@timber-js/app 0.2.0-alpha.191 → 0.2.0-alpha.194

package/src/routing/convention-lint.ts

@@ -17,17 +17,17 @@
  * Design doc: 07-routing.md, 10-error-handling.md
  */
 
-import { existsSync } from 'node:fs';
-import type { RouteFile, RouteTree, SegmentNode } from './types.js';
-import { swallow } from '../server/logger.js';
-import { isMdxFilePath } from '../server/utils/mdx-file.js';
+import { existsSync, readFileSync } from 'node:fs';
+import type { RouteFile, RouteTree, SegmentNode } from './types.ts';
+import { swallow } from '../server/logger.ts';
+import { isMdxFilePath } from '../server/utils/mdx-file.ts';
 import {
   fileDefaultExportIsLocalValue,
   fileHasAnyExport,
   fileHasDefaultExport,
   fileHasDirective,
   fileHasStarExport,
-} from './export-detect.js';
+} from './export-detect.ts';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 
@@ -69,15 +69,56 @@ export function lintConventions(tree: RouteTree, appDir: string): ConventionWarn
   // Check 5: page.tsx / layout.tsx without default export
   checkDefaultExports(tree.root, warnings);
 
-  // Check 6: error.tsx / 404.tsx / 4xx.tsx / … without 'use client' directive
+  // Check 6: Client layouts cannot suppress server children before Flight
+  // serializes them. They remain valid UI boundaries, but not authorization
+  // or data-hiding boundaries.
+  checkClientLayouts(tree.root, warnings);
+
+  // Check 7: error.tsx / 404.tsx / 4xx.tsx / … without 'use client' directive
   checkClientBoundaryFiles(tree.root, warnings);
   if (tree.globalError) {
     checkFileUseClientDirective(tree.globalError, 'global-error', warnings);
   }
 
+  // Check 8: Wildcard MDX status files (4xx.mdx, 5xx.mdx, error.mdx) that
+  // reference `props` — props resolve on deny and throw paths but are empty
+  // on the boundary path. See design/10-error-handling.md §"MDX Props by Path".
+  checkWildcardMdxProps(tree.root, warnings);
+
   return warnings;
 }
 
+function checkClientLayouts(node: SegmentNode, warnings: ConventionWarning[]): void {
+  if (node.layout && isScriptExtension(node.layout.extension)) {
+    try {
+      const isClient = fileHasDirective(node.layout.filePath, 'use client');
+      const isProvablyServer = fileDefaultExportIsLocalValue(node.layout.filePath);
+      if (isClient || !isProvablyServer) {
+        const certainty = isClient
+          ? `This layout is a client component.`
+          : `Timber cannot prove this layout is a server component because its default export comes from another module or an opaque expression.`;
+        warnings.push({
+          id: `CLIENT_LAYOUT_NOT_AUTH_BOUNDARY:${node.layout.filePath}`,
+          summary: isClient
+            ? `Client layout cannot securely suppress server children: ${node.layout.filePath}`
+            : `Layout may resolve to a client component and cannot be trusted as an auth boundary: ${node.layout.filePath}`,
+          details:
+            `  File: ${node.layout.filePath}\n\n` +
+            `  ${certainty}\n` +
+            `  React Flight resolves server content passed to a client layout before the layout runs in the browser.\n` +
+            `  Conditionally omitting children here does not prevent descendant server components from executing or being serialized.\n\n` +
+            `  To fix: Put authorization in access.ts or a provably server layout with a locally defined default component, and keep client components inside that boundary.\n`,
+          level: 'warn',
+        });
+      }
+    } catch (err) {
+      swallow(err, `convention-lint: unreadable layout file ${node.layout.filePath}`);
+    }
+  }
+  for (const child of node.children) checkClientLayouts(child, warnings);
+  for (const slot of Object.values(node.slots)) checkClientLayouts(slot, warnings);
+}
+
 // ─── Check: Empty App ───────────────────────────────────────────────────────
 
