@timber-js/app 0.2.0-alpha.12 → 0.2.0-alpha.121

package/src/server/middleware-runner.ts

@@ -1,9 +1,9 @@
 /**
- * Middleware runner — executes a route's middleware.ts before rendering.
+ * Middleware runner — executes a route's middleware.ts chain before rendering.
  *
- * Only the leaf route's middleware runs. There is no middleware chain.
- * Middleware does NOT have next() — it either short-circuits with a Response
- * or returns void to continue to access checks + render.
+ * All middleware.ts files in the segment chain run, root to leaf (top-down).
+ * The first middleware that returns a Response short-circuits the chain.
+ * There is no next() — each middleware is independent.
  *
  * See design/07-routing.md §"middleware.ts"
  */
@@ -30,3 +30,74 @@ export async function runMiddleware(
   }
   return undefined;
 }
+
+/**
+ * Run all middleware functions in the segment chain, root to leaf.
+ *
+ * Execution is top-down: root middleware runs first, leaf middleware runs last.
+ * All middleware share the same MiddlewareContext — a parent that sets
+ * ctx.requestHeaders makes it visible to child middleware and downstream components.
+ *
+ * Short-circuits on the first middleware that returns a Response.
+ * Remaining middleware in the chain do not execute.
+ *
+ * @param chain - Middleware functions ordered root-to-leaf
+ * @param ctx - Shared middleware context
+ * @returns A Response if any middleware short-circuited, or undefined to continue
+ */
+export async function runMiddlewareChain(
+  chain: MiddlewareFn[],
+  ctx: MiddlewareContext
+): Promise<Response | undefined> {
+  for (const fn of chain) {
+    const result = await fn(ctx);
+    if (result instanceof Response) {
+      return result;
+    }
+  }
+  return undefined;
+}
+
+// ─── Per-Request Middleware Bypass ─────────────────────────────────────────
+
+/**
+ * Per-request marker for synthetic re-render requests that should NOT
+ * re-execute `middleware.ts`. The action-dispatch wrapper runs middleware
+ * once on the inbound action POST; when validation fails on the no-JS
+ * path, it builds a synthetic GET that flows through the normal pipeline
+ * to render the page with `getFormFlash()` data. Without this marker, the
+ * pipeline would run middleware a second time on that synthetic GET.
+ *
+ * The set is keyed by the synthetic Request object itself, so the entry
+ * lives exactly as long as the request and is garbage-collected with it.
+ * Cannot be set or detected by user code — there is no header, no URL
+ * parameter, nothing on the wire that an attacker could spoof.
+ *
+ * See TIM-871.
+ *
+ * @internal — framework use only.
+ */
+const middlewareBypassRequests = new WeakSet<Request>();
+
+/**
+ * Mark a request so the pipeline skips its middleware phase.
+ *
+ * Used by `wrap-action-dispatch.ts` for the no-JS form-rerender path.
+ *
+ * @internal
+ */
+export function markRequestBypassMiddleware(req: Request): void {
+  middlewareBypassRequests.add(req);
+}
+
+/**
+ * Check whether a request was marked to bypass middleware.
+ *
+ * Called by `handleRequest` in pipeline-phases.ts before invoking the
+ * middleware phase. Returns false for any request not explicitly marked.
+ *
+ * @internal
+ */
+export function shouldBypassMiddleware(req: Request): boolean {
+  return middlewareBypassRequests.has(req);
+}

package/src/server/node-stream-transforms.ts

@@ -0,0 +1,361 @@
+/**
+ * Node.js native stream transforms for SSR HTML post-processing.
+ *
+ * Node.js `Transform` wrappers around the pure helpers in
+ * `html-injector-core.ts`. Used on Node.js / Bun where C++-backed
+ * native streams are significantly faster than the JS-implemented
+ * Web Streams. The Web `TransformStream` equivalents live in
+ * `html-injectors.ts` and wrap the same core — keep the two files
+ * byte-for-byte equivalent in behavior. If you fix a streaming bug
+ * here, it almost certainly belongs in the core (`html-injector-core.ts`),
+ * not in this wrapper.
