@timber-js/app 0.2.0-alpha.191 → 0.2.0-alpha.194

package/dist/server/internal.js

@@ -1,13 +1,13 @@
-import { n as isRscRequest } from "../_chunks/rsc-media-type-DRqE_lD_.js";
-import { a as canonicalize, c as getMetadataRouteAutoLink, l as getMetadataRouteServePath, o as METADATA_ROUTE_CONVENTIONS, s as classifyMetadataRoute, t as computeSegmentTreePaths } from "../_chunks/segment-keys-BawYuNFO.js";
+import { n as isRscContentType, r as isRscRequest } from "../_chunks/rsc-media-type-DDc7duTD.js";
+import { a as canonicalize, c as getMetadataRouteAutoLink, l as getMetadataRouteServePath, o as METADATA_ROUTE_CONVENTIONS, s as classifyMetadataRoute, t as computeSegmentTreePaths } from "../_chunks/segment-keys-BhqoHiLc.js";
+import { n as isMdxFilePath } from "../_chunks/mdx-file-CXyHGUpS.js";
 import { n as classifyUrlSegment, r as effectiveUrlSegment } from "../_chunks/segment-classify-C539Pa2O.js";
 import { a as timingAls, r as requestContextAls, t as earlyHintsSenderAls } from "../_chunks/als-registry-C6kcfprT.js";
-import { A as setMatchedSegmentPath, C as applyRequestHeaderOverlay, D as getSegmentParams, E as getSearchParams, F as getSetCookieHeaders, G as replaceTraceId, H as getOtelTraceId, I as getWaitUntil, J as withSpan, K as runWithTraceId, L as isDebug, M as setSegmentParams, N as getCookie, O as markResponseFlushed, V as generateTraceId, W as getTraceId, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMutableCookieContext, k as runWithRequestContext, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as setSpanAttribute, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as getHeader } from "../_chunks/logger-CH7IcMmg.js";
+import { A as setMatchedSegmentPath, C as applyRequestHeaderOverlay, D as getSegmentParams, E as getSearchParams, F as getSetCookieHeaders, G as replaceTraceId, H as getOtelTraceId, I as getWaitUntil, J as withSpan, K as runWithTraceId, L as isDebug, M as setSegmentParams, N as getCookie, O as markResponseFlushed, V as generateTraceId, W as getTraceId, _ as RedirectSignal, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, g as DenySignal, h as swallow, i as logMiddlewareShortCircuit, j as setMutableCookieContext, k as runWithRequestContext, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, q as setSpanAttribute, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as RenderError, w as getHeader } from "../_chunks/logger-pumCm3Il.js";
 import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-DD0fl_-s.js";
-import { t as isMdxFilePath } from "../_chunks/mdx-file-C005ay-P.js";
 import { i as collectRouteModulepreloads, n as collectRouteCss, r as collectRouteFonts } from "../_chunks/build-manifest-DWppEdLB.js";
-import { i as coerce, t as executeAction } from "../_chunks/actions-BjbbNRFN.js";
-import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-DllJ-Lyw.js";
+import { i as coerce, t as executeAction } from "../_chunks/actions-CWYtq6ii.js";
+import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as createSingleflight, y as lastInvalidationEpochFor } from "../_chunks/cache-api-CQeYzA5g.js";
 import "../_chunks/error-boundary-D-ODYX41.js";
 import { n as toBracketKey } from "../_chunks/resolve-schema-CBR6Lm4i.js";
 import { r as normalizeParamValue } from "../_chunks/segment-context-CjOlyB8Y.js";
@@ -403,44 +403,46 @@ function renderOpenGraph(og, elements) {
 			content
 		}
 	});
-	if (og.images) if (typeof og.images === "string") elements.push({
-		tag: "meta",
-		attrs: {
-			property: "og:image",
-			content: og.images
-		}
-	});
-	else {
-		const imgList = Array.isArray(og.images) ? og.images : [og.images];
-		for (const img of imgList) {
-			elements.push({
-				tag: "meta",
-				attrs: {
-					property: "og:image",
-					content: img.url
-				}
-			});
-			if (img.width) elements.push({
-				tag: "meta",
-				attrs: {
-					property: "og:image:width",
-					content: String(img.width)
-				}
-			});
-			if (img.height) elements.push({
-				tag: "meta",
-				attrs: {
-					property: "og:image:height",
-					content: String(img.height)
-				}
-			});
-			if (img.alt) elements.push({
-				tag: "meta",
-				attrs: {
-					property: "og:image:alt",
-					content: img.alt
-				}
-			});
+	if (og.images) {
+		if (typeof og.images === "string") elements.push({
+			tag: "meta",
+			attrs: {
+				property: "og:image",
+				content: og.images
+			}
+		});
+		else {
+			const imgList = Array.isArray(og.images) ? og.images : [og.images];
+			for (const img of imgList) {
+				elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image",
+						content: img.url
+					}
+				});
+				if (img.width) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:width",
+						content: String(img.width)
+					}
+				});
+				if (img.height) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:height",
+						content: String(img.height)
+					}
+				});
+				if (img.alt) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:alt",
+						content: img.alt
+					}
+				});
+			}
 		}
 	}
 	if (og.videos) for (const video of og.videos) elements.push({
@@ -488,24 +490,26 @@ function renderTwitter(tw, elements) {
 			content
 		}
 	});
-	if (tw.images) if (typeof tw.images === "string") elements.push({
-		tag: "meta",
-		attrs: {
-			name: "twitter:image",
-			content: tw.images
-		}
-	});
-	else {
-		const imgList = Array.isArray(tw.images) ? tw.images : [tw.images];
-		for (const img of imgList) {
-			const url = typeof img === "string" ? img : img.url;
-			elements.push({
-				tag: "meta",
-				attrs: {
-					name: "twitter:image",
-					content: url
-				}
-			});
+	if (tw.images) {
+		if (typeof tw.images === "string") elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:image",
+				content: tw.images
+			}
+		});
+		else {
+			const imgList = Array.isArray(tw.images) ? tw.images : [tw.images];
+			for (const img of imgList) {
+				const url = typeof img === "string" ? img : img.url;
+				elements.push({
+					tag: "meta",
+					attrs: {
+						name: "twitter:image",
+						content: url
+					}
+				});
+			}
 		}
 	}
 	if (tw.players) for (const player of tw.players) {
@@ -1082,11 +1086,12 @@ function resolveMetadataUrls(metadata) {
 * the user's error component with the proper props.
 */
 function ErrorReconstituter({ error: serialized, digest, reset, component, status, dangerouslyPassData }) {
+	const error = Object.assign(new Error(serialized.message), {
+		name: serialized.name,
+		...serialized.stack != null ? { stack: serialized.stack } : {}
+	});
 	return createElement(component, {
-		error: Object.assign(new Error(serialized.message), {
-			name: serialized.name,
-			...serialized.stack != null ? { stack: serialized.stack } : {}
-		}),
+		error,
 		digest,
 		reset,
 		...status != null ? {
@@ -1493,527 +1498,154 @@ function buildDeniedFallback(DeniedComponent, slotName, data, createElement) {
 	});
 }
 //#endregion
-//#region src/client/slot-context.ts
+//#region src/server/error-boundary-wrapper.ts
 /**
-* SlotContext — delivers live slot content to SlotOutlet holes inside
-* cached component shells (TIM-1173).
+* Load a status/error file's component, or `null` if the boundary should be skipped.
 *
-* A `cache.component(Fn, { slots: [...] })` shell is captured with a
-* stable <SlotOutlet slot={name} /> client reference in place of each
-* declared slot prop. At request time the revived shell is wrapped in a
-* SlotsProvider carrying the live slot values; each outlet reads its
-* value from this context by name.
+* Two ways to get `null`, both deliberate:
+*   - the module fails to load (syntax error in the error page) — building an
+*     error boundary must not itself throw, so the boundary is skipped (TIM-584);
+*   - the default export is not a valid React component type, which would
+*     otherwise crash inside `createElement`.
+*/
+async function loadBoundaryComponent(file, loadModule) {
+	let mod;
+	try {
+		mod = await loadModule(file);
+	} catch {
+		return null;
+	}
+	return isValidElementType(mod?.default) ? mod.default : null;
+}
+/**
+* Wrap `element` in one error boundary rendering `Component` on failure.
 *
-* Providers MERGE per-key with their parent: an inner SlotsProvider
-* inherits the outer's values and overrides only the keys it declares.
-* Two sibling instances each have their own provider and resolve
-* independently. Layouts use a reserved slot name (LAYOUT_CHILDREN_SLOT)
-* that cannot collide with user-declared slot names (TIM-1191).
+* MDX status files are server components and cannot be passed as function
+* props to `TimberErrorBoundary` (a 'use client' component). They are
+* pre-rendered as elements and passed as `fallbackElement` instead. See TIM-503.
 *
-* Generalizes the original layout children pattern (TIM-1181) from a
-* single implicit `children` hole on layouts to explicitly declared,
-* named slot props on any cached component. Layouts use this same
-* context with the reserved LAYOUT_CHILDREN_SLOT key (TIM-1191).
+* @param status      boundary status filter — omitted entirely for `error.tsx`
+* @param fallbackProps props handed to an MDX fallback when it is pre-rendered
+*/
+function wrapInBoundary(element, Component, file, status, fallbackProps, config) {
+	const props = isMdxFilePath(file.filePath) ? {
+		fallbackElement: config.createElement(Component, fallbackProps),
+		children: element
+	} : {
+		fallbackComponent: Component,
+		children: element
+	};
+	if (status !== void 0) props.status = status;
+	if (config.segmentKey !== void 0) props.segmentKey = config.segmentKey;
+	return config.createElement(config.errorBoundaryComponent, props);
+}
+/**
+* Wrap an element in the error boundaries declared by a route segment.
 *
-* SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
-* can duplicate this module across chunks; globalThis guarantees a single
-* context instance.
+* Wrapping is applied inside-out — the last wrap produces the outermost
+* boundary — so the processing order below is innermost to outermost:
 *
-* See design/45-cache-lifetimes.md §Slot Components.
+* 1. Specific status files (e.g. `404.tsx`, `503.tsx`) — highest priority at runtime
+* 2. Category catch-alls (`4xx.tsx`, `5xx.tsx`)
+* 3. `error.tsx` — catches anything not matched by a status file
+*
+* The order is load-bearing: it decides which boundary catches a given throw.
+*
+* See design/10-error-handling.md §"Format-Aware Fallback Chains".