 /**
@@ -408,6 +449,95 @@ function checkFileUseClientDirective(
   });
 }
 
+// ─── Check: Wildcard MDX Props ──────────────────────────────────────────────
+
+/**
+ * Wildcard status file keys in `statusFiles` whose props differ by path.
+ * `error` is not here — the scanner stores it in `node.error`, not
+ * `node.statusFiles`, and the check handles it separately below.
+ */
+const WILDCARD_MDX_STATUS_KEYS = new Set(['4xx', '5xx']);
+
+/**
+ * Warn when a wildcard MDX status file (`4xx.mdx`, `5xx.mdx`, `error.mdx`)
+ * appears to reference `props` in its source.
+ *
+ * These files are pre-rendered into `fallbackElement` on the error-boundary
+ * path, before the error happens, so they receive empty or partial props.
+ * On the deny and error-renderer paths they receive the real props. An author
+ * writing `{props.status}` gets the number on some paths and `undefined` on
+ * others — same source, different output.
+ *
+ * A text scan for `props` is acceptable here because the check is `level:
+ * 'warn'` — a false positive costs a printed line, not a refused build. A
+ * sound check would need the MDX compiler, which is optional, async, and
+ * scoped to the RSC environment. See TIM-1333.
+ *
+ * Exact-code MDX files (e.g. `503.mdx`) are unaffected — all four paths
+ * agree on their status.
+ */
+function checkWildcardMdxProps(node: SegmentNode, warnings: ConventionWarning[]): void {
+  if (node.statusFiles) {
+    for (const [key, file] of Object.entries(node.statusFiles)) {
+      if (WILDCARD_MDX_STATUS_KEYS.has(key) && isMdxFilePath(file.filePath)) {
+        checkMdxFileForProps(file.filePath, key, warnings);
+      }
+    }
+  }
+  if (node.error && isMdxFilePath(node.error.filePath)) {
+    checkMdxFileForProps(node.error.filePath, 'error', warnings);
+  }
+
+  for (const child of node.children) {
+    checkWildcardMdxProps(child, warnings);
+  }
+  for (const slot of Object.values(node.slots)) {
+    checkWildcardMdxProps(slot, warnings);
+  }
+}
+
+/**
+ * Check if an MDX file's source appears to reference `props`.
+ *
+ * MDX passes a `props` object to the default export function. A reference to
+ * `props.status` or `props.dangerouslyPassData` in a wildcard file works on
+ * the deny/throw paths but renders `undefined` on the boundary path.
+ */
+function checkMdxFileForProps(
+  filePath: string,
+  convention: string,
+  warnings: ConventionWarning[]
+): void {
+  let source: string;
+  try {
+    source = readFileSync(filePath, 'utf-8');
+  } catch {
+    return;
+  }
+
+  // MDX exposes props via the default export: export default function(props) { ... }
+  // and via JSX expressions: {props.status}. A text scan is intentionally
+  // broad — false positives are cheap at warn level.
+  if (!/\bprops\b/.test(source)) return;
+
+  const label = `${convention}.${filePath.endsWith('.md') ? 'md' : 'mdx'}`;
+  warnings.push({
+    id: `MDX_WILDCARD_PROPS:${filePath}`,
+    summary: `${label} references props, which are empty on the error boundary path: ${filePath}`,
+    details:
+      `  File: ${filePath}\n\n` +
+      `  Wildcard MDX status files (${convention}.mdx) are pre-rendered into\n` +
+      '  fallbackElement before the error occurs. On that path, props are\n' +
+      `  empty${convention === 'error' ? '' : ' (no status, no dangerouslyPassData)'}. On the deny() and error-renderer\n` +
+      '  paths, props.status resolves correctly.\n\n' +
+      '  If this file uses only static content and "props" appears in prose,\n' +
+      '  this warning is a false positive — ignore it.\n\n' +
+      '  To fix: Use only static content in wildcard MDX status files, or\n' +
+      '  use an exact-code file (e.g. 404.mdx) where all paths agree.\n',
+    level: 'warn',
+  });
+}
+
 // ─── Check: App Directory Exists ────────────────────────────────────────────
 
