@timber-js/app 0.2.0-alpha.18 → 0.2.0-alpha.181

package/dist/server/als-registry.d.ts

@@ -6,20 +6,33 @@
  * this registry and re-export public accessor functions.
  *
  * Why: ALS instances require singleton semantics — if two copies of the
- * same ALS exist (one from a relative import, one from a barrel import),
- * one module writes to its copy and another reads from an empty copy.
- * Centralizing ALS creation in a single module eliminates this class of bug.
+ * same ALS exist (one from a relative import, one from a barrel import,
+ * or the same file re-evaluated by Vite after an HMR invalidation), one
+ * module writes to its copy and another reads from an empty copy.
+ * Centralizing ALS creation in a single module + anchoring each instance
+ * on `globalThis` under a `Symbol.for(...)` key eliminates this class of
+ * bug, including the Vite-dev case where module instance split would
+ * otherwise hand two copies of this file out of a single evaluation cycle.
  *
- * The `timber-shims` plugin ensures `@timber-js/app/server` resolves to
- * src/ in RSC and SSR environments, so all import paths converge here.
+ * The `timber-shims` plugin remaps `@timber-js/app/server` to src/ in
+ * RSC and SSR environments so import-specifier paths converge here, and
+ * the `globalThis[SYMBOL_FOR]` anchor below closes the remaining gap: any
+ * second evaluation of this module picks up the ALS the first evaluation
+ * already stored rather than instantiating a fresh one. Same pattern the
+ * Cloudflare bindings ALS uses in `adapters/cloudflare.ts`.
  *
  * DO NOT create ALS instances outside this file. If you need a new ALS,
  * add it here and import from `./als-registry.js` in the consuming module.
+ * Inside this file, always route through `getOrCreateAls(symbol)` — a raw
+ * `new AsyncLocalStorage()` reintroduces the instance-split hazard.
  *
  * See design/18-build-system.md §"Module Singleton Strategy" and
- * §"Singleton State Registry".
+ * §"Singleton State Registry". Regression test:
+ * `tests/als-registry-singleton.test.ts`.
  */
+import '#server-only-guard';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import type { DebugComponentEntry } from './rsc-entry/helpers.js';
 /** @internal — import via request-context.ts public API */
 export declare const requestContextAls: AsyncLocalStorage<RequestContextStore>;
 export interface RequestContextStore {
@@ -32,29 +45,90 @@ export interface RequestContextStore {
     /** Original (pre-overlay) frozen headers, kept for overlay merging. */
     originalHeaders: Headers;
     /**
-     * Promise resolving to the route's typed search params (when search-params.ts
-     * exists) or to the raw URLSearchParams. Stored as a Promise so the framework
-     * can later support partial pre-rendering where param resolution is deferred.
+     * Raw URLSearchParams for the current request.
+     * To get typed parsed params, import a search params definition and
+     * call `.parse(searchParams())`.
      */
-    searchParamsPromise: Promise<URLSearchParams | Record<string, unknown>>;
+    searchParams: URLSearchParams;
+    /**
+     * Raw search string from the request URL (e.g. "?foo=bar&baz=1").
+     * Available synchronously for use in `redirect()` with `preserveSearchParams`.
+     */
+    searchString: string;
+    /**
+     * Coerced segment params for the current request.
+     * Set by the pipeline after route matching and param coercion, before
+     * middleware and rendering. Pages and layouts read params via
+     * `getSegmentParams()` instead of receiving them as a prop.
+     *
+     * See design/07-routing.md §"params.ts — Convention File for Typed Params"
+     */
+    segmentParams?: Record<string, string | string[]>;
+    /**