 */
-var CTX_KEY$1 = Symbol.for("__timber_slot_ctx");
-function getOrCreateContext$1() {
-	const existing = globalThis[CTX_KEY$1];
-	if (existing !== void 0) return existing;
-	if (typeof React.createContext === "function") {
-		const ctx = React.createContext(null);
-		globalThis[CTX_KEY$1] = ctx;
-		return ctx;
+async function wrapSegmentWithErrorBoundaries(segment, element, config) {
+	const { loadModule } = config;
+	if (segment.statusFiles) {
+		for (const [key, file] of Object.entries(segment.statusFiles)) {
+			if (key === "4xx" || key === "5xx") continue;
+			const status = parseInt(key, 10);
+			if (isNaN(status)) continue;
+			const Component = await loadBoundaryComponent(file, loadModule);
+			if (Component) element = wrapInBoundary(element, Component, file, status, { status }, config);
+		}
+		for (const [key, file] of Object.entries(segment.statusFiles)) {
+			if (key !== "4xx" && key !== "5xx") continue;
+			const Component = await loadBoundaryComponent(file, loadModule);
+			if (Component) element = wrapInBoundary(element, Component, file, key === "4xx" ? 400 : 500, {}, config);
+		}
 	}
+	if (segment.error) {
+		const Component = await loadBoundaryComponent(segment.error, loadModule);
+		if (Component) element = wrapInBoundary(element, Component, segment.error, void 0, {}, config);
+	}
+	return element;
 }
-var SlotContext = getOrCreateContext$1();
 //#endregion
-//#region src/client/slot-outlet.tsx
+//#region src/server/param-coercion.ts
+/** Global schema codecs, set once at startup from virtual:timber-schema. */
+var _globalCodecs = null;
 /**
-* SlotOutlet — the hole in a cached component shell (TIM-1173).
+* Run segment param coercion on the matched route's segments.
 *
-* At capture time the prebuilt runtime renders the wrapped component with
-* <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
-* client component, it serializes into the flight payload as a stable,
-* deterministic client reference — the same bytes regardless of what live
-* content will fill the hole. At request time the revived shell sits under
-* a SlotsProvider and each outlet reads its live value from SlotContext.
+* Codecs come from `app/schema.ts` and nowhere else (TIM-1342 completed
+* design/41-global-params.md migration step 9). A route with no schema, or
+* a param the schema does not declare, keeps its raw string — which is the
+* honest type for an uninterpreted URL segment.
 *
-* See design/45-cache-lifetimes.md §Slot Components.
+* Throws ParamCoercionError if any codec fails (→ 404).
+*
+* This runs BEFORE middleware, so ctx.segmentParams is already typed.
+* See design/07-routing.md §"Where Coercion Runs"
+* See design/41-global-params.md §"Pipeline Integration"
+*
+* Stays `async` with nothing to await: it is injected as a
+* `CoerceSegmentParamsFn` into the revalidation renderer and the action
+* middleware runner, both of which await it. Narrowing the return type to
+* `void` would break those contracts and remove a microtask boundary the
+* pipeline's ordering has always had, for no gain.
 */
-function SlotOutlet({ slot }) {
-	const values = useContext(SlotContext);
-	return values ? values[slot] ?? null : null;
+async function coerceSegmentParams(match) {
+	const globalCodecs = _globalCodecs;
+	const mergeTarget = Object.create(null);
+	for (const key of Object.keys(match.segmentParams)) if (key !== "__proto__") mergeTarget[key] = match.segmentParams[key];
+	match.segmentParams = mergeTarget;
+	if (globalCodecs) for (const node of match.segments) {
+		const segment = effectiveUrlSegment(node);
+		if (!segment.paramName) continue;
+		const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+		const codec = globalCodecs[bracketKey];
+		if (!codec) continue;
+		const key = segment.paramName;
+		if (!(key in mergeTarget)) continue;
+		let parsed;
+		try {
+			parsed = codec.parse(mergeTarget[key]);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (isDebug()) console.warn(`[timber] Global schema codec rejected value for param "${key}"\n  Error: ${message}\n  Raw value: ${JSON.stringify(mergeTarget[key])}\n  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`);
+			throw new ParamCoercionError(message);
+		}
+		mergeTarget[key] = normalizeParamValue(parsed, key);
+	}
 }
 //#endregion
-//#region src/client/slot-provider.tsx
+//#region src/server/pipeline-interception.ts
 /**
-* SlotsProvider — wraps a revived cached shell to supply live slot content
-* to the SlotOutlet holes inside it (TIM-1173).
+* Interception route matching for the request pipeline.
 *
-* Values MERGE with the nearest parent provider so that nesting a
-* cache.component SlotsProvider inside a layout SlotsProvider preserves
-* the layout's `children` slot while adding the component's own slots.
-* Inner values override outer ones with the same name (spread order).
+* Matches target URLs against interception rewrites to support the
+* modal route pattern (soft navigation intercepts).
 *
-* Tree structure per cached-component instance:
-*   SlotsProvider(values={children: <Live />})
-*     └── revived shell
-*          └── SlotOutlet(slot="children") → reads context → <Live />
+* Extracted from pipeline.ts to keep files under 500 lines.
 *
-* See design/45-cache-lifetimes.md §Slot Components.
+* See design/07-routing.md §"Intercepting Routes"
 */
-function SlotsProvider({ values, children }) {
-	const parent = useContext(SlotContext);
-	const merged = parent ? {
-		...parent,
-		...values
-	} : values;
-	return createElement(SlotContext.Provider, { value: merged }, children);
-}
-//#endregion
-//#region src/server/prebuilt/cache-key.ts
 /**
-* Component cache-key hashing for prebuilt (cache.component) entries.
+* Check if an intercepting route applies for this soft navigation.
 *
-* Key: `sha256(canonicalJson({ props, params })).slice(0, 16)` — see
-* design/44-render-at-build-time.md §Cache Key. Both the request-time
-* lookup (prebuilt-runtime.ts) and the post-build capture pass (TIM-1119)
-* MUST use this exact function, or build artifacts become unaddressable.
+* Two conditions must hold:
 *
-* THE IDENTITY CONTRACT (design/44 §Cache Key): cache identity is **JSON
-* value semantics** — two inputs are the same entry iff they are the same
-* JSON value. This is an ALLOWLIST, not a denylist: a value participates
-* in caching iff it is plain JSON data — null, boolean, finite number,
-* string, dense array, or a plain `Object.prototype` object with only
-* enumerable string-keyed data properties — plus `undefined` and `-0`,
-* which hash as distinct sentinels because flight preserves them. Every
-* value outside that domain (functions, symbols, bigints, accessors,
-* hidden or symbol-keyed properties, non-`Object.prototype` prototypes
-* including null, aliased references, sparse arrays, cycles, non-finite
-* numbers) is UNKEYABLE by definition: `computeComponentCacheKey` returns
-* null and the caller renders live — slower, never wrong.
-*
-* The line between rejected and declared-out-of-domain: values are
-* REJECTED when the JSON projection itself would be ambiguous or lossy
-* (hidden/symbol/non-enumerable properties, accessors, exotic
-* prototypes). Observable state that leaves the projection intact — key
-* order, reference identity, descriptor metadata (writable/configurable,
-* frozen/sealed/extensible), proxy behavior — is DECLARED outside
-* cache.component's supported input domain rather than rejected:
-* key-order insensitivity is required for determinism, and rejecting
-* frozen objects would unkey ubiquitous legitimate inputs
-* (Object.freeze'd config props) to defend against components that
-* render differently based on property attributes.
-*
-* Two hard rules for this walk itself: it must be TOTAL (never throw
-* anything but UnkeyableValueError) and SIDE-EFFECT-FREE (descriptor
-* reads only; never invoke user code such as getters).
-*
-* Object keys sort recursively so `{a, b}` and `{b, a}` hash identically
-* (design/13-security.md checklist #14 — cache key determinism; key order
-* is deliberately NOT part of identity).
-*/
-var UnkeyableValueError = class extends Error {};
-function canonicalize$1(value, seen) {
-	if (value === null) return "null";
-	switch (typeof value) {
-		case "string": return JSON.stringify(value);
-		case "boolean": return value ? "true" : "false";
-		case "number":
-			if (!Number.isFinite(value)) throw new UnkeyableValueError("non-finite number");
-			return Object.is(value, -0) ? "-0" : String(value);
-		case "object": break;
-		case "undefined": return "undefined";
-		default: throw new UnkeyableValueError(`unsupported type: ${typeof value}`);
-	}
-	const obj = value;
-	if (seen.has(obj)) throw new UnkeyableValueError("repeated object reference (cycle or alias)");
-	seen.add(obj);
-	if (Object.getOwnPropertySymbols(obj).length > 0) throw new UnkeyableValueError("symbol-keyed property");
-	{
-		if (Array.isArray(obj)) {
-			if (Object.getOwnPropertyNames(obj).length !== obj.length + 1) throw new UnkeyableValueError("non-index array property");
-			const parts = [];
-			for (let i = 0; i < obj.length; i++) {
-				const desc = Object.getOwnPropertyDescriptor(obj, i);
-				if (desc === void 0) throw new UnkeyableValueError("sparse array hole");
-				if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
-				if (!desc.enumerable) throw new UnkeyableValueError("non-enumerable array element");
-				parts.push(canonicalize$1(desc.value, seen));
-			}
-			return "[" + parts.join(",") + "]";
-		}
-		if (Object.getPrototypeOf(obj) !== Object.prototype) throw new UnkeyableValueError("non-plain object");
-		const keys = Object.keys(obj).sort();
-		if (keys.length !== Object.getOwnPropertyNames(obj).length) throw new UnkeyableValueError("non-enumerable property");
-		const parts = [];
-		for (const key of keys) {
-			const desc = Object.getOwnPropertyDescriptor(obj, key);
-			if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
-			parts.push(JSON.stringify(key) + ":" + canonicalize$1(desc.value, seen));
-		}
-		return "{" + parts.join(",") + "}";
-	}
-}
-/**
-* Canonicalize a single value, or null if it is unkeyable. The ONE
-* definition of "faithfully comparable" — every prebuilt code path that
-* needs value equality (cache keys, slot-param divergence) goes through
-* this, so the unkeyable rules (accessors, hidden props, aliases,
-* bigints, …) live in exactly one place.
-*/
-function tryCanonicalize(value) {
-	try {
-		return canonicalize$1(value, /* @__PURE__ */ new Set());
-	} catch (error) {
-		return toUnkeyable(error);
-	}
-}
-/**
-* Totality by construction: ANY throw from the walk means the input is
-* outside the keyable domain. The walk touches only user-controlled
-* values through reflection ops — and a Proxy trap can throw arbitrary
-* errors from any of them (codex review on PR #835) — so converting only
-* UnkeyableValueError would let hostile/exotic inputs abort a render
-* that plain live rendering would have served fine. Unexpected error
-* types are logged for visibility (they would indicate either a proxy
-* trap or a canonicalizer bug) but still degrade to unkeyable.
-*/
-function toUnkeyable(error) {
-	if (!(error instanceof UnkeyableValueError)) console.error("[timber] cache key canonicalization threw — treating input as unkeyable:", error);
-	return null;
-}
-/**
-* Split a props record into data props (participate in the cache key) and
-* slot values (React-element holes, excluded from the key) per the
-* component's declared `slots` option (TIM-1173).
-*
-* Every DECLARED slot lands in `slotValues` — present or not — because the
-* capture render always injects a SlotOutlet placeholder for each declared
-* slot: the cached shell is identical whether the caller passed the slot
-* or omitted it, so slot presence must not vary the key. `dataProps` is
-* everything else and is what gets hashed.
