@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.187

package/dist/index.js

@@ -1,13 +1,19 @@
 import { a as __esmMin, o as __exportAll, s as __toCommonJS } from "./_chunks/dist-BA3u1z3W.js";
-import { c as isDynamicMetadataExtension, l as isMetadataRouteServePath, r as canonicalize } from "./_chunks/canonicalize-DQHyFClh.js";
-import { h as swallow } from "./_chunks/logger-AWfuX-KJ.js";
-import { i as scanRoutes } from "./_chunks/cli-schema-sync-BTWEKJXo.js";
-import { a as generateRouteMap, c as fileHasDirective, d as getPrerenderExport, i as validateSchemaAgainstRoutes, l as fileHasExport, n as collectInterceptionRewrites, o as fileHasAnyExport, s as fileHasDefaultExport, t as collectLeafRoutes, u as fileHasStarExport } from "./_chunks/walkers-_6zKFlch.js";
-import { a as resolveAppDir, c as createNoopTimer, n as loadTimberConfigFile, o as resolveBuildDir, r as mergeFileConfig, s as resolveClientJavascript, t as createPluginContext } from "./_chunks/plugin-context---kTF5v8.js";
-import { t as fnv1aHash } from "./_chunks/fast-hash-D6hIVt1Y.js";
+import { t as RSC_CONTENT_TYPE } from "./_chunks/rsc-media-type-DRqE_lD_.js";
+import { a as canonicalize, d as isMetadataRouteServePath, u as isDynamicMetadataExtension } from "./_chunks/segment-keys-BawYuNFO.js";
+import { n as collectInterceptionRewrites, r as matchUrlParts, t as scanRoutes } from "./_chunks/scanner-C8b0Gcw3.js";
+import { h as swallow } from "./_chunks/logger-D8xJZXIN.js";
+import { c as writeRouteCodegen, i as getPrerenderExport, l as buildDirToRouteMap, n as formatConventionWarnings, r as lintConventions, s as flushCodegenWrites, t as checkAppDirExists } from "./_chunks/convention-lint-kXsgc_-7.js";
+import { c as resolveClientJavascript, i as mergeFileConfig, l as createNoopTimer, o as resolveAppDir, r as loadTimberConfigFile, s as resolveBuildDir, t as createPluginContext } from "./_chunks/plugin-context-rCinWLiE.js";
+import { r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "./_chunks/walkers-RzN6AFjr.js";
+import { i as withBasePath, n as normalizeBasePath, t as isRelativeBase } from "./_chunks/base-path-DaQrzbez.js";
+import { t as rscPayloadPath } from "./_chunks/rsc-payload-path-B_LBodc2.js";
+import { a as REDIRECTS_FILE, n as detectFsIdentity, o as RESERVED_OUTPUT_PATHS, r as fsKey, t as EXACT_FS_IDENTITY } from "./_chunks/fs-identity-D7vb6GdI.js";
+import { t as EMPTY_BUILD_MANIFEST } from "./_chunks/build-manifest-DWppEdLB.js";
+import { t as fnv1aHash } from "./_chunks/fast-hash-C-tVYrLb.js";
 import { t as formatSize } from "./_chunks/format-CfwjgPz9.js";
 import { createLogger, parseAst } from "vite";
-import { basename, dirname, extname, join, normalize, relative, resolve, win32 } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, win32 } from "node:path";
 import { builtinModules, createRequire } from "node:module";
 import react, { reactCompilerPreset } from "@vitejs/plugin-react";
 import { existsSync, readFileSync, statSync } from "node:fs";
@@ -282,8 +288,8 @@ function classifyStack(stack, projectRoot) {
 *
 * Design doc: 21-dev-server.md §"Error Overlay"
 */
-var noValidate$1 = { validateStream: false };
-var style$1 = (fmt, text) => styleText(fmt, text, noValidate$1);
+var noValidate = { validateStream: false };
+var style = (fmt, text) => styleText(fmt, text, noValidate);
 /**
 * Wrap text in an OSC 8 hyperlink escape sequence.
 *
@@ -305,7 +311,7 @@ function hyperlink(text, url) {
 function fileLink(filePath, line, col) {
 	const display = line ? `${filePath}:${line}${col ? `:${col}` : ""}` : filePath;
 	const base = pathToFileURL(filePath).href;
-	return style$1(["cyan", "underline"], hyperlink(display, line ? `${base}:${line}${col ? `:${col}` : ""}` : base));
+	return style(["cyan", "underline"], hyperlink(display, line ? `${base}:${line}${col ? `:${col}` : ""}` : base));
 }
 var BOX = {
 	topLeft: "╭",
@@ -324,9 +330,9 @@ var BOX = {
 function box(lines, borderFormat, width = 80) {
 	const bar = BOX.horizontal.repeat(width - 2);
 	const output = [];
-	output.push(style$1(borderFormat, `${BOX.topLeft}${bar}${BOX.topRight}`));
-	for (const line of lines) output.push(`${style$1(borderFormat, BOX.vertical)} ${line}`);
-	output.push(style$1(borderFormat, `${BOX.bottomLeft}${bar}${BOX.bottomRight}`));
+	output.push(style(borderFormat, `${BOX.topLeft}${bar}${BOX.topRight}`));
+	for (const line of lines) output.push(`${style(borderFormat, BOX.vertical)} ${line}`);
+	output.push(style(borderFormat, `${BOX.bottomLeft}${bar}${BOX.bottomRight}`));
 	return output.join("\n");
 }
 /**
@@ -347,32 +353,32 @@ function formatTerminalError$1(error, phase, projectRoot) {
 	const appFrames = frames.filter((f) => f.type === "app");
 	const internalCount = frames.filter((f) => f.type !== "app").length;
 	const boxLines = [];
-	boxLines.push(style$1(["red", "bold"], `${PHASE_LABELS$1[phase]} Error`));
+	boxLines.push(style(["red", "bold"], `${PHASE_LABELS$1[phase]} Error`));
 	boxLines.push("");
-	for (const msgLine of error.message.split("\n")) boxLines.push(style$1("red", msgLine));
+	for (const msgLine of error.message.split("\n")) boxLines.push(style("red", msgLine));
 	if (loc) {
 		boxLines.push("");
 		const relPath = loc.file.startsWith(projectRoot) ? loc.file.slice(projectRoot.length + 1) : loc.file;
-		boxLines.push(`${style$1("bold", "→")} ${fileLink(loc.file, loc.line, loc.column)} ${style$1("dim", `(${relPath})`)}`);
+		boxLines.push(`${style("bold", "→")} ${fileLink(loc.file, loc.line, loc.column)} ${style("dim", `(${relPath})`)}`);
 	}
 	sections.push(box(boxLines, "red"));
 	if (componentStack) {
 		sections.push("");
-		sections.push(`  ${style$1("bold", "Component Stack:")}`);
-		for (const csLine of componentStack.trim().split("\n")) sections.push(`  ${style$1("dim", csLine.trim())}`);
+		sections.push(`  ${style("bold", "Component Stack:")}`);
+		for (const csLine of componentStack.trim().split("\n")) sections.push(`  ${style("dim", csLine.trim())}`);
 	}
 	if (appFrames.length > 0) {
 		sections.push("");
-		sections.push(`  ${style$1("bold", "Application Frames:")}`);
+		sections.push(`  ${style("bold", "Application Frames:")}`);
 		for (let i = 0; i < appFrames.length; i++) {
 			const f = appFrames[i];
 			if (f.file && f.line) {
-				const prefix = i === 0 ? style$1("bold", "▸") : " ";
-				sections.push(`  ${prefix} ${fileLink(f.file, f.line, f.col)} ${style$1("dim", extractFnName(f.raw))}`);
+				const prefix = i === 0 ? style("bold", "▸") : " ";
+				sections.push(`  ${prefix} ${fileLink(f.file, f.line, f.col)} ${style("dim", extractFnName(f.raw))}`);
 			} else sections.push(`  ${f.raw}`);
 		}
 	}
-	if (internalCount > 0) sections.push(`  ${style$1("dim", `… ${internalCount} internal frame${internalCount !== 1 ? "s" : ""} hidden`)}`);
+	if (internalCount > 0) sections.push(`  ${style("dim", `… ${internalCount} internal frame${internalCount !== 1 ? "s" : ""} hidden`)}`);
 	sections.push("");
 	return sections.join("\n");
 }
@@ -1374,7 +1380,7 @@ var COMPRESSIBLE_TYPES = /* @__PURE__ */ new Set([
 	"text/plain",
 	"text/xml",
 	"text/javascript",
-	"text/x-component",
+	RSC_CONTENT_TYPE,
 	"application/json",
 	"application/javascript",
 	"application/xml",
@@ -1479,125 +1485,6 @@ function compressWithGzip(body) {
 	return Readable.toWeb(gzip);
 }
 //#endregion
-//#region src/server/tree-match.ts
-/**
-* Match URL path parts against a segment tree.
-*
-* Walks the tree depth-first with backtracking, applying priority
-* ordering globally across group boundaries. Returns the matched
-* segment chain and collected params, or null if no route matches.
-*
-* By default, a match requires a terminal node (one with `page` or
-* `route`) at the leaf. Pass `{ requireTerminal: false }` to match
-* any segment (used by metadata route matching).
-*
-* @param root  The root segment node to start matching from.
-* @param parts URL path parts (e.g. ['blog', 'hello-world']).
-*              Empty array matches the root itself (if terminal).
-*/
-function matchUrlParts(root, parts, options) {
-	const chain = [];
-	const params = {};
-	if (matchNode(root, parts, 0, chain, params, options?.requireTerminal ?? true)) return {
-		chain,
-		params
-	};
-	return null;
-}
-/**
-* Flatten children through group segments.
-*
-* Groups are transparent for URL matching — their non-group descendants
-* are returned with the chain of group nodes leading to them. This lets
-* the caller apply priority ordering (static > dynamic > catch-all >
-* optional-catch-all) across all groups uniformly instead of per-group.
-*/
-function collectEffectiveChildren(node, groupChain = []) {
-	const result = [];
-	for (const child of node.children) if (child.segmentType === "group") {
-		const nested = collectEffectiveChildren(child, [...groupChain, child]);
-		result.push(...nested);
-	} else result.push({
-		child,
-		groupChain
-	});
-	return result;
-}
-/** A node is terminal if it can serve a response (has a page or route handler). */
-function isTerminal(node) {
-	return !!(node.page || node.route);
-}
-/** Combined affix length for specificity ordering. */
-function affixLength(node) {
-	return (node.paramPrefix?.length ?? 0) + (node.paramSuffix?.length ?? 0);
-}
-/**
-* Recursive depth-first matcher with backtracking.
-*
-* Mutates `chain` and `params` in place for performance; backtracks
-* (restores previous state) when a candidate doesn't lead to a match.
-*/
-function matchNode(node, parts, index, chain, params, requireTerminal) {
-	chain.push(node);
-	if (index >= parts.length) {
-		if (!requireTerminal || isTerminal(node)) return true;
-		for (const child of node.children) if (child.segmentType === "group") {
-			if (matchNode(child, parts, index, chain, params, requireTerminal)) return true;
-		}
-		const effective = collectEffectiveChildren(node);
-		for (const { child, groupChain } of effective) if (child.segmentType === "optional-catch-all" && (!requireTerminal || isTerminal(child))) {
-			chain.push(...groupChain, child);
-			return true;
-		}
-		chain.pop();
-		return false;
-	}
-	const part = parts[index];
-	const effective = collectEffectiveChildren(node);
-	for (const { child, groupChain } of effective) if (child.segmentType === "static" && child.segmentName === part) {
-		chain.push(...groupChain);
-		if (matchNode(child, parts, index + 1, chain, params, requireTerminal)) return true;
-		chain.length -= groupChain.length;
-	}
-	const affixed = effective.filter(({ child }) => child.segmentType === "dynamic" && child.paramName && (child.paramPrefix || child.paramSuffix));
-	affixed.sort((a, b) => affixLength(b.child) - affixLength(a.child));
-	for (const { child, groupChain } of affixed) {
-		const prefix = child.paramPrefix ?? "";
-		const suffix = child.paramSuffix ?? "";
-		if (part.length > prefix.length + suffix.length && (!prefix || part.startsWith(prefix)) && (!suffix || part.endsWith(suffix))) {
-			const value = part.slice(prefix.length, part.length - (suffix.length || 0));
-			chain.push(...groupChain);
-			const prev = params[child.paramName];
-			params[child.paramName] = value;
-			if (matchNode(child, parts, index + 1, chain, params, requireTerminal)) return true;
-			chain.length -= groupChain.length;
-			if (prev !== void 0) params[child.paramName] = prev;
-			else delete params[child.paramName];
-		}
-	}
-	for (const { child, groupChain } of effective) if (child.segmentType === "dynamic" && child.paramName && !child.paramPrefix && !child.paramSuffix) {
-		chain.push(...groupChain);
-		const prev = params[child.paramName];
-		params[child.paramName] = part;
-		if (matchNode(child, parts, index + 1, chain, params, requireTerminal)) return true;
-		chain.length -= groupChain.length;
-		if (prev !== void 0) params[child.paramName] = prev;
-		else delete params[child.paramName];
-	}
-	for (const { child, groupChain } of effective) if (child.segmentType === "catch-all" && child.paramName && (!requireTerminal || isTerminal(child))) {
-		chain.push(...groupChain, child);
-		params[child.paramName] = parts.slice(index);
-		return true;
-	}
-	for (const { child, groupChain } of effective) if (child.segmentType === "optional-catch-all" && child.paramName && (!requireTerminal || isTerminal(child))) {
-		chain.push(...groupChain, child);
-		params[child.paramName] = parts.slice(index);
-		return true;
-	}
-	chain.pop();
-	return false;
-}
-//#endregion
 //#region src/plugins/dev-server.ts
 var RSC_ENTRY_ID = "virtual:timber-rsc-entry";
 /**
@@ -2014,6 +1901,7 @@ function generateConfigModule(ctx) {
 		csrf: ctx.config.csrf ?? true,
 		allowedOrigins: ctx.config.allowedOrigins,
 		clientJavascript: ctx.clientJavascript,
+		base: ctx.base,
 		dev: ctx.dev ?? false,
 		slowPhaseMs: ctx.config.dev?.slowPhaseMs ?? 200,
 		slowRequestMs: ctx.config.slowRequestMs ?? 3e3,
@@ -2318,69 +2206,10 @@ function timberMdx(ctx) {
 	};
 }
 //#endregion
-//#region src/routing/segment-codegen.ts
-/**
-* $segment type generation and directory-to-route mapping.
