as useRawCookie,\n  notifyCookieChange,\n  getCookieValue,\n} from '../client/use-cookie.js';\n\n// ─── Environment Detection ────────────────────────────────────────────────\n\n/**\n * Try to get the server cookie jar. Returns null if we're in the client\n * environment (stub throws) or if there's no request context.\n *\n * On the server, getCookieJar() throws \"outside of a request context\" if\n * called without an ALS store — this is a real error and is re-thrown.\n * The client stub throws a different message — that's caught and returns null.\n */\nfunction tryGetServerCookieJar(): ReturnType<typeof getCookieJar> | null {\n  try {\n    return getCookieJar();\n  } catch (e) {\n    // Server-side \"no request context\" error — re-throw as a real bug.\n    if (e instanceof Error && e.message.includes('outside of a request context')) {\n      throw e;\n    }\n    // Client stub error or other — fall through to client path.\n    return null;\n  }\n}\n\n// ─── Client Cookie Helpers ────────────────────────────────────────────────\n\n/** Write a cookie via document.cookie and notify useCookie subscribers. */\nfunction setClientCookie(name: string, value: string, options?: ClientCookieOptions): void {\n  const parts: string[] = [`${name}=${encodeURIComponent(value)}`];\n  const path = options?.path ?? '/';\n  parts.push(`Path=${path}`);\n  if (options?.domain) parts.push(`Domain=${options.domain}`);\n  if (options?.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);\n  if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);\n  const sameSite = options?.sameSite ?? 'lax';\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  if (options?.secure) parts.push('Secure');\n  document.cookie = parts.join('; ');\n  notifyCookieChange(name);\n}\n\n/** Delete a cookie via document.cookie and notify useCookie subscribers. */\nfunction deleteClientCookie(name: string, options?: ClientCookieOptions): void {\n  const path = options?.path ?? '/';\n  const domain = options?.domain;\n  let cookieStr = `${name}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=${path}`;\n  if (domain) cookieStr += `; Domain=${domain}`;\n  document.cookie = cookieStr;\n  notifyCookieChange(name);\n}\n\n// ─── Standard Schema Auto-Detection ───────────────────────────────────────\n\nfunction resolveCodec<T>(codecOrSchema: CookieCodec<T> | StandardSchemaV1<T>): CookieCodec<T> {\n  // If it has parse + serialize, it's already a Codec\n  if (\n    typeof (codecOrSchema as Codec<T>).parse === 'function' &&\n    typeof (codecOrSchema as Codec<T>).serialize === 'function'\n  ) {\n    return codecOrSchema as CookieCodec<T>;\n  }\n\n  // Auto-detect Standard Schema\n  if (typeof codecOrSchema === 'object' && codecOrSchema !== null && '~standard' in codecOrSchema) {\n    return fromSchema(codecOrSchema as StandardSchemaV1<unknown>) as CookieCodec<T>;\n  }\n\n  throw new Error(\n    '[timber] defineCookie: codec must be a Codec<T> (with parse/serialize methods) ' +\n      'or a Standard Schema object (Zod, Valibot, ArkType).'\n  );\n}\n\n// ─── Factory ──────────────────────────────────────────────────────────────\n\n/**\n * Define a typed cookie.