@timber-js/app 0.2.0-alpha.19 → 0.2.0-alpha.190

package/dist/server/action-handler.d.ts

@@ -15,6 +15,7 @@
 import { type CsrfConfig } from './csrf.js';
 import { type RevalidateRenderer } from './actions.js';
 import { type BodyLimitsConfig } from './body-limits.js';
+import { type SensitiveFieldsOption } from './sensitive-fields.js';
 import type { FormFlashData } from './form-flash.js';
 /** Configuration for the action handler. */
 export interface ActionDispatchConfig {
@@ -24,6 +25,12 @@ export interface ActionDispatchConfig {
     revalidateRenderer?: RevalidateRenderer;
     /** Body size limits (from timber.config.ts). */
     bodyLimits?: BodyLimitsConfig;
+    /**
+     * Override the sensitive-field deny-list for the no-JS form POST path.
+     * Defaults to the global `forms.stripSensitiveFields` from `timber.config.ts`.
+     * See `SensitiveFieldsOption` in `./sensitive-fields.ts` and TIM-816.
+     */
+    sensitiveFields?: SensitiveFieldsOption;
 }
 /**
  * Check if a request is a server action invocation.
@@ -32,11 +39,38 @@ export interface ActionDispatchConfig {
  * - With JS: POST with `x-rsc-action` header (client callServer dispatch)
  * - Without JS: POST with form data containing `$ACTION_REF` or `$ACTION_KEY`
  *   (React's progressive enhancement hidden fields)
+ *
+ * **Important:** This function returns true for ANY POST with a form
+ * Content-Type, including non-action POSTs to route.ts API handlers.
+ * The caller (wrap-action-dispatch.ts) MUST check the matched route type
+ * before entering the action path — route.ts matches skip action detection
+ * entirely so their body is not pre-parsed. See TIM-870.
  */
 export declare function isActionRequest(req: Request): boolean;
-/** Signal from handleFormAction to re-render the page with flash data instead of redirecting. */
+/**
+ * Signal from handleFormAction to re-render the page with flash data instead of redirecting.
+ *
+ * Carries two cookie-related snapshots taken before the action's ALS scope
+ * exits, so the rerender pipeline (which establishes its own fresh cookie
+ * jar from the original request) doesn't lose the action's mutations:
+ *
+ *   - `setCookieHeaders`: serialized Set-Cookie headers to append to the
+ *     final HTML response. Without this, cookies set inside the action are
+ *     silently dropped from the response. See TIM-836 (LOCAL-740).
+ *
+ *   - `cookies`: the post-action read-your-own-writes view of the cookie
+ *     jar, as the same `Map<string, string>` shape used by the request
+ *     context's `parsedCookies`. The rerender dispatcher seeds this map
+ *     directly into the rerender request context via `seedRequestCookies`,
+ *     bypassing any string round-trip through a `Cookie:` header. The
+ *     direct-Map seed eliminates the value-smuggling primitive that the
+ *     previous `cookieHeader: string` shape carried — see
+ *     ONGOING_SECURITY.md H-3 (TIM-868) and TIM-837.
+ */
 export interface FormRerender {
     rerender: FormFlashData;
+    setCookieHeaders: string[];
+    cookies: Map<string, string>;
 }
 /**
  * Handle a server action request.

package/dist/server/action-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CAwCzC"}
+{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAItE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAOrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CA6EzC"}