 /**

package/src/routing/export-detect.ts

@@ -8,7 +8,7 @@
 
 import { existsSync } from 'node:fs';
 import { parseAst } from 'vite';
-import { readFileCached } from './file-cache.js';
+import { readFileCached } from './file-cache.ts';
 
 interface AstNode {
   type: string;

package/src/routing/index.ts

@@ -1,6 +1,6 @@
-export { scanRoutes } from './scanner.js';
-export { generateRouteMap } from './codegen.js';
-export type { CodegenOptions } from './codegen.js';
+export { scanRoutes } from './scanner.ts';
+export { generateRouteMap } from './codegen.ts';
+export type { CodegenOptions } from './codegen.ts';
 export type {
   RouteTree,
   SegmentNode,
@@ -8,16 +8,16 @@ export type {
   RouteFile,
   ScannerConfig,
   InterceptionMarker,
-} from './types.js';
-export { DEFAULT_PAGE_EXTENSIONS, INTERCEPTION_MARKERS } from './types.js';
-export { collectInterceptionRewrites } from './interception.js';
-export type { InterceptionRewrite } from './interception.js';
-export { classifyUrlSegment, classifySegment } from './segment-classify.js';
-export type { UrlSegment, SegmentClassification } from './segment-classify.js';
-export { collectLeafRoutes } from './walkers.js';
-export type { LeafRoute, CollectLeafRoutesOptions } from './walkers.js';
+} from './types.ts';
+export { DEFAULT_PAGE_EXTENSIONS, INTERCEPTION_MARKERS } from './types.ts';
+export { collectInterceptionRewrites } from './interception.ts';
+export type { InterceptionRewrite } from './interception.ts';
+export { classifyUrlSegment, classifySegment } from './segment-classify.ts';
+export type { UrlSegment, SegmentClassification } from './segment-classify.ts';
+export { collectLeafRoutes } from './walkers.ts';
+export type { LeafRoute, CollectLeafRoutesOptions } from './walkers.ts';
 export {
   validateSchemaAgainstRoutes,
   collectDynamicSegmentsFromTree,
-} from './schema-validation.js';
-export type { SchemaWarning } from './schema-validation.js';
+} from './schema-validation.ts';
+export type { SchemaWarning } from './schema-validation.ts';

package/src/routing/interception.ts

@@ -17,13 +17,13 @@
  * See design/07-routing.md §"Intercepting Routes"
  */
 
-import type { SegmentNode, InterceptionMarker, RouteFile } from './types.js';
-import { computeSegmentTreePaths, treePathDepth } from './segment-keys.js';
-import { classifyUrlSegment, effectiveUrlSegment } from './segment-classify.js';
+import type { SegmentNode, InterceptionMarker, RouteFile } from './types.ts';
+import { computeSegmentTreePaths, treePathDepth } from './segment-keys.ts';
+import { classifyUrlSegment, effectiveUrlSegment } from './segment-classify.ts';
 // Every collision space — the main tree, each slot, each intercepting subtree
 // — decides order-dependence with the same oracle, so the spaces cannot drift
 // on what counts as two pages answering one URL. See TIM-1308.
-import { findOrderDependentCollision, type ProbeLeaf } from './collision-probe.js';
+import { findOrderDependentCollision, type ProbeLeaf } from './collision-probe.ts';
 
 /** Fields shared by both interception shapes. */
 interface InterceptionRewriteBase {
@@ -505,6 +505,42 @@ function assertInterceptedCatchAllsAreTerminal(node: SegmentNode, nodePath: stri
   }
 }
 