+     * The matched segment path (e.g. '/(browse)/[artistSlug]/[year]').
+     * Includes route groups and parallel slots — uniquely identifies the
+     * segment in the route tree. Set by the pipeline alongside segmentParams.
+     * Used by getSegmentParams() for dev-mode validation.
+     * See design/41-global-params.md §Runtime Validation
+     */
+    matchedSegmentPath?: string;
+    /**
+     * Per-slot coerced segment params, keyed by the slot's full tree path
+     * (e.g. '/(browse)/@shows/[artistSlug]/[...year]').
+     *
+     * Each slot walks its own segment tree and may interpret URL parts
+     * differently from the main route (e.g. catch-all vs dynamic). This
+     * map stores slot-specific params so getSegmentParams(segmentPath)
+     * returns the correct types for slot pages.
+     *
+     * See design/07-routing.md §"Parallel Slot Params"
+     */
+    slotParamsMap?: Map<string, Record<string, string | string[]>>;
     /** Outgoing Set-Cookie entries (name → serialized value + options). Last write wins. */
     cookieJar: Map<string, CookieEntry>;
     /** Whether the response has flushed (headers committed). */
     flushed: boolean;
     /** Whether the current context allows cookie mutation. */
     mutableContext: boolean;
+    /**
+     * Set by AccessGate or PageDenyBoundary when a DenySignal is caught
+     * server-side (inside the React tree, before React Flight sees it).
+     * The pipeline reads this after render to set the HTTP status code.
+     * See TIM-666.
+     */
+    denyStatus?: number;
+    /**
+     * Callback fired when setDenyStatus() is called. Used by shellSettled
+     * to short-circuit when any component catches a DenySignal in-tree,
+     * regardless of which component caught it (AccessGate, TracedLayout,
+     * or PageDenyBoundary). See TIM-1208.
+     */
+    onDenyStatus?: () => void;
+    /**
+     * Dev-only: getter for the current request's RSC debug components.
+     * Set by renderRoute() so onPipelineError can include component tree
+     * context for render-phase errors without module-level shared state.
+     */
+    debugComponentsGetter?: () => DebugComponentEntry[];
 }
 /** A single outgoing cookie entry in the cookie jar. */
 export interface CookieEntry {
     name: string;
     value: string;
-    options: import('./request-context.js').CookieOptions;
+    options: import('./cookie-context.js').CookieOptions;
 }
 export interface TraceStore {
     /** 32-char lowercase hex trace ID (OTEL or UUID fallback). */
     traceId: string;
     /** OTEL span ID if available, undefined otherwise. */
     spanId?: string;
+    /**
+     * Innermost active native platform span (e.g. Cloudflare's `Span` from
+     * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes
+     * after span creation — the platform API has no getActiveSpan() equivalent.
+     * Saved/restored by withSpan() around each callback. See TIM-1135.
+     */
+    platformSpan?: import('./tracing.js').PlatformSpan;
 }
 /** @internal — import via tracing.ts public API */
 export declare const traceAls: AsyncLocalStorage<TraceStore>;
@@ -81,4 +155,12 @@ export declare const earlyHintsSenderAls: AsyncLocalStorage<EarlyHintsSenderFn>;
 export type WaitUntilFn = (promise: Promise<unknown>) => void;
 /** @internal — import via waituntil-bridge.ts public API */
 export declare const waitUntilAls: AsyncLocalStorage<WaitUntilFn>;
+/** Workers Cache purge function from Cloudflare ExecutionContext.cache. */
+export interface WorkersCachePurgeCtx {
+    purge(opts: {
+        tags: string[];
+    }): Promise<void>;
+}
+/** @internal — import via workers-cache-bridge.ts public API */
+export declare const workersCachePurgeAls: AsyncLocalStorage<WorkersCachePurgeCtx>;
 //# sourceMappingURL=als-registry.d.ts.map

