@timber-js/app 0.2.0-alpha.19 → 0.2.0-alpha.191

package/dist/client/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/client/router.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAoB,MAAM,iBAAiB,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAS1C,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AAEtE;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,YAAY,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,kGAAkG;IAClG,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,mFAAmF;IACnF,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAC5C,mFAAmF;IACnF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,IAAI,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,KACtE,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,kDAAkD;IAClD,SAAS,IAAI,OAAO,CAAC;IACrB,4DAA4D;IAC5D,aAAa,IAAI,MAAM,GAAG,IAAI,CAAC;IAC/B,yCAAyC;IACzC,eAAe,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClE,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC9E;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,gEAAgE;IAChE,YAAY,EAAE,YAAY,CAAC;IAC3B,iEAAiE;IACjE,aAAa,EAAE,aAAa,CAAC;IAC7B,4CAA4C;IAC5C,YAAY,EAAE,YAAY,CAAC;CAC5B;AAcD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAwW7D"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/client/router.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAqB,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIvF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAoY7D"}

package/dist/client/rsc-fetch.d.ts

@@ -10,34 +10,95 @@
  *
  * See design/19-client-navigation.md §"RSC Payload Handling"
  */
-import type { SegmentInfo } from './segment-cache';
-import type { HeadElement } from './head';
-import type { RouterDeps } from './router';
-/** Result of fetching an RSC payload — includes head elements and segment metadata. */
+import type { RscManifest } from '../shared/rsc-manifest.js';
+import { type PublishedParams } from '../shared/payload-root.js';
+import type { SegmentInfo, StateTree } from '../shared/segment-info.js';
+import type { RouterDeps } from './router-types.js';
+/** Result of fetching an RSC payload — includes segment metadata. */
 export interface FetchResult {
+    /** The renderable tree, split off the payload root. */
     payload: unknown;
-    headElements: HeadElement[] | null;
+    /**
+     * The params the same payload published beside that tree.
+     *
+     * Not a separate channel: both fields come out of one `splitPayloadRoot`
+     * call on one decoded root, so a response cannot deliver a tree and another
+     * route's params. They used to arrive on their own header, which is how a
+     * navigation could render one route and publish another's (TIM-1285,
+     * TIM-1294).
+     */
+    params: PublishedParams | Promise<PublishedParams>;
+    /**
+     * Promise that settles when the RSC decode completes or fails.
+     * The payload thenable is NOT awaited before returning (for streaming),
+     * so callers must monitor this to catch async decode errors
+     * (truncated streams, Flight parse failures) that would otherwise
+     * become unhandled rejections.
+     */
+    decodePromise: Promise<void> | null;
     /** Segment metadata from X-Timber-Segments header for populating the segment cache. */
     segmentInfo: SegmentInfo[] | null;
-    /** Route params from X-Timber-Params header for populating useParams(). */
-    params: Record<string, string | string[]> | null;
     /** Segment paths that were skipped by the server (for client-side merging). */
     skippedSegments: string[] | null;
+    /**
+     * HTTP status of the navigation response.
+     *
+     * Read at the commit site to decide whether the tree this payload produced
+     * is one worth caching. A deny page replaced a subtree, so `segmentInfo`
+     * describes more than actually mounted — but it cannot simply be emptied,
+     * because the merge point is chosen out of it. See TIM-1356.
+     */
+    status: number;
 }
-export declare const RSC_CONTENT_TYPE = "text/x-component";
-export declare function buildRscHeaders(stateTree: {
-    segments: string[];
-} | undefined, currentUrl?: string): Record<string, string>;
+/** Set the client deployment ID. Called once at bootstrap. */
+export declare function setClientDeploymentId(id: string | null): void;
+/** Get the client deployment ID. */
+export declare function getClientDeploymentId(): string | null;
+/** Set the deployment base path. Called once at bootstrap. */
+export declare function setBasePath(base: string | undefined): void;
+/** Get the normalized deployment base path. @internal Exported for testing. */
+export declare function getBasePath(): string;
+export declare function setStaticMode(enabled: boolean): void;
+export declare function isStaticMode(): boolean;
+/** @internal Exported for testing. */
+export declare function setRscManifest(manifest: RscManifest | null): void;
 /**
- * Extract head elements from the X-Timber-Head response header.
- * Returns null if the header is missing or malformed.