-*
-* Generates per-route $segment.d.ts files in .timber/types/ that mirror
-* the app/ directory structure. TypeScript's rootDirs feature makes these
-* importable as './$segment' from route files.
-*
-* Design doc: design/41-global-params.md §The $segment Module
-*/
-/**
-* Build a map of absolute filesystem directory → segment info.
-* Used by resolveId to map a $segment import's importer to the correct route,
-* and by writeSegmentTypes to generate per-route $segment.d.ts files.
-*
-* Walks every segment (not just leaves) so layouts and middleware
-* at any depth can import $segment.
-*/
-function buildDirToRouteMap(tree, appDir) {
-	const map = /* @__PURE__ */ new Map();
-	function walk(node, fsPath, treePath) {
-		map.set(fsPath, {
-			route: node.urlPath || "/",
-			segmentPath: treePath || "/"
-		});
-		for (const child of node.children) walk(child, join(fsPath, child.segmentName), `${treePath}/${child.segmentName}`);
-		for (const [slotName, slotNode] of Object.entries(node.slots)) walk(slotNode, join(fsPath, `@${slotName}`), `${treePath}/@${slotName}`);
-	}
-	walk(tree.root, appDir, "");
-	return map;
-}
-/**
-* Generate the full $segment.d.ts content for a segment.
-*/
-function generateSegmentDts(info) {
-	return [
-		`export const ROUTE: '${info.route}';`,
-		`export const SEGMENT_PATH: '${info.segmentPath}';`,
-		""
-	].join("\n");
-}
-/**
-* Generate per-route $segment.d.ts files in .timber/types/ mirroring
-* the app/ directory structure. These files are importable via TypeScript's
-* rootDirs feature.
-*/
-async function writeSegmentTypes(routeTree, appDir, root) {
-	const typesBase = join(root, ".timber", "types", appDir.slice(root.length + 1));
-	const map = buildDirToRouteMap(routeTree, appDir);
-	const writes = [];
-	for (const [fsDir, info] of map) {
-		const segmentDir = join(typesBase, fsDir.slice(appDir.length));
-		const segmentFile = join(segmentDir, "$segment.d.ts");
-		const content = generateSegmentDts(info);
-		writes.push(mkdir(segmentDir, { recursive: true }).then(() => writeFile(segmentFile, content, "utf-8")));
-	}
-	await Promise.all(writes);
-}
-//#endregion
 //#region src/routing/manifest-codegen.ts
 /**
 * Route manifest codegen — generates virtual module source for the route
-* manifest, search-params registry, and global schema.
+* manifest and the global schema loader.
 *
 * Extracted from plugins/routing.ts to keep it under the 500-line budget.
 * See design/18-build-system.md §"Virtual Modules".
@@ -2395,8 +2224,7 @@ var SINGLE_FILE_KEYS = [
 	"route",
 	"error",
 	"default",
-	"denied",
-	"params"
+	"denied"
 ];
 var RECORD_FILE_KEYS = [
 	"statusFiles",
@@ -2477,10 +2305,7 @@ function generateManifestModule(tree, viteRoot) {
 	let globalErrorLine = "";
 	if (tree.globalError) globalErrorLine = `  globalError: { load: ${addImport(tree.globalError)}, filePath: ${JSON.stringify(tree.globalError.filePath)} },`;
 	const rewrites = collectInterceptionRewrites(tree.root);
-	const rewritesLine = rewrites.length > 0 ? `  interceptionRewrites: ${JSON.stringify(rewrites.map((r) => ({
-		interceptedPattern: r.interceptedPattern,
-		interceptingPrefix: r.interceptingPrefix
-	})))},` : "";
+	const rewritesLine = rewrites.length > 0 ? `  interceptionRewrites: ${JSON.stringify(rewrites)},` : "";
 	return [
 		"// Auto-generated route manifest — do not edit.",
 		"// Generated by timber-routing plugin.",
@@ -2499,50 +2324,6 @@ function generateManifestModule(tree, viteRoot) {
 	].filter((line) => line !== void 0 && line !== "").join("\n");
 }
 /**
-* Walk the route tree and collect every page that exports a
-* `searchParams` definition, then emit a module that statically imports
-* each export and registers it into the shared search-params registry.
-*/
-function generateSearchParamsRegistryModule(tree) {
-	const entries = [];
-	function walk(node) {
-		if (node.page) {
-			if (node.params && fileHasSearchParamsExport(node.params.filePath)) entries.push({
-				urlPath: node.urlPath,
-				filePath: node.params.filePath
-			});
-			else if (fileHasSearchParamsExport(node.page.filePath)) entries.push({
-				urlPath: node.urlPath,
-				filePath: node.page.filePath
-			});
-		}
-		for (const child of node.children) walk(child);
-		for (const slot of Object.values(node.slots)) walk(slot);
-	}
-	walk(tree.root);
-	entries.sort((a, b) => a.urlPath.localeCompare(b.urlPath));
-	const lines = [];
-	lines.push("// Auto-generated search-params registry — do not edit.");
-	lines.push("// Generated by timber-routing plugin (TIM-830).");
-	lines.push("");
-	lines.push("import { registerSearchParams } from '@timber-js/app/search-params';");
-	lines.push("");
-	entries.forEach((entry, i) => {
-		lines.push(`import { searchParams as r${i} } from ${JSON.stringify(entry.filePath)};`);
-	});
-	lines.push("");
-	entries.forEach((entry, i) => {
-		lines.push(`registerSearchParams(${JSON.stringify(entry.urlPath)}, r${i});`);
-	});
-	lines.push("");
-	lines.push("export {};");
-	lines.push("");
-	return lines.join("\n");
-}
-function fileHasSearchParamsExport(filePath) {
-	return fileHasExport(filePath, "searchParams");
-}
-/**
 * Generate the virtual:timber-schema module.
 *
 * When app/schema.{ts,tsx,js,jsx} exists, generates a module that
@@ -2574,315 +2355,32 @@ function generateSchemaModule(appDir) {
 	].join("\n");
 }
 //#endregion
-//#region src/routing/convention-lint.ts
-/**
-* Convention linter — validates common misconfigurations in the route tree.
-*
-* Runs at scan time (build and dev startup). Each check produces a warning
-* with the file path, what's wrong, and what to do about it.
-*
-* These are warnings, not errors — they don't block the build. The goal is
-* to catch issues that would otherwise produce cryptic runtime behavior
-* (silent 404s, empty pages, confusing React errors).
-*
-* Design doc: 07-routing.md, 10-error-handling.md
-*/
-/**
-* Run all convention lint checks on a route tree.
-*
-* Returns an array of warnings. Empty array means everything looks good.
-*/
-function lintConventions(tree, appDir) {
-	const warnings = [];
-	checkEmptyApp(tree.root, appDir, warnings);
-	checkRouteExports(tree.root, warnings);
-	checkRootLayout(tree.root, warnings);
-	checkDefaultExports(tree.root, warnings);
-	checkErrorDirectives(tree.root, warnings);
-	if (tree.globalError && isScriptExtension(tree.globalError.extension)) checkFileUseClientDirective(tree.globalError.filePath, "global-error", warnings);
-	return warnings;
-}
-/**
-* Warn when the app/ directory has no routable files at all.
-*
-* This catches the "I created app/ but didn't add any pages" case where
-* every request silently 404s with no guidance.
-*/
-function checkEmptyApp(root, appDir, warnings) {
-	if (hasAnyRoutable(root)) return;
-	warnings.push({
-		id: "EMPTY_APP",
-		summary: "No pages or route handlers found in app/",
-		details: `  Directory: ${appDir}\n\n  Your app/ directory has no page.tsx or route.ts files.
-  Every request will return 404.
-
-  To fix: Create app/page.tsx with a default export:
-
-    export default function Home() {
-      return <h1>Hello</h1>;
-    }
-`,
-		level: "warn"
-	});
-}
-/**
-* Check if a segment tree has any routable files (page or route) anywhere.
-*/
-function hasAnyRoutable(node) {
-	if (node.page || node.route) return true;
-	for (const child of node.children) if (hasAnyRoutable(child)) return true;
-	for (const slot of Object.values(node.slots)) if (hasAnyRoutable(slot)) return true;
-	return false;
-}
-/**
-* Check if a segment tree has any page files (not just route handlers).
-* Used by checkRootLayout to avoid false positives for API-only apps (TIM-794).
-* API-only apps (just route.ts handlers) don't need a root layout.
-*/
-function hasAnyPage(node) {
-	if (node.page) return true;
-	for (const child of node.children) if (hasAnyPage(child)) return true;
-	for (const slot of Object.values(node.slots)) if (hasAnyPage(slot)) return true;
-	return false;
-}
-/** HTTP methods that route.ts can export. */
-var HTTP_METHODS = [
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE",
-	"HEAD",
-	"OPTIONS"
-];
-/**
-* Warn when a route.ts file doesn't appear to export any recognized HTTP methods.
-*
-* Uses AST-based detection via parseAst for precise matching.
-* Falls back silently when the file can't be parsed (syntax errors produce
-* no spurious warning — the TS compiler will catch those).
-*/
-function checkRouteExports(node, warnings) {
-	if (node.route) {
-		const filePath = node.route.filePath;
-		try {
-			if (fileHasAnyExport(filePath, HTTP_METHODS).size === 0 && !fileHasStarExport(filePath)) {
-				const hint = fileHasDefaultExport(filePath) ? "  It looks like you have a default export. route.ts uses named exports\n  for HTTP methods (GET, POST, etc.), not a default export.\n" : "";
-				warnings.push({
-					id: "ROUTE_NO_METHODS",
-					summary: `route.ts has no HTTP method exports: ${filePath}`,
-					details: `  File: ${filePath}\n\n  route.ts files must export named HTTP method handlers.
-  Without them, the route matches but returns 405 Method Not Allowed.
-
-` + hint + "  Example:\n\n    export function GET(ctx: RouteContext) {\n      return Response.json({ hello: 'world' });\n    }\n",
-					level: "warn"
-				});
-			}
-		} catch (err) {
-			swallow(err, `convention-lint: unreadable route.ts ${filePath}`);
-		}
-	}
-	for (const child of node.children) checkRouteExports(child, warnings);
-	for (const slot of Object.values(node.slots)) checkRouteExports(slot, warnings);
-}
-/**
-* Warn when the root segment has no layout.tsx.
-*
-* Without a root layout, there's no HTML shell (<html>, <body>).
-* The page will render but may have hydration issues or no proper document structure.
-*/
-function checkRootLayout(root, warnings) {
-	if (root.layout) return;
-	if (!hasAnyPage(root)) return;
-	warnings.push({
-		id: "NO_ROOT_LAYOUT",
-		summary: "No root layout.tsx found",
-		details: "  Your app has pages but no root layout.\n  Without app/layout.tsx, pages have no <html> or <body> wrapper.\n\n  To fix: Create app/layout.tsx:\n\n    export default function RootLayout({ children }: { children: React.ReactNode }) {\n      return (\n        <html lang=\"en\">\n          <body>{children}</body>\n        </html>\n      );\n    }\n",
-		level: "warn"
-	});
-}
-/**
-* Warn when page.tsx or layout.tsx files don't have a default export.
-*
-* Without a default export:
-* - page.tsx: the page renders nothing (empty content)
-* - layout.tsx: the layout module loads but has no component to render
-*
-* Uses AST-based detection via parseAst for precise matching. Falls back
-* silently when the file can't be parsed (no spurious warning on syntax errors).
