@timber-js/app 0.2.0-alpha.175 → 0.2.0-alpha.176

package/dist/server/request-context.d.ts

@@ -83,21 +83,6 @@ export declare function setMatchedSegmentPath(segmentPath: string): void;
  * @internal — used by redirect() for preserveSearchParams support.
  */
 export declare function getRequestSearchString(): string;
-/**
- * Run a callback inside a taint tracking scope. Returns whether any
- * request accessor (getHeaders, getSearchParams, cookies) was called
- * during the callback's execution.
- *
- * Uses a dedicated ALS so concurrent async components (Flight renders
- * siblings in parallel) each get their own isolated scope. The shared
- * push/pop stack model was unsound under concurrency.
- *
- * Results are stored in the request context's taintResults map, keyed
- * by segment/slot ID, for buildSegmentInfo() to consume.
- *
- * @internal — framework use only (route-element-builder.ts, slot-resolver.ts)
- */
-export declare function runInTaintScope<T>(segmentKey: string, fn: () => T | Promise<T>): Promise<T>;
 /**
  * Read-only Headers interface. The standard Headers class is mutable;
  * this type narrows it to read-only methods. The underlying object is

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAU5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAUjD;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CA+CxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,IAAI,CAKN;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI/D;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBjG;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mBAAmB,CAAC;AAOhF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAU5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAUjD;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CA+CxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,IAAI,CAKN;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI/D;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}

package/dist/server/request-dep.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Static request-dependency lookup.
+ *
+ * Queries the Vite plugin's precomputed module-graph analysis to determine
+ * whether a segment's entry file (layout/page/default) is request-dependent.
+ *
+ * In dev: the plugin registers a resolver function via Symbol.for bridge
+ * that lazily walks the RSC module graph.
+ * In prod: reads from the build manifest's requestDep map (set during build
+ * and serialized into the manifest init script by the adapter).
+ *
+ * Returns true (conservative) when no data is available.
+ */
+export declare function isStaticRequestDependent(filePath: string): boolean;
+//# sourceMappingURL=request-dep.d.ts.map

package/dist/server/request-dep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-dep.d.ts","sourceRoot":"","sources":["../../src/server/request-dep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkBlE"}

package/dist/server/route-element-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-element-builder.d.ts","sourceRoot":"","sources":["../../src/server/route-element-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAe9D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAO1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAyC,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA0CnG;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAM7D;AAID;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAID,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,qCAAqC;IACrC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AA8DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,YAAY,CAAC,EAAE,mBAAmB,EAClC,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,EACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAygB7B"}
+{"version":3,"file":"route-element-builder.d.ts","sourceRoot":"","sources":["../../src/server/route-element-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAe9D,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAO1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAyC,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyCnG;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAM7D;AAID;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAID,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,qCAAqC;IACrC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AA8DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,YAAY,CAAC,EAAE,mBAAmB,EAClC,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,EACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAsgB7B"}

package/dist/server/rsc-entry/helpers.d.ts

@@ -73,11 +73,11 @@ export declare function parseDebugRows(text: string): DebugComponentEntry[];
  * Describes the rendered segment chain with request-dependency status,
  * enabling the client to populate its segment cache for state tree diffing.
  *
- * Request-dependency is determined by render-time taint tracking via
- * runInTaintScope(). If taint results are available (RSC payload path),
- * segments/slots that called getHeaders()/getSearchParams()/cookies()
- * are marked request-dependent. Missing taint data (SSR path) defaults
- * to true (safe fallback — never incorrectly cached).
+ * Request-dependency is determined by static module-graph analysis: the
+ * Vite plugin walks each segment's import graph and marks it as
+ * request-dependent if any reachable module calls a request accessor.
+ * This replaces the previous runtime ALS-based taint tracking which
+ * couldn't attribute accessor calls in Flight-deferred child components.
  *
  * See design/07-routing.md §"Server Diffing Rules".
  */
@@ -92,7 +92,7 @@ interface SegmentInfoEntry {
 export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layoutComponents: Array<{
     component: (...args: unknown[]) => unknown;
     segment: ManifestSegmentNode;
-}>, slotSkipInfo?: SlotSkipEntry[], taintResults?: Map<string, boolean>, orphanTaint?: boolean, skippedSegmentKeys?: string[]): SegmentInfoEntry[];
+}>, slotSkipInfo?: SlotSkipEntry[], skippedSegmentKeys?: string[]): SegmentInfoEntry[];
 /**
  * Check if a request is asking for an RSC payload (client navigation)
  * rather than full HTML. Client-side navigation sends Accept: text/x-component.

