@timber-js/app 0.2.0-alpha.18 → 0.2.0-alpha.180

package/src/server/actions.ts

@@ -3,7 +3,7 @@
  *
  * - revalidatePath(path) re-renders the route at that path and returns the RSC
  *   flight payload for inline reconciliation.
- * - revalidateTag(tag) invalidates cached shells and 'use cache' entries by tag.
+ * - revalidateTag(tag) invalidates timber.cache entries by tag.
  *
  * Both are callable from anywhere on the server — actions, API routes, handlers.
  *
@@ -14,19 +14,16 @@
  * See design/08-forms-and-actions.md
  */
 
-import type { CacheHandler } from '#/cache/index';
-import { RedirectSignal } from './primitives';
+import { cache } from '../cache/cache-api';
+import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
-
 // ─── Types ───────────────────────────────────────────────────────────────
 
 /** Result of rendering a revalidation — element tree before RSC serialization. */
 export interface RevalidationResult {
   /** React element tree (pre-serialization — passed to renderToReadableStream). */
   element: unknown;
-  /** Resolved head elements for metadata. */
-  headElements: unknown[];
 }
 
 /** Renderer function that builds a React element tree for a given path. */
@@ -37,8 +34,6 @@ export type { RevalidationState } from './als-registry.js';
 
 /** Options for creating the action handler. */
 export interface ActionHandlerConfig {
-  /** Cache handler for tag invalidation. */
-  cacheHandler?: CacheHandler;
   /** Renderer for producing RSC payloads during revalidation. */
   renderer?: RevalidateRenderer;
 }
@@ -62,21 +57,11 @@ export interface ActionHandlerResult {
 // (the previous module-level global was vulnerable to cross-request pollution).
 
 /**
- * Set the revalidation state for the current action execution.
- * @internal — kept for test compatibility; prefer executeAction() which uses ALS.
- */
-export function _setRevalidationState(state: RevalidationState): void {
-  // Enter ALS scope — this is only used by tests that call revalidatePath/Tag
-  // directly without going through executeAction().
-  revalidationAls.enterWith(state);
-}
-
-/**
- * Clear the revalidation state after action execution.
- * @internal — kept for test compatibility.
+ * Run `fn` inside a revalidation ALS scope.
+ * @internal — for tests that call revalidatePath/Tag directly without executeAction().
  */
-export function _clearRevalidationState(): void {
-  revalidationAls.enterWith(undefined as unknown as RevalidationState);
+export function _runWithRevalidationState<T>(state: RevalidationState, fn: () => T): T {
+  return revalidationAls.run(state, fn);
 }
 
 /**
@@ -112,8 +97,8 @@ export function revalidatePath(path: string): void {
 }
 
 /**
- * Invalidate all pre-rendered shells and 'use cache' entries tagged with `tag`.
- * Does not return a payload — the next request for an invalidated route re-renders fresh.
+ * Invalidate all timber.cache entries tagged with `tag`.
+ * Does not return a payload — the next request for an invalidated entry re-executes.
  *
  * @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
  */
@@ -172,9 +157,26 @@ export async function executeAction(
     }
   });
 
-  // Process tag invalidation
-  if (state.tags.length > 0 && config.cacheHandler) {
-    await Promise.all(state.tags.map((tag) => config.cacheHandler!.invalidate({ tag })));
+  // Process tag invalidation through cache.invalidate so it records the
+  // invalidation epoch — an in-flight cached fn must not re-store data this
+  // mutation just invalidated (TIM-1028). cache.invalidate resolves the
+  // module-level handler singleton: setCacheHandler() is called at boot from
+  // rsc-entry when timber.config.ts provides a cacheHandler; otherwise falls
+  // back to in-memory LRU (TIM-599).
+  if (state.tags.length > 0) {
+    // cache.invalidate handles both data-cache clearing AND component-seed
+    // tombstone writes (design/45 §ISR mechanics) — no separate tombstone
+    // step needed here.
+    // Best-effort: the action body already executed and its mutation committed.
+    // Use allSettled so all tags settle before proceeding — Promise.all would
+    // short-circuit on the first rejection, leaving other invalidations (including
+    // component-seed tombstone writes) in-flight during revalidatePath rendering.
+    const results = await Promise.allSettled(state.tags.map((tag) => cache.invalidate({ tag })));
+    for (const r of results) {
+      if (r.status === 'rejected') {
+        console.error('[timber] revalidateTag invalidation failed:', r.reason);
+      }
+    }
   }
 
