@timber-js/app 0.2.0-alpha.16 → 0.2.0-alpha.160

package/dist/adapters/nitro.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nitro.d.ts","sourceRoot":"","sources":["../../src/adapters/nitro.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAsBnE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,aAAa,GACb,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,KAAK,CAAC;AAEV,2CAA2C;AAC3C,UAAU,YAAY;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAgFD,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,mBAAwB,GAAG,qBAAqB,CA2F9E;AAID,sCAAsC;AACtC,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,QAAQ,UAAO,EACf,eAAe,UAAQ,GACtB,MAAM,CAwFR;AAED,sCAAsC;AACtC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAyBR;AAOD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAsKnF;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sCAAsC;AACtC,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAClB,mBAAmB,GAAG,IAAI,CAY5B;AA8DD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjE"}
+{"version":3,"file":"nitro.d.ts","sourceRoot":"","sources":["../../src/adapters/nitro.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAOnE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,aAAa,GACb,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,KAAK,CAAC;AAEV,2CAA2C;AAC3C,UAAU,YAAY;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAgFD,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,mBAAwB,GAAG,qBAAqB,CAwE9E;AAID,sCAAsC;AACtC,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,QAAQ,UAAO,GACd,MAAM,CAmFR;AAOD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CA+QnF;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sCAAsC;AACtC,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAClB,mBAAmB,GAAG,IAAI,CAY5B;AA+DD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjE"}

package/dist/adapters/nitro.js

@@ -1,110 +1,26 @@
+import { n as IMMUTABLE_CACHE, t as runSharedBuildSteps } from "../_chunks/build-output-helper-DF5uScqS.js";
 import { join, relative } from "node:path";
-import { cp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
+import { transformWithOxc } from "vite";
 import { execFile } from "node:child_process";
+//#region src/server/compress.ts?raw
+var compress_default = "// Response compression for self-hosted deployments (dev server, Nitro preview).\n//\n// Uses CompressionStream (Web Platform API) for gzip. Brotli is intentionally\n// left to CDNs and reverse proxies — at streaming-friendly quality levels its\n// ratio advantage is marginal, and node:zlib's brotli transform buffers output\n// internally, breaking streaming. Cloudflare Workers auto-compress at the edge —\n// this module is only used on Node.js/Bun.\n//\n// See design/25-production-deployments.md.\n\n// ─── Constants ────────────────────────────────────────────────────────────\n\n/**\n * MIME types that benefit from compression.\n * text/* is handled via prefix matching; these are the specific\n * application/* and image/* types that are compressible.\n */\nexport const COMPRESSIBLE_TYPES = new Set([\n  'text/html',\n  'text/css',\n  'text/plain',\n  'text/xml',\n  'text/javascript',\n  'text/x-component',\n  'application/json',\n  'application/javascript',\n  'application/xml',\n  'application/xhtml+xml',\n  'application/rss+xml',\n  'application/atom+xml',\n  'image/svg+xml',\n]);\n\n/**\n * Status codes that should never be compressed (no body or special semantics).\n */\nconst NO_COMPRESS_STATUSES = new Set([204, 304]);\n\n// ─── Encoding Negotiation ─────────────────────────────────────────────────\n\n/**\n * Parse Accept-Encoding and return the best supported encoding.\n * Returns 'gzip' if the client accepts it, null otherwise.\n *\n * Brotli (br) is intentionally not handled at the application level.\n * At the streaming-friendly quality levels (0–4), brotli's compression\n * ratio advantage over gzip is marginal, and node:zlib's brotli transform\n * buffers output internally — turning smooth streaming responses into\n * large infrequent bursts. Brotli's real wins come from offline/static\n * compression at higher quality levels (5–11), which CDNs and reverse\n * proxies (Cloudflare, nginx, Caddy) apply on cached responses.\n *\n * See design/25-production-deployments.md.\n */\nexport function negotiateEncoding(acceptEncoding: string): 'gzip' | null {\n  if (!acceptEncoding) return null;\n\n  // Parse tokens with quality values from the Accept-Encoding header.\n  // Per RFC 9110 §12.5.3, q=0 means \"not acceptable\" — the client explicitly\n  // rejects that encoding. Tokens without a q-value default to q=1.\n  // e.g. \"gzip;q=1.0, br;q=0\" → gzip is acceptable, br is rejected.\n  const parts = acceptEncoding.split(',');\n  for (const part of parts) {\n    const [token, ...params] = part.split(';');\n    const name = token.trim().toLowerCase();\n    if (name !== 'gzip') continue;\n\n    // Check for q=0 (explicitly disabled)\n    let qValue = 1; // default quality is 1\n    for (const param of params) {\n      const trimmed = param.trim().toLowerCase();\n      if (trimmed.startsWith('q=')) {\n        qValue = parseFloat(trimmed.slice(2));\n        if (Number.isNaN(qValue)) qValue = 1;\n        break;\n      }\n    }\n\n    if (qValue > 0) return 'gzip';\n  }\n\n  return null;\n}\n\n// ─── Compressibility Check ────────────────────────────────────────────────\n\n/**\n * Determine if a response should be compressed.\n *\n * Returns false for:\n * - Responses without a body (204, 304, null body)\n * - Already-encoded responses (Content-Encoding set)\n * - Non-compressible content types (images, binary)\n * - SSE streams (text/event-stream — must not be buffered)\n */\nexport function shouldCompress(response: Response): boolean {\n  // No body to compress\n  if (!response.body) return false;\n  if (NO_COMPRESS_STATUSES.has(response.status)) return false;\n\n  // Already compressed\n  if (response.headers.has('Content-Encoding')) return false;\n\n  // Check content type\n  const contentType = response.headers.get('Content-Type');\n  if (!contentType) return false;\n\n  // Extract the MIME type (strip charset and other parameters)\n  const mimeType = contentType.split(';')[0].trim().toLowerCase();\n\n  // SSE must not be compressed — it relies on chunk-by-chunk delivery\n  if (mimeType === 'text/event-stream') return false;\n\n  return COMPRESSIBLE_TYPES.has(mimeType);\n}\n\n// ─── Compression ──────────────────────────────────────────────────────────\n\n/**\n * Compress a Web Response if the client supports it and the content is compressible.\n *\n * Returns the original response unchanged if compression is not applicable.\n * Returns a new Response with the compressed body, Content-Encoding, and Vary headers.\n *\n * The body is piped through a compression stream — no buffering of the full response.\n * This preserves streaming behavior for HTML shell + deferred Suspense chunks.\n */\nexport function compressResponse(request: Request, response: Response): Response {\n  // Check if response is compressible\n  if (!shouldCompress(response)) return response;\n\n  // Negotiate encoding with the client\n  const acceptEncoding = request.headers.get('Accept-Encoding') ?? '';\n  const encoding = negotiateEncoding(acceptEncoding);\n  if (!encoding) return response;\n\n  // Compress the body stream with gzip via the Web Platform CompressionStream API.\n  const compressedBody = compressWithGzip(response.body!);\n\n  // Build new headers: copy originals, add compression headers, remove Content-Length\n  // (compressed size is unknown until streaming completes).\n  const headers = new Headers(response.headers);\n  headers.set('Content-Encoding', encoding);\n  headers.delete('Content-Length');\n\n  // Append to Vary header (preserve existing Vary values)\n  const existingVary = headers.get('Vary');\n  if (existingVary) {\n    if (!existingVary.toLowerCase().includes('accept-encoding')) {\n      headers.set('Vary', `${existingVary}, Accept-Encoding`);\n    }\n  } else {\n    headers.set('Vary', 'Accept-Encoding');\n  }\n\n  return new Response(compressedBody, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\n// ─── Gzip (node:zlib with Z_SYNC_FLUSH) ──────────────────────────────────\n//\n// Uses node:zlib's createGzip with Z_SYNC_FLUSH so each chunk is flushed\n// to the output immediately. The Web Platform CompressionStream API buffers\n// internally and does NOT flush per-chunk — this kills streaming because\n// the browser doesn't receive the HTML shell until the gzip stream closes\n// (i.e. after all Suspense boundaries resolve).\n//\n// Z_SYNC_FLUSH adds ~2–5% size overhead vs Z_NO_FLUSH but preserves\n// correct streaming behavior: the shell renders instantly, Suspense\n// fallbacks are visible immediately, and streamed content appears\n// progressively.\n\nimport { createGzip, constants } from 'node:zlib';\nimport { Readable, pipeline } from 'node:stream';\n\n/**\n * Compress a ReadableStream with gzip, flushing each chunk immediately.\n *\n * Uses node:zlib's createGzip with Z_SYNC_FLUSH to ensure each HTML chunk\n * (shell, Suspense resolution, RSC payload) is delivered to the browser\n * as soon as it's available — preserving streaming semantics.\n */\nfunction compressWithGzip(body: ReadableStream<Uint8Array>): ReadableStream<Uint8Array> {\n  const gzip = createGzip({ flush: constants.Z_SYNC_FLUSH });\n  const nodeInput = Readable.fromWeb(body as import('stream/web').ReadableStream);\n\n  // pipeline() instead of bare pipe(): pipe() does not forward source errors,\n  // so an erroring body (streaming route handler, dropped upstream fetch)\n  // would emit an unhandled 'error' event and crash the process. pipeline()\n  // destroys gzip on source error — the returned web stream rejects — and\n  // tears down nodeInput when the consumer cancels the web stream, which\n  // cancels the source body via fromWeb. The error reaches the consumer\n  // through the web stream; the callback only marks it handled at the Node\n  // layer.\n  pipeline(nodeInput, gzip, () => {});\n\n  return Readable.toWeb(gzip) as ReadableStream<Uint8Array>;\n}\n";
+//#endregion
 //#region src/adapters/compress-module.ts
 /**
-* Generate a standalone ESM module that exports compressResponse().
+* Compile server/compress.ts into a standalone ESM module.
 *
-* Written to `_compress.mjs` during buildOutput. Imported by the Nitro entry
-* and preview server.
+* Uses Vite's OXC transform to strip TypeScript types from the
+* embedded source. The result is written to `_compress.mjs` during
+* buildOutput.
 *
 * @internal Exported for testing.
 */
-function generateCompressModule() {
-	return `// Generated by @timber-js/app — response compression for self-hosted deployments.
-// Do not edit — this file is regenerated on each build.
-// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse
-// proxies — at streaming quality levels its ratio advantage is marginal and
-// node:zlib buffers output internally, breaking streaming.
-
-const COMPRESSIBLE_TYPES = new Set([
-  'text/html', 'text/css', 'text/plain', 'text/xml', 'text/javascript',
-  'text/x-component', 'application/json', 'application/javascript',
-  'application/xml', 'application/xhtml+xml', 'application/rss+xml',
-  'application/atom+xml', 'image/svg+xml',
-]);
-
-const NO_COMPRESS_STATUSES = new Set([204, 304]);
-
-function negotiateEncoding(acceptEncoding) {
-  if (!acceptEncoding) return null;
-  // Parse tokens with quality values. Per RFC 9110 §12.5.3, q=0 means
-  // "not acceptable" — the client explicitly rejects that encoding.
-  // Brotli (br) is intentionally not handled at the application level.
-  const parts = acceptEncoding.split(',');
-  for (const part of parts) {
-    const [token, ...params] = part.split(';');
-    const name = token.trim().toLowerCase();
-    if (name !== 'gzip') continue;
-    let qValue = 1;
-    for (const param of params) {
-      const trimmed = param.trim().toLowerCase();
-      if (trimmed.startsWith('q=')) {
-        qValue = parseFloat(trimmed.slice(2));
-        if (Number.isNaN(qValue)) qValue = 1;
-        break;
-      }
-    }
-    if (qValue > 0) return 'gzip';
-  }
-  return null;
-}
-
-function shouldCompress(response) {
-  if (!response.body) return false;
-  if (NO_COMPRESS_STATUSES.has(response.status)) return false;
-  if (response.headers.has('Content-Encoding')) return false;
-  const contentType = response.headers.get('Content-Type');
-  if (!contentType) return false;
-  const mimeType = contentType.split(';')[0].trim().toLowerCase();
-  if (mimeType === 'text/event-stream') return false;
-  return COMPRESSIBLE_TYPES.has(mimeType);
-}
-
-function compressWithGzip(body) {
-  return body.pipeThrough(new CompressionStream('gzip'));
-}
-
-export function compressResponse(request, response) {
-  if (!shouldCompress(response)) return response;
-  const acceptEncoding = request.headers.get('Accept-Encoding') || '';
-  const encoding = negotiateEncoding(acceptEncoding);
-  if (!encoding) return response;
-  const compressedBody = compressWithGzip(response.body);
-  const headers = new Headers(response.headers);
-  headers.set('Content-Encoding', encoding);
-  headers.delete('Content-Length');
-  const existingVary = headers.get('Vary');
-  if (existingVary) {
-    if (!existingVary.toLowerCase().includes('accept-encoding')) {
-      headers.set('Vary', existingVary + ', Accept-Encoding');
-    }
-  } else {
-    headers.set('Vary', 'Accept-Encoding');
-  }
-  return new Response(compressedBody, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
-}
-`;
+async function generateCompressModule() {
+	return "// Generated by @timber-js/app — compiled from server/compress.ts.\n// Do not edit — this file is regenerated on each build.\n" + (await transformWithOxc(compress_default, "compress.ts", { lang: "ts" })).code;
 }
 //#endregion
 //#region src/adapters/nitro.ts
-var IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
-var STATIC_CACHE = "public, max-age=3600, must-revalidate";
-function generateHeadersFile() {
-	return `# Auto-generated by @timber-js/app — static asset cache headers.
-# See design/25-production-deployments.md §"CDN / Edge Cache"
-
-/assets/*
-  Cache-Control: ${IMMUTABLE_CACHE}
-
-/*
-  Cache-Control: ${STATIC_CACHE}
-`;
-}
 var PRESET_CONFIGS = {
 	"vercel": {
 		nitroPreset: "vercel",
@@ -196,19 +112,13 @@ function nitro(options = {}) {
 		name: `nitro-${preset}`,
 		async buildOutput(config, buildDir) {
 			const outDir = join(buildDir, "nitro");
-			await mkdir(outDir, { recursive: true });
-			const clientDir = join(buildDir, "client");
-			const publicDir = join(outDir, "public");
-			await mkdir(publicDir, { recursive: true });
-			await cp(clientDir, publicDir, {
-				recursive: true,
-				filter: config.clientJavascriptDisabled ? (src) => !src.endsWith(".js") : void 0
-			}).catch(() => {});
-			await writeFile(join(publicDir, "_headers"), generateHeadersFile());
-			if (config.manifestInit) await writeFile(join(outDir, "_timber-manifest-init.js"), config.manifestInit);
-			await writeFile(join(outDir, "_compress.mjs"), generateCompressModule());
-			await cp(join(buildDir, "rsc"), join(outDir, "rsc"), { recursive: true });
-			await cp(join(buildDir, "ssr"), join(outDir, "ssr"), { recursive: true }).catch(() => {});
+			await runSharedBuildSteps({
+				config,
+				buildDir,
+				outDir,
+				publicDirName: "public"
+			});
+			await writeFile(join(outDir, "_compress.mjs"), await generateCompressModule());
 			if (config.manifestInit) {
 				const rscEntry = join(outDir, "rsc", "index.js");
 				const rscContent = await readFile(rscEntry, "utf-8");
@@ -233,7 +143,7 @@ function nitro(options = {}) {
 	};
 }
 /** @internal Exported for testing. */
-function generateNitroEntry(buildDir, outDir, preset, compress = true, hasManifestInit = false) {
+function generateNitroEntry(buildDir, outDir, preset, compress = true) {
 	const serverEntryRelative = "./rsc/index.js";
 	const runtimeName = PRESET_CONFIGS[preset].runtimeName;
 	const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;
@@ -274,7 +184,7 @@ function generateNitroEntry(buildDir, outDir, preset, compress = true, hasManife
 	return `// Generated by @timber-js/app/adapters/nitro
 // Do not edit — this file is regenerated on each build.
 