+/**
+ * Reject a `route.ts` anywhere inside an intercepting subtree.
+ *
+ * An interception is a soft-navigation variant of a page — it swaps which
+ * page component renders. A route handler returns a `Response` and cannot
+ * be an interception target: `walkInterceptedLeaves` visits `node.page`
+ * only, so no rewrite is emitted for it, but `isTerminal` in
+ * `tree-match.ts` counts both `page` and `route`, so `matchUrlParts` can
+ * resolve to the route handler. `slot-interception.ts` then drops the
+ * match (`if (!leaf.page) continue`), silently disabling the page's
+ * interception. Fail-safe (the canonical route renders) but silent.
+ *
+ * The walk mirrors `assertInterceptedCatchAllsAreTerminal`: it descends
+ * `children` (not `slots`), matching `collectLeavesWithRewrites` exactly.
+ */
+function assertNoRouteHandlersInSubtree(node: SegmentNode, nodePath: string): void {
+  if (node.route) {
+    throw new Error(
+      `Build error: route handler inside an intercepting route.\n` +
+        `  File: ${node.route.filePath}\n` +
+        `  Directory: app/${nodePath}\n` +
+        `An intercepting subtree renders a page component on soft navigation — a ` +
+        `route handler returns a Response and cannot be an interception target. ` +
+        `The route handler would silently shadow the interception: the resolver ` +
+        `would match it and then discard it because it has no page, so the modal ` +
+        `would stop opening with no diagnostic.\n` +
+        `Remove the route.ts, or move it outside the intercepting subtree.\n` +
+        `See design/07-routing.md §"Intercepting Routes".`
+    );
+  }
+
+  for (const child of node.children) {
+    assertNoRouteHandlersInSubtree(child, `${nodePath}/${child.segmentName}`);
+  }
+}
+
 /**
  * Reject two pages that answer one URL among the interceptors an owner
  * resolves in a single walk.
@@ -723,6 +759,7 @@ function walkForPlacement(node: SegmentNode, path: string, ctx: PlacementContext
       // interception. The same input rewrite generation bases from.
       assertInterceptedBaseIsCountable(child, node.urlPath, childPath);
       assertInterceptedCatchAllsAreTerminal(child, childPath);
+      assertNoRouteHandlersInSubtree(child, childPath);
     }
 
     walkForPlacement(child, childPath, {

package/src/routing/link-codegen.ts

@@ -23,9 +23,9 @@
  * overload TS reports against on failure.
  */
 
-import type { ParamEntry, RouteEntry } from './codegen-types.js';
-import { buildSchemaParamType } from './codegen-shared.js';
-import { classifyUrlSegment } from './segment-classify.js';
+import type { ParamEntry, RouteEntry } from './codegen-types.ts';
+import { buildSchemaParamType } from './codegen-shared.ts';
+import { classifyUrlSegment } from './segment-classify.ts';
 
 /**
  * The `searchParams` prop type, emitted identically on every Link variant

package/src/routing/manifest-codegen.ts

@@ -10,8 +10,8 @@
 
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { collectInterceptionRewrites } from './interception.js';
-import type { RouteTree, SegmentNode, RouteFile } from './types.js';
+import { collectInterceptionRewrites } from './interception.ts';
+import type { RouteTree, SegmentNode, RouteFile } from './types.ts';
 
 // ── Single-file conventions ─────────────────────────────────────────────
 // Each entry maps to a node property that holds a single RouteFile.

package/src/routing/scanner.ts

@@ -17,15 +17,15 @@ import type {
   RouteFile,
   ScannerConfig,
   InterceptionMarker,
-} from './types.js';
-import { classifySegment, effectiveUrlSegment } from './segment-classify.js';
-import { validateInterceptionPlacement, computeInterceptedBase } from './interception.js';
-import { validateRouteGroupCollisions } from './collision-spaces.js';
-import { validateSlotPlacement } from './slot-placement.js';
-import { DEFAULT_PAGE_EXTENSIONS } from './types.js';
-import { classifyMetadataRoute, isDynamicMetadataExtension } from '../server/metadata-routes.js';
-import { swallow } from '../server/logger.js';
-import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.js';
+} from './types.ts';
+import { classifySegment, effectiveUrlSegment } from './segment-classify.ts';
+import { validateInterceptionPlacement, computeInterceptedBase } from './interception.ts';
+import { validateRouteGroupCollisions } from './collision-spaces.ts';
+import { validateSlotPlacement } from './slot-placement.ts';
+import { DEFAULT_PAGE_EXTENSIONS } from './types.ts';
+import { classifyMetadataRoute, isDynamicMetadataExtension } from '../server/metadata-routes.ts';
+import { swallow } from '../server/logger.ts';
+import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.ts';
 
 /**
  * File convention names that use pageExtensions (can be .tsx, .ts, .jsx, .js, .mdx, etc.)
@@ -44,6 +44,30 @@ const FIXED_CONVENTIONS = new Set(['middleware', 'access', 'route']);
  */
 const STATUS_CODE_PATTERN = /^(\d{3}|[45]xx)$/;
 