package/dist/server/als-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAA+C,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,sBAAsB,EAAE,aAAa,CAAC;CACvD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAAsC,CAAC;AAM5D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAAuC,CAAC;AAM9D,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAA6C,CAAC;AAM1E,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAAmE,CAAC;AAM7F,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAA8C,CAAC;AAM/E,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAuC,CAAC"}
+{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA2BlE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAE7B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,mBAAmB,EAAE,CAAC;CACrD;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;CACtD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAA6D,CAAC;AAMnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAMtF,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAE3B,CAAC;AAMF,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAExB,CAAC;AAMF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAE/B,CAAC;AAMF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAmE,CAAC;AAM7F,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,yCAEhC,CAAC"}

package/dist/server/asset-headers.d.ts

@@ -8,16 +8,17 @@
  * Unhashed assets (e.g. /favicon.ico) get a shorter cache with revalidation:
  *   Cache-Control: public, max-age=3600, must-revalidate
  *
- * This is applied automatically by the framework for static assets served
- * from the build output. Page responses are NOT affected — those are
- * controlled by the developer via middleware.ts or proxy.ts.
+ * The `_headers` file lists hashed asset paths (/assets/*, /_timber/fonts/*) as
+ * wildcard rules and unhashed files as per-file rules. At runtime, adapters
+ * that see static file requests (nitro, preview) also set Cache-Control via
+ * `getAssetCacheControl()`. On Cloudflare Workers Static Assets, the worker
+ * never sees static file requests — the `_headers` file is the only mechanism.
+ * Page responses are NOT affected — those are controlled by the developer
+ * via middleware.ts or proxy.ts.
  *
  * Design docs: 18-build-system.md, 06-caching.md
  */
-/** Cache-Control value for hashed (immutable) assets. */
-export declare const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
-/** Cache-Control value for unhashed static assets. */
-export declare const STATIC_CACHE = "public, max-age=3600, must-revalidate";
+export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.js';
 /**
  * Check if a URL path looks like a hashed asset.
  */
@@ -28,15 +29,4 @@ export declare function isHashedAsset(pathname: string): boolean;
  * Returns `immutable` for hashed assets, short-lived for unhashed.
  */
 export declare function getAssetCacheControl(pathname: string): string;
-/**
- * Generate a `_headers` file for static asset cache control.
- *
- * The `_headers` file is a platform convention supported by Cloudflare Workers
- * Static Assets, Cloudflare Pages, and Netlify. It maps URL patterns to
- * HTTP response headers.
- *
- * Vite places all hashed chunks under `/assets/` — these get immutable caching.
- * Everything else (favicon.ico, robots.txt, etc.) gets a shorter cache.
- */
-export declare function generateHeadersFile(): string;
 //# sourceMappingURL=asset-headers.d.ts.map

package/dist/server/asset-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-headers.d.ts","sourceRoot":"","sources":["../../src/server/asset-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,yDAAyD;AACzD,eAAO,MAAM,eAAe,wCAA2C,CAAC;AAExE,sDAAsD;AACtD,eAAO,MAAM,YAAY,0CAAiD,CAAC;AAE3E;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAU5C"}
+{"version":3,"file":"asset-headers.d.ts","sourceRoot":"","sources":["../../src/server/asset-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAiB3F;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/server/body-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAejB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}
+{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;aACzB,cAAc;aACd,cAAc;aACd,SAAS,EAAE,GAAG;CACN,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAKD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAoBjB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}

