@timber-js/app 0.2.0-alpha.161 → 0.2.0-alpha.164

package/src/plugins/prebuilt.ts

@@ -60,7 +60,6 @@
 import { readFileSync } from 'node:fs';
 import { relative } from 'node:path';
 import MagicString from 'magic-string';
-import { parseAst } from 'vite';
 import type { Plugin } from 'vite';
 import type { PluginContext } from '../plugin-context.js';
 import type { SegmentNode } from '../routing/types.js';
@@ -70,6 +69,7 @@ import {
   generateStableCallsiteId,
 } from './callsite-ast.js';
 import { collectJsxUsages, recordCallSiteProps } from './callsite-jsx.js';
+import { mayPrerender, unwrapExpression } from './prebuilt-options-analysis.js';
 import { cleanPrebuiltDir, runPrebuiltCapture } from './prebuilt-capture.js';
 import type {
   CallExpressionNode,
@@ -135,86 +135,6 @@ function importInsertionOffset(program: ProgramNode): number {
   return program.body.length > 0 ? program.body[program.body.length - 1].end : 0;
 }
 
-/** TS/paren wrappers that may sit between a declarator and the call. */
-const EXPRESSION_WRAPPER_TYPES = new Set([
-  'TSAsExpression',
-  'TSSatisfiesExpression',
-  'TSNonNullExpression',
-  'ParenthesizedExpression',
-]);
-
-function unwrapExpression(node: PositionedNode): PositionedNode {
-  let current = node;
-  while (EXPRESSION_WRAPPER_TYPES.has(current.type) && current.expression) {
-    current = current.expression as PositionedNode;
-  }
-  return current;
-}
-
-interface ObjectPropertyNode extends PositionedNode {
-  type: 'Property';
-  computed?: boolean;
-  key: PositionedNode & { name?: string; value?: unknown };
-  value: PositionedNode & { value?: unknown };
-}
-
-/**
- * Can this call site's options put the component in the prerender tier?
- *
- * Runtime-tier call sites (`ttl`/`tags` without `prerender`) must do NO
- * build work — recording them would make the post-build hook import the
- * built RSC entry (running production startup) and load route modules for
- * routes that have nothing to prerender (codex P2 on PR #836). The answer
- * is static only when the options argument is an object literal:
- *
- *   - literal with `prerender: true`            → yes
- *   - literal with `prerender: false`/absent    → no  (spread-free)
- *   - anything else (identifier, spread, non-literal `prerender` value)
- *     → conservatively yes — the capture pass re-checks the real options
- *       at runtime and skips non-prerender registrations; over-inclusion
- *       costs a wasted entry load, under-inclusion would silently skip
- *       prerendering.
- */
-function mayPrerender(call: CallExpressionNode): boolean {
-  if (call.arguments.length < 2) return false; // no options → no lifetime → never prerender
-  const options = unwrapExpression(call.arguments[1] as PositionedNode);
-  if (options.type !== 'ObjectExpression') return true;
-  const properties = (options as unknown as { properties: PositionedNode[] }).properties ?? [];
-  // Walk in source order with last-write-wins, mirroring object-literal
-  // evaluation: `{ prerender: false, ...opts }` may end up prerenderable
-  // (the spread can override), while `{ ...opts, prerender: false }`
-  // is statically false (codex P2 on PR #836). Computed keys are treated
-  // like spreads — they may evaluate to 'prerender'.
-  type Verdict = 'absent' | 'true' | 'false' | 'unknown';
-  let verdict: Verdict = 'absent';
-  for (const prop of properties) {
-    if (prop.type === 'SpreadElement') {
-      verdict = 'unknown';
-      continue;
-    }
-    if (prop.type !== 'Property') continue;
-    const property = prop as ObjectPropertyNode;
-    if (property.computed) {
-      verdict = 'unknown';
-      continue;
-    }
-    const keyName =
-      property.key.type === 'Identifier'
-        ? property.key.name
-        : property.key.type === 'Literal'
-          ? String(property.key.value)
-          : undefined;
-    if (keyName !== 'prerender') continue;
-    const value = unwrapExpression(property.value);
-    if (value.type === 'Literal') {
-      verdict = (value as { value?: unknown }).value === true ? 'true' : 'false';
-    } else {
-      verdict = 'unknown'; // `prerender: flag` — not statically known
-    }
-  }
-  return verdict === 'true' || verdict === 'unknown';
-}
-
 interface CandidateSite {
   call: CallExpressionNode;
   stmt: PositionedNode;
@@ -336,44 +256,40 @@ function collectPageAndLayoutFiles(root: SegmentNode): string[] {
   return files;
 }
 
