@timber-js/app 0.2.0-alpha.14 → 0.2.0-alpha.141

package/dist/server/version-skew.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-skew.d.ts","sourceRoot":"","sources":["../../src/server/version-skew.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,wEAAwE;AACxE,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAU/C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAID,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,EAAE,EAAE,OAAO,CAAC;IACZ,sFAAsF;IACtF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAmB9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEzD"}

package/dist/shared/href-validation.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared href/URL validation for all navigation sinks.
+ *
+ * Used by <Link>, useRouter().push/replace, and redirectExternal().
+ * Single source of truth for dangerous-scheme detection — prevents
+ * control-character smuggling that bypasses naive regex checks.
+ *
+ * See design/13-security.md §"Link scheme injection" (test #9)
+ * and design/07-routing.md §"<Link> Scheme Validation".
+ */
+/**
+ * Validate an href for navigation sinks (<Link>, useRouter, etc.).
+ *
+ * Rejects dangerous schemes (javascript:, data:, vbscript:) even when
+ * control characters are embedded to bypass naive regex checks.
+ * Also rejects protocol-relative URLs (//evil.com).
+ *
+ * Throws on rejection. Safe hrefs pass through silently.
+ */
+export declare function validateNavigationHref(href: string): void;
+/**
+ * Check if an href is internal (same-origin navigation) or external.
+ *
+ * Strips control characters before checking so that "java\tscript:" is
+ * correctly identified as having a scheme (and thus not internal).
+ */
+export declare function isInternalHref(href: string): boolean;
+/**
+ * Validate and canonicalize an external redirect URL.
+ *
+ * Requires http: or https: scheme and checks origin against an allow-list.
+ * Returns the parsed canonical URL string (from URL.href) to prevent
+ * raw user input from reaching the Location header.
+ *
+ * @throws On invalid URL, dangerous scheme, or origin not in allow-list.
+ */
+export declare function validateExternalRedirectUrl(url: string, allowList: string[]): string;
+//# sourceMappingURL=href-validation.d.ts.map

package/dist/shared/href-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"href-validation.d.ts","sourceRoot":"","sources":["../../src/shared/href-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuBH;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAqBzD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUpD;AAID;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAiCpF"}

package/dist/shared/merge-search-params.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared utility for merging preserved search params into a target URL.
+ *
+ * Used by both <Link> (client) and redirect() (server). Extracted to a shared
+ * module to avoid importing client code ('use client') from server modules.
+ */
+/**
+ * Merge preserved search params from the current URL into a target href.
+ *
+ * When `preserve` is `true`, all current search params are merged.
+ * When `preserve` is a `string[]`, only the named params are merged.
+ *
+ * The target href's own search params take precedence — preserved params
+ * are only added if the target doesn't already define them.
+ *
+ * @param targetHref - The resolved target href (may already contain query string)
+ * @param currentSearch - The current URL's search string (e.g. "?private=access&page=2")
+ * @param preserve - `true` to preserve all, or `string[]` to preserve specific params
+ * @returns The target href with preserved search params merged in
+ */
+export declare function mergePreservedSearchParams(targetHref: string, currentSearch: string, preserve: true | string[]): string;
+//# sourceMappingURL=merge-search-params.d.ts.map

package/dist/shared/merge-search-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-search-params.d.ts","sourceRoot":"","sources":["../../src/shared/merge-search-params.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,GACxB,MAAM,CA6BR"}

package/dist/shims/font-google.d.ts

@@ -16,7 +16,7 @@
  *
  * Design doc: 24-fonts.md, "Next.js Font Compatibility"
  */
-import type { GoogleFontConfig, FontResult } from '#/fonts/types.js';
+import type { GoogleFontConfig, FontResult } from '../fonts/types.js';
 export type { GoogleFontConfig, FontResult };
 /**
  * Generic font loader — accepts any font name, returns a stub FontResult.

