@timber-js/app 0.2.0-alpha.19 → 0.2.0-alpha.191

package/src/server/node-stream-transforms.ts

@@ -0,0 +1,336 @@
+/**
+ * Node.js native stream transforms for SSR HTML post-processing.
+ *
+ * Node.js `Transform` wrappers around the pure helpers in
+ * `html-injector-core.ts`. Used on Node.js / Bun where C++-backed
+ * native streams are significantly faster than the JS-implemented
+ * Web Streams. The Web `TransformStream` equivalents live in
+ * `html-injectors.ts` and wrap the same core — keep the two files
+ * byte-for-byte equivalent in behavior. If you fix a streaming bug
+ * here, it almost certainly belongs in the core (`html-injector-core.ts`),
+ * not in this wrapper.
+ *
+ * Architecture:
+ *   renderToPipeableStream → pipe(errorHandler) → pipe(headInjector)
+ *     → pipe(flightInjector) → Readable.toWeb() → Response
+ *
+ * All chunks stay in C++ Node.js stream buffers until the final
+ * Readable.toWeb() conversion for the Response body.
+ */
+
+import { PassThrough, Transform, type Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+import {
+  BufferAggregator,
+  FlightInjectorCore,
+  SUFFIX_BYTES,
+  createInjectorState,
+  createSuffixState,
+  injectorFlush,
+  processInjectorChunk,
+  processSuffixChunk,
+  suffixFlush,
+} from './html-injector-core.js';
+import { logStreamingError } from './logger.js';
+import { createTickCoalescer } from './coalesce-tick.js';
+import { isAbortError, NOINDEX_SCRIPT } from './render-utils.js';
+
+// ─── Buffered Transform ──────────────────────────────────────────────────────
+
+export interface NodeBufferedTransformOptions {
+  /**
+   * Flush synchronously once the buffer reaches this many bytes.
+   * Prevents unbounded memory growth for very large Fizz flushes.
+   * Default: Infinity (no byte limit — flush only on tick boundary).
+   */
+  readonly maxBufferByteLength?: number;
+}
+
+/**
+ * Node.js `Transform` that buffers incoming chunks and coalesces them
+ * within a single event loop tick.
+ *
+ * Equivalent to `createBufferedTransformStream` in `html-injectors.ts` —
+ * the actual buffer math lives in `BufferAggregator`. This wrapper only
+ * owns the `setImmediate` scheduling and the push to the Node `Transform`.
+ *
+ * **Not a polling loop.** Single-shot `setImmediate` per flush cycle —
+ * no recursive scheduling. See design/02 §"No Polling".
+ */
+export function createNodeBufferedTransform(options: NodeBufferedTransformOptions = {}): Transform {
+  const buffer = new BufferAggregator(options.maxBufferByteLength ?? Infinity);
+
+  const flushBuffer = () => {
+    const merged = buffer.drain();
+    if (merged) transform.push(merged);
+  };
+
+  const coalescer = createTickCoalescer(flushBuffer);
+
+  const transform = new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const overCap = buffer.append(chunk);
+      if (overCap) {
+        flushBuffer();
+      } else {
+        coalescer.schedule();
+      }
+      callback();
+    },
+    flush(callback) {
+      coalescer.flushSync();
+      callback();
+    },
+  });
+
+  return transform;
+}
+
+// ─── Move Suffix Transform ───────────────────────────────────────────────────
+
+/**
+ * Node.js `Transform` that moves `</body></html>` to the end of the stream.
+ *
+ * Equivalent to `createMoveSuffixStream` in `html-injectors.ts`. Strips
+ * the suffix on first sight and re-emits it from `flush()`. If the
+ * suffix never appeared in the input, it is appended anyway so output
+ * is well-formed.
+ */
+export function createNodeMoveSuffixTransform(): Transform {
+  const state = createSuffixState();
+
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const result = processSuffixChunk(state, chunk);
+      if (result.kind === 'passthrough') {
+        this.push(chunk);
+        callback();
+        return;
+      }
+      if (result.kind === 'noSuffix') {
+        if (result.emitSafe) this.push(Buffer.from(result.emitSafe));
+        callback();
+        return;
+      }
+      if (result.before) this.push(Buffer.from(result.before));
+      if (result.after) this.push(Buffer.from(result.after));
+      callback();
+    },
+    flush(callback) {
+      this.push(Buffer.from(suffixFlush(state)));
+      callback();
+    },
+  });
+}
+
+// Re-export for tests / consumers that need the suffix bytes constant.