-/**
- * For a route file (page/layout), check if it imports from any prebuilt-
- * declaring module and extract JSX call-site props for those bindings.
- * Uses `getModuleInfo` to get the RESOLVED import targets and the module's
- * transformed code (available on Rollup's ModuleInfo at generateBundle).
- */
-function collectCrossModuleProps(
+// Sentinel key for default-export component IDs in the binding map.
+// Uses \0 prefix so it can never collide with a real JS export name
+// (TIM-1187: 'Component'/'default' leaked into the named-import namespace).
+const DEFAULT_SENTINEL = '\0default';
+
+async function collectCrossModuleProps(
   ctx: PluginContext,
   moduleId: string,
-  getInfo: (id: string) => PrebuiltModuleInfo | null
-): void {
+  getInfo: (id: string) => PrebuiltModuleInfo | null,
+  resolve: (source: string, importer: string) => Promise<string | null>
+): Promise<void> {
   const bindingNames = ctx.prebuiltBindingNames!;
 
   const info = getInfo(moduleId);
   if (!info) return;
 
-  // Which of this module's imports are prebuilt-declaring modules?
-  // Exclude self — same-module usages are already captured in the transform.
   const declaringImports = info.importedIds.filter((id) => bindingNames.has(id) && id !== moduleId);
   if (declaringImports.length === 0) return;
 
   // Collect exported binding names from reachable declaring modules.
-  // On collision (two declaring modules export the same name) drop the
-  // entry — we can't tell which import it came from without resolving the
-  // raw specifier, and a wrong match would produce spurious cache entries.
+  // Skip sentinel keys — they are per-module and handled in the default
+  // import branch below. Only real export names go into the merged map.
   const exportNameToId = new Map<string, string>();
   const collisions = new Set<string>();
   for (const declId of declaringImports) {
     const map = bindingNames.get(declId)!;
     for (const [name, compId] of map) {
+      if (name === DEFAULT_SENTINEL) continue;
       if (exportNameToId.has(name)) collisions.add(name);
       exportNameToId.set(name, compId);
     }
   }
   for (const name of collisions) exportNameToId.delete(name);
 
-  // Read the route file source. getModuleInfo may provide `code` on
-  // Vite's extended Rollup interface; fall back to reading from disk.
   let source: string | null = null;
   const extInfo = getInfo(moduleId) as unknown as { code?: string | null };
   if (extInfo && typeof extInfo.code === 'string') {
@@ -389,17 +305,17 @@ function collectCrossModuleProps(
 
   let program: ProgramNode;
   try {
-    program = parseAst(source, { lang: 'tsx' }) as unknown as ProgramNode;
+    program = ctx.parseCached!.parse(source);
   } catch {
     return;
   }
 