-${hasManifestInit ? "import './_timber-manifest-init.js'\n" : ""}import handler, { runWithEarlyHintsSender${supportsWaitUntil ? ", runWithWaitUntil" : ""} } from '${serverEntryRelative}'
+import handler, { runWithEarlyHintsSender${supportsWaitUntil ? ", runWithWaitUntil" : ""} } from '${serverEntryRelative}'
 ${compress ? "import { compressResponse } from './_compress.mjs'\n" : ""}
 // Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.
 // See design/25-production-deployments.md §"TIMBER_RUNTIME".
@@ -293,27 +203,8 @@ ${handlerCall}
 }
 `;
 }
-/** @internal Exported for testing. */
-function generateNitroConfig(preset, userConfig) {
-	const presetConfig = PRESET_CONFIGS[preset];
-	const config = {
-		preset: presetConfig.nitroPreset,
-		entry: "./entry.ts",
-		output: { dir: presetConfig.outputDir },
-		routeRules: { "/assets/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } } },
-		...presetConfig.extraConfig,
-		...userConfig
-	};
-	return `// Generated by @timber-js/app/adapters/nitro
-// Do not edit — this file is regenerated on each build.
-
-import { defineNitroConfig } from 'nitro/config'
-
-export default defineNitroConfig(${JSON.stringify(config, null, 2)})
-`;
-}
 /** Presets that produce a locally-runnable server entry. */
-var LOCALLY_PREVIEWABLE = new Set(["node-server", "bun"]);
+var LOCALLY_PREVIEWABLE = /* @__PURE__ */ new Set(["node-server", "bun"]);
 /**
 * Generate a standalone preview server script that uses Node's built-in
 * HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports
@@ -379,11 +270,32 @@ const MIME_TYPES = {
 };
 
 const publicDir = join(__dirname, '${publicDir}');
-const port = parseInt(process.env.PORT || '3000', 10);
+
+// Port resolution (TIM-842):
+//   - Default to 3000
+//   - If PORT env var is set, honor it strictly (fail loudly on conflict)
+//   - Otherwise auto-bump from 3000 until a free port is found
+// Mirrors the dev server behavior so timber dev/preview/production all
+// behave the same way around port selection.
+const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : null;
+const portIsExplicit = envPort != null && Number.isFinite(envPort) && envPort > 0;
+const startPort = portIsExplicit ? envPort : 3000;
 const host = process.env.HOST || process.env.HOSTNAME || 'localhost';
 
+// Set after listenWithBump() resolves so request handlers can build
+// absolute URLs from the actual bound port (which may differ from
+// startPort after an auto-bump).
+let boundPort = startPort;
+
 const server = createServer(async (req, res) => {
-  const url = new URL(req.url || '/', \`http://\${host}:\${port}\`);
+  // Scheme from the socket's TLS state — a hardcoded http:// breaks CSRF
+  // origin comparison and absolute-URL construction when TLS is terminated
+  // at this server (TIM-1073; mirrors the dev-server fix in TIM-1067).
+  // X-Forwarded-Proto is intentionally not consulted here: on a direct
+  // connection it would be attacker-controlled. The CSRF layer honors it
+  // separately for reverse-proxy deployments.
+  const scheme = req.socket?.encrypted ? 'https' : 'http';
+  const url = new URL(req.url || '/', \`\${scheme}://\${host}:\${boundPort}\`);
 
   // Try serving static files from the public directory first.
   const filePath = join(publicDir, url.pathname);
@@ -396,7 +308,9 @@ const server = createServer(async (req, res) => {
         const contentType = MIME_TYPES[ext] || 'application/octet-stream';
         const body = await readFile(filePath);
         // Hashed assets get immutable cache, others get short cache.
-        const cacheControl = url.pathname.startsWith('/assets/')
+        const isImmutable =
+          url.pathname.startsWith('/assets/') || url.pathname.startsWith('/_timber/fonts/');
+        const cacheControl = isImmutable
           ? 'public, max-age=31536000, immutable'
           : 'public, max-age=3600, must-revalidate';
         res.writeHead(200, {
@@ -454,18 +368,64 @@ const server = createServer(async (req, res) => {
     const webResponse = compressResponse(webRequest, rawResponse);
 
     // Write the response back to the Node response.
-    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));
+    //
+    // Set-Cookie needs special handling: Headers.entries() joins multiple
+    // Set-Cookie values with ", " into a single entry, but each cookie must
+    // be its own header per RFC 6265 §4.1. Object.fromEntries() would then
+    // collapse them into one malformed Set-Cookie header that browsers reject
+    // (or only honor partially). Use getSetCookie() to preserve individual
+    // values, and pass them as an array — Node's writeHead accepts
+    // Record<string, string | string[]> and emits one header per array entry.
+    //
+    // Without this, EVERY cookie set by the framework on Node—/Nitro deployments
+    // is silently dropped: defineCookie().setCookie() in actions, middleware
+    // cookie writes, the framework's own session cookies, all of it. See
+    // LOCAL-741.
+    const responseHeaders = {};
+    webResponse.headers.forEach((value, key) => {
+      if (key.toLowerCase() !== 'set-cookie') {
+        responseHeaders[key] = value;
+      }
+    });
+    const setCookies = webResponse.headers.getSetCookie();
+    if (setCookies.length > 0) {
+      responseHeaders['set-cookie'] = setCookies;
+    }
+    res.writeHead(webResponse.status, responseHeaders);
 
     if (webResponse.body) {
       const reader = webResponse.body.getReader();
-      const pump = async () => {
+
+      // Cancel the reader when the client disconnects. This causes any
+      // pending reader.read() to reject, breaking the pump loop. Critical
+      // for SSE and other infinite streams — without this, disconnected
+      // clients leak readers.
+      let clientDisconnected = false;
+      const onClose = () => {
+        clientDisconnected = true;
+        reader.cancel('Client disconnected').catch(() => {});
+      };
+      res.on('close', onClose);
+
+      try {
         while (true) {
           const { done, value } = await reader.read();
-          if (done) { res.end(); return; }
+          if (done) break;
           res.write(value);
         }
-      };
-      await pump();
+      } catch (err) {
+        // reader.cancel() from the close handler causes read() to reject.
+        // This is expected on client disconnect — not an error.
+        if (!clientDisconnected) {
+          throw err;
+        }
+      } finally {
+        res.off('close', onClose);
+        reader.releaseLock();
+        if (!res.writableEnded) {
+          res.end();
+        }
+      }
     } else {
       res.end();
     }
@@ -478,13 +438,49 @@ const server = createServer(async (req, res) => {
   }
 });
 
