@timber-js/app 0.2.0-alpha.144 → 0.2.0-alpha.146

package/dist/_chunks/{actions-DzFMnUAR.js → actions-OIZ8siQu.js}

@@ -1,9 +1,9 @@
-import { _ as waitUntilAls, d as withSpan, h as revalidationAls, m as requestContextAls, v as isDebug } from "./tracing-M_zKubhk.js";
+import { d as withSpan, h as revalidationAls, m as requestContextAls, v as isDebug } from "./tracing-M_zKubhk.js";
 import { t as _setGetSearchParamsFn } from "./define-C3RvHQPK.js";
 import { t as _setGetSegmentParamsFn } from "./define-DMVhsipD.js";
 import { n as assertValidCookieOptions, r as assertValidCookieValue, t as assertValidCookieName } from "./validation-taUkvA4Q.js";
-import { i as mergePreservedSearchParams, n as validateExternalRedirectUrl } from "./href-validation-EZktELp8.js";
-import { t as getCacheHandler } from "./handler-store-DjISKYEB.js";
+import { r as getWaitUntil, t as getCacheHandler } from "./handler-store-BVDgyTh7.js";
+import { a as mergePreservedSearchParams, r as validateExternalRedirectUrl, t as assertRelativeRedirectPath } from "./href-validation-DyZIzfMJ.js";
 //#region src/server/cookie-parsing.ts
 /**
 * Parse a Cookie header string into a Map of name → value pairs.
@@ -86,15 +86,19 @@ function parseSetCookie(header) {
 			case "domain":
 				options.domain = val;
 				break;
-			case "max-age":
-				options.maxAge = Number(val);
+			case "max-age": {
+				const maxAge = Number(val);
+				if (Number.isFinite(maxAge)) options.maxAge = maxAge;
 				break;
+			}
 			case "expires":
 				options.expires = new Date(val);
 				break;
-			case "samesite":
-				options.sameSite = val.toLowerCase();
+			case "samesite": {
+				const sameSite = val.toLowerCase();
+				if (sameSite === "strict" || sameSite === "lax" || sameSite === "none") options.sameSite = sameSite;
 				break;
+			}
 			case "secure":
 				options.secure = true;
 				break;
@@ -214,6 +218,7 @@ function getCookieJar() {
 				maxAge: 0,
 				expires: /* @__PURE__ */ new Date(0)
 			};
+			assertValidCookieOptions(opts);
 			store.cookieJar.set(name, {
 				name,
 				value: "",
@@ -306,6 +311,7 @@ function assertMutable(store, method) {
 function setRaw(store, readMap, name, value, options) {
 	assertValidCookieName(name);
 	assertValidCookieValue(name, value);
+	assertValidCookieOptions(options);
 	store.cookieJar.set(name, {
 		name,
 		value,
@@ -542,28 +548,22 @@ function freezeHeaders(source) {
 	} });
 }
 //#endregion
-//#region src/server/waituntil-bridge.ts
+//#region src/shared/redirect-type.ts
 /**
-* Per-request waitUntil bridge — ALS bridge for platform adapters.
-*
-* The generated entry point (Nitro, Cloudflare) wraps the handler with
-* `runWithWaitUntil`, binding the platform's lifecycle extension function
-* (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the
-* request duration. The `waitUntil()` primitive reads from this ALS to
-* dispatch background work to the correct platform API.
+* Next.js redirect type discriminator.
 *
-* Design doc: design/11-platform.md §"waitUntil()"
-*/
-/**
-* Get the current request's waitUntil function, if available.
+* Provided for API compatibility with libraries that import `RedirectType`
+* from `next/navigation`. In timber, `redirect()` always uses `replace`
+* semantics (no history entry for the redirect itself).
 *
-* Returns undefined when no platform adapter has installed a waitUntil
-* handler for the current request (e.g., on platforms that don't support
-* lifecycle extension, or outside a request context).
+* Lives in shared/ (isomorphic) so both the server primitives and the
+* client-only next/navigation shim export the same definition without the
+* client shim pulling in server code.
 */
-function getWaitUntil() {
-	return waitUntilAls.getStore();
-}
+var RedirectType = {
+	push: "push",
+	replace: "replace"
+};
 //#endregion
 //#region src/server/primitives.ts
 /**
@@ -687,17 +687,6 @@ function deny(statusOrOptions, data) {
 	throw new DenySignal(status, resolvedData);
 }
 /**
-* Next.js redirect type discriminator.
-*
-* Provided for API compatibility with libraries that import `RedirectType`
-* from `next/navigation`. In timber, `redirect()` always uses `replace`
-* semantics (no history entry for the redirect itself).
-*/
-var RedirectType = {
-	push: "push",
-	replace: "replace"
-};
-/**
 * Render-phase signal thrown by `redirect()` and `redirectExternal()`.
 * Caught by the framework to produce a 3xx response or client-side navigation.
 */
@@ -711,9 +700,6 @@ var RedirectSignal = class extends Error {
 		this.status = status;
 	}
 };
-/** Pattern matching absolute URLs: http(s):// or protocol-relative // */
-var ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
-var REDIRECT_CONTROL_CHARS_RE = /[\x00-\x1f]/g;
 /**
 * Redirect to a relative path. Rejects absolute and protocol-relative URLs.
 * Use `redirectExternal()` for external redirects with an allow-list.
@@ -740,8 +726,7 @@ function redirect(path, statusOrOptions) {
 		preserveSearchParams = statusOrOptions.preserveSearchParams;
 	} else status = 302;
 	if (status < 300 || status > 399) throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
-	const cleaned = path.replace(REDIRECT_CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
-	if (ABSOLUTE_URL_RE.test(cleaned)) throw new Error(`redirect() only accepts relative URLs. Got absolute URL: "${path}". Use redirectExternal(url, allowList) for external redirects.`);
+	assertRelativeRedirectPath(path);
 	let resolvedPath = path;
 	if (preserveSearchParams) resolvedPath = mergePreservedSearchParams(path, getRequestSearchString(), preserveSearchParams);
 	throw new RedirectSignal(resolvedPath, status);
@@ -1142,6 +1127,6 @@ function isRscActionRequest(req) {
 	return accept.includes("text/x-component") || contentType.includes("text/x-component");
 }
 //#endregion
-export { setMatchedSegmentPath as C, getCookieJar as D, getCookie as E, getSetCookieHeaders as O, runWithRequestContext as S, setSegmentParams as T, getHeader as _, revalidateTag as a, getSegmentParams as b, DenySignal as c, RenderError as d, deny as f, applyRequestHeaderOverlay as g, waitUntil as h, revalidatePath as i, RedirectSignal as l, redirectExternal as m, executeAction as n, coerce as o, redirect as p, isRscActionRequest as r, parseFormData as s, buildNoJsResponse as t, RedirectType as u, getHeaders as v, setMutableCookieContext as w, markResponseFlushed as x, getSearchParams as y };
+export { setMatchedSegmentPath as C, getCookieJar as D, getCookie as E, getSetCookieHeaders as O, runWithRequestContext as S, setSegmentParams as T, getHeader as _, revalidateTag as a, getSegmentParams as b, DenySignal as c, deny as d, redirect as f, applyRequestHeaderOverlay as g, RedirectType as h, revalidatePath as i, RedirectSignal as l, waitUntil as m, executeAction as n, coerce as o, redirectExternal as p, isRscActionRequest as r, parseFormData as s, buildNoJsResponse as t, RenderError as u, getHeaders as v, setMutableCookieContext as w, markResponseFlushed as x, getSearchParams as y };
 
-//# sourceMappingURL=actions-DzFMnUAR.js.map
+//# sourceMappingURL=actions-OIZ8siQu.js.map