-  // Build local-name → componentId by matching import specifiers against
-  // the known exported binding names from declaring modules.
+  const declaringSet = new Set(declaringImports);
   const localToComponentId = new Map<string, string>();
   for (const stmt of program.body) {
     if (stmt.type !== 'ImportDeclaration') continue;
     const importDecl = stmt as unknown as {
+      source: { value: string };
       specifiers: Array<{
         type: string;
         local: { name: string };
@@ -409,19 +325,26 @@ function collectCrossModuleProps(
     for (const spec of importDecl.specifiers) {
       if (spec.type === 'ImportSpecifier') {
         const exportedName = spec.imported?.name ?? spec.local.name;
-        const compId = exportNameToId.get(exportedName);
-        if (compId) localToComponentId.set(spec.local.name, compId);
+        // `import { default as X }` is parsed as an ImportSpecifier
+        // with imported.name === 'default' — route through the same
+        // per-source sentinel lookup as ImportDefaultSpecifier.
+        if (exportedName === 'default') {
+          const resolvedId = await resolve(importDecl.source.value, moduleId);
+          if (resolvedId && declaringSet.has(resolvedId)) {
+            const map = bindingNames.get(resolvedId)!;
+            const compId = map.get(DEFAULT_SENTINEL);
+            if (compId) localToComponentId.set(spec.local.name, compId);
+          }
+        } else {
+          const compId = exportNameToId.get(exportedName);
+          if (compId) localToComponentId.set(spec.local.name, compId);
+        }
       } else if (spec.type === 'ImportDefaultSpecifier') {
-        // Default exports may be declared as `export default cache.component(...)`
-        // (recorded as 'Component') or `const X = cache.component(...); export default X`
-        // (recorded under the variable name 'X'). When the declaring module has
-        // exactly one prebuilt binding, a default import unambiguously refers to it.
-        const compId = exportNameToId.get('Component') ?? exportNameToId.get('default');
-        if (compId) {
-          localToComponentId.set(spec.local.name, compId);
-        } else if (exportNameToId.size === 1) {
-          const [, soleId] = [...exportNameToId.entries()][0];
-          localToComponentId.set(spec.local.name, soleId);
+        const resolvedId = await resolve(importDecl.source.value, moduleId);
+        if (resolvedId && declaringSet.has(resolvedId)) {
+          const map = bindingNames.get(resolvedId)!;
+          const compId = map.get(DEFAULT_SENTINEL);
+          if (compId) localToComponentId.set(spec.local.name, compId);
         }
       }
     }
@@ -462,7 +385,7 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
 