package/dist/server/actions.d.ts

@@ -3,7 +3,7 @@
  *
  * - revalidatePath(path) re-renders the route at that path and returns the RSC
  *   flight payload for inline reconciliation.
- * - revalidateTag(tag) invalidates cached shells and 'use cache' entries by tag.
+ * - revalidateTag(tag) invalidates timber.cache entries by tag.
  *
  * Both are callable from anywhere on the server — actions, API routes, handlers.
  *
@@ -13,22 +13,20 @@
  *
  * See design/08-forms-and-actions.md
  */
-import type { CacheHandler } from '#/cache/index';
 import { type RevalidationState } from './als-registry.js';
-/** Result of rendering a revalidation — element tree before RSC serialization. */
+/** Result of rendering a revalidation — payload root before RSC serialization. */
 export interface RevalidationResult {
-    /** React element tree (pre-serialization — passed to renderToReadableStream). */
-    element: unknown;
-    /** Resolved head elements for metadata. */
-    headElements: unknown[];
+    /**
+     * The payload root — tree plus the params it rendered with, exactly as an
+     * ordinary route payload. The client splits it in `applyRevalidation`.
+     */
+    payload: unknown;
 }
 /** Renderer function that builds a React element tree for a given path. */
 export type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;
 export type { RevalidationState } from './als-registry.js';
 /** Options for creating the action handler. */
 export interface ActionHandlerConfig {
-    /** Cache handler for tag invalidation. */
-    cacheHandler?: CacheHandler;
     /** Renderer for producing RSC payloads during revalidation. */
     renderer?: RevalidateRenderer;
 }
@@ -44,15 +42,10 @@ export interface ActionHandlerResult {
     redirectStatus?: number;
 }
 /**
- * Set the revalidation state for the current action execution.
- * @internal — kept for test compatibility; prefer executeAction() which uses ALS.
+ * Run `fn` inside a revalidation ALS scope.
+ * @internal — for tests that call revalidatePath/Tag directly without executeAction().
  */
-export declare function _setRevalidationState(state: RevalidationState): void;
-/**
- * Clear the revalidation state after action execution.
- * @internal — kept for test compatibility.
- */
-export declare function _clearRevalidationState(): void;
+export declare function _runWithRevalidationState<T>(state: RevalidationState, fn: () => T): T;
 /**
  * Re-render the route at `path` and include the RSC flight payload in the
  * action response. The client reconciles inline — no separate fetch needed.
@@ -63,8 +56,8 @@ export declare function _clearRevalidationState(): void;
  */
 export declare function revalidatePath(path: string): void;
 /**
- * Invalidate all pre-rendered shells and 'use cache' entries tagged with `tag`.
- * Does not return a payload — the next request for an invalidated route re-renders fresh.
+ * Invalidate all timber.cache entries tagged with `tag`.
+ * Does not return a payload — the next request for an invalidated entry re-executes.
  *
  * @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
  */
@@ -86,18 +79,4 @@ export declare function executeAction(actionFn: (...args: unknown[]) => Promise<
     actionFile?: string;
     actionName?: string;
 }): Promise<ActionHandlerResult>;
-/**
- * Build an HTTP Response for a no-JS form submission.
- * Standard POST → 302 redirect pattern.
- *
- * @param redirectPath - Where to redirect after the action executes.
- */
-export declare function buildNoJsResponse(redirectPath: string, status?: number): Response;
-/**
- * Detect whether the incoming request is an RSC action request (with JS)
- * or a plain HTML form POST (no JS).
- *
- * RSC action requests use Accept: text/x-component or Content-Type: text/x-component.
- */
-export declare function isRscActionRequest(req: Request): boolean;
 //# sourceMappingURL=actions.d.ts.map

package/dist/server/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI5E,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,YAAY,EAAE,OAAO,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAG/E,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAIpE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAmBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAK/C;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EAClD,IAAI,EAAE,OAAO,EAAE,EACf,MAAM,GAAE,mBAAwB,EAChC,QAAQ,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,GAAE,MAAY,GAAG,QAAQ,CAKtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIxD"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAG/E,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAErF;AAmBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAK/C;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EAClD,IAAI,EAAE,OAAO,EAAE,EACf,MAAM,GAAE,mBAAwB,EAChC,QAAQ,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC,CA4F9B"}