+ *
+ * Architecture:
+ *   renderToPipeableStream → pipe(errorHandler) → pipe(headInjector)
+ *     → pipe(flightInjector) → Readable.toWeb() → Response
+ *
+ * All chunks stay in C++ Node.js stream buffers until the final
+ * Readable.toWeb() conversion for the Response body.
+ */
+
+import { Transform } from 'node:stream';
+import { createGzip, constants } from 'node:zlib';
+
+import {
+  BufferAggregator,
+  FlightInjectorCore,
+  SUFFIX_BYTES,
+  createInjectorState,
+  createSuffixState,
+  injectorFlush,
+  processInjectorChunk,
+  processSuffixChunk,
+  suffixFlush,
+} from './html-injector-core.js';
+import { logStreamingError } from './logger.js';
+import { createTickCoalescer } from './coalesce-tick.js';
+
+// ─── Buffered Transform ──────────────────────────────────────────────────────
+
+export interface NodeBufferedTransformOptions {
+  /**
+   * Flush synchronously once the buffer reaches this many bytes.
+   * Prevents unbounded memory growth for very large Fizz flushes.
+   * Default: Infinity (no byte limit — flush only on tick boundary).
+   */
+  readonly maxBufferByteLength?: number;
+}
+
+/**
+ * Node.js `Transform` that buffers incoming chunks and coalesces them
+ * within a single event loop tick.
+ *
+ * Equivalent to `createBufferedTransformStream` in `html-injectors.ts` —
+ * the actual buffer math lives in `BufferAggregator`. This wrapper only
+ * owns the `setImmediate` scheduling and the push to the Node `Transform`.
+ *
+ * **Not a polling loop.** Single-shot `setImmediate` per flush cycle —
+ * no recursive scheduling. See design/02 §"No Polling".
+ */
+export function createNodeBufferedTransform(options: NodeBufferedTransformOptions = {}): Transform {
+  const buffer = new BufferAggregator(options.maxBufferByteLength ?? Infinity);
+
+  const flushBuffer = () => {
+    const merged = buffer.drain();
+    if (merged) transform.push(merged);
+  };
+
+  const coalescer = createTickCoalescer(flushBuffer);
+
+  const transform = new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const overCap = buffer.append(chunk);
+      if (overCap) {
+        flushBuffer();
+      } else {
+        coalescer.schedule();
+      }
+      callback();
+    },
+    flush(callback) {
+      coalescer.flushSync();
+      callback();
+    },
+  });
+
+  return transform;
+}
+
+// ─── Move Suffix Transform ───────────────────────────────────────────────────
+
+/**
+ * Node.js `Transform` that moves `</body></html>` to the end of the stream.
+ *
+ * Equivalent to `createMoveSuffixStream` in `html-injectors.ts`. Strips
+ * the suffix on first sight and re-emits it from `flush()`. If the
+ * suffix never appeared in the input, it is appended anyway so output
+ * is well-formed.
+ */
+export function createNodeMoveSuffixTransform(): Transform {
+  const state = createSuffixState();
+
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const result = processSuffixChunk(state, chunk);
+      if (result.kind === 'passthrough' || result.kind === 'noSuffix') {
+        this.push(chunk);
+        callback();
+        return;
+      }
+      if (result.before) this.push(Buffer.from(result.before));
+      if (result.after) this.push(Buffer.from(result.after));
+      callback();
+    },
+    flush(callback) {
+      this.push(Buffer.from(suffixFlush(state)));
+      callback();
+    },
+  });
+}
+
+// Re-export for tests / consumers that need the suffix bytes constant.
+export { SUFFIX_BYTES };
+
+// ─── Head Injection ──────────────────────────────────────────────────────────
+
+/**
+ * Node.js `Transform` that injects HTML content before `</head>`.
+ *
+ * Equivalent to `injectHead` in `html-injectors.ts`. Streams chunks
+ * through immediately, keeping only a small trailing buffer to handle
+ * `</head>` split across chunk boundaries.