   // Process path revalidation — build element tree (not yet serialized)
@@ -187,11 +189,28 @@ export async function executeAction(
       revalidation = await config.renderer(path);
     } catch (renderError) {
       if (renderError instanceof RedirectSignal) {
-        // Revalidation triggered a redirect (e.g., session expired)
+        // Revalidation triggered a redirect (e.g., session expired,
+        // middleware on the target path called `redirect()`).
         redirectTo = renderError.location;
         redirectStatus = renderError.status;
+      } else if (renderError instanceof DenySignal) {
+        // Target path's middleware/access denied this user.
+        //
+        // Dropping the revalidation here is the security boundary added
+        // in TIM-996: without this branch, a DenySignal would fall into
+        // the `console.error` path AND the element tree would have
+        // already been built and serialized — leaking a privileged RSC
+        // payload to the action submitter. By the time the signal
+        // surfaces, the renderer has thrown BEFORE building the tree,
+        // so we simply drop `revalidation` and ship the action result
+        // alone. The action itself still succeeded.
+        console.error(
+          `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`
+        );
       } else {
-        // Log but don't fail the action — revalidation is best-effort
+        // Log but don't fail the action — revalidation is best-effort.
+        // Includes input-validation rejections from the renderer
+        // (e.g., revalidatePath('//evil.com/admin')).
         console.error('[timber] revalidatePath render failed:', renderError);
       }
     }
@@ -203,28 +222,3 @@ export async function executeAction(
     ...(redirectTo ? { redirectTo, redirectStatus } : {}),
   };
 }
-
-/**
- * Build an HTTP Response for a no-JS form submission.
- * Standard POST → 302 redirect pattern.
- *
- * @param redirectPath - Where to redirect after the action executes.
- */
-export function buildNoJsResponse(redirectPath: string, status: number = 302): Response {
-  return new Response(null, {
-    status,
-    headers: { Location: redirectPath },
-  });
-}
-
-/**
- * Detect whether the incoming request is an RSC action request (with JS)
- * or a plain HTML form POST (no JS).
- *
- * RSC action requests use Accept: text/x-component or Content-Type: text/x-component.
- */
-export function isRscActionRequest(req: Request): boolean {
-  const accept = req.headers.get('Accept') ?? '';
-  const contentType = req.headers.get('Content-Type') ?? '';
-  return accept.includes('text/x-component') || contentType.includes('text/x-component');
-}

package/src/server/als-registry.ts

@@ -6,28 +6,64 @@
  * this registry and re-export public accessor functions.
  *
  * Why: ALS instances require singleton semantics — if two copies of the
- * same ALS exist (one from a relative import, one from a barrel import),
- * one module writes to its copy and another reads from an empty copy.
- * Centralizing ALS creation in a single module eliminates this class of bug.
+ * same ALS exist (one from a relative import, one from a barrel import,
+ * or the same file re-evaluated by Vite after an HMR invalidation), one
+ * module writes to its copy and another reads from an empty copy.
+ * Centralizing ALS creation in a single module + anchoring each instance
+ * on `globalThis` under a `Symbol.for(...)` key eliminates this class of
+ * bug, including the Vite-dev case where module instance split would
+ * otherwise hand two copies of this file out of a single evaluation cycle.
  *
- * The `timber-shims` plugin ensures `@timber-js/app/server` resolves to
- * src/ in RSC and SSR environments, so all import paths converge here.
+ * The `timber-shims` plugin remaps `@timber-js/app/server` to src/ in
+ * RSC and SSR environments so import-specifier paths converge here, and
+ * the `globalThis[SYMBOL_FOR]` anchor below closes the remaining gap: any
+ * second evaluation of this module picks up the ALS the first evaluation
+ * already stored rather than instantiating a fresh one. Same pattern the
+ * Cloudflare bindings ALS uses in `adapters/cloudflare.ts`.
  *
  * DO NOT create ALS instances outside this file. If you need a new ALS,
  * add it here and import from `./als-registry.js` in the consuming module.
+ * Inside this file, always route through `getOrCreateAls(symbol)` — a raw
+ * `new AsyncLocalStorage()` reintroduces the instance-split hazard.
  *
  * See design/18-build-system.md §"Module Singleton Strategy" and
- * §"Singleton State Registry".
+ * §"Singleton State Registry". Regression test:
+ * `tests/als-registry-singleton.test.ts`.
  */
 
