@timber-js/app 0.2.0-alpha.129 → 0.2.0-alpha.131

package/dist/server/ssr-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-entry.d.ts","sourceRoot":"","sources":["../../src/server/ssr-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,uCAAuC,CAAC;AA4B/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAsDxD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAmMnB;AAED,eAAe,SAAS,CAAC"}
+{"version":3,"file":"ssr-entry.d.ts","sourceRoot":"","sources":["../../src/server/ssr-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,uCAAuC,CAAC;AA4B/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAsDxD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAuMnB;AAED,eAAe,SAAS,CAAC"}

package/dist/server/ssr-render.d.ts

@@ -39,6 +39,11 @@ export declare function renderSsrStream(element: ReactNode, options?: {
     deferSuspenseFor?: number;
     signal?: AbortSignal;
     renderTimeoutMs?: number;
+    /** Request info threaded into render-error logs (method/path). */
+    requestInfo?: {
+        method: string;
+        path: string;
+    };
     /**
      * Fired synchronously when the render function is about to resolve
      * (i.e. at hold-end / shell-ready). `resolved` reports whether Fizz's
@@ -62,6 +67,11 @@ export declare function renderSsrNodeStream(element: ReactNode, options?: {
     deferSuspenseFor?: number;
     signal?: AbortSignal;
     renderTimeoutMs?: number;
+    /** Request info threaded into render-error logs (method/path). */
+    requestInfo?: {
+        method: string;
+        path: string;
+    };
     /**
      * Fired synchronously at the moment `renderSsrNodeStream`'s returned
      * Promise is about to resolve. `resolved` reports whether Fizz's

package/dist/server/ssr-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-render.d.ts","sourceRoot":"","sources":["../../src/server/ssr-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAuFvC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;IACR,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD,GACA,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAErC;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,SAAkB,CAAC;AAU9C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;IACR,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD,GACA,OAAO,CAAC,OAAO,aAAa,EAAE,QAAQ,CAAC,CAgGzC;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,aAAa,EAAE,QAAQ,GACvC,cAAc,CAAC,UAAU,CAAC,CAE5B;AAqGD;;;;;;;;;;;;GAYG;AACH,2CAA2C;AAC3C,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,UAAU,CAAC,CA2B5B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,GACvB,QAAQ,CASV"}
+{"version":3,"file":"ssr-render.d.ts","sourceRoot":"","sources":["../../src/server/ssr-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAuFvC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;IACR,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD,GACA,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAErC;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,SAAkB,CAAC;AAU9C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;IACR,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD,GACA,OAAO,CAAC,OAAO,aAAa,EAAE,QAAQ,CAAC,CAqGzC;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,aAAa,EAAE,QAAQ,GACvC,cAAc,CAAC,UAAU,CAAC,CAE5B;AA2GD;;;;;;;;;;;;GAYG;AACH,2CAA2C;AAC3C,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,UAAU,CAAC,CA2B5B;AAWD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,GACvB,QAAQ,CASV"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.129",
+  "version": "0.2.0-alpha.131",
   "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/plugins/server-bundle.ts

@@ -13,6 +13,31 @@
 
 import type { Plugin } from 'vite';
 
+// Build-time-only packages that must never be bundled into the runtime
+// server environments. With `noExternal: true` rolldown otherwise follows
+// the transitive graph through the user's `timber.config.ts` (loaded by the
+// `virtual:timber-cache-handler` dynamic import) into adapter code, dragging
+// build tooling into the prod server bundle. The most visible symptom is
+// rolldown trying to parse `fsevents.node` as JS and failing with
+// `[UNLOADABLE_DEPENDENCY] … stream did not contain valid UTF-8`.
+//
+//   - `nitro`, `@mdx-js/rollup`              — build-time tooling reachable
+//     transitively through adapter modules and timber's own MDX activation.
+//   - `rollup`                                — pulled in by nitro and
+//     @mdx-js/rollup; declares `fsevents` as an optional native dep.
+//   - `fsevents`, `chokidar`                  — native/optional deps of
+//     rollup/vite. They are macOS-only file watchers with no runtime use
+//     in a server bundle.
+//
+// Mirrored on both rsc and ssr environments. See TIM-988.
+const BUILD_ONLY_EXTERNALS: string[] = [
+  'nitro',
+  'rollup',
+  '@mdx-js/rollup',
+  'fsevents',
+  'chokidar',
+];
+
 export function timberServerBundle(): Plugin[] {
   const bundlePlugin: Plugin = {
     name: 'timber-server-bundle',
@@ -80,11 +105,11 @@ export function timberServerBundle(): Plugin[] {
         ssr: { target: 'webworker' },
         environments: {
           rsc: {
-            resolve: { noExternal: true },
+            resolve: { noExternal: true, external: BUILD_ONLY_EXTERNALS },
             define: serverDefine,
           },
           ssr: {
-            resolve: { noExternal: true },
+            resolve: { noExternal: true, external: BUILD_ONLY_EXTERNALS },
             define: serverDefine,
           },
         },

package/src/server/form-data.ts

@@ -29,6 +29,12 @@ export function parseFormData(formData: FormData): Record<string, unknown> {
     // Skip React internal fields
     if (key.startsWith('$ACTION_')) continue;
 
