@timber-js/app 0.2.0-alpha.16 → 0.2.0-alpha.160

package/dist/server/rsc-entry/helpers.d.ts

@@ -3,8 +3,7 @@
  *
  * Small, stateless functions used across the RSC entry modules.
  */
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import { RedirectSignal } from '#/server/primitives.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
 /** RSC content type for client navigation payload requests. */
 export declare const RSC_CONTENT_TYPE = "text/x-component";
 /**
@@ -17,14 +16,57 @@ export declare const RSC_CONTENT_TYPE = "text/x-component";
  * stream that we drain and discard.
  *
  * See design/13-security.md §"Server component source leak"
- *
- * TODO: In the future, expose this debug data to the browser in dev mode
- * for inline error overlays (e.g. component stack traces).
  */
 export declare function createDebugChannelSink(): {
     readable: ReadableStream;
     writable: WritableStream;
 };
+/**
+ * Parsed component debug info extracted from the Flight debug channel.
+ *
+ * Contains only component names, environment labels, and stack frames —
+ * never source code or props. See design/13-security.md §"Server source
+ * never reaches the client".
+ */
+export interface DebugComponentEntry {
+    name: string;
+    env: string | null;
+    key: string | null;
+    stack: unknown[] | null;
+}
+/**
+ * A debug channel that collects Flight debug rows instead of discarding them.
+ *
+ * Used in dev mode to capture server component tree information for the
+ * Vite error overlay. The collector provides the same `{ readable, writable }`
+ * shape as the discard sink, plus methods to retrieve collected data.
+ *
+ * Security: only component names, environments, and stack frames are
+ * extracted — props and source code are stripped. In production builds,
+ * use `createDebugChannelSink()` instead (this function is never called).
+ */
+export interface DebugChannelCollector {
+    readable: ReadableStream;
+    writable: WritableStream;
+    /** Get the raw collected text from the debug channel. */
+    getCollectedText(): string;
+    /** Get parsed component entries (names, stacks — no props or source). */
+    getComponents(): DebugComponentEntry[];
+}
+export declare function createDebugChannelCollector(): DebugChannelCollector;
+/**
+ * Parse React Flight debug rows into component entries.
+ *
+ * The Flight debug channel writes rows in `hexId:json\n` format. Each row
+ * with a JSON object containing a `name` field is a component debug info
+ * entry. Rows without `name` (timing rows, reference rows like `D"$id"`)
+ * are skipped.
+ *
+ * Security: `props` are explicitly stripped from parsed entries — they may
+ * contain rendered output or user data. Only `name`, `env`, `key`, and
+ * `stack` are retained.
+ */
+export declare function parseDebugRows(text: string): DebugComponentEntry[];
 /**
  * Build segment metadata for the X-Timber-Segments response header.
  * Describes the rendered segment chain with async status, enabling
@@ -40,6 +82,7 @@ export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layout
     segment: ManifestSegmentNode;
 }>): Array<{
     path: string;
+    segmentId?: string;
     isAsync: boolean;
 }>;
 /**
@@ -47,27 +90,7 @@ export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layout
  * rather than full HTML. Client-side navigation sends Accept: text/x-component.
  */
 export declare function isRscPayloadRequest(req: Request): boolean;
-/**
- * Build a redirect Response. For RSC payload requests (client navigation),
- * return 204 + X-Timber-Redirect header instead of a raw 302. The browser's
- * fetch with redirect: "manual" turns a 302 into an opaque redirect (status 0,
- * null body, inaccessible headers), which crashes createFromFetch when it
- * tries to call .body.getReader(). The X-Timber-Redirect header lets the
- * client detect the redirect and perform a soft SPA navigation.
- */
-export declare function buildRedirectResponse(req: Request, signal: RedirectSignal, responseHeaders: Headers): Response;
-/**
- * Check if an error is an abort error (connection closed by client).
- *
- * When the browser aborts a request (page refresh, navigation away),
- * the AbortSignal fires and React/streams throw an AbortError. This
- * is not an application error — suppress it from error boundaries and logs.
- */
-export declare function isAbortError(error: unknown): boolean;
-export declare function escapeHtml(str: string): string;
-/**
- * Parse a Cookie header string into a name→value Map.
- * Used to populate NavContext.cookies for SSR hooks (useCookie).
- */
-export declare function parseCookiesFromHeader(header: string): Map<string, string>;
+export { buildRedirectResponse } from '../pipeline-helpers.js';
+export { isAbortError } from '../render-utils.js';
+export { escapeHtml } from '../utils/escape-html.js';
 //# sourceMappingURL=helpers.d.ts.map

package/dist/server/rsc-entry/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,GACvB,QAAQ,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1E"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8B/D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAMD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/rsc-entry/index.d.ts