package/dist/server/build-manifest.d.ts

@@ -33,6 +33,18 @@ export interface BuildManifest {
     modulepreload: Record<string, string[]>;
     /** Map from input file path to font assets used by that module. */
     fonts: Record<string, ManifestFontEntry[]>;
+    /**
+     * Cache-busting hashes for metadata route files (opengraph-image, etc.).
+     * Map from file path (relative to project root) to short content hash.
+     * In dev mode this is empty — a startup nonce is used instead.
+     */
+    metadataRouteHashes?: Record<string, string>;
+    /**
+     * Static request-dependency map from the Vite plugin's module-graph analysis.
+     * Map from segment entry file path to whether it's request-dependent.
+     * Used by buildSegmentInfo() for X-Timber-Segments in production.
+     */
+    requestDep?: Record<string, boolean>;
 }
 /** Empty build manifest used in dev mode. */
 export declare const EMPTY_BUILD_MANIFEST: BuildManifest;
@@ -59,16 +71,6 @@ export declare function collectRouteCss(segments: SegmentWithFiles[], manifest:
  * via injectHead() before </head>.
  */
 export declare function buildCssLinkTags(cssUrls: string[]): string;
-/**
- * Generate a Link header value for CSS preload hints.
- *
- * Cloudflare CDN automatically converts Link headers with rel=preload
- * into 103 Early Hints responses. This avoids platform-specific 103
- * sending code.
- *
- * Example output: `</assets/root.css>; rel=preload; as=style, </assets/page.css>; rel=preload; as=style`
- */
-export declare function buildLinkHeaders(cssUrls: string[]): string;
 /**
  * Collect all font entries needed for a matched route's segment chain.
  *
@@ -83,21 +85,6 @@ export declare function collectRouteFonts(segments: SegmentWithFiles[], manifest
  * for font preloads even for same-origin resources per the spec).
  */
 export declare function buildFontPreloadTags(fonts: ManifestFontEntry[]): string;
-/**
- * Generate Link header values for font preload hints.
- *
- * Cloudflare CDN converts Link headers with rel=preload into 103 Early Hints.
- *
- * Example: `</fonts/inter.woff2>; rel=preload; as=font; crossorigin`
- */
-export declare function buildFontLinkHeaders(fonts: ManifestFontEntry[]): string;
-/**
- * Collect JS chunk URLs for a matched route's segment chain.
- *
- * Walks segments root → leaf, collecting the JS chunk for each layout
- * and page. Deduplicates while preserving order.
- */
-export declare function collectRouteJs(segments: SegmentWithFiles[], manifest: BuildManifest): string[];
 /**
  * Collect modulepreload URLs for a matched route's segment chain.
  *
@@ -112,9 +99,5 @@ export declare function collectRouteModulepreloads(segments: SegmentWithFiles[],
  * before they're needed, reducing waterfall latency for dynamic imports.
  */
 export declare function buildModulepreloadTags(urls: string[]): string;
-/**
- * Generate a <script type="module"> tag for a JS entry point.
- */
-export declare function buildEntryScriptTag(url: string): string;
 export {};
 //# sourceMappingURL=build-manifest.d.ts.map

package/dist/server/build-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;CAC5C;AAED,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,aAKlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAEvE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAiB9F;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,aAMlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAID;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D"}

package/dist/server/canonicalize.d.ts

@@ -14,6 +14,16 @@ export type CanonicalizeResult = {
     ok: false;
     status: 400;
 };
+/**
+ * Encoded separators that produce a 400 rejection.
+ * %2f (/) and %5c (\) cause path-confusion attacks.
+ *
+ * Shared between the runtime canonicalizer and the build-time route scanner
+ * to ensure both enforce identical security rules. See design/13-security.md.
+ */
+export declare const ENCODED_SEPARATOR_RE: RegExp;
+/** Null byte — rejected. Shared with the route scanner. */
+export declare const NULL_BYTE_RE: RegExp;
 /**
  * Canonicalize a URL pathname.
  *

package/dist/server/canonicalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAW7F;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}

package/dist/server/coalesce-tick.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Single-shot `setImmediate` coalescing primitive.
+ *
+ * Multiple synchronous `schedule()` calls within one event-loop tick
+ * result in exactly one `flush` invocation at the end of that tick.
+ * No recursive scheduling, no busy-wait, no polling loop.
+ *
+ * Both `createBufferedTransformStream` (Web) and
+ * `createNodeBufferedTransform` (Node) use this helper so the invariant
+ * — and this comment — live in one place.
+ *
+ * **Not a polling loop.** Uses a single-shot `setImmediate` per flush
+ * cycle — no recursive scheduling, no busy-wait. See design/02
+ * §"No Polling".
+ */
+export interface TickCoalescer {
+    /**
+     * Request a flush at the end of the current tick. If a flush is already
+     * scheduled, this is a no-op. Returns the pending promise (or undefined
+     * if the flush already fired and no new one has been scheduled).
+     */
+    schedule(): void;
+    /**
+     * The pending flush promise, if any. Callers (e.g. `flush()` in a
+     * TransformStream) can `await` this to wait for the scheduled flush
+     * to complete before closing the stream.
+     */
+    readonly pending: Promise<void> | undefined;
+    /**
+     * Cancel any pending scheduled flush and invoke the flush callback
+     * synchronously. Used by Node `Transform.flush()` which needs to
+     * drain the buffer immediately before calling back.
+     */
+    flushSync(): void;
+}
+/**
+ * Create a tick coalescer that calls `onFlush` at most once per tick.
+ */
+export declare function createTickCoalescer(onFlush: () => void): TickCoalescer;
+//# sourceMappingURL=coalesce-tick.d.ts.map