+export { SUFFIX_BYTES };
+
+// ─── Head Injection ──────────────────────────────────────────────────────────
+
+/**
+ * Node.js `Transform` that injects HTML content before `</head>`.
+ *
+ * Equivalent to `injectHead` in `html-injectors.ts`. Streams chunks
+ * through immediately, keeping only a small trailing buffer to handle
+ * `</head>` split across chunk boundaries.
+ */
+export function createNodeHeadInjector(headHtml: string): Transform {
+  if (!headHtml) {
+    return new Transform({
+      transform(chunk, _enc, cb) {
+        cb(null, chunk);
+      },
+    });
+  }
+
+  const state = createInjectorState({ content: headHtml, targetTag: '</head>' });
+
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const result = processInjectorChunk(state, chunk);
+      if (result.kind === 'passthrough') {
+        callback(null, chunk);
+        return;
+      }
+      if (result.bytes) this.push(Buffer.from(result.bytes));
+      callback();
+    },
+    flush(callback) {
+      const leftover = injectorFlush(state);
+      if (leftover) this.push(Buffer.from(leftover));
+      callback();
+    },
+  });
+}
+
+// ─── RSC Flight Injection ────────────────────────────────────────────────────
+
+/**
+ * Options for the Node.js flight injector.
+ */
+export interface NodeFlightInjectorOptions {
+  /**
+   * Timeout in milliseconds for individual RSC stream reads. If a single
+   * `rscReader.read()` call does not resolve within this duration, the
+   * read is aborted and the stream errors with a `RenderTimeoutError`.
+   * Default: 30000 (30s).
+   */
+  renderTimeoutMs?: number;
+  /** Signal that fires when an unhandled RSC error is detected. */
+  errorSignal?: AbortSignal;
+}
+
+/**
+ * Node.js `Transform` that merges RSC script tags into the HTML stream.
+ *
+ * Equivalent to `createFlightInjectionTransform` in `html-injectors.ts`.
+ * The state machine, pending queue, and pull loop all live in
+ * `FlightInjectorCore` — this wrapper only shuffles bytes between the
+ * core and the Node `Transform.push()` API.
+ *
+ * Suffix stripping (`</body></html>`) is handled upstream by
+ * `createNodeMoveSuffixTransform`. RSC scripts are buffered in
+ * `core.pending[]` and only drained from `transform()` (after a complete
+ * HTML chunk) or `flush()` — never mid-tag. See design/02
+ * §"Scripts at Chunk Boundaries Only".
+ *
+ * The RSC stream is a Web `ReadableStream` (from the tee'd RSC Flight
+ * stream). The core reads from it using the Web API — this is the one
+ * bridge point between Web Streams and Node.js streams in the pipeline.
+ */
+export function createNodeFlightInjector(
+  rscStream: ReadableStream<Uint8Array> | undefined,
+  options?: NodeFlightInjectorOptions
+): Transform {
+  if (!rscStream) {
+    return new Transform({
+      transform(chunk, _enc, cb) {
+        cb(null, chunk);
+      },
+    });
+  }
+
+  const core = new FlightInjectorCore(rscStream, options?.renderTimeoutMs, options?.errorSignal);
+
+  const drain = (): void => {
+    while (core.pending.length > 0) transform.push(Buffer.from(core.pending.shift()!));
+  };
+
+  const transform = new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      const wasInit = core.isInit;
+      if (wasInit) core.notifyFirstChunk();
+
+      // Emit the HTML chunk, then drain any buffered RSC scripts.
+      // Scripts always come AFTER a complete HTML chunk — never mid-tag.
+      // The buffered transform upstream (TIM-528) ensures coherent chunks.
+      // Suffix stripping is upstream via createNodeMoveSuffixTransform (TIM-530).
+      transform.push(chunk);
+      drain();
+
+      // Start the pull loop on the first HTML chunk.
+      if (wasInit) core.ensurePullLoop(drain);
+      callback();
+    },
+    destroy(err, callback) {
+      core.abort(err ?? 'pipeline destroyed');
+      callback(err);
+    },
+    flush(callback) {
+      // All HTML chunks have been emitted. Pull loop stops yielding.