+import '#server-only-guard';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import type { DebugComponentEntry } from './rsc-entry/helpers.js';
+
+/**
+ * Return a process-wide singleton `AsyncLocalStorage` keyed by `symbol`.
+ *
+ * `Symbol.for(...)` keys live in the cross-realm symbol registry, and
+ * `globalThis` is shared across every module evaluation inside the same
+ * Node.js process. Together they give a stable anchor that survives
+ * re-evaluation of this file — the second evaluation observes the
+ * `globalThis[symbol]` slot already populated by the first and hands
+ * back the identical ALS instance.
+ */
+function getOrCreateAls<T>(symbol: symbol): AsyncLocalStorage<T> {
+  const g = globalThis as unknown as Record<symbol, unknown>;
+  const existing = g[symbol];
+  if (existing instanceof AsyncLocalStorage) {
+    return existing as AsyncLocalStorage<T>;
+  }
+  const created = new AsyncLocalStorage<T>();
+  g[symbol] = created;
+  return created;
+}
 
 // ─── Request Context ──────────────────────────────────────────────────────
-// Used by: request-context.ts (headers(), cookies(), searchParams())
+// Used by: request-context.ts (getHeaders(), getCookies(), getSearchParams())
 // Design doc: design/04-authorization.md
 
 /** @internal — import via request-context.ts public API */
-export const requestContextAls = new AsyncLocalStorage<RequestContextStore>();
+export const requestContextAls = getOrCreateAls<RequestContextStore>(
+  Symbol.for('timber:request-context-als')
+);
 