-*
-* Returns null when the props OBJECT itself is outside the identity
-* contract at the top level — accessors, symbol-keyed or non-enumerable
-* properties, or a non-`Object.prototype` prototype. Splitting such an
-* object would normalize away observable state (and reading an accessor
-* would invoke user code, which this walk must never do) BEFORE
-* `computeComponentCacheKey` gets the chance to reject it — a cached
-* shell could then be served for inputs a live render distinguishes.
-* Null means unkeyable: the caller renders live with the original props.
-* The walk is descriptor-reads only; getters are never invoked. Nested
-* data-prop values still face the full allowlist when hashed.
-*/
-/** Create an own enumerable data property — safe for keys like `__proto__`. */
-function defineOwn(target, key, value) {
-	Object.defineProperty(target, key, {
-		value,
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-}
-function splitSlotProps(props, slots) {
-	try {
-		if (Object.getPrototypeOf(props) !== Object.prototype) return null;
-		if (Object.getOwnPropertySymbols(props).length > 0) return null;
-		const slotSet = new Set(slots);
-		const dataProps = {};
-		const slotValues = {};
-		for (const key of Object.getOwnPropertyNames(props)) {
-			const desc = Object.getOwnPropertyDescriptor(props, key);
-			if (desc === void 0 || desc.get !== void 0 || desc.set !== void 0 || !desc.enumerable) return null;
-			defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
-		}
-		for (const slot of slotSet) if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, void 0);
-		return {
-			dataProps,
-			slotValues
-		};
-	} catch (error) {
-		return toUnkeyable(error);
-	}
-}
-/**
-* Compute the cache-entry hash for a component render:
-* `sha256({props, params}).slice(0, 16)` over canonical JSON.
-*
-* Returns null when props (or params) contain unkeyable values — the
-* caller must fall back to dynamic rendering.
-*/
-function computeComponentCacheKey(props, params) {
-	let canonical;
-	try {
-		const seen = /* @__PURE__ */ new Set();
-		canonical = "{\"params\":" + canonicalize$1({ ...params }, seen) + ",\"props\":" + canonicalize$1(props, seen) + "}";
-	} catch (error) {
-		return toUnkeyable(error);
-	}
-	return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
-}
-/**
-* Is this value the framework-injected layout children slot outlet
-* (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
-* receive this as their `children` prop — a stable client reference
-* whose cache key is stripped so layout `cache.component` hits work
-* (design/45 §Layout Propagation).
-*
-* Uses a framework-reserved slot name (LAYOUT_CHILDREN_SLOT) that
-* cannot collide with user-declared slot names, preventing context
-* shadowing when a cached component with its own SlotsProvider is
-* nested inside a layout. See TIM-1191.
-*
-* Total: the probes run against a user-controlled value, and a Proxy
-* trap can throw — that must classify as "not the outlet" (the
-* canonicalizer then rejects the value as unkeyable → live render), not
-* abort the request (codex P2 on PR #890).
-*/
-function isChildrenSlotOutletElement(value) {
-	try {
-		if (value == null || typeof value !== "object") return false;
-		if (!("type" in value)) return false;
-		const el = value;
-		return el.type === SlotOutlet && el.props?.slot === "\0timber:children";
-	} catch {
-		return false;
-	}
-}
-/**
-* Dense array of non-empty strings — no holes, no non-string entries.
-* Total: the reads run against a user-controlled value at module load,
-* and a throwing Proxy trap must classify as invalid, not crash startup.
-*/
-function isDenseStringArray(value) {
-	try {
-		if (!Array.isArray(value)) return false;
-		for (let i = 0; i < value.length; i++) {
-			if (!Object.hasOwn(value, i)) return false;
-			const entry = value[i];
-			if (typeof entry !== "string" || entry.length === 0) return false;
-		}
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Validate the `slots` option. Both the production and dev wrappers gate
-* on this — slot substitution is active in dev exactly when it would be
-* active in production, so the tree shape a component sees never
-* diverges between the two.
-*/
-function resolveSlotNames(id, options) {
-	const slots = options.slots;
-	if (slots === void 0) return { kind: "none" };
-	if (!isDenseStringArray(slots)) {
-		console.warn(`[timber] cache.component "${id}": invalid slots declaration — expected an array of non-empty prop-name strings. Slot caching is disabled.`);
-		return { kind: "disabled" };
-	}
-	if (slots.length === 0) return { kind: "none" };
-	if (!(options.ttl !== void 0 || options.tags != null)) {
-		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
-		return { kind: "disabled" };
-	}
-	return {
-		kind: "active",
-		slots
-	};
-}
-/**
-* Split the live props into the cacheable shell render (data props plus a
-* deterministic SlotOutlet placeholder per declared slot — identical
-* whether or not the caller passed the slot) and the per-instance live
-* slot values.
-*
-* Null when the props object itself is unkeyable at the top level
-* (accessors, hidden properties, exotic prototype — see splitSlotProps):
-* the caller must render live with the original props.
-*/
-function prepareSlotRender(props, slots) {
-	const split = splitSlotProps(props ?? {}, slots);
-	if (split === null) return null;
-	const { dataProps, slotValues } = split;
-	const shellProps = { ...dataProps };
-	for (const slot of slots) Object.defineProperty(shellProps, slot, {
-		value: createElement(SlotOutlet, { slot }),
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-	return {
-		shellProps,
-		dataProps,
-		slotValues
-	};
-}
-/**
-* Wrap a rendered shell (revived payload or live element) in a
-* per-instance SlotsProvider feeding the live values to its outlets.
-*/
-function wrapInSlotsProvider(shell, slotValues) {
-	return createElement(SlotsProvider, {
-		values: slotValues,
-		children: shell
-	});
-}
-//#endregion
-//#region src/server/error-boundary-wrapper.ts
-/**
-* Load a status/error file's component, or `null` if the boundary should be skipped.
-*
-* Two ways to get `null`, both deliberate:
-*   - the module fails to load (syntax error in the error page) — building an
-*     error boundary must not itself throw, so the boundary is skipped (TIM-584);
-*   - the default export is not a valid React component type, which would
-*     otherwise crash inside `createElement`.
-*/
-async function loadBoundaryComponent(file, loadModule) {
-	let mod;
-	try {
-		mod = await loadModule(file);
-	} catch {
-		return null;
-	}
-	return isValidElementType(mod?.default) ? mod.default : null;
-}
-/**
-* Wrap `element` in one error boundary rendering `Component` on failure.
-*
-* MDX status files are server components and cannot be passed as function
-* props to `TimberErrorBoundary` (a 'use client' component). They are
-* pre-rendered as elements and passed as `fallbackElement` instead. See TIM-503.
-*
-* @param status      boundary status filter — omitted entirely for `error.tsx`
-* @param fallbackProps props handed to an MDX fallback when it is pre-rendered
-*/
-function wrapInBoundary(element, Component, file, status, fallbackProps, config) {
-	const props = isMdxFilePath(file.filePath) ? {
-		fallbackElement: config.createElement(Component, fallbackProps),
-		children: element
-	} : {
-		fallbackComponent: Component,
-		children: element
-	};
-	if (status !== void 0) props.status = status;
-	if (config.segmentKey !== void 0) props.segmentKey = config.segmentKey;
-	return config.createElement(config.errorBoundaryComponent, props);
-}
-/**
-* Wrap an element in the error boundaries declared by a route segment.
-*
-* Wrapping is applied inside-out — the last wrap produces the outermost
-* boundary — so the processing order below is innermost to outermost:
-*
-* 1. Specific status files (e.g. `404.tsx`, `503.tsx`) — highest priority at runtime
-* 2. Category catch-alls (`4xx.tsx`, `5xx.tsx`)
-* 3. `error.tsx` — catches anything not matched by a status file
-*
-* The order is load-bearing: it decides which boundary catches a given throw.
-*
-* See design/10-error-handling.md §"Format-Aware Fallback Chains".
-*/
-async function wrapSegmentWithErrorBoundaries(segment, element, config) {
-	const { loadModule, skipDenyBoundaries = false } = config;
-	if (segment.statusFiles) {
-		for (const [key, file] of Object.entries(segment.statusFiles)) {
-			if (key === "4xx" || key === "5xx") continue;
-			const status = parseInt(key, 10);
-			if (isNaN(status)) continue;
-			if (skipDenyBoundaries && status >= 400 && status <= 499) continue;
-			const Component = await loadBoundaryComponent(file, loadModule);
-			if (Component) element = wrapInBoundary(element, Component, file, status, { status }, config);
-		}
-		for (const [key, file] of Object.entries(segment.statusFiles)) {
-			if (key !== "4xx" && key !== "5xx") continue;
-			if (skipDenyBoundaries && key === "4xx") continue;
-			const Component = await loadBoundaryComponent(file, loadModule);
-			if (Component) element = wrapInBoundary(element, Component, file, key === "4xx" ? 400 : 500, {}, config);
-		}
-	}
-	if (segment.error) {
-		const Component = await loadBoundaryComponent(segment.error, loadModule);
-		if (Component) element = wrapInBoundary(element, Component, segment.error, void 0, {}, config);
-	}
-	return element;
-}
-//#endregion
-//#region src/server/param-coercion.ts
-/** Global schema codecs, set once at startup from virtual:timber-schema. */
-var _globalCodecs = null;
-/**
-* Run segment param coercion on the matched route's segments.
-*
-* Codecs come from `app/schema.ts` and nowhere else (TIM-1342 completed
-* design/41-global-params.md migration step 9). A route with no schema, or
-* a param the schema does not declare, keeps its raw string — which is the
-* honest type for an uninterpreted URL segment.
-*
-* Throws ParamCoercionError if any codec fails (→ 404).
-*
-* This runs BEFORE middleware, so ctx.segmentParams is already typed.
-* See design/07-routing.md §"Where Coercion Runs"
-* See design/41-global-params.md §"Pipeline Integration"
-*
-* Stays `async` with nothing to await: it is injected as a
-* `CoerceSegmentParamsFn` into the revalidation renderer and the action
-* middleware runner, both of which await it. Narrowing the return type to
-* `void` would break those contracts and remove a microtask boundary the
-* pipeline's ordering has always had, for no gain.
-*/
-async function coerceSegmentParams(match) {
-	const globalCodecs = _globalCodecs;
-	const mergeTarget = Object.create(null);
-	for (const key of Object.keys(match.segmentParams)) if (key !== "__proto__") mergeTarget[key] = match.segmentParams[key];
-	match.segmentParams = mergeTarget;
-	if (globalCodecs) for (const node of match.segments) {
-		const segment = effectiveUrlSegment(node);
-		if (!segment.paramName) continue;
-		const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
-		const codec = globalCodecs[bracketKey];
-		if (!codec) continue;
-		const key = segment.paramName;
-		if (!(key in mergeTarget)) continue;
-		let parsed;
-		try {
-			parsed = codec.parse(mergeTarget[key]);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isDebug()) console.warn(`[timber] Global schema codec rejected value for param "${key}"\n  Error: ${message}\n  Raw value: ${JSON.stringify(mergeTarget[key])}\n  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`);
-			throw new ParamCoercionError(message);
-		}
-		mergeTarget[key] = normalizeParamValue(parsed, key);
-	}
-}
-//#endregion
-//#region src/server/pipeline-interception.ts
-/**
-* Interception route matching for the request pipeline.
