@timber-js/app 0.2.0-alpha.175 → 0.2.0-alpha.176

package/src/server/als-registry.ts

@@ -140,18 +140,6 @@ export interface RequestContextStore {
    * context for render-phase errors without module-level shared state.
    */
   debugComponentsGetter?: () => DebugComponentEntry[];
-  /**
-   * Taint tracking results from render-time accessor scope tracking.
-   * Keyed by segment/slot ID, true = accessor was called during render.
-   * Populated by runInTaintScope() wrappers in TracedLayout and slot
-   * resolution; consumed by buildSegmentInfo() for X-Timber-Segments.
-   */
-  taintResults?: Map<string, boolean>;
-  /**
-   * Set to true if an accessor is called outside any taint scope.
-   * When true, all segments are marked request-dependent (safe fallback).
-   */
-  orphanTaint?: boolean;
 }
 
 /** A single outgoing cookie entry in the cookie jar. */
@@ -161,38 +149,6 @@ export interface CookieEntry {
   options: import('./cookie-context.js').CookieOptions;
 }
 
-// ─── Taint Scope ─────────────────────────────────────────────────────────
-// Per-component accessor taint tracking. Each scope runs inside its own
-// ALS context so concurrent async components (Flight renders siblings in
-// parallel) don't corrupt each other's touched flags.
-
-export interface TaintScope {
-  touched: boolean;
-}
-
-export const taintScopeAls = getOrCreateAls<TaintScope>(Symbol.for('timber:taint-scope-als'));
-
-/**
- * Mark that a request accessor was called in the current scope.
- * If a taint scope is active, marks that scope. If no scope is active
- * but a request context exists, sets the orphan taint flag (all segments
- * become request-dependent as a safety fallback).
- *
- * Lives here (not request-context.ts) to avoid circular deps with
- * cookie-context.ts which also needs to call it.
- */
-export function markAccessorTouched(): void {
-  const scope = taintScopeAls.getStore();
-  if (scope) {
-    scope.touched = true;
-    return;
-  }
-  const store = requestContextAls.getStore();
-  if (store) {
-    store.orphanTaint = true;
-  }
-}
-
 // ─── Tracing ──────────────────────────────────────────────────────────────
 // Used by: tracing.ts (getTraceId(), getSpanId())
 // Design doc: design/17-logging.md

package/src/server/build-manifest.ts

@@ -41,6 +41,12 @@ export interface BuildManifest {
    * In dev mode this is empty — a startup nonce is used instead.
    */
   metadataRouteHashes?: Record<string, string>;
+  /**
+   * Static request-dependency map from the Vite plugin's module-graph analysis.
+   * Map from segment entry file path to whether it's request-dependent.
+   * Used by buildSegmentInfo() for X-Timber-Segments in production.
+   */
+  requestDep?: Record<string, boolean>;
 }
 
 /** Empty build manifest used in dev mode. */

package/src/server/cookie-context.ts

@@ -12,11 +12,7 @@
  * smuggling primitive that the encoding contract closes.
  */
 
-import {
-  requestContextAls,
-  markAccessorTouched,
-  type RequestContextStore,
-} from './als-registry.js';
+import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { isDebug } from './debug.js';
 import {
   assertValidCookieName,
@@ -66,8 +62,6 @@ export function getCookieJar(): RequestCookies {
     );
   }
 
-  markAccessorTouched();
-
   // Parse cookies lazily on first access
   if (!store.parsedCookies) {
     store.parsedCookies = parseCookieHeader(store.cookieHeader);

package/src/server/request-context.ts

@@ -14,13 +14,7 @@
  * and design/11-platform.md §"AsyncLocalStorage".
  */
 
-import {
-  requestContextAls,
-  taintScopeAls,
-  markAccessorTouched,
-  type RequestContextStore,
-  type TaintScope,
-} from './als-registry.js';
+import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { _setGetSearchParamsFn } from '../search-params/define.js';
 import { _setGetSegmentParamsFn } from '../segment-params/define.js';
 import { consumeSeededCookies } from './cookie-context.js';
@@ -45,7 +39,7 @@ export function getHeaders(): ReadonlyHeaders {
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
-  markAccessorTouched();
+
   return store.headers;
 }
 