 export interface RequestContextStore {
   /** Incoming request headers (read-only view). */
@@ -39,28 +75,82 @@ export interface RequestContextStore {
   /** Original (pre-overlay) frozen headers, kept for overlay merging. */
   originalHeaders: Headers;
   /**
-   * Promise resolving to the route's typed search params (when search-params.ts
-   * exists) or to the raw URLSearchParams. Stored as a Promise so the framework
-   * can later support partial pre-rendering where param resolution is deferred.
+   * Raw URLSearchParams for the current request.
+   * To get typed parsed params, import a search params definition and
+   * call `.parse(searchParams())`.
+   */
+  searchParams: URLSearchParams;
+  /**
+   * Raw search string from the request URL (e.g. "?foo=bar&baz=1").
+   * Available synchronously for use in `redirect()` with `preserveSearchParams`.
+   */
+  searchString: string;
+  /**
+   * Coerced segment params for the current request.
+   * Set by the pipeline after route matching and param coercion, before
+   * middleware and rendering. Pages and layouts read params via
+   * `getSegmentParams()` instead of receiving them as a prop.
+   *
+   * See design/07-routing.md §"params.ts — Convention File for Typed Params"
+   */
+  segmentParams?: Record<string, string | string[]>;
+  /**
+   * The matched segment path (e.g. '/(browse)/[artistSlug]/[year]').
+   * Includes route groups and parallel slots — uniquely identifies the
+   * segment in the route tree. Set by the pipeline alongside segmentParams.
+   * Used by getSegmentParams() for dev-mode validation.
+   * See design/41-global-params.md §Runtime Validation
+   */
+  matchedSegmentPath?: string;
+  /**
+   * Per-slot coerced segment params, keyed by the slot's full tree path
+   * (e.g. '/(browse)/@shows/[artistSlug]/[...year]').
+   *
+   * Each slot walks its own segment tree and may interpret URL parts
+   * differently from the main route (e.g. catch-all vs dynamic). This
+   * map stores slot-specific params so getSegmentParams(segmentPath)
+   * returns the correct types for slot pages.
+   *
+   * See design/07-routing.md §"Parallel Slot Params"
    */
-  searchParamsPromise: Promise<URLSearchParams | Record<string, unknown>>;
+  slotParamsMap?: Map<string, Record<string, string | string[]>>;
   /** Outgoing Set-Cookie entries (name → serialized value + options). Last write wins. */
   cookieJar: Map<string, CookieEntry>;
   /** Whether the response has flushed (headers committed). */
   flushed: boolean;
   /** Whether the current context allows cookie mutation. */
   mutableContext: boolean;
+  /**
+   * Set by AccessGate or PageDenyBoundary when a DenySignal is caught
+   * server-side (inside the React tree, before React Flight sees it).
+   * The pipeline reads this after render to set the HTTP status code.
+   * See TIM-666.
+   */
+  denyStatus?: number;
+  /**
+   * Callback fired when setDenyStatus() is called. Used by shellSettled
+   * to short-circuit when any component catches a DenySignal in-tree,
+   * regardless of which component caught it (AccessGate, TracedLayout,
+   * or PageDenyBoundary). See TIM-1208.
+   */
+  onDenyStatus?: () => void;
+  /**
+   * Dev-only: getter for the current request's RSC debug components.
+   * Set by renderRoute() so onPipelineError can include component tree
+   * context for render-phase errors without module-level shared state.
+   */
+  debugComponentsGetter?: () => DebugComponentEntry[];
 }
 
 /** A single outgoing cookie entry in the cookie jar. */
 export interface CookieEntry {
   name: string;
   value: string;
-  options: import('./request-context.js').CookieOptions;
+  options: import('./cookie-context.js').CookieOptions;
 }
 
 // ─── Tracing ──────────────────────────────────────────────────────────────
-// Used by: tracing.ts (traceId(), spanId())
+// Used by: tracing.ts (getTraceId(), getSpanId())
 // Design doc: design/17-logging.md
 
 export interface TraceStore {
@@ -68,10 +158,17 @@ export interface TraceStore {
   traceId: string;
   /** OTEL span ID if available, undefined otherwise. */
   spanId?: string;
+  /**
+   * Innermost active native platform span (e.g. Cloudflare's `Span` from
+   * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes
+   * after span creation — the platform API has no getActiveSpan() equivalent.
+   * Saved/restored by withSpan() around each callback. See TIM-1135.
+   */
+  platformSpan?: import('./tracing.js').PlatformSpan;
 }
 
 /** @internal — import via tracing.ts public API */
-export const traceAls = new AsyncLocalStorage<TraceStore>();
+export const traceAls = getOrCreateAls<TraceStore>(Symbol.for('timber:trace-als'));
 
 // ─── Server-Timing ────────────────────────────────────────────────────────
 // Used by: server-timing.ts (recordTiming(), withTiming())
@@ -82,7 +179,7 @@ export interface TimingStore {
 }
 
 /** @internal — import via server-timing.ts public API */
-export const timingAls = new AsyncLocalStorage<TimingStore>();
+export const timingAls = getOrCreateAls<TimingStore>(Symbol.for('timber:timing-als'));
 
 // ─── Revalidation ─────────────────────────────────────────────────────────
 // Used by: actions.ts (revalidatePath(), revalidateTag())
@@ -96,14 +193,18 @@ export interface RevalidationState {
 }
 
 /** @internal — import via actions.ts public API */
-export const revalidationAls = new AsyncLocalStorage<RevalidationState>();
+export const revalidationAls = getOrCreateAls<RevalidationState>(
+  Symbol.for('timber:revalidation-als')
+);
 
 // ─── Form Flash ───────────────────────────────────────────────────────────
 // Used by: form-flash.ts (getFormFlash())
 // Design doc: design/08-forms-and-actions.md §"No-JS Error Round-Trip"
 
