@timber-js/app 0.2.0-alpha.19 → 0.2.0-alpha.191

package/dist/server/children-interception.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Children-path interception — the sibling layout swap (TIM-1280).
+ *
+ * The second shape interception has. An intercepting directory that is a
+ * direct child of an ordinary segment or route group renders *in place of*
+ * `children` for that directory's own layout chain:
+ *
+ * ```
+ * app/(landing)/layout.tsx
+ * app/(landing)/[artistSlug]/[year]/[month]/[day]/page.tsx      ← hard nav
+ * app/(browse)/layout.tsx
+ * app/(browse)/(...)[artistSlug]/[year]/[month]/[day]/page.tsx  ← soft nav from (browse)
+ * ```
+ *
+ * There is no overlay, no slot, and no `default.tsx`. Nothing is re-matched
+ * either — and that is the point. The modal shape re-matches
+ * `interceptingPrefix`, a URL, and route groups contribute nothing to a URL,
+ * so an owner like `app/(browse)/` serializes to "/" and re-matching it
+ * resolves through whichever group owns the canonical page. This resolver
+ * addresses the owner by **tree path** instead, which never collapses.
+ *
+ * The result is an ordinary `RouteMatch` whose chain runs
+ * `[…owner ancestors, interceptingNode, …its matched descendants]`. Every
+ * consumer downstream — `tree-builder.ts`, the element builder, access gates,
+ * middleware — sees a segment chain and needs to know nothing about
+ * interception. That is why this feature adds no rendering path: the chain
+ * *is* the feature.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { RouteMatch } from './pipeline.js';
+import { type ManifestSegmentNode } from './route-matcher.js';
+/**
+ * Resolve a children-path interception to a complete route match.
+ *
+ * `interceptingScope` is the rewrite's own build-time field — the tree path of
+ * the directory that owns the interception. The pipeline has already
+ * established that the client's rendered tree passes through it; this
+ * translates it into the chain to render.
+ *
+ * Returns null when the scope names no directory in this manifest, or when no
+ * intercepting child of that directory matches the target. Both are fail-safe:
+ * the caller keeps the canonical target match, so the page the user gets is
+ * the one a hard navigation would have produced.
+ */
+export type InterceptedRouteMatcher = (targetPathname: string, interceptingScope: string) => RouteMatch | null;
+/** Build a children-path interception resolver over a runtime manifest. */
+export declare function createInterceptedRouteMatcher(root: ManifestSegmentNode): InterceptedRouteMatcher;
+//# sourceMappingURL=children-interception.d.ts.map

package/dist/server/children-interception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"children-interception.d.ts","sourceRoot":"","sources":["../../src/server/children-interception.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,KACtB,UAAU,GAAG,IAAI,CAAC;AAEvB,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,mBAAmB,GAAG,uBAAuB,CA4BhG"}

package/dist/server/coalesce-tick.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Single-shot `setImmediate` coalescing primitive.
+ *
+ * Multiple synchronous `schedule()` calls within one event-loop tick
+ * result in exactly one `flush` invocation at the end of that tick.
+ * No recursive scheduling, no busy-wait, no polling loop.
+ *
+ * Both `createBufferedTransformStream` (Web) and
+ * `createNodeBufferedTransform` (Node) use this helper so the invariant
+ * — and this comment — live in one place.
+ *
+ * **Not a polling loop.** Uses a single-shot `setImmediate` per flush
+ * cycle — no recursive scheduling, no busy-wait. See design/02
+ * §"No Polling".
+ */
+export interface TickCoalescer {
+    /**
+     * Request a flush at the end of the current tick. If a flush is already
+     * scheduled, this is a no-op. Returns the pending promise (or undefined
+     * if the flush already fired and no new one has been scheduled).
+     */
+    schedule(): void;
+    /**
+     * The pending flush promise, if any. Callers (e.g. `flush()` in a
+     * TransformStream) can `await` this to wait for the scheduled flush
+     * to complete before closing the stream.
+     */
+    readonly pending: Promise<void> | undefined;
+    /**
+     * Cancel any pending scheduled flush and invoke the flush callback
+     * synchronously. Used by Node `Transform.flush()` which needs to
+     * drain the buffer immediately before calling back.
+     */
+    flushSync(): void;
+}
+/**
+ * Create a tick coalescer that calls `onFlush` at most once per tick.
+ */
+export declare function createTickCoalescer(onFlush: () => void): TickCoalescer;
+//# sourceMappingURL=coalesce-tick.d.ts.map