package/dist/_chunks/actions-OIZ8siQu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-OIZ8siQu.js","names":[],"sources":["../../src/server/cookie-parsing.ts","../../src/server/cookie-context.ts","../../src/server/request-context.ts","../../src/shared/redirect-type.ts","../../src/server/primitives.ts","../../src/server/form-data.ts","../../src/server/actions.ts"],"sourcesContent":["/**\n * Cookie parsing and serialization helpers — pure string ↔ structure\n * functions with no ALS dependency. Split out of `cookie-context.ts`\n * (TIM-853) so the API surface and the wire-format codecs can each be\n * read on their own.\n *\n * The functions in this module are total over arbitrary input. They\n * never throw and never call `assertValid*` (the security validators\n * live in the API surface — `cookie-context.ts` invokes them at every\n * jar entry point so the smuggling-primitive invariant from TIM-868\n * is enforced regardless of which path produced the bytes).\n */\n\nimport type { CookieEntry } from './als-registry.js';\nimport type { CookieOptions } from './cookie-context.js';\n\n/**\n * Parse a Cookie header string into a Map of name → value pairs.\n * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.\n *\n * Values are auto-decoded with `decodeURIComponent` so they round-trip\n * losslessly with `getCookies().set()` (which auto-encodes). Malformed\n * `%`-escapes from third-party cookies fall back to the raw byte sequence\n * — the parser must be total over arbitrary inbound headers, including\n * non-conforming values from other servers, browser extensions, etc.\n */\nexport function parseCookieHeader(header: string): Map<string, string> {\n  const map = new Map<string, string>();\n  if (!header) return map;\n\n  for (const pair of header.split(';')) {\n    const eqIndex = pair.indexOf('=');\n    if (eqIndex === -1) continue;\n    const name = pair.slice(0, eqIndex).trim();\n    const value = pair.slice(eqIndex + 1).trim();\n    if (name && !map.has(name)) {\n      map.set(name, safeDecodeCookieValue(value));\n    }\n  }\n\n  return map;\n}\n\n/**\n * Decode a single cookie value with `decodeURIComponent`, falling back to\n * the raw byte sequence if the input contains a malformed `%`-escape.\n *\n * Used by both `parseCookieHeader` (incoming Cookie: header) and the\n * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).\n * Total — never throws.\n */\nexport function safeDecodeCookieValue(raw: string): string {\n  try {\n    return decodeURIComponent(raw);\n  } catch {\n    return raw;\n  }\n}\n\n/** Serialize a CookieEntry into a Set-Cookie header value. */\nexport function serializeCookieEntry(entry: CookieEntry): string {\n  const parts = [`${entry.name}=${entry.value}`];\n  const opts = entry.options;\n\n  if (opts.domain) parts.push(`Domain=${opts.domain}`);\n  if (opts.path) parts.push(`Path=${opts.path}`);\n  if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);\n  if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`);\n  if (opts.httpOnly) parts.push('HttpOnly');\n  if (opts.secure) parts.push('Secure');\n  if (opts.sameSite) {\n    parts.push(`SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`);\n  }\n  if (opts.partitioned) parts.push('Partitioned');\n\n  return parts.join('; ');\n}\n\n/**\n * Parse a raw `Set-Cookie` header string into name, value, and options.\n * Handles all standard attributes: Path, Domain, Max-Age, Expires,\n * SameSite, Secure, HttpOnly, Partitioned.\n *\n * Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether\n * to merge defaults (e.g. `set()` does, but `setRaw()` should preserve\n * the original header's intent).\n */\nexport function parseSetCookie(\n  header: string\n): { name: string; value: string; options: CookieOptions } | null {\n  const segments = header.split(';');\n  const nameValue = segments[0];\n  const eqIdx = nameValue.indexOf('=');\n  if (eqIdx <= 0) return null;\n\n  const name = nameValue.slice(0, eqIdx).trim();\n  const value = nameValue.slice(eqIdx + 1).trim();\n  const options: CookieOptions = {};\n\n  for (let i = 1; i < segments.length; i++) {\n    const seg = segments[i].trim();\n    if (!seg) continue;\n    const [attrName, ...rest] = seg.split('=');\n    const key = attrName.trim().toLowerCase();\n    const val = rest.join('=').trim();\n    switch (key) {\n      case 'path':\n        options.path = val || '/';\n        break;\n      case 'domain':\n        options.domain = val;\n        break;\n      case 'max-age': {\n        // RFC 6265 §5.2.2: a non-numeric Max-Age is ignored, not fatal.\n        // Dropping NaN/Infinity here keeps this parser total and keeps\n        // `Max-Age=NaN` out of the serialized Set-Cookie header.\n        const maxAge = Number(val);\n        if (Number.isFinite(maxAge)) options.maxAge = maxAge;\n        break;\n      }\n      case 'expires':\n        options.expires = new Date(val);\n        break;\n      case 'samesite': {\n        // Unknown SameSite values are ignored (browsers treat them as\n        // unspecified) so forwarding a quirky upstream header via\n        // setFromHeaders never trips the entry-point validator.\n        const sameSite = val.toLowerCase();\n        if (sameSite === 'strict' || sameSite === 'lax' || sameSite === 'none') {\n          options.sameSite = sameSite;\n        }\n        break;\n      }\n      case 'secure':\n        options.secure = true;\n        break;\n      case 'httponly':\n        options.httpOnly = true;\n        break;\n      case 'partitioned':\n        options.partitioned = true;\n        break;\n    }\n  }\n\n  return { name, value, options };\n}\n","/**\n * Cookie Context — per-request cookie API and on-the-wire helpers.\n *\n * Split out of `request-context.ts` (TIM-853) so the cookie subsystem\n * — encoding contract, options grammar, parser, serializer, RYW map,\n * and rerender seed — lives in one file. The headers/scope/params APIs\n * stay in `request-context.ts` and call into this module via the\n * exported helpers.\n *\n * See design/29-cookies.md for the encoding contract and read-your-own-\n * writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the\n * smuggling primitive that the encoding contract closes.\n */\n\nimport { requestContextAls, type RequestContextStore } from './als-registry.js';\nimport { isDebug } from './debug.js';\nimport {\n  assertValidCookieName,\n  assertValidCookieValue,\n  assertValidCookieOptions,\n} from '../cookies/validation.js';\nimport {\n  parseCookieHeader,\n  parseSetCookie,\n  safeDecodeCookieValue,\n  serializeCookieEntry,\n} from './cookie-parsing.js';\n\n// Re-export the validators so framework-internal consumers and tests can\n// import the canonical implementation from the same module that hosts\n// `getCookies()`. The pure shared module lives in `cookies/validation.ts`\n// so the client `useCookie` hook can use the same checks without pulling\n// in the server ALS code.\nexport { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };\n\n// ─── Public API ───────────────────────────────────────────────────────────\n\n/**\n * Returns a cookie accessor for the current request.\n *\n * Available in middleware, access checks, server components, and server actions.\n * Throws if called outside a request context (security principle #2: no global fallback).\n *\n * Read methods (.get, .has, .getAll) are always available and reflect\n * read-your-own-writes from .set() calls in the same request.\n *\n * Mutation methods (.set, .delete, .clear) are only available in mutable\n * contexts (middleware.ts, server actions, route.ts handlers). Calling them\n * in read-only contexts (access.ts, server components) throws.\n *\n * This is the escape hatch for direct cookie jar operations. For typed\n * cookie access, use `defineCookie()` instead.\n *\n * See design/29-cookies.md\n */\nexport function getCookieJar(): RequestCookies {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error(\n      '[timber] getCookieJar() called outside of a request context. ' +\n        'It can only be used in middleware, access checks, server components, and server actions.'\n    );\n  }\n\n  // Parse cookies lazily on first access\n  if (!store.parsedCookies) {\n    store.parsedCookies = parseCookieHeader(store.cookieHeader);\n  }\n\n  const map = store.parsedCookies;\n  return {\n    get(name: string): string | undefined {\n      return map.get(name);\n    },\n    has(name: string): boolean {\n      return map.has(name);\n    },\n    getAll(): Array<{ name: string; value: string }> {\n      return Array.from(map.entries()).map(([name, value]) => ({ name, value }));\n    },\n    get size(): number {\n      return map.size;\n    },\n\n    set(name: string, value: string, options?: SetCookieOptions): void {\n      assertMutable(store, 'set');\n      // Validate the name first — names cannot be URL-encoded (RFC 7230\n      // token grammar is strict), so a bad name is always a bug.\n      assertValidCookieName(name);\n      // Type guard with a guiding error. The single most common mistake\n      // is passing a non-string (object, number, Date) and expecting the\n      // framework to JSON-encode. Point developers at jsonCookieCodec.\n      if (typeof value !== 'string') {\n        throw new Error(\n          `[timber] getCookieJar().set(${JSON.stringify(name)}, …): value must be a string, got ${typeof value}.\\n` +\n            `  To store a JSON-serializable value, use defineCookie + jsonCookieCodec:\\n` +\n            `\\n` +\n            `    import { defineCookie, jsonCookieCodec } from '@timber-js/app/cookies';\\n` +\n            `\\n` +\n            `    export const ${name}Cookie = defineCookie(${JSON.stringify(name)}, {\\n` +\n            `      codec: jsonCookieCodec(),\\n` +\n            `    });\\n` +\n            `\\n` +\n            `    ${name}Cookie.set(value);\\n` +\n            `\\n` +\n            `  See design/29-cookies.md §\"Typed Cookies with Schema Validation\".`\n        );\n      }\n      // Encode the value so the on-the-wire bytes always satisfy\n      // RFC 6265 §4.1.1 cookie-octet. encodeURIComponent's output is a\n      // strict subset of cookie-octet (only `A-Z a-z 0-9 ! ' ( ) * - . _\n      // ~ %`), so the encoded form can never carry the H-3 smuggling\n      // primitive — `;` becomes `%3B`, CR/LF become `%0D`/`%0A`, etc.\n      // The round-trip is lossless: parseCookieHeader auto-decodes on\n      // read, so `cookies().get(name)` returns exactly `value`. See\n      // ONGOING_SECURITY.md H-3 (TIM-868) and design/29-cookies.md\n      // §\"Encoding Contract\".\n      //\n      // The `{ raw: true }` opt-out skips the encoder for callers who\n      // need exact byte control (e.g. forwarding pre-encoded cookies\n      // from an upstream service). The opt-out goes through the strict\n      // cookie-octet validator instead — the smuggling primitive cannot\n      // sneak in via the escape hatch.\n      const raw = options?.raw === true;\n      const wireValue = raw ? value : encodeURIComponent(value);\n      if (raw) {\n        assertValidCookieValue(name, wireValue);\n      }\n      if (store.flushed) {\n        if (isDebug()) {\n          console.warn(\n            `[timber] warn: getCookieJar().set('${name}') called after response headers were committed.\\n` +\n              `  The cookie will NOT be sent. Move cookie mutations to middleware.ts, a server action,\\n` +\n              `  or a route.ts handler.`\n          );\n        }\n        return;\n      }\n      // Strip the framework-only `raw` flag before persisting — it is\n      // not an HTTP cookie attribute and must not leak into the jar.\n      const { raw: _raw, ...attributeOptions } = options ?? {};\n      void _raw;\n      const opts = { ...DEFAULT_COOKIE_OPTIONS, ...attributeOptions };\n      assertValidCookieOptions(opts);\n      store.cookieJar.set(name, { name, value: wireValue, options: opts });\n      // Read-your-own-writes: store the DECODED logical value so that\n      // subsequent `cookies().get(name)` in the same request returns\n      // exactly what the developer wrote — never the encoded form.\n      // For `{ raw: true }`, the wire form IS the logical form.\n      map.set(name, raw ? wireValue : value);\n    },\n\n    setFromHeaders(headers: Headers): void {\n      assertMutable(store, 'setFromHeaders');\n      if (store.flushed) {\n        console.warn(\n          `[timber] warn: getCookieJar().setFromHeaders() called after response headers were committed.\\n` +\n            `  The cookies will NOT be sent. Move cookie mutations to middleware.ts, a server action,\\n` +\n            `  or a route.ts handler.`\n        );\n        return;\n      }\n      // Headers.getSetCookie() returns individual Set-Cookie strings,\n      // avoiding the fragile comma-splitting that raw .get() requires.\n      for (const raw of headers.getSetCookie()) {\n        const parsed = parseSetCookie(raw);\n        if (parsed) {\n          // Use setRaw to preserve the original header's attributes without\n          // merging DEFAULT_COOKIE_OPTIONS (parseSetCookie intentionally\n          // does not apply defaults — see its doc comment).\n          setRaw(store, map, parsed.name, parsed.value, parsed.options);\n        }\n      }\n    },\n\n    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void {\n      assertMutable(store, 'delete');\n      // Validate the name even though delete writes an empty value — a\n      // smuggled name (`;` or CR/LF) would corrupt the Set-Cookie header\n      // we emit. See ONGOING_SECURITY.md H-3 (TIM-868).\n      assertValidCookieName(name);\n      if (store.flushed) {\n        if (isDebug()) {\n          console.warn(\n            `[timber] warn: getCookieJar().delete('${name}') called after response headers were committed.\\n` +\n              `  The cookie will NOT be deleted. Move cookie mutations to middleware.ts, a server action,\\n` +\n              `  or a route.ts handler.`\n          );\n        }\n        return;\n      }\n      const opts: CookieOptions = {\n        ...DEFAULT_COOKIE_OPTIONS,\n        ...options,\n        maxAge: 0,\n        expires: new Date(0),\n      };\n      // delete() is a jar entry point like set() — caller-supplied\n      // path/domain are serialized verbatim into the Set-Cookie header,\n      // so they must pass the same attribute-injection guard. See\n      // design/29-cookies.md §\"Cookie Attribute Validation\" (TIM-1026).\n      assertValidCookieOptions(opts);\n      store.cookieJar.set(name, { name, value: '', options: opts });\n      // Remove from read view\n      map.delete(name);\n    },\n\n    clear(): void {\n      assertMutable(store, 'clear');\n      if (store.flushed) return;\n      // Delete every incoming cookie\n      for (const name of Array.from(map.keys())) {\n        store.cookieJar.set(name, {\n          name,\n          value: '',\n          options: { ...DEFAULT_COOKIE_OPTIONS, maxAge: 0, expires: new Date(0) },\n        });\n      }\n      map.clear();\n    },\n\n    toString(): string {\n      // Re-encode values when serializing as a Cookie header — the\n      // RYW map holds decoded logical values, but a Cookie header has\n      // to satisfy `cookie-octet`. Mirror the auto-encode contract on\n      // `set()` so toString() round-trips losslessly with parseCookieHeader.\n      return Array.from(map.entries())\n        .map(([name, value]) => `${name}=${encodeURIComponent(value)}`)\n        .join('; ');\n    },\n  };\n}\n\n/**\n * Returns the value of a single cookie, or undefined if absent.\n *\n * @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.\n */\nexport function getCookie(name: string): string | undefined {\n  const jar = getCookieJar();\n  return jar.get(name);\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\n/**\n * Per-call options for `getCookies().set()`. Extends the persistent\n * `CookieOptions` (HTTP cookie attributes) with framework-only flags\n * that are NOT serialized into the Set-Cookie header.\n *\n * The `raw` flag is the escape hatch for the auto-encoding contract.\n * See design/29-cookies.md §\"Encoding Contract\".\n */\nexport interface SetCookieOptions extends CookieOptions {\n  /**\n   * Skip the framework's `encodeURIComponent` pass and store the value\n   * verbatim. The value is then validated against the strict RFC 6265\n   * §4.1.1 `cookie-octet` grammar — the H-3 smuggling primitive cannot\n   * sneak in via this opt-out.\n   *\n   * Use this when forwarding a cookie value that is already in its\n   * intended on-the-wire form (e.g. mirroring an upstream service's\n   * Set-Cookie). Default: `false` (auto-encode).\n   */\n  raw?: boolean;\n}\n\n/** Options for setting a cookie. See design/29-cookies.md. */\nexport interface CookieOptions {\n  /** Domain scope. Default: omitted (current domain only). */\n  domain?: string;\n  /** URL path scope. Default: '/'. */\n  path?: string;\n  /** Expiration date. Mutually exclusive with maxAge. */\n  expires?: Date;\n  /** Max age in seconds. Mutually exclusive with expires. */\n  maxAge?: number;\n  /** Prevent client-side JS access. Default: true. */\n  httpOnly?: boolean;\n  /** Only send over HTTPS. Default: true. */\n  secure?: boolean;\n  /** Cross-site request policy. Default: 'lax'. */\n  sameSite?: 'strict' | 'lax' | 'none';\n  /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */\n  partitioned?: boolean;\n}\n\n/**\n * Cookie accessor returned by `getCookies()`.\n *\n * Read methods are always available. Mutation methods throw in read-only\n * contexts (access.ts, server components).\n */\nexport interface RequestCookies {\n  /** Get a cookie value by name. Returns undefined if not present. */\n  get(name: string): string | undefined;\n  /** Check if a cookie exists. */\n  has(name: string): boolean;\n  /** Get all cookies as an array of { name, value } pairs. */\n  getAll(): Array<{ name: string; value: string }>;\n  /** Number of cookies. */\n  readonly size: number;\n  /**\n   * Set a cookie. Only available in mutable contexts (middleware, actions,\n   * route handlers).\n   *\n   * The value is auto-encoded with `encodeURIComponent` so the on-the-wire\n   * bytes always satisfy RFC 6265 §4.1.1 cookie-octet — `cookies().get()`\n   * returns the same logical value the developer wrote. Pass `{ raw: true }`\n   * to skip the encoder; the raw path validates against the strict\n   * cookie-octet grammar instead. See design/29-cookies.md §\"Encoding\n   * Contract\" and ONGOING_SECURITY.md H-3 (TIM-868).\n   */\n  set(name: string, value: string, options?: SetCookieOptions): void;\n  /**\n   * Copy all `Set-Cookie` headers from a `Headers` object.\n   * Parses each header and forwards name, value, and all attributes\n   * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).\n   *\n   * Useful when forwarding cookies from an internal `fetch()` or auth handler:\n   * ```ts\n   * const response = await auth.handler(req);\n   * getCookies().then(c => c.setFromHeaders(response.headers));\n   * ```\n   */\n  setFromHeaders(headers: Headers): void;\n  /** Delete a cookie. Only available in mutable contexts. */\n  delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;\n  /** Delete all cookies. Only available in mutable contexts. */\n  clear(): void;\n  /** Serialize cookies as a Cookie header string. */\n  toString(): string;\n}\n\nconst DEFAULT_COOKIE_OPTIONS: CookieOptions = {\n  path: '/',\n  httpOnly: true,\n  secure: true,\n  sameSite: 'lax',\n};\n\n// ─── Framework-Internal Helpers ───────────────────────────────────────────\n\n/**\n * Per-request seed map of cookie name → value, registered out-of-band so the\n * pipeline's `runWithRequestContext` call can pick it up without changing\n * the function's calling convention. Stored in a WeakMap keyed by the\n * synthetic Request object built for the rerender path, so the seed lives\n * exactly as long as the request and is collected with it.\n *\n * The seed exists to eliminate the parse/serialize round-trip on the no-JS\n * form-rerender path — see ONGOING_SECURITY.md H-3 (TIM-868). The action's\n * post-mutation RYW snapshot is threaded directly into the rerender scope's\n * `parsedCookies` map, bypassing `parseCookieHeader` entirely.\n */\nconst seededRequestCookies = new WeakMap<Request, Map<string, string>>();\n\n/**\n * Register a pre-parsed cookie map to use as the request context seed for\n * the next `runWithRequestContext(req, …)` call with this exact `req`.\n *\n * Used by the no-JS form-rerender dispatcher in\n * `rsc-entry/wrap-action-dispatch.ts` to thread the action's post-mutation\n * cookie state into the rerender scope without serializing back through a\n * `Cookie:` header. See TIM-868 / TIM-837.\n *\n * @internal — framework use only.\n */\nexport function seedRequestCookies(req: Request, cookies: Map<string, string>): void {\n  // Defensive copy: callers must not be able to mutate the rerender scope's\n  // map after seeding, and the rerender scope must not mutate the snapshot\n  // we hand back to other observers.\n  seededRequestCookies.set(req, new Map(cookies));\n}\n\n/**\n * Pop the seed (if any) for `req` and return it. Called from\n * `runWithRequestContext` exactly once per request — the seed is consumed\n * eagerly so it cannot leak into a hypothetical future re-use of the same\n * Request reference.\n *\n * @internal — framework use only.\n */\nexport function consumeSeededCookies(req: Request): Map<string, string> | undefined {\n  const seed = seededRequestCookies.get(req);\n  if (seed) seededRequestCookies.delete(req);\n  return seed;\n}\n\n/**\n * Build a Map of cookie name → value reflecting the current request's\n * read-your-own-writes state. Includes incoming cookies plus any\n * mutations from getCookies().set() / getCookies().delete() in the same request.\n *\n * Used by SSR renderers to populate NavContext.cookies so that\n * useCookie()'s server snapshot matches the actual response state.\n *\n * See design/29-cookies.md §\"Read-Your-Own-Writes\"\n * See design/triage/TIM-441-cookie-api-triage.md §4\n */\nexport function getCookiesForSsr(): Map<string, string> {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error('[timber] getCookiesForSsr() called outside of a request context.');\n  }\n\n  // Trigger lazy parsing if not yet done\n  if (!store.parsedCookies) {\n    store.parsedCookies = parseCookieHeader(store.cookieHeader);\n  }\n\n  // The parsedCookies map already reflects read-your-own-writes:\n  // - getCookies().set() updates the map via map.set(name, value)\n  // - getCookies().delete() removes from the map via map.delete(name)\n  // Return a copy so callers can't mutate the internal map.\n  return new Map(store.parsedCookies);\n}\n\n/**\n * Collect all Set-Cookie headers from the cookie jar.