-server.listen(port, host, () => {
+function listenWithBump(port, attempt = 0) {
+  return new Promise((resolveListen, rejectListen) => {
+    const onError = (err) => {
+      server.removeListener('listening', onListening);
+      if (err && err.code === 'EADDRINUSE' && !portIsExplicit && attempt < 100) {
+        if (attempt === 0) {
+          console.log(\`  [timber] Port \${port} in use, trying \${port + 1}...\`);
+        }
+        listenWithBump(port + 1, attempt + 1).then(resolveListen, rejectListen);
+        return;
+      }
+      rejectListen(err);
+    };
+    const onListening = () => {
+      server.removeListener('error', onError);
+      resolveListen(port);
+    };
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen(port, host);
+  });
+}
+
+try {
+  boundPort = await listenWithBump(startPort);
+  if (boundPort !== startPort) {
+    console.log();
+    console.log(\`  [timber] Port \${startPort} in use, using \${boundPort}\`);
+  }
   console.log();
   console.log('  ⚡ timber preview server running at:');
   console.log();
-  console.log(\`    ➜  http://\${host}:\${port}\`);
+  console.log(\`    ➜  http://\${host}:\${boundPort}\`);
   console.log();
-});
+} catch (err) {
+  if (err && err.code === 'EADDRINUSE') {
+    console.error(\`[timber] Port \${startPort} is already in use. \` +
+      'Set PORT to a free port, or unset PORT to auto-pick.');
+  } else {
+    console.error('[timber] Failed to start preview server:', err);
+  }
+  process.exit(1);
+}
 `;
 }
 /** @internal Exported for testing. */
@@ -512,7 +508,10 @@ async function runNitroBuild(nitroDir, preset, userConfig) {
 		preset: presetConfig.nitroPreset,
 		renderer: { handler: join(nitroDir, "entry.ts") },
 		output: { dir: join(nitroDir, presetConfig.outputDir) },
-		routeRules: { "/assets/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } } },
+		routeRules: {
+			"/assets/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } },
+			"/_timber/fonts/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } }
+		},
 		rollupConfig: { external: [/\.\.\/rsc\//] },
 		...presetConfig.extraConfig,
 		...userConfig
@@ -541,6 +540,6 @@ function getPresetConfig(preset) {
 	return PRESET_CONFIGS[preset];
 }
 //#endregion
-export { generateNitroConfig, generateNitroEntry, generateNitroPreviewCommand, generatePreviewScript, getPresetConfig, nitro };
+export { generateNitroEntry, generateNitroPreviewCommand, generatePreviewScript, getPresetConfig, nitro };
 