\n *\n * ```ts\n * import { defineCookie } from '@timber-js/app/cookies';\n * import { z } from 'zod/v4';\n *\n * // httpOnly: false — client methods available\n * export const themeCookie = defineCookie('theme', {\n *   codec: z.enum(['light', 'dark', 'system']).default('system'),\n *   httpOnly: false,\n *   maxAge: 60 * 60 * 24 * 365,\n * });\n *\n * // Server or client\n * const theme = themeCookie.get();\n * themeCookie.set('dark');\n *\n * // Client hook\n * const [theme, setTheme] = themeCookie.useCookie();\n *\n * // httpOnly: true (default) — server-only, no client methods\n * export const sessionCookie = defineCookie('session', {\n *   codec: z.string(),\n * });\n * sessionCookie.get();       // works on server\n * sessionCookie.useCookie(); // TS error — httpOnly cookie\n * ```\n */\nexport function defineCookie<T, HttpOnly extends boolean = true>(\n  name: string,\n  options: DefineCookieOptions<T, HttpOnly>\n): HttpOnly extends false ? CookieDefinition<T> : ServerOnlyCookieDefinition<T> {\n  const { codec: codecOrSchema, ...cookieOpts } = options;\n  const codec = resolveCodec(codecOrSchema);\n  const resolvedOptions: CookieOptions = { ...cookieOpts };\n  const isHttpOnly = options.httpOnly !== false; // default true\n\n  function getClientOpts(): ClientCookieOptions {\n    return {\n      path: resolvedOptions.path,\n      domain: resolvedOptions.domain,\n      maxAge: resolvedOptions.maxAge,\n      expires: resolvedOptions.expires,\n      sameSite: resolvedOptions.sameSite,\n      secure: resolvedOptions.secure,\n    };\n  }\n\n  const base: ServerOnlyCookieDefinition<T> = {\n    name,\n    options: resolvedOptions,\n    codec,\n\n    get(): T {\n      const serverJar = tryGetServerCookieJar();\n      if (serverJar) {\n        return codec.parse(serverJar.get(name));\n      }\n      // Client path\n      if (isHttpOnly) {\n        throw new Error(\n          `[timber] defineCookie('${name}').get() cannot be used with httpOnly cookies — ` +\n            `the browser cannot access them. Set httpOnly: false to enable client access.`\n        );\n      }\n      const raw = getCookieValue(name);\n      return codec.parse(raw);\n    },\n\n    set(value: T): void {\n      const serverJar = tryGetServerCookieJar();\n      if (serverJar) {\n        const serialized = codec.serialize(value);\n        if (serialized === null) {\n          serverJar.delete(name, {\n            path: resolvedOptions.path,\n            domain: resolvedOptions.domain,\n          });\n        } else {\n          serverJar.set(name, serialized, resolvedOptions);\n        }\n        return;\n      }\n      // Client path\n      if (isHttpOnly) {\n        throw new Error(\n          `[timber] defineCookie('${name}').set() cannot be used with httpOnly cookies — ` +\n            `the browser cannot access them. Set httpOnly: false to enable client access.`\n        );\n      }\n      const serialized = codec.serialize(value);\n      if (serialized === null) {\n        deleteClientCookie(name, getClientOpts());\n      } else {\n        setClientCookie(name, serialized, getClientOpts());\n      }\n    },\n\n    delete(): void {\n      const serverJar = tryGetServerCookieJar();\n      if (serverJar) {\n        serverJar.delete(name, {\n          path: resolvedOptions.path,\n          domain: resolvedOptions.domain,\n        });\n        return;\n      }\n      // Client path\n      if (isHttpOnly) {\n        throw new Error(\n          `[timber] defineCookie('${name}').delete() cannot be used with httpOnly cookies — ` +\n            `the browser cannot access them. Set httpOnly: false to enable client access.