       let program: ProgramNode;
       try {
-        program = parseAst(code, { lang: 'tsx' }) as unknown as ProgramNode;
+        program = ctx.parseCached!.parse(code);
       } catch {
         return;
       }
@@ -516,14 +439,25 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
         // prop detection at generateBundle time (TIM-1142).
         const bindingMap = new Map<string, string>();
         let componentIdIdx = 0;
-        for (const { call, displayName } of callSites) {
+        for (const { call, stmt, displayName } of callSites) {
           if (!ctx.dev && mayPrerender(call)) {
-            bindingMap.set(displayName, componentIds[componentIdIdx++]);
+            const compId = componentIds[componentIdIdx++];
+            // Direct `export default cache.component(...)` produces
+            // displayName 'Component' from an ExportDefaultDeclaration —
+            // a synthetic name, not a real export. Store only the sentinel
+            // key. A variable literally named `Component` (from a
+            // VariableDeclarator) is a real binding and stored as-is.
+            if (stmt.type === 'ExportDefaultDeclaration') {
+              bindingMap.set(DEFAULT_SENTINEL, compId);
+            } else {
+              bindingMap.set(displayName, compId);
+            }
           }
         }
-        // Detect `export default <identifier>` re-exports that reference
-        // a declared binding and add a 'default' alias so cross-module
-        // default imports can resolve the component ID.
+        // Detect default re-exports that reference a declared binding
+        // and add a sentinel alias so cross-module default imports can
+        // resolve the component ID. Handles both `export default X` and
+        // `export { X as default }` (TIM-1189).
         for (const stmt of program.body) {
           if (
             stmt.type === 'ExportDefaultDeclaration' &&
@@ -531,8 +465,21 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
             (stmt.declaration as PositionedNode).type === 'Identifier'
           ) {
             const name = (stmt.declaration as PositionedNode as unknown as IdentifierNode).name;
-            if (bindingMap.has(name) && !bindingMap.has('default')) {
-              bindingMap.set('default', bindingMap.get(name)!);
+            if (bindingMap.has(name) && !bindingMap.has(DEFAULT_SENTINEL)) {
+              bindingMap.set(DEFAULT_SENTINEL, bindingMap.get(name)!);
+            }
+          }
+          if (stmt.type === 'ExportNamedDeclaration' && Array.isArray(stmt.specifiers)) {
+            for (const spec of stmt.specifiers as Array<{
+              local: IdentifierNode;
+              exported: IdentifierNode;
+            }>) {
+              if (spec.exported.name === 'default') {
+                const compId = bindingMap.get(spec.local.name);
+                if (compId && !bindingMap.has(DEFAULT_SENTINEL)) {
+                  bindingMap.set(DEFAULT_SENTINEL, compId);
+                }
+              }
             }
           }
         }
@@ -545,7 +492,10 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
         // Same-module JSX usages: if a prebuilt component is declared AND
         // used (<BlogBody variant="full" />) in the same module, capture
         // its static call-site props here (TIM-1142, design/44 §Props).
-        const declaredBindings = new Set(bindingMap.keys());
+        // Exclude sentinel keys — they are not real JSX element names.
+        const declaredBindings = new Set(
+          [...bindingMap.keys()].filter((k) => k !== DEFAULT_SENTINEL)
+        );
         if (declaredBindings.size > 0) {
           const usages = collectJsxUsages(program, declaredBindings);
           for (const [bindingName, propsList] of usages) {
@@ -582,7 +532,7 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
      * SHARED components work — a component imported by several routes is
      * captured under every importing route's param combos.
      */
-    generateBundle(
+    async generateBundle(
       _options?: unknown,
       bundle?: Record<
         string,
@@ -591,18 +541,23 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
     ) {
       if (ctx.dev) return;
       if (this?.environment?.name !== 'rsc') return;
-      // Recompute attribution from scratch every build — a stale map from
-      // a previous watch-mode build would otherwise keep scheduling the
-      // capture (and its built-entry import) for components that no
-      // longer exist (codex P2 on PR #836).
       ctx.routePrebuiltComponents = undefined;
       const moduleComponents = ctx.prebuiltModuleComponents;
       if (!moduleComponents || moduleComponents.size === 0 || !ctx.routeTree) return;
 
       const self = this as unknown as {
         getModuleInfo?: (id: string) => PrebuiltModuleInfo | null;
+        resolve?: (
+          source: string,
+          importer: string,
+          opts?: unknown
+        ) => Promise<{ id: string } | null>;
       };
       const getInfo = (id: string) => self.getModuleInfo?.(id) ?? null;
+      const resolveFn = async (source: string, importer: string): Promise<string | null> => {
+        const result = await self.resolve?.(source, importer);
+        return result?.id ?? null;
+      };
 
       const routeComponents = new Map<string, string[]>();
       for (const filePath of collectPageAndLayoutFiles(ctx.routeTree.root)) {
@@ -648,7 +603,7 @@ export function timberPrebuilt(ctx: PluginContext): Plugin {
               visited.add(modId);
               if (!scannedModules.has(modId)) {
                 scannedModules.add(modId);
-                collectCrossModuleProps(ctx, modId, getInfo);
+                await collectCrossModuleProps(ctx, modId, getInfo, resolveFn);
               }
               const modInfo = getInfo(modId);
               if (!modInfo) continue;

package/src/plugins/prerender-sugar.ts

@@ -22,7 +22,6 @@
  */
 
 import MagicString from 'magic-string';
-import { parseAst } from 'vite';
 import type { Plugin } from 'vite';
 import type { PluginContext } from '../plugin-context.js';
 import type { SegmentNode, RouteFile } from '../routing/types.js';
@@ -205,7 +204,7 @@ export function timberPrerenderSugar(ctx: PluginContext): Plugin {
       // This page has a resolved prerender value — wrap its default export
       let program: { body: AstNode[] };
       try {
-        program = parseAst(code, { lang: 'tsx' }) as unknown as { body: AstNode[] };
+        program = ctx.parseCached!.parse(code) as unknown as { body: AstNode[] };
       } catch {
         return;
       }