 //# sourceMappingURL=nitro.js.map

package/dist/adapters/nitro.js.map

@@ -1 +1 @@
-{"version":3,"file":"nitro.js","names":[],"sources":["../../src/adapters/compress-module.ts","../../src/adapters/nitro.ts"],"sourcesContent":["// Generated compression module template for self-hosted deployments.\n//\n// This file generates a standalone ESM module (_compress.mjs) that is\n// written to the build output during adapter buildOutput(). It's imported\n// by the Nitro entry and preview server at runtime.\n//\n// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal and\n// node:zlib buffers output internally, breaking streaming.\n// Cloudflare Workers don't need this — the edge auto-compresses.\n//\n// See design/25-production-deployments.md.\n\n/**\n * Generate a standalone ESM module that exports compressResponse().\n *\n * Written to `_compress.mjs` during buildOutput. Imported by the Nitro entry\n * and preview server.\n *\n * @internal Exported for testing.\n */\nexport function generateCompressModule(): string {\n  return `// Generated by @timber-js/app — response compression for self-hosted deployments.\n// Do not edit — this file is regenerated on each build.\n// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal and\n// node:zlib buffers output internally, breaking streaming.\n\nconst COMPRESSIBLE_TYPES = new Set([\n  'text/html', 'text/css', 'text/plain', 'text/xml', 'text/javascript',\n  'text/x-component', 'application/json', 'application/javascript',\n  'application/xml', 'application/xhtml+xml', 'application/rss+xml',\n  'application/atom+xml', 'image/svg+xml',\n]);\n\nconst NO_COMPRESS_STATUSES = new Set([204, 304]);\n\nfunction negotiateEncoding(acceptEncoding) {\n  if (!acceptEncoding) return null;\n  // Parse tokens with quality values. Per RFC 9110 §12.5.3, q=0 means\n  // \"not acceptable\" — the client explicitly rejects that encoding.\n  // Brotli (br) is intentionally not handled at the application level.\n  const parts = acceptEncoding.split(',');\n  for (const part of parts) {\n    const [token, ...params] = part.split(';');\n    const name = token.trim().toLowerCase();\n    if (name !== 'gzip') continue;\n    let qValue = 1;\n    for (const param of params) {\n      const trimmed = param.trim().toLowerCase();\n      if (trimmed.startsWith('q=')) {\n        qValue = parseFloat(trimmed.slice(2));\n        if (Number.isNaN(qValue)) qValue = 1;\n        break;\n      }\n    }\n    if (qValue > 0) return 'gzip';\n  }\n  return null;\n}\n\nfunction shouldCompress(response) {\n  if (!response.body) return false;\n  if (NO_COMPRESS_STATUSES.has(response.status)) return false;\n  if (response.headers.has('Content-Encoding')) return false;\n  const contentType = response.headers.get('Content-Type');\n  if (!contentType) return false;\n  const mimeType = contentType.split(';')[0].trim().toLowerCase();\n  if (mimeType === 'text/event-stream') return false;\n  return COMPRESSIBLE_TYPES.has(mimeType);\n}\n\nfunction compressWithGzip(body) {\n  return body.pipeThrough(new CompressionStream('gzip'));\n}\n\nexport function compressResponse(request, response) {\n  if (!shouldCompress(response)) return response;\n  const acceptEncoding = request.headers.get('Accept-Encoding') || '';\n  const encoding = negotiateEncoding(acceptEncoding);\n  if (!encoding) return response;\n  const compressedBody = compressWithGzip(response.body);\n  const headers = new Headers(response.headers);\n  headers.set('Content-Encoding', encoding);\n  headers.delete('Content-Length');\n  const existingVary = headers.get('Vary');\n  if (existingVary) {\n    if (!existingVary.toLowerCase().includes('accept-encoding')) {\n      headers.set('Vary', existingVary + ', Accept-Encoding');\n    }\n  } else {\n    headers.set('Vary', 'Accept-Encoding');\n  }\n  return new Response(compressedBody, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n`;\n}\n","// Nitro adapter — multi-platform deployment\n//\n// Covers everything except Cloudflare Workers: Node.js, Bun, Vercel,\n// Netlify, AWS Lambda, Deno Deploy, Azure Functions. Nitro handles\n// compression, graceful shutdown, static file serving, and platform quirks.\n// See design/11-platform.md and design/25-production-deployments.md.\n\nimport { writeFile, readFile, mkdir, cp } from 'node:fs/promises';\nimport { execFile } from 'node:child_process';\nimport { join, relative } from 'node:path';\nimport type { TimberPlatformAdapter, TimberConfig } from './types';\nimport { generateCompressModule } from './compress-module.js';\n// Inlined from server/asset-headers.ts — adapters are loaded by Node at\n// Vite startup time, before Vite's module resolver is available, so cross-\n// directory .ts imports don't resolve.\nconst IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';\nconst STATIC_CACHE = 'public, max-age=3600, must-revalidate';\n\nfunction generateHeadersFile(): string {\n  return `# Auto-generated by @timber-js/app — static asset cache headers.\n# See design/25-production-deployments.md §\"CDN / Edge Cache\"\n\n/assets/*\n  Cache-Control: ${IMMUTABLE_CACHE}\n\n/*\n  Cache-Control: ${STATIC_CACHE}\n`;\n}\n\n// ─── Presets ─────────────────────────────────────────────────────────────────\n\n/**\n * Supported Nitro deployment presets.\n *\n * Each preset maps to a Nitro deployment target. The adapter generates\n * the appropriate configuration and entry point for the selected platform.\n */\nexport type NitroPreset =\n  | 'vercel'\n  | 'vercel-edge'\n  | 'netlify'\n  | 'netlify-edge'\n  | 'aws-lambda'\n  | 'deno-deploy'\n  | 'azure-functions'\n  | 'node-server'\n  | 'bun';\n\n/** Preset-specific Nitro configuration. */\ninterface PresetConfig {\n  /** Nitro preset name passed to the Nitro build. */\n  nitroPreset: string;\n  /** Output directory name within the build dir. */\n  outputDir: string;\n  /** Whether the runtime supports waitUntil. */\n  supportsWaitUntil: boolean;\n  /** Whether the runtime supports application-level 103 Early Hints. */\n  supportsEarlyHints: boolean;\n  /** Value for TIMBER_RUNTIME env var. See design/25-production-deployments.md. */\n  runtimeName: string;\n  /** Additional nitro.config fields for this preset. */\n  extraConfig?: Record<string, unknown>;\n}\n\nconst PRESET_CONFIGS: Record<NitroPreset, PresetConfig> = {\n  'vercel': {\n    nitroPreset: 'vercel',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel',\n    extraConfig: { vercel: { functions: { maxDuration: 30 } } },\n  },\n  'vercel-edge': {\n    nitroPreset: 'vercel-edge',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel-edge',\n  },\n  'netlify': {\n    nitroPreset: 'netlify',\n    outputDir: '.netlify/functions-internal',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify',\n  },\n  'netlify-edge': {\n    nitroPreset: 'netlify-edge',\n    outputDir: '.netlify/edge-functions',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify-edge',\n  },\n  'aws-lambda': {\n    nitroPreset: 'aws-lambda',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'aws-lambda',\n  },\n  'deno-deploy': {\n    nitroPreset: 'deno-deploy',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'deno-deploy',\n  },\n  'azure-functions': {\n    nitroPreset: 'azure-functions',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'azure-functions',\n  },\n  'node-server': {\n    nitroPreset: 'node-server',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled by default: most node-server deployments sit behind a\n    // reverse proxy (nginx, caddy, traefik) that doesn't support 103\n    // Early Hints over HTTP/1.1. Sending 103 causes nginx to intermittently\n    // treat the response as an error and retry after proxy_connect_timeout\n    // (~5s stalls on ~23% of requests). Link headers on the 200 response\n    // are the safe fallback — Cloudflare and other CDNs convert them to\n    // 103 automatically at the edge (over HTTP/2+ to the browser).\n    supportsEarlyHints: false,\n    runtimeName: 'node-server',\n  },\n  'bun': {\n    nitroPreset: 'bun',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled for same reason as node-server — reverse proxies choke on 103.\n    // Link headers on the 200 response are converted to 103 by CDNs.\n    supportsEarlyHints: false,\n    runtimeName: 'bun',\n  },\n};\n\n// ─── Options ─────────────────────────────────────────────────────────────────\n\n/** Options for the Nitro adapter. */\nexport interface NitroAdapterOptions {\n  /**\n   * Deployment preset. Determines the target platform.\n   * @default 'node-server'\n   */\n  preset?: NitroPreset;\n\n  /**\n   * Enable application-level gzip compression for HTML and RSC responses.\n   *\n   * When `true` (default), the origin compresses responses using the Web\n   * `CompressionStream` API. This is useful for self-hosted deployments\n   * where no reverse proxy or CDN handles compression.\n   *\n   * Set to `false` when deploying behind a reverse proxy (nginx, caddy)\n   * or CDN (Cloudflare, Fastly, Vercel) that compresses at the edge.\n   * Disabling origin compression saves CPU on the Node.js event loop —\n   * compressing 1MB+ streaming HTML responses takes 10-15ms of main\n   * thread time per request, directly reducing throughput under load.\n   *\n   * @default true\n   */\n  compress?: boolean;\n\n  /**\n   * Additional Nitro configuration to merge into the generated config.\n   * Overrides default values for the selected preset.\n   */\n  nitroConfig?: Record<string, unknown>;\n}\n\n// ─── Adapter ─────────────────────────────────────────────────────────────────\n\n/**\n * Create a Nitro-based adapter for multi-platform deployment.\n *\n * Nitro abstracts deployment targets — the same timber.js app can deploy\n * to Vercel, Netlify, AWS, Deno Deploy, or Azure by changing the preset.\n *\n * @example\n * ```ts\n * import { nitro } from '@timber-js/app/adapters/nitro'\n *\n * export default {\n *   output: 'server',\n *   adapter: nitro({ preset: 'vercel' }),\n * }\n * ```\n */\nexport function nitro(options: NitroAdapterOptions = {}): TimberPlatformAdapter {\n  const preset = options.preset ?? 'node-server';\n  const compress = options.compress ?? true;\n  const presetConfig = PRESET_CONFIGS[preset];\n  const pendingPromises: Promise<unknown>[] = [];\n\n  return {\n    name: `nitro-${preset}`,\n\n    async buildOutput(config: TimberConfig, buildDir: string) {\n      const outDir = join(buildDir, 'nitro');\n      await mkdir(outDir, { recursive: true });\n\n      // Copy client assets to public directory.\n      // When client JavaScript is disabled, skip .js files — only CSS,\n      // fonts, images, and other static assets are needed.\n      const clientDir = join(buildDir, 'client');\n      const publicDir = join(outDir, 'public');\n      await mkdir(publicDir, { recursive: true });\n      await cp(clientDir, publicDir, {\n        recursive: true,\n        filter: config.clientJavascriptDisabled ? (src: string) => !src.endsWith('.js') : undefined,\n      }).catch(() => {\n        // Client dir may not exist when client JavaScript is disabled\n      });\n\n      // Write _headers file for platforms that support it (Netlify, etc.).\n      // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n      await writeFile(join(publicDir, '_headers'), generateHeadersFile());\n\n      // Write the build manifest init module (if manifest data was produced).\n      if (config.manifestInit) {\n        await writeFile(join(outDir, '_timber-manifest-init.js'), config.manifestInit);\n      }\n\n      // Write the compression helper module for runtime use.\n      // See design/25-production-deployments.md — self-hosted deployments\n      // need application-level compression (Cloudflare handles it at the edge).\n      await writeFile(join(outDir, '_compress.mjs'), generateCompressModule());\n\n      // Copy rsc/ssr build output into the nitro dir so imports stay local\n      // during the Nitro bundling step (avoids broken relative paths in output).\n      await cp(join(buildDir, 'rsc'), join(outDir, 'rsc'), { recursive: true });\n      await cp(join(buildDir, 'ssr'), join(outDir, 'ssr'), { recursive: true }).catch(() => {});\n\n      // Prepend the manifest assignment directly into the RSC entry so\n      // globalThis.__TIMBER_BUILD_MANIFEST__ is set before any module reads it.\n      // This must be top-level code, not an import, because rollup tree-shakes\n      // side-effect-only globalThis assignments from imported modules.\n      if (config.manifestInit) {\n        const rscEntry = join(outDir, 'rsc', 'index.js');\n        const rscContent = await readFile(rscEntry, 'utf-8');\n        await writeFile(rscEntry, `${config.manifestInit}\\n${rscContent}`);\n      }\n\n      // Generate the Nitro entry point (imports from ./rsc/ within nitro dir)\n      const entry = generateNitroEntry(buildDir, outDir, preset, compress);\n      await writeFile(join(outDir, 'entry.ts'), entry);\n\n      // Run the Nitro build to produce a production-ready server bundle.\n      // The output goes to dist/nitro/.output/server/index.mjs (for node-server preset).\n      // Config is passed programmatically — no nitro.config.ts file needed.\n      await runNitroBuild(outDir, preset, options.nitroConfig);\n    },\n\n    // Only presets that produce a locally-runnable server get preview().\n    // Serverless presets (vercel, netlify, aws-lambda, etc.) have no\n    // local runtime — Vite's built-in preview is the fallback.\n    preview: LOCALLY_PREVIEWABLE.has(preset)\n      ? async (_config: TimberConfig, buildDir: string) => {\n          // Generate a standalone preview server that uses Node's built-in\n          // HTTP server. The Nitro entry.ts can't be run directly because\n          // it imports h3 (a Nitro dependency not available at runtime).\n          const previewScript = generatePreviewScript(buildDir, preset);\n          const scriptPath = join(buildDir, 'nitro', '_preview-server.mjs');\n          await writeFile(scriptPath, previewScript);\n\n          const command = preset === 'bun' ? 'bun' : 'node';\n          await spawnNitroPreview(command, [scriptPath], join(buildDir, 'nitro'));\n        }\n      : undefined,\n\n    waitUntil: presetConfig.supportsWaitUntil\n      ? (promise: Promise<unknown>) => {\n          const tracked = promise.catch((err) => {\n            console.error('[timber] waitUntil promise rejected:', err);\n          });\n          pendingPromises.push(tracked);\n        }\n      : undefined,\n  };\n}\n\n// ─── Entry Generation ────────────────────────────────────────────────────────\n\n/** @internal Exported for testing. */\nexport function generateNitroEntry(\n  buildDir: string,\n  outDir: string,\n  preset: NitroPreset,\n  compress = true,\n  hasManifestInit = false\n): string {\n  // The RSC entry is the main request handler — it exports the fetch handler as default.\n  // rsc/ is copied into the nitro dir so the import is local.\n  // The manifest init is prepended to rsc/index.js before the nitro build,\n  // so globalThis.__TIMBER_BUILD_MANIFEST__ is set before any code reads it.\n  const serverEntryRelative = './rsc/index.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n  const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;\n  const supportsWaitUntil = PRESET_CONFIGS[preset].supportsWaitUntil;\n\n  // On node-server and bun, wrap the handler with ALS so the pipeline\n  // can send 103 Early Hints via res.writeEarlyHints(). Other presets\n  // either don't support 103 or handle it at the CDN level.