package/dist/server/rsc-entry/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;;;;GAYG;AACH,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,EACF,YAAY,CAAC,EAAE,aAAa,EAAE,EAC9B,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,CAAC,EAAE,OAAO,EACrB,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC5B,gBAAgB,EAAE,CAmEpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAMD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;;;;GAYG;AACH,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,EACF,YAAY,CAAC,EAAE,aAAa,EAAE,EAC9B,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC5B,gBAAgB,EAAE,CAmDpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAMD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/rsc-entry/rsc-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,EAC1B,YAAY,CAAC,EAAE,aAAa,EAAE,GAC7B,OAAO,CAAC,QAAQ,CAAC,CA8LnB"}
+{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,EAC1B,YAAY,CAAC,EAAE,aAAa,EAAE,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAqLnB"}

package/dist/server/slot-resolver.d.ts

@@ -33,7 +33,7 @@ type CreateElementFn = (...args: unknown[]) => React.ReactElement;
  * 3. SlotAccessGate if the segment has access.ts (gate OUTSIDE the layout,
  *    so a denied layout never executes — see TIM-1074)
  */
-export declare function resolveSlotElement(slotNode: ManifestSegmentNode, match: RouteMatch, h: CreateElementFn, interception?: InterceptionContext, parentTreePath?: string, accessVerdicts?: SlotAccessVerdict[], taintKey?: string): Promise<React.ReactElement | null>;
+export declare function resolveSlotElement(slotNode: ManifestSegmentNode, match: RouteMatch, h: CreateElementFn, interception?: InterceptionContext, parentTreePath?: string, accessVerdicts?: SlotAccessVerdict[]): Promise<React.ReactElement | null>;
 /** Result of eagerly evaluating one segment's access.ts. */
 export interface SlotAccessVerdict {
     node: ManifestSegmentNode;

package/dist/server/slot-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slot-resolver.d.ts","sourceRoot":"","sources":["../../src/server/slot-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,EAAkC,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5F,KAAK,eAAe,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC;AA4ClE;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,UAAU,EACjB,CAAC,EAAE,eAAe,EAClB,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,MAAM,EACvB,cAAc,CAAC,EAAE,iBAAiB,EAAE,EACpC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAiIpC;AAmQD,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,mBAAmB,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;CACzD;AAwDD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,CAAC,EAAE,eAAe,CAAC;IACnB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,OAAO,EACP,SAAS,EACT,KAAK,EACL,CAAC,EACD,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,YAAY,GACb,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuJzD"}
+{"version":3,"file":"slot-resolver.d.ts","sourceRoot":"","sources":["../../src/server/slot-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,EAAkC,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5F,KAAK,eAAe,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC;AAgClE;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,UAAU,EACjB,CAAC,EAAE,eAAe,EAClB,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,MAAM,EACvB,cAAc,CAAC,EAAE,iBAAiB,EAAE,GACnC,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAwHpC;AA8PD,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,mBAAmB,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;CACzD;AAwDD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,CAAC,EAAE,eAAe,CAAC;IACnB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,OAAO,EACP,SAAS,EACT,KAAK,EACL,CAAC,EACD,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,YAAY,GACb,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwLzD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.175",
+  "version": "0.2.0-alpha.176",
   "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/index.ts

@@ -31,6 +31,7 @@ import { timberChunks } from './plugins/chunks';
 import { clientChunkGroup } from './plugins/client-chunks';
 import { timberServerBundle } from './plugins/server-bundle';
 import { timberCacheTransform } from './plugins/cache';
+import { timberRequestDep } from './plugins/request-dep';
 import { timberPrebuilt } from './plugins/prebuilt';
 import { timberPrerenderSugar } from './plugins/prerender-sugar';
 import { timberCloudflareWasm } from './plugins/cloudflare-wasm';
@@ -559,6 +560,7 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
     timberStaticBuild(ctx),
     timberFonts(ctx),
     timberMdx(ctx),
+    timberRequestDep(ctx),
     timberCacheTransform(ctx),
     timberPrerenderSugar(ctx), // export const prerender → cache.component() desugaring
     timberPrebuilt(ctx), // cache.component() → __prebuilt() callsite rewrite