+ * Compute the unhashed `_rsc/*.rsc` path for a route URL.
+ *
+ * Returns a **route-space** path: the deployment base is stripped from the
+ * incoming URL and is NOT re-applied, because this value doubles as the RSC
+ * manifest key, and the manifest is base-less. `toStaticRscUrl` applies the
+ * base to whatever is actually fetched.
+ *
+ * @internal Exported for testing.
  */
-export declare function extractHeadElements(response: Response): HeadElement[] | null;
+export declare function toUnhashedRscUrl(url: string): string;
+/** Header name used by the server to signal a version skew reload. */
+export declare const RELOAD_HEADER = "X-Timber-Reload";
+/** Header name for the client's deployment ID. */
+export declare const DEPLOYMENT_ID_HEADER = "X-Timber-Deployment-Id";
+/**
+ * Check if a response signals a version skew reload.
+ * Triggers a full page reload if the server indicates the client is stale.
+ */
+export declare function checkReloadSignal(response: Response): boolean;
+/**
+ * Build the headers for an RSC payload request.
+ *
+ * **Every header added here is hashed into the payload URL** as the `_rsc`
+ * cache key (see `rscCacheKey`), and URLs are logged by proxies, CDNs, and
+ * origin access logs. So: no credentials, no session identifiers, no
+ * user-supplied content. `fnv1aHash` is a cache-key hash, not a KDF — a
+ * low-entropy secret would be recoverable from the URL by brute force.
+ * Authentication already travels on cookies, which are not part of this
+ * object and never enter the key.
+ */
+export declare function buildRscHeaders(stateTree: StateTree | undefined, currentUrl?: string): Record<string, string>;
 /**
  * Extract segment metadata from the X-Timber-Segments response header.
  * Returns null if the header is missing or malformed.
  *
- * Format: JSON array of {path, isAsync} objects describing the rendered
+ * Format: JSON array of {path, isRequestDependent} objects describing the rendered
  * segment chain from root to leaf. Used to populate the client-side
  * segment cache for state tree diffing on subsequent navigations.
  */
@@ -51,13 +112,6 @@ export declare function extractSegmentInfo(response: Response): SegmentInfo[] |
  * The client uses this to merge the partial payload with cached segments.
  */
 export declare function extractSkippedSegments(response: Response): string[] | null;
-/**
- * Extract route params from the X-Timber-Params response header.
- * Returns null if the header is missing or malformed.
- *
- * Used to populate useParams() after client-side navigation.
- */
-export declare function extractParams(response: Response): Record<string, string | string[]> | null;
 /**
  * Thrown when an RSC payload response contains X-Timber-Redirect header.
  * Caught in navigate() to trigger a soft router navigation to the redirect target.
@@ -66,15 +120,48 @@ export declare class RedirectError extends Error {
     readonly redirectUrl: string;
     constructor(url: string);
 }
+/**
+ * Thrown when the server signals a version skew (X-Timber-Reload header).
+ * Caught in navigate() to trigger a full page reload.
+ * See TIM-446.
+ */
+export declare class VersionSkewError extends Error {
+    constructor();
+}
+/**
+ * Thrown when the server returns an error for an RSC payload request.
+ * The server sends X-Timber-Error header and a JSON body instead of a
+ * broken RSC stream for any RenderError (4xx or 5xx). Caught in
+ * navigate() to trigger a hard navigation so the server can render
+ * the error page as HTML.
+ *
+ * See design/10-error-handling.md §"Error Page Rendering for Client Navigation"
+ */
+export declare class ServerErrorResponse extends Error {
+    readonly status: number;
+    readonly url: string;
+    constructor(status: number, url: string);
+}
+/**
+ * Thrown when the RSC fetch response has a Content-Type that is not
+ * text/x-component — e.g., a static asset (image, CSS, JS) served
+ * for a same-origin URL that isn't a route. The response body is
+ * cancelled immediately (headers-only cost). Caught in navigate()
+ * to trigger a hard navigation; caught in prefetch() to store a
+ * negative cache entry so click hard-navigates without a second fetch.
+ *
+ * See TIM-1231.
+ */
+export declare class NonRscResponse extends Error {
+    readonly url: string;
+    constructor(url: string);
+}
 /**
  * Fetch an RSC payload from the server. If a decodeRsc function is provided,
  * the response is decoded into a React element tree via createFromFetch.
  * Otherwise, the raw response text is returned (test mode).
- *
- * Also extracts head elements from the X-Timber-Head response header
- * so the client can update document.title and <meta> tags after navigation.
  */
 export declare function fetchRscPayload(url: string, deps: RouterDeps, stateTree?: {
     segments: string[];
-}, currentUrl?: string): Promise<FetchResult>;
+}, currentUrl?: string, signal?: AbortSignal): Promise<FetchResult>;
 //# sourceMappingURL=rsc-fetch.d.ts.map