+ */
+export function createNodeHeadInjector(headHtml: string): Transform {
+  if (!headHtml) {
+    return new Transform({
+      transform(chunk, _enc, cb) {
+        cb(null, chunk);
+      },
+    });
+  }
+
+  const state = createInjectorState({ content: headHtml, targetTag: '</head>' });
+
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const result = processInjectorChunk(state, chunk);
+      if (result.kind === 'passthrough') {
+        callback(null, chunk);
+        return;
+      }
+      if (result.bytes) this.push(Buffer.from(result.bytes));
+      callback();
+    },
+    flush(callback) {
+      const leftover = injectorFlush(state);
+      if (leftover) this.push(Buffer.from(leftover));
+      callback();
+    },
+  });
+}
+
+// ─── RSC Flight Injection ────────────────────────────────────────────────────
+
+/**
+ * Options for the Node.js flight injector.
+ */
+export interface NodeFlightInjectorOptions {
+  /**
+   * Timeout in milliseconds for individual RSC stream reads. If a single
+   * `rscReader.read()` call does not resolve within this duration, the
+   * read is aborted and the stream errors with a `RenderTimeoutError`.
+   * Default: 30000 (30s).
+   */
+  renderTimeoutMs?: number;
+  /** Signal that fires when an unhandled RSC error is detected. */
+  errorSignal?: AbortSignal;
+}
+
+/**
+ * Node.js `Transform` that merges RSC script tags into the HTML stream.
+ *
+ * Equivalent to `createFlightInjectionTransform` in `html-injectors.ts`.
+ * The state machine, pending queue, and pull loop all live in
+ * `FlightInjectorCore` — this wrapper only shuffles bytes between the
+ * core and the Node `Transform.push()` API.
+ *
+ * Suffix stripping (`</body></html>`) is handled upstream by
+ * `createNodeMoveSuffixTransform`. RSC scripts are buffered in
+ * `core.pending[]` and only drained from `transform()` (after a complete
+ * HTML chunk) or `flush()` — never mid-tag. See design/02
+ * §"Scripts at Chunk Boundaries Only".
+ *
+ * The RSC stream is a Web `ReadableStream` (from the tee'd RSC Flight
+ * stream). The core reads from it using the Web API — this is the one
+ * bridge point between Web Streams and Node.js streams in the pipeline.
+ */
+export function createNodeFlightInjector(
+  rscStream: ReadableStream<Uint8Array> | undefined,
+  options?: NodeFlightInjectorOptions
+): Transform {
+  if (!rscStream) {
+    return new Transform({
+      transform(chunk, _enc, cb) {
+        cb(null, chunk);
+      },
+    });
+  }
+
+  const core = new FlightInjectorCore(rscStream, options?.renderTimeoutMs, options?.errorSignal);
+
+  const drain = (): void => {
+    while (core.pending.length > 0) transform.push(Buffer.from(core.pending.shift()!));
+  };
+
+  const transform = new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const wasInit = core.isInit;
+      if (wasInit) core.notifyFirstChunk();
+
+      // Emit the HTML chunk, then drain any buffered RSC scripts.
+      // Scripts always come AFTER a complete HTML chunk — never mid-tag.
+      // The buffered transform upstream (TIM-528) ensures coherent chunks.
+      // Suffix stripping is upstream via createNodeMoveSuffixTransform (TIM-530).
+      transform.push(chunk);
+      drain();
+
+      // Start the pull loop on the first HTML chunk.
+      if (wasInit) core.ensurePullLoop(drain);
+      callback();
+    },
+    flush(callback) {
+      // All HTML chunks have been emitted. Pull loop stops yielding.
+      core.notifyHtmlDone();
+
+      const finish = () => {
+        drain();
+        const err = core.terminalError;
+        if (err !== null) {
+          transform.destroy(err instanceof Error ? err : new Error(String(err)));
+          return;
+        }
+        callback();
+      };
+
+      if (core.isPullDone) {
+        finish();
+        return;
+      }
+      // Wait on the pull-loop promise instead of polling. Zero CPU cost
+      // while waiting. See design/02 §"No Polling".