\n * Called by the framework at flush time to apply cookies to the response.\n *\n * Returns an array of serialized Set-Cookie header values.\n */\nexport function getSetCookieHeaders(): string[] {\n  const store = requestContextAls.getStore();\n  if (!store) return [];\n  return Array.from(store.cookieJar.values()).map(serializeCookieEntry);\n}\n\n// ─── Cookie Helpers ───────────────────────────────────────────────────────\n\n/** Throw if cookie mutation is attempted in a read-only context. */\nfunction assertMutable(store: RequestContextStore, method: string): void {\n  if (!store.mutableContext) {\n    throw new Error(\n      `[timber] getCookieJar().${method}() cannot be called in this context.\\n` +\n        `  Set cookies in middleware.ts, server actions, or route.ts handlers.`\n    );\n  }\n}\n\n/**\n * Write a cookie to the jar WITHOUT merging DEFAULT_COOKIE_OPTIONS.\n * Used by setFromHeaders to preserve the original header's attributes exactly.\n *\n * For deletion cookies (maxAge=0), the jar entry is still created so the\n * Set-Cookie header is emitted, but the cookie is NOT added to the read map\n * (it would be misleading — the cookie is being deleted).\n */\nfunction setRaw(\n  store: RequestContextStore,\n  readMap: Map<string, string>,\n  name: string,\n  value: string,\n  options: CookieOptions\n): void {\n  // setRaw is the forwarding path for upstream Set-Cookie headers\n  // (`getCookies().setFromHeaders(response.headers)`). The value comes\n  // out of `parseSetCookie` in its on-the-wire form — already encoded\n  // by whoever produced it — so we re-emit it verbatim into our jar.\n  // We DO validate against the strict cookie-octet grammar, both as\n  // defense-in-depth against a malicious upstream and to keep the\n  // ONGOING_SECURITY.md H-3 invariant intact at every entry point into\n  // the cookie jar / RYW map.\n  assertValidCookieName(name);\n  assertValidCookieValue(name, value);\n  // Options get the same entry-point guard as set()/delete(). For the\n  // setFromHeaders path this can only fire on attributes parseSetCookie\n  // cannot produce (it splits on `;` and normalizes Max-Age/SameSite),\n  // but setRaw is the jar entry point — the invariant lives here, not in\n  // the caller. See design/29-cookies.md §\"Cookie Attribute Validation\".\n  assertValidCookieOptions(options);\n  store.cookieJar.set(name, { name, value, options });\n  // Deletion cookies (Max-Age=0) should not appear in the read map.\n  if (options.maxAge === 0) {\n    readMap.delete(name);\n  } else {\n    // Decode for the RYW map so consumers see the same logical bytes\n    // they would see if the upstream cookie had arrived on the next\n    // request. Mirrors `parseCookieHeader`'s auto-decode.\n    readMap.set(name, safeDecodeCookieValue(value));\n  }\n}\n","/**\n * Request Context — per-request ALS store for headers, search params,\n * segment params, and request scope lifecycle.\n *\n * Follows the same pattern as tracing.ts: a module-level AsyncLocalStorage\n * instance, public accessor functions that throw outside request scope,\n * and a framework-internal `runWithRequestContext()` to establish scope.\n *\n * Cookie state lives in `cookie-context.ts` (split out in TIM-853). The\n * scope set up here owns the cookie jar / parsedCookies fields on the\n * store, but the cookie API and helpers are in the cookie module.\n *\n * See design/04-authorization.md §\"AccessContext does not include cookies or headers\"\n * and design/11-platform.md §\"AsyncLocalStorage\".\n */\n\nimport { requestContextAls, type RequestContextStore } from './als-registry.js';\nimport { _setGetSearchParamsFn } from '../search-params/define.js';\nimport { _setGetSegmentParamsFn } from '../segment-params/define.js';\nimport { consumeSeededCookies } from './cookie-context.js';\nimport { isDebug } from './debug.js';\n\n// Re-export the ALS for framework-internal consumers that need direct access.\nexport { requestContextAls };\n\n// ─── Public API ───────────────────────────────────────────────────────────\n\n/**\n * Returns a read-only view of the current request's headers.\n *\n * Available in middleware, access checks, server components, and server actions.\n * Throws if called outside a request context (security principle #2: no global fallback).\n */\nexport function getHeaders(): ReadonlyHeaders {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error(\n      '[timber] getHeaders() called outside of a request context. ' +\n        'It can only be used in middleware, access checks, server components, and server actions.'\n    );\n  }\n  return store.headers;\n}\n\n/**\n * Returns the value of a single request header, or undefined if absent.\n *\n * Thin wrapper over `getHeaders().get(name)` for the common case where\n * you need exactly one header.\n *\n * @internal — not part of the public API. Use `getHeaders().get(name)` instead.\n */\nexport function getHeader(name: string): string | undefined {\n  const headers = getHeaders();\n  return headers.get(name) ?? undefined;\n}\n\n/**\n * Returns the current request's raw URLSearchParams.\n *\n * @internal — not part of the public API. Use `defineSearchParams().get()` instead.\n */\nexport function getSearchParams(): URLSearchParams {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error(\n      '[timber] getSearchParams() called outside of a request context. ' +\n        'It can only be used in middleware, access checks, server components, and server actions.'\n    );\n  }\n  return store.searchParams;\n}\n\n// Eagerly register getSearchParams with the search-params module so\n// searchParams.get() can call it without a dynamic import.\n// Dynamic imports lose ALS context in React's RSC Flight renderer,\n// breaking getSearchParams() in parallel slot pages. See TIM-523.\n_setGetSearchParamsFn(getSearchParams);\n\n// Eagerly register getSegmentParams with the segment-params module so\n// segmentParams.get() can call it without a dynamic import.\n// Same pattern as search params — dynamic imports lose ALS context. See TIM-523.\n_setGetSegmentParamsFn(getSegmentParams);\n\n/**\n * Returns the current request's coerced segment params.\n *\n * The optional `segmentPath` argument exists only for TypeScript narrowing —\n * it does not affect the runtime return value. Pass a segment path\n * (e.g. `'/(browse)/[artistSlug]/[year]'`) to narrow the return type to the\n * exact params shape for that segment.\n *\n * Without an argument, returns all coerced params with optional types.\n *\n * See design/41-global-params.md §Function Signatures\n */\nexport function getSegmentParams(segmentPath?: string): Record<string, string | string[]> {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error(\n      '[timber] getSegmentParams() called outside of a request context. ' +\n        'It can only be used in middleware, access checks, server components, and server actions.'\n    );\n  }\n  if (!store.segmentParams) {\n    throw new Error(\n      '[timber] getSegmentParams() called before route matching completed. ' +\n        'Segment params are not available until after the route is matched.'\n    );\n  }\n\n  // Check slot params map first — parallel slots may have different param\n  // types than the main route (e.g. catch-all [..year] → string[] vs\n  // dynamic [year] → string). If the requested segment path matches a\n  // stored slot, return its params merged with the main route's.\n  if (segmentPath && store.slotParamsMap?.has(segmentPath)) {\n    const slotParams = store.slotParamsMap.get(segmentPath)!;\n    // Merge: main params as base, slot-specific params override.\n    // This ensures params from segments above the slot (that the slot\n    // doesn't re-derive) are still available.\n    return { ...store.segmentParams, ...slotParams };\n  }\n\n  // Dev-mode validation: warn when the segment path expects dynamic\n  // segments that don't exist on the actual matched segment. This catches\n  // bugs like passing a child segment's $segment to a parent layout.\n  // Skip for slot paths — they're validated against their own chain.\n  // See design/41-global-params.md §Runtime Validation\n  if (segmentPath && isDebug() && store.matchedSegmentPath) {\n    const expected = extractDynamicSegments(segmentPath);\n    const actual = extractDynamicSegments(store.matchedSegmentPath);\n    const missing = expected.filter((s) => !actual.includes(s));\n\n    if (missing.length > 0) {\n      console.warn(\n        `[timber] getSegmentParams('${segmentPath}') called but current segment is '${store.matchedSegmentPath}'\\n` +\n          `  Missing params: ${missing.join(', ')}\\n` +\n          `  These will be undefined at runtime despite the type annotation.`\n      );\n    }\n  }\n\n  return store.segmentParams;\n}\n\n/**\n * Set the segment params on the current request context.\n * Called by the pipeline after route matching and param coercion.\n *\n * @internal — framework use only\n */\nexport function setSegmentParams(params: Record<string, string | string[]>): void {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error('[timber] setSegmentParams() called outside of a request context.');\n  }\n  store.segmentParams = params;\n}\n\n/**\n * Store per-slot coerced segment params in the current request context.\n * Called by the route element builder when resolving parallel slots.\n *\n * @param segmentPath — The slot's full tree path (e.g. '/(browse)/@shows/[artistSlug]/[...year]')\n * @param params — The slot's coerced segment params\n * @internal — framework use only\n */\nexport function setSlotParams(\n  segmentPath: string,\n  params: Record<string, string | string[]>\n): void {\n  const store = requestContextAls.getStore();\n  if (!store) return; // non-throwing — optional diagnostic\n  if (!store.slotParamsMap) store.slotParamsMap = new Map();\n  store.slotParamsMap.set(segmentPath, params);\n}\n\n/**\n * Store the matched segment path (e.g. '/(browse)/[artistSlug]/[year]') for\n * dev-mode validation in getSegmentParams().\n *\n * @internal — framework use only\n */\nexport function setMatchedSegmentPath(segmentPath: string): void {\n  const store = requestContextAls.getStore();\n  if (!store) return; // non-throwing — optional diagnostic\n  store.matchedSegmentPath = segmentPath;\n}\n\n/**\n * Extract dynamic segment names from a route pattern.\n * '/[artistSlug]/[year]' → ['artistSlug', 'year']\n * '/docs/[...slug]'      → ['slug']\n */\nfunction extractDynamicSegments(route: string): string[] {\n  const segments: string[] = [];\n  // Match [paramName], [...paramName], [[...paramName]]\n  const re = /\\[{1,2}\\.{0,3}(\\w+)\\]{1,2}/g;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(route)) !== null) {\n    segments.push(m[1]);\n  }\n  return segments;\n}\n\n/**\n * Returns the raw search string from the current request URL (e.g. \"?foo=bar\").\n * Synchronous — safe for use in `redirect()` which throws synchronously.\n *\n * Returns empty string if called outside a request context (non-throwing for\n * use in redirect's optional preserveSearchParams path).\n *\n * @internal — used by redirect() for preserveSearchParams support.\n */\nexport function getRequestSearchString(): string {\n  const store = requestContextAls.getStore();\n  return store?.searchString ?? '';\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\n/**\n * Read-only Headers interface. The standard Headers class is mutable;\n * this type narrows it to read-only methods. The underlying object is\n * still a Headers instance, but user code should not mutate it.\n */\nexport type ReadonlyHeaders = Pick<\n  Headers,\n  'get' | 'has' | 'entries' | 'keys' | 'values' | 'forEach' | typeof Symbol.iterator\n>;\n\n// ─── Framework-Internal Helpers ───────────────────────────────────────────\n\n/**\n * Run a callback within a request context. Used by the pipeline to establish\n * per-request ALS scope so that `getHeaders()` and `getCookies()` work.\n *\n * If the request was previously registered via `seedRequestCookies`, the\n * resulting context's `parsedCookies` map is initialized from the seed and\n * the raw `cookieHeader` is left empty — `parseCookieHeader` is never called\n * for that request. This is the no-JS form-rerender path. See TIM-868.\n *\n * @param req - The incoming Request object.\n * @param fn - The function to run within the request context.\n */\nexport function runWithRequestContext<T>(req: Request, fn: () => T): T {\n  const originalCopy = new Headers(req.headers);\n  const parsedUrl = new URL(req.url);\n  const seed = consumeSeededCookies(req);\n  const store: RequestContextStore = {\n    headers: freezeHeaders(req.headers),\n    originalHeaders: originalCopy,\n    // When seeded, leave the raw header empty — parseCookieHeader is the\n    // exact code path the smuggling primitive abused, and lazy parsing is\n    // gated on `parsedCookies` being undefined.\n    cookieHeader: seed ? '' : (req.headers.get('cookie') ?? ''),\n    parsedCookies: seed,\n    searchParams: parsedUrl.searchParams,\n    searchString: parsedUrl.search,\n    cookieJar: new Map(),\n    flushed: false,\n    mutableContext: false,\n  };\n  return requestContextAls.run(store, fn);\n}\n\n/**\n * Enable cookie mutation for the current context. Called by the framework\n * when entering middleware.ts, server actions, or route.ts handlers.\n *\n * See design/29-cookies.md §\"Context Tracking\"\n */\nexport function setMutableCookieContext(mutable: boolean): void {\n  const store = requestContextAls.getStore();\n  if (store) {\n    store.mutableContext = mutable;\n  }\n}\n\n/**\n * Mark the response as flushed (headers committed). After this point,\n * cookie mutations log a warning instead of throwing.\n *\n * See design/29-cookies.md §\"Streaming Constraint: Post-Flush Cookie Warning\"\n */\nexport function markResponseFlushed(): void {\n  const store = requestContextAls.getStore();\n  if (store) {\n    store.flushed = true;\n  }\n}\n\n/**\n * Apply middleware-injected request headers to the current request context.\n *\n * Called by the pipeline after middleware.ts runs. Merges overlay headers\n * on top of the original request headers so downstream code (access.ts,\n * server components, server actions) sees them via `getHeaders()`.\n *\n * The original request headers are never mutated — a new frozen Headers\n * object is created with the overlay applied on top.\n *\n * See design/07-routing.md §\"Request Header Injection\"\n */\nexport function applyRequestHeaderOverlay(overlay: Headers): void {\n  const store = requestContextAls.getStore();\n  if (!store) {\n    throw new Error('[timber] applyRequestHeaderOverlay() called outside of a request context.');\n  }\n\n  // Check if the overlay has any headers — skip if empty\n  let hasOverlay = false;\n  overlay.forEach(() => {\n    hasOverlay = true;\n  });\n  if (!hasOverlay) return;\n\n  // Merge: start with original headers, overlay on top\n  const merged = new Headers(store.originalHeaders);\n  overlay.forEach((value, key) => {\n    merged.set(key, value);\n  });\n  store.headers = freezeHeaders(merged);\n}\n\n// ─── Read-Only Headers ────────────────────────────────────────────────────\n\nconst MUTATING_METHODS = new Set(['set', 'append', 'delete']);\n\n/**\n * Wrap a Headers object in a Proxy that throws on mutating methods.\n * Object.freeze doesn't work on Headers (native internal slots), so we\n * intercept property access and reject set/append/delete at runtime.\n *\n * Read methods (get, has, entries, etc.) must be bound to the underlying\n * Headers instance because they access private #headersList slots.\n */\nfunction freezeHeaders(source: Headers): Headers {\n  const copy = new Headers(source);\n  return new Proxy(copy, {\n    get(target, prop) {\n      if (typeof prop === 'string' && MUTATING_METHODS.has(prop)) {\n        return () => {\n          throw new Error(\n            `[timber] getHeaders() returns a read-only Headers object. ` +\n              `Calling .${prop}() is not allowed. ` +\n              `Use ctx.requestHeaders in middleware to inject headers for downstream components.`\n          );\n        };\n      }\n      const value = Reflect.get(target, prop);\n      // Bind methods to the real Headers instance so private slot access works\n      if (typeof value === 'function') {\n        return value.bind(target);\n      }\n      return value;\n    },\n  });\n}\n","/**\n * Next.js redirect type discriminator.\n *\n * Provided for API compatibility with libraries that import `RedirectType`\n * from `next/navigation`. In timber, `redirect()` always uses `replace`\n * semantics (no history entry for the redirect itself).\n *\n * Lives in shared/ (isomorphic) so both the server primitives and the\n * client-only next/navigation shim export the same definition without the\n * client shim pulling in server code.\n */\nexport const RedirectType = {\n  push: 'push',\n  replace: 'replace',\n} as const;\n\nexport type RedirectTypeValue = (typeof RedirectType)[keyof typeof RedirectType];\n","// Server-side primitives: deny, redirect, redirectExternal, RenderError, waitUntil, SsrStreamError\n//\n// These are the core runtime signals that components, middleware, and access gates\n// use to control request flow. See design/10-error-handling.md.\n\nimport type { JsonSerializable } from './types.js';\nimport { getWaitUntil as _getWaitUntil } from './waituntil-bridge.js';\nimport { isDebug } from './debug.js';\nimport { getRequestSearchString } from './request-context.js';\nimport { mergePreservedSearchParams } from '../shared/merge-search-params.js';\nimport {\n  assertRelativeRedirectPath,\n  validateExternalRedirectUrl,\n} from '../shared/href-validation.js';\n\n// ─── Dev-mode validation ────────────────────────────────────────────────────\n\n/**\n * Check if a value is JSON-serializable without data loss.\n * Returns a description of the first non-serializable value found, or null if OK.\n *\n * @internal Exported for testing only.\n */\nexport function findNonSerializable(value: unknown, path = 'data'): string | null {\n  if (value === null || value === undefined) return null;\n\n  switch (typeof value) {\n    case 'string':\n    case 'number':\n    case 'boolean':\n      return null;\n    case 'bigint':\n      return `${path} contains a BigInt — BigInt throws in JSON.stringify`;\n    case 'function':\n      return `${path} is a function — functions are not JSON-serializable`;\n    case 'symbol':\n      return `${path} is a symbol — symbols are not JSON-serializable`;\n    case 'object':\n      break;\n    default:\n      return `${path} has unsupported type \"${typeof value}\"`;\n  }\n\n  if (value instanceof Date) {\n    return `${path} is a Date — Dates silently coerce to strings in JSON.stringify`;\n  }\n  if (value instanceof Map) {\n    return `${path} is a Map — Maps serialize as {} in JSON.stringify (data loss)`;\n  }\n  if (value instanceof Set) {\n    return `${path} is a Set — Sets serialize as {} in JSON.stringify (data loss)`;\n  }\n  if (value instanceof RegExp) {\n    return `${path} is a RegExp — RegExps serialize as {} in JSON.stringify`;\n  }\n  if (value instanceof Error) {\n    return `${path} is an Error — Errors serialize as {} in JSON.stringify`;\n  }\n\n  if (Array.isArray(value)) {\n    for (let i = 0; i < value.length; i++) {\n      const result = findNonSerializable(value[i], `${path}[${i}]`);\n      if (result) return result;\n    }\n    return null;\n  }\n\n  // Plain object — only Object.prototype is safe. Null-prototype objects\n  // (Object.create(null)) survive JSON.stringify but React Flight rejects\n  // them with \"Classes or null prototypes are not supported\", so the\n  // pre-flush deny path (renderDenyPage → renderToReadableStream) would throw.\n  const proto = Object.getPrototypeOf(value);\n  if (proto === null) {\n    return `${path} is a null-prototype object — React Flight rejects null prototypes`;\n  }\n  if (proto !== Object.prototype) {\n    const name = (value as object).constructor?.name ?? 'unknown';\n    return `${path} is a ${name} instance — class instances may lose data in JSON.stringify`;\n  }\n\n  for (const key of Object.keys(value as Record<string, unknown>)) {\n    const result = findNonSerializable((value as Record<string, unknown>)[key], `${path}.${key}`);\n    if (result) return result;\n  }\n  return null;\n}\n\n/**\n * Emit a dev-mode warning if data is not JSON-serializable.\n * No-op in production.\n */\nfunction warnIfNotSerializable(data: unknown, callerName: string): void {\n  if (!isDebug()) return;\n  if (data === undefined) return;\n\n  const issue = findNonSerializable(data);\n  if (issue) {\n    console.warn(\n      `[timber] ${callerName}: ${issue}. ` +\n        'Data passed to deny() or RenderError must be JSON-serializable because ' +\n        'the post-flush path uses JSON.stringify, not React Flight.'\n    );\n  }\n}\n\n// ─── DenySignal ─────────────────────────────────────────────────────────────\n\n/**\n * Render-phase signal thrown by `deny()`. Caught by the framework to produce\n * the correct HTTP status code (segment context) or graceful degradation (slot context).\n */\nexport class DenySignal extends Error {\n  readonly status: number;\n  readonly data: JsonSerializable | undefined;\n\n  constructor(status: number, data?: JsonSerializable) {\n    super(`Access denied with status ${status}`);\n    this.name = 'DenySignal';\n    this.status = status;\n    this.data = data;\n  }\n\n  /**\n   * Extract the file that called deny() from the stack trace.\n   * Returns a short path (e.g. \"app/auth/access.ts\") or undefined if\n   * the stack can't be parsed. Dev-only — used for dev log output.\n   */\n  get sourceFile(): string | undefined {\n    if (!this.stack) return undefined;\n    const frames = this.stack.split('\\n');\n    // Skip the Error line and the deny() frame — the caller is the 3rd line.\n    // Stack format: \"    at FnName (file:line:col)\" or \"    at file:line:col\"\n    for (let i = 2; i < frames.length; i++) {\n      const frame = frames[i];\n      if (!frame) continue;\n      // Skip framework internals\n      if (frame.includes('primitives.ts') || frame.includes('node_modules')) continue;\n      // Extract file path from the frame\n      const match =\n        frame.match(/\\(([^)]+?)(?::\\d+:\\d+)\\)/) ?? frame.match(/at\\s+([^\\s]+?)(?::\\d+:\\d+)/);\n      if (match?.[1]) {\n        // Shorten to app-relative path\n        const full = match[1];\n        const appIdx = full.indexOf('/app/');\n        return appIdx >= 0 ? full.slice(appIdx + 1) : full;\n      }\n    }\n    return undefined;\n  }\n}\n\n/** Options for deny() when using the object form. */\nexport interface DenyOptions {\n  /** HTTP status code (4xx or 5xx). Default: 403. */\n  status?: number;\n  /** Human-readable message (logged server-side, not sent to client). */\n  message?: string;\n  /** JSON-serializable data passed as `dangerouslyPassData` prop to status-code files. */\n  data?: JsonSerializable;\n}\n\n/**\n * Universal denial/error primitive. Throws a `DenySignal` that the framework catches.