package/dist/server/coalesce-tick.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce-tick.d.ts","sourceRoot":"","sources":["../../src/server/coalesce-tick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,IAAI,IAAI,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE5C;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,aAAa,CAgCtE"}

package/dist/server/cookie-context.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Cookie Context — per-request cookie API and on-the-wire helpers.
+ *
+ * Split out of `request-context.ts` (TIM-853) so the cookie subsystem
+ * — encoding contract, options grammar, parser, serializer, RYW map,
+ * and rerender seed — lives in one file. The headers/scope/params APIs
+ * stay in `request-context.ts` and call into this module via the
+ * exported helpers.
+ *
+ * See design/29-cookies.md for the encoding contract and read-your-own-
+ * writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the
+ * smuggling primitive that the encoding contract closes.
+ */
+import { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions } from '../cookies/validation.js';
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
+/**
+ * Returns a cookie accessor for the current request.
+ *
+ * Available in middleware, access checks, server components, and server actions.
+ * Throws if called outside a request context (security principle #2: no global fallback).
+ *
+ * Read methods (.get, .has, .getAll) are always available and reflect
+ * read-your-own-writes from .set() calls in the same request.
+ *
+ * Mutation methods (.set, .delete, .clear) are only available in mutable
+ * contexts (middleware.ts, server actions, route.ts handlers). Calling them
+ * in read-only contexts (access.ts, server components) throws.
+ *
+ * This is the escape hatch for direct cookie jar operations. For typed
+ * cookie access, use `defineCookie()` instead.
+ *
+ * See design/29-cookies.md
+ */
+export declare function getCookieJar(): RequestCookies;
+/**
+ * Returns the value of a single cookie, or undefined if absent.
+ *
+ * @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.
+ */
+export declare function getCookie(name: string): string | undefined;
+/**
+ * Per-call options for `getCookies().set()`. Extends the persistent
+ * `CookieOptions` (HTTP cookie attributes) with framework-only flags
+ * that are NOT serialized into the Set-Cookie header.
+ *
+ * The `raw` flag is the escape hatch for the auto-encoding contract.
+ * See design/29-cookies.md §"Encoding Contract".
+ */
+export interface SetCookieOptions extends CookieOptions {
+    /**
+     * Skip the framework's `encodeURIComponent` pass and store the value
+     * verbatim. The value is then validated against the strict RFC 6265
+     * §4.1.1 `cookie-octet` grammar — the H-3 smuggling primitive cannot
+     * sneak in via this opt-out.
+     *
+     * Use this when forwarding a cookie value that is already in its
+     * intended on-the-wire form (e.g. mirroring an upstream service's
+     * Set-Cookie). Default: `false` (auto-encode).
+     */
+    raw?: boolean;
+}
+/** Options for setting a cookie. See design/29-cookies.md. */
+export interface CookieOptions {
+    /** Domain scope. Default: omitted (current domain only). */
+    domain?: string;
+    /** URL path scope. Default: '/'. */
+    path?: string;
+    /** Expiration date. Mutually exclusive with maxAge. */
+    expires?: Date;
+    /** Max age in seconds. Mutually exclusive with expires. */
+    maxAge?: number;
+    /** Prevent client-side JS access. Default: true. */
+    httpOnly?: boolean;
+    /** Only send over HTTPS. Default: true. */
+    secure?: boolean;
+    /** Cross-site request policy. Default: 'lax'. */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
+    partitioned?: boolean;
+}