package/src/plugins/build-manifest.ts

@@ -393,7 +393,7 @@ export function timberBuildManifest(ctx: PluginContext): Plugin {
         '// Auto-generated build manifest — do not edit.',
         '// Production: reads manifest from globalThis (set by _timber-manifest-init.js).',
         '',
-        'const manifest = globalThis.__TIMBER_BUILD_MANIFEST__ ?? { css: {}, js: {}, modulepreload: {}, fonts: {}, metadataRouteHashes: {} };',
+        'const manifest = globalThis.__TIMBER_BUILD_MANIFEST__ ?? { css: {}, js: {}, modulepreload: {}, fonts: {}, metadataRouteHashes: {}, requestDep: {} };',
         '',
         'export default manifest;',
       ].join('\n');
@@ -443,6 +443,15 @@ export function timberBuildManifest(ctx: PluginContext): Plugin {
           ctx.buildManifest.metadataRouteHashes = computeMetadataRouteHashes(ctx.routeTree.root);
         }
 
+        // Attach static request-dependency map from the request-dep plugin.
+        // Computed in the RSC buildEnd hook and stored on ctx.
+        const requestDepMap = (ctx as unknown as Record<string, unknown>).requestDepMap as
+          | Record<string, boolean>
+          | undefined;
+        if (requestDepMap) {
+          ctx.buildManifest.requestDep = requestDepMap;
+        }
+
         // When client JavaScript is disabled, strip JS chunks from the bundle
         // so Rollup never writes them to disk. CSS assets are preserved —
         // they're still needed for server-rendered HTML.