+      core.notifyHtmlDone();
+
+      const finish = () => {
+        drain();
+        const err = core.terminalError;
+        if (err !== null) {
+          transform.destroy(err instanceof Error ? err : new Error(String(err)));
+          return;
+        }
+        callback();
+      };
+
+      if (core.isPullDone) {
+        finish();
+        return;
+      }
+      // Wait on the pull-loop promise instead of polling. Zero CPU cost
+      // while waiting. See design/02 §"No Polling".
+      core.ensurePullLoop(drain).then(finish, (err) => {
+        // ensurePullLoop's underlying loop catches its own errors and
+        // sends PULL_ERROR — this catch is defence-in-depth for any
+        // synchronous throws inside the .then() chain itself.
+        transform.destroy(err instanceof Error ? err : new Error(String(err)));
+      });
+    },
+  });
+
+  return transform;
+}
+
+// ─── Error Handling ──────────────────────────────────────────────────────────
+
+/**
+ * Run the Node SSR post-processing pipeline with post-shell error handling.
+ *
+ * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts: when the
+ * stream errors after the shell has flushed (deny/throw inside Suspense,
+ * an RSC read timeout in the flight injector, or an upstream Fizz error),
+ * the response closes cleanly with a trailing noindex script instead of
+ * aborting the connection mid-body. Abort errors (client disconnect,
+ * render-timeout abort) close the output silently — no noindex, no log.
+ *
+ * Why this is a pump function and not a Transform stage (TIM-1019):
+ * stream.promises.pipeline() destroys every stage in the chain when any
+ * stage errors, so a Transform *inside* the pipeline can never append
+ * bytes after a failure — by the time its 'error' listener fires, the
+ * transform and everything downstream are already destroyed and push()/
+ * end() are no-ops. The output PassThrough therefore lives OUTSIDE the
+ * pipeline() call: the last stage pipes into it (pipe() ends the output
+ * on upstream success but leaves it open on upstream error), and the
+ * pipeline's rejection handler appends the noindex script.
+ *
+ * Consumer cancellation (e.g. Readable.toWeb() cancel on client
+ * disconnect) is wired back into the pipeline via an AbortSignal so the
+ * source and all stages are torn down — the teardown that membership in
+ * pipeline() used to provide.
+ */
+export function runNodePipelineWithErrorHandling(
+  source: Readable,
+  transforms: readonly [Transform, ...Transform[]],
+  signal?: AbortSignal
+): PassThrough {
+  const output = new PassThrough();
+  const last = transforms[transforms.length - 1]!;
+  last.pipe(output);
+
+  // If the consumer destroys the output (client disconnect), abort the
+  // pipeline so the Fizz source and flight injector release their
+  // resources. On normal completion the pipeline has already settled and
+  // the abort is a no-op.
+  const consumerGone = new AbortController();
+  output.once('close', () => consumerGone.abort());
+
+  // The cast satisfies pipeline()'s [source, ...transforms, destination]
+  // tuple overload — TS can't prove the shape across a spread, but the
+  // signature above guarantees a non-empty transform list at compile time.
+  const stages = [source, ...transforms] as unknown as readonly [
+    Readable,
+    ...Transform[],
+    Transform,
+  ];
+
+  pipeline(stages, { signal: consumerGone.signal }).catch((error: unknown) => {
+    if (output.writableEnded || output.destroyed) return;
+    if (isAbortError(error) || signal?.aborted || consumerGone.signal.aborted) {
+      output.end();
+      return;
+    }
+    logStreamingError({ error });
+    output.end(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
+  });
+
+  return output;
+}

package/src/server/param-coercion.ts

@@ -0,0 +1,189 @@
+/**
+ * Segment param coercion — runs the app/schema.ts codecs over the raw
+ * matcher output before middleware and rendering.
+ *
+ * Lifted out of `pipeline-phases.ts` (TIM-853) so the coercer can be
+ * imported directly by other entry points (the action-dispatch wrapper,
+ * the revalidation renderer in `rsc-entry/index.ts`) without pulling
+ * the entire pipeline phase module along with it.
+ *
+ * The function throws `ParamCoercionError` from `route-element-builder.ts`
+ * on any codec failure; the pipeline catches that and dispatches to the
+ * 404 page. See design/07-routing.md §"Where Coercion Runs".