package/dist/shims/font-google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"font-google.d.ts","sourceRoot":"","sources":["../../src/shims/font-google.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;AAkB7C;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAEjF;AAID,eAAO,MAAM,KAAK,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC7F,eAAO,MAAM,MAAM,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC9F,eAAO,MAAM,SAAS,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AACjG,eAAO,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC5F,eAAO,MAAM,UAAU,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAClG,eAAO,MAAM,OAAO,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC/F,eAAO,MAAM,KAAK,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC7F,eAAO,MAAM,UAAU,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAClG,eAAO,MAAM,cAAc,GAAI,SAAS,gBAAgB,KAAG,UAC7B,CAAC;AAC/B,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,KAAG,UAC9B,CAAC;AAC/B,eAAO,MAAM,gBAAgB,GAAI,SAAS,gBAAgB,KAAG,UAC/B,CAAC;AAC/B,eAAO,MAAM,YAAY,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC"}
+{"version":3,"file":"font-google.d.ts","sourceRoot":"","sources":["../../src/shims/font-google.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;AAkB7C;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAEjF;AAID,eAAO,MAAM,KAAK,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC7F,eAAO,MAAM,MAAM,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC9F,eAAO,MAAM,SAAS,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AACjG,eAAO,MAAM,IAAI,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC5F,eAAO,MAAM,UAAU,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAClG,eAAO,MAAM,OAAO,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC/F,eAAO,MAAM,KAAK,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAC7F,eAAO,MAAM,UAAU,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC;AAClG,eAAO,MAAM,cAAc,GAAI,SAAS,gBAAgB,KAAG,UAC7B,CAAC;AAC/B,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,KAAG,UAC9B,CAAC;AAC/B,eAAO,MAAM,gBAAgB,GAAI,SAAS,gBAAgB,KAAG,UAC/B,CAAC;AAC/B,eAAO,MAAM,YAAY,GAAI,SAAS,gBAAgB,KAAG,UAA0C,CAAC"}

package/dist/shims/font-google.js

@@ -0,0 +1,42 @@
+//#region src/shims/font-google.ts
+/**
+* Create a stub FontResult with empty values.
+*
+* The timber-fonts plugin replaces these calls at build time with real
+* class names and font stacks. This stub ensures code that imports
+* font functions outside of the build pipeline (tests, type-checking)
+* gets a valid FontResult shape without runtime errors.
+*/
+function createStubFontResult(config) {
+	return {
+		className: "",
+		style: { fontFamily: "" },
+		variable: config?.variable
+	};
+}
+/**
+* Generic font loader — accepts any font name, returns a stub FontResult.
+*
+* Named exports like `Inter`, `Roboto`, etc. are generated dynamically
+* by the virtual module at build time. This function provides a catch-all
+* for non-Vite contexts.
+*/
+function createFont(_family, config) {
+	return createStubFontResult(config);
+}
+var Inter = (config) => createStubFontResult(config);
+var Roboto = (config) => createStubFontResult(config);
+var Open_Sans = (config) => createStubFontResult(config);
+var Lato = (config) => createStubFontResult(config);
+var Montserrat = (config) => createStubFontResult(config);
+var Poppins = (config) => createStubFontResult(config);
+var Geist = (config) => createStubFontResult(config);
+var Geist_Mono = (config) => createStubFontResult(config);
+var JetBrains_Mono = (config) => createStubFontResult(config);
+var Source_Code_Pro = (config) => createStubFontResult(config);
+var Playfair_Display = (config) => createStubFontResult(config);
+var Merriweather = (config) => createStubFontResult(config);
+//#endregion
+export { Geist, Geist_Mono, Inter, JetBrains_Mono, Lato, Merriweather, Montserrat, Open_Sans, Playfair_Display, Poppins, Roboto, Source_Code_Pro, createFont };
+
+//# sourceMappingURL=font-google.js.map