@@ -1,12 +1,34 @@
+import 'virtual:timber-search-params-registry';
+import type { PipelineConfig } from '../pipeline.js';
 /**
- * Set the dev pipeline error handler.
+ * Set the dev source-map handler.
  *
- * Called by the dev server after importing this module to wire pipeline
- * errors into the Vite browser error overlay. No-op in production.
+ * Called by the dev server after importing this module to wire Vite's
+ * module graph source-mapping into the error rendering pipeline. Errors
+ * rendered by renderErrorPage / renderFallbackError will have their
+ * stack traces rewritten to show original source positions.
+ *
+ * No-op in production.
+ */
+export declare function setDevSourceMapHandler(handler: (error: Error) => void): void;
+export { runWithEarlyHintsSender } from '../early-hints-sender.js';
+export { runWithWaitUntil } from '../waituntil-bridge.js';
+export { runWithWorkersCachePurge } from '../workers-cache-bridge.js';
+/**
+ * Post-build flight capture entry point (TIM-1119). The capture pass must
+ * run inside the built RSC bundle — the prebuilt component registry, the
+ * ALS instances, and the flight renderer are module instances in THIS
+ * bundle's graph; an outside import of the framework package would get
+ * fresh, empty copies. The timber-prebuilt plugin imports the built
+ * `rsc/index.js` after the 5-step build and calls this export.
+ * See design/44-render-at-build-time.md §Build Phase.
+ */
+export declare function __timber_capturePrebuilt(options: import('../prebuilt-builder.js').CaptureOptions): Promise<import('../prebuilt-builder.js').CaptureSummary>;
+declare const _handler: (req: Request) => Promise<Response>;
+/**
+ * The pipeline configuration object. Exported so the dev server can set
+ * `devPipelineErrorHandler` after import without a module-level singleton.
  */
-export declare function setDevPipelineErrorHandler(handler: (error: Error, phase: string) => void): void;
-export { runWithEarlyHintsSender } from '#/server/early-hints-sender.js';
-export { runWithWaitUntil } from '#/server/waituntil-bridge.js';
-declare const _default: (req: Request) => Promise<Response>;
-export default _default;
+export declare const pipelineConfig: PipelineConfig;
+export default _handler;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AA0FA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE/F;AAoZD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;8BAtQ3C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AAwQhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AAuB/C,OAAO,KAAK,EAAuB,cAAc,EAAc,MAAM,gBAAgB,CAAC;AAuCtF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAsbD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,wBAAwB,EAAE,cAAc,GACvD,OAAO,CAAC,OAAO,wBAAwB,EAAE,cAAc,CAAC,CAE1D;AAED,QAAA,MAAiB,QAAQ,qCAGxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,gBAAkB,CAAC;AAE9C,eAAe,QAAQ,CAAC"}