@@ -58,7 +52,6 @@ export function getHeaders(): ReadonlyHeaders {
  * @internal — not part of the public API. Use `getHeaders().get(name)` instead.
  */
 export function getHeader(name: string): string | undefined {
-  // getHeaders() already calls markAccessorTouched()
   const headers = getHeaders();
   return headers.get(name) ?? undefined;
 }
@@ -76,7 +69,7 @@ export function getSearchParams(): URLSearchParams {
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
-  markAccessorTouched();
+
   return store.searchParams;
 }
 
@@ -226,49 +219,6 @@ export function getRequestSearchString(): string {
   return store?.searchString ?? '';
 }
 
-// ─── Request Accessor Taint Tracking ─────────────────────────────────────
-// Used by segment/slot skip decisions to determine whether a component
-// actually reads per-request data, replacing the AsyncFunction heuristic.
-
-/**
- * Run a callback inside a taint tracking scope. Returns whether any
- * request accessor (getHeaders, getSearchParams, cookies) was called
- * during the callback's execution.
- *
- * Uses a dedicated ALS so concurrent async components (Flight renders
- * siblings in parallel) each get their own isolated scope. The shared
- * push/pop stack model was unsound under concurrency.
- *
- * Results are stored in the request context's taintResults map, keyed
- * by segment/slot ID, for buildSegmentInfo() to consume.
- *
- * @internal — framework use only (route-element-builder.ts, slot-resolver.ts)
- */
-export async function runInTaintScope<T>(segmentKey: string, fn: () => T | Promise<T>): Promise<T> {
-  const store = requestContextAls.getStore();
-  const scope: TaintScope = { touched: false };
-  try {
-    const result = await taintScopeAls.run(scope, fn);
-    if (store) {
-      if (!store.taintResults) store.taintResults = new Map();
-      // OR-merge: once a key is tainted, it stays tainted. A second scope
-      // for the same key (e.g. default.tsx fallback after a denied slot page)
-      // must not overwrite an earlier true with false.
-      store.taintResults.set(
-        segmentKey,
-        scope.touched || (store.taintResults.get(segmentKey) ?? false)
-      );
-    }
-    return result;
-  } catch (error) {
-    if (store) {
-      if (!store.taintResults) store.taintResults = new Map();
-      store.taintResults.set(segmentKey, true);
-    }
-    throw error;
-  }
-}
-
 // ─── Types ────────────────────────────────────────────────────────────────
 
 /**

package/src/server/request-dep.ts

@@ -0,0 +1,37 @@
+/**
+ * Static request-dependency lookup.
+ *
+ * Queries the Vite plugin's precomputed module-graph analysis to determine
+ * whether a segment's entry file (layout/page/default) is request-dependent.
+ *
+ * In dev: the plugin registers a resolver function via Symbol.for bridge
+ * that lazily walks the RSC module graph.
+ * In prod: reads from the build manifest's requestDep map (set during build
+ * and serialized into the manifest init script by the adapter).
+ *
+ * Returns true (conservative) when no data is available.
+ */
+
+const BRIDGE_KEY = Symbol.for('timber:request-dep');
+
+type RequestDepResolver = (filePath: string) => boolean;
+
+export function isStaticRequestDependent(filePath: string): boolean {
+  // Dev path: Vite plugin registers a resolver function
+  const resolver = (globalThis as Record<symbol, unknown>)[BRIDGE_KEY] as
+    | RequestDepResolver
+    | undefined;
+  if (resolver) return resolver(filePath);
+
+  // Prod path: read from the build manifest (loaded by adapter's init script)
+  const manifest = (
+    globalThis as unknown as {
+      __TIMBER_BUILD_MANIFEST__?: { requestDep?: Record<string, boolean> };
+    }
+  ).__TIMBER_BUILD_MANIFEST__;
+  if (manifest?.requestDep && filePath in manifest.requestDep) {
+    return manifest.requestDep[filePath];
+  }
+
+  return true; // Unknown → conservative
+}