package/dist/server/als-registry.d.ts

@@ -6,20 +6,34 @@
  * this registry and re-export public accessor functions.
  *
  * Why: ALS instances require singleton semantics — if two copies of the
- * same ALS exist (one from a relative import, one from a barrel import),
- * one module writes to its copy and another reads from an empty copy.
- * Centralizing ALS creation in a single module eliminates this class of bug.
+ * same ALS exist (one from a relative import, one from a barrel import,
+ * or the same file re-evaluated by Vite after an HMR invalidation), one
+ * module writes to its copy and another reads from an empty copy.
+ * Centralizing ALS creation in a single module + anchoring each instance
+ * on `globalThis` under a `Symbol.for(...)` key eliminates this class of
+ * bug, including the Vite-dev case where module instance split would
+ * otherwise hand two copies of this file out of a single evaluation cycle.
  *
- * The `timber-shims` plugin ensures `@timber-js/app/server` resolves to
- * src/ in RSC and SSR environments, so all import paths converge here.
+ * The `timber-shims` plugin remaps `@timber-js/app/server` to src/ in
+ * RSC and SSR environments so import-specifier paths converge here, and
+ * the `globalThis[SYMBOL_FOR]` anchor below closes the remaining gap: any
+ * second evaluation of this module picks up the ALS the first evaluation
+ * already stored rather than instantiating a fresh one. Same pattern the
+ * Cloudflare bindings ALS uses in `adapters/cloudflare.ts`.
  *
  * DO NOT create ALS instances outside this file. If you need a new ALS,
  * add it here and import from `./als-registry.js` in the consuming module.
+ * Inside this file, always route through `getOrCreateAls(symbol)` — a raw
+ * `new AsyncLocalStorage()` reintroduces the instance-split hazard.
  *
  * See design/18-build-system.md §"Module Singleton Strategy" and
- * §"Singleton State Registry".
+ * §"Singleton State Registry". Regression test:
+ * `tests/als-registry-singleton.test.ts`.
  */
+import '#server-only-guard';
+import type { SlotParamsRecord } from '../shared/slot-params.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import type { DebugComponentEntry } from './rsc-entry/helpers.js';
 /** @internal — import via request-context.ts public API */
 export declare const requestContextAls: AsyncLocalStorage<RequestContextStore>;
 export interface RequestContextStore {
@@ -32,29 +46,106 @@ export interface RequestContextStore {
     /** Original (pre-overlay) frozen headers, kept for overlay merging. */
     originalHeaders: Headers;
     /**
-     * Promise resolving to the route's typed search params (when search-params.ts
-     * exists) or to the raw URLSearchParams. Stored as a Promise so the framework
-     * can later support partial pre-rendering where param resolution is deferred.
+     * Raw URLSearchParams for the current request.
+     * To get typed parsed params, import a search params definition and
+     * call `.parse(searchParams())`.
      */
-    searchParamsPromise: Promise<URLSearchParams | Record<string, unknown>>;
+    searchParams: URLSearchParams;
+    /**
+     * Raw search string from the request URL (e.g. "?foo=bar&baz=1").
+     * Available synchronously for use in `redirect()` with `preserveSearchParams`.
+     */
+    searchString: string;
+    /**
+     * Coerced segment params for the current request.
+     * Set by the pipeline after route matching and param coercion, before
+     * middleware and rendering. Pages and layouts read params via
+     * `getSegmentParams()` instead of receiving them as a prop.
+     *
+     * See design/07-routing.md §"params.ts — Convention File for Typed Params"
+     */
+    segmentParams?: Record<string, string | string[]>;
+    /**
+     * The matched segment path (e.g. '/(browse)/[artistSlug]/[year]').
+     * Includes route groups and parallel slots — uniquely identifies the
+     * segment in the route tree. Set by the pipeline alongside segmentParams.
+     * Used by getSegmentParams() for dev-mode validation.
+     * See design/41-global-params.md §Runtime Validation
+     */
+    matchedSegmentPath?: string;