-*/
-function checkDefaultExports(node, warnings) {
-	if (node.page && isScriptExtension(node.page.extension)) checkFileDefaultExport(node.page.filePath, "page", warnings);
-	if (node.layout && isScriptExtension(node.layout.extension)) checkFileDefaultExport(node.layout.filePath, "layout", warnings);
-	for (const child of node.children) checkDefaultExports(child, warnings);
-	for (const slot of Object.values(node.slots)) checkDefaultExports(slot, warnings);
-}
-function isScriptExtension(ext) {
-	return ext === "tsx" || ext === "ts" || ext === "jsx" || ext === "js";
-}
-function checkFileDefaultExport(filePath, fileType, warnings) {
-	try {
-		if (!fileHasDefaultExport(filePath)) warnings.push({
-			id: `NO_DEFAULT_EXPORT:${filePath}`,
-			summary: `${fileType}.tsx has no default export: ${filePath}`,
-			details: `  File: ${filePath}\n\n  ${fileType}.tsx files must export a default React component.\n  Without a default export, the ${fileType === "page" ? "page renders nothing" : "layout has no component to wrap children"}.\n\n  To fix: Add a default export:\n\n    export default function My${fileType === "page" ? "Page" : "Layout"}(${fileType === "layout" ? "{ children }" : ""}) {\n      return ${fileType === "layout" ? "<div>{children}</div>" : "<h1>Hello</h1>"};\n    }\n`,
-			level: "warn"
-		});
-	} catch (err) {
-		swallow(err, `convention-lint: unreadable ${fileType} file ${filePath}`);
-	}
-}
-/**
-* Warn when error.tsx or global-error.tsx is missing 'use client'.
-*
-* React's error boundary API requires client components. Without the directive,
-* the error boundary silently fails — the component renders as a server component
-* with no error catching. Users discover this only via cryptic runtime errors.
-*/
-function checkErrorDirectives(node, warnings) {
-	if (node.error && isScriptExtension(node.error.extension)) checkFileUseClientDirective(node.error.filePath, "error", warnings);
-	for (const child of node.children) checkErrorDirectives(child, warnings);
-	for (const slot of Object.values(node.slots)) checkErrorDirectives(slot, warnings);
-}
-function checkFileUseClientDirective(filePath, fileType, warnings) {
-	try {
-		if (!fileHasDirective(filePath, "use client")) warnings.push({
-			id: `ERROR_NO_USE_CLIENT:${filePath}`,
-			summary: `${fileType}.tsx is missing 'use client': ${filePath}`,
-			details: `  File: ${filePath}\n\n  ${fileType}.tsx must start with 'use client' because React error\n  boundaries require client components. Without it, the error boundary
-  silently fails and errors are uncaught.
-
-  To fix: Add 'use client' as the first line of the file:
-
-    'use client';
-
-    export default function ${fileType === "global-error" ? "GlobalError" : "ErrorBoundary"}({ error, reset }) {\n      return <div><h2>Something went wrong</h2><button onClick={reset}>Try again</button></div>;
-    }
-`,
-			level: "warn"
-		});
-	} catch (err) {
-		swallow(err, `convention-lint: unreadable ${fileType} file ${filePath}`);
-	}
-}
-/**
-* Check if the app/ directory exists. Called before scanning.
-* Returns a warning if missing, or null if the directory exists.
-*/
-function checkAppDirExists(appDir) {
-	if (existsSync(appDir)) return null;
-	return {
-		id: "NO_APP_DIR",
-		summary: "No app/ directory found",
-		details: `  Expected: ${appDir}\n\n  timber.js requires an app/ directory for file-system routing.
-  Every request will return 404 until you create it.
-
-  To fix: Create the app/ directory with a page:
-
-    mkdir -p app
-    # Create app/layout.tsx and app/page.tsx
-`,
-		level: "error"
-	};
-}
-var noValidate = { validateStream: false };
-var style = (fmt, text) => styleText(fmt, text, noValidate);
-/**
-* Format warnings for terminal output.
-*
-* Groups by severity, uses colors, and includes fix suggestions.
-*/
-function formatConventionWarnings(warnings) {
-	if (warnings.length === 0) return "";
-	const errors = warnings.filter((w) => w.level === "error");
-	const warns = warnings.filter((w) => w.level === "warn");
-	const lines = [];
-	if (errors.length > 0) {
-		lines.push(`${style(["red", "bold"], "[timber]")} ${style("red", `${errors.length} configuration error${errors.length !== 1 ? "s" : ""}:`)}`);
-		for (const e of errors) {
-			lines.push("");
-			lines.push(`  ${style("red", "✗")} ${e.summary}`);
-			lines.push(style("dim", e.details));
-		}
-	}
-	if (warns.length > 0) {
-		if (errors.length > 0) lines.push("");
-		lines.push(`${style(["yellow", "bold"], "[timber]")} ${style("yellow", `${warns.length} configuration warning${warns.length !== 1 ? "s" : ""}:`)}`);
-		for (const w of warns) {
-			lines.push("");
-			lines.push(`  ${style("yellow", "⚠")} ${w.summary}`);
-			lines.push(style("dim", w.details));
-		}
-	}
-	return lines.join("\n");
-}
-//#endregion
 //#region src/plugins/routing.ts
 var VIRTUAL_MODULE_ID$1 = "virtual:timber-route-manifest";
 var RESOLVED_VIRTUAL_ID$1 = `\0${VIRTUAL_MODULE_ID$1}`;
-var SEARCH_PARAMS_REGISTRY_ID = "virtual:timber-search-params-registry";
-var RESOLVED_SEARCH_PARAMS_REGISTRY_ID = `\0${SEARCH_PARAMS_REGISTRY_ID}`;
 var SCHEMA_ID = "virtual:timber-schema";
 var RESOLVED_SCHEMA_ID = `\0${SCHEMA_ID}`;
 var SEGMENT_PREFIX = "\0$segment:";
 /**
 * File convention names we track for changes that require manifest regeneration.
 */
-var ROUTE_FILE_PATTERNS = /\/(page|layout|middleware|access|route|error|global-error|default|denied|params|schema|\d{3}|[45]xx|sitemap|robots|manifest|favicon|icon|opengraph-image|apple-icon)\./;
+var ROUTE_FILE_PATTERNS = /\/(page|layout|middleware|access|route|error|global-error|default|denied|schema|\d{3}|[45]xx|sitemap|robots|manifest|favicon|icon|opengraph-image|apple-icon)\./;
 /**
 * Create the timber-routing Vite plugin.
 *
 * Hooks: resolveId, load, buildStart, configureServer
 */
-/** Absolute path to the generated route map declaration file. */
-var CODEGEN_OUTPUT = ".timber/timber-routes.d.ts";
-/**
-* Content of the timber-env.d.ts file written to the project root.
-*
-* Uses a triple-slash reference so TypeScript auto-discovers the generated
-* route map without the user needing to edit tsconfig.json — same pattern
-* as Next.js's next-env.d.ts.
-*
-* Also references `vite/client` so side-effect imports like
-* `import './globals.css'` type-check without ts(2882), and so
-* `import.meta.env`, `import.meta.hot`, `import.meta.glob`, asset
-* imports (`*.png`, `*.svg`, …), CSS modules, and `?url`/`?raw`/
-* `?inline` query variants all resolve without the user editing
-* tsconfig.json themselves. Next.js's next-env.d.ts plays the same
-* role via `next/types/global`.
-*
-* `vite` is a peer dep of `@timber-js/app`, so the reference always
-* resolves in a correctly-installed project.
-*/
-var TIMBER_ENV_DTS = [
-	"// This file is auto-generated by timber.js. Do not edit.",
-	"// It ensures TypeScript picks up the generated route types and",
-	"// Vite-provided ambient types (CSS, assets, import.meta.env, HMR).",
-	"/* eslint-disable @typescript-eslint/triple-slash-reference */",
-	"/// <reference path=\".timber/timber-routes.d.ts\" />",
-	"/// <reference types=\"vite/client\" />",
-	""
-].join("\n");
 /**
 * Write the generated route map and the timber-env.d.ts reference file.
 *
-* Fire-and-forget — never awaited to avoid blocking the hot path.
-* Errors are swallowed; a missing .d.ts is a developer UX issue, not a runtime failure.
+* Not awaited, to avoid blocking the hot path — use `flushCodegenWrites()` to
+* wait for the writes to land. Failures are logged, not thrown: a missing .d.ts
+* is a developer UX issue in dev/build, not a runtime failure. (`timber check`
+* calls `writeRouteCodegen` directly and does treat a failure as fatal.)
 */
 function writeCodegen(ctx) {
 	if (!ctx.routeTree) return;
-	const timberDir = join(ctx.root, ".timber");
-	const content = generateRouteMap(ctx.routeTree, {
-		appDir: ctx.appDir,
-		outputDir: timberDir
-	});
-	const routesPath = join(ctx.root, CODEGEN_OUTPUT);
-	const envPath = join(ctx.root, "timber-env.d.ts");
-	mkdir(timberDir, { recursive: true }).then(() => Promise.all([
-		writeFile(routesPath, content, "utf-8"),
-		writeFile(envPath, TIMBER_ENV_DTS, "utf-8"),
-		writeSegmentTypes(ctx.routeTree, ctx.appDir, ctx.root)
-	])).catch((err) => {
+	writeRouteCodegen(ctx.routeTree, ctx.appDir, ctx.root).catch((err) => {
 		console.warn("[timber] Failed to write codegen output:", err);
 	});
 }
@@ -2906,12 +2404,16 @@ function timberRouting(ctx) {
 			return;
 		}
 		ctx.timer.start("route-scan");
-		ctx.routeTree = scanRoutes(ctx.appDir, { pageExtensions: ctx.config.pageExtensions });
+		const tree = scanRoutes(ctx.appDir, { pageExtensions: ctx.config.pageExtensions });
 		ctx.timer.end("route-scan");
+		const conventionWarnings = lintConventions(tree, ctx.appDir);
+		const fatal = conventionWarnings.filter((w) => w.level === "error");
+		if (fatal.length > 0) throw new Error(formatConventionWarnings(fatal, { color: false }));
+		ctx.routeTree = tree;
 		dirToRoute = buildDirToRouteMap(ctx.routeTree, ctx.appDir);
 		writeCodegen(ctx);
 		warnSchemaValidation(ctx);
-		const newConventionWarnings = lintConventions(ctx.routeTree, ctx.appDir).filter((w) => !warnedFiles.has(w.id));
+		const newConventionWarnings = conventionWarnings.filter((w) => !warnedFiles.has(w.id));
 		if (newConventionWarnings.length > 0) {
 			for (const w of newConventionWarnings) warnedFiles.add(w.id);
 			const formatted = formatConventionWarnings(newConventionWarnings);
@@ -2932,7 +2434,6 @@ function timberRouting(ctx) {
 			const cleanId = id.startsWith("\0") ? id.slice(1) : id;
 			if (cleanId === VIRTUAL_MODULE_ID$1) return RESOLVED_VIRTUAL_ID$1;
 			if (cleanId.endsWith(`/${VIRTUAL_MODULE_ID$1}`)) return RESOLVED_VIRTUAL_ID$1;
-			if (cleanId === SEARCH_PARAMS_REGISTRY_ID || cleanId.endsWith(`/${SEARCH_PARAMS_REGISTRY_ID}`)) return RESOLVED_SEARCH_PARAMS_REGISTRY_ID;
 			if (cleanId === SCHEMA_ID || cleanId.endsWith(`/${SCHEMA_ID}`)) return RESOLVED_SCHEMA_ID;
 			if (importer && (cleanId === "./$segment" || cleanId === "./$segment.js" || cleanId === "./$segment.ts")) {
 				const cleanImporter = importer.startsWith("\0") ? importer.slice(1) : importer;
@@ -2953,10 +2454,6 @@ function timberRouting(ctx) {
 				if (!ctx.routeTree) rescan();
 				return generateManifestModule(ctx.routeTree, ctx.root);
 			}
-			if (id === RESOLVED_SEARCH_PARAMS_REGISTRY_ID) {
-				if (!ctx.routeTree) rescan();
-				return generateSearchParamsRegistryModule(ctx.routeTree);
-			}
 			if (id === RESOLVED_SCHEMA_ID) return generateSchemaModule(ctx.appDir);
 			if (id.startsWith(SEGMENT_PREFIX)) {
 				const info = JSON.parse(id.slice(10));
@@ -2979,6 +2476,18 @@ function timberRouting(ctx) {
 			rescan();
 		},
 		/**
+		* Wait for the codegen writes started by `buildStart` before the build
+		* reports done.
+		*
+		* `writeCodegen` runs unawaited so route scanning never blocks on disk.
+		* Without this the build can finish — and the CLI can exit — while the
+		* generated `.d.ts` files are still being written, leaving a project root
+		* with no route types after an apparently successful build.
+		*/
+		closeBundle() {
+			return flushCodegenWrites();
+		},
+		/**
 		* Set up file watcher in dev mode.
 		*
 		* Watches app/ for file additions/deletions/renames that affect
@@ -2991,13 +2500,59 @@ function timberRouting(ctx) {
 			/** Snapshot of the last generated manifest, used to detect structural changes. */
 			let lastManifest = ctx.routeTree ? generateManifestModule(ctx.routeTree, ctx.root) : "";
 			/**
+			* Rescan without letting a rejected route tree kill the dev server.
+			*
+			* `rescan()` throws on hard misconfigurations — duplicate conventions,
+			* route collisions, a status file that is not a client component. Those
+			* throws are correct at startup and in `vite build`, but here they run
+			* inside a chokidar listener, where an exception is an unhandled
+			* rejection that takes the process down mid-edit. Report and keep the
+			* last good tree so the server stays up and the fix is one save away.