-*
-* Matches target URLs against interception rewrites to support the
-* modal route pattern (soft navigation intercepts).
-*
-* Extracted from pipeline.ts to keep files under 500 lines.
-*
-* See design/07-routing.md §"Intercepting Routes"
-*/
-/**
-* Check if an intercepting route applies for this soft navigation.
-*
-* Two conditions must hold:
-*
-* 1. The **target** pathname matches the rewrite's intercepted pattern.
-* 2. The **source** route — the page the user is navigating FROM, per the
-*    validated X-Timber-URL header — renders the segment that owns the slot
-*    holding the intercepting page (`interceptingScope`). Only then does that
-*    slot exist in the rendered tree, so only then can the intercepting page
-*    render.
+* 1. The **target** pathname matches the rewrite's intercepted pattern.
+* 2. The **source** route — the page the user is navigating FROM, per the
+*    validated X-Timber-URL header — renders the segment that owns the slot
+*    holding the intercepting page (`interceptingScope`). Only then does that
+*    slot exist in the rendered tree, so only then can the intercepting page
+*    render.
 *
 * Condition 2 replaced a URL-prefix check (TIM-1279). A prefix cannot
 * distinguish a route-group-scoped interception from a genuinely root-level
@@ -2127,17 +1759,17 @@ function pathnameMatchesPattern(pathname, pattern) {
 * See design/19-client-navigation.md §"Singleton Guarantee via globalThis"
 */
 var EMPTY_SEGMENT_UPDATES = /* @__PURE__ */ new Map();
-var CTX_KEY = Symbol.for("__timber_segment_update_ctx");
-function getOrCreateContext() {
-	const existing = globalThis[CTX_KEY];
+var CTX_KEY$1 = Symbol.for("__timber_segment_update_ctx");
+function getOrCreateContext$1() {
+	const existing = globalThis[CTX_KEY$1];
 	if (existing !== void 0) return existing;
 	if (typeof React.createContext === "function") {
 		const ctx = React.createContext(EMPTY_SEGMENT_UPDATES);
-		globalThis[CTX_KEY] = ctx;
+		globalThis[CTX_KEY$1] = ctx;
 		return ctx;
 	}
 }
-getOrCreateContext();
+getOrCreateContext$1();
 //#endregion
 //#region src/client/segment-outlet.tsx
 /**
@@ -2596,11 +2228,7 @@ async function handleRequest(config, req, method, path, pathIsCanonical) {
 				return new Response("Metadata route must export a default function", { status: 500 });
 			}
 			const handlerResult = await mod.default();
-			if (handlerResult instanceof Response) {
-				const res = cloneWithMutableHeaders(handlerResult);
-				if (res.ok && !res.headers.has("Cache-Control")) res.headers.set("Cache-Control", "public, max-age=14400, must-revalidate");
-				return res;
-			}
+			if (handlerResult instanceof Response) return cloneWithMutableHeaders(handlerResult);
 			const contentType = metaMatch.contentType;
 			let body;
 			if (typeof handlerResult === "string") body = handlerResult;
@@ -2829,9 +2457,7 @@ async function hasValidRscCacheKey(req) {
 * #36c.
 */
 function hardenRscPayloadResponse(response) {
-	const contentType = response.headers.get("content-type");
-	if (!contentType) return;
-	if (contentType.split(";")[0].trim().toLowerCase() !== "text/x-component") return;
+	if (!isRscContentType(response.headers.get("content-type"))) return;
 	response.headers.set("X-Content-Type-Options", "nosniff");
 }
 /**
@@ -2933,7 +2559,8 @@ function createPipeline(config) {
 		const path = url.pathname;
 		const startTime = performance.now();
 		activeRequests++;
-		return runWithTraceId(generateTraceId(), async () => {
+		const traceIdValue = generateTraceId();
+		return runWithTraceId(traceIdValue, async () => {
 			return runWithRequestContext(req, async () => {
 				const runRequest = async () => {
 					logRequestReceived({
@@ -3109,547 +2736,918 @@ function collectEarlyHintHeaders(segments, manifest, options) {
 //#endregion
 //#region src/server/early-hints-sender.ts
 /**
-* Per-request 103 Early Hints sender — ALS bridge for platform adapters.
-*
-* The pipeline collects Link headers for CSS, fonts, and JS chunks at
-* route-match time. On platforms that support it (Node.js v18.11+, Bun),
-* the adapter can send these as a 103 Early Hints interim response before
-* the final response is ready.
+* Per-request 103 Early Hints sender — ALS bridge for platform adapters.
+*
+* The pipeline collects Link headers for CSS, fonts, and JS chunks at
+* route-match time. On platforms that support it (Node.js v18.11+, Bun),
+* the adapter can send these as a 103 Early Hints interim response before
+* the final response is ready.
+*
+* This module provides an ALS-based bridge: the generated entry point
+* (e.g., the Nitro entry) wraps the handler with `runWithEarlyHintsSender`,
+* binding a per-request sender function. The pipeline calls
+* `sendEarlyHints103()` to fire the 103 if a sender is available.
+*
+* On platforms where 103 is handled at the CDN level (e.g., Cloudflare
+* converts Link headers into 103 automatically), no sender is installed
+* and `sendEarlyHints103()` is a no-op.
+*
+* Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
+*/
+/**
+* Run a function with a per-request early hints sender installed.
+*
+* Called by generated entry points (e.g., Nitro node-server/bun) to
+* bind the platform's writeEarlyHints capability for the request duration.
+*/
+function runWithEarlyHintsSender(sender, fn) {
+	return earlyHintsSenderAls.run(sender, fn);
+}
+/**
+* Send collected Link headers as a 103 Early Hints response.
+*
+* No-op if no sender is installed for the current request (e.g., on
+* Cloudflare where the CDN handles 103 automatically, or in dev mode).
+*
+* Non-fatal: errors from the sender are caught and silently ignored.
+*/
+function sendEarlyHints103(links) {
+	if (!links.length) return;
+	const sender = earlyHintsSenderAls.getStore();
+	if (!sender) return;
+	try {
+		sender(links);
+	} catch (err) {
+		swallow(err, "early hints 103 send failed");
+	}
+}
+//#endregion
+//#region src/server/tree-builder.ts
+/**
+* Build the unified element tree from a matched segment chain.
+*
+* Construction is bottom-up:
+*   1. Start with the page component (leaf segment)
+*   2. Wrap in status-code error boundaries (fallback chain)
+*   3. Wrap in AccessGate (if segment has access.ts)
+*   4. Pass as children to the segment's layout
+*   5. Repeat up the segment chain to root
+*
+* Parallel slots are resolved at each layout level and composed as named props.
+*/
+async function buildElementTree(config) {
+	const { segments, loadModule, createElement, errorBoundaryComponent } = config;
+	if (segments.length === 0) throw new Error("[timber] buildElementTree: empty segment chain");
+	const leaf = segments[segments.length - 1];
+	if (leaf.route && !leaf.page) return {
+		tree: null,
+		isApiRoute: true
+	};
+	const PageComponent = (leaf.page ? await loadModule(leaf.page) : null)?.default;
+	if (!PageComponent) throw new Error(`[timber] No page component found for route at ${leaf.urlPath}. Each route must have a page.tsx or route.ts.`);
+	let element = createElement(PageComponent, {});
+	for (let i = segments.length - 1; i >= 0; i--) {
+		const segment = segments[i];
+		element = await wrapSegmentWithErrorBoundaries(segment, element, {
+			loadModule,
+			createElement,
+			errorBoundaryComponent
+		});
+		if (segment.access) {
+			const accessFn = (await loadModule(segment.access)).default;
+			element = createElement("timber:access-gate", {
+				accessFn,
+				segmentName: segment.segmentName,
+				children: element
+			});
+		}
+		if (segment.layout) {
+			const LayoutComponent = (await loadModule(segment.layout)).default;
+			if (LayoutComponent) {
+				const slotProps = {};
+				const slotNames = Object.keys(segment.slots);
+				if (slotNames.length > 0) for (const slotName of slotNames) {
+					const slotNode = segment.slots[slotName];
+					slotProps[slotName] = await buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent);
+				}
+				element = createElement(LayoutComponent, {
+					...slotProps,
+					children: element
+				});
+			}
+		}
+	}
+	return {
+		tree: element,
+		isApiRoute: false
+	};
+}
+/**
+* Build the element tree for a parallel slot.
+*
+* Slots have their own access.ts (SlotAccessGate) and error boundaries.
+* On access denial: denied.tsx → default.tsx → null (graceful degradation).
+*/
+async function buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent) {
+	const PageComponent = (slotNode.page ? await loadModule(slotNode.page) : null)?.default;
+	const DefaultComponent = (slotNode.default ? await loadModule(slotNode.default) : null)?.default;
+	if (!PageComponent) return DefaultComponent ? createElement(DefaultComponent, {}) : null;
+	let element = createElement(PageComponent, {});
+	element = await wrapSegmentWithErrorBoundaries(slotNode, element, {
+		loadModule,
+		createElement,
+		errorBoundaryComponent
+	});
+	if (slotNode.access) {
+		const accessFn = (await loadModule(slotNode.access)).default;
+		const DeniedComponent = (slotNode.denied ? await loadModule(slotNode.denied) : null)?.default ?? null;
+		const defaultFallback = DefaultComponent ? createElement(DefaultComponent, {}) : null;
+		element = createElement("timber:slot-access-gate", {
+			accessFn,
+			DeniedComponent,
+			slotName: slotNode.segmentName.replace(/^@/, ""),
+			createElement,
+			defaultFallback,
+			children: element
+		});
+	}
+	return element;
+}
+//#endregion
+//#region src/server/status-code-resolver.ts
+/**
+* Look up `{statusStr}` then `{categoryKey}` (e.g. "4xx" / "5xx") in a
+* status-file group on a single segment. Shared by all three fallback
+* chains — the only structural difference between component 4xx,
+* component 5xx, and JSON resolution is *which* group is searched and
+* how the per-segment loop is layered around it.
+*/
+function lookupInGroup(group, statusStr, categoryKey, segmentIndex, status) {
+	if (!group) return null;
+	const exact = group[statusStr];
+	if (exact) return {
+		file: exact,
+		status,
+		kind: "exact",
+		segmentIndex
+	};
+	const category = group[categoryKey];
+	if (category) return {
+		file: category,
+		status,
+		kind: "category",
+		segmentIndex
+	};
+	return null;
+}
+/**
+* Resolve the status-code file to render for a given HTTP status code.
+*
+* Walks the segment chain from leaf to root following the fallback chain
+* defined in design/10-error-handling.md. Returns null if no file is found
+* (caller should render the framework default).
+*
+* @param status - The HTTP status code (4xx or 5xx).
+* @param segments - The matched segment chain from root (index 0) to leaf (last).
+* @param format - The response format family ('component' or 'json'). Defaults to 'component'.
+* @param maxIndex - Optional upper bound on the segment index to search.