package/dist/server/rsc-entry/render-route.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Route renderer — turns a matched route into a Response.
+ *
+ * Extracted from `rsc-entry/index.ts` so the entry can stay focused on
+ * pipeline construction. This module owns the steps that happen *after*
+ * the pipeline has matched a route and before it commits a response:
+ * element-tree build, RSC Flight render, and dispatch to either the SSR
+ * HTML path or the RSC payload path. It also handles the
+ * synchronous-signal escape hatches (deny / redirect / render error
+ * thrown during stream creation) so the entry doesn't carry that logic.
+ *
+ * The function is parameterized over its dependencies — `clientBootstrap`,
+ * `clientJsDisabled`, `rootSegment`, `globalError` — so the entry passes
+ * them in once at handler-construction time and they ride along on every
+ * call. No globals, no closures over the entry's createRequestHandler
+ * scope.
+ *
+ * Design docs: 02-rendering-pipeline.md, 19-client-navigation.md.
+ */
+import type { BuildManifest } from '../build-manifest.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import type { InterceptionContext, RouteMatch } from '../pipeline.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+/**
+ * Static-per-handler dependencies for `renderRoute` — captured once at
+ * handler construction so each per-request call site only has to pass
+ * the request-specific arguments.
+ */
+export interface RenderRouteDeps {
+    clientBootstrap: ClientBootstrapConfig;
+    clientJsDisabled: boolean;
+    rootSegment: ManifestSegmentNode;
+    buildManifest: BuildManifest;
+    globalError?: {
+        load: () => Promise<unknown>;
+        filePath: string;
+    };
+}
+/**
+ * Render a matched route to an HTML Response via RSC → SSR pipeline,
+ * or return a raw RSC Flight stream for client-side navigation requests.
+ *
+ * 1. Load page/layout components from the segment chain
+ * 2. Resolve metadata
+ * 3. Render to RSC Flight stream (serializes "use client" as references)
+ * 4. If Accept: text/x-component → return RSC stream directly
+ *    Otherwise → pass RSC stream to SSR entry for HTML rendering
+ */
+export declare function renderRoute(req: Request, match: RouteMatch, responseHeaders: Headers, deps: RenderRouteDeps, interception?: InterceptionContext): Promise<Response>;
+//# sourceMappingURL=render-route.d.ts.map

package/dist/server/rsc-entry/render-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-route.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/render-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAW1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAa/D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,eAAe,EACrB,YAAY,CAAC,EAAE,mBAAmB,GACjC,OAAO,CAAC,QAAQ,CAAC,CA+MnB"}

package/dist/server/rsc-entry/revalidate-renderer.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Revalidation renderer — builds the React element tree for the target
+ * path requested by `revalidatePath()` from inside a server action, with
+ * the same security guarantees as a normal route render.
+ *
+ * Before this module existed, `revalidatePath()` matched the route, coerced
+ * params, and called `buildRouteElement()` directly. That bypassed the
+ * target route's `middleware.ts` chain entirely. An action that revalidated
+ * a higher-privilege or user-controlled path could leak an authenticated
+ * RSC tree to the action submitter even when middleware on that path
+ * would have denied them.
+ *
+ * The fix (TIM-996) is to run the target route's middleware chain inside
+ * a fresh `runWithRequestContext` scope BEFORE building the element tree,
+ * propagate `DenySignal` and `RedirectSignal` to `executeAction`, drop the
+ * revalidation when middleware returns a short-circuit `Response`, and
+ * lift the request-header overlay onto the action's ALS store so the
+ * revalidated component render sees middleware-injected headers via
+ * `getHeaders()`.
+ *
+ * The input `path` is also validated as a local root-relative pathname so
+ * `revalidatePath('//evil.com/admin')` and similar scheme/authority
+ * injections cannot smuggle a foreign host through `new URL(path, base)`.
+ *
+ * See design/08-forms-and-actions.md §"revalidatePath()" and
+ * design/13-security.md §"Server actions silently bypass middleware".
+ */
+import type { BuildManifest } from '../build-manifest.js';
+import type { RouteMatcher } from '../pipeline.js';
+import type { RevalidateRenderer } from '../actions.js';
+import { type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+/**
+ * Sentinel thrown when revalidation cannot proceed because middleware
+ * returned a short-circuit `Response` (a non-redirect HTTP response that
+ * we cannot translate back to an element tree). `executeAction` catches
+ * this and drops the revalidation — the action result is still delivered,
+ * but no `_tree` is piggybacked onto the response. The matching name
+ * `RevalidationDropped` is exported so callers can identify it via
+ * `instanceof` without leaking the message text to clients.
+ */
+export declare class RevalidationDropped extends Error {
+    constructor(message: string);
+}
+/** Result of validating a `revalidatePath()` argument. */
+type PathValidation = {
+    ok: true;
+    pathname: string;
+    search: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Validate a `revalidatePath()` argument.
+ *
+ * Accepts local root-relative pathnames only. Rejects anything that
+ * `new URL(path, base)` would resolve to a different host or scheme:
+ *
+ *   - Empty / non-string input
+ *   - Anything not starting with `/` (relative, scheme-bearing, etc.)
+ *   - Protocol-relative `//evil.com/admin` — resolves to scheme://evil.com
+ *   - Backslash-prefixed `/\evil.com` — some clients fold `\` into `/`
+ *   - Control characters and null bytes
+ *   - Paths that fail canonicalization (encoded separators, `..` escaping
+ *     root, malformed percent-encoding)
+ *
+ * The pathname is canonicalized so the rest of the renderer matches the
+ * same shape the page pipeline matches.
+ */
+export declare function validateRevalidatePath(path: unknown): PathValidation;
+/** Dependencies for the revalidate renderer factory. */
+export interface RevalidateRendererDeps {
+    matchRoute: RouteMatcher;
+    coerceSegmentParams: CoerceSegmentParamsFn;
+    buildManifest: BuildManifest;
+}
+/**
+ * Build a per-request `RevalidateRenderer`.
+ *
+ * The returned renderer:
+ *   1. Validates the requested path.
+ *   2. Matches the canonicalized path against the route tree.
+ *   3. Coerces segment params via the matched chain's `params.ts` codecs.
+ *   4. Runs the matched route's `middleware.ts` chain inside a fresh
+ *      `runWithRequestContext` scope (via `runMiddlewareForAction`).
+ *      Deny/redirect signals are re-thrown so `executeAction` can apply
+ *      its existing redirect handling and the new deny-drop behavior.
+ *      A short-circuit `Response` becomes `RevalidationDropped`.
+ *   5. Lifts the request-header overlay onto the OUTER action's ALS store
+ *      so the revalidated component render (which happens later inside
+ *      `renderToReadableStream` in the action's scope) observes
+ *      middleware-injected headers via `getHeaders()`. Acceptable because
+ *      revalidation runs after the action body has returned — the only
+ *      remaining ALS readers are render-phase code that should see the
+ *      same overlay a normal page render would see.
+ *   6. Builds and returns the route element tree, ready for the action
+ *      handler to serialize alongside the action result.
+ *
+ * Cookies set inside the revalidation middleware are intentionally NOT
+ * propagated to the action response. The middleware on a *different* path
+ * setting cookies via the action's response is surprising semantics; the
+ * scoped cookie jar on the inner ALS run is discarded with the scope.
+ * The primary security boundary closed here is auth — `deny()` from the
+ * target's middleware now prevents the revalidated tree from leaking.
+ */
+export declare function createRevalidateRendererFactory(deps: RevalidateRendererDeps): (req: Request) => RevalidateRenderer;
+export {};
+//# sourceMappingURL=revalidate-renderer.d.ts.map