+ */
+
+import type { Codec } from '../codec.js';
+import type { SegmentType } from '../routing/types.js';
+import { effectiveUrlSegment } from '../routing/segment-classify.js';
+import { toBracketKey } from '../params/resolve-schema.js';
+import type { RouteMatch } from './pipeline.js';
+import { normalizeParamValue, type CoercedParams } from '../shared/param-value.js';
+import { ParamCoercionError } from './route-element-builder.js';
+import { isDebug } from './debug.js';
+
+// ---------------------------------------------------------------------------
+// Module-level global codec store (TIM-931)
+// ---------------------------------------------------------------------------
+
+/** Global schema codecs, set once at startup from virtual:timber-schema. */
+let _globalCodecs: Record<string, Codec<unknown>> | null = null;
+
+/**
+ * Register the global schema codecs. Called once from the RSC entry
+ * at server startup when app/schema.ts provides segment param codecs.
+ * @internal
+ */
+export function setGlobalSchemaCodecs(codecs: Record<string, Codec<unknown>> | null): void {
+  _globalCodecs = codecs;
+}
+
+/**
+ * Coerce raw slot params through global schema codecs.
+ *
+ * Each slot segment that has a paramName is looked up in the global codec
+ * map by its bracket key (e.g. '[...year]' for catch-all). If a codec
+ * exists, the raw value is parsed through it. If no codec exists or no
+ * global codecs are registered, the raw value passes through unchanged.
+ *
+ * Segments are read through `effectiveUrlSegment` because an intercepting
+ * node's own `segmentType` is `'intercepting'` and its `paramName` is unset
+ * — the param it binds lives in the intercepted name (`(.)[id]` → `[id]`).
+ * The slot resolver matches through the same helper, so the key a param is
+ * coerced under is always the key it was matched under (TIM-1281).
+ *
+ * Unlike main route coercion, this does NOT throw ParamCoercionError on
+ * failure — slots degrade gracefully. A failed coercion logs a warning
+ * in dev mode and keeps the raw value.
+ *
+ * @internal — framework use only
+ */
+export function coerceSlotParams(
+  slotChain: Array<{
+    segmentName: string;
+    segmentType: SegmentType;
+    paramName?: string;
+    interceptedSegmentName?: string;
+  }>,
+  rawParams: Record<string, string | string[]>
+): CoercedParams {
+  const globalCodecs = _globalCodecs;
+  if (!globalCodecs) return rawParams;
+
+  const result: CoercedParams = Object.create(null);
+  for (const key of Object.keys(rawParams)) {
+    result[key] = rawParams[key];
+  }
+
+  for (const node of slotChain) {
+    const segment = effectiveUrlSegment(node);
+    if (!segment.paramName) continue;
+    const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+    const codec = globalCodecs[bracketKey];
+    if (!codec) continue;
+
+    const key = segment.paramName;
+    if (!(key in result)) continue;
+
+    let parsed: unknown;
+    try {
+      parsed = codec.parse(result[key] as string | string[]);
+    } catch (err) {
+      // Slot param coercion failures are non-fatal — keep the raw value.
+      // The main route already validated the URL; the slot just interprets
+      // the same parts differently.
+      if (isDebug()) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(
+          `[timber] Slot param coercion failed for "${key}" (codec: ${bracketKey})\n` +
+            `  Error: ${message}\n` +
+            `  Raw value: ${JSON.stringify(result[key])}\n` +
+            `  Keeping raw value.`
+        );
+      }
+      continue;
+    }
+    result[key] = normalizeParamValue(parsed, key);
+  }
+
+  return result;
+}
+
+/**
+ * Run segment param coercion on the matched route's segments.
+ *
+ * Codecs come from `app/schema.ts` and nowhere else (TIM-1342 completed
+ * design/41-global-params.md migration step 9). A route with no schema, or
+ * a param the schema does not declare, keeps its raw string — which is the
+ * honest type for an uninterpreted URL segment.
+ *
+ * Throws ParamCoercionError if any codec fails (→ 404).
+ *
+ * This runs BEFORE middleware, so ctx.segmentParams is already typed.
+ * See design/07-routing.md §"Where Coercion Runs"
+ * See design/41-global-params.md §"Pipeline Integration"
+ *
+ * Stays `async` with nothing to await: it is injected as a
+ * `CoerceSegmentParamsFn` into the revalidation renderer and the action
+ * middleware runner, both of which await it. Narrowing the return type to
+ * `void` would break those contracts and remove a microtask boundary the
+ * pipeline's ordering has always had, for no gain.