package/dist/client/rsc-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-fetch.d.ts","sourceRoot":"","sources":["../../src/client/rsc-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAI3C,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IACjD,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAClC;AAID,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AA2BnD,wBAAgB,eAAe,CAC7B,SAAS,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,EAC7C,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,EAAE,GAAG,IAAI,CAQ5E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,EAAE,GAAG,IAAI,CAQ3E;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAQ1F;AAID;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBACjB,GAAG,EAAE,MAAM;CAIxB;AAID;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,EAClC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAuDtB"}
+{"version":3,"file":"rsc-fetch.d.ts","sourceRoot":"","sources":["../../src/client/rsc-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;OAQG;IACH,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,uFAAuF;IACvF,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAiDD,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7D;AAED,oCAAoC;AACpC,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAgBD,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE1D;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAYD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEpD;AAED,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAkBD,sCAAsC;AACtC,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEjE;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYpD;AAkCD,sEAAsE;AACtE,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAE/C,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE7D;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAeD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,EAAE,GAAG,IAAI,CAS3E;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI,CAU1E;AAID;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,YAAY,GAAG,EAAE,MAAM,EAGtB;CACF;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,cAEC;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAItC;CACF;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY,GAAG,EAAE,MAAM,EAGtB;CACF;AAqDD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,EAClC,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAsLtB"}

