@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.187

package/dist/_chunks/fs-identity-D7vb6GdI.js

@@ -0,0 +1,208 @@
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { rm, stat, writeFile } from "node:fs/promises";
+//#region src/shared/static-platform-files.ts
+/**
+* Platform files the static build is allowed to overwrite in the output.
+*
+* The build merges two trees into the deployed directory — the client bundle
+* (which carries everything the user put in `public/`) and the pre-rendered
+* site. That merge otherwise refuses overlaps, because a silent overwrite
+* leaves one of two artifacts deployed with nothing recording which
+* (TIM-1266).
+*
+* These names are the exception, and only because the pre-rendered copy is
+* *derived from* the one it replaces rather than competing with it:
+* `plugins/static-build.ts` reads `public/_redirects` and writes the
+* generated rules plus the user's, so the winner is a superset of the loser.
+*
+* That holds only for a file the current pass produced, which is why
+* `cleanConditionalArtifacts` deletes a previous build's `_redirects` before
+* generation: written only when a pass finds redirects, it would otherwise
+* survive into a pass that produced nothing and claim an exemption it no
+* longer earns.
+*
+* `_headers` is NOT here. It is not written into the pre-rendered tree at
+* all — adapters generate it directly into the output, folding in the
+* user's copy as they go (TIM-1326).
+*
+* Declared once so the code that performs the merge and the code that
+* produces the merged file cannot disagree about which names are exempt.
+*
+* Isomorphic: no server, client, or build-time imports.
+*/
+/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */
+var REDIRECTS_FILE = "_redirects";
+/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */
+var HEADERS_FILE = "_headers";
+/**
+* Where a user authors platform files. Stated once because two modules read
+* from here — `plugins/static-build.ts` for `_redirects`, adapters for
+* `_headers` — and they must look in the same place.
+*
+* Both read the **project source**, never the build output. The generated
+* file lands under the same name in the output directory, so a reader aimed
+* there would fold the previous build's generated rules back in and compound
+* them on every rebuild.
+*/
+var USER_PLATFORM_DIR = "public";
+/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */
+var USER_MERGED_PLATFORM_FILES = [REDIRECTS_FILE];
+/**
+* Output paths the framework writes itself, which no route may claim.
+*
+* These are written outside the per-entry writer — `_redirects` after
+* generation, `_headers` by the adapter after the copy — so the collision
+* tracker never sees them and a route rendering to one of these paths is
+* overwritten with nothing recording it.
+*
+* Reserved rather than tracked, because there is no version of "serve a route
+* at `/_headers`" that works: Cloudflare Pages and Netlify read these two
+* files themselves and never serve them, so the route is unservable however
+* the conflict is resolved.
+*
+* That justification is per-file, not per-mechanism. `.nojekyll` is written
+* the same way and is deliberately NOT here: only the `github-pages` target
+* writes it, and everywhere else `/.nojekyll` is an ordinary servable path,
+* so reserving it globally would refuse a valid Cloudflare site. Its write
+* site skips the write when a file is already there instead — GitHub Pages
+* only cares that the file exists.
+*
+* Same reasoning as the synthetic 404 entry using an internal urlPath so a
+* real `/404` route cannot collide with `404.html`.
+*/
+var RESERVED_OUTPUT_PATHS = [REDIRECTS_FILE, HEADERS_FILE];
+//#endregion
+//#region src/adapters/fs-identity.ts
+/**
+* What the output filesystem considers "the same file".
+*
+* Two build steps compare paths to decide whether two artifacts would land on
+* one file — the render pass (`plugins/static-build.ts`) and the adapter's
+* tree merge (`build-output-helper.ts`). Both are predicting a filesystem
+* decision, so both ask the filesystem rather than comparing raw strings
+* (TIM-1266).
+*
+* Two properties matter, and they are independent:
+*
+* - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does
+*   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on
+*   Linux CI.
+* - **Unicode normalization.** APFS compares normalization-insensitively, so
+*   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one
+*   file. This holds even on a *case-sensitive* APFS volume, which is why it
+*   is probed separately rather than inferred from case folding.
+*
+* Probed rather than read off `process.platform`: a case-sensitive volume on
+* macOS and a case-insensitive mount on Linux are both ordinary, and the
+* answer that matters is the one for the directory being written.