+      core.ensurePullLoop(drain).then(finish, (err) => {
+        // ensurePullLoop's underlying loop catches its own errors and
+        // sends PULL_ERROR — this catch is defence-in-depth for any
+        // synchronous throws inside the .then() chain itself.
+        transform.destroy(err instanceof Error ? err : new Error(String(err)));
+      });
+    },
+  });
+
+  return transform;
+}
+
+// ─── Error Handling ──────────────────────────────────────────────────────────
+
+const NOINDEX_SCRIPT =
+  '<script>document.head.appendChild(Object.assign(document.createElement("meta"),{name:"robots",content:"noindex"}))</script>';
+
+/**
+ * Node.js Transform that catches post-shell streaming errors.
+ *
+ * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts.
+ * Catches errors from React's streaming phase (deny/throw inside Suspense
+ * after the shell has flushed) and closes the stream cleanly.
+ */
+export function createNodeErrorHandler(signal?: AbortSignal): Transform {
+  const transform = new Transform({
+    transform(chunk, _encoding, callback) {
+      callback(null, chunk);
+    },
+  });
+
+  transform.on('error', (error) => {
+    const isAbort =
+      (error instanceof DOMException && error.name === 'AbortError') ||
+      (error instanceof Error && error.name === 'AbortError') ||
+      signal?.aborted;
+
+    if (isAbort) {
+      transform.end();
+      return;
+    }
+
+    logStreamingError({ error });
+    transform.push(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
+    transform.end();
+  });
+
+  return transform;
+}
+
+// ─── Compression ─────────────────────────────────────────────────────────────
+
+const COMPRESSIBLE_TYPES = new Set([
+  'text/html',
+  'text/css',
+  'text/plain',
+  'text/xml',
+  'text/javascript',
+  'text/x-component',
+  'application/json',
+  'application/javascript',
+  'application/xml',
+  'application/xhtml+xml',
+  'application/rss+xml',
+  'image/svg+xml',
+]);
+
+/**
+ * Create a Node.js gzip Transform using native node:zlib.
+ *
+ * Uses `createGzip()` which is backed by C++ zlib — significantly faster
+ * than the Web Streams `CompressionStream` API (which is a JS wrapper
+ * around the same zlib but with per-chunk Promise overhead).
+ *
+ * Returns null if the response shouldn't be compressed (wrong content type,
+ * client doesn't accept gzip, already encoded, etc.).
+ */
+export function createNodeGzipCompressor(
+  requestHeaders: Headers,
+  responseHeaders: Headers
+): Transform | null {
+  // Check Accept-Encoding
+  const acceptEncoding = requestHeaders.get('accept-encoding') || '';
+  if (!acceptEncoding.includes('gzip')) return null;
+
+  // Check content type is compressible
+  const contentType = responseHeaders.get('content-type') || '';
+  const mimeType = contentType.split(';')[0].trim().toLowerCase();
+  if (!COMPRESSIBLE_TYPES.has(mimeType)) return null;
+
+  // Don't double-compress
+  if (responseHeaders.has('content-encoding')) return null;
+
+  // Set response headers for gzip
+  responseHeaders.set('content-encoding', 'gzip');
+  responseHeaders.delete('content-length');
+  const existingVary = responseHeaders.get('vary');
+  if (existingVary) {
+    if (!existingVary.toLowerCase().includes('accept-encoding')) {
+      responseHeaders.set('vary', existingVary + ', Accept-Encoding');
+    }
+  } else {
+    responseHeaders.set('vary', 'Accept-Encoding');
+  }
+
+  // Z_SYNC_FLUSH ensures each chunk is flushed to the output immediately.
+  // Without it, gzip buffers internally and the browser doesn't receive
+  // the HTML shell until the gzip stream closes — breaking streaming.
+  // ~2–5% size overhead vs Z_NO_FLUSH but preserves correct streaming.