package/dist/server/rsc-entry/revalidate-renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidate-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/revalidate-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK/D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAC;AAE5E,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEnG;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,0DAA0D;AAC1D,KAAK,cAAc,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAiCpE;AAwBD,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,YAAY,CAAC;IACzB,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,sBAAsB,GAC3B,CAAC,GAAG,EAAE,OAAO,KAAK,kBAAkB,CA4KtC"}

package/dist/server/rsc-entry/rsc-payload.d.ts

@@ -5,12 +5,11 @@
  * returned directly without SSR HTML rendering. The client decodes it via
  * `createFromFetch` and renders into the hydrated React root.
  *
- * Design docs: 19-client-navigation.md §"RSC Payload Handling",
- *              16-metadata.md §"Head Elements"
+ * Design docs: 19-client-navigation.md §"RSC Payload Handling"
  */
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { HeadElement, LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
+import type { RouteMatch } from '../pipeline.js';
+import type { LayoutComponentEntry } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
 import type { RenderSignals } from './rsc-stream.js';
 /**
  * Build an RSC payload Response for a client-side navigation request.
@@ -21,5 +20,5 @@ import type { RenderSignals } from './rsc-stream.js';
  * initial component tree, allowing onError to capture DenySignal/
  * RedirectSignal before we commit the response. See TIM-344.
  */
-export declare function buildRscPayloadResponse(req: Request, rscStream: ReadableStream<Uint8Array>, signals: RenderSignals, segments: ManifestSegmentNode[], layoutComponents: LayoutComponentEntry[], headElements: HeadElement[], match: RouteMatch, responseHeaders: Headers, skippedSegments?: string[]): Promise<Response>;
+export declare function buildRscPayloadResponse(req: Request, rscStream: ReadableStream<Uint8Array>, signals: RenderSignals, segments: ManifestSegmentNode[], layoutComponents: LayoutComponentEntry[], match: RouteMatch, responseHeaders: Headers, skippedSegments?: string[]): Promise<Response>;
 //# sourceMappingURL=rsc-payload.d.ts.map