+*   When set, the resolver only considers segments `0..maxIndex` (inclusive),
+*   skipping any segments deeper in the tree. Used by the deny renderers to
+*   prevent resolving a status file below a denied segment — matching
+*   `buildDenyPageChain`'s start-at-i semantics. The error renderers omit
+*   this parameter, so the full chain is searched — a 500 from a leaf page
+*   should use the leaf's own `5xx.tsx`. See TIM-1358.
+*/
+function resolveStatusFile(status, segments, format = "component", maxIndex) {
+	if (status < 400 || status > 599) return null;
+	if (format === "json") return resolveJson(status, segments, maxIndex);
+	if (status <= 499) return resolve4xx(status, segments, maxIndex);
+	return resolve5xx(status, segments, maxIndex);
+}
+/**
+* 4xx component fallback chain — two separate full passes leaf→root.
+*
+* The passes must be separate (not interleaved per-segment) so that a
+* root-level `404.tsx` beats a leaf-level `error.tsx`. The 5xx chain
+* inverts this and is per-segment: a leaf's `error.tsx` beats a root's
+* `5xx.tsx`. This asymmetry is the only reason these two functions exist
+* separately.
+*
+*   Pass 1 — {status}.tsx → 4xx.tsx           (statusFiles)
+*   Pass 2 — error.tsx                         (error)
+*/
+function resolve4xx(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const r = lookupInGroup(segments[i].statusFiles, statusStr, "4xx", i, status);
+		if (r) return r;
+	}
+	for (let i = start; i >= 0; i--) {
+		const errorFile = segments[i].error;
+		if (errorFile) return {
+			file: errorFile,
+			status,
+			kind: "error",
+			segmentIndex: i
+		};
+	}
+	return null;
+}
+/**
+* 5xx component fallback chain — single pass, per-segment leaf→root.
+*
+* At each segment: {status}.tsx → 5xx.tsx → error.tsx. A leaf's
+* `error.tsx` therefore beats a root's `5xx.tsx`, which is the
+* intentional inverse of the 4xx chain.
+*/
+function resolve5xx(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const segment = segments[i];
+		const r = lookupInGroup(segment.statusFiles, statusStr, "5xx", i, status);
+		if (r) return r;
+		if (segment.error) return {
+			file: segment.error,
+			status,
+			kind: "error",
+			segmentIndex: i
+		};
+	}
+	return null;
+}
+/**
+* JSON fallback chain (for both 4xx and 5xx) — single pass leaf→root.
 *
-* This module provides an ALS-based bridge: the generated entry point
-* (e.g., the Nitro entry) wraps the handler with `runWithEarlyHintsSender`,
-* binding a per-request sender function. The pipeline calls
-* `sendEarlyHints103()` to fire the 103 if a sender is available.
+* At each segment: {status}.json → {category}.json. No legacy compat,
+* no error.tsx — the JSON chain terminates at the category catch-all
+* and the caller falls back to a bare-JSON framework default.
+*/
+function resolveJson(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const categoryKey = status >= 500 ? "5xx" : "4xx";
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const r = lookupInGroup(segments[i].jsonStatusFiles, statusStr, categoryKey, i, status);
+		if (r) return r;
+	}
+	return null;
+}
+/**
+* Resolve the denial file for a parallel route slot.
 *
-* On platforms where 103 is handled at the CDN level (e.g., Cloudflare
-* converts Link headers into 103 automatically), no sender is installed
-* and `sendEarlyHints103()` is a no-op.
+* Slot denial is graceful degradation — no HTTP status on the wire.
+* Fallback chain: denied.tsx → default.tsx → null.
 *
-* Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
+* @param slotNode - The segment node for the slot (segmentType === 'slot').
 */
+function resolveSlotDenied(slotNode) {
+	const slotName = slotNode.segmentName.replace(/^@/, "");
+	if (slotNode.denied) return {
+		file: slotNode.denied,
+		slotName,
+		kind: "denied"
+	};
+	if (slotNode.default) return {
+		file: slotNode.default,
+		slotName,
+		kind: "default"
+	};
+	return null;
+}
+//#endregion
+//#region src/server/csrf.ts
+/** HTTP methods that are considered safe (no mutation). */
+var SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
 /**
-* Run a function with a per-request early hints sender installed.
+* Derive the request's scheme from trusted sources.
 *
-* Called by generated entry points (e.g., Nitro node-server/bun) to
-* bind the platform's writeEarlyHints capability for the request duration.
+* Priority:
+* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+* 2. Request URL protocol
+*
+* Falls back to 'https' (fail closed) if neither is available.
 */
-function runWithEarlyHintsSender(sender, fn) {
-	return earlyHintsSenderAls.run(sender, fn);
+function deriveRequestScheme(req) {
+	const forwarded = req.headers.get("X-Forwarded-Proto");
+	if (forwarded) {
+		const proto = forwarded.split(",")[0].trim().toLowerCase();
+		if (proto === "http" || proto === "https") return proto;
+	}
+	try {
+		return new URL(req.url).protocol.replace(":", "");
+	} catch {
+		return "https";
+	}
 }
 /**
-* Send collected Link headers as a 103 Early Hints response.
+* Validate the Origin header against the request's full origin
+* (scheme + host + port).
 *
-* No-op if no sender is installed for the current request (e.g., on
-* Cloudflare where the CDN handles 103 automatically, or in dev mode).
+* For mutation methods (POST, PUT, PATCH, DELETE):
+* - If `csrf: false`, skip validation.
+* - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
+* - Otherwise, Origin must match the derived request origin.
 *
-* Non-fatal: errors from the sender are caught and silently ignored.
+* Safe methods (GET, HEAD, OPTIONS) always pass.
 */
-function sendEarlyHints103(links) {
-	if (!links.length) return;
-	const sender = earlyHintsSenderAls.getStore();
-	if (!sender) return;
+function validateCsrf(req, config) {
+	if (SAFE_METHODS.has(req.method)) return { ok: true };
+	if (config.csrf === false) return { ok: true };
+	const origin = req.headers.get("Origin");
+	if (!origin) return {
+		ok: false,
+		status: 403
+	};
+	if (config.allowedOrigins) return config.allowedOrigins.includes(origin) ? { ok: true } : {
+		ok: false,
+		status: 403
+	};
+	const host = req.headers.get("Host");
+	if (!host) return {
+		ok: false,
+		status: 403
+	};
+	let originOrigin;
 	try {
-		sender(links);
-	} catch (err) {
-		swallow(err, "early hints 103 send failed");
+		originOrigin = new URL(origin).origin;
+	} catch {
+		return {
+			ok: false,
+			status: 403
+		};
+	}
+	const scheme = deriveRequestScheme(req);
+	let expectedOrigin;
+	try {
+		expectedOrigin = new URL(`${scheme}://${host}`).origin;
+	} catch {
+		return {
+			ok: false,
+			status: 403
+		};
 	}
+	return originOrigin === expectedOrigin ? { ok: true } : {
+		ok: false,
+		status: 403
+	};
 }
 //#endregion
-//#region src/server/tree-builder.ts
+//#region src/server/body-limits.ts
+var KB = 1024;
+var MB = 1024 * KB;
+var GB = 1024 * MB;
+var DEFAULT_LIMITS = {
+	actionBodySize: 1 * MB,
+	uploadBodySize: 10 * MB,
+	maxFields: 100
+};
+var SIZE_PATTERN = /^(\d+(?:\.\d+)?)\s*(kb|mb|gb)?$/i;
+/** Parse a human-readable size string ("1mb", "512kb", "1024") into bytes. */
+function parseBodySize(size) {
+	const match = SIZE_PATTERN.exec(size.trim());
+	if (!match) throw new Error(`Invalid body size format: "${size}". Expected format like "1mb", "512kb", or "1024".`);
+	const value = Number.parseFloat(match[1]);
+	const unit = (match[2] ?? "").toLowerCase();
+	switch (unit) {
+		case "kb": return Math.floor(value * KB);
+		case "mb": return Math.floor(value * MB);
+		case "gb": return Math.floor(value * GB);
+		case "": return Math.floor(value);
+		default: throw new Error(`Unknown size unit: "${unit}"`);
+	}
+}
+/** Strict integer pattern: one or more digits, nothing else. */
+var STRICT_INTEGER_RE = /^\d+$/;
+/** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
+function enforceBodyLimits(req, kind, config) {
+	const contentLength = req.headers.get("Content-Length");
+	if (!contentLength) return {
+		ok: false,
+		status: 411
+	};
+	const trimmed = contentLength.trim();
+	if (!STRICT_INTEGER_RE.test(trimmed)) return {
+		ok: false,
+		status: 411
+	};
+	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
+		ok: false,
+		status: 413
+	};
+}
 /**
-* Build the unified element tree from a matched segment chain.
-*
-* Construction is bottom-up:
-*   1. Start with the page component (leaf segment)
-*   2. Wrap in status-code error boundaries (fallback chain)
-*   3. Wrap in AccessGate (if segment has access.ts)
-*   4. Pass as children to the segment's layout
-*   5. Repeat up the segment chain to root
+* Resolve the byte limit for a given body kind, using config overrides or defaults.
+*/
+function resolveLimit(kind, config) {
+	const userLimits = config.limits;
+	if (kind === "action") return userLimits?.actionBodySize ? parseBodySize(userLimits.actionBodySize) : DEFAULT_LIMITS.actionBodySize;
+	return userLimits?.uploadBodySize ? parseBodySize(userLimits.uploadBodySize) : DEFAULT_LIMITS.uploadBodySize;
+}
+//#endregion
+//#region src/server/route-handler.ts
+/** All recognized HTTP method export names. */
+var HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS"
+];
+/**
+* Resolve the full list of allowed methods for a route module.
 *
-* Parallel slots are resolved at each layout level and composed as named props.
+* Includes:
+* - All explicitly exported methods
+* - HEAD (implicit when GET is exported)
+* - OPTIONS (always implicit)
 */
-async function buildElementTree(config) {
-	const { segments, loadModule, createElement, errorBoundaryComponent } = config;
-	if (segments.length === 0) throw new Error("[timber] buildElementTree: empty segment chain");
-	const leaf = segments[segments.length - 1];
-	if (leaf.route && !leaf.page) return {
-		tree: null,
-		isApiRoute: true
-	};
-	const PageComponent = (leaf.page ? await loadModule(leaf.page) : null)?.default;
-	if (!PageComponent) throw new Error(`[timber] No page component found for route at ${leaf.urlPath}. Each route must have a page.tsx or route.ts.`);
-	let element = createElement(PageComponent, {});
-	for (let i = segments.length - 1; i >= 0; i--) {
-		const segment = segments[i];
-		element = await wrapSegmentWithErrorBoundaries(segment, element, {
-			loadModule,
-			createElement,
-			errorBoundaryComponent
-		});
-		if (segment.access) {
-			const accessFn = (await loadModule(segment.access)).default;
-			element = createElement("timber:access-gate", {
-				accessFn,
-				segmentName: segment.segmentName,
-				children: element
-			});
-		}
-		if (segment.layout) {
-			const LayoutComponent = (await loadModule(segment.layout)).default;
-			if (LayoutComponent) {
-				const slotProps = {};
-				const slotNames = Object.keys(segment.slots);
-				if (slotNames.length > 0) for (const slotName of slotNames) {
-					const slotNode = segment.slots[slotName];
-					slotProps[slotName] = await buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent);
-				}
-				element = createElement(LayoutComponent, {
-					...slotProps,
-					children: element
-				});
-			}
-		}
+function resolveAllowedMethods(mod) {
+	const methods = [];
+	for (const method of HTTP_METHODS) {
+		if (method === "HEAD" || method === "OPTIONS") continue;
+		if (mod[method]) methods.push(method);
 	}
-	return {
-		tree: element,
-		isApiRoute: false
-	};
+	if (mod.GET && !mod.HEAD) methods.push("HEAD");
+	else if (mod.HEAD) methods.push("HEAD");
+	if (!mod.OPTIONS) methods.push("OPTIONS");
+	else methods.push("OPTIONS");
+	return methods;
 }
 /**
-* Build the element tree for a parallel slot.