\n *\n * - In segment context (outside Suspense): produces HTTP status code\n * - In slot context: graceful degradation → denied.tsx → default.tsx → null\n * - Inside Suspense (hold window): promoted to pre-flush behavior\n * - Inside Suspense (after flush): error boundary + noindex meta\n *\n * Supports both positional and object signatures:\n * ```ts\n * deny()                                          // 403 (default)\n * deny(404)                                       // 404\n * deny(503, { retry: true })                      // 503 with data\n * deny({ status: 503, message: 'Maintenance' })   // object form\n * ```\n *\n * Accepts any 4xx or 5xx status code. This replaces the need for\n * `throw new RenderError(...)` in user code — RenderError is now an\n * internal pipeline detail.\n *\n * @param statusOrOptions - Status code (number) or options object. Default: 403.\n * @param data - Optional JSON-serializable data (positional form only).\n */\nexport function deny(statusOrOptions?: number | DenyOptions, data?: JsonSerializable): never {\n  let status: number;\n  let resolvedData: JsonSerializable | undefined;\n\n  if (typeof statusOrOptions === 'object' && statusOrOptions !== null) {\n    status = statusOrOptions.status ?? 403;\n    resolvedData = statusOrOptions.data;\n  } else {\n    status = statusOrOptions ?? 403;\n    resolvedData = data;\n  }\n\n  if (status < 400 || status > 599) {\n    throw new Error(`deny() requires a 4xx or 5xx status code, got ${status}.`);\n  }\n  warnIfNotSerializable(resolvedData, 'deny()');\n  throw new DenySignal(status, resolvedData);\n}\n\n/**\n * @deprecated Use `deny(404)` instead.\n * Kept for internal use by the Next.js shim layer.\n * @internal\n */\nexport function notFound(): never {\n  deny(404);\n}\n\n// Single source of truth shared with the client next/navigation shim —\n// see shared/redirect-type.ts.\nexport { RedirectType } from '../shared/redirect-type.js';\n\n// ─── RedirectSignal ─────────────────────────────────────────────────────────\n\n/**\n * Render-phase signal thrown by `redirect()` and `redirectExternal()`.\n * Caught by the framework to produce a 3xx response or client-side navigation.\n */\nexport class RedirectSignal extends Error {\n  readonly location: string;\n  readonly status: number;\n\n  constructor(location: string, status: number) {\n    super(`Redirect to ${location}`);\n    this.name = 'RedirectSignal';\n    this.location = location;\n    this.status = status;\n  }\n}\n\n/**\n * Options for redirect() — alternative to passing a bare status code.\n */\nexport interface RedirectOptions {\n  /** HTTP redirect status code (3xx). Defaults to 302 (or 308 when `permanent: true`). */\n  status?: number;\n  /**\n   * When true, defaults the status to 308 (Permanent Redirect, preserves HTTP method).\n   * If `status` is also provided, `status` takes precedence.\n   *\n   * @example\n   * redirect('/new-path', { permanent: true });       // 308\n   * redirect('/new-path', { permanent: true, status: 301 }); // 301\n   */\n  permanent?: boolean;\n  /**\n   * Preserve search params from the current request URL on the redirect target.\n   *\n   * - `true` — preserve ALL current search params (target params take precedence)\n   * - `string[]` — preserve only the named params (e.g. `['private', 'token']`)\n   *\n   * Target path's own query params always take precedence over preserved ones.\n   */\n  preserveSearchParams?: true | string[];\n}\n\n/**\n * Redirect to a relative path. Rejects absolute and protocol-relative URLs.\n * Use `redirectExternal()` for external redirects with an allow-list.\n *\n * @param path - Relative path (e.g. '/login', 'settings', '/login?returnTo=/dash')\n * @param statusOrOptions - HTTP status code (3xx, default 302) or options object.\n *\n * @example\n * // Simple redirect\n * redirect('/login');\n *\n * // With status code\n * redirect('/login', 301);\n *\n * // With preserved search params\n * redirect(`/docs/${version}/${slug}`, { preserveSearchParams: ['foo'] });\n */\nexport function redirect(path: string, statusOrOptions?: number | RedirectOptions): never {\n  let status: number;\n  let preserveSearchParams: true | string[] | undefined;\n\n  if (typeof statusOrOptions === 'number') {\n    status = statusOrOptions;\n  } else if (statusOrOptions) {\n    // Explicit status wins. Otherwise permanent: true → 308, default → 302.\n    status = statusOrOptions.status ?? (statusOrOptions.permanent ? 308 : 302);\n    preserveSearchParams = statusOrOptions.preserveSearchParams;\n  } else {\n    status = 302;\n  }\n\n  if (status < 300 || status > 399) {\n    throw new Error(`redirect() requires a 3xx status code, got ${status}.`);\n  }\n  // Relative-only validation shared with the client next/navigation shim —\n  // strips C0 controls and normalizes backslashes before the scheme check.\n  assertRelativeRedirectPath(path);\n\n  let resolvedPath = path;\n  if (preserveSearchParams) {\n    const currentSearch = getRequestSearchString();\n    resolvedPath = mergePreservedSearchParams(path, currentSearch, preserveSearchParams);\n  }\n\n  throw new RedirectSignal(resolvedPath, status);\n}\n\n/**\n * @deprecated Use `redirect(path, { permanent: true })` instead.\n * Kept for internal use by the Next.js shim layer.\n * @internal\n */\nexport function permanentRedirect(path: string, options?: Omit<RedirectOptions, 'status'>): never {\n  redirect(path, { permanent: true, ...options });\n}\n\n/**\n * Redirect to an external URL. The origin must be in the provided allow-list.\n *\n * Only http: and https: schemes are permitted. The allow-list is matched\n * against full origins (scheme + host + port), not bare hostnames.\n *\n * @param url - Absolute URL to redirect to.\n * @param allowList - Array of allowed origins (e.g. ['https://example.com', 'https://auth.example.com']).\n * @param status - HTTP redirect status code (3xx). Defaults to 302.\n */\nexport function redirectExternal(url: string, allowList: string[], status: number = 302): never {\n  if (status < 300 || status > 399) {\n    throw new Error(`redirectExternal() requires a 3xx status code, got ${status}.`);\n  }\n\n  const canonicalUrl = validateExternalRedirectUrl(url, allowList);\n  throw new RedirectSignal(canonicalUrl, status);\n}\n\n// ─── RenderError ────────────────────────────────────────────────────────────\n\n/**\n * Typed digest that crosses the RSC → client boundary.\n * The `code` identifies the error class; `data` carries JSON-serializable context.\n */\nexport interface RenderErrorDigest<\n  TCode extends string = string,\n  TData extends JsonSerializable = JsonSerializable,\n> {\n  code: TCode;\n  data: TData;\n}\n\n/**\n * Typed throw for render-phase errors that carry structured context to error boundaries.\n *\n * The `digest` (code + data) is serialized into the RSC stream separately from the\n * Error instance — only the digest crosses the RSC → client boundary.\n *\n * @example\n * ```ts\n * throw new RenderError('PRODUCT_NOT_FOUND', {\n *   title: 'Product not found',\n *   resourceId: params.id,\n * })\n * ```\n */\nexport class RenderError<\n  TCode extends string = string,\n  TData extends JsonSerializable = JsonSerializable,\n> extends Error {\n  readonly code: TCode;\n  readonly digest: RenderErrorDigest<TCode, TData>;\n  readonly status: number;\n\n  constructor(code: TCode, data: TData, options?: { status?: number }) {\n    super(`RenderError: ${code}`);\n    this.name = 'RenderError';\n    this.code = code;\n    this.digest = { code, data };\n\n    warnIfNotSerializable(data, 'RenderError');\n\n    const status = options?.status ?? 500;\n    if (status < 400 || status > 599) {\n      throw new Error(`RenderError status must be 4xx or 5xx, got ${status}.`);\n    }\n    this.status = status;\n  }\n}\n\n// ─── waitUntil ──────────────────────────────────────────────────────────────\n\n/** Minimal interface for adapters that support background work. */\nexport interface WaitUntilAdapter {\n  waitUntil?(promise: Promise<unknown>): void;\n}\n\n// Intentional per-app singleton — warn-once flag that persists for the\n// lifetime of the process/isolate. Not per-request; do not migrate to ALS.\nlet _waitUntilWarned = false;\n\n/**\n * Register a promise to be kept alive after the response is sent.\n * Maps to `ctx.waitUntil()` on Cloudflare Workers and similar platforms.\n *\n * In production, the platform adapter installs a per-request waitUntil\n * function via ALS (see waituntil-bridge.ts). This function checks the\n * ALS bridge first, then falls back to the legacy adapter argument.\n *\n * If neither is available, a warning is logged once and the promise is\n * left to resolve (or reject) without being tracked.\n *\n * @param promise - The background work to keep alive.\n * @param adapter - Optional legacy adapter (prefer ALS bridge in production).\n */\nexport function waitUntil(promise: Promise<unknown>, adapter?: WaitUntilAdapter): void {\n  // Check ALS bridge first (installed by generated entry points)\n  const alsFn = _getWaitUntil();\n  if (alsFn) {\n    alsFn(promise);\n    return;\n  }\n\n  // Fall back to legacy adapter argument\n  if (adapter && typeof adapter.waitUntil === 'function') {\n    adapter.waitUntil(promise);\n    return;\n  }\n\n  if (!_waitUntilWarned) {\n    _waitUntilWarned = true;\n    console.warn(\n      '[timber] waitUntil() is not supported by the current adapter. ' +\n        'Background work will not be tracked. This warning is shown once.'\n    );\n  }\n}\n\n/**\n * Reset the waitUntil warning state. Exported for testing only.\n * @internal\n */\nexport function _resetWaitUntilWarning(): void {\n  _waitUntilWarned = false;\n}\n\n// ─── SsrStreamError ─────────────────────────────────────────────────────────\n\n/**\n * Error thrown when SSR's renderToReadableStream fails due to an error\n * in the decoded RSC stream (e.g., uncontained slot errors).\n *\n * The RSC entry checks for this error type in its catch block to avoid\n * re-executing server components via renderDenyPage. Instead, it renders\n * a bare deny/error page without layout wrapping.\n *\n * Defined in primitives.ts (not ssr-entry.ts) because ssr-entry.ts imports\n * react-dom/server which cannot be loaded in the RSC environment.\n */\nexport class SsrStreamError extends Error {\n  constructor(\n    message: string,\n    public readonly cause: unknown\n  ) {\n    super(message);\n    this.name = 'SsrStreamError';\n  }\n}\n","/**\n * FormData preprocessing — schema-agnostic conversion of FormData to typed objects.\n *\n * FormData is all strings. Schema validation expects typed values. This module\n * bridges the gap with intelligent coercion that runs *before* schema validation.\n *\n * Inspired by zod-form-data, but schema-agnostic — works with any Standard Schema\n * library (Zod, Valibot, ArkType).\n *\n * See design/08-forms-and-actions.md §\"parseFormData() and coerce helpers\"\n */\n\n// ─── parseFormData ───────────────────────────────────────────────────────\n\n/**\n * Convert FormData into a plain object with intelligent coercion.\n *\n * Handles:\n * - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: [\"js\", \"ts\"] }`\n * - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: \"Alice\" } }`\n * - **Empty strings → undefined**: Enables `.optional()` semantics in schemas\n * - **Empty Files → undefined**: File inputs with no selection become `undefined`\n * - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded\n */\nexport function parseFormData(formData: FormData): Record<string, unknown> {\n  const flat: Record<string, unknown> = {};\n\n  for (const key of new Set(formData.keys())) {\n    // Skip React internal fields\n    if (key.startsWith('$ACTION_')) continue;\n\n    // Skip prototype-pollution keys at the top level — assigning to\n    // `flat['__proto__']` invokes the prototype setter and can splice\n    // attacker-controlled data into `flat`'s prototype chain.\n    // The dot-path case is filtered separately in `expandDotPaths`.\n    if (DANGEROUS_KEYS.has(key)) continue;\n\n    const values = formData.getAll(key);\n    const processed = values.map(normalizeValue);\n\n    if (processed.length === 1) {\n      flat[key] = processed[0];\n    } else {\n      // Filter out undefined entries from multi-value fields\n      flat[key] = processed.filter((v) => v !== undefined);\n    }\n  }\n\n  // Expand dot-notation paths into nested objects\n  return expandDotPaths(flat);\n}\n\n/**\n * Normalize a single FormData entry value.\n * - Empty strings → undefined (enables .optional() semantics)\n * - Empty File objects (no selection) → undefined\n * - Everything else passes through as-is\n */\nfunction normalizeValue(value: FormDataEntryValue): unknown {\n  if (typeof value === 'string') {\n    return value === '' ? undefined : value;\n  }\n\n  // File input with no selection: browsers submit a File with name=\"\" and size=0\n  if (value instanceof File && value.size === 0 && value.name === '') {\n    return undefined;\n  }\n\n  return value;\n}\n\n/**\n * Expand dot-notation keys into nested objects.\n * `{ \"user.name\": \"Alice\", \"user.age\": \"30\" }` → `{ user: { name: \"Alice\", age: \"30\" } }`\n *\n * Keys without dots are left as-is. Bracket notation (e.g. `items[0]`) is NOT\n * supported — use dot notation (`items.0`) instead.\n */\nfunction expandDotPaths(flat: Record<string, unknown>): Record<string, unknown> {\n  const result: Record<string, unknown> = {};\n  let hasDotPaths = false;\n\n  // First pass: check if any keys have dots\n  for (const key of Object.keys(flat)) {\n    if (key.includes('.')) {\n      hasDotPaths = true;\n      break;\n    }\n  }\n\n  // Fast path: no dot-notation keys, return as-is.\n  // Top-level dangerous keys are already filtered in `parseFormData` above.\n  if (!hasDotPaths) return flat;\n\n  for (const [key, value] of Object.entries(flat)) {\n    // Reject any path that contains __proto__ / constructor / prototype.\n    // Without this, `__proto__.x=1` writes to Object.prototype because\n    // `result['__proto__']` resolves to the prototype object itself.\n    const parts = key.split('.');\n    if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;\n\n    if (parts.length === 1) {\n      result[parts[0]] = value;\n      continue;\n    }\n\n    let current: Record<string, unknown> = result;\n    for (let i = 0; i < parts.length - 1; i++) {\n      const part = parts[i];\n      if (current[part] === undefined || current[part] === null) {\n        current[part] = {};\n      }\n      // If current[part] is not an object (e.g., a string from a non-dotted key),\n      // the dot-path takes precedence\n      if (typeof current[part] !== 'object' || current[part] instanceof File) {\n        current[part] = {};\n      }\n      current = current[part] as Record<string, unknown>;\n    }\n\n    current[parts[parts.length - 1]] = value;\n  }\n\n  return result;\n}\n\n// `__proto__` is the only key in this parser that escapes the dot-path\n// walk's `typeof !== 'object'` reset: accessing `obj['__proto__']` returns\n// `Object.prototype` (itself an object), so the walk steps into the global\n// prototype and the leaf write mutates it. `constructor` resolves to a\n// function (reset fires) and `prototype` is undefined on fresh objects\n// (reset fires), so neither escapes the walk — they parse as legit nested\n// keys and do not mutate anything global.\nconst DANGEROUS_KEYS = new Set(['__proto__']);\n\n// ─── Coercion Helpers ────────────────────────────────────────────────────\n\n/**\n * Schema-agnostic coercion primitives for common FormData patterns.\n *\n * These are plain transform functions — they compose with any schema library's\n * `transform`/`preprocess` pipeline:\n *\n * ```ts\n * // Zod\n * z.preprocess(coerce.number, z.number())\n * // Valibot\n * v.pipe(v.unknown(), v.transform(coerce.number), v.number())\n * ```\n */\nexport const coerce = {\n  /**\n   * Coerce a string to a number.\n   * - `\"42\"` → `42`\n   * - `\"3.14\"` → `3.14`\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Non-numeric strings → `undefined` (schema validation will catch this)\n   */\n  number(value: unknown): number | undefined {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (typeof value === 'number') return value;\n    if (typeof value !== 'string') return undefined;\n    const num = Number(value);\n    if (Number.isNaN(num)) return undefined;\n    return num;\n  },\n\n  /**\n   * Coerce a checkbox value to a boolean.\n   * HTML checkboxes submit \"on\" when checked and are absent when unchecked.\n   * - `\"on\"` / any truthy string → `true`\n   * - `undefined` / `null` / `\"\"` → `false`\n   */\n  checkbox(value: unknown): boolean {\n    if (value === undefined || value === null || value === '') return false;\n    if (typeof value === 'boolean') return value;\n    // Any non-empty string (typically \"on\") is true\n    return typeof value === 'string' && value.length > 0;\n  },\n\n  /**\n   * Parse a JSON string into an object.\n   * - Valid JSON string → parsed object\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Invalid JSON → `undefined` (schema validation will catch this)\n   */\n  json(value: unknown): unknown {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (typeof value !== 'string') return value;\n    try {\n      return JSON.parse(value);\n    } catch {\n      return undefined;\n    }\n  },\n\n  /**\n   * Coerce a date string to a Date object.\n   * Handles `<input type=\"date\">` (`\"2024-01-15\"`), `<input type=\"datetime-local\">`\n   * (`\"2024-01-15T10:30\"`), and full ISO 8601 strings.\n   * - Valid date string → `Date`\n   * - `\"\"` / `undefined` / `null` → `undefined`\n   * - Invalid date strings → `undefined` (schema validation will catch this)\n   * - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`\n   */\n  date(value: unknown): Date | undefined {\n    if (value === undefined || value === null || value === '') return undefined;\n    if (value instanceof Date) return value;\n    if (typeof value !== 'string') return undefined;\n    const date = new Date(value);\n    if (Number.isNaN(date.getTime())) return undefined;\n\n    // Overflow detection: extract Y/M/D from the input string and verify\n    // they match the parsed Date components. new Date('2024-02-31') silently\n    // normalizes to March 2nd — we reject such inputs.\n    const ymdMatch = value.match(/^(\\d{4})-(\\d{2})-(\\d{2})/);\n    if (ymdMatch) {\n      const inputYear = Number(ymdMatch[1]);\n      const inputMonth = Number(ymdMatch[2]);\n      const inputDay = Number(ymdMatch[3]);\n\n      // Use UTC methods for date-only and Z-suffixed strings to avoid\n      // timezone offset shifting the day. For datetime-local (no Z suffix),\n      // the Date constructor parses in local time, so use local methods.\n      const isUTC = value.length === 10 || value.endsWith('Z');\n      const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();\n      const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;\n      const parsedDay = isUTC ? date.getUTCDate() : date.getDate();\n\n      if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) {\n        return undefined;\n      }\n    }\n\n    return date;\n  },\n\n  /**\n   * Create a File coercion function with optional size and mime type validation.\n   * Returns the File if valid, `undefined` otherwise.\n   *\n   * ```ts\n   * // Basic — just checks it's a real File\n   * z.preprocess(coerce.file(), z.instanceof(File))\n   *\n   * // With constraints\n   * z.preprocess(\n   *   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),\n   *   z.instanceof(File)\n   * )\n   * ```\n   */\n  file(options?: { maxSize?: number; accept?: string[] }): (value: unknown) => File | undefined {\n    return (value: unknown): File | undefined => {\n      if (value === undefined || value === null || value === '') return undefined;\n      if (!(value instanceof File)) return undefined;\n\n      // Empty file input (no selection): browsers submit File with name=\"\" and size=0\n      if (value.size === 0 && value.name === '') return undefined;\n\n      if (options?.maxSize !== undefined && value.size > options.maxSize) {\n        return undefined;\n      }\n\n      if (options?.accept !== undefined && !options.accept.includes(value.type)) {\n        return undefined;\n      }\n\n      return value;\n    };\n  },\n};\n","/**\n * Server action primitives: revalidatePath, revalidateTag, and the action handler.\n *\n * - revalidatePath(path) re-renders the route at that path and returns the RSC\n *   flight payload for inline reconciliation.\n * - revalidateTag(tag) invalidates timber.cache entries by tag.\n *\n * Both are callable from anywhere on the server — actions, API routes, handlers.\n *\n * The action handler processes incoming action requests, validates CSRF,\n * enforces body limits, executes the action, and returns the response\n * (with piggybacked RSC payload if revalidatePath was called).\n *\n * See design/08-forms-and-actions.md\n */\n\nimport { getCacheHandler } from '../cache/handler-store';\nimport { DenySignal, RedirectSignal } from './primitives';\nimport { withSpan } from './tracing';\nimport { revalidationAls, type RevalidationState } from './als-registry.js';\nimport type { HeadElementPayload } from '../shared/head-header.js';\n\n// ─── Types ───────────────────────────────────────────────────────────────\n\n/** Result of rendering a revalidation — element tree before RSC serialization. */\nexport interface RevalidationResult {\n  /** React element tree (pre-serialization — passed to renderToReadableStream). */\n  element: unknown;\n  /** Resolved head elements for metadata (forwarded via X-Timber-Head). */\n  headElements: HeadElementPayload[];\n}\n\n/** Renderer function that builds a React element tree for a given path. */\nexport type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;\n\n// Re-export the type from the registry for public API consumers.\nexport type { RevalidationState } from './als-registry.js';\n\n/** Options for creating the action handler. */\nexport interface ActionHandlerConfig {\n  /** Renderer for producing RSC payloads during revalidation. */\n  renderer?: RevalidateRenderer;\n}\n\n/** Result of handling a server action request. */\nexport interface ActionHandlerResult {\n  /** The action's return value (serialized). */\n  actionResult: unknown;\n  /** Revalidation result if revalidatePath was called (element tree, not yet serialized). */\n  revalidation?: RevalidationResult;\n  /** Redirect location if a RedirectSignal was thrown during revalidation. */\n  redirectTo?: string;\n  /** Redirect status code. */\n  redirectStatus?: number;\n}\n\n// ─── Revalidation State ──────────────────────────────────────────────────\n\n// Per-request revalidation state stored in AsyncLocalStorage (from als-registry.ts).