+/**
+ * Cookie accessor returned by `getCookies()`.
+ *
+ * Read methods are always available. Mutation methods throw in read-only
+ * contexts (access.ts, server components).
+ */
+export interface RequestCookies {
+    /** Get a cookie value by name. Returns undefined if not present. */
+    get(name: string): string | undefined;
+    /** Check if a cookie exists. */
+    has(name: string): boolean;
+    /** Get all cookies as an array of { name, value } pairs. */
+    getAll(): Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Number of cookies. */
+    readonly size: number;
+    /**
+     * Set a cookie. Only available in mutable contexts (middleware, actions,
+     * route handlers).
+     *
+     * The value is auto-encoded with `encodeURIComponent` so the on-the-wire
+     * bytes always satisfy RFC 6265 §4.1.1 cookie-octet — `cookies().get()`
+     * returns the same logical value the developer wrote. Pass `{ raw: true }`
+     * to skip the encoder; the raw path validates against the strict
+     * cookie-octet grammar instead. See design/29-cookies.md §"Encoding
+     * Contract" and ONGOING_SECURITY.md H-3 (TIM-868).
+     */
+    set(name: string, value: string, options?: SetCookieOptions): void;
+    /**
+     * Copy all `Set-Cookie` headers from a `Headers` object.
+     * Parses each header and forwards name, value, and all attributes
+     * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).
+     *
+     * Useful when forwarding cookies from an internal `fetch()` or auth handler:
+     * ```ts
+     * const response = await auth.handler(req);
+     * getCookies().then(c => c.setFromHeaders(response.headers));
+     * ```
+     */
+    setFromHeaders(headers: Headers): void;
+    /** Delete a cookie. Only available in mutable contexts. */
+    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
+    /** Delete all cookies. Only available in mutable contexts. */
+    clear(): void;
+    /** Serialize cookies as a Cookie header string. */
+    toString(): string;
+}
+/**
+ * Register a pre-parsed cookie map to use as the request context seed for
+ * the next `runWithRequestContext(req, …)` call with this exact `req`.
+ *
+ * Used by the no-JS form-rerender dispatcher in
+ * `rsc-entry/wrap-action-dispatch.ts` to thread the action's post-mutation
+ * cookie state into the rerender scope without serializing back through a
+ * `Cookie:` header. See TIM-868 / TIM-837.
+ *
+ * @internal — framework use only.
+ */
+export declare function seedRequestCookies(req: Request, cookies: Map<string, string>): void;
+/**
+ * Pop the seed (if any) for `req` and return it. Called from
+ * `runWithRequestContext` exactly once per request — the seed is consumed
+ * eagerly so it cannot leak into a hypothetical future re-use of the same
+ * Request reference.
+ *
+ * @internal — framework use only.
+ */
+export declare function consumeSeededCookies(req: Request): Map<string, string> | undefined;
+/**
+ * Build a Map of cookie name → value reflecting the current request's
+ * read-your-own-writes state. Includes incoming cookies plus any
+ * mutations from getCookies().set() / getCookies().delete() in the same request.
+ *
+ * Used by SSR renderers to populate NavContext.cookies so that
+ * useCookie()'s server snapshot matches the actual response state.
+ *
+ * See design/29-cookies.md §"Read-Your-Own-Writes"
+ * See design/triage/TIM-441-cookie-api-triage.md §4
+ */
+export declare function getCookiesForSsr(): Map<string, string>;
+/**
+ * Collect all Set-Cookie headers from the cookie jar.
+ * Called by the framework at flush time to apply cookies to the response.
+ *
+ * Returns an array of serialized Set-Cookie header values.
+ */
+export declare function getSetCookieHeaders(): string[];
+//# sourceMappingURL=cookie-context.d.ts.map