package/dist/shims/font-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"font-google.js","names":[],"sources":["../../src/shims/font-google.ts"],"sourcesContent":["/**\n * Fallback shim for `next/font/google` → `@timber/fonts/google`.\n *\n * At build time, the timber-fonts plugin's transform hook replaces font\n * function calls with static FontResult objects containing real class names\n * and font stacks. This file serves two purposes:\n *\n * 1. **TypeScript resolution** — provides types for IDEs and `tsc` outside\n *    of Vite's module graph (where the virtual module handles it).\n * 2. **Runtime fallback** — returns empty className/fontFamily values when\n *    the plugin hasn't processed a call (e.g. in tests or non-Vite environments).\n *\n * The shim resolution path (`next/font/google` → `\\0@timber/fonts/google`)\n * is unchanged — this file is NOT on that resolution path. It exists as a\n * physical module for direct imports and type re-exports.\n *\n * Design doc: 24-fonts.md, \"Next.js Font Compatibility\"\n */\n\nimport type { GoogleFontConfig, FontResult } from '../fonts/types.js';\n\nexport type { GoogleFontConfig, FontResult };\n\n/**\n * Create a stub FontResult with empty values.\n *\n * The timber-fonts plugin replaces these calls at build time with real\n * class names and font stacks. This stub ensures code that imports\n * font functions outside of the build pipeline (tests, type-checking)\n * gets a valid FontResult shape without runtime errors.\n */\nfunction createStubFontResult(config?: GoogleFontConfig): FontResult {\n  return {\n    className: '',\n    style: { fontFamily: '' },\n    variable: config?.variable,\n  };\n}\n\n/**\n * Generic font loader — accepts any font name, returns a stub FontResult.\n *\n * Named exports like `Inter`, `Roboto`, etc. are generated dynamically\n * by the virtual module at build time. This function provides a catch-all\n * for non-Vite contexts.\n */\nexport function createFont(_family: string, config?: GoogleFontConfig): FontResult {\n  return createStubFontResult(config);\n}\n\n// Common Google Font exports for TypeScript autocomplete.\n// These are stubs — the virtual module and transform hook provide real values.\nexport const Inter = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Roboto = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Open_Sans = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Lato = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Montserrat = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Poppins = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Geist = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const Geist_Mono = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\nexport const JetBrains_Mono = (config?: GoogleFontConfig): FontResult =>\n  createStubFontResult(config);\nexport const Source_Code_Pro = (config?: GoogleFontConfig): FontResult =>\n  createStubFontResult(config);\nexport const Playfair_Display = (config?: GoogleFontConfig): FontResult =>\n  createStubFontResult(config);\nexport const Merriweather = (config?: GoogleFontConfig): FontResult => createStubFontResult(config);\n"],"mappings":";;;;;;;;;AA+BA,SAAS,qBAAqB,QAAuC;CACnE,OAAO;EACL,WAAW;EACX,OAAO,EAAE,YAAY,GAAG;EACxB,UAAU,QAAQ;CACpB;AACF;;;;;;;;AASA,SAAgB,WAAW,SAAiB,QAAuC;CACjF,OAAO,qBAAqB,MAAM;AACpC;AAIA,IAAa,SAAS,WAA0C,qBAAqB,MAAM;AAC3F,IAAa,UAAU,WAA0C,qBAAqB,MAAM;AAC5F,IAAa,aAAa,WAA0C,qBAAqB,MAAM;AAC/F,IAAa,QAAQ,WAA0C,qBAAqB,MAAM;AAC1F,IAAa,cAAc,WAA0C,qBAAqB,MAAM;AAChG,IAAa,WAAW,WAA0C,qBAAqB,MAAM;AAC7F,IAAa,SAAS,WAA0C,qBAAqB,MAAM;AAC3F,IAAa,cAAc,WAA0C,qBAAqB,MAAM;AAChG,IAAa,kBAAkB,WAC7B,qBAAqB,MAAM;AAC7B,IAAa,mBAAmB,WAC9B,qBAAqB,MAAM;AAC7B,IAAa,oBAAoB,WAC/B,qBAAqB,MAAM;AAC7B,IAAa,gBAAgB,WAA0C,qBAAqB,MAAM"}

package/dist/shims/font-local.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Fallback shim for `next/font/local` → `@timber/fonts/local`.
+ *
+ * At build time, the timber-fonts plugin's transform hook replaces
+ * `localFont()` calls with static FontResult objects containing real
+ * class names and font stacks. This file serves two purposes:
+ *
+ * 1. **TypeScript resolution** — provides types for IDEs and `tsc` outside
+ *    of Vite's module graph (where the virtual module handles it).
+ * 2. **Runtime fallback** — returns empty className/fontFamily values when
+ *    the plugin hasn't processed a call (e.g. in tests or non-Vite environments).
+ *
+ * Design doc: 24-fonts.md, "Next.js Font Compatibility"
+ */
+import type { LocalFontConfig, FontResult } from '../fonts/types.js';
+export type { LocalFontConfig, FontResult };
+/**
+ * Create a local font.
+ *
+ * The timber-fonts plugin replaces these calls at build time with real
+ * class names and font stacks. This stub ensures code that imports
+ * `localFont` outside of the build pipeline (tests, type-checking)
+ * gets a valid FontResult shape without runtime errors.
+ */
+export default function localFont(config?: LocalFontConfig): FontResult;
+//# sourceMappingURL=font-local.d.ts.map