package/dist/server/coalesce-tick.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce-tick.d.ts","sourceRoot":"","sources":["../../src/server/coalesce-tick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,IAAI,IAAI,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE5C;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,aAAa,CAgCtE"}

package/dist/server/compress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}

package/dist/server/cookie-context.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Cookie Context — per-request cookie API and on-the-wire helpers.
+ *
+ * Split out of `request-context.ts` (TIM-853) so the cookie subsystem
+ * — encoding contract, options grammar, parser, serializer, RYW map,
+ * and rerender seed — lives in one file. The headers/scope/params APIs
+ * stay in `request-context.ts` and call into this module via the
+ * exported helpers.
+ *
+ * See design/29-cookies.md for the encoding contract and read-your-own-
+ * writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the
+ * smuggling primitive that the encoding contract closes.
+ */
+import { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions } from '../cookies/validation.js';
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
+/**
+ * Returns a cookie accessor for the current request.
+ *
+ * Available in middleware, access checks, server components, and server actions.
+ * Throws if called outside a request context (security principle #2: no global fallback).
+ *
+ * Read methods (.get, .has, .getAll) are always available and reflect
+ * read-your-own-writes from .set() calls in the same request.
+ *
+ * Mutation methods (.set, .delete, .clear) are only available in mutable
+ * contexts (middleware.ts, server actions, route.ts handlers). Calling them
+ * in read-only contexts (access.ts, server components) throws.
+ *
+ * This is the escape hatch for direct cookie jar operations. For typed
+ * cookie access, use `defineCookie()` instead.
+ *
+ * See design/29-cookies.md
+ */
+export declare function getCookieJar(): RequestCookies;
+/**
+ * Returns the value of a single cookie, or undefined if absent.
+ *
+ * @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.
+ */
+export declare function getCookie(name: string): string | undefined;
+/**
+ * Per-call options for `getCookies().set()`. Extends the persistent
+ * `CookieOptions` (HTTP cookie attributes) with framework-only flags
+ * that are NOT serialized into the Set-Cookie header.
+ *
+ * The `raw` flag is the escape hatch for the auto-encoding contract.
+ * See design/29-cookies.md §"Encoding Contract".
+ */
+export interface SetCookieOptions extends CookieOptions {
+    /**
+     * Skip the framework's `encodeURIComponent` pass and store the value
+     * verbatim. The value is then validated against the strict RFC 6265
+     * §4.1.1 `cookie-octet` grammar — the H-3 smuggling primitive cannot
+     * sneak in via this opt-out.
+     *
+     * Use this when forwarding a cookie value that is already in its
+     * intended on-the-wire form (e.g. mirroring an upstream service's
+     * Set-Cookie). Default: `false` (auto-encode).
+     */
+    raw?: boolean;
+}
+/** Options for setting a cookie. See design/29-cookies.md. */
+export interface CookieOptions {
+    /** Domain scope. Default: omitted (current domain only). */
+    domain?: string;
+    /** URL path scope. Default: '/'. */
+    path?: string;
+    /** Expiration date. Mutually exclusive with maxAge. */
+    expires?: Date;
+    /** Max age in seconds. Mutually exclusive with expires. */
+    maxAge?: number;
+    /** Prevent client-side JS access. Default: true. */
+    httpOnly?: boolean;
+    /** Only send over HTTPS. Default: true. */
+    secure?: boolean;
+    /** Cross-site request policy. Default: 'lax'. */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