\n  //\n  // For presets that support waitUntil, bridge h3's event.waitUntil()\n  // to timber's waitUntil() primitive via the ALS bridge.\n  // See design/11-platform.md §\"waitUntil()\".\n  let handlerCall: string;\n  if (earlyHints && supportsWaitUntil) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const callHandler = () => handler(webRequest)\n  let wrappedHandler = earlyHintsSender\n    ? () => runWithEarlyHintsSender(earlyHintsSender, callHandler)\n    : callHandler\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, wrappedHandler)\n    : await wrappedHandler()`;\n  } else if (earlyHints) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const webResponse = earlyHintsSender\n    ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else if (supportsWaitUntil) {\n    handlerCall = `  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else {\n    handlerCall = `  const webResponse = await handler(webRequest)`;\n  }\n\n  // Build manifest init must be imported before the handler so that\n  // globalThis.__TIMBER_BUILD_MANIFEST__ is set when the virtual module evaluates.\n  // ESM guarantees imports are evaluated in order.\n  const manifestImport = hasManifestInit ? \"import './_timber-manifest-init.js'\\n\" : '';\n\n  // Import runWithWaitUntil only when the preset supports it.\n  const waitUntilImport = supportsWaitUntil ? ', runWithWaitUntil' : '';\n\n  const compressImport = compress ? \"import { compressResponse } from './_compress.mjs'\\n\" : '';\n  const compressCall = compress ? 'compressResponse(webRequest, webResponse)' : 'webResponse';\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\n${manifestImport}import handler, { runWithEarlyHintsSender${waitUntilImport} } from '${serverEntryRelative}'\n${compressImport}\n// Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.\n// See design/25-production-deployments.md §\"TIMBER_RUNTIME\".\nprocess.env.TIMBER_RUNTIME = '${runtimeName}'\n\n// Nitro's index.mjs wraps this import with defineLazyEventHandler, which\n// already handles the event handler protocol. We export a plain async\n// function — no defineEventHandler wrapper needed.\n// Nitro bundles h3 into its internal _libs/ directory but doesn't make\n// it available as a bare specifier in the output's node_modules.\nexport default async function timberHandler(event) {\n  // h3 v2: event.req is the Web Request\n  const webRequest = event.req\n${handlerCall}\n  return ${compressCall}\n}\n`;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroConfig(\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): string {\n  const presetConfig = PRESET_CONFIGS[preset];\n\n  const config: Record<string, unknown> = {\n    preset: presetConfig.nitroPreset,\n    entry: './entry.ts',\n    output: { dir: presetConfig.outputDir },\n    // Static asset cache headers — hashed assets are immutable, others get 1h.\n    // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  };\n\n  const configJson = JSON.stringify(config, null, 2);\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\nimport { defineNitroConfig } from 'nitro/config'\n\nexport default defineNitroConfig(${configJson})\n`;\n}\n\n// ─── Preview ─────────────────────────────────────────────────────────────────\n\n/** Presets that produce a locally-runnable server entry. */\nconst LOCALLY_PREVIEWABLE = new Set<NitroPreset>(['node-server', 'bun']);\n\n/**\n * Generate a standalone preview server script that uses Node's built-in\n * HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports\n * h3 which isn't available outside a Nitro build. For local preview we\n * just need to serve static files and route requests to the RSC handler.\n *\n * @internal Exported for testing.\n */\nexport function generatePreviewScript(buildDir: string, preset: NitroPreset): string {\n  const rscEntryRelative = relative(join(buildDir, 'nitro'), join(buildDir, 'rsc', 'index.js'));\n  const rscEntry = rscEntryRelative.startsWith('.') ? rscEntryRelative : './' + rscEntryRelative;\n  const publicDir = './public';\n  const manifestInitPath = './_timber-manifest-init.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n\n  return `// Generated by @timber-js/app — standalone preview server.\n// Uses Node's built-in HTTP server to serve static assets and route\n// dynamic requests through the RSC handler. No Nitro/h3 dependency.\n\nimport { createServer } from 'node:http';\nimport { readFile, stat } from 'node:fs/promises';\nimport { join, extname } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { existsSync } from 'node:fs';\n\n// Set runtime before importing the handler.\nprocess.env.TIMBER_RUNTIME = '${runtimeName}';\n\n// Load the build manifest if it exists.\nconst __dirname = fileURLToPath(new URL('.', import.meta.url));\nconst manifestPath = join(__dirname, '${manifestInitPath}');\nif (existsSync(manifestPath)) {\n  await import('${manifestInitPath}');\n}\n\n// Import the RSC handler (default export is the fetch-like handler).\nconst { default: handler, runWithEarlyHintsSender } = await import('${rscEntry}');\n\n// Import compression helper for self-hosted response compression.\nconst { compressResponse } = await import('./_compress.mjs');\n\nconst MIME_TYPES = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.otf': 'font/otf',\n  '.webp': 'image/webp',\n  '.avif': 'image/avif',\n  '.webm': 'video/webm',\n  '.mp4': 'video/mp4',\n  '.txt': 'text/plain',\n  '.xml': 'application/xml',\n  '.wasm': 'application/wasm',\n};\n\nconst publicDir = join(__dirname, '${publicDir}');\nconst port = parseInt(process.env.PORT || '3000', 10);\nconst host = process.env.HOST || process.env.HOSTNAME || 'localhost';\n\nconst server = createServer(async (req, res) => {\n  const url = new URL(req.url || '/', \\`http://\\${host}:\\${port}\\`);\n\n  // Try serving static files from the public directory first.\n  const filePath = join(publicDir, url.pathname);\n  // Prevent path traversal.\n  if (filePath.startsWith(publicDir)) {\n    try {\n      const fileStat = await stat(filePath);\n      if (fileStat.isFile()) {\n        const ext = extname(filePath);\n        const contentType = MIME_TYPES[ext] || 'application/octet-stream';\n        const body = await readFile(filePath);\n        // Hashed assets get immutable cache, others get short cache.\n        const cacheControl = url.pathname.startsWith('/assets/')\n          ? 'public, max-age=31536000, immutable'\n          : 'public, max-age=3600, must-revalidate';\n        res.writeHead(200, {\n          'Content-Type': contentType,\n          'Content-Length': body.length,\n          'Cache-Control': cacheControl,\n        });\n        res.end(body);\n        return;\n      }\n    } catch {\n      // File not found — fall through to the RSC handler.\n    }\n  }\n\n  // Convert Node request to Web Request.\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value) {\n      if (Array.isArray(value)) {\n        for (const v of value) headers.append(key, v);\n      } else {\n        headers.set(key, value);\n      }\n    }\n  }\n\n  let body = undefined;\n  if (req.method !== 'GET' && req.method !== 'HEAD') {\n    body = await new Promise((resolve) => {\n      const chunks = [];\n      req.on('data', (chunk) => chunks.push(chunk));\n      req.on('end', () => resolve(Buffer.concat(chunks)));\n    });\n  }\n\n  const webRequest = new Request(url.href, {\n    method: req.method,\n    headers,\n    body,\n    duplex: body ? 'half' : undefined,\n  });\n\n  try {\n    // Support 103 Early Hints when available.\n    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')\n      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }\n      : undefined;\n\n    const rawResponse = earlyHintsSender && runWithEarlyHintsSender\n      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n      : await handler(webRequest);\n\n    // Compress the response for self-hosted deployments.\n    const webResponse = compressResponse(webRequest, rawResponse);\n\n    // Write the response back to the Node response.\n    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));\n\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n      const pump = async () => {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) { res.end(); return; }\n          res.write(value);\n        }\n      };\n      await pump();\n    } else {\n      res.end();\n    }\n  } catch (err) {\n    console.error('[timber preview] Request error:', err);\n    if (!res.headersSent) {\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n    }\n    res.end('Internal Server Error');\n  }\n});\n\nserver.listen(port, host, () => {\n  console.log();\n  console.log('  ⚡ timber preview server running at:');\n  console.log();\n  console.log(\\`    ➜  http://\\${host}:\\${port}\\`);\n  console.log();\n});\n`;\n}\n\n/** Command descriptor for Nitro preview — testable without spawning. */\nexport interface NitroPreviewCommand {\n  command: string;\n  args: string[];\n  cwd: string;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroPreviewCommand(\n  buildDir: string,\n  preset: NitroPreset\n): NitroPreviewCommand | null {\n  if (!LOCALLY_PREVIEWABLE.has(preset)) return null;\n\n  const nitroDir = join(buildDir, 'nitro');\n  const entryPath = join(nitroDir, 'entry.ts');\n\n  const command = preset === 'bun' ? 'bun' : 'node';\n  return {\n    command,\n    args: [entryPath],\n    cwd: nitroDir,\n  };\n}\n\n/**\n * Run the Nitro production build using the programmatic API.\n * Uses dynamic import so nitro is only loaded at build time.\n * Externalizes the timber RSC/SSR output — those files are pre-built\n * by timber and have internal references that nitro's bundler can't follow.\n */\nasync function runNitroBuild(\n  nitroDir: string,\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): Promise<void> {\n  const presetConfig = PRESET_CONFIGS[preset];\n  const {\n    createNitro,\n    build: nitroBuild,\n    prepare,\n    copyPublicAssets,\n  } = await import('nitro/builder');\n\n  const nitro = await createNitro({\n    rootDir: nitroDir,\n    preset: presetConfig.nitroPreset,\n    // Use renderer.entry so Nitro wraps our handler with its server runtime\n    // (HTTP server, static file serving, graceful shutdown, etc.).\n    // Using `entry` directly would bypass the Nitro server runtime.\n    renderer: { handler: join(nitroDir, 'entry.ts') },\n    output: { dir: join(nitroDir, presetConfig.outputDir) },\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    // Don't bundle the timber RSC/SSR build output — it has its own\n    // internal file references that nitro's bundler can't follow.\n    // Mark them as external so rollup leaves the imports as-is.\n    rollupConfig: {\n      external: [/\\.\\.\\/rsc\\//],\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  });\n\n  await prepare(nitro);\n  await copyPublicAssets(nitro);\n  await nitroBuild(nitro);\n  await nitro.close();\n}\n\n/** Spawn a Nitro preview process and pipe stdio. */\nfunction spawnNitroPreview(command: string, args: string[], cwd: string): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const child = execFile(command, args, { cwd }, (err) => {\n      if (err) reject(err);\n      else resolve();\n    });\n    child.stdout?.pipe(process.stdout);\n    child.stderr?.pipe(process.stderr);\n  });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Get the preset configuration for a given preset name.\n * @internal Exported for testing.\n */\nexport function getPresetConfig(preset: NitroPreset): PresetConfig {\n  return PRESET_CONFIGS[preset];\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,SAAgB,yBAAiC;AAC/C,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACPT,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAErB,SAAS,sBAA8B;AACrC,QAAO;;;;mBAIU,gBAAgB;;;mBAGhB,aAAa;;;AAuChC,IAAM,iBAAoD;CACxD,UAAU;EACR,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACb,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,IAAI,EAAE,EAAE;EAC5D;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,WAAW;EACT,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,gBAAgB;EACd,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,cAAc;EACZ,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,mBAAmB;EACjB,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EAQnB,oBAAoB;EACpB,aAAa;EACd;CACD,OAAO;EACL,aAAa;EACb,WAAW;EACX,mBAAmB;EAGnB,oBAAoB;EACpB,aAAa;EACd;CACF;;;;;;;;;;;;;;;;;AAsDD,SAAgB,MAAM,UAA+B,EAAE,EAAyB;CAC9E,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,eAAe,eAAe;CACpC,MAAM,kBAAsC,EAAE;AAE9C,QAAO;EACL,MAAM,SAAS;EAEf,MAAM,YAAY,QAAsB,UAAkB;GACxD,MAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,SAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;GAKxC,MAAM,YAAY,KAAK,UAAU,SAAS;GAC1C,MAAM,YAAY,KAAK,QAAQ,SAAS;AACxC,SAAM,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;AAC3C,SAAM,GAAG,WAAW,WAAW;IAC7B,WAAW;IACX,QAAQ,OAAO,4BAA4B,QAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,KAAA;IACnF,CAAC,CAAC,YAAY,GAEb;AAIF,SAAM,UAAU,KAAK,WAAW,WAAW,EAAE,qBAAqB,CAAC;AAGnE,OAAI,OAAO,aACT,OAAM,UAAU,KAAK,QAAQ,2BAA2B,EAAE,OAAO,aAAa;AAMhF,SAAM,UAAU,KAAK,QAAQ,gBAAgB,EAAE,wBAAwB,CAAC;AAIxE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC;AACzE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC,CAAC,YAAY,GAAG;AAMzF,OAAI,OAAO,cAAc;IACvB,MAAM,WAAW,KAAK,QAAQ,OAAO,WAAW;IAChD,MAAM,aAAa,MAAM,SAAS,UAAU,QAAQ;AACpD,UAAM,UAAU,UAAU,GAAG,OAAO,aAAa,IAAI,aAAa;;GAIpE,MAAM,QAAQ,mBAAmB,UAAU,QAAQ,QAAQ,SAAS;AACpE,SAAM,UAAU,KAAK,QAAQ,WAAW,EAAE,MAAM;AAKhD,SAAM,cAAc,QAAQ,QAAQ,QAAQ,YAAY;;EAM1D,SAAS,oBAAoB,IAAI,OAAO,GACpC,OAAO,SAAuB,aAAqB;GAIjD,MAAM,gBAAgB,sBAAsB,UAAU,OAAO;GAC7D,MAAM,aAAa,KAAK,UAAU,SAAS,sBAAsB;AACjE,SAAM,UAAU,YAAY,cAAc;AAG1C,SAAM,kBADU,WAAW,QAAQ,QAAQ,QACV,CAAC,WAAW,EAAE,KAAK,UAAU,QAAQ,CAAC;MAEzE,KAAA;EAEJ,WAAW,aAAa,qBACnB,YAA8B;GAC7B,MAAM,UAAU,QAAQ,OAAO,QAAQ;AACrC,YAAQ,MAAM,wCAAwC,IAAI;KAC1D;AACF,mBAAgB,KAAK,QAAQ;MAE/B,KAAA;EACL;;;AAMH,SAAgB,mBACd,UACA,QACA,QACA,WAAW,MACX,kBAAkB,OACV;CAKR,MAAM,sBAAsB;CAC5B,MAAM,cAAc,eAAe,QAAQ;CAC3C,MAAM,aAAa,eAAe,QAAQ;CAC1C,MAAM,oBAAoB,eAAe,QAAQ;CASjD,IAAI;AACJ,KAAI,cAAc,kBAChB,eAAc;;;;;;;;;;;;;;;;UAgBL,WACT,eAAc;;;;;;;;UAQL,kBACT,eAAc;;;;;;;KAQd,eAAc;AAchB,QAAO;;;EARgB,kBAAkB,0CAA0C,GAWpE,2CARS,oBAAoB,uBAAuB,GAQO,WAAW,oBAAoB;EANlF,WAAW,yDAAyD,GAO5E;;;gCAGe,YAAY;;;;;;;;;;EAU1C,YAAY;WAnBS,WAAW,8CAA8C,cAoBxD;;;;;AAMxB,SAAgB,oBACd,QACA,YACQ;CACR,MAAM,eAAe,eAAe;CAEpC,MAAM,SAAkC;EACtC,QAAQ,aAAa;EACrB,OAAO;EACP,QAAQ,EAAE,KAAK,aAAa,WAAW;EAGvC,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EACD,GAAG,aAAa;EAChB,GAAG;EACJ;AAID,QAAO;;;;;mCAFY,KAAK,UAAU,QAAQ,MAAM,EAAE,CAON;;;;AAO9C,IAAM,sBAAsB,IAAI,IAAiB,CAAC,eAAe,MAAM,CAAC;;;;;;;;;AAUxE,SAAgB,sBAAsB,UAAkB,QAA6B;CACnF,MAAM,mBAAmB,SAAS,KAAK,UAAU,QAAQ,EAAE,KAAK,UAAU,OAAO,WAAW,CAAC;CAC7F,MAAM,WAAW,iBAAiB,WAAW,IAAI,GAAG,mBAAmB,OAAO;CAC9E,MAAM,YAAY;CAClB,MAAM,mBAAmB;AAGzB,QAAO;;;;;;;;;;;gCAFa,eAAe,QAAQ,YAaD;;;;wCAIJ,iBAAiB;;kBAEvC,iBAAiB;;;;sEAImC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B1C,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsH/C,SAAgB,4BACd,UACA,QAC4B;AAC5B,KAAI,CAAC,oBAAoB,IAAI,OAAO,CAAE,QAAO;CAE7C,MAAM,WAAW,KAAK,UAAU,QAAQ;CACxC,MAAM,YAAY,KAAK,UAAU,WAAW;AAG5C,QAAO;EACL,SAFc,WAAW,QAAQ,QAAQ;EAGzC,MAAM,CAAC,UAAU;EACjB,KAAK;EACN;;;;;;;;AASH,eAAe,cACb,UACA,QACA,YACe;CACf,MAAM,eAAe,eAAe;CACpC,MAAM,EACJ,aACA,OAAO,YACP,SACA,qBACE,MAAM,OAAO;CAEjB,MAAM,QAAQ,MAAM,YAAY;EAC9B,SAAS;EACT,QAAQ,aAAa;EAIrB,UAAU,EAAE,SAAS,KAAK,UAAU,WAAW,EAAE;EACjD,QAAQ,EAAE,KAAK,KAAK,UAAU,aAAa,UAAU,EAAE;EACvD,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EAID,cAAc,EACZ,UAAU,CAAC,cAAc,EAC1B;EACD,GAAG,aAAa;EAChB,GAAG;EACJ,CAAC;AAEF,OAAM,QAAQ,MAAM;AACpB,OAAM,iBAAiB,MAAM;AAC7B,OAAM,WAAW,MAAM;AACvB,OAAM,MAAM,OAAO;;;AAIrB,SAAS,kBAAkB,SAAiB,MAAgB,KAA4B;AACtF,QAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,KAAK,GAAG,QAAQ;AACtD,OAAI,IAAK,QAAO,IAAI;OACf,UAAS;IACd;AACF,QAAM,QAAQ,KAAK,QAAQ,OAAO;AAClC,QAAM,QAAQ,KAAK,QAAQ,OAAO;GAClC;;;;;;AASJ,SAAgB,gBAAgB,QAAmC;AACjE,QAAO,eAAe"}