+    /**
+     * Per-slot coerced segment params, keyed by the slot's full tree path
+     * (e.g. '/(browse)/@shows/[artistSlug]/[...year]').
+     *
+     * Each slot walks its own segment tree and may interpret URL parts
+     * differently from the main route (e.g. catch-all vs dynamic). This
+     * map stores slot-specific params so getSegmentParams(segmentPath)
+     * returns the correct types for slot pages.
+     *
+     * See design/07-routing.md §"Parallel Slot Params"
+     */
+    slotParams?: SlotParamsRecord;
     /** Outgoing Set-Cookie entries (name → serialized value + options). Last write wins. */
     cookieJar: Map<string, CookieEntry>;
     /** Whether the response has flushed (headers committed). */
     flushed: boolean;
     /** Whether the current context allows cookie mutation. */
     mutableContext: boolean;
+    /**
+     * Set by AccessGate or PageDenyBoundary when a DenySignal is caught
+     * server-side (inside the React tree, before React Flight sees it).
+     * The pipeline reads this after render to set the HTTP status code.
+     * See TIM-666.
+     */
+    denyStatus?: number;
+    /**
+     * Callback fired when setDenyStatus() is called. Used by shellSettled
+     * to short-circuit when any component catches a DenySignal in-tree,
+     * regardless of which component caught it (AccessGate, TracedLayout,
+     * or PageDenyBoundary). See TIM-1208.
+     */
+    onDenyStatus?: () => void;
+    /**
+     * Dev-only: getter for the current request's RSC debug components.
+     * Set by renderRoute() so onPipelineError can include component tree
+     * context for render-phase errors without module-level shared state.
+     */
+    debugComponentsGetter?: () => DebugComponentEntry[];
+    /**
+     * Index of the first segment whose AccessGate denied during render.
+     * Recorded by AccessGate when it catches a DenySignal so post-render
+     * consumers (buildSegmentInfo, X-Timber-Segments header) can bound
+     * the segment list without a pre-render access pass. Infinity when
+     * no segment denied. See TIM-1363.
+     */
+    _firstDeniedSegmentIndex?: number;
+    /**
+     * Metadata entries collected during render by MetadataCollector.
+     * Populated per-segment in tree order (root→page) during
+     * renderToReadableStream. MetadataHead reads all entries,
+     * merges them, and renders Float-hoisted head elements.
+     * See TIM-1363, design/16-metadata.md.
+     */
+    _metadataEntries?: import('./metadata.js').SegmentMetadataEntry[];
 }
 /** A single outgoing cookie entry in the cookie jar. */
 export interface CookieEntry {
     name: string;
     value: string;
-    options: import('./request-context.js').CookieOptions;
+    options: import('./cookie-context.js').CookieOptions;
 }
 export interface TraceStore {
     /** 32-char lowercase hex trace ID (OTEL or UUID fallback). */
     traceId: string;
     /** OTEL span ID if available, undefined otherwise. */
     spanId?: string;
+    /**
+     * Innermost active native platform span (e.g. Cloudflare's `Span` from
+     * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes
+     * after span creation — the platform API has no getActiveSpan() equivalent.
+     * Saved/restored by withSpan() around each callback. See TIM-1135.
+     */
+    platformSpan?: import('./tracing.js').PlatformSpan;
 }
 /** @internal — import via tracing.ts public API */
 export declare const traceAls: AsyncLocalStorage<TraceStore>;
@@ -81,4 +172,12 @@ export declare const earlyHintsSenderAls: AsyncLocalStorage<EarlyHintsSenderFn>;
 export type WaitUntilFn = (promise: Promise<unknown>) => void;
 /** @internal — import via waituntil-bridge.ts public API */
 export declare const waitUntilAls: AsyncLocalStorage<WaitUntilFn>;
+/** Workers Cache purge function from Cloudflare ExecutionContext.cache. */
+export interface WorkersCachePurgeCtx {
+    purge(opts: {
+        tags: string[];
+    }): Promise<void>;
+}
+/** @internal — import via workers-cache-bridge.ts public API */
+export declare const workersCachePurgeAls: AsyncLocalStorage<WorkersCachePurgeCtx>;
 //# sourceMappingURL=als-registry.d.ts.map