package/src/plugins/request-dep.ts

@@ -0,0 +1,458 @@
+/**
+ * timber-request-dep — Static module-graph analysis for request-dependency.
+ *
+ * Replaces runtime ALS-based taint tracking with a build/dev-time computed
+ * map: segment entry file → statically request-dependent?
+ *
+ * A segment/slot is request-dependent iff any module reachable from its
+ * layout/page/default in the RSC module graph (stopping at client-reference
+ * boundaries) imports and calls a request accessor (getHeaders, cookies,
+ * getSearchParams, etc.) or calls .get() on a search-params/cookie
+ * definition object.
+ *
+ * This is deterministic, covers children/barrels/node_modules/Suspense-
+ * deferred code, and is computed before any byte is flushed.
+ *
+ * See design/19-client-navigation.md §"X-Timber-State-Tree Header"
+ */
+
+import type { Plugin } from 'vite';
+import type { PluginContext } from '../plugin-context.js';
+import {
+  findImportBindings,
+  type ProgramNode,
+  type CallExpressionNode,
+  type MemberExpressionNode,
+  type IdentifierNode,
+} from './callsite-ast.js';
+
+// ─── Module specifiers whose bindings are request accessors ──────────────
+
+const ACCESSOR_SOURCES = new Set(['@timber-js/app/server', 'next/headers', 'next/headers.js']);
+
+const ACCESSOR_NAMES = new Set([
+  'getHeaders',
+  'getHeader',
+  'getSearchParams',
+  'getCookieJar',
+  'getCookie',
+  // next/headers shim names
+  'headers',
+  'cookies',
+]);
+
+const DEFINITION_FACTORY_SOURCES = new Set([
+  '@timber-js/app/search-params',
+  '@timber-js/app/cookies',
+]);
+
+const DEFINITION_FACTORY_NAMES = new Set(['defineSearchParams', 'defineCookie']);
+
+// ─── Fast token pre-filter ───────────────────────────────────────────────
+
+const ACCESSOR_TOKENS = [
+  'getHeaders',
+  'getHeader',
+  'getSearchParams',
+  'getCookieJar',
+  'getCookie',
+  'headers',
+  'cookies',
+  'defineSearchParams',
+  'defineCookie',
+  // .get() on imported/local definition bindings (searchParams.get())
+  '.get(',
+];
+
+function hasRelevantToken(code: string): boolean {
+  for (const token of ACCESSOR_TOKENS) {
+    if (code.includes(token)) return true;
+  }
+  return false;
+}
+
+// ─── Per-module facts ────────────────────────────────────────────────────
+
+interface ModuleFacts {
+  /** Module directly calls a request accessor. */
+  callsAccessor: boolean;
+  /** Module imports a definition factory (defineSearchParams/defineCookie). */
+  importsDefinitionFactory: boolean;
+  /** Import specifiers where `.get()` was called on the binding. */
+  getterCallSources: string[];
+}
+
+// ─── AST analysis ────────────────────────────────────────────────────────
+
+function analyzeModule(code: string, program: ProgramNode): ModuleFacts {
+  const facts: ModuleFacts = {
+    callsAccessor: false,
+    importsDefinitionFactory: false,
+    getterCallSources: [],
+  };
+
+  // Check for accessor imports
+  for (const name of ACCESSOR_NAMES) {
+    const bindings = findImportBindings(program, ACCESSOR_SOURCES, name);
+    if (bindings.named.size > 0 || bindings.namespaces.size > 0) {
+      // Check if any binding is actually called (not just imported)
+      if (hasCallSite(program, bindings.named, bindings.namespaces, name)) {
+        facts.callsAccessor = true;
+      }
+    }
+  }
+
+  // Check for definition factory imports
+  for (const name of DEFINITION_FACTORY_NAMES) {
+    const bindings = findImportBindings(program, DEFINITION_FACTORY_SOURCES, name);
+    if (bindings.named.size > 0 || bindings.namespaces.size > 0) {
+      facts.importsDefinitionFactory = true;
+    }
+  }
+
+  // Check for .get() calls on imported bindings (searchParams.get(), etc.)
+  // Collect which import sources have .get() called on their bindings.
+  for (const stmt of program.body) {
+    if (stmt.type !== 'ImportDeclaration') continue;
+    const decl = stmt as unknown as {
+      source: { value: string };
+      specifiers: Array<{ type: string; local: IdentifierNode; imported?: IdentifierNode }>;
+    };
+    for (const spec of decl.specifiers) {
+      if (spec.type === 'ImportDefaultSpecifier' || spec.type === 'ImportSpecifier') {
+        const localName = spec.local.name;
+        if (hasGetterCall(program, localName)) {
+          facts.getterCallSources.push(decl.source.value);
+        }
+      }
+    }
+  }
+
+  // Check for co-located definitions: const sp = defineSearchParams(...); sp.get()
+  // If a module both mints a definition AND calls .get() on any local binding
+  // whose init is a defineSearchParams/defineCookie call, it's a taint source.
+  if (facts.importsDefinitionFactory) {
+    for (const stmt of program.body) {
+      if (stmt.type !== 'VariableDeclaration') continue;
+      for (const decl of ((stmt as Record<string, unknown>).declarations as Array<
+        Record<string, unknown>
+      >) ?? []) {
+        if (!decl.init || !decl.id) continue;
+        const init = decl.init as Record<string, unknown>;
+        // Check if init is a call to a definition factory
+        if (init.type === 'CallExpression') {
+          const callee = init.callee as Record<string, unknown>;
+          if (callee.type === 'Identifier') {
+            const calleeName = (callee as unknown as IdentifierNode).name;
+            // Check if this name is a definition factory binding