package/dist/client/segment-cache.d.ts

@@ -1,14 +1,33 @@
-import type { HeadElement } from './head';
-/** A prefetched RSC result with optional head elements and segment metadata. */
+import type { PublishedParams } from '../shared/payload-root.js';
+import type { SegmentInfo, StateTree } from '../shared/segment-info.js';
+/** A prefetched RSC result with optional segment metadata. */
 export interface PrefetchResult {
     payload: unknown;
-    headElements: HeadElement[] | null;
+    /**
+     * Completion of the full Flight stream, when the prefetch is still decoding.
+     * Carried through to the navigation that consumes the entry so a decode
+     * failure reaches *that* navigation's recovery rather than dying with the
+     * prefetch (TIM-1275).
+     */
+    decodePromise?: Promise<void> | null;
     /** Segment metadata from X-Timber-Segments header for populating the segment cache. */
     segmentInfo?: SegmentInfo[] | null;
-    /** Route params from X-Timber-Params header for populating useParams(). */
-    params?: Record<string, string | string[]> | null;
+    /**
+     * The params published beside `payload`, split off the same payload root.
+     * Carried so a consumed prefetch publishes the params of the tree it is
+     * about to render, and not the ones already on screen.
+     */
+    params?: PublishedParams | Promise<PublishedParams>;
     /** Segment paths skipped by the server (for client-side merging). */
     skippedSegments?: string[] | null;
+    /**
+     * HTTP status of the prefetched response. A deny payload is an ordinary
+     * Flight response carrying a 4xx, so it prefetches and caches like any
+     * other — and the tree it renders is one the segment cache must not learn
+     * from. Absent on entries that predate the field, and on the negative
+     * sentinel. See TIM-1356.
+     */
+    status?: number;
 }
 /**
  * A node in the client-side segment tree. Each node represents a mounted
@@ -17,19 +36,33 @@ export interface PrefetchResult {
 export interface SegmentNode {
     /** The segment's URL pattern (e.g., "/", "/dashboard", "/projects/[id]") */
     segment: string;
+    /**
+     * The segment's `app/` directory path, groups included (e.g. `/(browse)/feed`).
+     * Undefined for slot nodes and for servers that predate the field.
+     */
+    treePath?: string;
     /** The RSC flight payload for this segment (opaque to the cache) */
     payload: unknown;
-    /** Whether the segment is async (async layouts always re-render on navigation) */
-    isAsync: boolean;
+    /**
+     * Whether the segment/slot is request-dependent (calls getHeaders,
+     * getSearchParams, cookies, etc.). Request-dependent segments always
+     * re-render on navigation. For segments, this is still based on the
+     * AsyncFunction heuristic (to be replaced separately). For slots,
+     * this is taint-tracked via ALS.
+     */
+    isRequestDependent: boolean;
     /** Child segments keyed by segment path */
     children: Map<string, SegmentNode>;
-}
-/**
- * Serialized state tree sent via X-Timber-State-Tree header.
- * Only sync segments are included — async segments always re-render.
- */
-export interface StateTree {
-    segments: string[];
+    /** Parallel route slots keyed by slot path (e.g., "/@sidebar") */
+    slots?: Map<string, SegmentNode>;
+    /** Whether this slot's access.ts denied on its last render. */
+    denied?: boolean;
+    /**
+     * Content key for slot nodes — opaque string the server computed from
+     * owner parts, slot name, entry file, and slot params. Advertised back
+     * to the server so it can decide skips by key membership (TIM-1370).
+     */
+    contentKey?: string;
 }
 /**
  * Maintains the client-side segment tree representing currently mounted
@@ -51,19 +84,18 @@ export declare class SegmentCache {
      * client can actually merge (i.e., segments whose cached element tree
      * contains an inner SegmentProvider the merger can splice into).
      *
+     * `treePaths` is collected UNFILTERED, unlike `segments` and `slots`. Those
+     * two answer "what may the server skip re-rendering?", so every reason a
+     * segment cannot be reused is a reason to leave it out. `treePaths` answers
+     * "what is mounted right now?" for interception scoping — a request-dependent