\n// This ensures concurrent requests never share or overwrite each other's state\n// (the previous module-level global was vulnerable to cross-request pollution).\n\n/**\n * Run `fn` inside a revalidation ALS scope.\n * @internal — for tests that call revalidatePath/Tag directly without executeAction().\n */\nexport function _runWithRevalidationState<T>(state: RevalidationState, fn: () => T): T {\n  return revalidationAls.run(state, fn);\n}\n\n/**\n * Get the current revalidation state. Throws if called outside an action context.\n * @internal\n */\nfunction getRevalidationState(): RevalidationState {\n  const state = revalidationAls.getStore();\n  if (!state) {\n    throw new Error(\n      'revalidatePath/revalidateTag called outside of a server action context. ' +\n        'These functions can only be called during action execution.'\n    );\n  }\n  return state;\n}\n\n// ─── Public API ──────────────────────────────────────────────────────────\n\n/**\n * Re-render the route at `path` and include the RSC flight payload in the\n * action response. The client reconciles inline — no separate fetch needed.\n *\n * Can be called from server actions, API routes, or any server-side context.\n *\n * @param path - The path to re-render (e.g. '/dashboard', '/todos').\n */\nexport function revalidatePath(path: string): void {\n  const state = getRevalidationState();\n  if (!state.paths.includes(path)) {\n    state.paths.push(path);\n  }\n}\n\n/**\n * Invalidate all timber.cache entries tagged with `tag`.\n * Does not return a payload — the next request for an invalidated entry re-executes.\n *\n * @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').\n */\nexport function revalidateTag(tag: string): void {\n  const state = getRevalidationState();\n  if (!state.tags.includes(tag)) {\n    state.tags.push(tag);\n  }\n}\n\n// ─── Action Handler ──────────────────────────────────────────────────────\n\n/**\n * Execute a server action and process revalidation.\n *\n * 1. Sets up revalidation state\n * 2. Calls the action function\n * 3. Processes revalidateTag calls (invalidates cache entries)\n * 4. Processes revalidatePath calls (re-renders and captures RSC payload)\n * 5. Returns the action result + optional RSC payload\n *\n * @param actionFn - The server action function to execute.\n * @param args - Arguments to pass to the action.\n * @param config - Handler configuration (cache handler, renderer).\n */\nexport async function executeAction(\n  actionFn: (...args: unknown[]) => Promise<unknown>,\n  args: unknown[],\n  config: ActionHandlerConfig = {},\n  spanMeta?: { actionFile?: string; actionName?: string }\n): Promise<ActionHandlerResult> {\n  const state: RevalidationState = { paths: [], tags: [] };\n  let actionResult: unknown;\n  let redirectTo: string | undefined;\n  let redirectStatus: number | undefined;\n\n  // Run the action inside ALS scope so revalidatePath/Tag resolve to this\n  // request's state object — concurrent requests each get their own scope.\n  await revalidationAls.run(state, async () => {\n    try {\n      actionResult = await withSpan(\n        'timber.action',\n        {\n          ...(spanMeta?.actionFile ? { 'timber.action_file': spanMeta.actionFile } : {}),\n          ...(spanMeta?.actionName ? { 'timber.action_name': spanMeta.actionName } : {}),\n        },\n        () => actionFn(...args)\n      );\n    } catch (error) {\n      if (error instanceof RedirectSignal) {\n        redirectTo = error.location;\n        redirectStatus = error.status;\n      } else {\n        throw error;\n      }\n    }\n  });\n\n  // Process tag invalidation via the module-level cache handler singleton.\n  // setCacheHandler() is called at boot from rsc-entry when timber.config.ts\n  // provides a cacheHandler; otherwise falls back to in-memory LRU (TIM-599).\n  if (state.tags.length > 0) {\n    const handler = getCacheHandler();\n    await Promise.all(state.tags.map((tag) => handler.invalidate({ tag })));\n  }\n\n  // Process path revalidation — build element tree (not yet serialized)\n  let revalidation: RevalidationResult | undefined;\n  if (state.paths.length > 0 && config.renderer) {\n    // For now, render the first revalidated path.\n    // Multiple paths could be supported via multipart streaming in the future.\n    const path = state.paths[0];\n    try {\n      revalidation = await config.renderer(path);\n    } catch (renderError) {\n      if (renderError instanceof RedirectSignal) {\n        // Revalidation triggered a redirect (e.g., session expired,\n        // middleware on the target path called `redirect()`).\n        redirectTo = renderError.location;\n        redirectStatus = renderError.status;\n      } else if (renderError instanceof DenySignal) {\n        // Target path's middleware/access denied this user.\n        //\n        // Dropping the revalidation here is the security boundary added\n        // in TIM-996: without this branch, a DenySignal would fall into\n        // the `console.error` path AND the element tree would have\n        // already been built and serialized — leaking a privileged RSC\n        // payload to the action submitter. By the time the signal\n        // surfaces, the renderer has thrown BEFORE building the tree,\n        // so we simply drop `revalidation` and ship the action result\n        // alone. The action itself still succeeded.\n        console.error(\n          `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`\n        );\n      } else {\n        // Log but don't fail the action — revalidation is best-effort.\n        // Includes input-validation rejections from the renderer\n        // (e.g., revalidatePath('//evil.com/admin')).\n        console.error('[timber] revalidatePath render failed:', renderError);\n      }\n    }\n  }\n\n  return {\n    actionResult,\n    revalidation,\n    ...(redirectTo ? { redirectTo, redirectStatus } : {}),\n  };\n}\n\n/**\n * Build an HTTP Response for a no-JS form submission.\n * Standard POST → 302 redirect pattern.\n *\n * @param redirectPath - Where to redirect after the action executes.\n */\nexport function buildNoJsResponse(redirectPath: string, status: number = 302): Response {\n  return new Response(null, {\n    status,\n    headers: { Location: redirectPath },\n  });\n}\n\n/**\n * Detect whether the incoming request is an RSC action request (with JS)\n * or a plain HTML form POST (no JS).\n *\n * RSC action requests use Accept: text/x-component or Content-Type: text/x-component.\n */\nexport function isRscActionRequest(req: Request): boolean {\n  const accept = req.headers.get('Accept') ?? '';\n  const contentType = req.headers.get('Content-Type') ?? '';\n  return accept.includes('text/x-component') || contentType.includes('text/x-component');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA0BA,SAAgB,kBAAkB,QAAqC;CACrE,MAAM,sBAAM,IAAI,IAAoB;CACpC,IAAI,CAAC,QAAQ,OAAO;CAEpB,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,KAAK,QAAQ,GAAG;EAChC,IAAI,YAAY,IAAI;EACpB,MAAM,OAAO,KAAK,MAAM,GAAG,OAAO,EAAE,KAAK;EACzC,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,EAAE,KAAK;EAC3C,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,GACvB,IAAI,IAAI,MAAM,sBAAsB,KAAK,CAAC;CAE9C;CAEA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,sBAAsB,KAAqB;CACzD,IAAI;EACF,OAAO,mBAAmB,GAAG;CAC/B,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,qBAAqB,OAA4B;CAC/D,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO;CAC7C,MAAM,OAAO,MAAM;CAEnB,IAAI,KAAK,QAAQ,MAAM,KAAK,UAAU,KAAK,QAAQ;CACnD,IAAI,KAAK,MAAM,MAAM,KAAK,QAAQ,KAAK,MAAM;CAC7C,IAAI,KAAK,SAAS,MAAM,KAAK,WAAW,KAAK,QAAQ,YAAY,GAAG;CACpE,IAAI,KAAK,WAAW,KAAA,GAAW,MAAM,KAAK,WAAW,KAAK,QAAQ;CAClE,IAAI,KAAK,UAAU,MAAM,KAAK,UAAU;CACxC,IAAI,KAAK,QAAQ,MAAM,KAAK,QAAQ;CACpC,IAAI,KAAK,UACP,MAAM,KAAK,YAAY,KAAK,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,SAAS,MAAM,CAAC,GAAG;CAEzF,IAAI,KAAK,aAAa,MAAM,KAAK,aAAa;CAE9C,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;;;;;AAWA,SAAgB,eACd,QACgE;CAChE,MAAM,WAAW,OAAO,MAAM,GAAG;CACjC,MAAM,YAAY,SAAS;CAC3B,MAAM,QAAQ,UAAU,QAAQ,GAAG;CACnC,IAAI,SAAS,GAAG,OAAO;CAEvB,MAAM,OAAO,UAAU,MAAM,GAAG,KAAK,EAAE,KAAK;CAC5C,MAAM,QAAQ,UAAU,MAAM,QAAQ,CAAC,EAAE,KAAK;CAC9C,MAAM,UAAyB,CAAC;CAEhC,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;EACxC,MAAM,MAAM,SAAS,GAAG,KAAK;EAC7B,IAAI,CAAC,KAAK;EACV,MAAM,CAAC,UAAU,GAAG,QAAQ,IAAI,MAAM,GAAG;EACzC,MAAM,MAAM,SAAS,KAAK,EAAE,YAAY;EACxC,MAAM,MAAM,KAAK,KAAK,GAAG,EAAE,KAAK;EAChC,QAAQ,KAAR;GACE,KAAK;IACH,QAAQ,OAAO,OAAO;IACtB;GACF,KAAK;IACH,QAAQ,SAAS;IACjB;GACF,KAAK,WAAW;IAId,MAAM,SAAS,OAAO,GAAG;IACzB,IAAI,OAAO,SAAS,MAAM,GAAG,QAAQ,SAAS;IAC9C;GACF;GACA,KAAK;IACH,QAAQ,UAAU,IAAI,KAAK,GAAG;IAC9B;GACF,KAAK,YAAY;IAIf,MAAM,WAAW,IAAI,YAAY;IACjC,IAAI,aAAa,YAAY,aAAa,SAAS,aAAa,QAC9D,QAAQ,WAAW;IAErB;GACF;GACA,KAAK;IACH,QAAQ,SAAS;IACjB;GACF,KAAK;IACH,QAAQ,WAAW;IACnB;GACF,KAAK;IACH,QAAQ,cAAc;IACtB;EACJ;CACF;CAEA,OAAO;EAAE;EAAM;EAAO;CAAQ;AAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3FA,SAAgB,eAA+B;CAC7C,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,uJAEF;CAIF,IAAI,CAAC,MAAM,eACT,MAAM,gBAAgB,kBAAkB,MAAM,YAAY;CAG5D,MAAM,MAAM,MAAM;CAClB,OAAO;EACL,IAAI,MAAkC;GACpC,OAAO,IAAI,IAAI,IAAI;EACrB;EACA,IAAI,MAAuB;GACzB,OAAO,IAAI,IAAI,IAAI;EACrB;EACA,SAAiD;GAC/C,OAAO,MAAM,KAAK,IAAI,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,YAAY;IAAE;IAAM;GAAM,EAAE;EAC3E;EACA,IAAI,OAAe;GACjB,OAAO,IAAI;EACb;EAEA,IAAI,MAAc,OAAe,SAAkC;GACjE,cAAc,OAAO,KAAK;GAG1B,sBAAsB,IAAI;GAI1B,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MACR,+BAA+B,KAAK,UAAU,IAAI,EAAE,oCAAoC,OAAO,MAAM,kLAK/E,KAAK,wBAAwB,KAAK,UAAU,IAAI,EAAE,uDAI/D,KAAK,0FAGhB;GAiBF,MAAM,MAAM,SAAS,QAAQ;GAC7B,MAAM,YAAY,MAAM,QAAQ,mBAAmB,KAAK;GACxD,IAAI,KACF,uBAAuB,MAAM,SAAS;GAExC,IAAI,MAAM,SAAS;IACjB,IAAI,QAAQ,GACV,QAAQ,KACN,sCAAsC,KAAK,oKAG7C;IAEF;GACF;GAGA,MAAM,EAAE,KAAK,MAAM,GAAG,qBAAqB,WAAW,CAAC;GAEvD,MAAM,OAAO;IAAE,GAAG;IAAwB,GAAG;GAAiB;GAC9D,yBAAyB,IAAI;GAC7B,MAAM,UAAU,IAAI,MAAM;IAAE;IAAM,OAAO;IAAW,SAAS;GAAK,CAAC;GAKnE,IAAI,IAAI,MAAM,MAAM,YAAY,KAAK;EACvC;EAEA,eAAe,SAAwB;GACrC,cAAc,OAAO,gBAAgB;GACrC,IAAI,MAAM,SAAS;IACjB,QAAQ,KACN,kNAGF;IACA;GACF;GAGA,KAAK,MAAM,OAAO,QAAQ,aAAa,GAAG;IACxC,MAAM,SAAS,eAAe,GAAG;IACjC,IAAI,QAIF,OAAO,OAAO,KAAK,OAAO,MAAM,OAAO,OAAO,OAAO,OAAO;GAEhE;EACF;EAEA,OAAO,MAAc,SAAwD;GAC3E,cAAc,OAAO,QAAQ;GAI7B,sBAAsB,IAAI;GAC1B,IAAI,MAAM,SAAS;IACjB,IAAI,QAAQ,GACV,QAAQ,KACN,yCAAyC,KAAK,uKAGhD;IAEF;GACF;GACA,MAAM,OAAsB;IAC1B,GAAG;IACH,GAAG;IACH,QAAQ;IACR,yBAAS,IAAI,KAAK,CAAC;GACrB;GAKA,yBAAyB,IAAI;GAC7B,MAAM,UAAU,IAAI,MAAM;IAAE;IAAM,OAAO;IAAI,SAAS;GAAK,CAAC;GAE5D,IAAI,OAAO,IAAI;EACjB;EAEA,QAAc;GACZ,cAAc,OAAO,OAAO;GAC5B,IAAI,MAAM,SAAS;GAEnB,KAAK,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,CAAC,GACtC,MAAM,UAAU,IAAI,MAAM;IACxB;IACA,OAAO;IACP,SAAS;KAAE,GAAG;KAAwB,QAAQ;KAAG,yBAAS,IAAI,KAAK,CAAC;IAAE;GACxE,CAAC;GAEH,IAAI,MAAM;EACZ;EAEA,WAAmB;GAKjB,OAAO,MAAM,KAAK,IAAI,QAAQ,CAAC,EAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,mBAAmB,KAAK,GAAG,EAC7D,KAAK,IAAI;EACd;CACF;AACF;;;;;;AAOA,SAAgB,UAAU,MAAkC;CAE1D,OADY,aACL,EAAI,IAAI,IAAI;AACrB;AA6FA,IAAM,yBAAwC;CAC5C,MAAM;CACN,UAAU;CACV,QAAQ;CACR,UAAU;AACZ;;;;;;;;;;;;;AAgBA,IAAM,uCAAuB,IAAI,QAAsC;;;;;;;;;AA4BvE,SAAgB,qBAAqB,KAA+C;CAClF,MAAM,OAAO,qBAAqB,IAAI,GAAG;CACzC,IAAI,MAAM,qBAAqB,OAAO,GAAG;CACzC,OAAO;AACT;;;;;;;AAqCA,SAAgB,sBAAgC;CAC9C,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,OAAO,MAAM,KAAK,MAAM,UAAU,OAAO,CAAC,EAAE,IAAI,oBAAoB;AACtE;;AAKA,SAAS,cAAc,OAA4B,QAAsB;CACvE,IAAI,CAAC,MAAM,gBACT,MAAM,IAAI,MACR,2BAA2B,OAAO,4GAEpC;AAEJ;;;;;;;;;AAUA,SAAS,OACP,OACA,SACA,MACA,OACA,SACM;CASN,sBAAsB,IAAI;CAC1B,uBAAuB,MAAM,KAAK;CAMlC,yBAAyB,OAAO;CAChC,MAAM,UAAU,IAAI,MAAM;EAAE;EAAM;EAAO;CAAQ,CAAC;CAElD,IAAI,QAAQ,WAAW,GACrB,QAAQ,OAAO,IAAI;MAKnB,QAAQ,IAAI,MAAM,sBAAsB,KAAK,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;AClcA,SAAgB,aAA8B;CAC5C,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,qJAEF;CAEF,OAAO,MAAM;AACf;;;;;;;;;AAUA,SAAgB,UAAU,MAAkC;CAE1D,OADgB,WACT,EAAQ,IAAI,IAAI,KAAK,KAAA;AAC9B;;;;;;AAOA,SAAgB,kBAAmC;CACjD,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,0JAEF;CAEF,OAAO,MAAM;AACf;AAMA,sBAAsB,eAAe;AAKrC,uBAAuB,gBAAgB;;;;;;;;;;;;;AAcvC,SAAgB,iBAAiB,aAAyD;CACxF,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,2JAEF;CAEF,IAAI,CAAC,MAAM,eACT,MAAM,IAAI,MACR,wIAEF;CAOF,IAAI,eAAe,MAAM,eAAe,IAAI,WAAW,GAAG;EACxD,MAAM,aAAa,MAAM,cAAc,IAAI,WAAW;EAItD,OAAO;GAAE,GAAG,MAAM;GAAe,GAAG;EAAW;CACjD;CAOA,IAAI,eAAe,QAAQ,KAAK,MAAM,oBAAoB;EACxD,MAAM,WAAW,uBAAuB,WAAW;EACnD,MAAM,SAAS,uBAAuB,MAAM,kBAAkB;EAC9D,MAAM,UAAU,SAAS,QAAQ,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;EAE1D,IAAI,QAAQ,SAAS,GACnB,QAAQ,KACN,8BAA8B,YAAY,oCAAoC,MAAM,mBAAmB,uBAChF,QAAQ,KAAK,IAAI,EAAE,oEAE5C;CAEJ;CAEA,OAAO,MAAM;AACf;;;;;;;AAQA,SAAgB,iBAAiB,QAAiD;CAChF,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,gBAAgB;AACxB;;;;;;;AA0BA,SAAgB,sBAAsB,aAA2B;CAC/D,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OAAO;CACZ,MAAM,qBAAqB;AAC7B;;;;;;AAOA,SAAS,uBAAuB,OAAyB;CACvD,MAAM,WAAqB,CAAC;CAE5B,MAAM,KAAK;CACX,IAAI;CACJ,QAAQ,IAAI,GAAG,KAAK,KAAK,OAAO,MAC9B,SAAS,KAAK,EAAE,EAAE;CAEpB,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,yBAAiC;CAE/C,OADc,kBAAkB,SACzB,GAAO,gBAAgB;AAChC;;;;;;;;;;;;;AA4BA,SAAgB,sBAAyB,KAAc,IAAgB;CACrE,MAAM,eAAe,IAAI,QAAQ,IAAI,OAAO;CAC5C,MAAM,YAAY,IAAI,IAAI,IAAI,GAAG;CACjC,MAAM,OAAO,qBAAqB,GAAG;CACrC,MAAM,QAA6B;EACjC,SAAS,cAAc,IAAI,OAAO;EAClC,iBAAiB;EAIjB,cAAc,OAAO,KAAM,IAAI,QAAQ,IAAI,QAAQ,KAAK;EACxD,eAAe;EACf,cAAc,UAAU;EACxB,cAAc,UAAU;EACxB,2BAAW,IAAI,IAAI;EACnB,SAAS;EACT,gBAAgB;CAClB;CACA,OAAO,kBAAkB,IAAI,OAAO,EAAE;AACxC;;;;;;;AAQA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,OACF,MAAM,iBAAiB;AAE3B;;;;;;;AAQA,SAAgB,sBAA4B;CAC1C,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,OACF,MAAM,UAAU;AAEpB;;;;;;;;;;;;;AAcA,SAAgB,0BAA0B,SAAwB;CAChE,MAAM,QAAQ,kBAAkB,SAAS;CACzC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,2EAA2E;CAI7F,IAAI,aAAa;CACjB,QAAQ,cAAc;EACpB,aAAa;CACf,CAAC;CACD,IAAI,CAAC,YAAY;CAGjB,MAAM,SAAS,IAAI,QAAQ,MAAM,eAAe;CAChD,QAAQ,SAAS,OAAO,QAAQ;EAC9B,OAAO,IAAI,KAAK,KAAK;CACvB,CAAC;CACD,MAAM,UAAU,cAAc,MAAM;AACtC;AAIA,IAAM,mBAAmB,IAAI,IAAI;CAAC;CAAO;CAAU;AAAQ,CAAC;;;;;;;;;AAU5D,SAAS,cAAc,QAA0B;CAC/C,MAAM,OAAO,IAAI,QAAQ,MAAM;CAC/B,OAAO,IAAI,MAAM,MAAM,EACrB,IAAI,QAAQ,MAAM;EAChB,IAAI,OAAO,SAAS,YAAY,iBAAiB,IAAI,IAAI,GACvD,aAAa;GACX,MAAM,IAAI,MACR,sEACc,KAAK,qGAErB;EACF;EAEF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,IAAI;EAEtC,IAAI,OAAO,UAAU,YACnB,OAAO,MAAM,KAAK,MAAM;EAE1B,OAAO;CACT,EACF,CAAC;AACH;;;;;;;;;;;;;;AC3VA,IAAa,eAAe;CAC1B,MAAM;CACN,SAAS;AACX;;;;;;;;;ACSA,SAAgB,oBAAoB,OAAgB,OAAO,QAAuB;CAChF,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAElD,QAAQ,OAAO,OAAf;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,UACH,OAAO,GAAG,KAAK;EACjB,KAAK,YACH,OAAO,GAAG,KAAK;EACjB,KAAK,UACH,OAAO,GAAG,KAAK;EACjB,KAAK,UACH;EACF,SACE,OAAO,GAAG,KAAK,yBAAyB,OAAO,MAAM;CACzD;CAEA,IAAI,iBAAiB,MACnB,OAAO,GAAG,KAAK;CAEjB,IAAI,iBAAiB,KACnB,OAAO,GAAG,KAAK;CAEjB,IAAI,iBAAiB,KACnB,OAAO,GAAG,KAAK;CAEjB,IAAI,iBAAiB,QACnB,OAAO,GAAG,KAAK;CAEjB,IAAI,iBAAiB,OACnB,OAAO,GAAG,KAAK;CAGjB,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,MAAM,SAAS,oBAAoB,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,EAAE;GAC5D,IAAI,QAAQ,OAAO;EACrB;EACA,OAAO;CACT;CAMA,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,IAAI,UAAU,MACZ,OAAO,GAAG,KAAK;CAEjB,IAAI,UAAU,OAAO,WAEnB,OAAO,GAAG,KAAK,QADD,MAAiB,aAAa,QAAQ,UACxB;CAG9B,KAAK,MAAM,OAAO,OAAO,KAAK,KAAgC,GAAG;EAC/D,MAAM,SAAS,oBAAqB,MAAkC,MAAM,GAAG,KAAK,GAAG,KAAK;EAC5F,IAAI,QAAQ,OAAO;CACrB;CACA,OAAO;AACT;;;;;AAMA,SAAS,sBAAsB,MAAe,YAA0B;CACtE,IAAI,CAAC,QAAQ,GAAG;CAChB,IAAI,SAAS,KAAA,GAAW;CAExB,MAAM,QAAQ,oBAAoB,IAAI;CACtC,IAAI,OACF,QAAQ,KACN,YAAY,WAAW,IAAI,MAAM,oIAGnC;AAEJ;;;;;AAQA,IAAa,aAAb,cAAgC,MAAM;CACpC;CACA;CAEA,YAAY,QAAgB,MAAyB;EACnD,MAAM,6BAA6B,QAAQ;EAC3C,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;;;;;;CAOA,IAAI,aAAiC;EACnC,IAAI,CAAC,KAAK,OAAO,OAAO,KAAA;EACxB,MAAM,SAAS,KAAK,MAAM,MAAM,IAAI;EAGpC,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;GACtC,MAAM,QAAQ,OAAO;GACrB,IAAI,CAAC,OAAO;GAEZ,IAAI,MAAM,SAAS,eAAe,KAAK,MAAM,SAAS,cAAc,GAAG;GAEvE,MAAM,QACJ,MAAM,MAAM,0BAA0B,KAAK,MAAM,MAAM,4BAA4B;GACrF,IAAI,QAAQ,IAAI;IAEd,MAAM,OAAO,MAAM;IACnB,MAAM,SAAS,KAAK,QAAQ,OAAO;IACnC,OAAO,UAAU,IAAI,KAAK,MAAM,SAAS,CAAC,IAAI;GAChD;EACF;CAEF;AACF;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,KAAK,iBAAwC,MAAgC;CAC3F,IAAI;CACJ,IAAI;CAEJ,IAAI,OAAO,oBAAoB,YAAY,oBAAoB,MAAM;EACnE,SAAS,gBAAgB,UAAU;EACnC,eAAe,gBAAgB;CACjC,OAAO;EACL,SAAS,mBAAmB;EAC5B,eAAe;CACjB;CAEA,IAAI,SAAS,OAAO,SAAS,KAC3B,MAAM,IAAI,MAAM,iDAAiD,OAAO,EAAE;CAE5E,sBAAsB,cAAc,QAAQ;CAC5C,MAAM,IAAI,WAAW,QAAQ,YAAY;AAC3C;;;;;AAqBA,IAAa,iBAAb,cAAoC,MAAM;CACxC;CACA;CAEA,YAAY,UAAkB,QAAgB;EAC5C,MAAM,eAAe,UAAU;EAC/B,KAAK,OAAO;EACZ,KAAK,WAAW;EAChB,KAAK,SAAS;CAChB;AACF;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,SAAS,MAAc,iBAAmD;CACxF,IAAI;CACJ,IAAI;CAEJ,IAAI,OAAO,oBAAoB,UAC7B,SAAS;MACJ,IAAI,iBAAiB;EAE1B,SAAS,gBAAgB,WAAW,gBAAgB,YAAY,MAAM;EACtE,uBAAuB,gBAAgB;CACzC,OACE,SAAS;CAGX,IAAI,SAAS,OAAO,SAAS,KAC3B,MAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE;CAIzE,2BAA2B,IAAI;CAE/B,IAAI,eAAe;CACnB,IAAI,sBAEF,eAAe,2BAA2B,MADpB,uBAC0B,GAAe,oBAAoB;CAGrF,MAAM,IAAI,eAAe,cAAc,MAAM;AAC/C;;;;;;;;;;;AAqBA,SAAgB,iBAAiB,KAAa,WAAqB,SAAiB,KAAY;CAC9F,IAAI,SAAS,OAAO,SAAS,KAC3B,MAAM,IAAI,MAAM,sDAAsD,OAAO,EAAE;CAIjF,MAAM,IAAI,eADW,4BAA4B,KAAK,SAC7B,GAAc,MAAM;AAC/C;;;;;;;;;;;;;;;AA8BA,IAAa,cAAb,cAGU,MAAM;CACd;CACA;CACA;CAEA,YAAY,MAAa,MAAa,SAA+B;EACnE,MAAM,gBAAgB,MAAM;EAC5B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;GAAE;GAAM;EAAK;EAE3B,sBAAsB,MAAM,aAAa;EAEzC,MAAM,SAAS,SAAS,UAAU;EAClC,IAAI,SAAS,OAAO,SAAS,KAC3B,MAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE;EAEzE,KAAK,SAAS;CAChB;AACF;AAWA,IAAI,mBAAmB;;;;;;;;;;;;;;;AAgBvB,SAAgB,UAAU,SAA2B,SAAkC;CAErF,MAAM,QAAQ,aAAc;CAC5B,IAAI,OAAO;EACT,MAAM,OAAO;EACb;CACF;CAGA,IAAI,WAAW,OAAO,QAAQ,cAAc,YAAY;EACtD,QAAQ,UAAU,OAAO;EACzB;CACF;CAEA,IAAI,CAAC,kBAAkB;EACrB,mBAAmB;EACnB,QAAQ,KACN,gIAEF;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;ACzZA,SAAgB,cAAc,UAA6C;CACzE,MAAM,OAAgC,CAAC;CAEvC,KAAK,MAAM,OAAO,IAAI,IAAI,SAAS,KAAK,CAAC,GAAG;EAE1C,IAAI,IAAI,WAAW,UAAU,GAAG;EAMhC,IAAI,eAAe,IAAI,GAAG,GAAG;EAG7B,MAAM,YADS,SAAS,OAAO,GACb,EAAO,IAAI,cAAc;EAE3C,IAAI,UAAU,WAAW,GACvB,KAAK,OAAO,UAAU;OAGtB,KAAK,OAAO,UAAU,QAAQ,MAAM,MAAM,KAAA,CAAS;CAEvD;CAGA,OAAO,eAAe,IAAI;AAC5B;;;;;;;AAQA,SAAS,eAAe,OAAoC;CAC1D,IAAI,OAAO,UAAU,UACnB,OAAO,UAAU,KAAK,KAAA,IAAY;CAIpC,IAAI,iBAAiB,QAAQ,MAAM,SAAS,KAAK,MAAM,SAAS,IAC9D;CAGF,OAAO;AACT;;;;;;;;AASA,SAAS,eAAe,MAAwD;CAC9E,MAAM,SAAkC,CAAC;CACzC,IAAI,cAAc;CAGlB,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,GAChC,IAAI,IAAI,SAAS,GAAG,GAAG;EACrB,cAAc;EACd;CACF;CAKF,IAAI,CAAC,aAAa,OAAO;CAEzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;EAI/C,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,MAAM,MAAM,eAAe,IAAI,CAAC,CAAC,GAAG;EAE9C,IAAI,MAAM,WAAW,GAAG;GACtB,OAAO,MAAM,MAAM;GACnB;EACF;EAEA,IAAI,UAAmC;EACvC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,SAAS,GAAG,KAAK;GACzC,MAAM,OAAO,MAAM;GACnB,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,UAAU,MACnD,QAAQ,QAAQ,CAAC;GAInB,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,iBAAiB,MAChE,QAAQ,QAAQ,CAAC;GAEnB,UAAU,QAAQ;EACpB;EAEA,QAAQ,MAAM,MAAM,SAAS,MAAM;CACrC;CAEA,OAAO;AACT;AASA,IAAM,iBAAiB,IAAI,IAAI,CAAC,WAAW,CAAC;;;;;;;;;;;;;;AAiB5C,IAAa,SAAS;;;;;;;;CAQpB,OAAO,OAAoC;EACzC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;EACtC,MAAM,MAAM,OAAO,KAAK;EACxB,IAAI,OAAO,MAAM,GAAG,GAAG,OAAO,KAAA;EAC9B,OAAO;CACT;;;;;;;CAQA,SAAS,OAAyB;EAChC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO;EAClE,IAAI,OAAO,UAAU,WAAW,OAAO;EAEvC,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;CACrD;;;;;;;CAQA,KAAK,OAAyB;EAC5B,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,QAAQ;GACN;EACF;CACF;;;;;;;;;;CAWA,KAAK,OAAkC;EACrC,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;EACtC,MAAM,OAAO,IAAI,KAAK,KAAK;EAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG,OAAO,KAAA;EAKzC,MAAM,WAAW,MAAM,MAAM,0BAA0B;EACvD,IAAI,UAAU;GACZ,MAAM,YAAY,OAAO,SAAS,EAAE;GACpC,MAAM,aAAa,OAAO,SAAS,EAAE;GACrC,MAAM,WAAW,OAAO,SAAS,EAAE;GAKnC,MAAM,QAAQ,MAAM,WAAW,MAAM,MAAM,SAAS,GAAG;GACvD,MAAM,aAAa,QAAQ,KAAK,eAAe,IAAI,KAAK,YAAY;GACpE,MAAM,cAAc,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,IAAI;GACvE,MAAM,YAAY,QAAQ,KAAK,WAAW,IAAI,KAAK,QAAQ;GAE3D,IAAI,cAAc,cAAc,eAAe,eAAe,aAAa,WACzE;EAEJ;EAEA,OAAO;CACT;;;;;;;;;;;;;;;;CAiBA,KAAK,SAAyF;EAC5F,QAAQ,UAAqC;GAC3C,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,IAAI,OAAO,KAAA;GAClE,IAAI,EAAE,iBAAiB,OAAO,OAAO,KAAA;GAGrC,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS,IAAI,OAAO,KAAA;GAElD,IAAI,SAAS,YAAY,KAAA,KAAa,MAAM,OAAO,QAAQ,SACzD;GAGF,IAAI,SAAS,WAAW,KAAA,KAAa,CAAC,QAAQ,OAAO,SAAS,MAAM,IAAI,GACtE;GAGF,OAAO;EACT;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;ACrMA,SAAS,uBAA0C;CACjD,MAAM,QAAQ,gBAAgB,SAAS;CACvC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,qIAEF;CAEF,OAAO;AACT;;;;;;;;;AAYA,SAAgB,eAAe,MAAoB;CACjD,MAAM,QAAQ,qBAAqB;CACnC,IAAI,CAAC,MAAM,MAAM,SAAS,IAAI,GAC5B,MAAM,MAAM,KAAK,IAAI;AAEzB;;;;;;;AAQA,SAAgB,cAAc,KAAmB;CAC/C,MAAM,QAAQ,qBAAqB;CACnC,IAAI,CAAC,MAAM,KAAK,SAAS,GAAG,GAC1B,MAAM,KAAK,KAAK,GAAG;AAEvB;;;;;;;;;;;;;;AAiBA,eAAsB,cACpB,UACA,MACA,SAA8B,CAAC,GAC/B,UAC8B;CAC9B,MAAM,QAA2B;EAAE,OAAO,CAAC;EAAG,MAAM,CAAC;CAAE;CACvD,IAAI;CACJ,IAAI;CACJ,IAAI;CAIJ,MAAM,gBAAgB,IAAI,OAAO,YAAY;EAC3C,IAAI;GACF,eAAe,MAAM,SACnB,iBACA;IACE,GAAI,UAAU,aAAa,EAAE,sBAAsB,SAAS,WAAW,IAAI,CAAC;IAC5E,GAAI,UAAU,aAAa,EAAE,sBAAsB,SAAS,WAAW,IAAI,CAAC;GAC9E,SACM,SAAS,GAAG,IAAI,CACxB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,gBAAgB;IACnC,aAAa,MAAM;IACnB,iBAAiB,MAAM;GACzB,OACE,MAAM;EAEV;CACF,CAAC;CAKD,IAAI,MAAM,KAAK,SAAS,GAAG;EACzB,MAAM,UAAU,gBAAgB;EAChC,MAAM,QAAQ,IAAI,MAAM,KAAK,KAAK,QAAQ,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;CACxE;CAGA,IAAI;CACJ,IAAI,MAAM,MAAM,SAAS,KAAK,OAAO,UAAU;EAG7C,MAAM,OAAO,MAAM,MAAM;EACzB,IAAI;GACF,eAAe,MAAM,OAAO,SAAS,IAAI;EAC3C,SAAS,aAAa;GACpB,IAAI,uBAAuB,gBAAgB;IAGzC,aAAa,YAAY;IACzB,iBAAiB,YAAY;GAC/B,OAAO,IAAI,uBAAuB,YAWhC,QAAQ,MACN,sEAAsE,YAAY,OAAO,EAC3F;QAKA,QAAQ,MAAM,0CAA0C,WAAW;EAEvE;CACF;CAEA,OAAO;EACL;EACA;EACA,GAAI,aAAa;GAAE;GAAY;EAAe,IAAI,CAAC;CACrD;AACF;;;;;;;AAQA,SAAgB,kBAAkB,cAAsB,SAAiB,KAAe;CACtF,OAAO,IAAI,SAAS,MAAM;EACxB;EACA,SAAS,EAAE,UAAU,aAAa;CACpC,CAAC;AACH;;;;;;;AAQA,SAAgB,mBAAmB,KAAuB;CACxD,MAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ,KAAK;CAC5C,MAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;CACvD,OAAO,OAAO,SAAS,kBAAkB,KAAK,YAAY,SAAS,kBAAkB;AACvF"}