+            for (const factoryName of DEFINITION_FACTORY_NAMES) {
+              const bindings = findImportBindings(program, DEFINITION_FACTORY_SOURCES, factoryName);
+              if (bindings.named.has(calleeName)) {
+                // This local variable is a definition instance
+                const localName =
+                  (decl.id as Record<string, unknown>).type === 'Identifier'
+                    ? (decl.id as unknown as IdentifierNode).name
+                    : null;
+                if (localName && hasGetterCall(program, localName)) {
+                  facts.callsAccessor = true;
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  return facts;
+}
+
+/** Check if any named/namespace binding is called as a function. */
+function hasCallSite(
+  program: ProgramNode,
+  named: Set<string>,
+  namespaces: Set<string>,
+  importedName: string
+): boolean {
+  return walkForCall(program, named, namespaces, importedName);
+}
+
+function walkForCall(
+  node: Record<string, unknown>,
+  named: Set<string>,
+  namespaces: Set<string>,
+  importedName: string
+): boolean {
+  if (node.type === 'CallExpression') {
+    const call = node as unknown as CallExpressionNode;
+    const callee = call.callee;
+    // Direct call: getHeaders()
+    if (callee.type === 'Identifier' && named.has((callee as IdentifierNode).name)) {
+      return true;
+    }
+    // Namespace call: ns.getHeaders()
+    if (callee.type === 'MemberExpression') {
+      const member = callee as MemberExpressionNode;
+      if (
+        !member.computed &&
+        member.object.type === 'Identifier' &&
+        namespaces.has((member.object as IdentifierNode).name) &&
+        member.property.type === 'Identifier' &&
+        (member.property as IdentifierNode).name === importedName
+      ) {
+        return true;
+      }
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end') continue;
+    const val = node[key];
+    if (val && typeof val === 'object') {
+      if (Array.isArray(val)) {
+        for (const item of val) {
+          if (item && typeof item === 'object' && typeof item.type === 'string') {
+            if (walkForCall(item as Record<string, unknown>, named, namespaces, importedName))
+              return true;
+          }
+        }
+      } else if (typeof (val as Record<string, unknown>).type === 'string') {
+        if (walkForCall(val as Record<string, unknown>, named, namespaces, importedName))
+          return true;
+      }
+    }
+  }
+  return false;
+}
+
+/** Check if `localName.get(...)` appears anywhere in the module. */
+function hasGetterCall(node: Record<string, unknown>, localName: string): boolean {
+  if (node.type === 'CallExpression') {
+    const call = node as unknown as CallExpressionNode;
+    if (call.callee.type === 'MemberExpression') {
+      const member = call.callee as MemberExpressionNode;
+      if (
+        !member.computed &&
+        member.object.type === 'Identifier' &&
+        (member.object as IdentifierNode).name === localName &&
+        member.property.type === 'Identifier' &&
+        (member.property as IdentifierNode).name === 'get'
+      ) {
+        return true;
+      }
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end') continue;
+    const val = node[key];
+    if (val && typeof val === 'object') {
+      if (Array.isArray(val)) {
+        for (const item of val) {
+          if (item && typeof item === 'object' && typeof item.type === 'string') {
+            if (hasGetterCall(item as Record<string, unknown>, localName)) return true;
+          }
+        }
+      } else if (typeof (val as Record<string, unknown>).type === 'string') {
+        if (hasGetterCall(val as Record<string, unknown>, localName)) return true;
+      }
+    }
+  }
+  return false;
+}
+
+// ─── Module graph reachability ───────────────────────────────────────────
+
+/** Walk the module graph from an entry, returning true if any taint source is reachable. */
+function isReachableTaintSource(
+  entryId: string,
+  factsMap: Map<string, ModuleFacts>,
+  definitionModules: Set<string>,
+  getImports: (id: string) => string[]
+): boolean {
+  const visited = new Set<string>();
+  const stack = [entryId];
+
+  while (stack.length > 0) {
+    const id = stack.pop()!;
+    if (visited.has(id)) continue;
+    visited.add(id);
+
+    const facts = factsMap.get(id);
+    if (facts) {
+      if (facts.callsAccessor) return true;
+      // Check if any .get() call is on a definition module
+      for (const source of facts.getterCallSources) {
+        // Resolve relative to the module — for now just check if the
+        // resolved ID is a definition module.
+        // In dev, the getter source is unresolved; we check if any
+        // imported module is a definition module by looking at actual imports.
+      }
+    }
+
+    // Check if this module IS a definition module and has .get() callers
+    // (handled by the importer's facts)
+
+    const imports = getImports(id);
+    for (const imp of imports) {
+      // Stop at client boundaries — 'use client' modules in the RSC graph
+      // resolve to generated proxy stubs with no further imports.
+      // Also stop at virtual modules (they're framework internals).
+      if (!imp.startsWith('\0') && !visited.has(imp)) {
