@timber-js/app 0.2.0-alpha.166 → 0.2.0-alpha.168

package/dist/server/internal.js

@@ -1,8 +1,8 @@
 import { a as classifyMetadataRoute, i as METADATA_ROUTE_CONVENTIONS, o as getMetadataRouteAutoLink, r as canonicalize, s as getMetadataRouteServePath } from "../_chunks/canonicalize-P41GR6tY.js";
 import { n as classifyUrlSegment } from "../_chunks/segment-classify-CDDRVKs7.js";
-import { A as runWithRequestContext, D as getSearchParams, G as getTraceId, H as generateTraceId, I as getSetCookieHeaders, J as setSpanAttribute, K as replaceTraceId, L as getWaitUntil, M as setMutableCookieContext, N as setSegmentParams, O as getSegmentParams, P as getCookie, Q as requestContextAls, R as isDebug, T as getHeader, U as getOtelTraceId, X as earlyHintsSenderAls, Y as withSpan, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, et as timingAls, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMatchedSegmentPath, k as markResponseFlushed, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as runWithTraceId, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as applyRequestHeaderOverlay } from "../_chunks/logger-t3uxAmbX.js";
-import { i as coerce, t as executeAction } from "../_chunks/actions-CDPfMp_I.js";
-import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-DygSeKCB.js";
+import { $ as timingAls, A as setMatchedSegmentPath, C as applyRequestHeaderOverlay, D as getSegmentParams, E as getSearchParams, F as getSetCookieHeaders, G as replaceTraceId, H as getOtelTraceId, I as getWaitUntil, J as withSpan, K as runWithTraceId, L as isDebug, M as setSegmentParams, N as getCookie, O as markResponseFlushed, V as generateTraceId, W as getTraceId, Y as earlyHintsSenderAls, Z as requestContextAls, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMutableCookieContext, k as runWithRequestContext, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as setSpanAttribute, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as getHeader } from "../_chunks/logger-AWfuX-KJ.js";
+import { i as coerce, t as executeAction } from "../_chunks/actions-O_LsyCE4.js";
+import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-B-lhk9p4.js";
 import "../client/error-boundary.js";
 import { n as toBracketKey } from "../_chunks/resolve-schema-Dz3fcFUo.js";
 import "../_chunks/segment-context-ZDnXDkbz.js";
@@ -403,35 +403,6 @@ async function runMiddlewareChain(chain, ctx) {
 		if (result instanceof Response) return result;
 	}
 }
-/**
-* Per-request marker for synthetic re-render requests that should NOT
-* re-execute `middleware.ts`. The action-dispatch wrapper runs middleware
-* once on the inbound action POST; when validation fails on the no-JS
-* path, it builds a synthetic GET that flows through the normal pipeline
-* to render the page with `getFormFlash()` data. Without this marker, the
-* pipeline would run middleware a second time on that synthetic GET.
-*
-* The set is keyed by the synthetic Request object itself, so the entry
-* lives exactly as long as the request and is garbage-collected with it.
-* Cannot be set or detected by user code — there is no header, no URL
-* parameter, nothing on the wire that an attacker could spoof.
-*
-* See TIM-871.
-*
-* @internal — framework use only.
-*/
-var middlewareBypassRequests = /* @__PURE__ */ new WeakSet();
-/**
-* Check whether a request was marked to bypass middleware.
-*
-* Called by `handleRequest` in pipeline-phases.ts before invoking the
-* middleware phase. Returns false for any request not explicitly marked.
-*
-* @internal
-*/
-function shouldBypassMiddleware(req) {
-	return middlewareBypassRequests.has(req);
-}
 //#endregion
 //#region src/server/metadata-social.ts
 /**
@@ -1433,7 +1404,10 @@ function renderDenyEntry(entry, status, data) {
 */
 function setDenyStatus(status) {
 	const store = requestContextAls.getStore();
-	if (store) store.denyStatus = status;
+	if (store) {
+		store.denyStatus = status;
+		store.onDenyStatus?.();
+	}
 }
 //#endregion
 //#region src/server/access-gate.tsx
@@ -1580,6 +1554,7 @@ async function coerceSegmentParams(match) {
 			const codec = globalCodecs[bracketKey];
 			if (!codec) continue;
 			const key = segment.paramName;
+			if (!(key in mergeTarget)) continue;
 			try {
 				mergeTarget[key] = sanitizeParamValue(codec.parse(mergeTarget[key]));
 			} catch (err) {
@@ -2036,16 +2011,20 @@ function validateInterceptionHeader(raw, stripTrailingSlash) {
 	return result.pathname;
 }
 /**
-* Run the proxy.ts phase. Calls user proxy code and uses `handleRequest` as
-* the inner `next()` continuation. The proxy resolver was picked at pipeline
+* Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
+*
+* When `next` is provided, it replaces the default `handleRequest` as the
+* continuation — this lets the pipeline inject action dispatch between proxy
+* and route matching (TIM-1213). The proxy resolver was picked at pipeline
 * construction time so the hot path sees no per-request branching on the
 * `ProxyConfig` discriminant.
 */
-async function runProxyPhase(config, getProxy, req, method, path) {
+async function runProxyPhase(config, getProxy, req, method, path, next) {
 	const detailed = config.serverTiming === "detailed";
 	try {
 		const proxyExport = await getProxy();
-		const proxyFn = () => runProxy(proxyExport, req, () => handleRequest(config, req, method, path, true));
+		const continuation = next ?? (() => handleRequest(config, req, method, path, true));
+		const proxyFn = () => runProxy(proxyExport, req, continuation);
 		return {
 			kind: "response",
 			phase: "proxy",
@@ -2313,7 +2292,7 @@ async function handleRequest(config, req, method, path, pathIsCanonical) {
 	setSegmentParams(match.segmentParams);
 	const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
 	setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
-	return outcomeToResponse(config, !shouldBypassMiddleware(req) && match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
+	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
 		canonicalPathname,
 		interception
 	}) : await runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, {
@@ -2344,7 +2323,7 @@ function createPipeline(config) {
 	const slowRequestMs = config.slowRequestMs ?? 3e3;
 	const serverTiming = config.serverTiming ?? "total";
 	let activeRequests = 0;
-	return async (req) => {
+	const pipelineFn = async (req) => {
 		const url = new URL(req.url);
 		const method = req.method;
 		const path = url.pathname;
@@ -2376,13 +2355,20 @@ function createPipeline(config) {
 							canonicalUrl.pathname = canonicalPath;
 							canonicalReq = new Request(canonicalUrl.toString(), req);
 						}
+						const innerHandler = async () => {
+							if (config.dispatchAction) {
+								const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
+								if (actionResult) return actionResult;
+							}
+							return handleRequest(config, canonicalReq, method, canonicalPath, true);
+						};
 						let result;
-						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath), {
+						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
 							req: canonicalReq,
 							method,
 							path: canonicalPath
 						});
-						else result = await handleRequest(config, canonicalReq, method, canonicalPath, true);
+						else result = await innerHandler();
 						await setSpanAttribute("http.response.status_code", result.status);
 						const varyTokens = ["Accept"];
 						if (config.interceptionRewrites?.length) varyTokens.push("X-Timber-URL");
@@ -2428,6 +2414,7 @@ function createPipeline(config) {
 			});
 		});
 	};
+	return pipelineFn;
 }
 //#endregion
 //#region src/server/build-manifest.ts