package/dist/shims/font-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"font-local.d.ts","sourceRoot":"","sources":["../../src/shims/font-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAErE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,UAAU,CAMtE"}

package/dist/shims/font-local.js

@@ -0,0 +1,20 @@
+//#region src/shims/font-local.ts
+/**
+* Create a local font.
+*
+* The timber-fonts plugin replaces these calls at build time with real
+* class names and font stacks. This stub ensures code that imports
+* `localFont` outside of the build pipeline (tests, type-checking)
+* gets a valid FontResult shape without runtime errors.
+*/
+function localFont(config) {
+	return {
+		className: "",
+		style: { fontFamily: "" },
+		variable: config?.variable
+	};
+}
+//#endregion
+export { localFont as default };
+
+//# sourceMappingURL=font-local.js.map

package/dist/shims/font-local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"font-local.js","names":[],"sources":["../../src/shims/font-local.ts"],"sourcesContent":["/**\n * Fallback shim for `next/font/local` → `@timber/fonts/local`.\n *\n * At build time, the timber-fonts plugin's transform hook replaces\n * `localFont()` calls with static FontResult objects containing real\n * class names and font stacks. This file serves two purposes:\n *\n * 1. **TypeScript resolution** — provides types for IDEs and `tsc` outside\n *    of Vite's module graph (where the virtual module handles it).\n * 2. **Runtime fallback** — returns empty className/fontFamily values when\n *    the plugin hasn't processed a call (e.g. in tests or non-Vite environments).\n *\n * Design doc: 24-fonts.md, \"Next.js Font Compatibility\"\n */\n\nimport type { LocalFontConfig, FontResult } from '../fonts/types.js';\n\nexport type { LocalFontConfig, FontResult };\n\n/**\n * Create a local font.\n *\n * The timber-fonts plugin replaces these calls at build time with real\n * class names and font stacks. This stub ensures code that imports\n * `localFont` outside of the build pipeline (tests, type-checking)\n * gets a valid FontResult shape without runtime errors.\n */\nexport default function localFont(config?: LocalFontConfig): FontResult {\n  return {\n    className: '',\n    style: { fontFamily: '' },\n    variable: config?.variable,\n  };\n}\n"],"mappings":";;;;;;;;;AA2BA,SAAwB,UAAU,QAAsC;CACtE,OAAO;EACL,WAAW;EACX,OAAO,EAAE,YAAY,GAAG;EACxB,UAAU,QAAQ;CACpB;AACF"}

package/dist/shims/headers.d.ts

@@ -5,5 +5,6 @@
  * via native package.json exports. This ensures the same ALS singleton as the
  * pipeline (both import from the same shared request-context chunk in dist/).
  */
-export { headers, cookies } from '@timber-js/app/server';
+export { getHeaders, getCookieJar } from '@timber-js/app/server';
+export { getHeaders as headers, getCookieJar as cookies } from '@timber-js/app/server';
 //# sourceMappingURL=headers.d.ts.map

package/dist/shims/headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/shims/headers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/shims/headers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/shims/image.d.ts