+    // Skip prototype-pollution keys at the top level — assigning to
+    // `flat['__proto__']` invokes the prototype setter and can splice
+    // attacker-controlled data into `flat`'s prototype chain.
+    // The dot-path case is filtered separately in `expandDotPaths`.
+    if (DANGEROUS_KEYS.has(key)) continue;
+
     const values = formData.getAll(key);
     const processed = values.map(normalizeValue);
 
@@ -82,18 +88,23 @@ function expandDotPaths(flat: Record<string, unknown>): Record<string, unknown>
     }
   }
 
-  // Fast path: no dot-notation keys, return as-is
+  // Fast path: no dot-notation keys, return as-is.
+  // Top-level dangerous keys are already filtered in `parseFormData` above.
   if (!hasDotPaths) return flat;
 
   for (const [key, value] of Object.entries(flat)) {
-    if (!key.includes('.')) {
-      result[key] = value;
+    // Reject any path that contains __proto__ / constructor / prototype.
+    // Without this, `__proto__.x=1` writes to Object.prototype because
+    // `result['__proto__']` resolves to the prototype object itself.
+    const parts = key.split('.');
+    if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
+
+    if (parts.length === 1) {
+      result[parts[0]] = value;
       continue;
     }
 
-    const parts = key.split('.');
     let current: Record<string, unknown> = result;
-
     for (let i = 0; i < parts.length - 1; i++) {
       const part = parts[i];
       if (current[part] === undefined || current[part] === null) {
@@ -113,6 +124,15 @@ function expandDotPaths(flat: Record<string, unknown>): Record<string, unknown>
   return result;
 }
 
+// `__proto__` is the only key in this parser that escapes the dot-path
+// walk's `typeof !== 'object'` reset: accessing `obj['__proto__']` returns
+// `Object.prototype` (itself an object), so the walk steps into the global
+// prototype and the leaf write mutates it. `constructor` resolves to a
+// function (reset fires) and `prototype` is undefined on fresh objects
+// (reset fires), so neither escapes the walk — they parse as legit nested
+// keys and do not mutate anything global.
+const DANGEROUS_KEYS = new Set(['__proto__']);
+
 // ─── Coercion Helpers ────────────────────────────────────────────────────
 
 /**

package/src/server/render-timeout.ts

@@ -55,24 +55,20 @@ export function createRenderTimeout(timeoutMs: number, parentSignal?: AbortSigna
   const controller = new AbortController();
   const reason = new RenderTimeoutError(timeoutMs, 'RSC stream read timed out');
 
-  const timer = setTimeout(() => {
-    controller.abort(reason);
-  }, timeoutMs);
+  const timer = setTimeout(() => controller.abort(reason), timeoutMs);
+
+  let onParentAbort: (() => void) | null = null;
 
-  // If there's a parent signal (e.g. request abort), chain it
   if (parentSignal) {
     if (parentSignal.aborted) {
       clearTimeout(timer);
       controller.abort(parentSignal.reason);
     } else {
-      parentSignal.addEventListener(
-        'abort',
-        () => {
-          clearTimeout(timer);
-          controller.abort(parentSignal.reason);
-        },
-        { once: true }
-      );
+      onParentAbort = () => {
+        clearTimeout(timer);
+        controller.abort(parentSignal.reason);
+      };
+      parentSignal.addEventListener('abort', onParentAbort, { once: true });
     }
   }
 
@@ -80,6 +76,10 @@ export function createRenderTimeout(timeoutMs: number, parentSignal?: AbortSigna
     signal: controller.signal,
     cancel: () => {
       clearTimeout(timer);
+      if (onParentAbort && parentSignal) {
+        parentSignal.removeEventListener('abort', onParentAbort);
+        onParentAbort = null;
+      }
     },
   };
 }

package/src/server/ssr-entry.ts

@@ -198,6 +198,7 @@ export async function handleSsr(
         } = _nodeStreamImports;
 
         const renderTimeoutMs = _runtimeConfig.renderTimeoutMs ?? undefined;
+        const requestInfo = { method: 'GET', path: navContext.pathname };
 
         let nodeHtmlStream: import('node:stream').Readable;
         try {
@@ -206,12 +207,13 @@ export async function handleSsr(
             deferSuspenseFor: navContext.deferSuspenseFor,
             signal: navContext.signal,
             renderTimeoutMs,
+            requestInfo,
             onFizzAllReadyResolved: (resolved) => {
               navContext._fizzAllReadyResolved = resolved;
             },
           });
         } catch (renderError) {
-          logRenderError({ method: '', path: '', error: renderError });
+          logRenderError({ ...requestInfo, error: renderError });
           throw new SsrStreamError(
             'SSR renderToReadableStream failed due to RSC stream error',
             renderError
@@ -268,6 +270,7 @@ export async function handleSsr(
 