+     * layout is still on screen, and dropping it would silently narrow the scope
+     * the server sees and cancel a modal that should open (TIM-1282).
+     *
      * This is a performance optimization only, NOT a security boundary.
      * The server always runs all access.ts files regardless of the state tree.
      */
     serializeStateTree(mergeableFilter?: Set<string>): StateTree;
 }
-/**
- * Segment metadata from the server, sent via X-Timber-Segments header.
- * Describes a rendered segment's path and whether it's async.
- */
-export interface SegmentInfo {
-    path: string;
-    isAsync: boolean;
-}
 /**
  * Build a SegmentNode tree from flat segment metadata.
  *
@@ -76,6 +108,45 @@ export interface SegmentInfo {
  * from the tree — pages are never cached across navigations.
  */
 export declare function buildSegmentTree(segments: SegmentInfo[]): SegmentNode | undefined;
+/**
+ * Identifies a prefetched payload. A payload is addressed by *every* input that
+ * changes the server's answer, not by the destination alone.
+ *
+ * The server's answer for a destination depends on where the request came
+ * from — that is the whole mechanism behind intercepting routes, and it also
+ * drives slot-skip resolution. A prefetch issued from `/gallery` is a modal
+ * payload; the same URL prefetched from `/` is the full page. Keying on the
+ * destination alone let the first click after a hover be answered with
+ * whichever variant happened to be fetched (TIM-1265).
+ *
+ * `from` alone stopped being enough in TIM-1282. It is a pathname, and once
+ * interception scope comes from the rendered tree rather than the address, one
+ * pathname no longer names one source tree: `/photo/1` is the address both for
+ * a modal open over `(browse)` and for `(landing)`'s canonical page. A key
+ * without the scope hands the modal payload to the canonical page's click,
+ * which renders it without the server's scope check ever running.
+ *
+ * The two reads happen at different instants — `scope` is sampled at hover and
+ * again at click — which is why a tree that changed in between produces a
+ * *miss* and a refetch rather than a wrong hit.
+ */
+export interface PrefetchKey {
+    /** Destination URL — hash-less `pathname + search`, as navigate() fetches it. */
+    url: string;
+    /** Departing pathname — the `X-Timber-URL` the prefetch was issued with. */
+    from: string;
+    /**
+     * The rendered scope the prefetch was issued with — the `treePaths` half of
+     * `X-Timber-State-Tree`, joined. Empty when none crossed.
+     */
+    scope: string;
+}
+/**
+ * The `scope` half of a `PrefetchKey`, derived from the state tree that will
+ * actually be sent. Taking it from the header value rather than re-walking the
+ * cache is the point: the key varies by exactly what the request varies by.
+ */
+export declare function prefetchScopeOf(stateTree: StateTree | undefined): string;
 /**
  * Short-lived cache for hover-triggered prefetches. Entries expire after
  * 30 seconds. When a link is clicked, the prefetched payload is consumed
@@ -87,9 +158,20 @@ export declare function buildSegmentTree(segments: SegmentInfo[]): SegmentNode |
 export declare class PrefetchCache {
     private static readonly TTL_MS;
     private entries;
-    set(url: string, result: PrefetchResult): void;
-    get(url: string): PrefetchResult | undefined;
+    set(key: PrefetchKey, result: PrefetchResult): void;
+    get(key: PrefetchKey): PrefetchResult | undefined;
     /** Get and remove the entry (used when navigation consumes a prefetch) */
-    consume(url: string): PrefetchResult | undefined;
+    consume(key: PrefetchKey): PrefetchResult | undefined;
+    /**
+     * Store a negative entry — the URL is not a route (non-RSC Content-Type).
+     *
+     * Keyed like every other entry even though "not a route" does not actually
+     * vary by departing URL: a source-independent negative would be a second
+     * keying rule to keep correct, and the only cost of the uniform one is a
+     * repeated fetch for a link hovered from a second page.
+     */
+    setNegative(key: PrefetchKey): void;
+    /** Check if the entry is a negative cache entry (URL is not a route). */
+    isNegative(key: PrefetchKey): boolean;
 }
 //# sourceMappingURL=segment-cache.d.ts.map