package/src/server/route-element-builder.ts

@@ -43,7 +43,6 @@ import { SlotsProvider } from '../client/slot-provider.js';
 import { wrapSegmentWithErrorBoundaries } from './error-boundary-wrapper.js';
 import type { InterceptionContext } from './pipeline.js';
 import { shouldSkipSegment, computeSegmentKeys, type ClientStateTree } from './state-tree-diff.js';
-import { runInTaintScope } from './request-context.js';
 import { headElementsToReact } from './metadata.js';
 import { loadModule } from './safe-load.js';
 
@@ -663,13 +662,10 @@ export async function buildRouteElement(
         const layoutDenyPages = denyPageChains.get(i);
         const hasLayoutDenyChain = !!layoutDenyPages && layoutDenyPages.length > 0;
         const onLayoutSettled = hasLayoutDenyChain ? trackShellComponent() : undefined;
-        const taintKey = segmentId;
         const TracedLayout = async (props: Record<string, unknown>) => {
           try {
-            return await runInTaintScope(taintKey, () =>
-              withSpan('timber.layout', { 'timber.segment': segmentId }, () =>
-                (layoutComponentRef as (props: Record<string, unknown>) => unknown)(props)
-              )
+            return await withSpan('timber.layout', { 'timber.segment': segmentId }, () =>
+              (layoutComponentRef as (props: Record<string, unknown>) => unknown)(props)
             );
           } catch (error: unknown) {
             if (error instanceof DenySignal && layoutDenyPages) {

package/src/server/rsc-entry/helpers.ts

@@ -9,6 +9,7 @@ import { swallow } from '../logger.js';
 import { computeSegmentKeys } from '../state-tree-diff.js';
 import type { SlotSkipEntry } from '../slot-resolver.js';
 import { isClientReference } from '../route-element-builder.js';
+import { isStaticRequestDependent } from '../request-dep.js';
 
 /** RSC content type for client navigation payload requests. */
 export const RSC_CONTENT_TYPE = 'text/x-component';
@@ -171,11 +172,11 @@ export function parseDebugRows(text: string): DebugComponentEntry[] {
  * Describes the rendered segment chain with request-dependency status,
  * enabling the client to populate its segment cache for state tree diffing.
  *
- * Request-dependency is determined by render-time taint tracking via
- * runInTaintScope(). If taint results are available (RSC payload path),
- * segments/slots that called getHeaders()/getSearchParams()/cookies()
- * are marked request-dependent. Missing taint data (SSR path) defaults
- * to true (safe fallback — never incorrectly cached).
+ * Request-dependency is determined by static module-graph analysis: the
+ * Vite plugin walks each segment's import graph and marks it as
+ * request-dependent if any reachable module calls a request accessor.
+ * This replaces the previous runtime ALS-based taint tracking which
+ * couldn't attribute accessor calls in Flight-deferred child components.
  *
  * See design/07-routing.md §"Server Diffing Rules".
  */
@@ -195,8 +196,6 @@ export function buildSegmentInfo(
     segment: ManifestSegmentNode;
   }>,
   slotSkipInfo?: SlotSkipEntry[],
-  taintResults?: Map<string, boolean>,
-  orphanTaint?: boolean,
   skippedSegmentKeys?: string[]
 ): SegmentInfoEntry[] {
   const layoutBySegment = new Map(
@@ -216,22 +215,12 @@ export function buildSegmentInfo(
     const segmentId = segmentKeys[i];
     let isRequestDependent: boolean;
     if (isClientReference(component)) {
-      // Client components never execute on the server — they can't
-      // call getHeaders()/cookies()/getSearchParams(). Always cacheable.
       isRequestDependent = false;
-    } else if (orphanTaint) {
-      isRequestDependent = true;
-    } else if (taintResults?.has(segmentId)) {
-      isRequestDependent = taintResults.get(segmentId)!;
     } else if (skippedSet?.has(segmentId)) {
-      // Skipped segments have no taint data (runInTaintScope never ran).
-      // They're safe to mark non-request-dependent: a segment is only
-      // skippable because the client's state tree listed it, and the
-      // client only serializes non-request-dependent segments.
       isRequestDependent = false;
+    } else if (segment.layout) {
+      isRequestDependent = isStaticRequestDependent(segment.layout.filePath);
     } else {
-      // No taint data (SSR path or segment not yet rendered).
-      // Default to true — safe fallback that degrades to current behavior.
       isRequestDependent = true;
     }
 