package/dist/server/als-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAA+C,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,sBAAsB,EAAE,aAAa,CAAC;CACvD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAAsC,CAAC;AAM5D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAAuC,CAAC;AAM9D,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAA6C,CAAC;AAM1E,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAAmE,CAAC;AAM7F,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAA8C,CAAC;AAM/E,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAuC,CAAC"}
+{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA2BlE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAE7B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,mBAAmB,EAAE,CAAC;IACpD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,eAAe,EAAE,oBAAoB,EAAE,CAAC;CACnE;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;CACtD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAA6D,CAAC;AAMnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAMtF,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAE3B,CAAC;AAMF,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAExB,CAAC;AAMF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAE/B,CAAC;AAMF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAmE,CAAC;AAM7F,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,yCAEhC,CAAC"}

package/dist/server/asset-headers.d.ts

@@ -8,16 +8,17 @@
  * Unhashed assets (e.g. /favicon.ico) get a shorter cache with revalidation:
  *   Cache-Control: public, max-age=3600, must-revalidate
  *
- * This is applied automatically by the framework for static assets served
- * from the build output. Page responses are NOT affected — those are
- * controlled by the developer via middleware.ts or proxy.ts.
+ * The `_headers` file lists hashed asset paths (/assets/*, /_timber/fonts/*) as
+ * wildcard rules and unhashed files as per-file rules. At runtime, adapters
+ * that see static file requests (nitro, preview) also set Cache-Control via
+ * `getAssetCacheControl()`. On Cloudflare Workers Static Assets, the worker
+ * never sees static file requests — the `_headers` file is the only mechanism.
+ * Page responses are NOT affected — those are controlled by the developer
+ * via middleware.ts or proxy.ts.
  *
  * Design docs: 18-build-system.md, 06-caching.md
  */
-/** Cache-Control value for hashed (immutable) assets. */
-export declare const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
-/** Cache-Control value for unhashed static assets. */
-export declare const STATIC_CACHE = "public, max-age=3600, must-revalidate";
+export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.js';
 /**
  * Check if a URL path looks like a hashed asset.
  */
@@ -28,15 +29,4 @@ export declare function isHashedAsset(pathname: string): boolean;
  * Returns `immutable` for hashed assets, short-lived for unhashed.
  */
 export declare function getAssetCacheControl(pathname: string): string;
-/**
- * Generate a `_headers` file for static asset cache control.
- *
- * The `_headers` file is a platform convention supported by Cloudflare Workers
- * Static Assets, Cloudflare Pages, and Netlify. It maps URL patterns to
- * HTTP response headers.
- *
- * Vite places all hashed chunks under `/assets/` — these get immutable caching.
- * Everything else (favicon.ico, robots.txt, etc.) gets a shorter cache.
- */
-export declare function generateHeadersFile(): string;
 //# sourceMappingURL=asset-headers.d.ts.map

package/dist/server/asset-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-headers.d.ts","sourceRoot":"","sources":["../../src/server/asset-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,yDAAyD;AACzD,eAAO,MAAM,eAAe,wCAA2C,CAAC;AAExE,sDAAsD;AACtD,eAAO,MAAM,YAAY,0CAAiD,CAAC;AAE3E;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAU5C"}
+{"version":3,"file":"asset-headers.d.ts","sourceRoot":"","sources":["../../src/server/asset-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAiB3F;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/server/body-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAejB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}
+{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;aACzB,cAAc;aACd,cAAc;aACd,SAAS,EAAE,GAAG;CACN,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAKD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAoBjB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}