+{"version":3,"file":"nitro.js","names":[],"sources":["../../src/adapters/compress-module.ts","../../src/adapters/nitro.ts"],"sourcesContent":["// Compiles server/compress.ts into a standalone ESM module (_compress.mjs)\n// for self-hosted deployments. The adapter writes this to the build output\n// during buildOutput(). It's imported by the Nitro entry and preview server\n// at runtime.\n//\n// By compiling the actual TypeScript source rather than maintaining a\n// hand-written string template, any fix to server/compress.ts automatically\n// flows to the production module. See design/18-build-system.md (\"entry\n// modules are real TypeScript files, not codegen strings\").\n\nimport { transformWithOxc } from 'vite';\n// Vite's ?raw import embeds the file as a string at build time — works\n// in both dev (Vite resolves the TS source) and the published package\n// (the string is inlined into the compiled adapter entry).\nimport compressSource from '../server/compress.ts?raw';\n\n/**\n * Compile server/compress.ts into a standalone ESM module.\n *\n * Uses Vite's OXC transform to strip TypeScript types from the\n * embedded source. The result is written to `_compress.mjs` during\n * buildOutput.\n *\n * @internal Exported for testing.\n */\nexport async function generateCompressModule(): Promise<string> {\n  const result = await transformWithOxc(compressSource, 'compress.ts', {\n    lang: 'ts',\n  });\n\n  return (\n    '// Generated by @timber-js/app — compiled from server/compress.ts.\\n' +\n    '// Do not edit — this file is regenerated on each build.\\n' +\n    result.code\n  );\n}\n","// Nitro adapter — multi-platform deployment\n//\n// Covers everything except Cloudflare Workers: Node.js, Bun, Vercel,\n// Netlify, AWS Lambda, Deno Deploy, Azure Functions. Nitro handles\n// compression, graceful shutdown, static file serving, and platform quirks.\n// See design/11-platform.md and design/25-production-deployments.md.\n\nimport { writeFile, readFile } from 'node:fs/promises';\nimport { execFile } from 'node:child_process';\nimport { join, relative } from 'node:path';\nimport type { TimberPlatformAdapter, TimberConfig } from './types';\nimport { generateCompressModule } from './compress-module.js';\nimport { IMMUTABLE_CACHE } from './shared.js';\nimport { runSharedBuildSteps } from './build-output-helper.js';\n\n// ─── Presets ─────────────────────────────────────────────────────────────────\n\n/**\n * Supported Nitro deployment presets.\n *\n * Each preset maps to a Nitro deployment target. The adapter generates\n * the appropriate configuration and entry point for the selected platform.\n */\nexport type NitroPreset =\n  | 'vercel'\n  | 'vercel-edge'\n  | 'netlify'\n  | 'netlify-edge'\n  | 'aws-lambda'\n  | 'deno-deploy'\n  | 'azure-functions'\n  | 'node-server'\n  | 'bun';\n\n/** Preset-specific Nitro configuration. */\ninterface PresetConfig {\n  /** Nitro preset name passed to the Nitro build. */\n  nitroPreset: string;\n  /** Output directory name within the build dir. */\n  outputDir: string;\n  /** Whether the runtime supports waitUntil. */\n  supportsWaitUntil: boolean;\n  /** Whether the runtime supports application-level 103 Early Hints. */\n  supportsEarlyHints: boolean;\n  /** Value for TIMBER_RUNTIME env var. See design/25-production-deployments.md. */\n  runtimeName: string;\n  /** Additional nitro.config fields for this preset. */\n  extraConfig?: Record<string, unknown>;\n}\n\nconst PRESET_CONFIGS: Record<NitroPreset, PresetConfig> = {\n  'vercel': {\n    nitroPreset: 'vercel',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel',\n    extraConfig: { vercel: { functions: { maxDuration: 30 } } },\n  },\n  'vercel-edge': {\n    nitroPreset: 'vercel-edge',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel-edge',\n  },\n  'netlify': {\n    nitroPreset: 'netlify',\n    outputDir: '.netlify/functions-internal',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify',\n  },\n  'netlify-edge': {\n    nitroPreset: 'netlify-edge',\n    outputDir: '.netlify/edge-functions',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify-edge',\n  },\n  'aws-lambda': {\n    nitroPreset: 'aws-lambda',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'aws-lambda',\n  },\n  'deno-deploy': {\n    nitroPreset: 'deno-deploy',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'deno-deploy',\n  },\n  'azure-functions': {\n    nitroPreset: 'azure-functions',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'azure-functions',\n  },\n  'node-server': {\n    nitroPreset: 'node-server',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled by default: most node-server deployments sit behind a\n    // reverse proxy (nginx, caddy, traefik) that doesn't support 103\n    // Early Hints over HTTP/1.1. Sending 103 causes nginx to intermittently\n    // treat the response as an error and retry after proxy_connect_timeout\n    // (~5s stalls on ~23% of requests). Link headers on the 200 response\n    // are the safe fallback — Cloudflare and other CDNs convert them to\n    // 103 automatically at the edge (over HTTP/2+ to the browser).\n    supportsEarlyHints: false,\n    runtimeName: 'node-server',\n  },\n  'bun': {\n    nitroPreset: 'bun',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled for same reason as node-server — reverse proxies choke on 103.\n    // Link headers on the 200 response are converted to 103 by CDNs.\n    supportsEarlyHints: false,\n    runtimeName: 'bun',\n  },\n};\n\n// ─── Options ─────────────────────────────────────────────────────────────────\n\n/** Options for the Nitro adapter. */\nexport interface NitroAdapterOptions {\n  /**\n   * Deployment preset. Determines the target platform.\n   * @default 'node-server'\n   */\n  preset?: NitroPreset;\n\n  /**\n   * Enable application-level gzip compression for HTML and RSC responses.\n   *\n   * When `true` (default), the origin compresses responses using the Web\n   * `CompressionStream` API. This is useful for self-hosted deployments\n   * where no reverse proxy or CDN handles compression.\n   *\n   * Set to `false` when deploying behind a reverse proxy (nginx, caddy)\n   * or CDN (Cloudflare, Fastly, Vercel) that compresses at the edge.\n   * Disabling origin compression saves CPU on the Node.js event loop —\n   * compressing 1MB+ streaming HTML responses takes 10-15ms of main\n   * thread time per request, directly reducing throughput under load.\n   *\n   * @default true\n   */\n  compress?: boolean;\n\n  /**\n   * Additional Nitro configuration to merge into the generated config.\n   * Overrides default values for the selected preset.\n   */\n  nitroConfig?: Record<string, unknown>;\n}\n\n// ─── Adapter ─────────────────────────────────────────────────────────────────\n\n/**\n * Create a Nitro-based adapter for multi-platform deployment.\n *\n * Nitro abstracts deployment targets — the same timber.js app can deploy\n * to Vercel, Netlify, AWS, Deno Deploy, or Azure by changing the preset.\n *\n * @example\n * ```ts\n * import { nitro } from '@timber-js/app/adapters/nitro'\n *\n * export default {\n *   output: 'server',\n *   adapter: nitro({ preset: 'vercel' }),\n * }\n * ```\n */\nexport function nitro(options: NitroAdapterOptions = {}): TimberPlatformAdapter {\n  const preset = options.preset ?? 'node-server';\n  const compress = options.compress ?? true;\n  const presetConfig = PRESET_CONFIGS[preset];\n  const pendingPromises: Promise<unknown>[] = [];\n\n  return {\n    name: `nitro-${preset}`,\n\n    async buildOutput(config: TimberConfig, buildDir: string) {\n      const outDir = join(buildDir, 'nitro');\n\n      // Steps 1–5: shared across all adapters (mkdir, copy client/rsc/ssr,\n      // write _headers, write manifest-init).\n      await runSharedBuildSteps({\n        config,\n        buildDir,\n        outDir,\n        publicDirName: 'public',\n      });\n\n      // Write the compression helper module for runtime use.\n      // See design/25-production-deployments.md — self-hosted deployments\n      // need application-level compression (Cloudflare handles it at the edge).\n      await writeFile(join(outDir, '_compress.mjs'), await generateCompressModule());\n\n      // Prepend the manifest assignment directly into the RSC entry so\n      // globalThis.__TIMBER_BUILD_MANIFEST__ is set before any module reads it.\n      // This must be top-level code, not an import, because rollup tree-shakes\n      // side-effect-only globalThis assignments from imported modules.\n      if (config.manifestInit) {\n        const rscEntry = join(outDir, 'rsc', 'index.js');\n        const rscContent = await readFile(rscEntry, 'utf-8');\n        await writeFile(rscEntry, `${config.manifestInit}\\n${rscContent}`);\n      }\n\n      // Generate the Nitro entry point (imports from ./rsc/ within nitro dir)\n      const entry = generateNitroEntry(buildDir, outDir, preset, compress);\n      await writeFile(join(outDir, 'entry.ts'), entry);\n\n      // Run the Nitro build to produce a production-ready server bundle.\n      // The output goes to dist/nitro/.output/server/index.mjs (for node-server preset).\n      // Config is passed programmatically — no nitro.config.ts file needed.\n      await runNitroBuild(outDir, preset, options.nitroConfig);\n    },\n\n    // Only presets that produce a locally-runnable server get preview().\n    // Serverless presets (vercel, netlify, aws-lambda, etc.) have no\n    // local runtime — Vite's built-in preview is the fallback.\n    preview: LOCALLY_PREVIEWABLE.has(preset)\n      ? async (_config: TimberConfig, buildDir: string) => {\n          // Generate a standalone preview server that uses Node's built-in\n          // HTTP server. The Nitro entry.ts can't be run directly because\n          // it imports h3 (a Nitro dependency not available at runtime).\n          const previewScript = generatePreviewScript(buildDir, preset);\n          const scriptPath = join(buildDir, 'nitro', '_preview-server.mjs');\n          await writeFile(scriptPath, previewScript);\n\n          const command = preset === 'bun' ? 'bun' : 'node';\n          await spawnNitroPreview(command, [scriptPath], join(buildDir, 'nitro'));\n        }\n      : undefined,\n\n    waitUntil: presetConfig.supportsWaitUntil\n      ? (promise: Promise<unknown>) => {\n          const tracked = promise.catch((err) => {\n            console.error('[timber] waitUntil promise rejected:', err);\n          });\n          pendingPromises.push(tracked);\n        }\n      : undefined,\n  };\n}\n\n// ─── Entry Generation ────────────────────────────────────────────────────────\n\n/** @internal Exported for testing. */\nexport function generateNitroEntry(\n  buildDir: string,\n  outDir: string,\n  preset: NitroPreset,\n  compress = true\n): string {\n  // The RSC entry is the main request handler — it exports the fetch handler as default.\n  // rsc/ is copied into the nitro dir so the import is local.\n  // The manifest init is prepended to rsc/index.js before the nitro build,\n  // so globalThis.__TIMBER_BUILD_MANIFEST__ is set before any code reads it.\n  const serverEntryRelative = './rsc/index.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n  const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;\n  const supportsWaitUntil = PRESET_CONFIGS[preset].supportsWaitUntil;\n\n  // On node-server and bun, wrap the handler with ALS so the pipeline\n  // can send 103 Early Hints via res.writeEarlyHints(). Other presets\n  // either don't support 103 or handle it at the CDN level.\n  //\n  // For presets that support waitUntil, bridge h3's event.waitUntil()\n  // to timber's waitUntil() primitive via the ALS bridge.\n  // See design/11-platform.md §\"waitUntil()\".\n  let handlerCall: string;\n  if (earlyHints && supportsWaitUntil) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const callHandler = () => handler(webRequest)\n  let wrappedHandler = earlyHintsSender\n    ? () => runWithEarlyHintsSender(earlyHintsSender, callHandler)\n    : callHandler\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, wrappedHandler)\n    : await wrappedHandler()`;\n  } else if (earlyHints) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const webResponse = earlyHintsSender\n    ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else if (supportsWaitUntil) {\n    handlerCall = `  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else {\n    handlerCall = `  const webResponse = await handler(webRequest)`;\n  }\n\n  // Import runWithWaitUntil only when the preset supports it.\n  const waitUntilImport = supportsWaitUntil ? ', runWithWaitUntil' : '';\n\n  const compressImport = compress ? \"import { compressResponse } from './_compress.mjs'\\n\" : '';\n  const compressCall = compress ? 'compressResponse(webRequest, webResponse)' : 'webResponse';\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\nimport handler, { runWithEarlyHintsSender${waitUntilImport} } from '${serverEntryRelative}'\n${compressImport}\n// Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.\n// See design/25-production-deployments.md §\"TIMBER_RUNTIME\".\nprocess.env.TIMBER_RUNTIME = '${runtimeName}'\n\n// Nitro's index.mjs wraps this import with defineLazyEventHandler, which\n// already handles the event handler protocol. We export a plain async\n// function — no defineEventHandler wrapper needed.\n// Nitro bundles h3 into its internal _libs/ directory but doesn't make\n// it available as a bare specifier in the output's node_modules.\nexport default async function timberHandler(event) {\n  // h3 v2: event.req is the Web Request\n  const webRequest = event.req\n${handlerCall}\n  return ${compressCall}\n}\n`;\n}\n\n// ─── Preview ─────────────────────────────────────────────────────────────────\n\n/** Presets that produce a locally-runnable server entry. */\nconst LOCALLY_PREVIEWABLE = new Set<NitroPreset>(['node-server', 'bun']);\n\n/**\n * Generate a standalone preview server script that uses Node's built-in\n * HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports\n * h3 which isn't available outside a Nitro build. For local preview we\n * just need to serve static files and route requests to the RSC handler.\n *\n * @internal Exported for testing.\n */\nexport function generatePreviewScript(buildDir: string, preset: NitroPreset): string {\n  const rscEntryRelative = relative(join(buildDir, 'nitro'), join(buildDir, 'rsc', 'index.js'));\n  const rscEntry = rscEntryRelative.startsWith('.') ? rscEntryRelative : './' + rscEntryRelative;\n  const publicDir = './public';\n  const manifestInitPath = './_timber-manifest-init.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n\n  return `// Generated by @timber-js/app — standalone preview server.\n// Uses Node's built-in HTTP server to serve static assets and route\n// dynamic requests through the RSC handler. No Nitro/h3 dependency.