+* Handle an incoming request against a route.ts module.
 *
-* Slots have their own access.ts (SlotAccessGate) and error boundaries.
-* On access denial: denied.tsx → default.tsx → null (graceful degradation).
+* Dispatches to the named method handler, auto-generates 405/OPTIONS,
+* and merges response headers from ctx.headers.
 */
-async function buildSlotElement(slotNode, loadModule, createElement, errorBoundaryComponent) {
-	const PageComponent = (slotNode.page ? await loadModule(slotNode.page) : null)?.default;
-	const DefaultComponent = (slotNode.default ? await loadModule(slotNode.default) : null)?.default;
-	if (!PageComponent) return DefaultComponent ? createElement(DefaultComponent, {}) : null;
-	let element = createElement(PageComponent, {});
-	element = await wrapSegmentWithErrorBoundaries(slotNode, element, {
-		loadModule,
-		createElement,
-		errorBoundaryComponent
+async function handleRouteRequest(mod, ctx) {
+	const method = ctx.req.method.toUpperCase();
+	const allowHeader = resolveAllowedMethods(mod).join(", ");
+	if (method === "OPTIONS") {
+		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
+		return new Response(null, {
+			status: 204,
+			headers: { Allow: allowHeader }
+		});
+	}
+	if (method === "HEAD") {
+		if (mod.HEAD) return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
+		if (mod.GET) return stripHeadBody(await runHandler(mod.GET, ctx), method);
+	}
+	const handler = mod[method];
+	if (!handler) return new Response(null, {
+		status: 405,
+		headers: { Allow: allowHeader }
 	});
-	if (slotNode.access) {
-		const accessFn = (await loadModule(slotNode.access)).default;
-		const DeniedComponent = (slotNode.denied ? await loadModule(slotNode.denied) : null)?.default ?? null;
-		const defaultFallback = DefaultComponent ? createElement(DefaultComponent, {}) : null;
-		element = createElement("timber:slot-access-gate", {
-			accessFn,
-			DeniedComponent,
-			slotName: slotNode.segmentName.replace(/^@/, ""),
-			createElement,
-			defaultFallback,
-			children: element
+	return runHandler(handler, ctx);
+}
+/**
+* Run a handler, merge ctx.headers into the response, and catch errors.
+*/
+async function runHandler(handler, ctx) {
+	try {
+		return mergeResponseHeaders(await handler(ctx), ctx.headers);
+	} catch (error) {
+		if (error instanceof DenySignal || error instanceof RedirectSignal) throw error;
+		logRouteError({
+			method: ctx.req.method,
+			path: new URL(ctx.req.url).pathname,
+			error
 		});
+		return new Response(null, { status: 500 });
 	}
-	return element;
 }
-//#endregion
-//#region src/server/status-code-resolver.ts
 /**
-* Look up `{statusStr}` then `{categoryKey}` (e.g. "4xx" / "5xx") in a
-* status-file group on a single segment. Shared by all three fallback
-* chains — the only structural difference between component 4xx,
-* component 5xx, and JSON resolution is *which* group is searched and
-* how the per-segment loop is layered around it.
+* Merge response headers from ctx.headers into the handler's response.
+* ctx.headers (set by middleware or the handler) are applied to the final response.
+* Handler-set headers take precedence over ctx.headers.
 */
-function lookupInGroup(group, statusStr, categoryKey, segmentIndex, status) {
-	if (!group) return null;
-	const exact = group[statusStr];
-	if (exact) return {
-		file: exact,
-		status,
-		kind: "exact",
-		segmentIndex
-	};
-	const category = group[categoryKey];
-	if (category) return {
-		file: category,
-		status,
-		kind: "category",
-		segmentIndex
-	};
-	return null;
+function mergeResponseHeaders(res, ctxHeaders) {
+	let hasCtxHeaders = false;
+	ctxHeaders.forEach(() => {
+		hasCtxHeaders = true;
+	});
+	if (!hasCtxHeaders) return res;
+	const merged = new Headers();
+	ctxHeaders.forEach((value, key) => {
+		if (key.toLowerCase() === "set-cookie") merged.append(key, value);
+		else merged.set(key, value);
+	});
+	const resCookies = res.headers.getSetCookie();
+	for (const cookie of resCookies) merged.append("Set-Cookie", cookie);
+	res.headers.forEach((value, key) => {
+		if (key.toLowerCase() !== "set-cookie") merged.set(key, value);
+	});
+	return new Response(res.body, {
+		status: res.status,
+		statusText: res.statusText,
+		headers: merged
+	});
 }
+//#endregion
+//#region src/server/render-timeout.ts
 /**
-* Resolve the status-code file to render for a given HTTP status code.
+* Render timeout utilities for SSR streaming pipeline.
 *
-* Walks the segment chain from leaf to root following the fallback chain
-* defined in design/10-error-handling.md. Returns null if no file is found
-* (caller should render the framework default).
+* Provides a RenderTimeoutError class and a helper to create
+* timeout-guarded AbortSignals. Used to defend against hung RSC
+* streams and infinite SSR renders.
 *
-* @param status - The HTTP status code (4xx or 5xx).
-* @param segments - The matched segment chain from root (index 0) to leaf (last).
-* @param format - The response format family ('component' or 'json'). Defaults to 'component'.
-* @param maxIndex - Optional upper bound on the segment index to search.
-*   When set, the resolver only considers segments `0..maxIndex` (inclusive),
-*   skipping any segments deeper in the tree. Used by the deny renderers to
-*   prevent resolving a status file below a denied segment — matching
-*   `buildDenyPageChain`'s start-at-i semantics. The error renderers omit
-*   this parameter, so the full chain is searched — a 500 from a leaf page
-*   should use the leaf's own `5xx.tsx`. See TIM-1358.
+* Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
 */
-function resolveStatusFile(status, segments, format = "component", maxIndex) {
-	if (status < 400 || status > 599) return null;
-	if (format === "json") return resolveJson(status, segments, maxIndex);
-	if (status <= 499) return resolve4xx(status, segments, maxIndex);
-	return resolve5xx(status, segments, maxIndex);
-}
 /**
-* 4xx component fallback chain — two separate full passes leaf→root.
+* Error thrown when an SSR render or RSC stream read exceeds the
+* configured timeout. Callers can check `instanceof RenderTimeoutError`
+* to distinguish timeout from other errors and return a 504 or close
+* the connection cleanly.
+*/
+var RenderTimeoutError = class extends Error {
+	timeoutMs;
+	constructor(timeoutMs, context) {
+		const message = context ? `Render timeout after ${timeoutMs}ms: ${context}` : `Render timeout after ${timeoutMs}ms`;
+		super(message);
+		this.name = "RenderTimeoutError";
+		this.timeoutMs = timeoutMs;
+	}
+};
+//#endregion
+//#region src/server/prebuilt/cache-key.ts
+/**
+* Component cache-key hashing for prebuilt (cache.component) entries.
 *
-* The passes must be separate (not interleaved per-segment) so that a
-* root-level `404.tsx` beats a leaf-level `error.tsx`. The 5xx chain
-* inverts this and is per-segment: a leaf's `error.tsx` beats a root's
-* `5xx.tsx`. This asymmetry is the only reason these two functions exist
-* separately.
+* Key: `sha256(canonicalJson({ props, params })).slice(0, 16)` — see
+* design/44-render-at-build-time.md §Cache Key. Both the request-time
+* lookup (prebuilt-runtime.ts) and the post-build capture pass (TIM-1119)
+* MUST use this exact function, or build artifacts become unaddressable.
 *
-*   Pass 1 — {status}.tsx → 4xx.tsx           (statusFiles)
-*   Pass 2 — error.tsx                         (error)
+* THE IDENTITY CONTRACT (design/44 §Cache Key): cache identity is **JSON
+* value semantics** — two inputs are the same entry iff they are the same
+* JSON value. This is an ALLOWLIST, not a denylist: a value participates
+* in caching iff it is plain JSON data — null, boolean, finite number,
+* string, dense array, or a plain `Object.prototype` object with only
+* enumerable string-keyed data properties — plus `undefined` and `-0`,
+* which hash as distinct sentinels because flight preserves them. Every
+* value outside that domain (functions, symbols, bigints, accessors,
+* hidden or symbol-keyed properties, non-`Object.prototype` prototypes
+* including null, aliased references, sparse arrays, cycles, non-finite
+* numbers) is UNKEYABLE by definition: `computeComponentCacheKey` returns
+* null and the caller renders live — slower, never wrong.
+*
+* The line between rejected and declared-out-of-domain: values are
+* REJECTED when the JSON projection itself would be ambiguous or lossy
+* (hidden/symbol/non-enumerable properties, accessors, exotic
+* prototypes). Observable state that leaves the projection intact — key
+* order, reference identity, descriptor metadata (writable/configurable,
+* frozen/sealed/extensible), proxy behavior — is DECLARED outside
+* cache.component's supported input domain rather than rejected:
+* key-order insensitivity is required for determinism, and rejecting
+* frozen objects would unkey ubiquitous legitimate inputs
+* (Object.freeze'd config props) to defend against components that
+* render differently based on property attributes.
+*
+* Two hard rules for this walk itself: it must be TOTAL (never throw
+* anything but UnkeyableValueError) and SIDE-EFFECT-FREE (descriptor
+* reads only; never invoke user code such as getters).
+*
+* Object keys sort recursively so `{a, b}` and `{b, a}` hash identically
+* (design/13-security.md checklist #14 — cache key determinism; key order
+* is deliberately NOT part of identity).