package/dist/server/build-manifest.d.ts

@@ -33,8 +33,32 @@ export interface BuildManifest {
     modulepreload: Record<string, string[]>;
     /** Map from input file path to font assets used by that module. */
     fonts: Record<string, ManifestFontEntry[]>;
+    /**
+     * Cache-busting hashes for metadata route files (opengraph-image, etc.).
+     * Map from file path (relative to project root) to short content hash.
+     * In dev mode this is empty — a startup nonce is used instead.
+     */
+    metadataRouteHashes?: Record<string, string>;
+    /**
+     * Static request-dependency map from the Vite plugin's module-graph analysis.
+     * Map from segment entry file path to whether it's request-dependent.
+     * Used by buildSegmentInfo() for X-Timber-Segments in production.
+     */
+    requestDep?: Record<string, boolean>;
 }
-/** Empty build manifest used in dev mode. */
+/**
+ * Empty build manifest used in dev mode, and the single source of truth for
+ * what an empty manifest contains.
+ *
+ * `virtual:timber-build-manifest` serializes this constant into its generated
+ * source rather than restating it — one literal for the dev module, one for the
+ * production module's `globalThis.__TIMBER_BUILD_MANIFEST__ ?? …` fallback.
+ * They were three hand-written objects that had already drifted: this one and
+ * the dev literal were missing `requestDep` while the production fallback had
+ * it, so a reader who grepped the built bundle for `requestDep` found the one
+ * copy that mentioned it and read the fallback as the shipped map (TIM-1300).
+ * A field added here now reaches every copy.
+ */
 export declare const EMPTY_BUILD_MANIFEST: BuildManifest;
 /** Segment shape expected by collectRouteCss (matches ManifestSegmentNode). */
 interface SegmentWithFiles {
@@ -59,16 +83,6 @@ export declare function collectRouteCss(segments: SegmentWithFiles[], manifest:
  * via injectHead() before </head>.
  */
 export declare function buildCssLinkTags(cssUrls: string[]): string;
-/**
- * Generate a Link header value for CSS preload hints.
- *
- * Cloudflare CDN automatically converts Link headers with rel=preload
- * into 103 Early Hints responses. This avoids platform-specific 103
- * sending code.
- *
- * Example output: `</assets/root.css>; rel=preload; as=style, </assets/page.css>; rel=preload; as=style`
- */
-export declare function buildLinkHeaders(cssUrls: string[]): string;
 /**
  * Collect all font entries needed for a matched route's segment chain.
  *
@@ -83,21 +97,6 @@ export declare function collectRouteFonts(segments: SegmentWithFiles[], manifest
  * for font preloads even for same-origin resources per the spec).
  */
 export declare function buildFontPreloadTags(fonts: ManifestFontEntry[]): string;
-/**
- * Generate Link header values for font preload hints.
- *
- * Cloudflare CDN converts Link headers with rel=preload into 103 Early Hints.
- *
- * Example: `</fonts/inter.woff2>; rel=preload; as=font; crossorigin`
- */
-export declare function buildFontLinkHeaders(fonts: ManifestFontEntry[]): string;
-/**
- * Collect JS chunk URLs for a matched route's segment chain.
- *
- * Walks segments root → leaf, collecting the JS chunk for each layout
- * and page. Deduplicates while preserving order.
- */
-export declare function collectRouteJs(segments: SegmentWithFiles[], manifest: BuildManifest): string[];
 /**
  * Collect modulepreload URLs for a matched route's segment chain.
  *
@@ -112,9 +111,5 @@ export declare function collectRouteModulepreloads(segments: SegmentWithFiles[],
  * before they're needed, reducing waterfall latency for dynamic imports.
  */
 export declare function buildModulepreloadTags(urls: string[]): string;
-/**
- * Generate a <script type="module"> tag for a JS entry point.
- */
-export declare function buildEntryScriptTag(url: string): string;
 export {};
 //# sourceMappingURL=build-manifest.d.ts.map

package/dist/server/build-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;CAC5C;AAED,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,aAKlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAEvE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAiB9F;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAOlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAID;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D"}

package/dist/server/canonicalize.d.ts

@@ -14,6 +14,16 @@ export type CanonicalizeResult = {
     ok: false;
     status: 400;
 };
+/**
+ * Encoded separators that produce a 400 rejection.
+ * %2f (/) and %5c (\) cause path-confusion attacks.
+ *
+ * Shared between the runtime canonicalizer and the build-time route scanner
+ * to ensure both enforce identical security rules. See design/13-security.md.
+ */
+export declare const ENCODED_SEPARATOR_RE: RegExp;
+/** Null byte — rejected. Shared with the route scanner. */
+export declare const NULL_BYTE_RE: RegExp;
 /**
  * Canonicalize a URL pathname.
  *

package/dist/server/canonicalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAW7F;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}