+			*
+			* Returns false when the scan failed, so callers skip the manifest
+			* regeneration that would otherwise publish a stale tree as fresh.
+			*/
+			/**
+			* True while the last rescan is still failing.
+			*
+			* Recovery has to force a reload even when the manifest is byte-identical.
+			* Adding a missing `'use client'` back to a status file changes no route
+			* metadata, so the content-change path would send nothing and leave the
+			* error overlay on screen over a page that is now fine.
+			*/
+			let scanFailed = false;
+			const rescanSafely = () => {
+				try {
+					rescan();
+					if (scanFailed) {
+						scanFailed = false;
+						lastManifest = ctx.routeTree ? generateManifestModule(ctx.routeTree, ctx.root) : "";
+						invalidateManifest(devServer);
+					}
+					return true;
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					process.stderr.write(`[timber] Route scan failed — keeping previous routes.\n${message}\n`);
+					scanFailed = true;
+					devServer.hot.send({
+						type: "error",
+						err: {
+							message,
+							stack: "",
+							plugin: "timber-routing"
+						}
+					});
+					return false;
+				}
+			};
+			/**
 			* Handle a route-significant file being added or removed.
 			* Always triggers a full-reload since the route tree structure changed.
 			*/
 			const handleStructuralChange = (filePath) => {
 				if (!filePath.startsWith(ctx.appDir)) return;
 				if (!ROUTE_FILE_PATTERNS.test(filePath)) return;
-				rescan();
+				if (!rescanSafely()) return;
 				lastManifest = ctx.routeTree ? generateManifestModule(ctx.routeTree, ctx.root) : "";
 				invalidateManifest(devServer);
 			};
@@ -3012,7 +2567,7 @@ function timberRouting(ctx) {
 			const handleContentChange = (filePath) => {
 				if (!filePath.startsWith(ctx.appDir)) return;
 				if (!ROUTE_FILE_PATTERNS.test(filePath)) return;
-				rescan();
+				if (!rescanSafely()) return;
 				const newManifest = ctx.routeTree ? generateManifestModule(ctx.routeTree, ctx.root) : "";
 				if (newManifest !== lastManifest) {
 					lastManifest = newManifest;
@@ -3062,11 +2617,7 @@ function invalidateManifest(server) {
 	for (const envName of Object.keys(server.environments)) {
 		const env = server.environments[envName];
 		if (!env?.moduleGraph) continue;
-		for (const virtualId of [
-			RESOLVED_VIRTUAL_ID$1,
-			RESOLVED_SEARCH_PARAMS_REGISTRY_ID,
-			RESOLVED_SCHEMA_ID
-		]) {
+		for (const virtualId of [RESOLVED_VIRTUAL_ID$1, RESOLVED_SCHEMA_ID]) {
 			const mod = env.moduleGraph.getModuleById(virtualId);
 			if (mod) env.moduleGraph.invalidateModule(mod);
 		}
@@ -3104,7 +2655,6 @@ var SUBPATH_SRC_MAP = {
 	"cookies": "cookies/index.ts",
 	"params": "params/index.ts",
 	"search-params": "search-params/index.ts",
-	"segment-params": "segment-params/index.ts",
 	"cache/stores/memory": "cache/stores/memory.ts",
 	"cache/stores/redis": "cache/stores/redis.ts",
 	"cache/stores/cloudflare-kv": "cache/stores/cloudflare-kv.ts",
@@ -6194,16 +5744,19 @@ function writeFontManifest(pipeline, buildManifest, base = "/") {
 */
 function timberFonts(ctx) {
 	const pipeline = new FontPipeline({ hashOnRegister: !ctx.dev });
-	let resolvedBase = "/";
 	return {
 		name: "timber-fonts",
 		/**
-		* Capture Vite's resolved `base` so every font URL the pipeline emits
-		* (@font-face src, manifest hrefs, dev middleware matching) carries
-		* the prefix. Emitted file locations are unaffected — only URLs.
+		* Push Vite's resolved `base` into the pipeline so every font URL it
+		* emits (@font-face src, manifest hrefs, dev middleware matching)
+		* carries the prefix. Emitted file locations are unaffected — only URLs.
+		*
+		* `config.base` is read here rather than `ctx.base`: this plugin is
+		* `enforce: 'pre'`, so its configResolved runs before timber-root-sync
+		* populates `ctx.base`. Every *later* hook reads `ctx.base` — the single
+		* copy (TIM-1261).
 		*/
 		configResolved(config) {
-			resolvedBase = config.base;
 			pipeline.setBase(config.base);
 			const originalWarnOnce = config.logger.warnOnce.bind(config.logger);
 			config.logger.warnOnce = (msg, options) => {
@@ -6292,7 +5845,7 @@ function timberFonts(ctx) {
 						} else {
 							const familyCached = groupCachedFontsByFamily(await downloadAndCacheFonts([font], ctx.root)).get(font.family.toLowerCase()) ?? [];
 							pipeline.attachCachedFiles(font.id, familyCached);
-							pipeline.attachFaces(font.id, generateProductionFontFaces(familyCached, font.display, fontUrlPrefix(resolvedBase)));
+							pipeline.attachFaces(font.id, generateProductionFontFaces(familyCached, font.display, fontUrlPrefix(ctx.base)));
 						}
 					} catch (e) {
 						if (!ctx.dev) throw e;
@@ -6310,7 +5863,7 @@ function timberFonts(ctx) {
 		* this middleware.
 		*/
 		configureServer(server) {
-			installFontDevMiddleware(server, pipeline, resolvedBase);
+			installFontDevMiddleware(server, pipeline, ctx.base);
 		},
 		/**
 		* No-op. Font downloading and face attachment happen lazily in `load()`
@@ -6380,7 +5933,7 @@ function timberFonts(ctx) {
 		generateBundle() {
 			emitFontAssets(pipeline, (asset) => this.emitFile(asset), (msg) => this.warn(msg));
 			if (!ctx.buildManifest) return;
-			writeFontManifest(pipeline, ctx.buildManifest, resolvedBase);
+			writeFontManifest(pipeline, ctx.buildManifest, ctx.base);
 		}
 	};
 }
@@ -6410,6 +5963,7 @@ function timberAdapterBuild(ctx) {
 				if (ctx.clientJavascript.disabled) await stripJsFromRscAssetsManifests(buildDir);
 				const adapterConfig = {
 					root: ctx.root,
+					base: normalizeBasePath(ctx.base),
 					output: ctx.config.output ?? "server",
 					clientJavascriptDisabled: ctx.clientJavascript.disabled,
 					manifestInit,
@@ -6654,10 +6208,22 @@ function detectDynamicApis(code, fileId) {
 * Generate a `_redirects` file from collected redirect entries.
 * Uses the Cloudflare Pages / Netlify format: `/from /to statusCode`
 *
+* Both sides are base-prefixed (TIM-1274). `from` is matched by the host
+* against the request path and `to` is served to the browser as a `Location`,
+* so both are deployed-URL space while `StaticRedirectEntry` carries route
+* space — under `base: '/repo/'`, a rule `/old /new 301` would match nothing
+* and, if it did, would send the browser off the deployment.
+*
+* An off-origin `to` is left alone: `redirectExternal()` produces an absolute
+* URL, and a protocol-relative one addresses another host too. Neither is a
+* path on this deployment, so neither takes the prefix.
+*
+* @param base Normalized deployment base (see `shared/base-path.ts`).
 * @internal Exported for testing.
 */
-function generateRedirectsFile(redirects) {
-	return redirects.map((r) => `${r.from} ${r.to} ${r.status}`).join("\n") + "\n";
+function generateRedirectsFile(redirects, base) {
+	const target = (to) => to.startsWith("/") && !to.startsWith("//") ? withBasePath(base, to) : to;
+	return redirects.map((r) => `${withBasePath(base, r.from)} ${target(r.to)} ${r.status}`).join("\n") + "\n";
 }
 /** Write a file atomically: temp sibling + rename. */
 async function writeFileAtomic$1(path, data) {
@@ -6669,18 +6235,203 @@ async function writeFileAtomic$1(path, data) {
 * Determine the output file path for a static page entry.
 *
 * Pages: /about → about/index.html, / → index.html
-* RSC:   /about → _rsc/about.rsc, / → _rsc/index.rsc
+* RSC:   /about → _rsc/about/index.rsc, / → _rsc/index.rsc
 * API:   /feed.xml → feed.xml, /api/data → api/data
+*
+* The RSC shape mirrors the HTML shape for the reason the HTML shape has it:
+* a route gets a directory and the artifact is the `index` inside it, so the
+* mapping is injective. See `shared/rsc-payload-path.ts` (TIM-1266).
 */
 function staticOutputPath(entry) {
 	const urlPath = entry.urlPath === "/" ? "" : entry.urlPath;
-	if (entry.kind === "rsc") return `_rsc${urlPath || "/index"}.rsc`;
+	if (entry.kind === "rsc") return rscPayloadPath(entry.urlPath).slice(1);
 	if (entry.kind === "api") return urlPath.startsWith("/") ? urlPath.slice(1) : urlPath || "index";
 	if (!urlPath) return "index.html";
 	if (urlPath === "/_timber_not_found") return "404.html";
 	return `${urlPath.startsWith("/") ? urlPath.slice(1) : urlPath}/index.html`;
 }
 /**
+* Records which entry claimed each output path and reports second claims.
+*
+* Two entries landing on one path is not a rendering failure — both render
+* fine — so nothing downstream notices. The file is written twice, the second
+* write wins, and the deployment serves one route's bytes at another route's
+* URL with the same content type and the same shape (TIM-1266).
+*
+* The naming rules are injective by construction (a route path is a directory
+* and the artifact is the `index` inside it), so a collision here means either
+* two entries were enumerated for one URL or a route reached a path the
+* framework reserves for itself (`404.html`). Both are build errors: there is
+* no correct file to write.
+*
+* Two entries can also be unwritable together without claiming the same
+* string: one wants a file where the other wants a directory (`about` from an
+* API route, `about/index.html` from a page). The filesystem does refuse that
+* one — `EISDIR` on the rename, `ENOTDIR` on the mkdir, depending on which
+* lands second — but an errno names a path, and in the rename case the path
+* it names is `about.tmp`. Reported here instead, so the message says which
+* two routes.
+*
+* Collisions are **collected, not thrown**. `onEntry` runs inside the
+* generator, whose RSC branch treats a throw as "this payload is unavailable,
+* SPA navigation falls back to a full load" and swallows it — which for a
+* collision is the wrong end state, since the two payloads are still
+* ambiguous. The caller raises them once generation is done.
+*
+* @internal Exported for testing.
+*/
+var StaticOutputPaths = class {
+	identity;
+	claimed = /* @__PURE__ */ new Map();
+	/** Every ancestor directory of a claimed path, mapped to its claimant. */
+	directories = /* @__PURE__ */ new Map();
+	collisions = [];
+	/**
+	* @param identity How the output filesystem decides two paths name one
+	*   file, from `detectFsIdentity`. The guard predicts whether two writes
+	*   land on one file, which is a property of the filesystem — so it is
+	*   asked, not assumed. Folding unconditionally would reject `/Foo` beside
+	*   `/foo` on Linux, where both are perfectly servable files.
+	*/
+	constructor(identity = EXACT_FS_IDENTITY) {
+		this.identity = identity;
+	}
+	/** The identity under which the filesystem will compare this path. */
+	key(relPath) {
+		return fsKey(relPath, this.identity);
+	}
+	/**
+	* Claim `relPath` for `entry`. Returns false when the path cannot be
+	* written alongside an earlier claim, in which case the caller must not
+	* write the file — the losing entry is recorded and the build fails at
+	* the end.
+	*/
+	claim(relPath, entry) {
+		if (RESERVED_OUTPUT_PATHS.some((name) => this.key(name) === this.key(relPath))) {
+			this.collisions.push(`  - ${relPath}: reserved — the framework writes this file itself, and ${entry.kind} for ${entry.urlPath} would be overwritten by it`);
+			return false;
+		}
+		const key = this.key(relPath);
+		const conflict = this.claimed.get(key) ?? this.directories.get(key) ?? ancestors(relPath).reduce((found, dir) => found ?? this.claimed.get(this.key(dir)), void 0);
+		if (conflict) {
+			this.collisions.push(`  - ${relPath}: ${conflict.kind} for ${conflict.urlPath} and ${entry.kind} for ${entry.urlPath}`);
+			return false;
+		}
+		this.claimed.set(key, entry);
+		for (const dir of ancestors(relPath)) {
+			const dirKey = this.key(dir);
+			if (!this.directories.has(dirKey)) this.directories.set(dirKey, entry);
+		}
+		return true;
+	}
+	/** Throw if any two entries could not both be written. */
+	assertNoCollisions() {
+		if (this.collisions.length === 0) return;
+		throw new Error(`[timber] Static generation: ${this.collisions.length} output path collision(s) — two entries write the same path and one would silently overwrite the other. Rename or remove one route in each pair:\n${this.collisions.join("\n")}`);
+	}
+};
+/** Every directory an output path sits under, outermost first. */
+function ancestors(relPath) {
+	const parts = relPath.split("/");
+	parts.pop();
+	return parts.map((_, i) => parts.slice(0, i + 1).join("/"));
+}
+/**
+* Writes generated entries into the static output directory, one file per
+* entry, refusing any write that would land on a path another entry holds.