+*
+* Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,
+* which `server/asset-headers.ts` re-exports from and which therefore must
+* stay free of `node:fs` for the Workers bundle.
+*/
+/** Every path comparison is exact — the conservative answer when unprobed. */
+var EXACT_FS_IDENTITY = {
+	caseInsensitive: false,
+	normalizationInsensitive: false,
+	stripsTrailingDotsAndSpaces: false
+};
+/**
+* Probe `dir` by writing one file and asking for it under other spellings.
+*
+* Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That
+* under-detects, but a directory this cannot write to is one the caller is
+* about to fail on anyway, with a clearer error than a missed collision.
+*/
+async function detectFsIdentity(dir) {
+	const name = `.timber-probe-${randomUUID()}-café`;
+	const path = join(dir, name);
+	try {
+		await writeFile(path, "");
+		const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] = await Promise.all([
+			exists(join(dir, name.toUpperCase())),
+			exists(join(dir, name.normalize("NFD"))),
+			exists(join(dir, `${name}.`))
+		]);
+		return {
+			caseInsensitive,
+			normalizationInsensitive,
+			stripsTrailingDotsAndSpaces
+		};
+	} catch {
+		return EXACT_FS_IDENTITY;
+	} finally {
+		await rm(path, { force: true }).catch(() => {});
+	}
+}
+/**
+* Fold a path to the identity the filesystem compares it under.
+*
+* Normalization first, then case: `toLowerCase()` operates per code point, so
+* folding a decomposed string first would leave the combining marks in a
+* different order than folding a precomposed one.
+*
+* An approximation of the filesystem's own algorithm — APFS and NTFS fold per
+* their own Unicode tables, which `toLowerCase()` matches for everything short
+* of the exotic. It errs toward *finding* a collision, and the cost of a false
+* positive is a build error naming two routes rather than a silent overwrite.
+*/
+function fsKey(path, identity) {
+	let key = identity.caseInsensitive ? caseFold(path) : path;
+	if (identity.normalizationInsensitive) key = key.normalize("NFC");
+	if (identity.stripsTrailingDotsAndSpaces) key = key.split("/").map(stripTrailing).join("/");
+	return key;
+}
+/**
+* Approximate Unicode case folding, which is what case-insensitive
+* filesystems actually compare under.
+*
+* `toLowerCase()` is not it. Greek `σ` and final `ς` are both already
+* lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS
+* folds `ς` to `σ` — so two routes differing only in that letter are one file
+* on both, and a lowercase key admitted them as two claims (TIM-1266).
+* Uppercasing first collapses them.
+*
+* The residual is over-folding, in these cases and a few like them:
+*
+* | pair      | folded together here | NTFS / APFS       |
+* | --------- | -------------------- | ----------------- |
+* | `σ` / `ς` | yes                  | yes — the fix     |
+* | `ß` / `ss`| yes                  | no                |
+* | `ı` / `i` | yes                  | no                |
+* | `fi` / `fi`| yes                  | no                |
+*
+* That direction is deliberate. Over-folding costs a build error naming two
+* routes, which a developer fixes by renaming one; under-folding costs a
+* payload silently overwritten by another route's, which nothing downstream
+* can detect. An exact fold would need `Intl.Collator`, which compares but
+* emits no sort key, so using it would turn a hash lookup into a pairwise
+* scan over every claimed path.
+*/
+function caseFold(value) {
+	return value.toUpperCase().toLowerCase();
+}
+/**
+* Drop trailing dots and spaces from one path segment, as Win32 does.
+*
+* A segment that is nothing but dots and spaces is left alone: `.` and `..`
+* are traversal, which the caller rejects before reaching here, and emptying
+* a segment would merge two unrelated paths rather than the aliases this
+* models.