package/dist/server/rsc-entry/rsc-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAQrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,YAAY,EAAE,WAAW,EAAE,EAC3B,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,QAAQ,CAAC,CA0HnB"}
+{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAQ/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,QAAQ,CAAC,CAmKnB"}

package/dist/server/rsc-entry/rsc-stream.d.ts

@@ -9,7 +9,8 @@
  * Design docs: 02-rendering-pipeline.md §"Single-Pass Rendering",
  *              13-security.md §"Errors don't leak"
  */
-import { DenySignal, RedirectSignal } from '#/server/primitives.js';
+import { DenySignal, RedirectSignal } from '../primitives.js';
+import { type DebugComponentEntry } from './helpers.js';
 /**
  * Mutable signal state captured during RSC rendering.
  *
@@ -27,12 +28,27 @@ export interface RenderSignals {
         error: unknown;
         status: number;
     } | null;
+    /**
+     * The last unhandled error seen by RSC onError that isn't a signal.
+     * Used as a fallback when SSR fails (SsrStreamError) but no structured
+     * signal was captured — provides the original error for the error page
+     * instead of relying on SsrStreamError.cause extraction.
+     *
+     * NOT used for page-level error detection (that would break Suspense
+     * error isolation). Only consumed when SSR actually fails.
+     */
+    lastUnhandledError: unknown | null;
     /** Callback fired when a redirect or deny signal is captured in onError. */
     onSignal?: () => void;
+    /** Callback fired when an unhandled error (non-signal) is captured. Used
+     *  to halt Flight data injection into the inline stream. */
+    onUnhandledError?: () => void;
 }
 export interface RscStreamResult {
     rscStream: ReadableStream<Uint8Array> | undefined;
     signals: RenderSignals;
+    /** Dev-only: server component debug info from the Flight debug channel. */
+    getDebugComponents?: () => DebugComponentEntry[];
 }
 /**
  * Render a React element tree to an RSC Flight stream.

package/dist/server/rsc-entry/rsc-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-stream.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAe,MAAM,wBAAwB,CAAC;AAMjF;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,WAAW,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CA4G1F"}
+{"version":3,"file":"rsc-stream.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAItB;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,WAAW,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD;;;;;;;;OAQG;IACH,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB;gEAC4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC;IACvB,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,mBAAmB,EAAE,CAAC;CAClD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CA6J1F"}

package/dist/server/rsc-entry/ssr-bridge.d.ts

@@ -1,6 +1,10 @@
 /**
  * SSR Bridge — loads the SSR entry and passes the RSC stream for HTML rendering.
+ *
+ * This is the RSC → SSR environment hop. The two environments are separate
+ * Vite module graphs; `NavContext` is the serializable contract that crosses
+ * the boundary. See `../ssr-bridge-types.ts` for the contract definition.
  */
-import type { NavContext } from '#/server/ssr-entry.js';
+import type { NavContext } from '../ssr-bridge-types.js';
 export declare function callSsr(rscStream: ReadableStream<Uint8Array>, navContext: NavContext): Promise<Response>;
 //# sourceMappingURL=ssr-bridge.d.ts.map

package/dist/server/rsc-entry/ssr-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-bridge.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-bridge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,wBAAsB,OAAO,CAC3B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAMnB"}
+{"version":3,"file":"ssr-bridge.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,wBAAsB,OAAO,CAC3B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAenB"}