@@ -34,7 +34,7 @@ export declare function Image({ priority: _priority, quality: _quality, fill: _f
     alt?: string | undefined;
     crossOrigin?: "" | "anonymous" | "use-credentials" | undefined;
     decoding?: "async" | "auto" | "sync" | undefined;
-    fetchPriority?: "high" | "low" | "auto";
+    fetchPriority?: "high" | "low" | "auto" | undefined;
     height?: number | string | undefined;
     loading?: "eager" | "lazy" | undefined;
     referrerPolicy?: import("react").HTMLAttributeReferrerPolicy | undefined;

package/dist/shims/navigation-client.d.ts

@@ -15,7 +15,9 @@
  *
  * See design/14-ecosystem.md §"next/navigation" for the full shim audit.
  */
-export { useParams, usePathname, useSearchParams, useRouter, useSelectedLayoutSegment, useSelectedLayoutSegments, } from '@timber-js/app/client';
+export { useSegmentParams } from '../client/use-segment-params.js';
+export { useSearchParams } from '../client/use-search-params.js';
+export { usePathname, useRouter, useSelectedLayoutSegment, useSelectedLayoutSegments, } from '@timber-js/app/client';
 export declare const RedirectType: {
     readonly push: "push";
     readonly replace: "replace";

package/dist/shims/navigation-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation-client.d.ts","sourceRoot":"","sources":["../../src/shims/navigation-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,SAAS,EACT,WAAW,EACX,eAAe,EACf,SAAS,EACT,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAI/B,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAKX,wBAAgB,QAAQ,IAAI,KAAK,CAKhC;AAED,wBAAgB,iBAAiB,IAAI,KAAK,CAKzC;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAIhC"}
+{"version":3,"file":"navigation-client.d.ts","sourceRoot":"","sources":["../../src/shims/navigation-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,WAAW,EACX,SAAS,EACT,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAI/B,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAKX,wBAAgB,QAAQ,IAAI,KAAK,CAKhC;AAED,wBAAgB,iBAAiB,IAAI,KAAK,CAKzC;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAIhC"}

package/dist/shims/navigation.d.ts

@@ -1,10 +1,16 @@
 /**
  * Shim: next/navigation → timber navigation primitives
  *
- * Client hooks import from @timber-js/app/client (the public barrel) so they
- * resolve to the same module instances as user code in Vite dev. Server
- * functions import from @timber-js/app/server for ALS singleton consistency.
+ * Client hooks import from their direct modules since useSegmentParams,
+ * useSearchParams, and useQueryStates are no longer part of
+ * @timber-js/app/client public exports (they live on define* factories).
+ * The shim re-exports them for next/navigation library compat (nuqs etc).
+ *
+ * Server functions import from @timber-js/app/server for ALS singleton consistency.
  */
-export { useParams, usePathname, useSearchParams, useRouter, useSelectedLayoutSegment, useSelectedLayoutSegments, } from '@timber-js/app/client';
-export { redirect, permanentRedirect, notFound, RedirectType } from '@timber-js/app/server';
+export { useSegmentParams, useSegmentParams as useParams } from '../client/use-segment-params.js';
+export { useSearchParams } from '../client/use-search-params.js';
+export { usePathname, useRouter, useSelectedLayoutSegment, useSelectedLayoutSegments, } from '@timber-js/app/client';
+export { redirect, redirectExternal, RedirectType } from '@timber-js/app/server';
+export { permanentRedirect, notFound } from '../server/primitives.js';
 //# sourceMappingURL=navigation.d.ts.map