package/dist/client/segment-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segment-cache.d.ts","sourceRoot":"","sources":["../../src/client/segment-cache.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAI1C,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAClD,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAA0B;IAEtC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAO7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI;IAM7C,KAAK,IAAI,IAAI;IAIb;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;CAO7D;AAkBD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,WAAW,GAAG,SAAS,CA+BjF;AASD;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAU;IACxC,OAAO,CAAC,OAAO,CAAoC;IAEnD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI;IAO9C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAU5C,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;CAOjD"}
+{"version":3,"file":"segment-cache.d.ts","sourceRoot":"","sources":["../../src/client/segment-cache.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAIxE,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,uFAAuF;IACvF,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnC,kEAAkE;IAClE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACjC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAA0B;IAEtC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAK5C;IAED,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAI5C;IAED,KAAK,IAAI,IAAI,CAEZ;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,kBAAkB,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAiB3D;CACF;AAsDD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,WAAW,GAAG,SAAS,CAmEjF;AAYD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAWD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAExE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAU;IACxC,OAAO,CAAC,OAAO,CAAoC;IAEnD,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAKlD;IAED,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAShD;IAED,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAMpD;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAElC;IAED,yEAAyE;IACzE,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEpC;CACF"}

package/dist/client/segment-outlet.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SegmentOutlet — client component boundary at each layout segment.
+ *
+ * Each layout in the segment tree is wrapped with a SegmentOutlet that:
+ * 1. Knows its segment path (prop from the server)
+ * 2. Reads from SegmentUpdateContext for partial navigation updates
+ * 3. Caches its rendered content in a ref across navigations
+ *
+ * On full navigation: receives new children via props, caches and renders them.
+ * On partial navigation (this segment skipped): the context map has no entry
+ * for this path, so the outlet returns cached content — preserving layout state.
+ * On partial navigation (this segment updated): the context map has content
+ * for this path, so the outlet renders the update.
+ *
+ * Uses React context instead of useSyncExternalStore to stay compatible
+ * with concurrent rendering (transitions). All outlets re-render when the
+ * context value changes, but each bails out quickly if its segment has
+ * no update — same approach as Next.js LayoutRouter.
+ *
+ * Security: performance optimization only. The server always runs all
+ * access.ts files regardless of segment skipping.
+ * See design/13-security.md §"State tree manipulation".
+ */
+import { type ReactNode } from 'react';
+export interface SegmentOutletProps {
+    /**
+     * Unique identifier for this segment. For normal segments this is the
+     * urlPath (e.g., "/", "/dashboard"). For route groups this includes the
+     * group name (e.g., "/(marketing)") to distinguish siblings that share
+     * the same urlPath. For slots this includes the slot name (e.g., "/@sidebar").
+     * Must match the segmentId used in state-tree-diff.ts.
+     */
+    segmentPath: string;
+    /** The segment's React subtree (layout + inner content). */
+    children: ReactNode;
+    /**
+     * When true, the outlet returns cached content instead of rendering
+     * new children. Used for skipped parallel route slots — the server
+     * sends an empty SegmentOutlet with skip=true, and the client keeps
+     * the previously cached slot content.
+     */
+    skip?: boolean;
+}
+/**
+ * Client component boundary at each layout segment in the element tree.
+ *
+ * On full navigation (context map is empty): renders children, caches in ref.
+ * On partial navigation: checks the context map for an update at segmentPath.
+ *   - Update found → renders update, caches in ref.
+ *   - No update → returns cached content (layout state preserved).
+ *
+ * React preserves component instances across reactRoot.render() calls
+ * when the same type appears at the same tree position. The ref persists
+ * across navigations because SegmentOutlet is reconciled, not remounted.
+ */
+export declare function SegmentOutlet({ segmentPath, children, skip }: SegmentOutletProps): ReactNode;
+//# sourceMappingURL=segment-outlet.d.ts.map

package/dist/client/segment-outlet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-outlet.d.ts","sourceRoot":"","sources":["../../src/client/segment-outlet.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAG3D,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB,4DAA4D;IAC5D,QAAQ,EAAE,SAAS,CAAC;IAEpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,kBAAkB,aA8ChF"}

package/dist/client/segment-update-context.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SegmentUpdateContext — React context for partial navigation updates.
+ *
+ * During partial navigation (server skips unchanged sync layouts), the
+ * router builds a Map of segment path → ReactNode updates and passes it
+ * as the context value. Mounted SegmentOutlet components read from this
+ * context to decide whether to render the update or their cached content.
+ *
+ * SINGLETON GUARANTEE: Uses globalThis + Symbol.for — same pattern as
+ * NavigationContext. The RSC client bundler can duplicate this module
+ * across chunks (browser-entry graph + client-reference graph). With
+ * ESM output, each chunk gets its own module scope — a bare createContext
+ * at module level would create separate instances per chunk. globalThis
+ * guarantees a single instance regardless of duplication.
+ *
+ * See design/19-client-navigation.md §"Singleton Guarantee via globalThis"
+ */
+import React, { type ReactNode } from 'react';
+export declare const EMPTY_SEGMENT_UPDATES: Map<string, ReactNode>;
+export declare const SegmentUpdateContext: React.Context<Map<string, ReactNode>>;
+//# sourceMappingURL=segment-update-context.d.ts.map