package/dist/server/cookie-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-context.d.ts","sourceRoot":"","sources":["../../src/server/cookie-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;AAInF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,cAAc,CAgL7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,2DAA2D;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,mDAAmD;IACnD,QAAQ,IAAI,MAAM,CAAC;CACpB;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKnF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAI9C"}

package/dist/server/cookie-parsing.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cookie parsing and serialization helpers — pure string ↔ structure
+ * functions with no ALS dependency. Split out of `cookie-context.ts`
+ * (TIM-853) so the API surface and the wire-format codecs can each be
+ * read on their own.
+ *
+ * The functions in this module are total over arbitrary input. They
+ * never throw and never call `assertValid*` (the security validators
+ * live in the API surface — `cookie-context.ts` invokes them at every
+ * jar entry point so the smuggling-primitive invariant from TIM-868
+ * is enforced regardless of which path produced the bytes).
+ *
+ * Delegates to the `cookie` package (RFC 6265, dependency-free,
+ * browser-safe) for wire codecs. Adapts at the boundary to preserve
+ * timber's Map-based API and never-throw contract.
+ */
+import type { CookieEntry } from './als-registry.js';
+import type { CookieOptions } from './cookie-context.js';
+/**
+ * Parse a Cookie header string into a Map of name → value pairs.
+ * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
+ *
+ * Values are auto-decoded with `decodeURIComponent` so they round-trip
+ * losslessly with `getCookies().set()` (which auto-encodes). Malformed
+ * `%`-escapes from third-party cookies fall back to the raw byte sequence
+ * — the parser must be total over arbitrary inbound headers, including
+ * non-conforming values from other servers, browser extensions, etc.
+ */
+export declare function parseCookieHeader(header: string): Map<string, string>;
+/**
+ * Decode a single cookie value with `decodeURIComponent`, falling back to
+ * the raw byte sequence if the input contains a malformed `%`-escape.
+ *
+ * Used by both `parseCookieHeader` (incoming Cookie: header) and the
+ * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
+ * Total — never throws.
+ *
+ * cookie's internal decode has identical semantics but is not exported,
+ * so we keep this standalone helper.
+ */
+export declare function safeDecodeCookieValue(raw: string): string;
+/**
+ * Serialize a CookieEntry into a Set-Cookie header value.
+ *
+ * Total — never throws. If the cookie package's serializer rejects
+ * the input (e.g. non-integer maxAge, forbidden chars in name/value),
+ * falls back to a minimal hand-rolled serialization so the response
+ * path is never interrupted by a codec error.
+ */
+export declare function serializeCookieEntry(entry: CookieEntry): string;
+/**
+ * Parse a raw `Set-Cookie` header string into name, value, and options.
+ * Handles all standard attributes: Path, Domain, Max-Age, Expires,
+ * SameSite, Secure, HttpOnly, Partitioned.
+ *
+ * Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether
+ * to merge defaults (e.g. `set()` does, but `setRaw()` should preserve
+ * the original header's intent).
+ */
+export declare function parseSetCookie(header: string): {
+    name: string;
+    value: string;
+    options: CookieOptions;
+} | null;
+//# sourceMappingURL=cookie-parsing.d.ts.map

package/dist/server/cookie-parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-parsing.d.ts","sourceRoot":"","sources":["../../src/server/cookie-parsing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0B/D;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CA8BhE"}

package/dist/server/csrf.d.ts

@@ -21,12 +21,13 @@ export type CsrfResult = {
     status: 403;
 };
 /**
- * Validate the Origin header against the request's Host.
+ * Validate the Origin header against the request's full origin
+ * (scheme + host + port).
  *
  * For mutation methods (POST, PUT, PATCH, DELETE):
  * - If `csrf: false`, skip validation.
  * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * - Otherwise, Origin must match the derived request origin.
  *
  * Safe methods (GET, HEAD, OPTIONS) always pass.
  */

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AASnE;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAuCzE"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAgCnE;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAgDzE"}