+*/
+function stripTrailing(segment) {
+	const stripped = segment.replace(/[. ]+$/, "");
+	return stripped === "" ? segment : stripped;
+}
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { REDIRECTS_FILE as a, USER_PLATFORM_DIR as c, HEADERS_FILE as i, detectFsIdentity as n, RESERVED_OUTPUT_PATHS as o, fsKey as r, USER_MERGED_PLATFORM_FILES as s, EXACT_FS_IDENTITY as t };
+
+//# sourceMappingURL=fs-identity-D7vb6GdI.js.map

package/dist/_chunks/fs-identity-D7vb6GdI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-identity-D7vb6GdI.js","names":[],"sources":["../../src/shared/static-platform-files.ts","../../src/adapters/fs-identity.ts"],"sourcesContent":["/**\n * Platform files the static build is allowed to overwrite in the output.\n *\n * The build merges two trees into the deployed directory — the client bundle\n * (which carries everything the user put in `public/`) and the pre-rendered\n * site. That merge otherwise refuses overlaps, because a silent overwrite\n * leaves one of two artifacts deployed with nothing recording which\n * (TIM-1266).\n *\n * These names are the exception, and only because the pre-rendered copy is\n * *derived from* the one it replaces rather than competing with it:\n * `plugins/static-build.ts` reads `public/_redirects` and writes the\n * generated rules plus the user's, so the winner is a superset of the loser.\n *\n * That holds only for a file the current pass produced, which is why\n * `cleanConditionalArtifacts` deletes a previous build's `_redirects` before\n * generation: written only when a pass finds redirects, it would otherwise\n * survive into a pass that produced nothing and claim an exemption it no\n * longer earns.\n *\n * `_headers` is NOT here. It is not written into the pre-rendered tree at\n * all — adapters generate it directly into the output, folding in the\n * user's copy as they go (TIM-1326).\n *\n * Declared once so the code that performs the merge and the code that\n * produces the merged file cannot disagree about which names are exempt.\n *\n * Isomorphic: no server, client, or build-time imports.\n */\n\n/** Platform redirect rules (Cloudflare Pages, Netlify). See TIM-1245/TIM-1249. */\nexport const REDIRECTS_FILE = '_redirects';\n\n/** Platform header rules (Cloudflare Pages, Netlify). See TIM-1241/TIM-1326. */\nexport const HEADERS_FILE = '_headers';\n\n/**\n * Where a user authors platform files. Stated once because two modules read\n * from here — `plugins/static-build.ts` for `_redirects`, adapters for\n * `_headers` — and they must look in the same place.\n *\n * Both read the **project source**, never the build output. The generated\n * file lands under the same name in the output directory, so a reader aimed\n * there would fold the previous build's generated rules back in and compound\n * them on every rebuild.\n */\nexport const USER_PLATFORM_DIR = 'public';\n\n/** Output-relative paths whose pre-rendered copy subsumes the `public/` one. */\nexport const USER_MERGED_PLATFORM_FILES: readonly string[] = [REDIRECTS_FILE];\n\n/**\n * Output paths the framework writes itself, which no route may claim.\n *\n * These are written outside the per-entry writer — `_redirects` after\n * generation, `_headers` by the adapter after the copy — so the collision\n * tracker never sees them and a route rendering to one of these paths is\n * overwritten with nothing recording it.\n *\n * Reserved rather than tracked, because there is no version of \"serve a route\n * at `/_headers`\" that works: Cloudflare Pages and Netlify read these two\n * files themselves and never serve them, so the route is unservable however\n * the conflict is resolved.\n *\n * That justification is per-file, not per-mechanism. `.nojekyll` is written\n * the same way and is deliberately NOT here: only the `github-pages` target\n * writes it, and everywhere else `/.nojekyll` is an ordinary servable path,\n * so reserving it globally would refuse a valid Cloudflare site. Its write\n * site skips the write when a file is already there instead — GitHub Pages\n * only cares that the file exists.\n *\n * Same reasoning as the synthetic 404 entry using an internal urlPath so a\n * real `/404` route cannot collide with `404.html`.\n */\nexport const RESERVED_OUTPUT_PATHS: readonly string[] = [REDIRECTS_FILE, HEADERS_FILE];\n","/**\n * What the output filesystem considers \"the same file\".