+  return createGzip({ flush: constants.Z_SYNC_FLUSH });
+}

package/src/server/param-coercion.ts

@@ -0,0 +1,206 @@
+/**
+ * Segment param coercion — runs the matched route's `params.ts` codecs
+ * over the raw matcher output before middleware and rendering.
+ *
+ * Lifted out of `pipeline-phases.ts` (TIM-853) so the coercer can be
+ * imported directly by other entry points (the action-dispatch wrapper,
+ * the revalidation renderer in `rsc-entry/index.ts`) without pulling
+ * the entire pipeline phase module along with it.
+ *
+ * The function throws `ParamCoercionError` from `route-element-builder.ts`
+ * on any codec failure; the pipeline catches that and dispatches to the
+ * 404 page. See design/07-routing.md §"Where Coercion Runs".
+ */
+
+import type { Codec } from '../codec.js';
+import { toBracketKey } from '../params/resolve-schema.js';
+import type { RouteMatch } from './pipeline.js';
+import { sanitizeParamValue } from './pipeline-helpers.js';
+import { loadModule } from './safe-load.js';
+import { ParamCoercionError } from './route-element-builder.js';
+import { isDebug } from './debug.js';
+
+// ---------------------------------------------------------------------------
+// Module-level global codec store (TIM-931)
+// ---------------------------------------------------------------------------
+
+/** Global schema codecs, set once at startup from virtual:timber-schema. */
+let _globalCodecs: Record<string, Codec<unknown>> | null = null;
+
+/**
+ * Register the global schema codecs. Called once from the RSC entry
+ * at server startup when app/schema.ts provides segment param codecs.
+ * @internal
+ */
+export function setGlobalSchemaCodecs(codecs: Record<string, Codec<unknown>> | null): void {
+  _globalCodecs = codecs;
+}
+
+/**
+ * Coerce raw slot params through global schema codecs.
+ *
+ * Each slot segment that has a paramName is looked up in the global codec
+ * map by its bracket key (e.g. '[...year]' for catch-all). If a codec
+ * exists, the raw value is parsed through it. If no codec exists or no
+ * global codecs are registered, the raw value passes through unchanged.
+ *
+ * Unlike main route coercion, this does NOT throw ParamCoercionError on
+ * failure — slots degrade gracefully. A failed coercion logs a warning
+ * in dev mode and keeps the raw value.
+ *
+ * @internal — framework use only
+ */
+export function coerceSlotParams(
+  slotChain: Array<{ segmentType: string; paramName?: string }>,
+  rawParams: Record<string, string | string[]>
+): Record<string, string | string[]> {
+  const globalCodecs = _globalCodecs;
+  if (!globalCodecs) return rawParams;
+
+  const result: Record<string, string | string[]> = Object.create(null);
+  for (const key of Object.keys(rawParams)) {
+    result[key] = rawParams[key];
+  }
+
+  for (const segment of slotChain) {
+    if (!segment.paramName) continue;
+    const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+    const codec = globalCodecs[bracketKey];
+    if (!codec) continue;
+
+    const key = segment.paramName;
+    if (!(key in result)) continue;
+
+    try {
+      result[key] = sanitizeParamValue(codec.parse(result[key] as string | string[])) as
+        | string
+        | string[];
+    } catch (err) {
+      // Slot param coercion failures are non-fatal — keep the raw value.
+      // The main route already validated the URL; the slot just interprets
+      // the same parts differently.
+      if (isDebug()) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(
+          `[timber] Slot param coercion failed for "${key}" (codec: ${bracketKey})\n` +
+            `  Error: ${message}\n` +
+            `  Raw value: ${JSON.stringify(result[key])}\n` +
+            `  Keeping raw value.`
+        );
+      }
+    }
+  }
+
+  return result as Record<string, string | string[]>;
+}
+
+/**
+ * Run segment param coercion on the matched route's segments.
+ *
+ * When `globalCodecs` is provided (from app/schema.ts), uses the global
+ * codec map keyed by bare param name. Otherwise falls back to loading
+ * per-segment params.ts modules.