+        stack.push(imp);
+      }
+    }
+  }
+
+  // Second pass: check getter calls against definition modules
+  for (const id of visited) {
+    const facts = factsMap.get(id);
+    if (!facts) continue;
+    if (facts.getterCallSources.length === 0) continue;
+    // Check if any import of this module is a definition module
+    const imports = getImports(id);
+    for (const imp of imports) {
+      if (definitionModules.has(imp)) {
+        // This module imports a definition module and calls .get() on some binding.
+        // Conservative: treat it as a taint source.
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+// ─── Plugin ──────────────────────────────────────────────────────────────
+
+const BRIDGE_KEY = Symbol.for('timber:request-dep');
+
+export function timberRequestDep(ctx: PluginContext): Plugin {
+  const factsMap = new Map<string, ModuleFacts>();
+  const definitionModules = new Set<string>();
+  const cache = new Map<string, boolean>();
+
+  return {
+    name: 'timber-request-dep',
+    // Only run in RSC environment — that's where server components render.
+    applyToEnvironment(env) {
+      return env.name === 'rsc';
+    },
+
+    async transform(code, id) {
+      // Skip non-JS (include .mdx/.md — compiled to JS by timber-mdx before this runs)
+      if (!/\.[mc]?[jt]sx?$/.test(id) && !/\.mdx?$/.test(id)) return;
+      // Skip virtual modules
+      if (id.startsWith('\0') || id.startsWith('virtual:')) return;
+      // Fast token check
+      if (!hasRelevantToken(code)) return;
+
+      const program = (this as unknown as { parse(code: string): ProgramNode }).parse(code);
+      const facts = analyzeModule(code, program);
+
+      if (
+        facts.callsAccessor ||
+        facts.importsDefinitionFactory ||
+        facts.getterCallSources.length > 0
+      ) {
+        factsMap.set(id, facts);
+        if (facts.importsDefinitionFactory) {
+          definitionModules.add(id);
+        }
+      }
+
+      // No code transform needed — this is analysis only.
+      return undefined;
+    },
+
+    configureServer(server) {
+      // Register the bridge so runtime can query request-dep status.
+      const resolver = (filePath: string): boolean => {
+        if (cache.has(filePath)) return cache.get(filePath)!;
+
+        const rscEnv = server.environments?.rsc;
+        if (!rscEnv?.moduleGraph) {
+          return true; // Unknown → conservative
+        }
+
+        const getImports = (moduleId: string): string[] => {
+          const mod = rscEnv.moduleGraph.getModuleById(moduleId);
+          if (!mod) return [];
+          const result: string[] = [];
+          for (const imp of mod.importedModules) {
+            if (imp.id) result.push(imp.id);
+          }
+          return result;
+        };
+
+        const result = isReachableTaintSource(filePath, factsMap, definitionModules, getImports);
+        cache.set(filePath, result);
+        return result;
+      };
+
+      (globalThis as Record<symbol, unknown>)[BRIDGE_KEY] = resolver;
+
+      // Clear cache on file changes
+      const clearCache = () => cache.clear();
+      server.watcher.on('change', clearCache);
+      server.watcher.on('add', clearCache);
+      server.watcher.on('unlink', clearCache);
+    },
+
+    buildEnd() {
+      // Prod: compute the full map and register on globalThis for the
+      // build manifest plugin to pick up.
+      if (ctx.dev) return;
+
+      const getModuleInfo = (
+        this as unknown as {
+          getModuleInfo: (
+            id: string
+          ) => { importedIds?: string[]; dynamicallyImportedIds?: string[] } | null;
+        }
+      ).getModuleInfo;
+
+      const getImports = (moduleId: string): string[] => {
+        const info = getModuleInfo(moduleId);
+        if (!info) return [];
+        return [...(info.importedIds ?? []), ...(info.dynamicallyImportedIds ?? [])];
+      };
+
+      const requestDepMap: Record<string, boolean> = {};
+
+      // Walk the route tree to find all segment entry files
+      if (ctx.routeTree) {
+        walkSegmentTree(ctx.routeTree.root as unknown as WalkableNode, (filePath: string) => {
+          const result = isReachableTaintSource(filePath, factsMap, definitionModules, getImports);
+          requestDepMap[filePath] = result;
+        });
+      }
+
+      // Store on ctx for build-manifest plugin to serialize into the manifest.
+      // Prod runtime reads from __TIMBER_BUILD_MANIFEST__.requestDep.
+      (ctx as unknown as Record<string, unknown>).requestDepMap = requestDepMap;
+    },
+  };
+}
+
+interface WalkableNode {
+  layout?: { filePath: string };
+  page?: { filePath: string };
+  default?: { filePath: string };
+  children?: unknown[];
+  slots?: Record<string, unknown>;
+}
+
+function walkSegmentTree(node: WalkableNode, fn: (filePath: string) => void): void {
+  if (node.layout) fn(node.layout.filePath);
+  if (node.page) fn(node.page.filePath);
+  if (node.default) fn((node.default as { filePath: string }).filePath);
+  if (node.children) {
+    for (const child of node.children) {
+      walkSegmentTree(child as typeof node, fn);
+    }
+  }
+  if (node.slots) {
+    for (const slot of Object.values(node.slots)) {
+      walkSegmentTree(slot as typeof node, fn);
+    }
+  }
+}