+    partitioned?: boolean;
+}
+/**
+ * Cookie accessor returned by `getCookies()`.
+ *
+ * Read methods are always available. Mutation methods throw in read-only
+ * contexts (access.ts, server components).
+ */
+export interface RequestCookies {
+    /** Get a cookie value by name. Returns undefined if not present. */
+    get(name: string): string | undefined;
+    /** Check if a cookie exists. */
+    has(name: string): boolean;
+    /** Get all cookies as an array of { name, value } pairs. */
+    getAll(): Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Number of cookies. */
+    readonly size: number;
+    /**
+     * Set a cookie. Only available in mutable contexts (middleware, actions,
+     * route handlers).
+     *
+     * The value is auto-encoded with `encodeURIComponent` so the on-the-wire
+     * bytes always satisfy RFC 6265 §4.1.1 cookie-octet — `cookies().get()`
+     * returns the same logical value the developer wrote. Pass `{ raw: true }`
+     * to skip the encoder; the raw path validates against the strict
+     * cookie-octet grammar instead. See design/29-cookies.md §"Encoding
+     * Contract" and ONGOING_SECURITY.md H-3 (TIM-868).
+     */
+    set(name: string, value: string, options?: SetCookieOptions): void;
+    /**
+     * Copy all `Set-Cookie` headers from a `Headers` object.
+     * Parses each header and forwards name, value, and all attributes
+     * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).
+     *
+     * Useful when forwarding cookies from an internal `fetch()` or auth handler:
+     * ```ts
+     * const response = await auth.handler(req);
+     * getCookies().then(c => c.setFromHeaders(response.headers));
+     * ```
+     */
+    setFromHeaders(headers: Headers): void;
+    /** Delete a cookie. Only available in mutable contexts. */
+    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
+    /** Delete all cookies. Only available in mutable contexts. */
+    clear(): void;
+    /** Serialize cookies as a Cookie header string. */
+    toString(): string;
+}
+/**
+ * Register a pre-parsed cookie map to use as the request context seed for
+ * the next `runWithRequestContext(req, …)` call with this exact `req`.
+ *
+ * Used by the no-JS form-rerender dispatcher in
+ * `rsc-entry/wrap-action-dispatch.ts` to thread the action's post-mutation
+ * cookie state into the rerender scope without serializing back through a
+ * `Cookie:` header. See TIM-868 / TIM-837.
+ *
+ * @internal — framework use only.
+ */
+export declare function seedRequestCookies(req: Request, cookies: Map<string, string>): void;
+/**
+ * Pop the seed (if any) for `req` and return it. Called from
+ * `runWithRequestContext` exactly once per request — the seed is consumed
+ * eagerly so it cannot leak into a hypothetical future re-use of the same
+ * Request reference.
+ *
+ * @internal — framework use only.
+ */
+export declare function consumeSeededCookies(req: Request): Map<string, string> | undefined;
+/**
+ * Build a Map of cookie name → value reflecting the current request's
+ * read-your-own-writes state. Includes incoming cookies plus any
+ * mutations from getCookies().set() / getCookies().delete() in the same request.
+ *
+ * Used by SSR renderers to populate NavContext.cookies so that
+ * useCookie()'s server snapshot matches the actual response state.
+ *
+ * See design/29-cookies.md §"Read-Your-Own-Writes"
+ * See design/triage/TIM-441-cookie-api-triage.md §4
+ */
+export declare function getCookiesForSsr(): Map<string, string>;
+/**
+ * Collect all Set-Cookie headers from the cookie jar.
+ * Called by the framework at flush time to apply cookies to the response.
+ *
+ * Returns an array of serialized Set-Cookie header values.
+ */
+export declare function getSetCookieHeaders(): string[];
+//# sourceMappingURL=cookie-context.d.ts.map