+ */
+// eslint-disable-next-line @typescript-eslint/require-await -- see above
+export async function coerceSegmentParams(match: RouteMatch): Promise<void> {
+  const globalCodecs = _globalCodecs;
+  // Unconditionally install a null-prototype target so the invariant
+  // "match.segmentParams is null-prototype" holds from the first line,
+  // regardless of whether any segment has a codec.
+  const mergeTarget: CoercedParams = Object.create(null);
+  for (const key of Object.keys(match.segmentParams)) {
+    if (key !== '__proto__') {
+      mergeTarget[key] = match.segmentParams[key as keyof typeof match.segmentParams];
+    }
+  }
+  match.segmentParams = mergeTarget;
+
+  // TIM-931/TIM-936: When a global schema is available, use it for coercion
+  // instead of per-segment params.ts files. The global codec map is keyed
+  // by bracket name (e.g. '[id]', '[...slug]') to avoid collisions between
+  // distinct segment types that share a param name.
+  if (globalCodecs) {
+    for (const node of match.segments) {
+      // Read through `effectiveUrlSegment` for the same reason
+      // `coerceSlotParams` does: an intercepting node's own `segmentType` is
+      // 'intercepting' and its `paramName` is unset — the param it binds lives
+      // in the intercepted name (`(.)[id]` → `[id]`). Until TIM-1280 an
+      // intercepting node could only appear in a *slot* chain, so only that
+      // path needed it; a children-path interception puts one in the main
+      // chain, and reading the node directly would silently skip coercion for
+      // exactly the param the intercepting directory declares — so the swapped
+      // route and the canonical one would disagree about the param's type.
+      const segment = effectiveUrlSegment(node);
+      if (!segment.paramName) continue;
+      const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+      const codec = globalCodecs[bracketKey];
+      if (!codec) continue; // no codec in schema → keep raw string
+
+      const key = segment.paramName;
+      if (!(key in mergeTarget)) continue;
+      let parsed: unknown;
+      try {
+        parsed = codec.parse(mergeTarget[key] as string | string[]);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (isDebug()) {
+          console.warn(
+            `[timber] Global schema codec rejected value for param "${key}"\n` +
+              `  Error: ${message}\n` +
+              `  Raw value: ${JSON.stringify(mergeTarget[key])}\n` +
+              `  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`
+          );
+        }
+        throw new ParamCoercionError(message);
+      }
+      // Outside the catch: a codec that rejects a URL value is a 404, a codec
+      // that returns an unrepresentable one is a bug in the app. Normalizing
+      // inside would report the second as the first.
+      mergeTarget[key] = normalizeParamValue(parsed, key);
+    }
+  }
+}

package/src/server/pipeline-helpers.ts

@@ -0,0 +1,159 @@
+/**
+ * Pipeline helpers — small utility functions used by `pipeline.ts` and
+ * `pipeline-phases.ts`. Lifted out of `pipeline.ts` to keep that file
+ * focused on the request handler entry point.
+ *
+ * Each helper is intentionally a free function with no closure capture, so
+ * it can be unit-tested in isolation.
+ *
+ * See design/07-routing.md §"Request Lifecycle".
+ */
+
+import type { ProxyExport } from './proxy.js';
+import { getSetCookieHeaders } from './cookie-context.js';
+import { callOnRequestError } from './instrumentation.js';
+import { getTraceId } from './tracing.js';
+import { RedirectSignal } from './primitives.js';
+import type { ProxyConfig } from './pipeline.js';
+import { isRscRequest } from '../shared/rsc-media-type.js';
+
+// ─── Prototype-Pollution-Safe Sanitizer ────────────────────────────────────
+
+// ─── Proxy Resolver ────────────────────────────────────────────────────────
+
+/**
+ * Resolver closure produced once at pipeline construction. The lazy variant
+ * still calls `loader()` per-request (HMR relies on re-importing), but the
+ * choice of which branch to take is made once, not on every request.
+ */
+export type ProxyResolver = () => ProxyExport | Promise<ProxyExport>;
+
+/**
+ * Build a proxy resolver closure from the declared source. Called exactly
+ * once at `createPipeline` setup time, so the hot path sees only the branch
+ * that corresponds to this pipeline's configured variant.
+ *
+ * Returns `null` when the app has no proxy.ts — the hot path short-circuits
+ * around `runProxyPhase` entirely in that case.
+ *
+ * Accepts the sugar form (a bare `ProxyExport` — function or function array)
+ * and normalises it to the static variant. Functions and arrays are
+ * structurally distinct from the tagged `{ kind: 'lazy', loader }` object,
+ * so discrimination is unambiguous.