 /** @internal — import via form-flash.ts public API */
-export const formFlashAls = new AsyncLocalStorage<import('./form-flash.js').FormFlashData>();
+export const formFlashAls = getOrCreateAls<import('./form-flash.js').FormFlashData>(
+  Symbol.for('timber:form-flash-als')
+);
 
 // ─── Early Hints Sender ──────────────────────────────────────────────────
 // Used by: early-hints-sender.ts (sendEarlyHints103())
@@ -113,7 +214,9 @@ export const formFlashAls = new AsyncLocalStorage<import('./form-flash.js').Form
 export type EarlyHintsSenderFn = (links: string[]) => void;
 
 /** @internal — import via early-hints-sender.ts public API */
-export const earlyHintsSenderAls = new AsyncLocalStorage<EarlyHintsSenderFn>();
+export const earlyHintsSenderAls = getOrCreateAls<EarlyHintsSenderFn>(
+  Symbol.for('timber:early-hints-sender-als')
+);
 
 // ─── waitUntil Bridge ────────────────────────────────────────────────────
 // Used by: waituntil-bridge.ts (waitUntil())
@@ -123,4 +226,18 @@ export const earlyHintsSenderAls = new AsyncLocalStorage<EarlyHintsSenderFn>();
 export type WaitUntilFn = (promise: Promise<unknown>) => void;
 
 /** @internal — import via waituntil-bridge.ts public API */
-export const waitUntilAls = new AsyncLocalStorage<WaitUntilFn>();
+export const waitUntilAls = getOrCreateAls<WaitUntilFn>(Symbol.for('timber:wait-until-als'));
+
+// ─── Workers Cache Purge Bridge ─────────────────────────────────────────
+// Used by: workers-cache-bridge.ts (runWithWorkersCachePurge())
+// Design doc: design/06-caching.md, design/25-production-deployments.md
+
+/** Workers Cache purge function from Cloudflare ExecutionContext.cache. */
+export interface WorkersCachePurgeCtx {
+  purge(opts: { tags: string[] }): Promise<void>;
+}
+
+/** @internal — import via workers-cache-bridge.ts public API */
+export const workersCachePurgeAls = getOrCreateAls<WorkersCachePurgeCtx>(
+  Symbol.for('timber:workers-cache-purge-als')
+);

package/src/server/asset-headers.ts

@@ -8,13 +8,25 @@
  * Unhashed assets (e.g. /favicon.ico) get a shorter cache with revalidation:
  *   Cache-Control: public, max-age=3600, must-revalidate
  *
- * This is applied automatically by the framework for static assets served
- * from the build output. Page responses are NOT affected — those are
- * controlled by the developer via middleware.ts or proxy.ts.
+ * The `_headers` file lists hashed asset paths (/assets/*, /_timber/fonts/*) as
+ * wildcard rules and unhashed files as per-file rules. At runtime, adapters
+ * that see static file requests (nitro, preview) also set Cache-Control via
+ * `getAssetCacheControl()`. On Cloudflare Workers Static Assets, the worker
+ * never sees static file requests — the `_headers` file is the only mechanism.
+ * Page responses are NOT affected — those are controlled by the developer
+ * via middleware.ts or proxy.ts.
  *
  * Design docs: 18-build-system.md, 06-caching.md
  */
 
+import { IMMUTABLE_CACHE, STATIC_CACHE } from '../adapters/shared.js';
+
+// Re-export cache constants and generateHeadersFile from the shared adapter
+// module. The canonical definitions live in adapters/shared.ts because
+// adapters are loaded by Node before Vite's resolver is available — they
+// can only import from within their own directory.
+export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.js';
+
 /**
  * Regex matching Vite-hashed asset filenames.
  *
@@ -30,18 +42,6 @@
  */
 const HASHED_ASSET_RE = /[-.][\da-f]{8,}\.\w+$/;
 