\n *\n * Two build steps compare paths to decide whether two artifacts would land on\n * one file — the render pass (`plugins/static-build.ts`) and the adapter's\n * tree merge (`build-output-helper.ts`). Both are predicting a filesystem\n * decision, so both ask the filesystem rather than comparing raw strings\n * (TIM-1266).\n *\n * Two properties matter, and they are independent:\n *\n * - **Case folding.** macOS APFS and Windows NTFS fold by default, ext4 does\n *   not. Dynamic params `Foo` and `foo` are one file on a Mac and two on\n *   Linux CI.\n * - **Unicode normalization.** APFS compares normalization-insensitively, so\n *   `café` spelled NFC (`é`) and NFD (`e` + combining acute) address one\n *   file. This holds even on a *case-sensitive* APFS volume, which is why it\n *   is probed separately rather than inferred from case folding.\n *\n * Probed rather than read off `process.platform`: a case-sensitive volume on\n * macOS and a case-insensitive mount on Linux are both ordinary, and the\n * answer that matters is the one for the directory being written.\n *\n * Leaf module — Node built-ins only. Deliberately not in `adapters/shared.ts`,\n * which `server/asset-headers.ts` re-exports from and which therefore must\n * stay free of `node:fs` for the Workers bundle.\n */\n\nimport { writeFile, stat, rm } from 'node:fs/promises';\nimport { randomUUID } from 'node:crypto';\nimport { join } from 'node:path';\n\n/** How the output filesystem decides that two paths name one file. */\nexport interface FsIdentity {\n  /** `Foo` and `foo` are the same file. */\n  caseInsensitive: boolean;\n  /** Canonically equivalent Unicode spellings are the same file. */\n  normalizationInsensitive: boolean;\n  /**\n   * Trailing dots and spaces are stripped from each segment, so `foo.` and\n   * `foo` are the same file. Win32 does this in path resolution rather than\n   * in the filesystem, which is why it is probed like the others.\n   */\n  stripsTrailingDotsAndSpaces: boolean;\n}\n\n/** Every path comparison is exact — the conservative answer when unprobed. */\nexport const EXACT_FS_IDENTITY: FsIdentity = {\n  caseInsensitive: false,\n  normalizationInsensitive: false,\n  stripsTrailingDotsAndSpaces: false,\n};\n\n/**\n * Probe `dir` by writing one file and asking for it under other spellings.\n *\n * Returns {@link EXACT_FS_IDENTITY} when the probe cannot run. That\n * under-detects, but a directory this cannot write to is one the caller is\n * about to fail on anyway, with a clearer error than a missed collision.\n */\nexport async function detectFsIdentity(dir: string): Promise<FsIdentity> {\n  // `café` — NFC, with a precomposed é. The UUID contributes the\n  // hex letters the case probe needs.\n  const name = `.timber-probe-${randomUUID()}-café`;\n  const path = join(dir, name);\n\n  try {\n    await writeFile(path, '');\n    const [caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces] =\n      await Promise.all([\n        exists(join(dir, name.toUpperCase())),\n        // NFD spells the same string as `e` + U+0301; a filesystem that\n        // resolves it to the NFC file compares normalization-insensitively.\n        exists(join(dir, name.normalize('NFD'))),\n        // Win32 strips trailing dots and spaces during path resolution, so\n        // asking for `name.` reaches `name`.\n        exists(join(dir, `${name}.`)),\n      ]);\n    return { caseInsensitive, normalizationInsensitive, stripsTrailingDotsAndSpaces };\n  } catch {\n    return EXACT_FS_IDENTITY;\n  } finally {\n    await rm(path, { force: true }).catch(() => {});\n  }\n}\n\n/**\n * Fold a path to the identity the filesystem compares it under.\n *\n * Normalization first, then case: `toLowerCase()` operates per code point, so\n * folding a decomposed string first would leave the combining marks in a\n * different order than folding a precomposed one.\n *\n * An approximation of the filesystem's own algorithm — APFS and NTFS fold per\n * their own Unicode tables, which `toLowerCase()` matches for everything short\n * of the exotic. It errs toward *finding* a collision, and the cost of a false\n * positive is a build error naming two routes rather than a silent overwrite.