package/dist/server/cookie-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-context.d.ts","sourceRoot":"","sources":["../../src/server/cookie-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;AAInF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,cAAc,CAgL7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,2DAA2D;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,mDAAmD;IACnD,QAAQ,IAAI,MAAM,CAAC;CACpB;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKnF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAI9C"}

package/dist/server/cookie-parsing.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cookie parsing and serialization helpers — pure string ↔ structure
+ * functions with no ALS dependency. Split out of `cookie-context.ts`
+ * (TIM-853) so the API surface and the wire-format codecs can each be
+ * read on their own.
+ *
+ * The functions in this module are total over arbitrary input. They
+ * never throw and never call `assertValid*` (the security validators
+ * live in the API surface — `cookie-context.ts` invokes them at every
+ * jar entry point so the smuggling-primitive invariant from TIM-868
+ * is enforced regardless of which path produced the bytes).
+ *
+ * Delegates to the `cookie` package (RFC 6265, dependency-free,
+ * browser-safe) for wire codecs. Adapts at the boundary to preserve
+ * timber's Map-based API and never-throw contract.
+ */
+import type { CookieEntry } from './als-registry.js';
+import type { CookieOptions } from './cookie-context.js';
+/**
+ * Parse a Cookie header string into a Map of name → value pairs.
+ * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
+ *
+ * Values are auto-decoded with `decodeURIComponent` so they round-trip
+ * losslessly with `getCookies().set()` (which auto-encodes). Malformed
+ * `%`-escapes from third-party cookies fall back to the raw byte sequence
+ * — the parser must be total over arbitrary inbound headers, including
+ * non-conforming values from other servers, browser extensions, etc.
+ */
+export declare function parseCookieHeader(header: string): Map<string, string>;
+/**
+ * Decode a single cookie value with `decodeURIComponent`, falling back to
+ * the raw byte sequence if the input contains a malformed `%`-escape.
+ *
+ * Used by both `parseCookieHeader` (incoming Cookie: header) and the
+ * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
+ * Total — never throws.
+ *
+ * cookie's internal decode has identical semantics but is not exported,
+ * so we keep this standalone helper.
+ */
+export declare function safeDecodeCookieValue(raw: string): string;
+/**
+ * Serialize a CookieEntry into a Set-Cookie header value.
+ *
+ * Total — never throws. If the cookie package's serializer rejects
+ * the input (e.g. non-integer maxAge, forbidden chars in name/value),
+ * falls back to a minimal hand-rolled serialization so the response
+ * path is never interrupted by a codec error.
+ */
+export declare function serializeCookieEntry(entry: CookieEntry): string;
+/**
+ * Parse a raw `Set-Cookie` header string into name, value, and options.
+ * Handles all standard attributes: Path, Domain, Max-Age, Expires,
+ * SameSite, Secure, HttpOnly, Partitioned.
+ *
+ * Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether
+ * to merge defaults (e.g. `set()` does, but `setRaw()` should preserve
+ * the original header's intent).
+ */
+export declare function parseSetCookie(header: string): {
+    name: string;
+    value: string;
+    options: CookieOptions;
+} | null;
+//# sourceMappingURL=cookie-parsing.d.ts.map

package/dist/server/cookie-parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-parsing.d.ts","sourceRoot":"","sources":["../../src/server/cookie-parsing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0B/D;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CA8BhE"}

package/dist/server/csrf.d.ts

@@ -21,12 +21,13 @@ export type CsrfResult = {
     status: 403;
 };
 /**
- * Validate the Origin header against the request's Host.
+ * Validate the Origin header against the request's full origin
+ * (scheme + host + port).
  *
  * For mutation methods (POST, PUT, PATCH, DELETE):
  * - If `csrf: false`, skip validation.
  * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * - Otherwise, Origin must match the derived request origin.
  *
  * Safe methods (GET, HEAD, OPTIONS) always pass.
  */