package/dist/shims/navigation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../src/shims/navigation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,SAAS,EACT,WAAW,EACX,eAAe,EACf,SAAS,EACT,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../src/shims/navigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,WAAW,EACX,SAAS,EACT,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIjF,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/utils/state-machine.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Tiny typed state machine utility.
+ *
+ * Enforces discriminated-union states, typed transitions with runtime
+ * guards, subscribe for external store integration, and assertPhase
+ * for function entry guards.
+ *
+ * Designed for 3–5 state consumers (stream transforms, client navigation,
+ * build phase sequencing). No async, no hierarchy, no history.
+ *
+ * Performance: send() is one object lookup + one function call.
+ * Equivalent cost to a boolean check after V8 inlining.
+ */
+/** A state machine instance with typed state and events. */
+export interface Machine<TState extends {
+    phase: string;
+}, TEvent extends {
+    type: string;
+}> {
+    /** Current state (discriminated union — narrowed by phase). */
+    readonly state: TState;
+    /** Transition with runtime guard. Throws on invalid source+event pair. */
+    send(event: TEvent): void;
+    /** Subscribe to state changes. Returns unsubscribe function. */
+    subscribe(listener: (state: TState) => void): () => void;
+    /** Throw if not in the expected phase. Entry guard for functions. */
+    assertPhase<P extends TState['phase']>(phase: P): void;
+}
+/**
+ * Transition map: `transitions[phase][eventType]` returns the next state.
+ *
+ * Each handler receives the current state (narrowed by phase context)
+ * and the event, returning the new state.
+ */
+export type TransitionMap<TState extends {
+    phase: string;
+}, TEvent extends {
+    type: string;
+}> = {
+    [P in TState['phase']]?: {
+        [E in TEvent['type']]?: (state: Extract<TState, {
+            phase: P;
+        }>, event: Extract<TEvent, {
+            type: E;
+        }>) => TState;
+    };
+};
+export interface MachineConfig<TState extends {
+    phase: string;
+}, TEvent extends {
+    type: string;
+}> {
+    initial: TState;
+    transitions: TransitionMap<TState, TEvent>;
+    /** Fires after every valid transition. Use for side effects. */
+    onTransition?: (prev: TState, next: TState, event: TEvent) => void;
+}
+/**
+ * Create a state machine from a config.
+ *
+ * @example
+ * ```ts
+ * type State = { phase: 'idle' } | { phase: 'running'; pid: number };
+ * type Event = { type: 'START'; pid: number } | { type: 'STOP' };
+ *
+ * const m = createMachine<State, Event>({
+ *   initial: { phase: 'idle' },
+ *   transitions: {
+ *     idle: { START: (_s, e) => ({ phase: 'running', pid: e.pid }) },
+ *     running: { STOP: () => ({ phase: 'idle' }) },
+ *   },
+ * });
+ * ```
+ */
+export declare function createMachine<TState extends {
+    phase: string;
+}, TEvent extends {
+    type: string;
+}>(config: MachineConfig<TState, TEvent>): Machine<TState, TEvent>;
+//# sourceMappingURL=state-machine.d.ts.map