\n */\nexport function fsKey(path: string, identity: FsIdentity): string {\n  let key = identity.caseInsensitive ? caseFold(path) : path;\n  if (identity.normalizationInsensitive) key = key.normalize('NFC');\n  if (identity.stripsTrailingDotsAndSpaces) key = key.split('/').map(stripTrailing).join('/');\n  return key;\n}\n\n/**\n * Approximate Unicode case folding, which is what case-insensitive\n * filesystems actually compare under.\n *\n * `toLowerCase()` is not it. Greek `σ` and final `ς` are both already\n * lowercase and stay distinct under it, yet NTFS upcases both to `Σ` and APFS\n * folds `ς` to `σ` — so two routes differing only in that letter are one file\n * on both, and a lowercase key admitted them as two claims (TIM-1266).\n * Uppercasing first collapses them.\n *\n * The residual is over-folding, in these cases and a few like them:\n *\n * | pair      | folded together here | NTFS / APFS       |\n * | --------- | -------------------- | ----------------- |\n * | `σ` / `ς` | yes                  | yes — the fix     |\n * | `ß` / `ss`| yes                  | no                |\n * | `ı` / `i` | yes                  | no                |\n * | `fi` / `fi`| yes                  | no                |\n *\n * That direction is deliberate. Over-folding costs a build error naming two\n * routes, which a developer fixes by renaming one; under-folding costs a\n * payload silently overwritten by another route's, which nothing downstream\n * can detect. An exact fold would need `Intl.Collator`, which compares but\n * emits no sort key, so using it would turn a hash lookup into a pairwise\n * scan over every claimed path.\n */\nfunction caseFold(value: string): string {\n  return value.toUpperCase().toLowerCase();\n}\n\n/**\n * Drop trailing dots and spaces from one path segment, as Win32 does.\n *\n * A segment that is nothing but dots and spaces is left alone: `.` and `..`\n * are traversal, which the caller rejects before reaching here, and emptying\n * a segment would merge two unrelated paths rather than the aliases this\n * models.\n */\nfunction stripTrailing(segment: string): string {\n  const stripped = segment.replace(/[. ]+$/, '');\n  return stripped === '' ? segment : stripped;\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,iBAAiB;;AAG9B,IAAa,eAAe;;;;;;;;;;;AAY5B,IAAa,oBAAoB;;AAGjC,IAAa,6BAAgD,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;AAyB5E,IAAa,wBAA2C,CAAC,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3BrF,IAAa,oBAAgC;CAC3C,iBAAiB;CACjB,0BAA0B;CAC1B,6BAA6B;AAC/B;;;;;;;;AASA,eAAsB,iBAAiB,KAAkC;CAGvE,MAAM,OAAO,iBAAiB,WAAW,EAAE;CAC3C,MAAM,OAAO,KAAK,KAAK,IAAI;CAE3B,IAAI;EACF,MAAM,UAAU,MAAM,EAAE;EACxB,MAAM,CAAC,iBAAiB,0BAA0B,+BAChD,MAAM,QAAQ,IAAI;GAChB,OAAO,KAAK,KAAK,KAAK,YAAY,CAAC,CAAC;GAGpC,OAAO,KAAK,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;GAGvC,OAAO,KAAK,KAAK,GAAG,KAAK,EAAE,CAAC;EAC9B,CAAC;EACH,OAAO;GAAE;GAAiB;GAA0B;EAA4B;CAClF,QAAQ;EACN,OAAO;CACT,UAAU;EACR,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAChD;AACF;;;;;;;;;;;;;AAcA,SAAgB,MAAM,MAAc,UAA8B;CAChE,IAAI,MAAM,SAAS,kBAAkB,SAAS,IAAI,IAAI;CACtD,IAAI,SAAS,0BAA0B,MAAM,IAAI,UAAU,KAAK;CAChE,IAAI,SAAS,6BAA6B,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG;CAC1F,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,YAAY,CAAC,CAAC,YAAY;AACzC;;;;;;;;;AAUA,SAAS,cAAc,SAAyB;CAC9C,MAAM,WAAW,QAAQ,QAAQ,UAAU,EAAE;CAC7C,OAAO,aAAa,KAAK,UAAU;AACrC;AAEA,eAAe,OAAO,MAAgC;CACpD,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/_chunks/{logger-AWfuX-KJ.js → logger-D8xJZXIN.js}

@@ -1,45 +1,10 @@
 import { i as assertValidCookieValue, n as assertValidCookieName, r as assertValidCookieOptions, t as require_dist } from "./dist-BA3u1z3W.js";
-import { t as _setGetSearchParamsFn } from "./define-COtkxMRT.js";
-import { t as _setGetSegmentParamsFn } from "./define-c4au4I9R.js";
+import { o as traceAls, r as requestContextAls, s as waitUntilAls } from "./als-registry-C6kcfprT.js";
+import { n as _setGetSegmentParamsFn, t as _setGetSearchParamsFn } from "./als-slots-BEEIPKYm.js";
+import { r as appVisibleSearch } from "./rsc-cache-key-DD0fl_-s.js";
+import { t as resolveSegmentParams } from "./slot-params-BCTmZkQB.js";
 import { a as mergePreservedSearchParams, r as validateExternalRedirectUrl, t as assertRelativeRedirectPath } from "./href-validation-CMc5JRls.js";
 import { randomUUID } from "node:crypto";
-import "#server-only-guard";
-import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/server/als-registry.ts
-/**
-* Return a process-wide singleton `AsyncLocalStorage` keyed by `symbol`.