-/** One year in seconds (365 days). */
-const ONE_YEAR = 31_536_000;
-
-/** One hour in seconds. */
-const ONE_HOUR = 3_600;
-
-/** Cache-Control value for hashed (immutable) assets. */
-export const IMMUTABLE_CACHE = `public, max-age=${ONE_YEAR}, immutable`;
-
-/** Cache-Control value for unhashed static assets. */
-export const STATIC_CACHE = `public, max-age=${ONE_HOUR}, must-revalidate`;
-
 /**
  * Check if a URL path looks like a hashed asset.
  */
@@ -57,25 +57,3 @@ export function isHashedAsset(pathname: string): boolean {
 export function getAssetCacheControl(pathname: string): string {
   return isHashedAsset(pathname) ? IMMUTABLE_CACHE : STATIC_CACHE;
 }
-
-/**
- * Generate a `_headers` file for static asset cache control.
- *
- * The `_headers` file is a platform convention supported by Cloudflare Workers
- * Static Assets, Cloudflare Pages, and Netlify. It maps URL patterns to
- * HTTP response headers.
- *
- * Vite places all hashed chunks under `/assets/` — these get immutable caching.
- * Everything else (favicon.ico, robots.txt, etc.) gets a shorter cache.
- */
-export function generateHeadersFile(): string {
-  return `# Auto-generated by @timber-js/app — static asset cache headers.
-# See design/25-production-deployments.md §"CDN / Edge Cache"
-
-/assets/*
-  Cache-Control: ${IMMUTABLE_CACHE}
-
-/*
-  Cache-Control: ${STATIC_CACHE}
-`;
-}

package/src/server/body-limits.ts

@@ -53,6 +53,9 @@ export function parseBodySize(size: string): number {
   }
 }
 
+/** Strict integer pattern: one or more digits, nothing else. */
+const STRICT_INTEGER_RE = /^\d+$/;
+
 /** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
 export function enforceBodyLimits(
   req: Request,
@@ -66,11 +69,16 @@ export function enforceBodyLimits(
     return { ok: false, status: 411 };
   }
 
-  const bodySize = Number.parseInt(contentLength, 10);
-  if (Number.isNaN(bodySize)) {
+  // Reject malformed values: multiple values ("100, 999999"), negative numbers,
+  // floats ("100.5"), or non-numeric strings. parseInt would silently parse
+  // the first number from "100, 999999" as 100, letting the real body through.
+  const trimmed = contentLength.trim();
+  if (!STRICT_INTEGER_RE.test(trimmed)) {
     return { ok: false, status: 411 };
   }
 
+  const bodySize = Number.parseInt(trimmed, 10);
+
   const limit = resolveLimit(kind, config);
   return bodySize <= limit ? { ok: true } : { ok: false, status: 413 };
 }

package/src/server/build-manifest.ts

@@ -35,6 +35,18 @@ export interface BuildManifest {
   modulepreload: Record<string, string[]>;
   /** Map from input file path to font assets used by that module. */
   fonts: Record<string, ManifestFontEntry[]>;
+  /**
+   * Cache-busting hashes for metadata route files (opengraph-image, etc.).
+   * Map from file path (relative to project root) to short content hash.
+   * In dev mode this is empty — a startup nonce is used instead.
+   */
+  metadataRouteHashes?: Record<string, string>;
+  /**
+   * Static request-dependency map from the Vite plugin's module-graph analysis.
+   * Map from segment entry file path to whether it's request-dependent.
+   * Used by buildSegmentInfo() for X-Timber-Segments in production.
+   */
+  requestDep?: Record<string, boolean>;
 }
 
 /** Empty build manifest used in dev mode. */
@@ -43,6 +55,7 @@ export const EMPTY_BUILD_MANIFEST: BuildManifest = {
   js: {},
   modulepreload: {},
   fonts: {},
+  metadataRouteHashes: {},
 };
 