\n\nimport { createServer } from 'node:http';\nimport { readFile, stat } from 'node:fs/promises';\nimport { join, extname } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { existsSync } from 'node:fs';\n\n// Set runtime before importing the handler.\nprocess.env.TIMBER_RUNTIME = '${runtimeName}';\n\n// Load the build manifest if it exists.\nconst __dirname = fileURLToPath(new URL('.', import.meta.url));\nconst manifestPath = join(__dirname, '${manifestInitPath}');\nif (existsSync(manifestPath)) {\n  await import('${manifestInitPath}');\n}\n\n// Import the RSC handler (default export is the fetch-like handler).\nconst { default: handler, runWithEarlyHintsSender } = await import('${rscEntry}');\n\n// Import compression helper for self-hosted response compression.\nconst { compressResponse } = await import('./_compress.mjs');\n\nconst MIME_TYPES = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.otf': 'font/otf',\n  '.webp': 'image/webp',\n  '.avif': 'image/avif',\n  '.webm': 'video/webm',\n  '.mp4': 'video/mp4',\n  '.txt': 'text/plain',\n  '.xml': 'application/xml',\n  '.wasm': 'application/wasm',\n};\n\nconst publicDir = join(__dirname, '${publicDir}');\n\n// Port resolution (TIM-842):\n//   - Default to 3000\n//   - If PORT env var is set, honor it strictly (fail loudly on conflict)\n//   - Otherwise auto-bump from 3000 until a free port is found\n// Mirrors the dev server behavior so timber dev/preview/production all\n// behave the same way around port selection.\nconst envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : null;\nconst portIsExplicit = envPort != null && Number.isFinite(envPort) && envPort > 0;\nconst startPort = portIsExplicit ? envPort : 3000;\nconst host = process.env.HOST || process.env.HOSTNAME || 'localhost';\n\n// Set after listenWithBump() resolves so request handlers can build\n// absolute URLs from the actual bound port (which may differ from\n// startPort after an auto-bump).\nlet boundPort = startPort;\n\nconst server = createServer(async (req, res) => {\n  // Scheme from the socket's TLS state — a hardcoded http:// breaks CSRF\n  // origin comparison and absolute-URL construction when TLS is terminated\n  // at this server (TIM-1073; mirrors the dev-server fix in TIM-1067).\n  // X-Forwarded-Proto is intentionally not consulted here: on a direct\n  // connection it would be attacker-controlled. The CSRF layer honors it\n  // separately for reverse-proxy deployments.\n  const scheme = req.socket?.encrypted ? 'https' : 'http';\n  const url = new URL(req.url || '/', \\`\\${scheme}://\\${host}:\\${boundPort}\\`);\n\n  // Try serving static files from the public directory first.\n  const filePath = join(publicDir, url.pathname);\n  // Prevent path traversal.\n  if (filePath.startsWith(publicDir)) {\n    try {\n      const fileStat = await stat(filePath);\n      if (fileStat.isFile()) {\n        const ext = extname(filePath);\n        const contentType = MIME_TYPES[ext] || 'application/octet-stream';\n        const body = await readFile(filePath);\n        // Hashed assets get immutable cache, others get short cache.\n        const isImmutable =\n          url.pathname.startsWith('/assets/') || url.pathname.startsWith('/_timber/fonts/');\n        const cacheControl = isImmutable\n          ? 'public, max-age=31536000, immutable'\n          : 'public, max-age=3600, must-revalidate';\n        res.writeHead(200, {\n          'Content-Type': contentType,\n          'Content-Length': body.length,\n          'Cache-Control': cacheControl,\n        });\n        res.end(body);\n        return;\n      }\n    } catch {\n      // File not found — fall through to the RSC handler.\n    }\n  }\n\n  // Convert Node request to Web Request.\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value) {\n      if (Array.isArray(value)) {\n        for (const v of value) headers.append(key, v);\n      } else {\n        headers.set(key, value);\n      }\n    }\n  }\n\n  let body = undefined;\n  if (req.method !== 'GET' && req.method !== 'HEAD') {\n    body = await new Promise((resolve) => {\n      const chunks = [];\n      req.on('data', (chunk) => chunks.push(chunk));\n      req.on('end', () => resolve(Buffer.concat(chunks)));\n    });\n  }\n\n  const webRequest = new Request(url.href, {\n    method: req.method,\n    headers,\n    body,\n    duplex: body ? 'half' : undefined,\n  });\n\n  try {\n    // Support 103 Early Hints when available.\n    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')\n      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }\n      : undefined;\n\n    const rawResponse = earlyHintsSender && runWithEarlyHintsSender\n      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n      : await handler(webRequest);\n\n    // Compress the response for self-hosted deployments.\n    const webResponse = compressResponse(webRequest, rawResponse);\n\n    // Write the response back to the Node response.\n    //\n    // Set-Cookie needs special handling: Headers.entries() joins multiple\n    // Set-Cookie values with \", \" into a single entry, but each cookie must\n    // be its own header per RFC 6265 §4.1. Object.fromEntries() would then\n    // collapse them into one malformed Set-Cookie header that browsers reject\n    // (or only honor partially). Use getSetCookie() to preserve individual\n    // values, and pass them as an array — Node's writeHead accepts\n    // Record<string, string | string[]> and emits one header per array entry.\n    //\n    // Without this, EVERY cookie set by the framework on Node—/Nitro deployments\n    // is silently dropped: defineCookie().setCookie() in actions, middleware\n    // cookie writes, the framework's own session cookies, all of it. See\n    // LOCAL-741.\n    const responseHeaders = {};\n    webResponse.headers.forEach((value, key) => {\n      if (key.toLowerCase() !== 'set-cookie') {\n        responseHeaders[key] = value;\n      }\n    });\n    const setCookies = webResponse.headers.getSetCookie();\n    if (setCookies.length > 0) {\n      responseHeaders['set-cookie'] = setCookies;\n    }\n    res.writeHead(webResponse.status, responseHeaders);\n\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n\n      // Cancel the reader when the client disconnects. This causes any\n      // pending reader.read() to reject, breaking the pump loop. Critical\n      // for SSE and other infinite streams — without this, disconnected\n      // clients leak readers.\n      let clientDisconnected = false;\n      const onClose = () => {\n        clientDisconnected = true;\n        reader.cancel('Client disconnected').catch(() => {});\n      };\n      res.on('close', onClose);\n\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          res.write(value);\n        }\n      } catch (err) {\n        // reader.cancel() from the close handler causes read() to reject.\n        // This is expected on client disconnect — not an error.\n        if (!clientDisconnected) {\n          throw err;\n        }\n      } finally {\n        res.off('close', onClose);\n        reader.releaseLock();\n        if (!res.writableEnded) {\n          res.end();\n        }\n      }\n    } else {\n      res.end();\n    }\n  } catch (err) {\n    console.error('[timber preview] Request error:', err);\n    if (!res.headersSent) {\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n    }\n    res.end('Internal Server Error');\n  }\n});\n\nfunction listenWithBump(port, attempt = 0) {\n  return new Promise((resolveListen, rejectListen) => {\n    const onError = (err) => {\n      server.removeListener('listening', onListening);\n      if (err && err.code === 'EADDRINUSE' && !portIsExplicit && attempt < 100) {\n        if (attempt === 0) {\n          console.log(\\`  [timber] Port \\${port} in use, trying \\${port + 1}...\\`);\n        }\n        listenWithBump(port + 1, attempt + 1).then(resolveListen, rejectListen);\n        return;\n      }\n      rejectListen(err);\n    };\n    const onListening = () => {\n      server.removeListener('error', onError);\n      resolveListen(port);\n    };\n    server.once('error', onError);\n    server.once('listening', onListening);\n    server.listen(port, host);\n  });\n}\n\ntry {\n  boundPort = await listenWithBump(startPort);\n  if (boundPort !== startPort) {\n    console.log();\n    console.log(\\`  [timber] Port \\${startPort} in use, using \\${boundPort}\\`);\n  }\n  console.log();\n  console.log('  ⚡ timber preview server running at:');\n  console.log();\n  console.log(\\`    ➜  http://\\${host}:\\${boundPort}\\`);\n  console.log();\n} catch (err) {\n  if (err && err.code === 'EADDRINUSE') {\n    console.error(\\`[timber] Port \\${startPort} is already in use. \\` +\n      'Set PORT to a free port, or unset PORT to auto-pick.');\n  } else {\n    console.error('[timber] Failed to start preview server:', err);\n  }\n  process.exit(1);\n}\n`;\n}\n\n/** Command descriptor for Nitro preview — testable without spawning. */\nexport interface NitroPreviewCommand {\n  command: string;\n  args: string[];\n  cwd: string;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroPreviewCommand(\n  buildDir: string,\n  preset: NitroPreset\n): NitroPreviewCommand | null {\n  if (!LOCALLY_PREVIEWABLE.has(preset)) return null;\n\n  const nitroDir = join(buildDir, 'nitro');\n  const entryPath = join(nitroDir, 'entry.ts');\n\n  const command = preset === 'bun' ? 'bun' : 'node';\n  return {\n    command,\n    args: [entryPath],\n    cwd: nitroDir,\n  };\n}\n\n/**\n * Run the Nitro production build using the programmatic API.\n * Uses dynamic import so nitro is only loaded at build time.\n * Externalizes the timber RSC/SSR output — those files are pre-built\n * by timber and have internal references that nitro's bundler can't follow.\n */\nasync function runNitroBuild(\n  nitroDir: string,\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): Promise<void> {\n  const presetConfig = PRESET_CONFIGS[preset];\n  const {\n    createNitro,\n    build: nitroBuild,\n    prepare,\n    copyPublicAssets,\n  } = await import('nitro/builder');\n\n  const nitro = await createNitro({\n    rootDir: nitroDir,\n    preset: presetConfig.nitroPreset,\n    // Use renderer.entry so Nitro wraps our handler with its server runtime\n    // (HTTP server, static file serving, graceful shutdown, etc.).\n    // Using `entry` directly would bypass the Nitro server runtime.\n    renderer: { handler: join(nitroDir, 'entry.ts') },\n    output: { dir: join(nitroDir, presetConfig.outputDir) },\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n      '/_timber/fonts/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    // Don't bundle the timber RSC/SSR build output — it has its own\n    // internal file references that nitro's bundler can't follow.\n    // Mark them as external so rollup leaves the imports as-is.\n    rollupConfig: {\n      external: [/\\.\\.\\/rsc\\//],\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  });\n\n  await prepare(nitro);\n  await copyPublicAssets(nitro);\n  await nitroBuild(nitro);\n  await nitro.close();\n}\n\n/** Spawn a Nitro preview process and pipe stdio. */\nfunction spawnNitroPreview(command: string, args: string[], cwd: string): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const child = execFile(command, args, { cwd }, (err) => {\n      if (err) reject(err);\n      else resolve();\n    });\n    child.stdout?.pipe(process.stdout);\n    child.stderr?.pipe(process.stderr);\n  });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Get the preset configuration for a given preset name.\n * @internal Exported for testing.\n */\nexport function getPresetConfig(preset: NitroPreset): PresetConfig {\n  return PRESET_CONFIGS[preset];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,eAAsB,yBAA0C;CAK9D,OACE,oIAEA,MAPmB,iBAAiB,kBAAgB,eAAe,EACnE,MAAM,KACR,CAAC,EAAA,CAKQ;AAEX;;;ACeA,IAAM,iBAAoD;CACxD,UAAU;EACR,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACb,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,GAAG,EAAE,EAAE;CAC5D;CACA,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,WAAW;EACT,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,gBAAgB;EACd,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,cAAc;EACZ,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,mBAAmB;EACjB,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;CACf;CACA,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EAQnB,oBAAoB;EACpB,aAAa;CACf;CACA,OAAO;EACL,aAAa;EACb,WAAW;EACX,mBAAmB;EAGnB,oBAAoB;EACpB,aAAa;CACf;AACF;;;;;;;;;;;;;;;;;AAsDA,SAAgB,MAAM,UAA+B,CAAC,GAA0B;CAC9E,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,eAAe,eAAe;CACpC,MAAM,kBAAsC,CAAC;CAE7C,OAAO;EACL,MAAM,SAAS;EAEf,MAAM,YAAY,QAAsB,UAAkB;GACxD,MAAM,SAAS,KAAK,UAAU,OAAO;GAIrC,MAAM,oBAAoB;IACxB;IACA;IACA;IACA,eAAe;GACjB,CAAC;GAKD,MAAM,UAAU,KAAK,QAAQ,eAAe,GAAG,MAAM,uBAAuB,CAAC;GAM7E,IAAI,OAAO,cAAc;IACvB,MAAM,WAAW,KAAK,QAAQ,OAAO,UAAU;IAC/C,MAAM,aAAa,MAAM,SAAS,UAAU,OAAO;IACnD,MAAM,UAAU,UAAU,GAAG,OAAO,aAAa,IAAI,YAAY;GACnE;GAGA,MAAM,QAAQ,mBAAmB,UAAU,QAAQ,QAAQ,QAAQ;GACnE,MAAM,UAAU,KAAK,QAAQ,UAAU,GAAG,KAAK;GAK/C,MAAM,cAAc,QAAQ,QAAQ,QAAQ,WAAW;EACzD;EAKA,SAAS,oBAAoB,IAAI,MAAM,IACnC,OAAO,SAAuB,aAAqB;GAIjD,MAAM,gBAAgB,sBAAsB,UAAU,MAAM;GAC5D,MAAM,aAAa,KAAK,UAAU,SAAS,qBAAqB;GAChE,MAAM,UAAU,YAAY,aAAa;GAGzC,MAAM,kBADU,WAAW,QAAQ,QAAQ,QACV,CAAC,UAAU,GAAG,KAAK,UAAU,OAAO,CAAC;EACxE,IACA,KAAA;EAEJ,WAAW,aAAa,qBACnB,YAA8B;GAC7B,MAAM,UAAU,QAAQ,OAAO,QAAQ;IACrC,QAAQ,MAAM,wCAAwC,GAAG;GAC3D,CAAC;GACD,gBAAgB,KAAK,OAAO;EAC9B,IACA,KAAA;CACN;AACF;;AAKA,SAAgB,mBACd,UACA,QACA,QACA,WAAW,MACH;CAKR,MAAM,sBAAsB;CAC5B,MAAM,cAAc,eAAe,OAAO,CAAC;CAC3C,MAAM,aAAa,eAAe,OAAO,CAAC;CAC1C,MAAM,oBAAoB,eAAe,OAAO,CAAC;CASjD,IAAI;CACJ,IAAI,cAAc,mBAChB,cAAc;;;;;;;;;;;;;;;;MAgBT,IAAI,YACT,cAAc;;;;;;;;MAQT,IAAI,mBACT,cAAc;;;;;;;MAQd,cAAc;CAShB,OAAO;;;2CALiB,oBAAoB,uBAAuB,GAQV,WAAW,oBAAoB;EANjE,WAAW,yDAAyD,GAO5E;;;gCAGe,YAAY;;;;;;;;;;EAU1C,YAAY;WAnBS,WAAW,8CAA8C,cAoBxD;;;AAGxB;;AAKA,IAAM,sCAAsB,IAAI,IAAiB,CAAC,eAAe,KAAK,CAAC;;;;;;;;;AAUvE,SAAgB,sBAAsB,UAAkB,QAA6B;CACnF,MAAM,mBAAmB,SAAS,KAAK,UAAU,OAAO,GAAG,KAAK,UAAU,OAAO,UAAU,CAAC;CAC5F,MAAM,WAAW,iBAAiB,WAAW,GAAG,IAAI,mBAAmB,OAAO;CAC9E,MAAM,YAAY;CAClB,MAAM,mBAAmB;CAGzB,OAAO;;;;;;;;;;;gCAFa,eAAe,OAAO,CAAC,YAaD;;;;wCAIJ,iBAAiB;;kBAEvC,iBAAiB;;;;sEAImC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B1C,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqN/C;;AAUA,SAAgB,4BACd,UACA,QAC4B;CAC5B,IAAI,CAAC,oBAAoB,IAAI,MAAM,GAAG,OAAO;CAE7C,MAAM,WAAW,KAAK,UAAU,OAAO;CACvC,MAAM,YAAY,KAAK,UAAU,UAAU;CAG3C,OAAO;EACL,SAFc,WAAW,QAAQ,QAAQ;EAGzC,MAAM,CAAC,SAAS;EAChB,KAAK;CACP;AACF;;;;;;;AAQA,eAAe,cACb,UACA,QACA,YACe;CACf,MAAM,eAAe,eAAe;CACpC,MAAM,EACJ,aACA,OAAO,YACP,SACA,qBACE,MAAM,OAAO;CAEjB,MAAM,QAAQ,MAAM,YAAY;EAC9B,SAAS;EACT,QAAQ,aAAa;EAIrB,UAAU,EAAE,SAAS,KAAK,UAAU,UAAU,EAAE;EAChD,QAAQ,EAAE,KAAK,KAAK,UAAU,aAAa,SAAS,EAAE;EACtD,YAAY;GACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,gBAAgB,EAAE;GAC9D,qBAAqB,EAAE,SAAS,EAAE,iBAAiB,gBAAgB,EAAE;EACvE;EAIA,cAAc,EACZ,UAAU,CAAC,aAAa,EAC1B;EACA,GAAG,aAAa;EAChB,GAAG;CACL,CAAC;CAED,MAAM,QAAQ,KAAK;CACnB,MAAM,iBAAiB,KAAK;CAC5B,MAAM,WAAW,KAAK;CACtB,MAAM,MAAM,MAAM;AACpB;;AAGA,SAAS,kBAAkB,SAAiB,MAAgB,KAA4B;CACtF,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,IAAI,IAAI,QAAQ;GACtD,IAAI,KAAK,OAAO,GAAG;QACd,QAAQ;EACf,CAAC;EACD,MAAM,QAAQ,KAAK,QAAQ,MAAM;EACjC,MAAM,QAAQ,KAAK,QAAQ,MAAM;CACnC,CAAC;AACH;;;;;AAQA,SAAgB,gBAAgB,QAAmC;CACjE,OAAO,eAAe;AACxB"}