 */
-function resolve4xx(status, segments, maxIndex) {
-	const statusStr = String(status);
-	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
-	for (let i = start; i >= 0; i--) {
-		const r = lookupInGroup(segments[i].statusFiles, statusStr, "4xx", i, status);
-		if (r) return r;
+var UnkeyableValueError = class extends Error {};
+function canonicalize$1(value, seen) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "string": return JSON.stringify(value);
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new UnkeyableValueError("non-finite number");
+			return Object.is(value, -0) ? "-0" : String(value);
+		case "object": break;
+		case "undefined": return "undefined";
+		default: throw new UnkeyableValueError(`unsupported type: ${typeof value}`);
 	}
-	for (let i = start; i >= 0; i--) {
-		const errorFile = segments[i].error;
-		if (errorFile) return {
-			file: errorFile,
-			status,
-			kind: "error",
-			segmentIndex: i
-		};
+	const obj = value;
+	if (seen.has(obj)) throw new UnkeyableValueError("repeated object reference (cycle or alias)");
+	seen.add(obj);
+	if (Object.getOwnPropertySymbols(obj).length > 0) throw new UnkeyableValueError("symbol-keyed property");
+	{
+		if (Array.isArray(obj)) {
+			if (Object.getOwnPropertyNames(obj).length !== obj.length + 1) throw new UnkeyableValueError("non-index array property");
+			const parts = [];
+			for (let i = 0; i < obj.length; i++) {
+				const desc = Object.getOwnPropertyDescriptor(obj, i);
+				if (desc === void 0) throw new UnkeyableValueError("sparse array hole");
+				if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+				if (!desc.enumerable) throw new UnkeyableValueError("non-enumerable array element");
+				parts.push(canonicalize$1(desc.value, seen));
+			}
+			return "[" + parts.join(",") + "]";
+		}
+		if (Object.getPrototypeOf(obj) !== Object.prototype) throw new UnkeyableValueError("non-plain object");
+		const keys = Object.keys(obj).sort();
+		if (keys.length !== Object.getOwnPropertyNames(obj).length) throw new UnkeyableValueError("non-enumerable property");
+		const parts = [];
+		for (const key of keys) {
+			const desc = Object.getOwnPropertyDescriptor(obj, key);
+			if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+			parts.push(JSON.stringify(key) + ":" + canonicalize$1(desc.value, seen));
+		}
+		return "{" + parts.join(",") + "}";
 	}
-	return null;
 }
 /**
-* 5xx component fallback chain — single pass, per-segment leaf→root.
-*
-* At each segment: {status}.tsx → 5xx.tsx → error.tsx. A leaf's
-* `error.tsx` therefore beats a root's `5xx.tsx`, which is the
-* intentional inverse of the 4xx chain.
+* Canonicalize a single value, or null if it is unkeyable. The ONE
+* definition of "faithfully comparable" — every prebuilt code path that
+* needs value equality (cache keys, slot-param divergence) goes through
+* this, so the unkeyable rules (accessors, hidden props, aliases,
+* bigints, …) live in exactly one place.
 */
-function resolve5xx(status, segments, maxIndex) {
-	const statusStr = String(status);
-	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
-	for (let i = start; i >= 0; i--) {
-		const segment = segments[i];
-		const r = lookupInGroup(segment.statusFiles, statusStr, "5xx", i, status);
-		if (r) return r;
-		if (segment.error) return {
-			file: segment.error,
-			status,
-			kind: "error",
-			segmentIndex: i
-		};
+function tryCanonicalize(value) {
+	try {
+		return canonicalize$1(value, /* @__PURE__ */ new Set());
+	} catch (error) {
+		return toUnkeyable(error);
 	}
-	return null;
 }
 /**
-* JSON fallback chain (for both 4xx and 5xx) — single pass leaf→root.
-*
-* At each segment: {status}.json → {category}.json. No legacy compat,
-* no error.tsx — the JSON chain terminates at the category catch-all
-* and the caller falls back to a bare-JSON framework default.
+* Totality by construction: ANY throw from the walk means the input is
+* outside the keyable domain. The walk touches only user-controlled
+* values through reflection ops — and a Proxy trap can throw arbitrary
+* errors from any of them (codex review on PR #835) — so converting only
+* UnkeyableValueError would let hostile/exotic inputs abort a render
+* that plain live rendering would have served fine. Unexpected error
+* types are logged for visibility (they would indicate either a proxy
+* trap or a canonicalizer bug) but still degrade to unkeyable.
 */
-function resolveJson(status, segments, maxIndex) {
-	const statusStr = String(status);
-	const categoryKey = status >= 500 ? "5xx" : "4xx";
-	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
-	for (let i = start; i >= 0; i--) {
-		const r = lookupInGroup(segments[i].jsonStatusFiles, statusStr, categoryKey, i, status);
-		if (r) return r;
-	}
+function toUnkeyable(error) {
+	if (!(error instanceof UnkeyableValueError)) console.error("[timber] cache key canonicalization threw — treating input as unkeyable:", error);
 	return null;
 }
 /**
-* Resolve the denial file for a parallel route slot.
+* Split a props record into data props (participate in the cache key) and
+* slot values (React-element holes, excluded from the key) per the
+* component's declared `slots` option (TIM-1173).
 *
-* Slot denial is graceful degradation — no HTTP status on the wire.
-* Fallback chain: denied.tsx → default.tsx → null.
+* Every DECLARED slot lands in `slotValues` — present or not — because the
+* capture render always injects a SlotOutlet placeholder for each declared
+* slot: the cached shell is identical whether the caller passed the slot
+* or omitted it, so slot presence must not vary the key. `dataProps` is
+* everything else and is what gets hashed.
 *
-* @param slotNode - The segment node for the slot (segmentType === 'slot').
+* Returns null when the props OBJECT itself is outside the identity
+* contract at the top level — accessors, symbol-keyed or non-enumerable
+* properties, or a non-`Object.prototype` prototype. Splitting such an
+* object would normalize away observable state (and reading an accessor
+* would invoke user code, which this walk must never do) BEFORE
+* `computeComponentCacheKey` gets the chance to reject it — a cached
+* shell could then be served for inputs a live render distinguishes.
+* Null means unkeyable: the caller renders live with the original props.
+* The walk is descriptor-reads only; getters are never invoked. Nested
+* data-prop values still face the full allowlist when hashed.
 */
-function resolveSlotDenied(slotNode) {
-	const slotName = slotNode.segmentName.replace(/^@/, "");
-	if (slotNode.denied) return {
-		file: slotNode.denied,
-		slotName,
-		kind: "denied"
-	};
-	if (slotNode.default) return {
-		file: slotNode.default,
-		slotName,
-		kind: "default"
-	};
-	return null;
+/** Create an own enumerable data property — safe for keys like `__proto__`. */
+function defineOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
 }
-//#endregion
-//#region src/server/csrf.ts
-/** HTTP methods that are considered safe (no mutation). */
-var SAFE_METHODS = /* @__PURE__ */ new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]);
-/**
-* Derive the request's scheme from trusted sources.
-*
-* Priority:
-* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
-* 2. Request URL protocol
-*
-* Falls back to 'https' (fail closed) if neither is available.
-*/
-function deriveRequestScheme(req) {
-	const forwarded = req.headers.get("X-Forwarded-Proto");
-	if (forwarded) {
-		const proto = forwarded.split(",")[0].trim().toLowerCase();
-		if (proto === "http" || proto === "https") return proto;
-	}
+function splitSlotProps(props, slots) {
 	try {
-		return new URL(req.url).protocol.replace(":", "");
-	} catch {
-		return "https";
+		if (Object.getPrototypeOf(props) !== Object.prototype) return null;
+		if (Object.getOwnPropertySymbols(props).length > 0) return null;
+		const slotSet = new Set(slots);
+		const dataProps = {};
+		const slotValues = {};
+		for (const key of Object.getOwnPropertyNames(props)) {
+			const desc = Object.getOwnPropertyDescriptor(props, key);
+			if (desc === void 0 || desc.get !== void 0 || desc.set !== void 0 || !desc.enumerable) return null;
+			defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
+		}
+		for (const slot of slotSet) if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, void 0);
+		return {
+			dataProps,
+			slotValues
+		};
+	} catch (error) {
+		return toUnkeyable(error);
 	}
 }
 /**
-* Validate the Origin header against the request's full origin
-* (scheme + host + port).
-*
-* For mutation methods (POST, PUT, PATCH, DELETE):
-* - If `csrf: false`, skip validation.
-* - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
-* - Otherwise, Origin must match the derived request origin.
+* Compute the cache-entry hash for a component render:
+* `sha256({props, params}).slice(0, 16)` over canonical JSON.
 *
-* Safe methods (GET, HEAD, OPTIONS) always pass.
+* Returns null when props (or params) contain unkeyable values — the
+* caller must fall back to dynamic rendering.
 */
-function validateCsrf(req, config) {
-	if (SAFE_METHODS.has(req.method)) return { ok: true };
-	if (config.csrf === false) return { ok: true };
-	const origin = req.headers.get("Origin");
-	if (!origin) return {
-		ok: false,
-		status: 403
-	};
-	if (config.allowedOrigins) return config.allowedOrigins.includes(origin) ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
-	const host = req.headers.get("Host");
-	if (!host) return {
-		ok: false,
-		status: 403
-	};
-	let originOrigin;
-	try {
-		originOrigin = new URL(origin).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
-	}
-	const scheme = deriveRequestScheme(req);
-	let expectedOrigin;
+function computeComponentCacheKey(props, params) {
+	let canonical;
 	try {
-		expectedOrigin = new URL(`${scheme}://${host}`).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
+		const seen = /* @__PURE__ */ new Set();
+		canonical = "{\"params\":" + canonicalize$1({ ...params }, seen) + ",\"props\":" + canonicalize$1(props, seen) + "}";
+	} catch (error) {
+		return toUnkeyable(error);
 	}
-	return originOrigin === expectedOrigin ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
+	return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
 //#endregion
-//#region src/server/body-limits.ts
-var KB = 1024;
-var MB = 1024 * KB;
-var GB = 1024 * MB;
-var DEFAULT_LIMITS = {
-	actionBodySize: 1 * MB,
-	uploadBodySize: 10 * MB,
-	maxFields: 100
-};
-var SIZE_PATTERN = /^(\d+(?:\.\d+)?)\s*(kb|mb|gb)?$/i;
-/** Parse a human-readable size string ("1mb", "512kb", "1024") into bytes. */
-function parseBodySize(size) {
-	const match = SIZE_PATTERN.exec(size.trim());
-	if (!match) throw new Error(`Invalid body size format: "${size}". Expected format like "1mb", "512kb", or "1024".`);
-	const value = Number.parseFloat(match[1]);
-	const unit = (match[2] ?? "").toLowerCase();
-	switch (unit) {
-		case "kb": return Math.floor(value * KB);
-		case "mb": return Math.floor(value * MB);
-		case "gb": return Math.floor(value * GB);
-		case "": return Math.floor(value);
-		default: throw new Error(`Unknown size unit: "${unit}"`);
+//#region src/client/slot-context.ts
+/**
+* SlotContext — delivers live slot content to SlotOutlet holes inside
+* cached component shells (TIM-1173).
+*
+* A `cache.component(Fn, { slots: [...] })` shell is captured with a
+* stable <SlotOutlet slot={name} /> client reference in place of each
+* declared slot prop. At request time the revived shell is wrapped in a
+* SlotsProvider carrying the live slot values; each outlet reads its
+* value from this context by name.
+*
+* Providers MERGE per-key with their parent: an inner SlotsProvider
+* inherits the outer's values and overrides only the keys it declares.
+* Two sibling instances each have their own provider and resolve
+* independently. Layouts use a reserved slot name (LAYOUT_CHILDREN_SLOT)
+* that cannot collide with user-declared slot names (TIM-1191).