-*
-* `Symbol.for(...)` keys live in the cross-realm symbol registry, and
-* `globalThis` is shared across every module evaluation inside the same
-* Node.js process. Together they give a stable anchor that survives
-* re-evaluation of this file — the second evaluation observes the
-* `globalThis[symbol]` slot already populated by the first and hands
-* back the identical ALS instance.
-*/
-function getOrCreateAls(symbol) {
-	const g = globalThis;
-	const existing = g[symbol];
-	if (existing instanceof AsyncLocalStorage) return existing;
-	const created = new AsyncLocalStorage();
-	g[symbol] = created;
-	return created;
-}
-/** @internal — import via request-context.ts public API */
-var requestContextAls = getOrCreateAls(Symbol.for("timber:request-context-als"));
-/** @internal — import via tracing.ts public API */
-var traceAls = getOrCreateAls(Symbol.for("timber:trace-als"));
-/** @internal — import via server-timing.ts public API */
-var timingAls = getOrCreateAls(Symbol.for("timber:timing-als"));
-/** @internal — import via actions.ts public API */
-var revalidationAls = getOrCreateAls(Symbol.for("timber:revalidation-als"));
-/** @internal — import via form-flash.ts public API */
-var formFlashAls = getOrCreateAls(Symbol.for("timber:form-flash-als"));
-/** @internal — import via early-hints-sender.ts public API */
-var earlyHintsSenderAls = getOrCreateAls(Symbol.for("timber:early-hints-sender-als"));
-/** @internal — import via waituntil-bridge.ts public API */
-var waitUntilAls = getOrCreateAls(Symbol.for("timber:wait-until-als"));
-getOrCreateAls(Symbol.for("timber:workers-cache-purge-als"));
-//#endregion
 //#region src/server/tracing.ts
 /**
 * Tracing — per-request trace ID via AsyncLocalStorage, OTEL span helpers.
@@ -940,13 +905,8 @@ function getSegmentParams(segmentPath) {
 	const store = requestContextAls.getStore();
 	if (!store) throw new Error("[timber] getSegmentParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
 	if (!store.segmentParams) throw new Error("[timber] getSegmentParams() called before route matching completed. Segment params are not available until after the route is matched.");
-	if (segmentPath && store.slotParamsMap?.has(segmentPath)) {
-		const slotParams = store.slotParamsMap.get(segmentPath);
-		return {
-			...store.segmentParams,
-			...slotParams
-		};
-	}
+	const slotResolved = resolveSegmentParams(store.segmentParams, store.slotParams, segmentPath);
+	if (slotResolved !== store.segmentParams) return slotResolved;
 	if (segmentPath && isDebug() && store.matchedSegmentPath) {
 		const expected = extractDynamicSegments(segmentPath);
 		const actual = extractDynamicSegments(store.matchedSegmentPath);
@@ -1015,15 +975,15 @@ function getRequestSearchString() {
 */
 function runWithRequestContext(req, fn) {
 	const originalCopy = new Headers(req.headers);
-	const parsedUrl = new URL(req.url);
+	const appVisible = appVisibleSearch(new URL(req.url));
 	const seed = consumeSeededCookies(req);
 	const store = {
 		headers: freezeHeaders(req.headers),
 		originalHeaders: originalCopy,
 		cookieHeader: seed ? "" : req.headers.get("cookie") ?? "",
 		parsedCookies: seed,
-		searchParams: parsedUrl.searchParams,
-		searchString: parsedUrl.search,
+		searchParams: appVisible.params,
+		searchString: appVisible.search,
 		cookieJar: /* @__PURE__ */ new Map(),
 		flushed: false,
 		mutableContext: false
@@ -1158,6 +1118,29 @@ function warnIfNotSerializable(data, callerName) {
 var DenySignal = class extends Error {
 	status;
 	data;
+	/**
+	* Segment key of the segment that owns the deny page matched for this
+	* signal — set by a framework catch site that matched an entry it may not
+	* render at its own position, and re-threw so the boundary at the owning
+	* segment renders it instead.