package/dist/server/rsc-entry/ssr-renderer.d.ts

@@ -11,11 +11,39 @@
  * Design docs: 02-rendering-pipeline.md §"RSC → SSR → Client Hydration",
  *              05-streaming.md §"deferSuspenseFor and the Hold Window"
  */
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import type { RouteMatch } from '../pipeline.js';
+import type { LayoutComponentEntry } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+import { type GlobalErrorFile } from './error-renderer.js';
 import type { RenderSignals } from './rsc-stream.js';
+/**
+ * Test-only observable: records how many microtask yields were consumed
+ * during the last signal promotion check. Import this in tests to assert
+ * the actual rejection chain depth and detect regressions if wrappers
+ * add more async hops.
+ *
+ * Only populated when the object is imported and exists — production
+ * bundles that don't import it pay zero cost (the typeof check is free).
+ */
+export declare const __test_only_signalPromotionDepth: {
+    value: number;
+};
+/**
+ * Test-only observable: true when the promotion loop hit the cap without
+ * capturing a signal (the silent-miss path — state 3 in TIM-970). False
+ * when the loop captured a signal at any depth, when it was skipped via
+ * `_fizzAllReadyResolved`, or when no signal was ever expected at a depth
+ * shallower than the cap.
+ *
+ * Pairs with `__test_only_signalPromotionDepth`: depth alone cannot
+ * distinguish "cap hit with signal captured on yield 5" from "cap hit with
+ * signal arriving on yield 6+" — both read `.value === 5`. This flag closes
+ * that gap. See TIM-970, design/05-streaming.md §"Signal Promotion".
+ */
+export declare const __test_only_signalPromotionCapHit: {
+    value: boolean;
+};
 interface SsrRenderOptions {
     req: Request;
     rscStream: ReadableStream<Uint8Array>;
@@ -28,6 +56,8 @@ interface SsrRenderOptions {
     clientJsDisabled: boolean;
     headHtml: string;
     deferSuspenseFor: number;
+    /** Tier 2 global-error.tsx file, if present in app/. */
+    globalError?: GlobalErrorFile;
 }
 /**
  * Render the RSC stream to HTML via SSR.

package/dist/server/rsc-entry/ssr-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAYrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,UAAU,gBAAgB;IACxB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsKjF"}
+{"version":3,"file":"ssr-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAY/D,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4BrD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAiB,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAqB,CAAC;AAEtF,UAAU,gBAAgB;IACxB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoVjF"}