package/dist/adapters/shared.d.ts

@@ -0,0 +1,6 @@
+/** Cache-Control value for hashed (immutable) assets. */
+export declare const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
+/** Cache-Control value for unhashed static assets. */
+export declare const STATIC_CACHE = "public, max-age=3600, must-revalidate";
+export declare function generateHeadersFile(unhashedPaths?: string[]): string;
+//# sourceMappingURL=shared.d.ts.map

package/dist/adapters/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/adapters/shared.ts"],"names":[],"mappings":"AAaA,yDAAyD;AACzD,eAAO,MAAM,eAAe,wCAAwC,CAAC;AAErE,sDAAsD;AACtD,eAAO,MAAM,YAAY,0CAA0C,CAAC;AAuBpE,wBAAgB,mBAAmB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CA2BpE"}

package/dist/cache/cache-api.d.ts

@@ -0,0 +1,26 @@
+import type { CacheOptions } from './index';
+import type { PrebuiltComponentOptions } from '../server/prebuilt-runtime';
+/**
+ * Public caching API: `cache(fn, opts)`.
+ *
+ * Wraps an async function with cross-request caching. Uses the configured
+ * cache handler (defaults to MemoryCacheHandler, overridable via timber.config.ts).
+ *
+ * ```ts
+ * import { cache } from '@timber-js/app/cache';
+ *
+ * const getUser = cache(
+ *   async (id: string) => db.users.findUnique({ where: { id } }),
+ *   { ttl: 60, tags: (id) => [`user:${id}`] }
+ * );
+ * ```
+ */
+export declare function cache<Fn extends (...args: any[]) => Promise<any>>(fn: Fn, opts: CacheOptions<Fn>, stableId?: string): Fn;
+export declare namespace cache {
+    var invalidate: (opts: {
+        key?: string;
+        tag?: string;
+    }) => Promise<void>;
+    var component: <C extends (props: any) => unknown>(componentFn: C, _options?: PrebuiltComponentOptions) => C;
+}
+//# sourceMappingURL=cache-api.d.ts.map

package/dist/cache/cache-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-api.d.ts","sourceRoot":"","sources":["../../src/cache/cache-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAO3E;;;;;;;;;;;;;;GAcG;AAEH,wBAAgB,KAAK,CAAC,EAAE,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,EAC/D,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,EAAE,CAMJ;yBAVe,KAAK;2BAoB8B;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;oBAgD5D,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,eACvD,CAAC,aACH,wBAAwB,KAClC,CAAC"}