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AASnE;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAuCzE"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAgCnE;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAgDzE"}

package/dist/server/default-logger.d.ts

@@ -0,0 +1,22 @@
+/**
+ * DefaultLogger — human-readable stderr logging when no custom logger is configured.
+ *
+ * Ships as the fallback so production deployments always have error visibility,
+ * even without an `instrumentation.ts` logger export. Output is one line per
+ * event, designed for `fly logs`, `kubectl logs`, Cloudflare dashboard tails, etc.
+ *
+ * Format:
+ *   [timber] ERROR  message  key=value key=value  trace_id=4bf92f35
+ *   [timber] WARN   message  key=value key=value  trace_id=4bf92f35
+ *   [timber] INFO   message  method=GET path=/dashboard status=200 durationMs=43  trace_id=4bf92f35
+ *
+ * Behavior:
+ * - Suppressed entirely in dev mode (dev logging handles all output)
+ * - `debug` suppressed unless TIMBER_DEBUG is set
+ * - Replaced entirely when a custom logger is set via `setLogger()`
+ *
+ * See design/17-logging.md §"DefaultLogger"
+ */
+import type { TimberLogger } from './logger.js';
+export declare function createDefaultLogger(): TimberLogger;
+//# sourceMappingURL=default-logger.d.ts.map

package/dist/server/default-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-logger.d.ts","sourceRoot":"","sources":["../../src/server/default-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0ChD,wBAAgB,mBAAmB,IAAI,YAAY,CAkClD"}

package/dist/server/default-status-page.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Framework default status page — the terminal fallback of the deny chain.
+ *
+ * design/10-error-handling.md §"Fallback Chain" ends every 4xx/5xx chain in a
+ * "framework default page". Before TIM-1258 that terminal did not exist: an app
+ * with no `404.tsx` / `4xx.tsx` / `error.tsx` got `Response(null, { status })` —
+ * a correct status code with an empty body. Browsers render that as a blank
+ * page, and static generation had nothing to write to `404.html`.
+ *
+ * This page is a plain HTML string rather than a React component on purpose:
+ * it is the *last* fallback, so it must not depend on the RSC → SSR pipeline
+ * (the machinery that may already have failed by the time we get here), and it
+ * must be renderable from the static build where no render environment exists.
+ * One builder is the single source of truth for both surfaces.
+ *
+ * Security: the page interpolates nothing but the status code, and the code is
+ * clamped to a plain integer before it reaches the markup. No request URL, no
+ * error message, no stack — see design/13-security.md principle 4.
+ */
+/** HTML content type used for every framework default page response. */
+export declare const DEFAULT_STATUS_PAGE_CONTENT_TYPE = "text/html; charset=utf-8";
+/** Human-readable phrase for a status code. Never caller-supplied text. */
+export declare function statusReasonPhrase(status: number): string;
+/**
+ * Build the framework default page for a status code as a full HTML document.
+ *
+ * The document is self-contained: no scripts, no external resources, no client
+ * JavaScript. It renders identically in `server` mode, in `static` mode's
+ * generated `404.html`, and with `clientJavascript: false`.
+ */
+export declare function defaultStatusPageHtml(status: number): string;
+/**
+ * Build the framework default page as an HTTP `Response`.
+ *
+ * `responseHeaders` carries whatever middleware/proxy already set (cookies,
+ * cache directives); the content type is overwritten because the body is
+ * always HTML regardless of what the route would have produced.
+ *
+ * The body is unconditional. HEAD is not this function's problem: the pipeline
+ * strips HEAD bodies at its single exit for every response shape, so a
+ * `method` parameter here would be one renderer's private copy of a rule that
+ * now holds framework-wide (TIM-1324).
+ */
+export declare function defaultStatusPageResponse(status: number, responseHeaders: Headers): Response;
+//# sourceMappingURL=default-status-page.d.ts.map

package/dist/server/default-status-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-status-page.d.ts","sourceRoot":"","sources":["../../src/server/default-status-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA+BH,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAc3E,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAG,QAAQ,CAG5F"}