+*
+* @internal Exported for testing.
+*/
+var StaticSiteWriter = class {
+	staticDir;
+	/** Content-Type per URL path for extensionless API routes (TIM-1241). */
+	contentTypes = {};
+	paths;
+	constructor(staticDir, identity = EXACT_FS_IDENTITY) {
+		this.staticDir = staticDir;
+		this.paths = new StaticOutputPaths(identity);
+	}
+	async write(entry) {
+		const relPath = staticOutputPath(entry);
+		const fullPath = resolve(this.staticDir, relPath);
+		const rel = relative(this.staticDir, fullPath);
+		if (rel.split(/[\\/]/)[0] === ".." || isAbsolute(rel) || resolve(this.staticDir, rel) !== fullPath) throw new Error(`[timber] Static generation: output path "${relPath}" escapes the static output directory — check generateStaticSegmentParams for path traversal characters in ${entry.urlPath}`);
+		if (!this.paths.claim(rel.replace(/\\/g, "/"), entry)) return;
+		await mkdir(dirname(fullPath), { recursive: true });
+		await writeFileAtomic$1(fullPath, entry.body);
+		if (entry.kind === "api" && !extname(relPath) && entry.contentType) this.contentTypes[entry.urlPath] = entry.contentType;
+	}
+	/** Throw if any two entries could not both be written. */
+	assertNoCollisions() {
+		this.paths.assertNoCollisions();
+	}
+};
+/**
+* Remove artifacts a generation pass produces only *conditionally*, so none
+* of them can survive from an earlier build into this one.
+*
+* Pages are not in this set: every page is rewritten each pass, and a page
+* whose route was deleted is a different problem (a stale file nothing links
+* to) from the one here.
+*
+* - `_rsc/` because the files are content-hashed. Left in place, a previous
+*   build's already-hashed payload gets hashed again and accumulates.
+* - `_redirects` because it is written only when this pass found redirects.
+*   A build whose redirects were removed would otherwise ship the previous
+*   build's rules — and would break the merge exemption in
+*   `shared/static-platform-files.ts`, which lets the pre-rendered copy
+*   overwrite `public/_redirects` on the grounds that it *contains* it. That
+*   holds only for a file the current pass produced (TIM-1266).
+*
+* @internal Exported for testing.
+*/
+async function cleanConditionalArtifacts(staticDir) {
+	await rm(join(staticDir, "_rsc"), {
+		recursive: true,
+		force: true
+	}).catch(() => {});
+	await rm(join(staticDir, REDIRECTS_FILE), { force: true }).catch(() => {});
+}
+/**
+* Run `fn` with `MessageChannel` instrumented, then stop every channel opened
+* while it ran from holding the process open.
+*
+* Static generation is the only build pass that renders **HTML** in the build
+* process: it imports the built app bundle and drives the full SSR pipeline
+* through it. React's scheduler opens a `MessageChannel` at module scope in
+* that bundle (`scheduler`'s DOM build) and never closes it, and a ref'd
+* `MessagePort` keeps Node's event loop alive on its own — so `timber build`
+* finished the site, printed its summary, and then hung forever. Server-mode
+* builds are unaffected because nothing there renders through react-dom.
+*
+* `unref()` is the whole fix: it leaves the port working and only drops the
+* "keep the process alive" property. It is applied **after** `fn` resolves, so
+* a render in flight can never be cut short by the process exiting under it —
+* an unref'd port would let Node exit while the scheduler still had a
+* continuation queued, which is a silently truncated page rather than a hang.
+*
+* Nothing renders after this pass. If that ever changes, the release has to
+* move to the end of whatever renders last.
+*
+* @internal Exported for testing.
+*/
+async function withSchedulerPortsReleased(fn) {
+	const opened = [];
+	const OriginalMessageChannel = globalThis.MessageChannel;
+	globalThis.MessageChannel = class extends OriginalMessageChannel {
+		constructor() {
+			super();
+			opened.push(this.port1, this.port2);
+		}
+	};
+	try {
+		return await fn();
+	} finally {
+		globalThis.MessageChannel = OriginalMessageChannel;
+		for (const port of opened) port.unref?.();
+	}
+}
+/**
 * Load the built RSC entry and run the static generation pass.
 *
 * Unlike prebuilt capture, this needs the FULL pipeline handler, so
@@ -6695,55 +6446,41 @@ async function runStaticGeneration(ctx) {
 	g.__TIMBER_CAPTURE_MODE__ = false;
 	if (ctx.buildManifest) await mergeRscAssetsManifest(ctx.buildDir, ctx.root, ctx.buildManifest, ctx.routeClientRefKeys);
 	console.log("[timber] Static generation: building site…");
-	let mod;
-	try {
-		mod = await import(
-			/* @vite-ignore */
-			`${pathToFileURL(entryPath).href}?t=${Date.now()}`
-);
-	} catch (error) {
-		throw new Error(`[timber] Static generation: failed to load the built RSC entry (${entryPath}). The full request handler must initialize for static rendering.`, { cause: error });
-	}
-	const generate = mod.__timber_generateStaticSite;
-	if (typeof generate !== "function") throw new Error("[timber] Static generation: built RSC entry does not export __timber_generateStaticSite — rebuild from a clean build directory");
 	const staticDir = join(ctx.buildDir, "static-pages");
-	await rm(join(staticDir, "_rsc"), {
-		recursive: true,
-		force: true
-	}).catch(() => {});
+	await cleanConditionalArtifacts(staticDir);
 	await mkdir(staticDir, { recursive: true });
 	const sitemapConfig = ctx.config.sitemap;
 	const autoSitemapEnabled = Boolean(sitemapConfig?.enabled && sitemapConfig?.baseUrl);
-	const contentTypes = {};
-	const routeParams = {};
-	const summary = await generate({
-		autoSitemapEnabled,
-		renderTimeoutMs: ctx.config.renderTimeoutMs,
-		onEntry: async (entry) => {
-			const relPath = staticOutputPath(entry);
-			const fullPath = resolve(staticDir, relPath);
-			const rel = relative(staticDir, fullPath);
-			if (rel.startsWith("..") || resolve(staticDir, rel) !== fullPath) throw new Error(`[timber] Static generation: output path "${relPath}" escapes the static output directory — check generateStaticSegmentParams for path traversal characters in ${entry.urlPath}`);
-			await mkdir(dirname(fullPath), { recursive: true });
-			await writeFileAtomic$1(fullPath, entry.body);
-			if (entry.kind === "rsc" && entry.headers["x-timber-params"]) {
-				const rscUrlKey = entry.urlPath === "/" ? "/_rsc/index.rsc" : `/_rsc${entry.urlPath}.rsc`;
-				try {
-					routeParams[rscUrlKey] = JSON.parse(entry.headers["x-timber-params"]);
-				} catch {}
-			}
-			if (entry.kind === "api" && !extname(relPath) && entry.contentType) contentTypes[entry.urlPath] = entry.contentType;
-		}
+	const writer = new StaticSiteWriter(staticDir, await detectFsIdentity(staticDir));
+	const summary = await withSchedulerPortsReleased(async () => {
+		let mod;
+		try {
+			mod = await import(
+				/* @vite-ignore */
+				`${pathToFileURL(entryPath).href}?t=${Date.now()}`
+);
+		} catch (error) {
+			throw new Error(`[timber] Static generation: failed to load the built RSC entry (${entryPath}). The full request handler must initialize for static rendering.`, { cause: error });
+		}
+		const generate = mod.__timber_generateStaticSite;
+		if (typeof generate !== "function") throw new Error("[timber] Static generation: built RSC entry does not export __timber_generateStaticSite — rebuild from a clean build directory");
+		return generate({
+			autoSitemapEnabled,
+			renderTimeoutMs: ctx.config.renderTimeoutMs,
+			onEntry: (entry) => writer.write(entry)
+		});
 	});
 	const totalUrls = summary.rendered + summary.errors.length;
 	console.log(`[timber] Static generation: rendered ${summary.rendered}/${totalUrls} entries.` + (summary.errors.length > 0 ? ` ${summary.errors.length} failed.` : "") + (summary.redirects.length > 0 ? ` ${summary.redirects.length} redirect(s).` : ""));
+	for (const warning of summary.warnings) console.warn(`[timber] Static generation warning: ${warning}`);
 	if (summary.errors.length > 0) {
 		const details = summary.errors.map((e) => `  - ${e.urlPath}: ${e.message}`).join("\n");
 		throw new Error(`[timber] Static generation failed:\n${details}`);
 	}
-	if (Object.keys(contentTypes).length > 0) ctx.staticContentTypes = contentTypes;
+	writer.assertNoCollisions();
+	if (Object.keys(writer.contentTypes).length > 0) ctx.staticContentTypes = writer.contentTypes;
 	if (!ctx.clientJavascript.disabled) {
-		const rscManifest = await hashRscPayloads(staticDir, routeParams);
+		const rscManifest = await hashRscPayloads(staticDir);
 		if (Object.keys(rscManifest).length > 0) {
 			await injectRscManifestIntoHtml(staticDir, rscManifest);
 			ctx.rscManifest = rscManifest;
@@ -6751,8 +6488,8 @@ async function runStaticGeneration(ctx) {
 		}
 	}
 	if (summary.redirects.length > 0) {
-		const generated = generateRedirectsFile(summary.redirects);
-		const redirectsPath = join(staticDir, "_redirects");
+		const generated = generateRedirectsFile(summary.redirects, normalizeBasePath(ctx.base));
+		const redirectsPath = join(staticDir, REDIRECTS_FILE);
 		const userRedirects = await readUserRedirects(ctx.root);
 		if (userRedirects !== null) {
 			await writeFileAtomic$1(redirectsPath, generated + "\n" + userRedirects);
@@ -6765,6 +6502,27 @@ async function runStaticGeneration(ctx) {
 	return summary;
 }
 /**
+* Warn when Vite's `base` is document-relative (`'./'`) in static mode.
+*
+* Payload URLs are addressed from the deployment root plus the base prefix.
+* A relative base gives no prefix to compute (see shared/base-path.ts), so
+* `/_rsc/about.rsc` is requested at the domain root — correct only when the
+* site is served from there. The build still succeeds: relative bases work
+* fine for assets, and for a root-served site nothing is wrong. The warning
+* exists so a sub-path deployment does not silently degrade to a hard
+* navigation on every link.
+*
+* Skipped when client JS is disabled — there is no SPA navigation and no
+* payload fetch to mis-address.
+*
+* @internal Exported for testing.
+*/
+function warnUnusableBase(ctx) {
+	if (ctx.clientJavascript.disabled) return;
+	if (!isRelativeBase(ctx.base)) return;
+	console.warn(`[timber] Static mode: base is "${ctx.base}", which is document-relative. RSC payload URLs are addressed from the domain root, so client-side navigation will fall back to a full page load if the site is served from a sub-path. Use an absolute base (e.g. base: '/repo/') to deploy under a sub-path. See design/11-platform.md.`);
+}
+/**
 * Compute a short content hash for immutable caching.
 * Uses 8 chars of base64url-encoded SHA-256, matching Vite's asset hash style.
 */
@@ -6799,6 +6557,12 @@ async function walkDir(dir) {
 * The manifest maps the original `_rsc/` URL to an entry object:
 * `{"/_rsc/index.rsc":{"url":"/_rsc/index-B7YxEKdN.rsc"}, ...}`
 *
+* Keys and URLs are **route-space**: root-relative, never carrying Vite's
+* `base`. The client applies the base once, at fetch time
+* (`client/rsc-fetch.ts` → `toStaticRscUrl`), so the generated site stays
+* relocatable and the base has exactly one expression at runtime rather
+* than two that must agree. See TIM-1261.
+*
 * Route params (from `routeParams`) are inlined into the manifest
 * entry, eliminating the need for .params.json sidecar files. TIM-1255.
 *
@@ -6807,7 +6571,7 @@ async function walkDir(dir) {
 *
 * @internal Exported for testing.
 */
-async function hashRscPayloads(staticDir, routeParams) {
+async function hashRscPayloads(staticDir) {
 	const files = await walkDir(join(staticDir, "_rsc"));
 	const manifest = {};
 	for (const filePath of files) {
@@ -6818,9 +6582,7 @@ async function hashRscPayloads(staticDir, routeParams) {
 		await rename(filePath, hashedPath);
 		const hashedRel = relative(staticDir, hashedPath).replace(/\\/g, "/");
 		const key = `/${rel}`;
-		const entry = { url: `/${hashedRel}` };
-		if (routeParams?.[key]) entry.params = routeParams[key];
-		manifest[key] = entry;
+		manifest[key] = { url: `/${hashedRel}` };
 	}
 	return manifest;
 }
@@ -6849,7 +6611,7 @@ async function injectRscManifestIntoHtml(staticDir, manifest) {
 * @internal Exported for testing.