package/dist/client/segment-update-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-update-context.d.ts","sourceRoot":"","sources":["../../src/client/segment-update-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE9C,eAAO,MAAM,qBAAqB,wBAA+B,CAAC;AAmBlE,eAAO,MAAM,oBAAoB,uCAAuB,CAAC"}

package/dist/client/shallow-url.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shallow URL replacement — update the browser URL bar without triggering
+ * RSC navigation, TopLoader, or any server round-trip.
+ *
+ * Uses the Navigation API's `info: { shallow: true }` when available (Chrome),
+ * which the navigate event handler intercepts with a no-op handler. Falls back
+ * to raw `history.replaceState` (Safari/Firefox — no navigate event fired).
+ */
+export declare function replaceUrl(url: string): void;
+//# sourceMappingURL=shallow-url.d.ts.map

package/dist/client/shallow-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shallow-url.d.ts","sourceRoot":"","sources":["../../src/client/shallow-url.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAU5C"}

package/dist/client/slot-context.d.ts

@@ -0,0 +1,31 @@
+/**
+ * SlotContext — delivers live slot content to SlotOutlet holes inside
+ * cached component shells (TIM-1173).
+ *
+ * A `cache.component(Fn, { slots: [...] })` shell is captured with a
+ * stable <SlotOutlet slot={name} /> client reference in place of each
+ * declared slot prop. At request time the revived shell is wrapped in a
+ * SlotsProvider carrying the live slot values; each outlet reads its
+ * value from this context by name.
+ *
+ * Providers MERGE per-key with their parent: an inner SlotsProvider
+ * inherits the outer's values and overrides only the keys it declares.
+ * Two sibling instances each have their own provider and resolve
+ * independently. Layouts use a reserved slot name (LAYOUT_CHILDREN_SLOT)
+ * that cannot collide with user-declared slot names (TIM-1191).
+ *
+ * Generalizes the original layout children pattern (TIM-1181) from a
+ * single implicit `children` hole on layouts to explicitly declared,
+ * named slot props on any cached component. Layouts use this same
+ * context with the reserved LAYOUT_CHILDREN_SLOT key (TIM-1191).
+ *
+ * SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
+ * can duplicate this module across chunks; globalThis guarantees a single
+ * context instance.
+ *
+ * See design/45-cache-lifetimes.md §Slot Components.
+ */
+import React, { type ReactNode } from 'react';
+export type SlotValues = Record<string, ReactNode>;
+export declare const SlotContext: React.Context<SlotValues | null>;
+//# sourceMappingURL=slot-context.d.ts.map

package/dist/client/slot-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-context.d.ts","sourceRoot":"","sources":["../../src/client/slot-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE9C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAiBnD,eAAO,MAAM,WAAW,kCAAuB,CAAC"}

package/dist/client/slot-outlet.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SlotOutlet — the hole in a cached component shell (TIM-1173).
+ *
+ * At capture time the prebuilt runtime renders the wrapped component with
+ * <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
+ * client component, it serializes into the flight payload as a stable,
+ * deterministic client reference — the same bytes regardless of what live
+ * content will fill the hole. At request time the revived shell sits under
+ * a SlotsProvider and each outlet reads its live value from SlotContext.
+ *
+ * See design/45-cache-lifetimes.md §Slot Components.
+ */
+export declare function SlotOutlet({ slot }: {
+    slot: string;
+}): string | number | bigint | boolean | Iterable<import("react").ReactNode> | Promise<string | number | bigint | boolean | Iterable<import("react").ReactNode> | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | import("react").ReactPortal | null | undefined> | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | null;
+//# sourceMappingURL=slot-outlet.d.ts.map

package/dist/client/slot-outlet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-outlet.d.ts","sourceRoot":"","sources":["../../src/client/slot-outlet.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,kZAGpD"}