`\n        );\n      }\n      deleteClientCookie(name, getClientOpts());\n    },\n  };\n\n  if (isHttpOnly) {\n    return base as HttpOnly extends false ? CookieDefinition<T> : ServerOnlyCookieDefinition<T>;\n  }\n\n  // httpOnly: false — add useCookie client hook\n  const full: CookieDefinition<T> = {\n    ...base,\n\n    useCookie(): [T, (value: T) => void, () => void] {\n      const clientOpts = getClientOpts();\n      const [raw, setRaw, deleteRaw] = useRawCookie(name, clientOpts);\n      const parsed = codec.parse(raw);\n\n      const setTyped = (value: T): void => {\n        const serialized = codec.serialize(value);\n        if (serialized === null) {\n          deleteRaw();\n        } else {\n          setRaw(serialized);\n        }\n      };\n\n      return [parsed, setTyped, deleteRaw];\n    },\n  };\n\n  return full as HttpOnly extends false ? CookieDefinition<T> : ServerOnlyCookieDefinition<T>;\n}\n","/**\n * jsonCookieCodec — Codec helper for storing JSON-serializable values in\n * cookies.\n *\n * The codec is intentionally minimal: `JSON.stringify` on serialize,\n * `JSON.parse` on parse. The framework handles the URL encoding /\n * decoding around it (see design/29-cookies.md §\"Encoding Contract\"):\n *\n *     defineCookie.setCookie(value)\n *       → codec.serialize: JSON.stringify       → '{\"a\":1}'\n *       → cookies().set: encodeURIComponent     → '%7B%22a%22%3A1%7D'\n *       → wire: Set-Cookie: prefs=%7B%22a%22%3A1%7D\n *\n *     defineCookie.getCookie()\n *       → wire: Cookie: prefs=%7B%22a%22%3A1%7D\n *       → parseCookieHeader: decodeURIComponent → '{\"a\":1}'\n *       → codec.parse: JSON.parse               → { a: 1 }\n *\n * The same chain works on the client: `useCookie` auto-encodes on writes\n * and auto-decodes on reads, so `jsonCookieCodec` composes with both the\n * server `defineCookie` methods and the client `useCookie` hook with no\n * environment-specific branches.\n *\n * Parsing is total: any non-JSON value (or `undefined`) returns the\n * supplied default. This matches the \"never crash on user-controlled\n * cookie input\" semantics that `fromSchema` uses for typed search params.\n *\n * ```ts\n * import { defineCookie, jsonCookieCodec } from '@timber-js/app/cookies';\n *\n * interface Prefs { lang: string; fontSize: number }\n *\n * export const prefsCookie = defineCookie('prefs', {\n *   codec: jsonCookieCodec<Prefs>({ lang: 'en', fontSize: 16 }),\n *   httpOnly: false,\n *   maxAge: 60 * 60 * 24 * 365,\n * });\n *\n * await prefsCookie.setCookie({ lang: 'fr', fontSize: 18 });\n * ```\n */\n\nimport type { Codec } from '../codec.js';\n\n/**\n * Build a CookieCodec that JSON-encodes the value. The framework's\n * cookie write path then URL-encodes the JSON string into a valid\n * `cookie-octet` form, and the read path reverses both transforms.\n *\n * @param defaultValue - Returned by `parse` when the cookie is missing\n *   or the stored value cannot be JSON-parsed. Optional — if omitted,\n *   `parse` returns `undefined` on missing/malformed input.