@@ -247,15 +236,9 @@ export function buildSegmentInfo(
 
   if (slotSkipInfo) {
     for (const slot of slotSkipInfo) {
-      let slotRequestDependent = slot.isRequestDependent;
-      if (orphanTaint) {
-        slotRequestDependent = true;
-      } else if (taintResults?.has(slot.slotKey)) {
-        slotRequestDependent = taintResults.get(slot.slotKey)!;
-      }
       const entry: SegmentInfoEntry = {
         path: slot.slotKey,
-        isRequestDependent: slotRequestDependent,
+        isRequestDependent: slot.isRequestDependent,
         slot: true,
         parentSegment: slot.parentSegmentId,
       };

package/src/server/rsc-entry/rsc-payload.ts

@@ -22,7 +22,7 @@ import {
   createDebugChannelSink,
   RSC_CONTENT_TYPE,
 } from './helpers.js';
-import { requestContextAls } from '../als-registry.js';
+
 import type { RenderSignals } from './rsc-stream.js';
 
 /**
@@ -197,19 +197,10 @@ export async function buildRscPayloadResponse(
   // client rendering. No X-Timber-Head header needed. See TIM-1151.
 
   // Send segment metadata so the client can populate its segment cache
-  // for state tree diffing on subsequent navigations. On the RSC payload
-  // path, taint results are available because the shell has rendered by
-  // the time we reach this point (first chunk already read from the stream).
+  // for state tree diffing on subsequent navigations. Request-dependency
+  // is determined by static module-graph analysis (not runtime taint).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  const store = requestContextAls.getStore();
-  const segmentInfo = buildSegmentInfo(
-    segments,
-    layoutComponents,
-    slotSkipInfo,
-    store?.taintResults,
-    store?.orphanTaint,
-    skippedSegments
-  );
+  const segmentInfo = buildSegmentInfo(segments, layoutComponents, slotSkipInfo, skippedSegments);
   responseHeaders.set('X-Timber-Segments', JSON.stringify(segmentInfo));
 
   // Send skipped segments so the client can merge the partial RSC payload

package/src/server/slot-resolver.ts

@@ -31,7 +31,7 @@ import { coerceSlotParams } from './param-coercion.js';
 import { matchUrlParts } from './tree-match.js';
 import { SegmentOutlet } from '../client/segment-outlet.js';
 import { computeSlotKey, shouldSkipSlot, type ClientStateTree } from './state-tree-diff.js';
-import { runInTaintScope } from './request-context.js';
+import { isStaticRequestDependent } from './request-dep.js';
 
 type CreateElementFn = (...args: unknown[]) => React.ReactElement;
 
@@ -52,26 +52,14 @@ async function loadComponent(loader: {
 /**
  * Load and render the default.tsx fallback for a slot node.
  * Returns null if the slot has no default.tsx or it has no default export.
- *
- * When taintKey is provided, wraps the component in a taint scope so
- * accessor calls (getHeaders, cookies, etc.) inside the default.tsx
- * are attributed to this slot instead of poisoning orphanTaint.
  */
 async function renderDefaultFallback(
   slotNode: ManifestSegmentNode,
-  h: CreateElementFn,
-  taintKey?: string
+  h: CreateElementFn
 ): Promise<React.ReactElement | null> {
   if (!slotNode.default) return null;
   const DefaultComp = await loadComponent(slotNode.default);
   if (!DefaultComp) return null;
-  if (taintKey && !isClientReference(DefaultComp)) {
-    const TaintedDefault = async (props: Record<string, unknown>) =>
-      runInTaintScope(taintKey, () =>
-        (DefaultComp as (props: Record<string, unknown>) => unknown)(props)
-      );
-    return h(TaintedDefault, {});
-  }
   return h(DefaultComp, {});
 }
 