package/dist/server/chain-url-parts.d.ts

@@ -0,0 +1,81 @@
+/**
+ * How much of the URL a matched segment chain has consumed.
+ *
+ * One question — "which URL parts had been consumed by the time segment `i`
+ * rendered?" — asked by four things that must all agree:
+ *
+ * - the layout depth handed to `SegmentProvider` (`route-element-builder.ts`),
+ *   which `useSelectedLayoutSegment(s)` indexes the live pathname with;
+ * - `slotUrlParts`, which slices the destination pathname for slot matching;
+ * - `resolveSlotProps` and `skippable-prefix.ts`, which derive content keys
+ *   for slot skip decisions (TIM-1370).
+ *
+ * They were four separate `extractUrlParts(...).length` calls. That was fine
+ * while the answer was a plain walk, and stopped being fine when interception
+ * gave it a second term (TIM-1280): the fix landed on the layout depth alone
+ * and the other three kept the old walk, so a layout and the slots beside it
+ * disagreed about how deep they were. Hence one function, in its own module,
+ * rather than a helper on the side of whichever caller was fixed first.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { ManifestSegmentNode } from './route-matcher.js';
+import type { RouteMatch } from './pipeline.js';
+/**
+ * Extract raw URL path parts from a segment chain.
+ *
+ * Each dynamic segment consumed one URL part (its param value). Static
+ * segments consumed their own name. Groups are transparent. Catch-all segments
+ * consumed multiple parts (their param value is `string[]`).
+ *
+ * The root segment is named '' and consumes nothing, so it is skipped here
+ * rather than by each caller — callers that pass a chain including the root
+ * (interception anchoring, slot-skip slicing) would otherwise have to remember
+ * to filter it, and one that forgot would push an empty part and shift every
+ * subsequent index by one.
+ *
+ * Uses rawSegmentParams (pre-coercion) to get actual URL strings. Values are
+ * coerced to `String()` defensively in case a codec leaked a non-string value
+ * into the params map.
+ *
+ * Each node is read through `effectiveUrlSegment`, so an intercepting
+ * directory contributes the URL part it intercepts (`(.)item` → `item`,
+ * `(.)[id]` → the bound value). A children-path interception puts such a node
+ * in the *main* chain, and reading it directly would classify it as neither
+ * static nor param-bearing — it would contribute nothing, and every part after
+ * it would shift by one.
+ */
+export declare function extractUrlParts(segments: ManifestSegmentNode[], mainParams: Record<string, string | string[]>): string[];
+/**
+ * The URL parts the chain has consumed through `index`, inclusive.
+ *
+ * For an ordinary chain this is just the walk. Two things make it more than
+ * that, and both are cases where a node stands for a different number of URL
+ * parts than itself:
+ *
+ * - A **catch-all** consumes as many parts as the request supplies, which the
+ *   walk already handles (its param value is an array).
+ * - An **interception with a climbing marker** intercepts a URL that starts
+ *   *above* its owner, so the owner's own URL segment — and any static
+ *   ancestor between the intercepted base and the owner — is not in the target
+ *   at all. `feed/(..)photo/[id]` at `/photo/42` still has `feed` in the
+ *   chain, and counting it puts everything after it off by one.
+ *
+ * So everything above the interception clamps to the anchor, and everything
+ * from it down counts forward from there. The owner chain is param-free by
+ * build-time rule and the intercepted base is a prefix of the owner's
+ * `urlPath`, so the target's leading `anchor` parts *are* the owner chain's
+ * leading `anchor` parts — which is what makes the clamped prefix real values
+ * rather than placeholders. For `(.)` the base is the owner's own path, so the
+ * clamp is a no-op and this reduces to the plain walk.
+ */
+export declare function consumedUrlParts(segments: ManifestSegmentNode[], index: number, match: RouteMatch): string[];
+/**
+ * The index in `match.segments` of a segment, or -1.
+ *
+ * Split out so the three slot call sites and the layout-depth one derive their
+ * slice point identically — `indexOf` plus `consumedUrlParts` — instead of
+ * each inlining the pair.
+ */
+export declare function consumedPartsThroughSegment(segment: ManifestSegmentNode, match: RouteMatch): string[];
+//# sourceMappingURL=chain-url-parts.d.ts.map

package/dist/server/chain-url-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-url-parts.d.ts","sourceRoot":"","sources":["../../src/server/chain-url-parts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAC5C,MAAM,EAAE,CA0BV;AAsBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAgBV;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAIV"}