\n *\n *   The default is **deep-cloned** on every fallback return via\n *   `structuredClone`, so mutating the parsed result in one request\n *   cannot leak into later requests that fall back to the same\n *   default. This matters for long-lived server processes where a\n *   codec is defined once at module load and shared across all\n *   requests — without the clone, a user doing\n *   `const prefs = prefsCookie.get(); prefs.lang = 'fr'` on a missing\n *   cookie would mutate the module-level default and poison every\n *   later fallback. See the \"shared mutable default\" regression test\n *   in `tests/define-cookie.test.ts`.\n */\nexport function jsonCookieCodec<T>(defaultValue?: T): Codec<T> {\n  // Resolve the fallback at call time, not capture time, so every\n  // fallback return produces a fresh deep copy. structuredClone handles\n  // nested objects, arrays, dates, maps, sets — everything\n  // JSON-serializable plus more. For primitives and undefined,\n  // structuredClone is effectively a no-op.\n  const cloneDefault = (): T => {\n    if (defaultValue === undefined || defaultValue === null) {\n      return defaultValue as T;\n    }\n    // structuredClone is a Node built-in since Node 17, available in\n    // all supported runtimes.\n    return structuredClone(defaultValue);\n  };\n\n  return {\n    parse(value: string | string[] | undefined): T {\n      if (value === undefined || value === '') {\n        return cloneDefault();\n      }\n      // Cookies are single-valued by name; defensively pick the last\n      // entry if a Codec consumer somehow passes an array.\n      const raw = Array.isArray(value) ? value[value.length - 1] : value;\n      if (raw === undefined || raw === '') {\n        return cloneDefault();\n      }\n      try {\n        return JSON.parse(raw) as T;\n      } catch {\n        return cloneDefault();\n      }\n    },\n\n    serialize(value: T): string | null {\n      if (value === null || value === undefined) {\n        return null;\n      }\n      return JSON.stringify(value);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsCA,IAAM,4BAAY,IAAI,KAA4B;;AAGlD,SAAgB,eAAe,MAAkC;AAC/D,KAAI,OAAO,aAAa,YAAa,QAAO,KAAA;CAC5C,MAAM,QAAQ,SAAS,OAAO,MAC5B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,uBAAuB,OAAO,GAAG,mBAAmB,CAC7F;AACD,QAAO,QAAQ,mBAAmB,MAAM,GAAG,GAAG,KAAA;;;AAIhD,SAAgB,iBAAiB,SAAuC;AACtE,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,QAAkB,EAAE;AAC1B,OAAM,KAAK,QAAQ,QAAQ,QAAQ,MAAM;AACzC,KAAI,QAAQ,OAAQ,OAAM,KAAK,UAAU,QAAQ,SAAS;AAC1D,KAAI,QAAQ,WAAW,KAAA,EAAW,OAAM,KAAK,WAAW,QAAQ,SAAS;AACzE,KAAI,QAAQ,QAAS,OAAM,KAAK,WAAW,QAAQ,QAAQ,aAAa,GAAG;CAC3E,MAAM,WAAW,QAAQ,YAAY;AACrC,OAAM,KAAK,YAAY,SAAS,OAAO,EAAE,CAAC,aAAa,GAAG,SAAS,MAAM,EAAE,GAAG;AAC9E,KAAI,QAAQ,OAAQ,OAAM,KAAK,SAAS;AACxC,QAAO,OAAO,MAAM,KAAK,KAAK;;;AAIhC,SAAS,OAAO,MAAoB;CAClC,MAAM,OAAO,UAAU,IAAI,KAAK;AAChC,KAAI,KACF,MAAK,MAAM,MAAM,KAAM,KAAI;;;;;;;;;AAW/B,SAAgB,mBAAmB,MAAoB;AACrD,QAAO,KAAK;;;;;;;;;;;;;AAgBd,SAAgB,UACd,MACA,gBACgF;CAChF,MAAM,aAAa,aAAqC;EACtD,IAAI,OAAO,UAAU,IAAI,KAAK;AAC9B,MAAI,CAAC,MAAM;AACT,0BAAO,IAAI,KAAK;AAChB,aAAU,IAAI,MAAM,KAAK;;AAE3B,OAAK,IAAI,SAAS;AAClB,eAAa;AACX,QAAM,OAAO,SAAS;AACtB,OAAI,KAAM,SAAS,EAAG,WAAU,OAAO,KAAK;;;CAIhD,MAAM,oBAAwC,eAAe,KAAK;CAClE,MAAM,0BAA8C,YAAY,EAAE,QAAQ,IAAI,KAAK;CAEnF,MAAM,QAAQ,qBAAqB,WAAW,aAAa,kBAAkB;AAM7E,uBAAsB,KAAK