@@ -96,8 +84,7 @@ export async function resolveSlotElement(
   h: CreateElementFn,
   interception?: InterceptionContext,
   parentTreePath?: string,
-  accessVerdicts?: SlotAccessVerdict[],
-  taintKey?: string
+  accessVerdicts?: SlotAccessVerdict[]
 ): Promise<React.ReactElement | null> {
   // When interception is active, try to match intercepting children in this
   // slot against the target pathname. If an intercepting child matches, render
@@ -132,7 +119,7 @@ export async function resolveSlotElement(
       // degrade to default.tsx or null — not crash the page. This matches
       // Next.js behavior. See design/02-rendering-pipeline.md
       // §"Slot Access Failure = Graceful Degradation"
-      const denyFallback = await renderDefaultFallback(slotNode, h, taintKey);
+      const denyFallback = await renderDefaultFallback(slotNode, h);
 
       // Build the slot page element.
       // Client references ('use client' pages) must NOT be called as functions —
@@ -148,11 +135,9 @@ export async function resolveSlotElement(
       if (isClientReference(SlotPage)) {
         element = h(SlotPage, {});
       } else {
-        const slotTaintKey = taintKey;
         const SafeSlotPage = async (props: Record<string, unknown>) => {
-          const run = async () => (SlotPage as (props: Record<string, unknown>) => unknown)(props);
           try {
-            return slotTaintKey ? await runInTaintScope(slotTaintKey, run) : await run();
+            return await (SlotPage as (props: Record<string, unknown>) => unknown)(props);
           } catch (error) {
             // RedirectSignal must propagate — the pipeline handles redirects
             // at the top level. Swallowing it here would silently return
@@ -180,13 +165,7 @@ export async function resolveSlotElement(
       // intermediate slot segments (everything between slot root and leaf).
       // Process innermost-first, same order as route-element-builder.ts
       // handles main segments. The slot root (index 0) is handled below.
-      element = await wrapWithIntermediateSegments(
-        slotMatch.chain,
-        element,
-        h,
-        accessVerdicts,
-        taintKey
-      );
+      element = await wrapWithIntermediateSegments(slotMatch.chain, element, h, accessVerdicts);
 
       // Wrap with slot root's layout — INSIDE the access gate, so the layout
       // server component never executes when access.ts denies. See TIM-1074.
@@ -199,7 +178,7 @@ export async function resolveSlotElement(
       // On denial: denied.tsx → default.tsx → null (graceful degradation),
       // rendered WITHOUT the denied slot's own layout.
       // See design/04-authorization.md §"Slot-Level Auth".
-      element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts, taintKey);
+      element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts);
 
       // Wrap with slot root's error boundaries (outermost)
       element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
@@ -225,8 +204,7 @@ export async function resolveSlotElement(
   // Per design/02-rendering-pipeline.md: "No access check for default.tsx."
   // Access verdicts from the eager evaluation are not applied here.
   // Pass taintKey so accessor calls inside default.tsx are scoped to this
-  // slot instead of poisoning orphanTaint for the entire request.
-  return renderDefaultFallback(slotNode, h, taintKey);
+  return renderDefaultFallback(slotNode, h);
 }
 