+	*
+	* Written only by the three in-tree catch sites (`PageDenyBoundary`,
+	* `TracedLayout`, `AccessGate`), never by user code. Two readers depend on
+	* it: `TimberErrorBoundary`, which declines any deny whose `ownerKey` is
+	* not its own `segmentKey`, and `buildRscPayloadResponse`, which keeps
+	* streaming instead of re-rendering when it is set.
+	*
+	* See design/04-authorization.md §"Where a Deny Page Renders", TIM-1356.
+	*/
+	ownerKey;
+	/**
+	* When true, the pipeline must respond with `rscErrorEnvelope` so the
+	* client hard-navigates instead of attempting to render a deny page
+	* from the RSC payload. Set by AccessGate when a skipped segment
+	* denies — rendering the deny page in-tree would appear inside the
+	* client's cached layout chrome (TIM-1074). See TIM-1363.
+	*/
+	_hardNavigate;
 	constructor(status, data) {
 		super(`Access denied with status ${status}`);
 		this.name = "DenySignal";
@@ -1463,6 +1446,6 @@ function swallow(err, reason, opts) {
 	} catch {}
 }
 //#endregion
-export { timingAls as $, setMatchedSegmentPath as A, addSpanEventSync as B, applyRequestHeaderOverlay as C, getSegmentParams as D, getSearchParams as E, getSetCookieHeaders as F, replaceTraceId as G, getOtelTraceId as H, getWaitUntil as I, withSpan as J, runWithTraceId as K, isDebug as L, setSegmentParams as M, getCookie as N, markResponseFlushed as O, getCookieJar as P, revalidationAls as Q, isDevMode as R, waitUntil as S, getHeaders as T, getSpanId as U, generateTraceId as V, getTraceId as W, formFlashAls as X, earlyHintsSenderAls as Y, requestContextAls as Z, RedirectSignal as _, logProxyError as a, redirect as b, logRequestReceived as c, logSwrRefetchFailed as d, logWaitUntilRejected as f, DenySignal as g, swallow as h, logMiddlewareShortCircuit as i, setMutableCookieContext as j, runWithRequestContext as k, logRouteError as l, setLogger as m, logCacheMiss as n, logRenderError as o, logWaitUntilUnsupported as p, setSpanAttribute as q, logMiddlewareError as r, logRequestCompleted as s, getLogger as t, logSlowRequest as u, RenderError as v, getHeader as w, redirectExternal as x, deny as y, addSpanEvent as z };
+export { setMatchedSegmentPath as A, addSpanEventSync as B, applyRequestHeaderOverlay as C, getSegmentParams as D, getSearchParams as E, getSetCookieHeaders as F, replaceTraceId as G, getOtelTraceId as H, getWaitUntil as I, withSpan as J, runWithTraceId as K, isDebug as L, setSegmentParams as M, getCookie as N, markResponseFlushed as O, getCookieJar as P, isDevMode as R, waitUntil as S, getHeaders as T, getSpanId as U, generateTraceId as V, getTraceId as W, RedirectSignal as _, logProxyError as a, redirect as b, logRequestReceived as c, logSwrRefetchFailed as d, logWaitUntilRejected as f, DenySignal as g, swallow as h, logMiddlewareShortCircuit as i, setMutableCookieContext as j, runWithRequestContext as k, logRouteError as l, setLogger as m, logCacheMiss as n, logRenderError as o, logWaitUntilUnsupported as p, setSpanAttribute as q, logMiddlewareError as r, logRequestCompleted as s, getLogger as t, logSlowRequest as u, RenderError as v, getHeader as w, redirectExternal as x, deny as y, addSpanEvent as z };
 
-//# sourceMappingURL=logger-AWfuX-KJ.js.map
+//# sourceMappingURL=logger-D8xJZXIN.js.map