 */
 async function readUserRedirects(root) {
-	const candidates = [join(root, "public", "_redirects")];
+	const candidates = [join(root, "public", REDIRECTS_FILE)];
 	for (const path of candidates) try {
 		return await readFile(path, "utf-8");
 	} catch {}
@@ -6897,6 +6659,7 @@ function timberStaticBuild(ctx) {
 			async handler() {
 				if (ctx.dev) return;
 				if (!(ctx.config.output === "static")) return;
+				warnUnusableBase(ctx);
 				await runStaticGeneration(ctx);
 			}
 		}
@@ -7050,12 +6813,10 @@ function walkModuleImports(moduleId, clientRefIndex, visited, result, getModuleI
 * Hooks: configResolved, resolveId, load, generateBundle (client and RSC envs)
 */
 function timberBuildManifest(ctx) {
-	let resolvedBase = "/";
 	let isDev = false;
 	return {
 		name: "timber-build-manifest",
 		configResolved(config) {
-			resolvedBase = config.base;
 			isDev = config.command === "serve";
 			if (!isDev && !ctx.deploymentId) ctx.deploymentId = randomUUID().replace(/-/g, "").slice(0, 16);
 		},
@@ -7067,19 +6828,22 @@ function timberBuildManifest(ctx) {
 		},
 		load(id) {
 			if (id !== RESOLVED_VIRTUAL_ID) return null;
+			const empty = JSON.stringify(EMPTY_BUILD_MANIFEST);
 			if (isDev) return [
 				"// Auto-generated build manifest — do not edit.",
 				"// Dev mode: empty manifest (Vite HMR handles CSS/JS).",
 				"",
-				"const manifest = { css: {}, js: {}, modulepreload: {}, fonts: {}, metadataRouteHashes: {} };",
+				`const manifest = ${empty};`,
 				"",
 				"export default manifest;"
 			].join("\n");
 			return [
 				"// Auto-generated build manifest — do not edit.",
 				"// Production: reads manifest from globalThis (set by _timber-manifest-init.js).",
+				"// The object below is only the fallback for when that global is unset —",
+				"// the real manifest, including the requestDep map, is in that init module.",
 				"",
-				"const manifest = globalThis.__TIMBER_BUILD_MANIFEST__ ?? { css: {}, js: {}, modulepreload: {}, fonts: {}, metadataRouteHashes: {}, requestDep: {} };",
+				`const manifest = globalThis.__TIMBER_BUILD_MANIFEST__ ?? ${empty};`,
 				"",
 				"export default manifest;"
 			].join("\n");
@@ -7102,10 +6866,10 @@ function timberBuildManifest(ctx) {
 				}
 			}
 			if (envName === "client") {
-				ctx.buildManifest = buildManifestFromBundle(bundle, resolvedBase, ctx.root);
+				ctx.buildManifest = buildManifestFromBundle(bundle, ctx.base, ctx.root);
 				if (ctx.routeTree) ctx.buildManifest.metadataRouteHashes = computeMetadataRouteHashes(ctx.routeTree.root);
-				const requestDepMap = ctx.requestDepMap;
-				if (requestDepMap) ctx.buildManifest.requestDep = requestDepMap;
+				if (ctx.requestDepMap === void 0) throw new Error("[timber] Build manifest: the request-dependency map was never computed. The RSC environment's buildEnd hook did not run before the client build, so no segment or slot could be skipped on client navigation. This is a plugin pipeline bug — timber-request-dep must run in the rsc environment.");
+				ctx.buildManifest.requestDep = ctx.requestDepMap;
 				if (ctx.clientJavascript.disabled) {
 					ctx.buildManifest.js = {};
 					ctx.buildManifest.modulepreload = {};
@@ -8200,7 +7964,319 @@ function timberCacheTransform(ctx) {
 	};
 }
 //#endregion
-//#region src/plugins/request-dep.ts
+//#region src/plugins/request-dep/analysis.ts
+/** `export default` has no local name of its own; this stands in for one. */
+var DEFAULT_EXPORT = "default";
+function createModuleFacts() {
+	return {
+		importedBindings: /* @__PURE__ */ new Map(),
+		reExports: /* @__PURE__ */ new Map(),
+		starReExports: [],
+		localExports: /* @__PURE__ */ new Map(),
+		factoryCalls: /* @__PURE__ */ new Map(),
+		calledLocals: /* @__PURE__ */ new Set(),
+		calledMembers: /* @__PURE__ */ new Map(),
+		getterLocals: /* @__PURE__ */ new Set(),
+		getterMembers: /* @__PURE__ */ new Map(),
+		referencedLocals: /* @__PURE__ */ new Set(),
+		resolvedSources: /* @__PURE__ */ new Map(),
+		unresolvedSources: /* @__PURE__ */ new Set()
+	};
+}
+/**
+* Specifiers the origin walk can actually reach, so the plugin resolves those
+* and not every import in the file.
+*
+* A re-export edge is always reachable — a downstream module can ask for any
+* name it forwards. An `import` edge is reachable through any local name the
+* module body mentions, or that it re-exports.
+*
+* The name set must be **the same one the taint rules consult**. Deriving it
+* from the call shapes instead (called, `.get()`d, member-called, minted from)
+* left `read(filters)` — a definition passed as an argument — with its
+* specifier unresolved, so the origin walk reported it inert and the page read
+* as request-independent. Two hand-maintained lists of "names that matter" is
+* one list too many; this is the one, and `referencedLocals` is a superset of
+* every call shape by construction, since each of them is an identifier the
+* walk visits. (Codex review round 1 on PR #991.)
+*/
+function usedSources(facts) {
+	const sources = new Set(facts.starReExports);
+	for (const edge of facts.reExports.values()) sources.add(edge.source);
+	for (const local of facts.referencedLocals) {
+		const edge = facts.importedBindings.get(local);
+		if (edge) sources.add(edge.source);
+	}
+	for (const local of facts.localExports.values()) {
+		const edge = facts.importedBindings.get(local);
+		if (edge) sources.add(edge.source);
+	}
+	return sources;
+}
+/**
+* True when the module cannot affect any answer, so its facts need not be kept.
+*
+* Every judgement bottoms out at a module edge: a call site resolves through
+* `importedBindings`, a chain link through `reExports` / `starReExports`. A
+* module with none of those can only ever resolve to `none` — its exports lead
+* to locals that lead nowhere — which is exactly what a *missing* entry
+* produces. Dropping it is behaviour-preserving and keeps the dev-time map from
+* holding an entry for every leaf module in the graph.
+*/
+function contributesNothing(facts) {
+	return facts.importedBindings.size === 0 && facts.reExports.size === 0 && facts.starReExports.length === 0;
+}
+function addToMapSet(map, key, value) {
+	const existing = map.get(key);
+	if (existing) existing.add(value);
+	else map.set(key, /* @__PURE__ */ new Set([value]));
+}
+function nameOf(node) {
+	if (!node) return null;
+	if (node.type === "Identifier") return node.name;
+	if (node.type === "Literal" && typeof node.value === "string") return node.value;
+	return null;
+}
+/**
+* `import type { … }` needs no handling here. Vite's TypeScript transform is a
+* core plugin and runs before this one, so types are already erased by the time
+* the analysis parses — and the parser it runs on is JavaScript-only, so
+* unerased TypeScript would throw rather than be silently misread.
+* `tests/request-dep-plugin.test.ts` pins the resulting property through the
+* real pipeline: a type-only accessor import is not request-dependent.
+*/
+function collectImportDeclaration(stmt, facts) {
+	const source = stmt.source?.value;
+	if (typeof source !== "string") return;
+	for (const spec of stmt.specifiers ?? []) {
+		const local = nameOf(spec.local);
+		if (!local) continue;
+		if (spec.type === "ImportNamespaceSpecifier") facts.importedBindings.set(local, {
+			source,
+			imported: "*"
+		});
+		else if (spec.type === "ImportDefaultSpecifier") facts.importedBindings.set(local, {
+			source,
+			imported: DEFAULT_EXPORT
+		});
+		else if (spec.type === "ImportSpecifier") facts.importedBindings.set(local, {
+			source,
+			imported: nameOf(spec.imported) ?? local
+		});
+	}
+}
+function collectDeclaredNames(decl, out) {
+	if (decl.type === "VariableDeclaration") for (const d of decl.declarations ?? []) {
+		const id = d.id;
+		if (id?.type === "Identifier") out.add(id.name);
+	}
+	else if (decl.type === "FunctionDeclaration" || decl.type === "ClassDeclaration") {
+		const id = decl.id;
+		if (id?.type === "Identifier") out.add(id.name);
+	}
+}
+function collectExportNamed(stmt, facts) {
+	const source = stmt.source?.value;
+	const specifiers = stmt.specifiers ?? [];
+	if (typeof source === "string") {
+		for (const spec of specifiers) {
+			const imported = nameOf(spec.imported) ?? nameOf(spec.local);
+			const exported = nameOf(spec.exported);
+			if (imported && exported) facts.reExports.set(exported, {
+				source,
+				imported
+			});
+		}
+		return;
+	}
+	for (const spec of specifiers) {
+		const local = nameOf(spec.local);
+		const exported = nameOf(spec.exported);
+		if (local && exported) facts.localExports.set(exported, local);
+	}
+	const declaration = stmt.declaration;
+	if (declaration) {
+		const names = /* @__PURE__ */ new Set();
+		collectDeclaredNames(declaration, names);
+		for (const name of names) facts.localExports.set(name, name);
+	}
+}
+function collectExportAll(stmt, facts) {
+	const source = stmt.source?.value;
+	if (typeof source !== "string") return;
+	const exported = nameOf(stmt.exported);
+	if (exported) facts.reExports.set(exported, {
+		source,
+		imported: "*"
+	});
+	else facts.starReExports.push(source);
+}
+function collectExportDefault(stmt, facts) {
+	const declaration = stmt.declaration;
+	if (!declaration) return;
+	facts.localExports.set(DEFAULT_EXPORT, DEFAULT_EXPORT);
+	if (declaration.type === "Identifier") facts.localExports.set(DEFAULT_EXPORT, declaration.name);
+	else if (declaration.type === "CallExpression") {
+		const ref = calleeRef(declaration);
+		if (ref) facts.factoryCalls.set(DEFAULT_EXPORT, ref);
+	}
+}
+function calleeRef(call) {
+	const callee = call.callee;
+	if (callee.type === "Identifier") return {
+		kind: "local",
+		name: callee.name
+	};
+	if (callee.type === "MemberExpression") {
+		const member = callee;
+		if (!member.computed && member.object.type === "Identifier" && member.property.type === "Identifier") return {
+			kind: "member",
+			object: member.object.name,
+			property: member.property.name
+		};
+	}
+	return null;
+}
+/**
+* Walk down a `.get()` receiver to the identifier it is ultimately rooted in,
+* along with the first property accessed on that identifier.
+*
+* `x.get()` → `x`, no property. `x(a).get()` → `x`. `ns.defs.get()` → `ns`
+* plus `defs`, which is both the namespace-member shape and the
+* `cookies.theme.get()` shape — the resolver tries the base binding and the
+* member, so one walk covers both.
+*/
+function chainRoot(node) {
+	let current = node;
+	let property = null;
+	for (;;) {
+		if (current.type === "Identifier") return {
+			base: current.name,
+			property
+		};
+		if (current.type === "MemberExpression") {
+			const member = current;
+			if (!member.computed && member.property.type === "Identifier") property = member.property.name;
+			else property = null;
+			current = member.object;
+			continue;
+		}
+		if (current.type === "CallExpression") {
+			property = null;
+			current = current.callee;
+			continue;
+		}
+		return null;
+	}
+}
+function collectExpression(node, facts) {
+	if (node.type === "VariableDeclarator") {
+		const id = node.id;
+		const init = node.init;
+		if (id?.type === "Identifier" && init?.type === "CallExpression") {
+			const ref = calleeRef(init);
+			if (ref) facts.factoryCalls.set(id.name, ref);
+		}
+		return;
+	}
+	if (node.type !== "CallExpression") return;
+	const callee = node.callee;
+	if (callee.type === "Identifier") {
+		facts.calledLocals.add(callee.name);
+		return;
+	}
+	if (callee.type !== "MemberExpression") return;
+	const member = callee;
+	if (member.computed || member.property.type !== "Identifier") return;
+	const propertyName = member.property.name;
+	if (propertyName === "get") {
+		const root = chainRoot(member.object);
+		if (root) {
+			facts.getterLocals.add(root.base);
+			if (root.property) addToMapSet(facts.getterMembers, root.base, root.property);
+		}
+		return;
+	}
+	if (member.object.type === "Identifier") addToMapSet(facts.calledMembers, member.object.name, propertyName);
+}
+/**
+* Statements whose whole subtree is an import/export *clause* rather than code.
+*
+* The walk skips them so `referencedLocals` means "the module body mentions
+* this name". Without the skip every imported name would count as referenced,
+* and a pure barrel — which mentions its names only in the clauses — would be
+* indistinguishable from a module that uses them.
+*/
+function isClauseOnly(node) {
+	if (node.type === "ImportDeclaration" || node.type === "ExportAllDeclaration") return true;
+	if (node.type === "ExportNamedDeclaration") return !node.declaration;
+	if (node.type === "ExportDefaultDeclaration") return node.declaration?.type === "Identifier";
+	return false;
+}
+/**
+* Keys holding *binding* positions rather than references: the name being
+* declared, not a mention of one.