 // ─── Element Wrapping Helpers ───────────────────────────────────────────────
@@ -251,14 +229,13 @@ async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
   element: React.ReactElement,
   h: CreateElementFn,
-  accessVerdicts?: SlotAccessVerdict[],
-  taintKey?: string
+  accessVerdicts?: SlotAccessVerdict[]
 ): Promise<React.ReactElement> {
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
     element = await wrapSegmentWithErrorBoundaries(seg, element, h);
     element = await wrapWithLayout(seg, element, h);
-    element = await wrapWithAccessGate(seg, element, h, accessVerdicts, taintKey);
+    element = await wrapWithAccessGate(seg, element, h, accessVerdicts);
   }
   return element;
 }
@@ -285,25 +262,21 @@ async function wrapWithAccessGate(
   slotNode: ManifestSegmentNode,
   element: React.ReactElement,
   h: CreateElementFn,
-  accessVerdicts?: SlotAccessVerdict[],
-  taintKey?: string
+  accessVerdicts?: SlotAccessVerdict[]
 ): Promise<React.ReactElement> {
   if (!slotNode.access) return element;
 
   const accessFn = await loadComponent(slotNode.access);
   if (!accessFn) return element;
 
-  // Pass the component (not pre-built element) so SlotAccessGate can
-  // forward DenySignal.data as dangerouslyPassData dynamically. See TIM-488.
   let DeniedComponent: ((...args: unknown[]) => unknown) | null = null;
   if (slotNode.denied) {
     DeniedComponent = (await loadComponent(slotNode.denied)) ?? null;
   }
 
-  // Extract slot name from the directory name (strip @ prefix)
   const slotName = slotNode.segmentName?.replace(/^@/, '') ?? '';
 
-  const defaultFallback = await renderDefaultFallback(slotNode, h, taintKey);
+  const defaultFallback = await renderDefaultFallback(slotNode, h);
 
   // Look up pre-computed verdict from eager evaluation. Only replay
   // denial/redirect verdicts — 'pass' verdicts must NOT be replayed
@@ -726,21 +699,54 @@ export async function resolveSlotProps({
         h,
         interception,
         parentTreePath,
-        chainVerdicts,
-        slotKey
+        chainVerdicts
       );
       slotProps[slotName] = h(SegmentOutlet, {
         segmentPath: slotKey,
         children: resolvedElement,
       });
-      // Conservative pre-render default: true. Overridden by taint
-      // results in buildSegmentInfo() after renderToReadableStream
-      // completes — runInTaintScope records whether the slot page
-      // actually called getHeaders/cookies/getSearchParams.
+      // Static analysis: check if any file in the slot's RENDERED tree
+      // is request-dependent. Only check layouts when destMatch exists —
+      // unmatched slots render default.tsx directly without layouts.
+      let slotRequestDep = false;
+      const destLeaf = destMatch?.chain[destMatch.chain.length - 1];
+      const hasRenderedPage = destMatch && destLeaf?.page;
+      if (hasRenderedPage) {
+        // Check slot root layout (rendered by wrapWithLayout)
+        if (
+          slotManifest.layout?.filePath &&
+          isStaticRequestDependent(slotManifest.layout.filePath)
+        ) {
+          slotRequestDep = true;
+        }
+        // Check intermediate slot layouts
+        if (!slotRequestDep) {
+          for (const seg of destMatch.chain) {
+            if (seg.layout?.filePath && isStaticRequestDependent(seg.layout.filePath)) {
+              slotRequestDep = true;
+              break;
+            }
+          }
+        }
+        // Check leaf page
+        if (!slotRequestDep) {
+          if (destLeaf?.page?.filePath && isStaticRequestDependent(destLeaf.page.filePath)) {
+            slotRequestDep = true;
+          }
+        }
+      } else {
+        // No match — only default.tsx is rendered (no layouts)
+        const defaultFile = slotManifest.default?.filePath;
+        if (!defaultFile) {
+          slotRequestDep = true; // No entry file → conservative
+        } else {
+          slotRequestDep = isStaticRequestDependent(defaultFile);
+        }
+      }
       slotSkipInfo.push({
         slotKey,
         parentSegmentId: segmentId,
-        isRequestDependent: true,
+        isRequestDependent: slotRequestDep,
         denied: accessBlocked,
       });
     }