package/src/server/html-injector-core.ts

@@ -112,58 +112,116 @@ export class BufferAggregator {
  *
  * - `passthrough` — already found and removed the suffix on a previous chunk.
  *   Caller emits the chunk unchanged.
- * - `noSuffix` — current chunk does not contain the suffix. Caller emits unchanged.
+ * - `noSuffix` — current chunk does not contain the suffix. When `emitSafe`
+ *   is set, the caller must emit those bytes (the safe head minus the
+ *   retained tail). When `emitSafe` is null, the entire chunk was absorbed
+ *   into the tail buffer and there is nothing to emit yet.
  * - `suffixFound` — caller emits `before` and `after` (skipping the suffix
  *   itself). The suffix will be re-emitted later by {@link suffixFlush}.
  */
 export type SuffixChunkResult =
   | { kind: 'passthrough' }
-  | { kind: 'noSuffix' }
+  | { kind: 'noSuffix'; emitSafe?: Uint8Array }
   | { kind: 'suffixFound'; before: Uint8Array | null; after: Uint8Array | null };
 
+/**
+ * State for the suffix mover. Works entirely in bytes — no TextDecoder
+ * needed because `</body></html>` is pure ASCII and its byte values are
+ * all < 0x80, so the pattern cannot appear inside multi-byte UTF-8
+ * sequences. This avoids the surrogate-pair and codepoint-corruption
+ * hazards that a text-based search + re-encode would introduce.
+ *
+ * We retain a trailing byte buffer (length `SUFFIX_BYTES.length - 1`)
+ * across chunks so the suffix is detected even when split across chunk
+ * boundaries — the same tail-buffer approach the head injector uses.
+ */
 export interface SuffixState {
   found: boolean;
+  /** Trailing bytes from the previous chunk for cross-boundary search. */
+  tail: Uint8Array | null;
+  readonly tailLen: number;
 }
 
 export function createSuffixState(): SuffixState {
-  return { found: false };
+  return {
+    found: false,
+    tail: null,
+    tailLen: SUFFIX_BYTES.byteLength - 1,
+  };
+}
+
+/** Find `needle` in `haystack` starting from byte offset `start`. Returns -1 if not found. */
+function indexOfBytes(haystack: Uint8Array, needle: Uint8Array, start = 0): number {
+  const hLen = haystack.byteLength;
+  const nLen = needle.byteLength;
+  if (nLen === 0) return start;
+  const last = hLen - nLen;
+  outer: for (let i = start; i <= last; i++) {
+    for (let j = 0; j < nLen; j++) {
+      if (haystack[i + j] !== needle[j]) continue outer;
+    }
+    return i;
+  }
+  return -1;
+}
+
+/** Concatenate two Uint8Arrays into one. */
+function concatBytes(a: Uint8Array, b: Uint8Array): Uint8Array {
+  const result = new Uint8Array(a.byteLength + b.byteLength);
+  result.set(a, 0);
+  result.set(b, a.byteLength);
+  return result;
 }
 
 /**
- * Search a chunk for {@link SUFFIX}. If found, mark state and return the
- * surrounding bytes (the caller emits them; the suffix is held for the
- * end of the stream). The bytes-vs-text dance matches what both Web and
- * Node implementations did before extraction — search via decoded UTF-8
- * to avoid splitting multi-byte characters at the suffix boundary.
+ * Search a chunk for {@link SUFFIX_BYTES}. If found, mark state and return
+ * the surrounding bytes (the caller emits them; the suffix is held for the
+ * end of the stream). A trailing byte tail is retained across calls so the
+ * suffix is detected even when split across chunk boundaries.
+ *
+ * All output is raw byte slices — no text decoding or re-encoding — so
+ * multi-byte UTF-8 codepoints and astral characters are never corrupted.
  */
 export function processSuffixChunk(state: SuffixState, chunk: Uint8Array): SuffixChunkResult {
   if (state.found) return { kind: 'passthrough' };
 