package/dist/server/rsc-entry/wrap-action-dispatch.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Action-dispatch wrapper around the route pipeline.
+ *
+ * Extracted from rsc-entry/index.ts so the wiring can be unit-tested in
+ * isolation from Vite's virtual modules. The wrapper is responsible for
+ * four things, in order:
+ *
+ *   1. **Pipeline-boundary CSRF validation** — runs on EVERY unsafe-method
+ *      request, before any dispatch decision. This is the only line of
+ *      defense for `route.ts` API handlers, which never see the action
+ *      handler. See LOCAL-773.
+ *
+ *   2. **Middleware-on-actions execution** — when the request is a server
+ *      action POST and `actions.runMiddleware !== false`, the matched
+ *      route's `middleware.ts` chain runs BEFORE the action body. This
+ *      closes the Next.js CVE-2025-29927 class of bug, where developers
+ *      reasonably believe `middleware.ts` runs on every request and find
+ *      out (the hard way) that actions silently bypass it. Middleware can
+ *      short-circuit with a `Response`, `redirect()`, or `deny()`; can
+ *      mutate cookies; and can inject request headers visible to the
+ *      action body via `getHeaders()`. See TIM-871.
+ *
+ *   3. **Server action interception** — POST requests carrying an
+ *      `x-rsc-action` header or React's `$ACTION_REF` form fields are
+ *      handed to `handleActionRequest`, which executes the action and
+ *      returns either an RSC response or a no-JS rerender signal.
+ *
+ *   4. **No-JS validation rerender** — when an action returns flash data
+ *      instead of a redirect, the wrapper re-runs the page render via the
+ *      pipeline with the post-action cookie state and `runWithFormFlash`
+ *      so server components can read the flash. The synthetic GET is
+ *      marked via `markRequestBypassMiddleware` so the pipeline does not
+ *      double-execute middleware on it. See TIM-836 / TIM-837 / TIM-871.
+ *
+ * Anything else falls through to `pipeline(req)` for normal route handling.
+ *
+ * The wrapper takes its dependencies as parameters (no module-level
+ * imports of virtual modules) so tests can construct it with stub
+ * pipelines, stub revalidate renderers, and stub route matchers.
+ */
+import type { BodyLimitsConfig } from '../body-limits.js';
+import { type CsrfConfig } from '../csrf.js';
+import { DenySignal } from '../primitives.js';
+import type { RouteMatch, RouteMatcher } from '../pipeline.js';
+import type { SensitiveFieldsOption } from '../sensitive-fields.js';
+import type { RevalidateRenderer } from '../actions.js';
+import { type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+/**
+ * Build a `RevalidateRenderer` for a specific request.
+ *
+ * The renderer needs to forward cookies/headers from the originating
+ * request when fetching the revalidated route. We pass the request in
+ * via a builder so the wrapper doesn't need to know about route matching,
+ * segment param coercion, or element building — those concerns stay in
+ * `rsc-entry/index.ts`.
+ */
+export type RevalidateRendererFactory = (req: Request) => RevalidateRenderer;
+/** Optional renderer for fallback deny pages — mirrors `PipelineConfig.renderDenyFallback`. */
+export type RenderDenyFallbackFn = (deny: DenySignal, req: Request, responseHeaders: Headers, match?: RouteMatch) => Response | Promise<Response>;
+/** Dependencies for the action-dispatch wrapper. */
+export interface ActionDispatchDeps {
+    /** CSRF configuration (Origin allow-list, on/off switch). */
+    csrfConfig: CsrfConfig;
+    /** Body size limits forwarded to `handleActionRequest`. */
+    bodyLimits?: BodyLimitsConfig['limits'];
+    /** Sensitive-field deny-list forwarded to `handleActionRequest`. */
+    sensitiveFields?: SensitiveFieldsOption;
+    /** Per-request factory that builds a `RevalidateRenderer`. */
+    buildRevalidateRenderer: RevalidateRendererFactory;
+    /**
+     * Route matcher — when present, enables middleware-on-actions execution.
+     * Mirrors `PipelineConfig.matchRoute`. Tests that don't exercise the
+     * middleware path may omit this; the wrapper falls back to the legacy
+     * "actions skip middleware" behavior.
+     */
+    matchRoute?: RouteMatcher;
+    /**
+     * Segment-param coercer — runs the matched route's `params.ts` codecs
+     * so the middleware context sees typed `segmentParams`. Required when
+     * `matchRoute` is provided.
+     */
+    coerceSegmentParams?: CoerceSegmentParamsFn;
+    /**
+     * Renderer for fallback deny pages — used when middleware throws a
+     * `DenySignal` and the framework wants to render `403.tsx` / `404.tsx`
+     * instead of returning a bare empty Response. Optional — when omitted
+     * the wrapper falls back to a bare status response.
+     */
+    renderDenyFallback?: RenderDenyFallbackFn;
+    /**
+     * Whether to run `middleware.ts` on server action requests. Defaults
+     * to `true` (the safe default). Controlled by
+     * `actions.runMiddleware` in `timber.config.ts`. See TIM-871.
+     */
+    runMiddleware?: boolean;
+    /**
+     * Whether to strip trailing slashes during pathname canonicalization
+     * for route matching. Mirrors `PipelineConfig.stripTrailingSlash`;
+     * defaults to `true` when omitted, matching the page pipeline. The
+     * wrapper MUST canonicalize before matching so non-canonical action
+     * POSTs (`/admin/`, `/admin//`, encoded separators) cannot bypass the
+     * middleware gate by missing the route match and falling through to
+     * the legacy path. See TIM-871 / codex review.
+     */
+    stripTrailingSlash?: boolean;
+}
+/**
+ * Wrap a pipeline function with CSRF validation and server-action dispatch.
+ *
+ * The returned handler is the framework's outermost request entry point.
+ * Its responsibilities are documented in the file header.
+ *
+ * The duplicate `validateCsrf` call inside `handleActionRequest` is left in
+ * place as defense-in-depth (no-op on the happy path) so the action handler
+ * remains safe to call from any future entry point that bypasses this
+ * wrapper. See LOCAL-773.
+ */
+export declare function wrapPipelineWithActionDispatch(pipeline: (req: Request) => Promise<Response>, deps: ActionDispatchDeps): (req: Request) => Promise<Response>;
+//# sourceMappingURL=wrap-action-dispatch.d.ts.map

package/dist/server/rsc-entry/wrap-action-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap-action-dispatch.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/wrap-action-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAI3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQ9C,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAInG;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,kBAAkB,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,KAAK,CAAC,EAAE,UAAU,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,UAAU,CAAC;IACvB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,oEAAoE;IACpE,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,8DAA8D;IAC9D,uBAAuB,EAAE,yBAAyB,CAAC;IACnD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC7C,IAAI,EAAE,kBAAkB,GACvB,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA8SrC"}