package/dist/client/slot-provider.d.ts

@@ -0,0 +1,25 @@
+/**
+ * SlotsProvider — wraps a revived cached shell to supply live slot content
+ * to the SlotOutlet holes inside it (TIM-1173).
+ *
+ * Values MERGE with the nearest parent provider so that nesting a
+ * cache.component SlotsProvider inside a layout SlotsProvider preserves
+ * the layout's `children` slot while adding the component's own slots.
+ * Inner values override outer ones with the same name (spread order).
+ *
+ * Tree structure per cached-component instance:
+ *   SlotsProvider(values={children: <Live />})
+ *     └── revived shell
+ *          └── SlotOutlet(slot="children") → reads context → <Live />
+ *
+ * See design/45-cache-lifetimes.md §Slot Components.
+ */
+import { type ReactNode } from 'react';
+import { type SlotValues } from './slot-context.js';
+interface SlotsProviderProps {
+    values: SlotValues;
+    children: ReactNode;
+}
+export declare function SlotsProvider({ values, children }: SlotsProviderProps): import("react").FunctionComponentElement<import("react").ProviderProps<SlotValues | null>>;
+export {};
+//# sourceMappingURL=slot-provider.d.ts.map

package/dist/client/slot-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-provider.d.ts","sourceRoot":"","sources":["../../src/client/slot-provider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEjE,UAAU,kBAAkB;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,kBAAkB,8FAIrE"}

package/dist/client/ssr-data.d.ts

@@ -21,6 +21,8 @@
  * All mutable state is delegated to client/state.ts for singleton guarantees.
  * See design/18-build-system.md §"Singleton State Registry"
  */
+import type { CoercedParams } from '../shared/param-value.js';
+import type { SlotParamsRecord } from '../shared/slot-params.js';
 export interface SsrData {
     /** The request's URL pathname (e.g. '/dashboard/settings') */
     pathname: string;
@@ -29,14 +31,28 @@ export interface SsrData {
     /** The request's cookies as name→value pairs */
     cookies: Map<string, string>;
     /** The request's route params (e.g. { id: '123' }) */
-    params: Record<string, string | string[]>;
+    params: CoercedParams;
     /**
-     * Mutable reference to NavContext for error boundary → RSC communication.
-     * When TimberErrorBoundary catches a DenySignal, it sets
-     * `_navContext._denyHandledByBoundary = true` to prevent the RSC entry
-     * from promoting the denial to page-level. See LOCAL-298.
+     * Per-slot params keyed by slot tree path, absent when the request rendered
+     * no slot with params of its own (TIM-1285).
+     */
+    slotParams?: SlotParamsRecord;
+    /**
+     * Mutable reference to NavContext for error boundary → pipeline communication.
+     *
+     * When TimberErrorBoundary catches a DenySignal during SSR, it:
+     * 1. Sets `statusCode` to the deny status (e.g., 403) — so the HTTP
+     *    Response has the correct status code without a re-render.
+     * 2. Sets `_denyHandledByBoundary = true` — so the pipeline skips
+     *    the redundant renderDenyPage() re-render.
+     *
+     * This runs synchronously during Fizz rendering, BEFORE onShellReady,
+     * so the status code is committed before any bytes are sent.
+     *
+     * See TIM-664, design/04-authorization.md §"React.cache Scope in Deny/Error Re-renders"
      */
     _navContext?: {
+        statusCode?: number;
         _denyHandledByBoundary?: boolean;
     };
 }

package/dist/client/ssr-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-data.d.ts","sourceRoot":"","sources":["../../src/client/ssr-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAWH,MAAM,WAAW,OAAO;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gDAAgD;IAChD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAkBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAEjF;AAMD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,OAAO,GAAG,SAAS,CAKhD"}
+{"version":3,"file":"ssr-data.d.ts","sourceRoot":"","sources":["../../src/client/ssr-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjE,MAAM,WAAW,OAAO;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gDAAgD;IAChD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sDAAsD;IACtD,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACzE;AAkBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAEjF;AAMD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,OAAO,GAAG,SAAS,CAKhD"}