-  const text = new TextDecoder().decode(chunk, { stream: true });
-  const idx = text.indexOf(SUFFIX);
-  if (idx === -1) return { kind: 'noSuffix' };
-
-  state.found = true;
-
-  // Whole chunk was the suffix — nothing to emit before/after.
-  if (chunk.byteLength === SUFFIX_BYTES.byteLength) {
-    return { kind: 'suffixFound', before: null, after: null };
+  // Combine tail (if any) with the new chunk for searching.
+  const combined = state.tail ? concatBytes(state.tail, chunk) : chunk;
+
+  const idx = indexOfBytes(combined, SUFFIX_BYTES);
+  if (idx !== -1) {
+    state.found = true;
+    state.tail = null;
+    const beforeEnd = idx;
+    const afterStart = idx + SUFFIX_BYTES.byteLength;
+    return {
+      kind: 'suffixFound',
+      before: beforeEnd > 0 ? combined.slice(0, beforeEnd) : null,
+      after: afterStart < combined.byteLength ? combined.slice(afterStart) : null,
+    };
   }
 
-  const beforeText = text.slice(0, idx);
-  const afterText = text.slice(idx + SUFFIX.length);
-  return {
-    kind: 'suffixFound',
-    before: beforeText ? encoder.encode(beforeText) : null,
-    after: afterText ? encoder.encode(afterText) : null,
-  };
+  // Suffix not yet seen — emit everything except the last tailLen bytes,
+  // which might be the start of the suffix split across chunks.
+  const safeEnd = Math.max(0, combined.byteLength - state.tailLen);
+  state.tail = combined.slice(safeEnd);
+
+  if (safeEnd === 0) return { kind: 'noSuffix' };
+  return { kind: 'noSuffix', emitSafe: combined.slice(0, safeEnd) };
 }
 
 /**
- * Final emit for the suffix mover. Always returns the suffix bytes — even
- * if no suffix was ever observed in the input — so output is well-formed.
+ * Final emit for the suffix mover. Returns any leftover tail bytes
+ * followed by the suffix. Always appends the suffix — even if none was
+ * ever observed in the input — so output is well-formed.
  */
-export function suffixFlush(_state: SuffixState): Uint8Array {
+export function suffixFlush(state: SuffixState): Uint8Array {
+  if (state.tail && state.tail.byteLength > 0) {
+    const result = concatBytes(state.tail, SUFFIX_BYTES);
+    state.tail = null;
+    return result;
+  }
+  state.tail = null;
   return SUFFIX_BYTES;
 }
 

package/src/server/html-injectors.ts

@@ -110,10 +110,14 @@ export function createMoveSuffixStream(): TransformStream<Uint8Array, Uint8Array
   return new TransformStream<Uint8Array, Uint8Array>({
     transform(chunk, controller) {
       const result = processSuffixChunk(state, chunk);
-      if (result.kind === 'passthrough' || result.kind === 'noSuffix') {
+      if (result.kind === 'passthrough') {
         controller.enqueue(chunk);
         return;
       }
+      if (result.kind === 'noSuffix') {
+        if (result.emitSafe) controller.enqueue(result.emitSafe);
+        return;
+      }
       if (result.before) controller.enqueue(result.before);
       if (result.after) controller.enqueue(result.after);
     },

package/src/server/node-stream-transforms.ts

@@ -103,11 +103,16 @@ export function createNodeMoveSuffixTransform(): Transform {
   return new Transform({
     transform(chunk: Buffer, _encoding, callback) {
       const result = processSuffixChunk(state, chunk);
-      if (result.kind === 'passthrough' || result.kind === 'noSuffix') {
+      if (result.kind === 'passthrough') {
         this.push(chunk);
         callback();
         return;
       }
+      if (result.kind === 'noSuffix') {
+        if (result.emitSafe) this.push(Buffer.from(result.emitSafe));
+        callback();
+        return;
+      }
       if (result.before) this.push(Buffer.from(result.before));
       if (result.after) this.push(Buffer.from(result.after));
       callback();