+*
+* `referencedLocals` must exclude these or `export const filters =
+* defineSearchParams({})` would count as referencing `filters`, and possession
+* would then taint every definition module — and through it every page that
+* imports one, whether or not it reads the request. Skipping only these keys
+* keeps a shadowing parameter's *body* uses as references, which over-reports
+* in the safe direction.
+*/
+var BINDING_KEYS = {
+	VariableDeclarator: ["id"],
+	FunctionDeclaration: ["id", "params"],
+	FunctionExpression: ["id", "params"],
+	ArrowFunctionExpression: ["params"],
+	ClassDeclaration: ["id"],
+	ClassExpression: ["id"],
+	CatchClause: ["param"]
+};
+function walk(node, facts) {
+	if (isClauseOnly(node)) return;
+	if (node.type === "Identifier") facts.referencedLocals.add(node.name);
+	collectExpression(node, facts);
+	const bindingKeys = BINDING_KEYS[node.type];
+	for (const key of Object.keys(node)) {
+		if (key === "type" || key === "start" || key === "end") continue;
+		if (bindingKeys?.includes(key)) continue;
+		const value = node[key];
+		if (!value || typeof value !== "object") continue;
+		if (Array.isArray(value)) {
+			for (const item of value) if (item && typeof item === "object" && typeof item.type === "string") walk(item, facts);
+		} else if (typeof value.type === "string") walk(value, facts);
+	}
+}
+/**
+* Record every binding, module edge, and call shape in one module.
+*
+* Names are recorded without scope analysis, so a parameter that shadows an
+* imported name is credited to the import. That direction is deliberate: a
+* needlessly request-dependent segment costs a re-render, a wrongly static one
+* serves stale content.
+*/
+function analyzeModule(program) {
+	const facts = createModuleFacts();
+	for (const stmt of program.body) switch (stmt.type) {
+		case "ImportDeclaration":
+			collectImportDeclaration(stmt, facts);
+			break;
+		case "ExportNamedDeclaration":
+			collectExportNamed(stmt, facts);
+			break;
+		case "ExportAllDeclaration":
+			collectExportAll(stmt, facts);
+			break;
+		case "ExportDefaultDeclaration":
+			collectExportDefault(stmt, facts);
+			break;
+	}
+	walk(program, facts);
+	return facts;
+}
+//#endregion
+//#region src/plugins/request-dep/origin.ts
 var ACCESSOR_SOURCES = /* @__PURE__ */ new Set([
 	"@timber-js/app/server",
 	"next/headers",
@@ -8217,165 +8293,326 @@ var ACCESSOR_NAMES = /* @__PURE__ */ new Set([
 ]);
 var DEFINITION_FACTORY_SOURCES = /* @__PURE__ */ new Set(["@timber-js/app/search-params", "@timber-js/app/cookies"]);
 var DEFINITION_FACTORY_NAMES = /* @__PURE__ */ new Set(["defineSearchParams", "defineCookie"]);
-function isFrameworkModule(id) {
-	return /[\\/]node_modules[\\/]@timber-js[\\/]app[\\/]/.test(id) || /[\\/]packages[\\/]timber-app[\\/]src[\\/]/.test(id);
+/** Every specifier the classifier recognises without resolving it. */
+var FRAMEWORK_SOURCES = /* @__PURE__ */ new Set([...ACCESSOR_SOURCES, ...DEFINITION_FACTORY_SOURCES]);
+var NONE = { kind: "none" };
+var UNKNOWN = { kind: "unknown" };
+/**
+* Classify an edge that points at a framework module, without resolving it.
+*
+* Returns `null` when the specifier is not a framework source, which is the
+* signal to keep walking. Both name sets are consulted for either source so a
+* specifier that grows a second role does not silently stop matching.
+*/
+function classifySpecifier(source, imported) {
+	const isAccessorSource = ACCESSOR_SOURCES.has(source);
+	const isFactorySource = DEFINITION_FACTORY_SOURCES.has(source);
+	if (!isAccessorSource && !isFactorySource) return null;
+	if (imported === "*") return {
+		kind: "framework-namespace",
+		source
+	};
+	if (isAccessorSource && ACCESSOR_NAMES.has(imported)) return { kind: "accessor" };
+	if (isFactorySource && DEFINITION_FACTORY_NAMES.has(imported)) return { kind: "factory" };
+	return NONE;
 }
-var ACCESSOR_TOKENS = [
-	"getHeaders",
-	"getHeader",
-	"getSearchParams",
-	"getCookieJar",
-	"getCookie",
-	"headers",
-	"cookies",
-	"defineSearchParams",
-	"defineCookie",
-	".get("
-];
-function hasRelevantToken(code) {
-	for (const token of ACCESSOR_TOKENS) if (code.includes(token)) return true;
-	return false;
+/** An origin whose *call* reads the request. */
+function callReadsRequest(origin) {
+	return origin.kind === "accessor" || origin.kind === "unknown";
 }
-function analyzeModule(code, program) {
-	const facts = {
-		callsAccessor: false,
-		importsDefinitionFactory: false,
-		getterCallSources: []
-	};
-	for (const name of ACCESSOR_NAMES) {
-		const bindings = findImportBindings(program, ACCESSOR_SOURCES, name);
-		if (bindings.named.size > 0 || bindings.namespaces.size > 0) {
-			if (hasCallSite(program, bindings.named, bindings.namespaces, name)) facts.callsAccessor = true;
+/** An origin whose `.get()` reads the request. */
+function getterReadsRequest(origin) {
+	return origin.kind === "definition" || origin.kind === "unknown";
+}
+function createOriginResolver(factsMap) {
+	/**
+	* Cycle guard. A `(module, export)` pair already being resolved contributes
+	* `none`: anything it could reach is reachable on the path still unwinding.
+	*/
+	const resolving = /* @__PURE__ */ new Map();
+	function enter(moduleId, name) {
+		const names = resolving.get(moduleId);
+		if (!names) {
+			resolving.set(moduleId, /* @__PURE__ */ new Set([name]));
+			return true;
 		}
+		if (names.has(name)) return false;
+		names.add(name);
+		return true;
 	}
-	for (const name of DEFINITION_FACTORY_NAMES) {
-		const bindings = findImportBindings(program, DEFINITION_FACTORY_SOURCES, name);
-		if (bindings.named.size > 0 || bindings.namespaces.size > 0) facts.importsDefinitionFactory = true;
+	function leave(moduleId, name) {
+		resolving.get(moduleId)?.delete(name);
+	}
+	/** Follow one `import`/`export … from` edge out of `moduleId`. */
+	function resolveEdge(moduleId, edge) {
+		const classified = classifySpecifier(edge.source, edge.imported);
+		if (classified) return classified;
+		const facts = factsMap.get(moduleId);
+		const targetId = facts?.resolvedSources.get(edge.source);
+		if (!targetId) return facts?.unresolvedSources.has(edge.source) ? UNKNOWN : NONE;
+		if (edge.imported === "*") return {
+			kind: "namespace",
+			moduleId: targetId
+		};
+		return resolveExport(targetId, edge.imported);
 	}
-	for (const stmt of program.body) {
-		if (stmt.type !== "ImportDeclaration") continue;
-		const decl = stmt;
-		for (const spec of decl.specifiers) if (spec.type === "ImportDefaultSpecifier" || spec.type === "ImportSpecifier") {
-			const localName = spec.local.name;
-			if (hasGetterCall(program, localName)) facts.getterCallSources.push(decl.source.value);
-		}
-	}
-	if (facts.importsDefinitionFactory) for (const stmt of program.body) {
-		if (stmt.type !== "VariableDeclaration") continue;
-		for (const decl of stmt.declarations ?? []) {
-			if (!decl.init || !decl.id) continue;
-			const init = decl.init;
-			if (init.type === "CallExpression") {
-				const callee = init.callee;
-				if (callee.type === "Identifier") {
-					const calleeName = callee.name;
-					for (const factoryName of DEFINITION_FACTORY_NAMES) if (findImportBindings(program, DEFINITION_FACTORY_SOURCES, factoryName).named.has(calleeName)) {
-						const localName = decl.id.type === "Identifier" ? decl.id.name : null;
-						if (localName && hasGetterCall(program, localName)) facts.callsAccessor = true;
-					}
-				}
+	/** What does `moduleId` export under `name`? */
+	function resolveExport(moduleId, name) {
+		const facts = factsMap.get(moduleId);
+		if (!facts) return NONE;
+		if (!enter(moduleId, `export:${name}`)) return NONE;
+		try {
+			const reExport = facts.reExports.get(name);
+			if (reExport) return resolveEdge(moduleId, reExport);
+			const local = facts.localExports.get(name);
+			if (local !== void 0) return resolveLocal(moduleId, local);
+			for (const source of facts.starReExports) {
+				const viaStar = resolveEdge(moduleId, {
+					source,
+					imported: name
+				});
+				if (viaStar.kind !== "none") return viaStar;
 			}
+			return NONE;
+		} finally {
+			leave(moduleId, `export:${name}`);
 		}
 	}
-	return facts;
-}
-/** Check if any named/namespace binding is called as a function. */
-function hasCallSite(program, named, namespaces, importedName) {
-	return walkForCall(program, named, namespaces, importedName);
-}
-function walkForCall(node, named, namespaces, importedName) {
-	if (node.type === "CallExpression") {
-		const callee = node.callee;
-		if (callee.type === "Identifier" && named.has(callee.name)) return true;
-		if (callee.type === "MemberExpression") {
-			const member = callee;
-			if (!member.computed && member.object.type === "Identifier" && namespaces.has(member.object.name) && member.property.type === "Identifier" && member.property.name === importedName) return true;
-		}
-	}
-	for (const key of Object.keys(node)) {
-		if (key === "type" || key === "start" || key === "end") continue;
-		const val = node[key];
-		if (val && typeof val === "object") {
-			if (Array.isArray(val)) {
-				for (const item of val) if (item && typeof item === "object" && typeof item.type === "string") {
-					if (walkForCall(item, named, namespaces, importedName)) return true;
-				}
-			} else if (typeof val.type === "string") {
-				if (walkForCall(val, named, namespaces, importedName)) return true;
+	/** What is the local binding `name` in `moduleId`? */
+	function resolveLocal(moduleId, name) {
+		const facts = factsMap.get(moduleId);
+		if (!facts) return NONE;
+		if (!enter(moduleId, `local:${name}`)) return NONE;
+		try {
+			const imported = facts.importedBindings.get(name);
+			if (imported) return resolveEdge(moduleId, imported);
+			const factoryCall = facts.factoryCalls.get(name);
+			if (factoryCall) {
+				const callee = resolveCallee(moduleId, factoryCall);
+				if (callee.kind === "factory") return { kind: "definition" };
+				if (callee.kind === "unknown") return UNKNOWN;
 			}
+			return NONE;
+		} finally {
+			leave(moduleId, `local:${name}`);
 		}
 	}
-	return false;
-}
-/**
-* Check if the object chain of a `.get()` call contains `localName`.
-* Walks through MemberExpression objects and CallExpression callees
-* to handle chained patterns like `getFilterCookie(key).get()` or
-* `cookies.theme.get()`.
-*/
-function objectChainContains(node, name) {
-	if (node.type === "Identifier" && node.name === name) return true;
-	if (node.type === "MemberExpression") return objectChainContains(node.object, name);
-	if (node.type === "CallExpression") return objectChainContains(node.callee, name);
-	return false;
-}
-/**
-* Check if `.get(...)` is called on `localName` anywhere in the module.
-* Handles direct (`localName.get()`), chained call (`localName(args).get()`),
-* and nested member (`localName.prop.get()`) patterns.
-*/
-function hasGetterCall(node, localName) {
-	if (node.type === "CallExpression") {
-		const call = node;
-		if (call.callee.type === "MemberExpression") {
-			const member = call.callee;
-			if (!member.computed && member.property.type === "Identifier" && member.property.name === "get" && objectChainContains(member.object, localName)) return true;
+	function resolveCallee(moduleId, ref) {
+		if (ref.kind === "local") return resolveLocal(moduleId, ref.name);
+		return resolveMember(moduleId, ref.object, ref.property);
+	}
+	/** `ns.name` where `ns` is a local binding in `moduleId`. */
+	function resolveMember(moduleId, object, name) {
+		const base = resolveLocal(moduleId, object);
+		if (base.kind === "framework-namespace") return classifySpecifier(base.source, name) ?? NONE;
+		if (base.kind === "namespace") return resolveExport(base.moduleId, name);
+		if (base.kind === "unknown") return UNKNOWN;
+		return NONE;
+	}
+	const taintCache = /* @__PURE__ */ new Map();
+	function computeTainted(moduleId, facts) {
+		for (const local of facts.calledLocals) if (callReadsRequest(resolveLocal(moduleId, local))) return true;
+		for (const [object, members] of facts.calledMembers) for (const member of members) if (callReadsRequest(resolveMember(moduleId, object, member))) return true;
+		for (const local of facts.getterLocals) if (getterReadsRequest(resolveLocal(moduleId, local))) return true;
+		for (const [object, members] of facts.getterMembers) for (const member of members) if (getterReadsRequest(resolveMember(moduleId, object, member))) return true;
+		return holdsRequestBinding(moduleId, facts);
+	}
+	/**
+	* Possession, not use: a module that binds a request accessor or a definition
+	* value under a local name is request-dependent whether or not the call is
+	* one this analysis can see.