 /** Segment shape expected by collectRouteCss (matches ManifestSegmentNode). */
@@ -85,22 +98,15 @@ export function collectRouteCss(segments: SegmentWithFiles[], manifest: BuildMan
  * via injectHead() before </head>.
  */
 export function buildCssLinkTags(cssUrls: string[]): string {
+  // Emit only <link rel="stylesheet"> — no preload tags. CSS preloading
+  // is handled by 103 Early Hints (Link header) which fires before the
+  // HTML stream. Float also emits `<link rel="stylesheet" data-precedence>`
+  // at the top of <head> during Fizz rendering — the browser discovers
+  // CSS from that tag. A <link rel="preload"> here would arrive *after*
+  // Float's stylesheet tag and trigger "Preload was ignored" warnings.
   return cssUrls.map((url) => `<link rel="stylesheet" href="${url}">`).join('');
 }
 
-/**
- * Generate a Link header value for CSS preload hints.
- *
- * Cloudflare CDN automatically converts Link headers with rel=preload
- * into 103 Early Hints responses. This avoids platform-specific 103
- * sending code.
- *
- * Example output: `</assets/root.css>; rel=preload; as=style, </assets/page.css>; rel=preload; as=style`
- */
-export function buildLinkHeaders(cssUrls: string[]): string {
-  return cssUrls.map((url) => `<${url}>; rel=preload; as=style`).join(', ');
-}
-
 // ─── Font utilities ──────────────────────────────────────────────────────
 
 /**
@@ -148,44 +154,8 @@ export function buildFontPreloadTags(fonts: ManifestFontEntry[]): string {
     .join('');
 }
 
-/**
- * Generate Link header values for font preload hints.
- *
- * Cloudflare CDN converts Link headers with rel=preload into 103 Early Hints.
- *
- * Example: `</fonts/inter.woff2>; rel=preload; as=font; crossorigin`
- */
-export function buildFontLinkHeaders(fonts: ManifestFontEntry[]): string {
-  return fonts.map((f) => `<${f.href}>; rel=preload; as=font; crossorigin`).join(', ');
-}
-
 // ─── JS chunk utilities ──────────────────────────────────────────────────
 
-/**
- * Collect JS chunk URLs for a matched route's segment chain.
- *
- * Walks segments root → leaf, collecting the JS chunk for each layout
- * and page. Deduplicates while preserving order.
- */
-export function collectRouteJs(segments: SegmentWithFiles[], manifest: BuildManifest): string[] {
-  const seen = new Set<string>();
-  const result: string[] = [];
-
-  for (const segment of segments) {
-    for (const file of [segment.layout, segment.page]) {
-      if (!file) continue;
-      const jsUrl = manifest.js[file.filePath];
-      if (!jsUrl) continue;
-      if (!seen.has(jsUrl)) {
-        seen.add(jsUrl);
-        result.push(jsUrl);
-      }
-    }
-  }
-
-  return result;
-}
-
 /**
  * Collect modulepreload URLs for a matched route's segment chain.
  *
@@ -225,10 +195,3 @@ export function collectRouteModulepreloads(
 export function buildModulepreloadTags(urls: string[]): string {
   return urls.map((url) => `<link rel="modulepreload" href="${url}">`).join('');
 }
-
-/**
- * Generate a <script type="module"> tag for a JS entry point.
- */
-export function buildEntryScriptTag(url: string): string {
-  return `<script type="module" src="${url}"></script>`;
-}

package/src/server/canonicalize.ts

@@ -13,11 +13,14 @@ export type CanonicalizeResult = { ok: true; pathname: string } | { ok: false; s
 /**
  * Encoded separators that produce a 400 rejection.
  * %2f (/) and %5c (\) cause path-confusion attacks.
+ *
+ * Shared between the runtime canonicalizer and the build-time route scanner
+ * to ensure both enforce identical security rules. See design/13-security.md.
  */
-const ENCODED_SEPARATOR_RE = /%2f|%5c/i;
+export const ENCODED_SEPARATOR_RE = /%2f|%5c/i;
 
-/** Null byte — rejected. */
-const NULL_BYTE_RE = /%00/i;
+/** Null byte — rejected. Shared with the route scanner. */
+export const NULL_BYTE_RE = /%00/i;
 
 /**
  * Canonicalize a URL pathname.