+ *
+ * Throws ParamCoercionError if any codec fails (→ 404).
+ *
+ * This runs BEFORE middleware, so ctx.segmentParams is already typed.
+ * See design/07-routing.md §"Where Coercion Runs"
+ * See design/41-global-params.md §"Pipeline Integration"
+ */
+export async function coerceSegmentParams(match: RouteMatch): Promise<void> {
+  const globalCodecs = _globalCodecs;
+  // Unconditionally install a null-prototype target so the invariant
+  // "match.segmentParams is null-prototype" holds from the first line,
+  // regardless of whether any segment has a codec.
+  const mergeTarget: Record<string, unknown> = Object.create(null);
+  for (const key of Object.keys(match.segmentParams)) {
+    if (key !== '__proto__') {
+      mergeTarget[key] = match.segmentParams[key as keyof typeof match.segmentParams];
+    }
+  }
+  match.segmentParams = mergeTarget as RouteMatch['segmentParams'];
+
+  // TIM-931/TIM-936: When a global schema is available, use it for coercion
+  // instead of per-segment params.ts files. The global codec map is keyed
+  // by bracket name (e.g. '[id]', '[...slug]') to avoid collisions between
+  // distinct segment types that share a param name.
+  if (globalCodecs) {
+    for (const segment of match.segments) {
+      if (!segment.paramName) continue;
+      const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+      const codec = globalCodecs[bracketKey];
+      if (!codec) continue; // no codec in schema → keep raw string
+
+      const key = segment.paramName;
+      try {
+        mergeTarget[key] = sanitizeParamValue(codec.parse(mergeTarget[key] as string | string[]));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (isDebug()) {
+          console.warn(
+            `[timber] Global schema codec rejected value for param "${key}"\n` +
+              `  Error: ${message}\n` +
+              `  Raw value: ${JSON.stringify(mergeTarget[key])}\n` +
+              `  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`
+          );
+        }
+        throw new ParamCoercionError(message);
+      }
+    }
+    return;
+  }
+
+  // Legacy path: per-segment params.ts coercion
+  for (const segment of match.segments) {
+    // Only process segments that have a params.ts convention file
+    if (!segment.params) continue;
+
+    let mod: Record<string, unknown>;
+    try {
+      mod = await loadModule(segment.params);
+    } catch (err) {
+      const message = `Failed to load params module for segment "${segment.segmentName}": ${err instanceof Error ? err.message : String(err)}`;
+      if (isDebug()) {
+        console.warn(
+          `[timber] Param coercion error: ${message}\n` +
+            `  Segment: ${segment.segmentName}\n` +
+            `  Params file: ${segment.params}`
+        );
+      }
+      throw new ParamCoercionError(message);
+    }
+
+    const segmentParamsDef = mod.segmentParams as
+      | { parse(raw: Record<string, string | string[]>): Record<string, unknown> }
+      | undefined;
+
+    if (!segmentParamsDef || typeof segmentParamsDef.parse !== 'function') continue;
+
+    try {
+      const coerced = segmentParamsDef.parse(match.segmentParams);
+
+      // Deep-sanitize codec output: every nested plain object becomes
+      // null-prototype with dangerous keys stripped at every depth.
+      // See TIM-873, design/13-security.md
+      for (const key of Object.keys(coerced as Record<string, unknown>)) {
+        if (key !== '__proto__') {
+          mergeTarget[key] = sanitizeParamValue((coerced as Record<string, unknown>)[key]);
+        }
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (isDebug()) {
+        const rawKeys = Object.keys(match.segmentParams).join(', ');
+        console.warn(
+          `[timber] Param codec rejected values for segment "${segment.segmentName}"\n` +
+            `  Error: ${message}\n` +
+            `  Available raw params: { ${rawKeys} }\n` +
+            `  Params file: ${segment.params}\n` +
+            `  Hint: this usually means a codec threw for the raw URL value.\n` +
+            `  Check that the regex/schema accepts the actual path segment string.`
+        );
+      }
+      throw new ParamCoercionError(message);
+    }
+  }
+}