       // Web Streams path (CF Workers / fallback)
       const renderTimeoutMs = _runtimeConfig.renderTimeoutMs ?? undefined;
+      const requestInfo = { method: 'GET', path: navContext.pathname };
       let htmlStream: ReadableStream<Uint8Array>;
       try {
         htmlStream = await renderSsrStream(wrappedElement, {
@@ -275,12 +278,13 @@ export async function handleSsr(
           deferSuspenseFor: navContext.deferSuspenseFor,
           signal: navContext.signal,
           renderTimeoutMs,
+          requestInfo,
           onFizzAllReadyResolved: (resolved) => {
             navContext._fizzAllReadyResolved = resolved;
           },
         });
       } catch (renderError) {
-        logRenderError({ method: '', path: '', error: renderError });
+        logRenderError({ ...requestInfo, error: renderError });
         throw new SsrStreamError(
           'SSR renderToReadableStream failed due to RSC stream error',
           renderError

package/src/server/ssr-render.ts

@@ -128,6 +128,8 @@ export async function renderSsrStream(
     deferSuspenseFor?: number;
     signal?: AbortSignal;
     renderTimeoutMs?: number;
+    /** Request info threaded into render-error logs (method/path). */
+    requestInfo?: { method: string; path: string };
     /**
      * Fired synchronously when the render function is about to resolve
      * (i.e. at hold-end / shell-ready). `resolved` reports whether Fizz's
@@ -166,6 +168,8 @@ export async function renderSsrNodeStream(
     deferSuspenseFor?: number;
     signal?: AbortSignal;
     renderTimeoutMs?: number;
+    /** Request info threaded into render-error logs (method/path). */
+    requestInfo?: { method: string; path: string };
     /**
      * Fired synchronously at the moment `renderSsrNodeStream`'s returned
      * Promise is about to resolve. `resolved` reports whether Fizz's
@@ -178,6 +182,7 @@ export async function renderSsrNodeStream(
   const signal = options?.signal;
   const deferMs = options?.deferSuspenseFor;
   const timeoutMs = options?.renderTimeoutMs;
+  const requestInfo = options?.requestInfo;
   const onFizzAllReadyResolved = options?.onFizzAllReadyResolved;
 
   return new Promise<import('node:stream').Readable>((resolve, reject) => {
@@ -229,7 +234,11 @@ export async function renderSsrNodeStream(
         // Skip React's sanitized production errors — the original was
         // already logged by the RSC onError with full details.
         if (isReactSanitizedError(error)) return;
-        logRenderError({ method: '', path: '', error });
+        logRenderError({
+          method: requestInfo?.method ?? '',
+          path: requestInfo?.path ?? '',
+          error,
+        });
       },
     });
 
@@ -250,8 +259,8 @@ export async function renderSsrNodeStream(
         'abort',
         () => {
           logRenderError({
-            method: '',
-            path: '',
+            method: requestInfo?.method ?? '',
+            path: requestInfo?.path ?? '',
             error: new Error(
               `SSR render timed out after ${timeoutMs}ms — aborting. ` +
                 'A Suspense component or downstream fetch may be hanging.'
@@ -293,11 +302,13 @@ async function renderViaReadableStream(
     deferSuspenseFor?: number;
     signal?: AbortSignal;
     renderTimeoutMs?: number;
+    requestInfo?: { method: string; path: string };
     onFizzAllReadyResolved?: (resolved: boolean) => void;
   }
 ): Promise<ReadableStream<Uint8Array>> {
   const signal = options?.signal;
   const timeoutMs = options?.renderTimeoutMs;
+  const requestInfo = options?.requestInfo;
   const onFizzAllReadyResolved = options?.onFizzAllReadyResolved;
 
   // If a render timeout is configured, create a combined signal that
@@ -318,8 +329,8 @@ async function renderViaReadableStream(
         if (isAbortError(error) || effectiveSignal?.aborted) return;
         if (error instanceof RenderTimeoutError) {
           logRenderError({
-            method: '',
-            path: '',
+            method: requestInfo?.method ?? '',
+            path: requestInfo?.path ?? '',
             error: new Error(
               `SSR render timed out after ${timeoutMs}ms — aborting. ` +
                 'A Suspense component or downstream fetch may be hanging.'
@@ -330,7 +341,11 @@ async function renderViaReadableStream(
         // Skip React's sanitized production errors — the original was
         // already logged by the RSC onError with full details.
         if (isReactSanitizedError(error)) return;
-        logRenderError({ method: '', path: '', error });
+        logRenderError({
+          method: requestInfo?.method ?? '',
+          path: requestInfo?.path ?? '',
+          error,
+        });
       },
     });
   } catch (error) {