package/dist/utils/state-machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-machine.d.ts","sourceRoot":"","sources":["../../src/utils/state-machine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,OAAO,CAAC,MAAM,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IACxF,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,0EAA0E;IAC1E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,gEAAgE;IAChE,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAEzD,qEAAqE;IACrE,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,IAAI;KAC5F,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SACtB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,CAAC,CAAA;SAAE,CAAC,EACpC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,KAChC,MAAM;KACZ;CACF,CAAC;AAEF,MAAM,WAAW,aAAa,CAAC,MAAM,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,gEAAgE;IAChE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,MAAM,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAC7F,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAwCzB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.14",
-  "description": "Vite-native React framework for Cloudflare Workers — correct HTTP semantics, real status codes, pages that work without JavaScript",
+  "version": "0.2.0-alpha.141",
+  "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",
     "framework",
@@ -31,7 +31,18 @@
   ],
   "type": "module",
   "imports": {
-    "#/*": "./src/*"
+    "#server-internal": {
+      "types": "./dist/server/internal.d.ts",
+      "default": "./dist/server/internal.js"
+    },
+    "#client-internal": {
+      "types": "./dist/client/internal.d.ts",
+      "default": "./dist/client/internal.js"
+    },
+    "#routing": {
+      "types": "./dist/routing/index.d.ts",
+      "default": "./dist/routing/index.js"
+    }
   },
   "exports": {
     ".": {
@@ -46,13 +57,17 @@
       "types": "./dist/client/index.d.ts",
       "import": "./dist/client/index.js"
     },
+    "./client/internal": {
+      "types": "./dist/client/internal.d.ts",
+      "import": "./dist/client/internal.js"
+    },
     "./cache": {
       "types": "./dist/cache/index.d.ts",
       "import": "./dist/cache/index.js"
     },
-    "./content": {
-      "types": "./dist/content/index.d.ts",
-      "import": "./dist/content/index.js"
+    "./codec": {
+      "types": "./dist/codec.d.ts",
+      "import": "./dist/codec.js"
     },
     "./cookies": {
       "types": "./dist/cookies/index.d.ts",
@@ -62,28 +77,54 @@
       "types": "./dist/search-params/index.d.ts",
       "import": "./dist/search-params/index.js"
     },
-    "./routing": {
-      "types": "./dist/routing/index.d.ts",
-      "import": "./dist/routing/index.js"
+    "./segment-params": {
+      "types": "./dist/segment-params/index.d.ts",
+      "import": "./dist/segment-params/index.js"
+    },
+    "./params": {
+      "types": "./dist/params/index.d.ts",
+      "import": "./dist/params/index.js"
     },
     "./adapters/cloudflare": {
       "types": "./dist/adapters/cloudflare.d.ts",
       "import": "./dist/adapters/cloudflare.js"
     },
+    "./adapters/cloudflare/cache": {
+      "types": "./dist/adapters/cloudflare-kv-cache.d.ts",
+      "import": "./dist/adapters/cloudflare-kv-cache.js"
+    },
+    "./adapters/cloudflare/dev": {
+      "types": "./dist/adapters/cloudflare-dev.d.ts",
+      "import": "./dist/adapters/cloudflare-dev.js"
+    },
     "./adapters/nitro": {
       "types": "./dist/adapters/nitro.d.ts",
       "import": "./dist/adapters/nitro.js"
     },
+    "./fonts/google": {
+      "types": "./dist/shims/font-google.d.ts",
+      "import": "./dist/shims/font-google.js"
+    },
+    "./fonts/local": {
+      "types": "./dist/shims/font-local.d.ts",
+      "import": "./dist/shims/font-local.js"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "vite build --config vite.lib.config.ts && tsc --emitDeclarationOnly --project tsconfig.json --outDir dist",
+    "typecheck": "tsgo --noEmit",
+    "prepublishOnly": "pnpm run build"
+  },
   "dependencies": {
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/context-async-hooks": "^2.6.0",
-    "@opentelemetry/sdk-trace-base": "^2.6.0",
-    "nitro": "3.0.260311-beta"
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/context-async-hooks": "^2.7.1",
+    "@opentelemetry/sdk-trace-base": "^2.7.1",
+    "magic-string": "^0.30.21",
+    "nitro": "3.0.260522-beta"
   },
   "peerDependencies": {
     "@content-collections/core": "^0.14.0",
@@ -93,9 +134,10 @@
     "@vitejs/plugin-react": "^6.0.0",
     "@vitejs/plugin-rsc": ">=0.5.21",
     "nuqs": "^2.0.0",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
-    "vite": "^8.0.1",
+    "react": "19.3.0-canary-d5736f09-20260507",
+    "react-dom": "19.3.0-canary-d5736f09-20260507",
+    "vite": "^8.0.13",
+    "wrangler": "^4.0.0",
     "zod": "^3.22.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {
@@ -111,15 +153,14 @@
     "@mdx-js/rollup": {
       "optional": true
     },
+    "wrangler": {
+      "optional": true
+    },
     "zod": {
       "optional": true
     }
   },
   "engines": {
-    "node": ">=20.0.0"
-  },
-  "scripts": {
-    "build": "vite build --config vite.lib.config.ts && tsc --emitDeclarationOnly --project tsconfig.json --outDir dist",
-    "typecheck": "tsgo --noEmit"
+    "node": ">=22.12.0"
   }
-}
+}