+	*
+	* The call-shape rules above only find a read that happens through the
+	* binding itself. A value can leave the binding first — `const read = flag ?
+	* getSearchParams : noop`, `const { get } = filters`, a prop handed to a
+	* helper — and every one of those is a fresh way to be missed, which is the
+	* shape of bug this ticket exists to stop enumerating. Nothing distinguishes
+	* those from an honest unused import except intent, so importing the accessor
+	* at all is treated as reading it.
+	*
+	* The rule is scoped by *reference*, not by export shape, and that scoping is
+	* what keeps it from being useless: `import { getSearchParams } from
+	* '@timber-js/app/server'; export { getSearchParams }` is a barrel whose body
+	* never mentions the name, and tainting it would taint every page that
+	* imports anything from that barrel. The forwarded name stays resolvable
+	* through `resolveExport`, so the page that actually calls it is still caught
+	* one hop later, in the module that uses it.
+	*
+	* Scoping on "the module only forwards it" would have been the natural
+	* phrasing and is wrong: a barrel can forward a name *and* use it
+	* (`export { getSearchParams }` beside `const read = flag ? getSearchParams
+	* : noop`), and that module is exactly the one this rule exists to catch.
+	* `referencedLocals` excludes import/export clauses and nothing else, so
+	* forwarding is exempt only when it is all the module does with the name.
+	*
+	* `unknown` is deliberately not included: an unresolvable specifier taints
+	* only when something is actually called or read on it, or every module with
+	* one broken import would go request-dependent.
+	*/
+	function holdsRequestBinding(moduleId, facts) {
+		for (const local of facts.referencedLocals) {
+			const origin = resolveLocal(moduleId, local);
+			if (origin.kind === "accessor" || origin.kind === "definition") return true;
 		}
+		return false;
 	}
-	for (const key of Object.keys(node)) {
-		if (key === "type" || key === "start" || key === "end") continue;
-		const val = node[key];
-		if (val && typeof val === "object") {
-			if (Array.isArray(val)) {
-				for (const item of val) if (item && typeof item === "object" && typeof item.type === "string") {
-					if (hasGetterCall(item, localName)) return true;
-				}
-			} else if (typeof val.type === "string") {
-				if (hasGetterCall(val, localName)) return true;
+	return {
+		isTainted(moduleId) {
+			const cached = taintCache.get(moduleId);
+			if (cached !== void 0) return cached;
+			const facts = factsMap.get(moduleId);
+			const result = facts ? computeTainted(moduleId, facts) : false;
+			taintCache.set(moduleId, result);
+			return result;
+		},
+		isDefinitionModule(moduleId) {
+			const facts = factsMap.get(moduleId);
+			if (!facts) return false;
+			for (const edge of facts.importedBindings.values()) {
+				const origin = resolveEdge(moduleId, edge);
+				if (origin.kind === "factory") return true;
+				if (origin.kind === "framework-namespace" && DEFINITION_FACTORY_SOURCES.has(origin.source)) return true;
 			}
+			return false;
+		},
+		callsGetterOnImport(moduleId) {
+			const facts = factsMap.get(moduleId);
+			if (!facts) return false;
+			for (const local of facts.getterLocals) if (facts.importedBindings.has(local)) return true;
+			return false;
 		}
-	}
-	return false;
+	};
 }
-/** Walk the module graph from an entry, returning true if any taint source is reachable. */
-function isReachableTaintSource(entryId, factsMap, definitionModules, getImports) {
+//#endregion
+//#region src/plugins/request-dep/index.ts
+function isFrameworkModule(id) {
+	return /[\\/]node_modules[\\/]@timber-js[\\/]app[\\/]/.test(id) || /[\\/]packages[\\/]timber-app[\\/]src[\\/]/.test(id);
+}
+/**
+* Cheap gate before parsing.
+*
+* This used to be a substring match on the accessor and factory names, which
+* was sound only for the analysis it served: when a call site had to name the
+* framework binding in its own import declaration, a module with no such name
+* could not be a call site. Resolving bindings across the graph removes that
+* guarantee — with
+*
+*     // _lib/index.ts
+*     export { getSearchParams as query } from '@timber-js/app/server';
+*     // page.tsx
+*     import { query } from './_lib';
+*     export default function Page() { return query(); }
+*
+* the page contains no accessor name, no `.get(`, and no re-export syntax, and
+* skipping it would have put the rename right back where the barrel was. So the
+* gate is now structural: a module matters if it has any module-level binding
+* to follow. What it skips is source with no `import` and no `export` at all —
+* data blobs, generated constants, side-effect scripts — none of which can name
+* a framework binding or forward one.
+*/
+function hasModuleBindings(code) {
+	return code.includes("import") || code.includes("export");
+}
+/**
+* Walk the module graph from an entry, returning true if any module reachable
+* from it reads the request.
+*
+* Two passes, and the second is a deliberately blunt backstop:
+*
+* 1. **Binding origins.** For each reachable module, resolve every call site's
+*    binding to its origin. This is precise and indifferent to indirection.
+* 2. **Definition reachability.** A module that calls `.get()` on *something*
+*    it imported, with a module holding a definition factory reachable behind
+*    that import, counts too. The origin walk cannot see through a value that
+*    is computed rather than bound — `getFilterCookie(key).get()`, where the
+*    helper returns a definition — and this pass can.
+*
+* The second pass over-reports by construction, which is the safe direction: a
+* needlessly request-dependent segment costs a re-render, a wrongly static one
+* serves stale content.
+*
+* An entry the graph does not contain is an edge we failed to walk, not the
+* absence of one — the same rule an unresolvable specifier gets. Without the
+* check it reads as an entry with no imports and no facts, and both passes fall
+* through to `false`: confidently request-INdependent, for a module nothing
+* ever looked at. In the build that answer is worse than no answer, because it
+* is written into `requestDep` as a definite `false` and the runtime's own
+* "absent key → conservative" fallback never fires.
+*/
+function isReachableTaintSource(entryId, input) {
+	const { factsMap, getImports, isKnownModule } = input;
+	if (!isKnownModule(entryId)) return true;
+	const resolver = createOriginResolver(factsMap);
 	const visited = /* @__PURE__ */ new Set();
 	const stack = [entryId];
 	while (stack.length > 0) {
 		const id = stack.pop();
 		if (visited.has(id)) continue;
 		visited.add(id);
-		const facts = factsMap.get(id);
-		if (facts) {
-			if (facts.callsAccessor) return true;
-			for (const source of facts.getterCallSources);
-		}
-		const imports = getImports(id);
-		for (const imp of imports) if (!imp.startsWith("\0") && !visited.has(imp)) stack.push(imp);
+		if (resolver.isTainted(id)) return true;
+		for (const imp of getImports(id)) if (!imp.startsWith("\0") && !visited.has(imp)) stack.push(imp);
 	}
+	const reachesDefinition = makeDefinitionReachability(resolver.isDefinitionModule, getImports);
 	for (const id of visited) {
-		const facts = factsMap.get(id);
-		if (!facts) continue;
-		if (facts.getterCallSources.length === 0) continue;
-		const imports = getImports(id);
-		for (const imp of imports) if (definitionModules.has(imp)) return true;
+		if (!resolver.callsGetterOnImport(id)) continue;
+		if (reachesDefinition(id)) return true;
 	}
 	return false;
 }
+/**
+* "Can a definition module be reached from this module's imports?", memoized
+* across the queries one entry makes.
+*
+* Walks the graph rather than testing direct imports, because `export … from`
+* is an ordinary module edge and a barrel is the common way an app shares one
+* `defineSearchParams` across routes.
+*
+* Cycles terminate on the memo seeded with `false`; a module already being
+* resolved contributes nothing, which is correct — anything it could reach is
+* reachable on the path that is still unwinding.
+*/
+function makeDefinitionReachability(isDefinitionModule, getImports) {
+	const cache = /* @__PURE__ */ new Map();
+	return function reaches(id) {
+		const cached = cache.get(id);
+		if (cached !== void 0) return cached;
+		cache.set(id, false);
+		let result = false;
+		for (const imp of getImports(id)) {
+			if (imp.startsWith("\0")) continue;
+			if (isDefinitionModule(imp) || reaches(imp)) {
+				result = true;
+				break;
+			}
+		}
+		cache.set(id, result);
+		return result;
+	};
+}
 var BRIDGE_KEY = Symbol.for("timber:request-dep");
+/**
+* Resolve every specifier the module has an edge to, so the origin walk can
+* follow them later without a module graph.
+*
+* Framework specifiers are classified by name and never resolved — that is what
+* keeps the terminal check independent of how `@timber-js/app` happens to be
+* installed. A specifier that fails to resolve is recorded as unresolved rather
+* than dropped, so the walk can take the conservative branch on it.
+*/
+async function resolveEdgeSources(pluginCtx, facts, importer) {
+	for (const source of usedSources(facts)) {
+		if (FRAMEWORK_SOURCES.has(source)) continue;
+		try {
+			const resolved = await pluginCtx.resolve(source, importer);
+			if (resolved?.id) facts.resolvedSources.set(source, resolved.id);
+			else facts.unresolvedSources.add(source);
+		} catch {
+			facts.unresolvedSources.add(source);
+		}
+	}
+}
 function timberRequestDep(ctx) {
 	const factsMap = /* @__PURE__ */ new Map();
-	const definitionModules = /* @__PURE__ */ new Set();
 	const cache = /* @__PURE__ */ new Map();
 	return {
 		name: "timber-request-dep",
@@ -8386,12 +8623,15 @@ function timberRequestDep(ctx) {
 			if (!/\.[mc]?[jt]sx?$/.test(id) && !/\.mdx?$/.test(id)) return;
 			if (id.startsWith("\0") || id.startsWith("virtual:")) return;
 			if (isFrameworkModule(id)) return;
-			if (!hasRelevantToken(code)) return;
-			const facts = analyzeModule(code, this.parse(code));
-			if (facts.callsAccessor || facts.importsDefinitionFactory || facts.getterCallSources.length > 0) {
-				factsMap.set(id, facts);
-				if (facts.importsDefinitionFactory) definitionModules.add(id);
+			if (!hasModuleBindings(code)) return;
+			const pluginCtx = this;
+			const facts = analyzeModule(pluginCtx.parse(code));
+			if (contributesNothing(facts)) {
+				factsMap.delete(id);
+				return;
 			}
+			await resolveEdgeSources(pluginCtx, facts, id);
+			factsMap.set(id, facts);
 		},
 		configureServer(server) {
 			const resolver = (filePath) => {
@@ -8405,8 +8645,13 @@ function timberRequestDep(ctx) {
 					for (const imp of mod.importedModules) if (imp.id) result.push(imp.id);
 					return result;
 				};
-				const result = isReachableTaintSource(filePath, factsMap, definitionModules, getImports);
-				cache.set(filePath, result);
+				const isKnownModule = (moduleId) => rscEnv.moduleGraph.getModuleById(moduleId) !== void 0;
+				const result = isReachableTaintSource(filePath, {
+					factsMap,
+					getImports,
+					isKnownModule
+				});
+				if (isKnownModule(filePath)) cache.set(filePath, result);
 				return result;
 			};
 			globalThis[BRIDGE_KEY] = resolver;
@@ -8423,10 +8668,14 @@ function timberRequestDep(ctx) {
 				if (!info) return [];
 				return [...info.importedIds ?? [], ...info.dynamicallyImportedIds ?? []];
 			};
+			const isKnownModule = (moduleId) => getModuleInfo(moduleId) != null;
 			const requestDepMap = {};
 			if (ctx.routeTree) walkSegmentTree(ctx.routeTree.root, (filePath) => {
-				const result = isReachableTaintSource(filePath, factsMap, definitionModules, getImports);
-				requestDepMap[filePath] = result;
+				requestDepMap[filePath] = isReachableTaintSource(filePath, {
+					factsMap,
+					getImports,
+					isKnownModule
+				});
 			});
 			ctx.requestDepMap = requestDepMap;
 		}
@@ -10351,6 +10600,7 @@ function timber(config) {
 	const earlyFileConfig = loadTimberConfigFile(process.cwd());
 	const rootSync = {
 		name: "timber-root-sync",
+		api: { getContext: () => ctx },
 		async config(userConfig, { command, isPreview }) {
 			const viteRoot = resolve(userConfig.root ?? process.cwd());
 			ctx.timer.start("config-load");
@@ -10407,7 +10657,6 @@ function timber(config) {
 				"@timber-js/app/cookies",
 				"@timber-js/app/cache",
 				"@timber-js/app/search-params",
-				"@timber-js/app/segment-params",
 				"@timber-js/app/params",
 				"@timber-js/app/codec"
 			];
@@ -10445,6 +10694,7 @@ function timber(config) {
 			ctx.root = resolved.root;
 			ctx.appDir = resolveAppDir(resolved.root, ctx.config.appDir);
 			ctx.dev = resolved.command === "serve";
+			ctx.base = resolved.base;
 			for (const name of [
 				"timber.config.ts",
 				"timber.config.js",