;CAE3B,MAAM,aAA2B,UAAkB,YAAkC;AACnF,MAAI,OAAO,aAAa,SACtB,OAAM,IAAI,MACR,sBAAsB,KAAK,UAAU,KAAK,CAAC,iCAAiC,OAAO,SAAS,qJAG7F;EAEH,MAAM,SAAS;GAAE,GAAG;GAAgB,GAAG;GAAS;AAKhD,WAAS,SAAS,GAAG,KAAK,GAAG,mBAAmB,SAAS,GAAG,iBAAiB,OAAO;AACpF,SAAO,KAAK;;CAGd,MAAM,qBAA2B;EAC/B,MAAM,OAAO,gBAAgB,QAAQ;EACrC,MAAM,SAAS,gBAAgB;EAC/B,IAAI,YAAY,GAAG,KAAK,4DAA4D;AACpF,MAAI,OAAQ,cAAa,YAAY;AACrC,WAAS,SAAS;AAClB,SAAO,KAAK;;AAGd,QAAO;EAAC;EAAO;EAAW;EAAa;;;;;;;;;;;;AC3CzC,SAAS,wBAAgE;AACvE,KAAI;AACF,SAAO,cAAc;UACd,GAAG;AAEV,MAAI,aAAa,SAAS,EAAE,QAAQ,SAAS,+BAA+B,CAC1E,OAAM;AAGR,SAAO;;;;AAOX,SAAS,gBAAgB,MAAc,OAAe,SAAqC;CACzF,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,mBAAmB,MAAM,GAAG;CAChE,MAAM,OAAO,SAAS,QAAQ;AAC9B,OAAM,KAAK,QAAQ,OAAO;AAC1B,KAAI,SAAS,OAAQ,OAAM,KAAK,UAAU,QAAQ,SAAS;AAC3D,KAAI,SAAS,WAAW,KAAA,EAAW,OAAM,KAAK,WAAW,QAAQ,SAAS;AAC1E,KAAI,SAAS,QAAS,OAAM,KAAK,WAAW,QAAQ,QAAQ,aAAa,GAAG;CAC5E,MAAM,WAAW,SAAS,YAAY;AACtC,OAAM,KAAK,YAAY,SAAS,OAAO,EAAE,CAAC,aAAa,GAAG,SAAS,MAAM,EAAE,GAAG;AAC9E,KAAI,SAAS,OAAQ,OAAM,KAAK,SAAS;AACzC,UAAS,SAAS,MAAM,KAAK,KAAK;AAClC,oBAAmB,KAAK;;;AAI1B,SAAS,mBAAmB,MAAc,SAAqC;CAC7E,MAAM,OAAO,SAAS,QAAQ;CAC9B,MAAM,SAAS,SAAS;CACxB,IAAI,YAAY,GAAG,KAAK,4DAA4D;AACpF,KAAI,OAAQ,cAAa,YAAY;AACrC,UAAS,SAAS;AAClB,oBAAmB,KAAK;;AAK1B,SAAS,aAAgB,eAAqE;AAE5F,KACE,OAAQ,cAA2B,UAAU,cAC7C,OAAQ,cAA2B,cAAc,WAEjD,QAAO;AAIT,KAAI,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,cAChF,QAAO,WAAW,cAA2C;AAG/D,OAAM,IAAI,MACR,sIAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCH,SAAgB,aACd,MACA,SAC8E;CAC9E,MAAM,EAAE,OAAO,eAAe,GAAG,eAAe;CAChD,MAAM,QAAQ,aAAa,cAAc;CACzC,MAAM,kBAAiC,EAAE,GAAG,YAAY;CACxD,MAAM,aAAa,QAAQ,aAAa;CAExC,SAAS,gBAAqC;AAC5C,SAAO;GACL,MAAM,gBAAgB;GACtB,QAAQ,gBAAgB;GACxB,QAAQ,gBAAgB;GACxB,SAAS,gBAAgB;GACzB,UAAU,gBAAgB;GAC1B,QAAQ,gBAAgB;GACzB;;CAGH,MAAM,OAAsC;EAC1C;EACA,SAAS;EACT;EAEA,MAAS;GACP,MAAM,YAAY,uBAAuB;AACzC,OAAI,UACF,QAAO,MAAM,MAAM,UAAU,IAAI,KAAK,CAAC;AAGzC,OAAI,WACF,OAAM,IAAI,MACR,0BAA0B,KAAK,8HAEhC;GAEH,MAAM,MAAM,eAAe,KAAK;AAChC,UAAO,MAAM,MAAM,IAAI;;EAGzB,IAAI,OAAgB;GAClB,MAAM,YAAY,uBAAuB;AACzC,OAAI,WAAW;IACb,MAAM,aAAa,MAAM,UAAU,MAAM;AACzC,QAAI,eAAe,KACjB,WAAU,OAAO,MAAM;KACrB,MAAM,gBAAgB;KACtB,QAAQ,gBAAgB;KACzB,CAAC;QAEF,WAAU,IAAI,MAAM,YAAY,gBAAgB;AAElD;;AAGF,OAAI,WACF,OAAM,IAAI,MACR,0BAA0B,KAAK,8HAEhC;GAEH,MAAM,aAAa,MAAM,UAAU,MAAM;AACzC,OAAI,eAAe,KACjB,oBAAmB,MAAM,eAAe,CAAC;OAEzC,iBAAgB,MAAM,YAAY,eAAe,CAAC;;EAItD,SAAe;GACb,MAAM,YAAY,uBAAuB;AACzC,OAAI,WAAW;AACb,cAAU,OAAO,MAAM;KACrB,MAAM,gBAAgB;KACtB,QAAQ,gBAAgB;KACzB,CAAC;AACF;;AAGF,OAAI,WACF,OAAM,IAAI,MACR,0BAA0B,KAAK,iIAEhC;AAEH,sBAAmB,MAAM,eAAe,CAAC;;EAE5C;AAED,KAAI,WACF,QAAO;AAyBT,QArBkC;EAChC,GAAG;EAEH,YAAiD;GAE/C,MAAM,CAAC,KAAK,QAAQ,aAAa,UAAa,MAD3B,eAAe,CAC6B;GAC/D,MAAM,SAAS,MAAM,MAAM,IAAI;GAE/B,MAAM,YAAY,UAAmB;IACnC,MAAM,aAAa,MAAM,UAAU,MAAM;AACzC,QAAI,eAAe,KACjB,YAAW;QAEX,QAAO,WAAW;;AAItB,UAAO;IAAC;IAAQ;IAAU;IAAU;;EAEvC;;;;;;;;;;;;;;;;;;;;;;;;ACzPH,SAAgB,gBAAmB,cAA4B;CAM7D,MAAM,qBAAwB;AAC5B,MAAI,iBAAiB,KAAA,KAAa,iBAAiB,KACjD,QAAO;AAIT,SAAO,gBAAgB,aAAa;;AAGtC,QAAO;EACL,MAAM,OAAyC;AAC7C,OAAI,UAAU,KAAA,KAAa,UAAU,GACnC,QAAO,cAAc;GAIvB,MAAM,MAAM,MAAM,QAAQ,MAAM,GAAG,MAAM,MAAM,SAAS,KAAK;AAC7D,OAAI,QAAQ,KAAA,KAAa,QAAQ,GAC/B,QAAO,cAAc;AAEvB,OAAI;AACF,WAAO,KAAK,MAAM,IAAI;WAChB;AACN,WAAO,cAAc;;;EAIzB,UAAU,OAAyB;AACjC,OAAI,UAAU,QAAQ,UAAU,KAAA,EAC9B,QAAO;AAET,UAAO,KAAK,UAAU,MAAM;;EAE/B"}