package/dist/_chunks/{handler-store-DjISKYEB.js → handler-store-BVDgyTh7.js}

@@ -1,3 +1,27 @@
+import { _ as waitUntilAls } from "./tracing-M_zKubhk.js";
+//#region src/server/waituntil-bridge.ts
+/**
+* Per-request waitUntil bridge — ALS bridge for platform adapters.
+*
+* The generated entry point (Nitro, Cloudflare) wraps the handler with
+* `runWithWaitUntil`, binding the platform's lifecycle extension function
+* (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the
+* request duration. The `waitUntil()` primitive reads from this ALS to
+* dispatch background work to the correct platform API.
+*
+* Design doc: design/11-platform.md §"waitUntil()"
+*/
+/**
+* Get the current request's waitUntil function, if available.
+*
+* Returns undefined when no platform adapter has installed a waitUntil
+* handler for the current request (e.g., on platforms that don't support
+* lifecycle extension, or outside a request context).
+*/
+function getWaitUntil() {
+	return waitUntilAls.getStore();
+}
+//#endregion
 //#region src/cache/handler-store.ts
 var handler = null;
 /** Replace the active cache handler. Called by the framework at boot. */
@@ -49,6 +73,6 @@ function createDefaultHandler() {
 	};
 }
 //#endregion
-export { setCacheHandler as n, getCacheHandler as t };
+export { setCacheHandler as n, getWaitUntil as r, getCacheHandler as t };
 