package/src/server/pipeline-phases.ts

@@ -446,7 +446,10 @@ export async function handleRequest(
   // Fires before middleware so the browser can begin fetching critical
   // assets while middleware runs. Non-fatal — a failing emitter never
   // blocks the request.
-  if (config.earlyHints) {
+  //
+  // Skip on RSC requests (client-side navigations) — the browser already
+  // has CSS, fonts, and JS chunks from the initial full-page load.
+  if (config.earlyHints && !isRscRequest) {
     try {
       await config.earlyHints(match, req, responseHeaders);
     } catch (err) {

package/src/server/prebuilt/cache-key.ts

@@ -177,6 +177,80 @@ function toUnkeyable(error: unknown): null {
   return null;
 }
 
+/**
+ * Split a props record into data props (participate in the cache key) and
+ * slot values (React-element holes, excluded from the key) per the
+ * component's declared `slots` option (TIM-1173).
+ *
+ * Every DECLARED slot lands in `slotValues` — present or not — because the
+ * capture render always injects a SlotOutlet placeholder for each declared
+ * slot: the cached shell is identical whether the caller passed the slot
+ * or omitted it, so slot presence must not vary the key. `dataProps` is
+ * everything else and is what gets hashed.
+ *
+ * Returns null when the props OBJECT itself is outside the identity
+ * contract at the top level — accessors, symbol-keyed or non-enumerable
+ * properties, or a non-`Object.prototype` prototype. Splitting such an
+ * object would normalize away observable state (and reading an accessor
+ * would invoke user code, which this walk must never do) BEFORE
+ * `computeComponentCacheKey` gets the chance to reject it — a cached
+ * shell could then be served for inputs a live render distinguishes.
+ * Null means unkeyable: the caller renders live with the original props.
+ * The walk is descriptor-reads only; getters are never invoked. Nested
+ * data-prop values still face the full allowlist when hashed.
+ */
+/** Create an own enumerable data property — safe for keys like `__proto__`. */
+function defineOwn(target: Record<string, unknown>, key: string, value: unknown): void {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true,
+  });
+}
+
+export function splitSlotProps(
+  props: Record<string, unknown>,
+  slots: readonly string[]
+): { dataProps: Record<string, unknown>; slotValues: Record<string, unknown> } | null {
+  // TOTAL, like tryCanonicalize: the reflection ops below run against a
+  // user-controlled object, and a Proxy trap (getPrototypeOf, ownKeys,
+  // getOwnPropertyDescriptor) can throw arbitrarily — that must degrade
+  // to unkeyable (live render), not abort the request. toUnkeyable logs
+  // the unexpected throw for visibility. Codex P2 on PR #890.
+  try {
+    if (Object.getPrototypeOf(props) !== Object.prototype) return null;
+    if (Object.getOwnPropertySymbols(props).length > 0) return null;
+    const slotSet = new Set(slots);
+    const dataProps: Record<string, unknown> = {};
+    const slotValues: Record<string, unknown> = {};
+    // Own-property defines + Object.hasOwn, never assignment or `in`: a
+    // prop/slot legitimately named `__proto__` must land as an own data
+    // property (assignment would mutate the map's prototype), and an absent
+    // slot named `toString`/`constructor` must not read as present through
+    // the prototype chain (the provider would then expose the inherited
+    // function instead of undefined). Codex P2 on PR #890.
+    for (const key of Object.getOwnPropertyNames(props)) {
+      const desc = Object.getOwnPropertyDescriptor(props, key);
+      if (
+        desc === undefined ||
+        desc.get !== undefined ||
+        desc.set !== undefined ||
+        !desc.enumerable
+      ) {
+        return null;
+      }
+      defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
+    }
+    for (const slot of slotSet) {
+      if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, undefined);
+    }
+    return { dataProps, slotValues };
+  } catch (error) {
+    return toUnkeyable(error);
+  }
+}
+
 /**
  * Compute the cache-entry hash for a component render:
  * `sha256({props, params}).slice(0, 16)` over canonical JSON.