package/src/adapters/build-output-helper.ts

@@ -0,0 +1,139 @@
+// Shared build-output helper for adapter buildOutput() methods.
+//
+// Steps 1–5 of every adapter's buildOutput are platform-agnostic:
+//   1. Copy client assets to the public/static directory
+//   2. Write _headers file for static asset cache control
+//   3. Copy RSC + SSR server bundles
+//   4. Write manifest-init module (if present)
+//
+// Only the final steps (entry codegen, platform config) vary per adapter.
+//
+// IMPORTANT: This module must remain a leaf — no imports from ../server/,
+// ../client/, or Vite-dependent code. See adapters/shared.ts header.
+
+import { writeFile, mkdir, cp, readdir, readFile } from 'node:fs/promises';
+import { join, basename } from 'node:path';
+import { generateHeadersFile } from './shared.js';
+import type { TimberConfig } from './types';
+
+/** Options for the shared build output steps. */
+export interface BuildOutputBaseOptions {
+  /** Resolved timber config. */
+  config: TimberConfig;
+  /** Root build directory (e.g. `.timber/build`). */
+  buildDir: string;
+  /** Adapter-specific output directory (e.g. `.timber/build/nitro`). */
+  outDir: string;
+  /**
+   * Name of the public/static directory within outDir.
+   * Nitro uses 'public', Cloudflare uses 'static'.
+   */
+  publicDirName: string;
+}
+
+/**
+ * Run the platform-agnostic build output steps shared by all adapters:
+ *
+ * 1. Create the output directory
+ * 2. Copy client assets to the public/static directory
+ * 3. Write the `_headers` file for static asset cache control
+ * 4. Copy RSC and SSR server bundles into the output directory
+ * 5. Write the manifest-init module if present
+ *
+ * Returns the resolved public directory path for further adapter-specific use.
+ */
+export async function runSharedBuildSteps(opts: BuildOutputBaseOptions): Promise<string> {
+  const { config, buildDir, outDir, publicDirName } = opts;
+
+  // 1. Create the output directory.
+  await mkdir(outDir, { recursive: true });
+
+  // 2. Copy client assets to public/static directory.
+  // When client JavaScript is disabled, skip .js files — only CSS,
+  // fonts, images, and other static assets are needed.
+  const clientDir = join(buildDir, 'client');
+  const publicDir = join(outDir, publicDirName);
+  await mkdir(publicDir, { recursive: true });
+  // Find WASM files that are referenced by client JS (legitimate client WASM)
+  // vs orphaned server-only WASM (e.g. @takumi-rs for OG image generation).
+  // Only strip orphaned WASM to avoid breaking client-side WASM usage.
+  const referencedWasm = await findReferencedWasm(clientDir);
+
+  await cp(clientDir, publicDir, {
+    recursive: true,
+    filter: (src: string) => {
+      if (src.endsWith('.wasm') && !referencedWasm.has(basename(src))) {
+        return false;
+      }
+      if (config.clientJavascriptDisabled && src.endsWith('.js')) return false;
+      return true;
+    },
+  }).catch((e: NodeJS.ErrnoException) => {
+    // Client dir may not exist when client JavaScript is disabled
+    if (e.code !== 'ENOENT') throw e;
+  });
+
+  // 3. Write _headers file for static asset cache control.
+  await writeFile(join(publicDir, '_headers'), generateHeadersFile());
+
+  // 4. Copy RSC + SSR server bundles into the output directory.
+  await cp(join(buildDir, 'rsc'), join(outDir, 'rsc'), { recursive: true });
+  await cp(join(buildDir, 'ssr'), join(outDir, 'ssr'), { recursive: true }).catch(
+    (e: NodeJS.ErrnoException) => {
+      // SSR dir may not exist for static-only builds
+      if (e.code !== 'ENOENT') throw e;
+    }
+  );
+
+  // 5. Write manifest-init module if present.
+  if (config.manifestInit) {
+    await writeFile(join(outDir, '_timber-manifest-init.js'), config.manifestInit);
+  }
+
+  return publicDir;
+}
+
+/**
+ * Scan client JS files for references to .wasm filenames.
+ * Returns the set of WASM basenames that are actually imported/referenced
+ * by client code and must be preserved in the static output.
+ */
+async function findReferencedWasm(clientDir: string): Promise<Set<string>> {
+  const referenced = new Set<string>();
+
+  let files: string[];
+  try {
+    files = await collectFiles(clientDir);
+  } catch {
+    return referenced;
+  }
+
+  const jsFiles = files.filter((f) => f.endsWith('.js'));
+  const wasmFiles = files.filter((f) => f.endsWith('.wasm')).map((f) => basename(f));
+  if (wasmFiles.length === 0) return referenced;
+
+  for (const jsFile of jsFiles) {
+    const content = await readFile(jsFile, 'utf-8');
+    for (const wasmName of wasmFiles) {
+      if (content.includes(wasmName)) {
+        referenced.add(wasmName);
+      }
+    }
+  }
+
+  return referenced;
+}
+
+async function collectFiles(dir: string): Promise<string[]> {
+  const result: string[] = [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      result.push(...(await collectFiles(fullPath)));
+    } else {
+      result.push(fullPath);
+    }
+  }
+  return result;
+}