-//# sourceMappingURL=handler-store-DjISKYEB.js.map
+//# sourceMappingURL=handler-store-BVDgyTh7.js.map

package/dist/_chunks/handler-store-BVDgyTh7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-store-BVDgyTh7.js","names":[],"sources":["../../src/server/waituntil-bridge.ts","../../src/cache/handler-store.ts"],"sourcesContent":["/**\n * Per-request waitUntil bridge — ALS bridge for platform adapters.\n *\n * The generated entry point (Nitro, Cloudflare) wraps the handler with\n * `runWithWaitUntil`, binding the platform's lifecycle extension function\n * (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the\n * request duration. The `waitUntil()` primitive reads from this ALS to\n * dispatch background work to the correct platform API.\n *\n * Design doc: design/11-platform.md §\"waitUntil()\"\n */\n\nimport { waitUntilAls } from './als-registry.js';\n\n/**\n * Run a function with a per-request waitUntil handler installed.\n *\n * Called by generated entry points (Nitro node-server/bun, Cloudflare)\n * to bind the platform's lifecycle extension for the request duration.\n */\nexport function runWithWaitUntil<T>(\n  waitUntilFn: (promise: Promise<unknown>) => void,\n  fn: () => T\n): T {\n  return waitUntilAls.run(waitUntilFn, fn);\n}\n\n/**\n * Get the current request's waitUntil function, if available.\n *\n * Returns undefined when no platform adapter has installed a waitUntil\n * handler for the current request (e.g., on platforms that don't support\n * lifecycle extension, or outside a request context).\n */\nexport function getWaitUntil(): ((promise: Promise<unknown>) => void) | undefined {\n  return waitUntilAls.getStore();\n}\n","/**\n * Module-level cache handler singleton.\n *\n * Lazily initialized to MemoryCacheHandler on first access. The framework\n * replaces this at boot from timber.config.ts via setCacheHandler().\n *\n * This module avoids importing from ./index to prevent circular dependencies.\n */\n\n// Inline the interface to avoid circular import with index.ts\ninterface CacheHandlerLike {\n  get(key: string): Promise<{ value: unknown; stale: boolean } | null>;\n  set(key: string, value: unknown, opts: { ttl: number; tags: string[] }): Promise<void>;\n  invalidate(opts: { key?: string; tag?: string }): Promise<void>;\n}\n\nlet handler: CacheHandlerLike | null = null;\n\n/** Replace the active cache handler. Called by the framework at boot. */\nexport function setCacheHandler(h: CacheHandlerLike): void {\n  handler = h;\n}\n\n/**\n * Get the active cache handler. Creates a default MemoryCacheHandler on\n * first access if none has been set via setCacheHandler().\n */\nexport function getCacheHandler(): CacheHandlerLike {\n  if (!handler) {\n    // Inline a minimal LRU cache to avoid circular dep with index.ts.\n    // In production, the framework always calls setCacheHandler() at boot.\n    handler = createDefaultHandler();\n  }\n  return handler;\n}\n\nfunction createDefaultHandler(): CacheHandlerLike {\n  const store = new Map<string, { value: unknown; expiresAt: number; tags: string[] }>();\n  const maxEntries = 1000;\n\n  return {\n    async get(key) {\n      const entry = store.get(key);\n      if (!entry) return null;\n      store.delete(key);\n      store.set(key, entry);\n      const stale = Date.now() > entry.expiresAt;\n      return { value: entry.value, stale };\n    },\n    async set(key, value, opts) {\n      if (store.has(key)) store.delete(key);\n      while (store.size >= maxEntries) {\n        const oldest = store.keys().next().value;\n        if (oldest !== undefined) store.delete(oldest);\n        else break;\n      }\n      store.set(key, { value, expiresAt: Date.now() + opts.ttl * 1000, tags: opts.tags });\n    },\n    async invalidate(opts) {\n      if (opts.key) store.delete(opts.key);\n      if (opts.tag) {\n        for (const [key, entry] of store) {\n          if (entry.tags.includes(opts.tag)) store.delete(key);\n        }\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,eAAkE;CAChF,OAAO,aAAa,SAAS;AAC/B;;;ACpBA,IAAI,UAAmC;;AAGvC,SAAgB,gBAAgB,GAA2B;CACzD,UAAU;AACZ;;;;;AAMA,SAAgB,kBAAoC;CAClD,IAAI,CAAC,SAGH,UAAU,qBAAqB;CAEjC,OAAO;AACT;AAEA,SAAS,uBAAyC;CAChD,MAAM,wBAAQ,IAAI,IAAmE;CACrF,MAAM,aAAa;CAEnB,OAAO;EACL,MAAM,IAAI,KAAK;GACb,MAAM,QAAQ,MAAM,IAAI,GAAG;GAC3B,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,OAAO,GAAG;GAChB,MAAM,IAAI,KAAK,KAAK;GACpB,MAAM,QAAQ,KAAK,IAAI,IAAI,MAAM;GACjC,OAAO;IAAE,OAAO,MAAM;IAAO;GAAM;EACrC;EACA,MAAM,IAAI,KAAK,OAAO,MAAM;GAC1B,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,OAAO,GAAG;GACpC,OAAO,MAAM,QAAQ,YAAY;IAC/B,MAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;IACnC,IAAI,WAAW,KAAA,GAAW,MAAM,OAAO,MAAM;SACxC;GACP;GACA,MAAM,IAAI,KAAK;IAAE;IAAO,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM;IAAM,MAAM,KAAK;GAAK,CAAC;EACpF;EACA,MAAM,WAAW,MAAM;GACrB,IAAI,KAAK,KAAK,MAAM,OAAO,KAAK,GAAG;GACnC,IAAI,KAAK;SACF,MAAM,CAAC,KAAK,UAAU,OACzB,IAAI,MAAM,KAAK,SAAS,KAAK,GAAG,GAAG,MAAM,OAAO,GAAG;GAAA;EAGzD;CACF;AACF"}

package/dist/_chunks/{href-validation-EZktELp8.js → href-validation-DyZIzfMJ.js}

@@ -95,6 +95,22 @@ function isInternalHref(href) {
 	if (extractScheme(href)) return false;
 	return true;
 }
+/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */
+var ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
+/**
+* Assert that a redirect target is a relative path — rejects absolute and
+* protocol-relative URLs. Used by both the server `redirect()` primitive and
+* the client next/navigation shim so they enforce identical semantics.
+*
+* Normalizes for validation only: strips C0 controls, trims, then replaces
+* backslashes with forward slashes. Browsers normalize \ → / during URL
+* resolution, so "/\evil.com" becomes "//evil.com" (protocol-relative open
+* redirect). See design/13-security.md tests #8, #8a–#8c.
+*/
+function assertRelativeRedirectPath(path) {
+	const cleaned = path.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
+	if (ABSOLUTE_URL_RE.test(cleaned)) throw new Error(`redirect() only accepts relative URLs. Got absolute URL: "${path}". Use redirectExternal(url, allowList) for external redirects.`);
+}
 var SAFE_REDIRECT_SCHEMES = new Set(["http:", "https:"]);
 /**
 * Validate and canonicalize an external redirect URL.
@@ -119,6 +135,6 @@ function validateExternalRedirectUrl(url, allowList) {
 	return parsed.href;
 }
 //#endregion
-export { mergePreservedSearchParams as i, validateExternalRedirectUrl as n, validateNavigationHref as r, isInternalHref as t };
+export { mergePreservedSearchParams as a, validateNavigationHref as i, isInternalHref as n, validateExternalRedirectUrl as r, assertRelativeRedirectPath as t };
 
-//# sourceMappingURL=href-validation-EZktELp8.js.map
+//# sourceMappingURL=href-validation-DyZIzfMJ.js.map

package/dist/_chunks/{href-validation-EZktELp8.js.map → href-validation-DyZIzfMJ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"href-validation-EZktELp8.js","names":[],"sources":["../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG;MACnB,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,GAAG,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAG5E,EAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;AAEA,IAAM,wBAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}
+{"version":3,"file":"href-validation-DyZIzfMJ.js","names":[],"sources":["../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\n/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */\nconst ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\\d+\\-.]*:|\\/\\/)/;\n\n/**\n * Assert that a redirect target is a relative path — rejects absolute and\n * protocol-relative URLs. Used by both the server `redirect()` primitive and\n * the client next/navigation shim so they enforce identical semantics.\n *\n * Normalizes for validation only: strips C0 controls, trims, then replaces\n * backslashes with forward slashes. Browsers normalize \\ → / during URL\n * resolution, so \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open\n * redirect). See design/13-security.md tests #8, #8a–#8c.\n */\nexport function assertRelativeRedirectPath(path: string): void {\n  const cleaned = path.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (ABSOLUTE_URL_RE.test(cleaned)) {\n    throw new Error(\n      `redirect() only accepts relative URLs. Got absolute URL: \"${path}\". ` +\n        'Use redirectExternal(url, allowList) for external redirects.'\n    );\n  }\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG;MACnB,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,GAAG,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAG5E,EAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,2BAA2B,MAAoB;CAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,gBAAgB,KAAK,OAAO,GAC9B,MAAM,IAAI,MACR,6DAA6D,KAAK,gEAEpE;AAEJ;AAEA,IAAM,wBAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}

package/dist/_chunks/{navigation-root-DLc4s4ZC.js → navigation-root-bUDZLw74.js}

@@ -66,6 +66,27 @@ function usePendingNavigation() {
 */
 //#endregion
 //#region src/client/navigation-root.tsx
+var NAV_TRANSITION_KEY = Symbol.for("__timber_nav_transition_counter");
+function getTransitionCounter() {
+	const g = globalThis;
+	if (!g[NAV_TRANSITION_KEY]) g[NAV_TRANSITION_KEY] = { id: 0 };
+	return g[NAV_TRANSITION_KEY];
+}
+/**
+* Invalidate all in-flight navigation transitions. Any navigateTransition()
+* call whose perform() has not yet committed will reject with AbortError
+* instead of committing its element.
+*
+* Called by the router when a render supersedes in-flight navigations
+* WITHOUT going through navigateTransition() — the cached popstate replay
+* renders via transitionRender(), which doesn't bump the counter, so a
+* stale forward navigation's setElement would otherwise pass the
+* `counter.id !== transId` guard and commit the forward page over the
+* replayed back page (TIM-1022).
+*/
+function supersedeNavigationTransitions() {
+	getTransitionCounter().id += 1;
+}
 /**
 * Module-level flag indicating a hard (MPA) navigation is in progress.
 *
@@ -98,6 +119,6 @@ function setHardNavigating(value) {
 	getHardNavStore().value = value;
 }
 //#endregion
-export { usePendingNavigation as n, setHardNavigating as t };
+export { supersedeNavigationTransitions as n, usePendingNavigation as r, setHardNavigating as t };
 
-//# sourceMappingURL=navigation-root-DLc4s4ZC.js.map
+//# sourceMappingURL=navigation-root-bUDZLw74.js.map