+*
+* Generalizes the original layout children pattern (TIM-1181) from a
+* single implicit `children` hole on layouts to explicitly declared,
+* named slot props on any cached component. Layouts use this same
+* context with the reserved LAYOUT_CHILDREN_SLOT key (TIM-1191).
+*
+* SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
+* can duplicate this module across chunks; globalThis guarantees a single
+* context instance.
+*
+* See design/45-cache-lifetimes.md §Slot Components.
+*/
+var CTX_KEY = Symbol.for("__timber_slot_ctx");
+function getOrCreateContext() {
+	const existing = globalThis[CTX_KEY];
+	if (existing !== void 0) return existing;
+	if (typeof React.createContext === "function") {
+		const ctx = React.createContext(null);
+		globalThis[CTX_KEY] = ctx;
+		return ctx;
 	}
 }
-/** Strict integer pattern: one or more digits, nothing else. */
-var STRICT_INTEGER_RE = /^\d+$/;
-/** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
-function enforceBodyLimits(req, kind, config) {
-	const contentLength = req.headers.get("Content-Length");
-	if (!contentLength) return {
-		ok: false,
-		status: 411
-	};
-	const trimmed = contentLength.trim();
-	if (!STRICT_INTEGER_RE.test(trimmed)) return {
-		ok: false,
-		status: 411
-	};
-	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
-		ok: false,
-		status: 413
-	};
-}
+var SlotContext = getOrCreateContext();
+//#endregion
+//#region src/client/slot-outlet.tsx
 /**
-* Resolve the byte limit for a given body kind, using config overrides or defaults.
+* SlotOutlet — the hole in a cached component shell (TIM-1173).
+*
+* At capture time the prebuilt runtime renders the wrapped component with
+* <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
+* client component, it serializes into the flight payload as a stable,
+* deterministic client reference — the same bytes regardless of what live
+* content will fill the hole. At request time the revived shell sits under
+* a SlotsProvider and each outlet reads its live value from SlotContext.
+*
+* See design/45-cache-lifetimes.md §Slot Components.
 */
-function resolveLimit(kind, config) {
-	const userLimits = config.limits;
-	if (kind === "action") return userLimits?.actionBodySize ? parseBodySize(userLimits.actionBodySize) : DEFAULT_LIMITS.actionBodySize;
-	return userLimits?.uploadBodySize ? parseBodySize(userLimits.uploadBodySize) : DEFAULT_LIMITS.uploadBodySize;
+function SlotOutlet({ slot }) {
+	const values = useContext(SlotContext);
+	return values ? values[slot] ?? null : null;
 }
 //#endregion
-//#region src/server/route-handler.ts
-/** All recognized HTTP method export names. */
-var HTTP_METHODS = [
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE",
-	"HEAD",
-	"OPTIONS"
-];
+//#region src/client/slot-provider.tsx
 /**
-* Resolve the full list of allowed methods for a route module.
+* SlotsProvider — wraps a revived cached shell to supply live slot content
+* to the SlotOutlet holes inside it (TIM-1173).
 *
-* Includes:
-* - All explicitly exported methods
-* - HEAD (implicit when GET is exported)
-* - OPTIONS (always implicit)
+* Values MERGE with the nearest parent provider so that nesting a
+* cache.component SlotsProvider inside a layout SlotsProvider preserves
+* the layout's `children` slot while adding the component's own slots.
+* Inner values override outer ones with the same name (spread order).
+*
+* Tree structure per cached-component instance:
+*   SlotsProvider(values={children: <Live />})
+*     └── revived shell
+*          └── SlotOutlet(slot="children") → reads context → <Live />
+*
+* See design/45-cache-lifetimes.md §Slot Components.
 */
-function resolveAllowedMethods(mod) {
-	const methods = [];
-	for (const method of HTTP_METHODS) {
-		if (method === "HEAD" || method === "OPTIONS") continue;
-		if (mod[method]) methods.push(method);
-	}
-	if (mod.GET && !mod.HEAD) methods.push("HEAD");
-	else if (mod.HEAD) methods.push("HEAD");
-	if (!mod.OPTIONS) methods.push("OPTIONS");
-	else methods.push("OPTIONS");
-	return methods;
+function SlotsProvider({ values, children }) {
+	const parent = useContext(SlotContext);
+	const merged = parent ? {
+		...parent,
+		...values
+	} : values;
+	return createElement(SlotContext.Provider, { value: merged }, children);
 }
 /**
-* Handle an incoming request against a route.ts module.
+* Is this value the framework-injected layout children slot outlet
+* (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
+* receive this as their `children` prop — a stable client reference
+* whose cache key is stripped so layout `cache.component` hits work
+* (design/45 §Layout Propagation).
 *
-* Dispatches to the named method handler, auto-generates 405/OPTIONS,
-* and merges response headers from ctx.headers.
+* Uses a framework-reserved slot name (LAYOUT_CHILDREN_SLOT) that
+* cannot collide with user-declared slot names, preventing context
+* shadowing when a cached component with its own SlotsProvider is
+* nested inside a layout. See TIM-1191.
+*
+* Total: the probes run against a user-controlled value, and a Proxy
+* trap can throw — that must classify as "not the outlet" (the
+* canonicalizer then rejects the value as unkeyable → live render), not
+* abort the request (codex P2 on PR #890).
 */
-async function handleRouteRequest(mod, ctx) {
-	const method = ctx.req.method.toUpperCase();
-	const allowHeader = resolveAllowedMethods(mod).join(", ");
-	if (method === "OPTIONS") {
-		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
-		return new Response(null, {
-			status: 204,
-			headers: { Allow: allowHeader }
-		});
-	}
-	if (method === "HEAD") {
-		if (mod.HEAD) return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
-		if (mod.GET) return stripHeadBody(await runHandler(mod.GET, ctx), method);
+function isChildrenSlotOutletElement(value) {
+	try {
+		if (value == null || typeof value !== "object") return false;
+		if (!("type" in value)) return false;
+		const el = value;
+		return el.type === SlotOutlet && el.props?.slot === "\0timber:children";
+	} catch {
+		return false;
 	}
-	const handler = mod[method];
-	if (!handler) return new Response(null, {
-		status: 405,
-		headers: { Allow: allowHeader }
-	});
-	return runHandler(handler, ctx);
 }
 /**
-* Run a handler, merge ctx.headers into the response, and catch errors.
+* Dense array of non-empty strings — no holes, no non-string entries.
+* Total: the reads run against a user-controlled value at module load,
+* and a throwing Proxy trap must classify as invalid, not crash startup.
 */
-async function runHandler(handler, ctx) {
+function isDenseStringArray(value) {
 	try {
-		return mergeResponseHeaders(await handler(ctx), ctx.headers);
-	} catch (error) {
-		if (error instanceof DenySignal || error instanceof RedirectSignal) throw error;
-		logRouteError({
-			method: ctx.req.method,
-			path: new URL(ctx.req.url).pathname,
-			error
-		});
-		return new Response(null, { status: 500 });
+		if (!Array.isArray(value)) return false;
+		for (let i = 0; i < value.length; i++) {
+			if (!Object.hasOwn(value, i)) return false;
+			const entry = value[i];
+			if (typeof entry !== "string" || entry.length === 0) return false;
+		}
+		return true;
+	} catch {
+		return false;
 	}
 }
 /**
-* Merge response headers from ctx.headers into the handler's response.
-* ctx.headers (set by middleware or the handler) are applied to the final response.
-* Handler-set headers take precedence over ctx.headers.
+* Validate the `slots` option. Both the production and dev wrappers gate
+* on this — slot substitution is active in dev exactly when it would be
+* active in production, so the tree shape a component sees never
+* diverges between the two.
 */
-function mergeResponseHeaders(res, ctxHeaders) {
-	let hasCtxHeaders = false;
-	ctxHeaders.forEach(() => {
-		hasCtxHeaders = true;
-	});
-	if (!hasCtxHeaders) return res;
-	const merged = new Headers();
-	ctxHeaders.forEach((value, key) => {
-		if (key.toLowerCase() === "set-cookie") merged.append(key, value);
-		else merged.set(key, value);
-	});
-	const resCookies = res.headers.getSetCookie();
-	for (const cookie of resCookies) merged.append("Set-Cookie", cookie);
-	res.headers.forEach((value, key) => {
-		if (key.toLowerCase() !== "set-cookie") merged.set(key, value);
-	});
-	return new Response(res.body, {
-		status: res.status,
-		statusText: res.statusText,
-		headers: merged
-	});
+function resolveSlotNames(id, options) {
+	const slots = options.slots;
+	if (slots === void 0) return { kind: "none" };
+	if (!isDenseStringArray(slots)) {
+		console.warn(`[timber] cache.component "${id}": invalid slots declaration — expected an array of non-empty prop-name strings. Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	if (slots.length === 0) return { kind: "none" };
+	if (!(options.ttl !== void 0 || options.tags != null)) {
+		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	return {
+		kind: "active",
+		slots
+	};
 }
-//#endregion
-//#region src/server/render-timeout.ts
 /**
-* Render timeout utilities for SSR streaming pipeline.
-*
-* Provides a RenderTimeoutError class and a helper to create
-* timeout-guarded AbortSignals. Used to defend against hung RSC
-* streams and infinite SSR renders.
+* Split the live props into the cacheable shell render (data props plus a
+* deterministic SlotOutlet placeholder per declared slot — identical
+* whether or not the caller passed the slot) and the per-instance live
+* slot values.
 *
-* Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
+* Null when the props object itself is unkeyable at the top level
+* (accessors, hidden properties, exotic prototype — see splitSlotProps):
+* the caller must render live with the original props.
 */
+function prepareSlotRender(props, slots) {
+	const split = splitSlotProps(props ?? {}, slots);
+	if (split === null) return null;
+	const { dataProps, slotValues } = split;
+	const shellProps = { ...dataProps };
+	for (const slot of slots) Object.defineProperty(shellProps, slot, {
+		value: createElement(SlotOutlet, { slot }),
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	return {
+		shellProps,
+		dataProps,
+		slotValues
+	};
+}
 /**
-* Error thrown when an SSR render or RSC stream read exceeds the
-* configured timeout. Callers can check `instanceof RenderTimeoutError`
-* to distinguish timeout from other errors and return a 504 or close
-* the connection cleanly.
+* Wrap a rendered shell (revived payload or live element) in a
+* per-instance SlotsProvider feeding the live values to its outlets.
 */
-var RenderTimeoutError = class extends Error {
-	timeoutMs;
-	constructor(timeoutMs, context) {
-		const message = context ? `Render timeout after ${timeoutMs}ms: ${context}` : `Render timeout after ${timeoutMs}ms`;
-		super(message);
-		this.name = "RenderTimeoutError";
-		this.timeoutMs = timeoutMs;
-	}
-};
+function wrapInSlotsProvider(shell, slotValues) {
+	return createElement(SlotsProvider, {
+		values: slotValues,
+		children: shell
+	});
+}
 //#endregion
 //#region src/server/prebuilt/key-discipline.ts
 /** Components already warned — exported so tests can reset between cases. */