+ */
+export function makeProxyResolver(
+  proxy: ProxyConfig | ProxyExport | undefined
+): ProxyResolver | null {
+  if (proxy === undefined) return null;
+  // Sugar: a bare ProxyExport (function or function array) — treat as static.
+  if (typeof proxy === 'function' || Array.isArray(proxy)) {
+    const exp = proxy;
+    return () => exp;
+  }
+  if (proxy.kind === 'static') {
+    const exp = proxy.export;
+    return () => exp;
+  }
+  const loader = proxy.loader;
+  return async () => (await loader()).default;
+}
+
+// ─── Cookie / Header Helpers ───────────────────────────────────────────────
+
+/**
+ * Apply all Set-Cookie headers from the cookie jar to a Headers object.
+ * Each cookie gets its own Set-Cookie header per RFC 6265 §4.1.
+ */
+export function applyCookieJar(headers: Headers): void {
+  for (const value of getSetCookieHeaders()) {
+    headers.append('Set-Cookie', value);
+  }
+}
+
+/**
+ * Merge framework-managed response headers onto a terminal response without
+ * overwriting headers the terminal response already set itself.
+ */
+export function mergeMissingHeaders(target: Headers, source: Headers): void {
+  const existingKeys = new Set([...target.keys()].map((key) => key.toLowerCase()));
+  for (const [key, value] of source.entries()) {
+    if (!existingKeys.has(key.toLowerCase())) {
+      target.append(key, value);
+    }
+  }
+}
+
+// ─── Mutable Response Cloning ──────────────────────────────────────────────
+
+/**
+ * Clone a Response into a fresh one whose header bag is guaranteed mutable.
+ *
+ * `Response.redirect()` and some platform-level passthrough responses (notably
+ * on Cloudflare Workers) return objects with frozen header bags. Calling
+ * `.set()` or `.append()` on them throws `TypeError: immutable`, which the
+ * pipeline can hit when it appends Set-Cookie or Server-Timing entries.
+ *
+ * The pipeline calls this at the producer sites where user-controlled
+ * responses enter the framework — `outcomeToResponse` for all phase outcomes,
+ * and `handleRequest` for metadata-route and auto-sitemap user handlers — so
+ * downstream code can write headers without runtime feature-detection.
+ *
+ * The clone is unconditional. This is a deliberate trade: we avoid a
+ * try/catch + thrown `TypeError` on every request (the previous probe-based
+ * approach paid that cost on the hot path) and accept one cheap Response
+ * rewrap at the framework boundary instead.
+ */
+export function cloneWithMutableHeaders(response: Response): Response {
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: new Headers(response.headers),
+  });
+}
+
+// ─── Redirect Builder ──────────────────────────────────────────────────────
+
+/**
+ * Build a redirect Response from a RedirectSignal.
+ *
+ * For RSC payload requests (client navigation), returns 204 + X-Timber-Redirect
+ * so the client router can perform a soft SPA redirect. A raw 302 would be
+ * turned into an opaque redirect by fetch({redirect:'manual'}), crashing
+ * createFromFetch. See design/19-client-navigation.md.
+ */
+export function buildRedirectResponse(
+  signal: RedirectSignal,
+  req: Request,
+  headers: Headers
+): Response {
+  if (isRscRequest(req)) {
+    headers.set('X-Timber-Redirect', signal.location);
+    return new Response(null, { status: 204, headers });
+  }
+  headers.set('Location', signal.location);
+  return new Response(null, { status: signal.status, headers });
+}
+
+// ─── Instrumentation ───────────────────────────────────────────────────────
+
+/**
+ * Fire the user's onRequestError hook with request context.
+ * Extracts request info from the Request object and calls the instrumentation hook.
+ */
+export async function fireOnRequestError(
+  error: unknown,
+  req: Request,
+  phase: 'proxy' | 'handler' | 'render' | 'action' | 'route'
+): Promise<void> {
+  const url = new URL(req.url);
+  const headersObj: Record<string, string> = {};
+  req.headers.forEach((v, k) => {
+    headersObj[k] = v;
+  });
+
+  await callOnRequestError(
+    error,
+    { method: req.method, path: url.pathname, headers: headersObj },
+    { phase, routePath: url.pathname, routeType: 'page', traceId: getTraceId() }
+  );
+}