package/dist/_chunks/navigation-root-bUDZLw74.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation-root-bUDZLw74.js","names":[],"sources":["../../src/client/use-pending-navigation.ts","../../src/client/top-loader.tsx","../../src/client/navigation-root.tsx"],"sourcesContent":["import { useSyncExternalStore } from 'react';\nimport { getRouterOrNull } from './router-ref.js';\n\nfunction subscribe(onStoreChange: () => void): () => void {\n  const router = getRouterOrNull();\n  if (!router) return () => {};\n  return router.onPendingChange(onStoreChange);\n}\n\nfunction getSnapshot(): boolean {\n  const router = getRouterOrNull();\n  return router ? router.isPending() : false;\n}\n\nconst getServerSnapshot = getSnapshot;\n\n/**\n * Returns true while an RSC navigation is in flight.\n *\n * Reads from the router's external pending store via useSyncExternalStore.\n * Only components that call this hook re-render when pending state\n * changes — no full-tree re-render.\n *\n * ```tsx\n * 'use client'\n * import { usePendingNavigation } from '@timber-js/app/client'\n *\n * export function NavBar() {\n *   const isPending = usePendingNavigation()\n *   return (\n *     <nav className={isPending ? 'opacity-50' : ''}>\n *       <Link href=\"/dashboard\">Dashboard</Link>\n *     </nav>\n *   )\n * }\n * ```\n */\nexport function usePendingNavigation(): boolean {\n  return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);\n}\n","/**\n * TopLoader — Built-in progress bar for client navigations.\n *\n * Shows an animated progress bar at the top of the viewport while an RSC\n * navigation is in flight. Injected automatically by the framework into\n * NavigationRoot — users never render this component directly.\n *\n * Configuration is via timber.config.ts `topLoader` key. Enabled by default.\n * Users who want a fully custom progress indicator disable the built-in one\n * (`topLoader: { enabled: false }`) and use `usePendingNavigation()` directly.\n *\n * Animation approach: pure CSS @keyframes. The bar crawls from 0% to ~90%\n * width over ~30s using ease-out timing. When navigation completes, the bar\n * snaps to 100% and fades out over 200ms. No JS animation loops (RAF, setInterval).\n *\n * Phase transitions are derived synchronously during render (React's\n * getDerivedStateFromProps pattern) — no useEffect needed for state tracking.\n * The finishing → hidden cleanup uses onTransitionEnd from the CSS transition.\n *\n * When delay > 0, CSS animation-delay + a visibility keyframe ensure the bar\n * stays invisible during the delay period. If navigation finishes before the\n * delay, the bar was never visible so the finish transition is also invisible.\n *\n * See design/19-client-navigation.md §\"usePendingNavigation()\"\n * See LOCAL-336 for design decisions.\n */\n\n'use client';\n\nimport { useState, createElement } from 'react';\nimport { usePendingNavigation } from './use-pending-navigation.js';\n\n// ─── Types ───────────────────────────────────────────────────────\n\nexport interface TopLoaderConfig {\n  /** Whether the top-loader is enabled. Default: true. */\n  enabled?: boolean;\n  /** Bar color. Default: '#2299DD'. */\n  color?: string;\n  /** Bar height in pixels. Default: 3. */\n  height?: number;\n  /** Show subtle glow/shadow effect. Default: false. */\n  shadow?: boolean;\n  /** Delay in ms before showing the bar. Default: 0. */\n  delay?: number;\n  /** CSS z-index. Default: 1600. */\n  zIndex?: number;\n}\n\n// ─── Defaults ────────────────────────────────────────────────────\n\nconst DEFAULT_COLOR = '#2299DD';\nconst DEFAULT_HEIGHT = 3;\nconst DEFAULT_SHADOW = false;\nconst DEFAULT_DELAY = 0;\nconst DEFAULT_Z_INDEX = 1600;\n\n// ─── Keyframes ───────────────────────────────────────────────────\n\n// Unique keyframes name to avoid collisions with user styles.\nconst CRAWL_KEYFRAMES = '__timber_top_loader_crawl';\nconst APPEAR_KEYFRAMES = '__timber_top_loader_appear';\nconst FINISH_KEYFRAMES = '__timber_top_loader_finish';\n\n// Track whether the @keyframes rules have been injected into the document.\nlet keyframesInjected = false;\n\n/**\n * Inject the @keyframes rules into the document head once.\n * Called during render (idempotent). Uses a <style> tag so the\n * animations are available for inline-styled elements.\n */\nfunction ensureKeyframes(): void {\n  if (keyframesInjected) return;\n  if (typeof document === 'undefined') return;\n\n  const style = document.createElement('style');\n  style.textContent = `\n@keyframes ${CRAWL_KEYFRAMES} {\n  0% { width: 0%; }\n  100% { width: 90%; }\n}\n@keyframes ${APPEAR_KEYFRAMES} {\n  from { opacity: 0; }\n  to { opacity: 1; }\n}\n@keyframes ${FINISH_KEYFRAMES} {\n  0% { width: 90%; opacity: 1; }\n  50% { width: 100%; opacity: 1; }\n  100% { width: 100%; opacity: 0; }\n}\n`;\n  document.head.appendChild(style);\n  keyframesInjected = true;\n}\n\n// ─── Component ───────────────────────────────────────────────────\n\n/**\n * Internal top-loader component. Injected by NavigationRoot.\n *\n * Reads pending navigation state from PendingNavigationContext.\n * Phase transitions are derived synchronously during render:\n *\n *   hidden → crawling:   when isPending becomes true\n *   crawling → finishing: when isPending becomes false\n *   finishing → hidden:   when CSS transition ends (onTransitionEnd)\n *   finishing → crawling: when isPending becomes true again\n *\n * No useEffect — all state changes are either derived during render\n * (getDerivedStateFromProps pattern) or triggered by DOM events.\n */\nexport function TopLoader({ config }: { config?: TopLoaderConfig }): React.ReactElement | null {\n  // Read pending state from the router's external store via\n  // useSyncExternalStore (inside usePendingNavigation). Only this\n  // component re-renders when pending changes — no full-tree re-render.\n  const isPending = usePendingNavigation();\n\n  const color = config?.color ?? DEFAULT_COLOR;\n  const height = config?.height ?? DEFAULT_HEIGHT;\n  const shadow = config?.shadow ?? DEFAULT_SHADOW;\n  const delay = config?.delay ?? DEFAULT_DELAY;\n  const zIndex = config?.zIndex ?? DEFAULT_Z_INDEX;\n\n  const [phase, setPhase] = useState<'hidden' | 'crawling' | 'finishing'>('hidden');\n\n  // ─── Synchronous phase derivation (getDerivedStateFromProps) ──\n  // React allows setState during render if the value changes — it\n  // immediately re-renders with the updated state before committing.\n\n  if (isPending && (phase === 'hidden' || phase === 'finishing')) {\n    setPhase('crawling');\n  }\n  if (!isPending && phase === 'crawling') {\n    setPhase('finishing');\n  }\n\n  // Inject keyframes on first visible render (idempotent)\n  if (phase !== 'hidden') {\n    ensureKeyframes();\n  }\n\n  if (phase === 'hidden') return null;\n\n  // ─── Styles ──────────────────────────────────────────────────\n\n  const containerStyle: React.CSSProperties = {\n    position: 'fixed',\n    top: 0,\n    left: 0,\n    width: '100%',\n    height: `${height}px`,\n    zIndex,\n    pointerEvents: 'none',\n  };\n\n  const barStyle: React.CSSProperties = {\n    height: '100%',\n    backgroundColor: color,\n    ...(phase === 'crawling'\n      ? {\n          // Crawl from 0% to 90% over 30s. When delay > 0, both the crawl\n          // and a visibility animation are delayed — the bar stays at width 0%\n          // and opacity 0 during the delay, then appears and starts crawling.\n          // With delay 0, the appear animation is instant (0s duration, no delay).\n          animation: [\n            `${CRAWL_KEYFRAMES} 30s ease-out ${delay}ms forwards`,\n            `${APPEAR_KEYFRAMES} 0s ${delay}ms both`,\n          ].join(', '),\n        }\n      : {\n          // Finishing: fill to 100% then fade out via a keyframe animation.\n          // We use a keyframe instead of a CSS transition because the\n          // animation-to-transition handoff is unreliable — the browser\n          // may not capture the animated width as the transition's \"from\"\n          // value when both the animation removal and transition are\n          // applied in the same render frame.\n          animation: `${FINISH_KEYFRAMES} 400ms ease forwards`,\n        }),\n    ...(shadow\n      ? {\n          boxShadow: `0 0 10px ${color}, 0 0 5px ${color}`,\n        }\n      : {}),\n  };\n\n  // Clean up the finishing phase when the finish animation completes.\n  const handleAnimationEnd =\n    phase === 'finishing'\n      ? (e: React.AnimationEvent) => {\n          if (e.animationName === FINISH_KEYFRAMES) {\n            setPhase('hidden');\n          }\n        }\n      : undefined;\n\n  return createElement(\n    'div',\n    {\n      'style': containerStyle,\n      'aria-hidden': 'true',\n      'data-timber-top-loader': '',\n    },\n    createElement('div', { style: barStyle, onAnimationEnd: handleAnimationEnd })\n  );\n}\n","/**\n * NavigationRoot — Wrapper component for transition-based rendering.\n *\n * Solves the \"new boundary has no old content\" problem for client-side\n * navigation. When React renders a completely new Suspense boundary via\n * root.render(), it shows the fallback immediately — root.render() is\n * always an urgent update regardless of startTransition.\n *\n * NavigationRoot holds the current element in React state. Navigation\n * updates call startTransition(() => setState(newElement)), which IS\n * a transition update. React keeps the old committed tree visible while\n * any new Suspense boundaries in the transition resolve.\n *\n * Also manages `pendingUrl` as React state with an urgent/transition split:\n * - Navigation START: `setPendingUrl(url)` is an urgent update — React\n *   commits it before the next paint, showing the spinner immediately.\n * - Navigation END: `setPendingUrl(null)` is inside `startTransition`\n *   alongside `setElement(newTree)` — both commit atomically, so the\n *   spinner disappears in the same frame as the new content appears.\n *\n * Hard navigation guard: When a hard navigation is triggered (500 error,\n * version skew), the component throws an unresolved thenable AFTER all\n * hooks to suspend forever — preventing React from rendering children\n * during page teardown. The throw must come after hooks to satisfy\n * React's rules (same hook count every render) while still preventing\n * child renders that could hit hook count mismatches in components\n * whose positions shift during teardown. This pattern is borrowed from\n * Next.js (app-router.tsx pushRef.mpaNavigation — also after hooks).\n *\n * See design/05-streaming.md §\"deferSuspenseFor\"\n * See design/19-client-navigation.md §\"NavigationContext\"\n */\n\nimport { createElement, Fragment, startTransition, useState, type ReactNode } from 'react';\nimport { PendingNavigationProvider } from './navigation-context.js';\nimport { TopLoader, type TopLoaderConfig } from './top-loader.js';\n\n// ─── Navigation Transition Counter ──────────────────────────────\n// Monotonically increasing counter that increments each time\n// navigateTransition() is called. Used to detect stale transitions:\n// if a newer transition started while the current one's perform()\n// was in flight, the current transition is stale and should reject.\n//\n// Separate from the link-pending navId (which only increments on\n// link clicks). This counter covers all navigation types: link clicks,\n// programmatic navigate(), refresh(), and handlePopState().\n//\n// Uses globalThis for singleton guarantee across chunks — same pattern\n// as NavigationContext and the link pending store.\n\nconst NAV_TRANSITION_KEY = Symbol.for('__timber_nav_transition_counter');\n\nfunction getTransitionCounter(): { id: number } {\n  const g = globalThis as Record<symbol, unknown>;\n  if (!g[NAV_TRANSITION_KEY]) {\n    g[NAV_TRANSITION_KEY] = { id: 0 };\n  }\n  return g[NAV_TRANSITION_KEY] as { id: number };\n}\n\n/**\n * Invalidate all in-flight navigation transitions. Any navigateTransition()\n * call whose perform() has not yet committed will reject with AbortError\n * instead of committing its element.\n *\n * Called by the router when a render supersedes in-flight navigations\n * WITHOUT going through navigateTransition() — the cached popstate replay\n * renders via transitionRender(), which doesn't bump the counter, so a\n * stale forward navigation's setElement would otherwise pass the\n * `counter.id !== transId` guard and commit the forward page over the\n * replayed back page (TIM-1022).\n */\nexport function supersedeNavigationTransitions(): void {\n  getTransitionCounter().id += 1;\n}\n\n// ─── Hard Navigation Guard ──────────────────────────────────────\n\n/**\n * Module-level flag indicating a hard (MPA) navigation is in progress.\n *\n * When true:\n * - NavigationRoot throws an unresolved thenable to suspend forever,\n *   preventing React from rendering children during page teardown\n *   (avoids \"Rendered more hooks\" crashes).\n * - The Navigation API handler skips interception, letting the browser\n *   perform a full page load (prevents infinite loops where\n *   window.location.href → navigate event → router.navigate → 500 →\n *   window.location.href → ...).\n *\n * Uses globalThis for singleton guarantee across chunks (same pattern\n * as NavigationContext). See design/19-client-navigation.md §\"Singleton\n * Guarantee via globalThis\".\n */\nconst HARD_NAV_KEY = Symbol.for('__timber_hard_navigating');\n\nfunction getHardNavStore(): { value: boolean } {\n  const g = globalThis as Record<symbol, unknown>;\n  if (!g[HARD_NAV_KEY]) {\n    g[HARD_NAV_KEY] = { value: false };\n  }\n  return g[HARD_NAV_KEY] as { value: boolean };\n}\n\n/**\n * Set the hard-navigating flag. Call this BEFORE setting\n * window.location.href or window.location.reload() to prevent:\n * 1. React from rendering children during page teardown\n * 2. Navigation API from intercepting the hard navigation\n */\nexport function setHardNavigating(value: boolean): void {\n  getHardNavStore().value = value;\n}\n\n/**\n * Check if a hard navigation is in progress.\n * Used by NavigationRoot (throw unresolvedThenable) and by the\n * Navigation API handler (skip interception).\n */\nexport function isHardNavigating(): boolean {\n  return getHardNavStore().value;\n}\n\n/**\n * A thenable that never resolves. When thrown during React render,\n * it causes the component to suspend forever — React keeps the\n * old committed tree visible and never attempts to render children.\n *\n * This is the same pattern Next.js uses in app-router.tsx for MPA\n * navigations (pushRef.mpaNavigation → throw unresolvedThenable).\n */\n// for React's Suspense mechanism. Same pattern as Next.js's unresolvedThenable.\n// eslint-disable-next-line unicorn/no-thenable -- Intentionally a never-resolving thenable\nconst unresolvedThenable = { then() {} } as PromiseLike<never>;\n\n// ─── Module-level functions ──────────────────────────────────────\n\n/**\n * Module-level reference to the state setter wrapped in startTransition.\n * Used for non-navigation renders (applyRevalidation, popstate replay).\n */\nlet _transitionRender: ((element: ReactNode) => void) | null = null;\n\n/**\n * Module-level reference to the navigation transition function.\n * Wraps a full navigation (fetch + render) in a single startTransition\n * with the pending URL.\n */\nlet _navigateTransition:\n  | ((\n      pendingUrl: string,\n      perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>\n    ) => Promise<void>)\n  | null = null;\n\n// ─── Component ───────────────────────────────────────────────────\n\n/**\n * Root wrapper component that enables transition-based rendering.\n *\n * Renders PendingNavigationProvider around children for the pending URL\n * context. The DOM tree matches the server-rendered HTML during hydration\n * (the provider renders no extra DOM elements).\n *\n * Usage in browser-entry.ts:\n *   const rootEl = createElement(NavigationRoot, { initial: wrapped });\n *   reactRoot = hydrateRoot(document, rootEl);\n *\n * Subsequent navigations:\n *   navigateTransition(url, async () => { fetch; return wrappedElement; });\n *\n * Non-navigation renders:\n *   transitionRender(newWrappedElement);\n */\nexport function NavigationRoot({\n  initial,\n  topLoaderConfig,\n}: {\n  initial: ReactNode;\n  topLoaderConfig?: TopLoaderConfig;\n}): ReactNode {\n  const [element, setElement] = useState<ReactNode>(initial);\n  const [pendingUrl, setPendingUrl] = useState<string | null>(null);\n\n  // NOTE: We use standalone `startTransition` (imported from 'react'),\n  // NOT `useTransition`. The `useTransition` hook's `startTransition`\n  // is tied to a single fiber and tracks one async callback at a time.\n  // When two navigations overlap (click slow-page, then click dashboard),\n  // calling useTransition's startTransition twice with concurrent async\n  // callbacks corrupts React's internal hook tracking — causing\n  // \"Rendered more hooks than during the previous render.\"\n  //\n  // Standalone `startTransition` creates independent transition lanes\n  // for each call, so concurrent navigations don't interfere. We don't\n  // need useTransition's `isPending` — we track pending state via our\n  // own `pendingUrl` useState.\n  //\n  // This matches the Next.js pattern (TIM-625): \"No useTransition in\n  // the router at all — only standalone startTransition.\"\n\n  // Non-navigation render (revalidation, popstate cached replay).\n  _transitionRender = (newElement: ReactNode) => {\n    startTransition(() => {\n      setElement(newElement);\n    });\n  };\n\n  // Full navigation transition.\n  // setPendingUrl(url) is an URGENT update — React commits it before the next\n  // paint, so the pending spinner appears immediately when navigation starts.\n  // Inside startTransition: the async fetch + setElement + setPendingUrl(null)\n  // are deferred. When the transition commits, the new tree and pendingUrl=null\n  // both apply in the same React commit — making the pending→active transition\n  // atomic (no frame where pending is false but the old tree is still visible).\n  _navigateTransition = (\n    url: string,\n    perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>\n  ) => {\n    // Increment the transition counter SYNCHRONOUSLY (before startTransition\n    // schedules the async work). Each call gets a unique transId; the counter\n    // is the same globalThis singleton, so a newer call always has a higher id.\n    const counter = getTransitionCounter();\n    const transId = ++counter.id;\n\n    // NO urgent setPendingUrl here. Per-link pending state is driven by\n    // Link's own useTransition — only the clicked Link re-renders for\n    // isPending. setPendingUrl is set INSIDE startTransition so the\n    // TopLoader activates as a transition update (no full-tree re-render).\n\n    return new Promise<void>((resolve, reject) => {\n      startTransition(async () => {\n        setPendingUrl(url);\n        try {\n          const { element, decodePromise } = await perform();\n          if (counter.id !== transId) {\n            decodePromise?.catch(() => {});\n            reject(new DOMException('Navigation superseded', 'AbortError'));\n            return;\n          }\n          setElement(element);\n          if (decodePromise) await decodePromise;\n          if (counter.id === transId) {\n            setPendingUrl(null);\n            resolve();\n          } else {\n            reject(new DOMException('Navigation superseded', 'AbortError'));\n          }\n        } catch (err) {\n          if (counter.id === transId) {\n            setPendingUrl(null);\n          }\n          reject(err);\n        }\n      });\n    });\n  };\n\n  // ─── Hard navigation guard ─────────────────────────────────\n  // When a hard navigation is in progress (500 error, version skew),\n  // suspend forever to prevent React from rendering children during\n  // page teardown. This avoids \"Rendered more hooks\" crashes in\n  // CHILD components whose hook counts may shift during teardown.\n  //\n  // CRITICAL: This throw MUST come AFTER all hooks (the two\n  // useState calls above). React requires the same hooks to run on\n  // every render. If we threw before hooks, React would see 0 hooks\n  // on the re-render vs 2 hooks on the initial render — triggering\n  // the exact \"Rendered more hooks\" error we're trying to prevent.\n  //\n  // By placing it after hooks but before the return, all hooks\n  // satisfy React's rules, but the thrown thenable prevents any\n  // children from rendering. Same pattern as Next.js app-router.tsx\n  // (pushRef.mpaNavigation — also placed after all hooks).\n  if (isHardNavigating()) {\n    throw unresolvedThenable;\n  }\n\n  // Inject TopLoader alongside the element tree inside PendingNavigationProvider.\n  // The TopLoader reads pendingUrl from context to show/hide the progress bar.\n  // It is rendered only when not explicitly disabled via config.\n  const showTopLoader = topLoaderConfig?.enabled !== false;\n  const children = showTopLoader\n    ? createElement(Fragment, null, createElement(TopLoader, { config: topLoaderConfig }), element)\n    : element;\n  return createElement(PendingNavigationProvider, { value: pendingUrl }, children);\n}\n\n// ─── Public API ──────────────────────────────────────────────────\n\n/**\n * Trigger a transition render for non-navigation updates.\n * React keeps the old committed tree visible while any new Suspense\n * boundaries in the update resolve.\n *\n * Used for: applyRevalidation, popstate replay with cached payload.\n */\nexport function transitionRender(element: ReactNode): void {\n  if (_transitionRender) {\n    _transitionRender(element);\n  }\n}\n\n/**\n * Run a full navigation inside a React transition with optimistic pending URL.\n *\n * The `perform` callback runs inside `startTransition` — it should fetch the\n * RSC payload, update router state, and return the wrapped React element.\n * The pending URL shows immediately (urgent update) and reverts\n * to null when the transition commits (atomic with the new tree).\n *\n * Returns a Promise that resolves when the async work completes (note: the\n * React transition may not have committed yet, but all state updates are done).\n *\n * Used for: navigate(), refresh(), popstate with fetch.\n */\nexport function navigateTransition(\n  pendingUrl: string,\n  perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>\n): Promise<void> {\n  if (_navigateTransition) {\n    return _navigateTransition(pendingUrl, perform);\n  }\n  // Fallback: no NavigationRoot mounted (shouldn't happen in production)\n  return perform().then(() => {});\n}\n\n/**\n * Check if the NavigationRoot is mounted and ready for renders.\n * Used by browser-entry.ts to guard against renders before hydration.\n */\nexport function isNavigationRootReady(): boolean {\n  return _transitionRender !== null;\n}\n\n/**\n * Install one-shot deferred callbacks for the no-RSC bootstrap path (TIM-600).\n *\n * When there's no RSC payload, we can't create a React root immediately —\n * `createRoot(document).render(...)` would blank the SSR HTML. Instead,\n * this sets up `_transitionRender` and `_navigateTransition` so that the\n * first client navigation triggers root creation via `createAndMount`.\n *\n * After `createAndMount` runs, NavigationRoot renders and overwrites these\n * callbacks with its real `startTransition`-based implementations.\n */\nexport function installDeferredNavigation(createAndMount: (initial: ReactNode) => void): void {\n  let mounted = false;\n  const mountOnce = (element: ReactNode) => {\n    if (mounted) return;\n    mounted = true;\n    createAndMount(element);\n  };\n  _transitionRender = (element: ReactNode) => {\n    mountOnce(element);\n  };\n  _navigateTransition = async (\n    _pendingUrl: string,\n    perform: () => Promise<{ element: ReactNode; decodePromise: Promise<void> | null }>\n  ) => {\n    const { element } = await perform();\n    mountOnce(element);\n  };\n}\n"],"mappings":";;;;AAGA,SAAS,UAAU,eAAuC;CACxD,MAAM,SAAS,gBAAgB;CAC/B,IAAI,CAAC,QAAQ,aAAa,CAAC;CAC3B,OAAO,OAAO,gBAAgB,aAAa;AAC7C;AAEA,SAAS,cAAuB;CAC9B,MAAM,SAAS,gBAAgB;CAC/B,OAAO,SAAS,OAAO,UAAU,IAAI;AACvC;AAEA,IAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;AAuB1B,SAAgB,uBAAgC;CAC9C,OAAO,qBAAqB,WAAW,aAAa,iBAAiB;AACvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AEWA,IAAM,qBAAqB,OAAO,IAAI,iCAAiC;AAEvE,SAAS,uBAAuC;CAC9C,MAAM,IAAI;CACV,IAAI,CAAC,EAAE,qBACL,EAAE,sBAAsB,EAAE,IAAI,EAAE;CAElC,OAAO,EAAE;AACX;;;;;;;;;;;;;AAcA,SAAgB,iCAAuC;CACrD,qBAAqB,EAAE,MAAM;AAC/B;;;;;;;;;;;;;;;;;AAoBA,IAAM,eAAe,OAAO,IAAI,0BAA0B;AAE1D,SAAS,kBAAsC;CAC7C,MAAM,IAAI;CACV,IAAI,CAAC,EAAE,eACL,EAAE,gBAAgB,EAAE,OAAO,MAAM;CAEnC,OAAO,EAAE;AACX;;;;;;;AAQA,SAAgB,kBAAkB,OAAsB;CACtD,gBAAgB,EAAE,QAAQ;AAC5B"}