+/**
+ * Whether a basename + extension pair is a route-convention file the
+ * framework itself imports: page/layout/error/default/denied and
+ * global-error on pageExtensions, middleware/access/route/proxy on
+ * .ts/.tsx/.js/.jsx only, and status-code files (404, 4xx, …) on
+ * pageExtensions or .json — mirroring this scanner's own recognition
+ * rules per family.
+ *
+ * Exported for the analyze classifier so its provisional classification
+ * (design/47 §2) derives from the scanner's real conventions instead of
+ * a duplicate list that can drift.
+ */
+export function isRouteConventionFile(
+  base: string,
+  ext: string,
+  pageExtensions: readonly string[] = DEFAULT_PAGE_EXTENSIONS
+): boolean {
+  const isPageExt = pageExtensions.includes(ext);
+  if ((PAGE_EXT_CONVENTIONS.has(base) || base === 'global-error') && isPageExt) return true;
+  if ((FIXED_CONVENTIONS.has(base) || base === 'proxy') && /^[jt]sx?$/.test(ext)) return true;
+  if (STATUS_CODE_PATTERN.test(base) && (isPageExt || ext === 'json')) return true;
+  return false;
+}
+
 /**
  * Scan the app/ directory and build the route tree.
  *

package/src/routing/schema-validation.ts

@@ -7,10 +7,10 @@
  * Design doc: design/41-global-params.md
  */
 
-import { readFileCached } from './file-cache.js';
-import type { RouteTree, SegmentNode } from './types.js';
-import { findSchemaFile, parseExistingSchemaKeys } from '../cli-schema-sync.js';
-import { classifyUrlSegment } from './segment-classify.js';
+import { readFileCached } from './file-cache.ts';
+import type { RouteTree, SegmentNode } from './types.ts';
+import { findSchemaFile, parseExistingSchemaKeys } from '../cli-schema-sync.ts';
+import { classifyUrlSegment } from './segment-classify.ts';
 
 export interface SchemaWarning {
   type: 'stale-key' | 'missing-key' | 'bracket-mismatch';

package/src/routing/segment-classify.ts

@@ -22,8 +22,8 @@
  * See design/07-routing.md §"Route Segments"
  */
 
-import type { InterceptionMarker, SegmentType } from './types.js';
-import { INTERCEPTION_MARKERS } from './types.js';
+import type { InterceptionMarker, SegmentType } from './types.ts';
+import { INTERCEPTION_MARKERS } from './types.ts';
 
 export type UrlSegment =
   | { kind: 'static'; value: string }

package/src/routing/segment-codegen.ts

@@ -10,7 +10,7 @@
 
 import { writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import type { RouteTree, SegmentNode } from './types.js';
+import type { RouteTree, SegmentNode } from './types.ts';
 
 /** Info carried per directory for type generation. */
 export interface SegmentInfo {

package/src/routing/segment-keys.ts

@@ -23,7 +23,7 @@
  * URL path and the segment classification, never on file payloads.
  */
 
-import type { CoercedParams } from '../shared/param-value.js';
+import type { CoercedParams } from '../shared/param-value.ts';
 
 export interface SegmentKeyInput {
   urlPath: string;

package/src/routing/slot-placement.ts

@@ -9,7 +9,7 @@
  * See design/07-routing.md §"Parallel Routes".
  */
 
-import type { SegmentNode } from './types.js';
+import type { SegmentNode } from './types.ts';
 
 /**
  * Reject every parallel slot that no renderer reaches.

package/src/routing/walkers.ts

@@ -14,7 +14,7 @@
  * local; the other two now share `collectLeafRoutes` from this file.
  */
 
-import type { SegmentNode } from './types.js';
+import type { SegmentNode } from './types.ts';
 
 /** A leaf route discovered while walking the segment tree. */
 export interface LeafRoute<TFile> {

package/src/rsc-runtime/transforms.ts

@@ -0,0 +1,13 @@
+/**
+ * Transforms Adapter — Re-exports from @vitejs/plugin-rsc/transforms.
+ *
+ * This module insulates the rest of the framework from direct imports of
+ * @vitejs/plugin-rsc. The plugin is pre-1.0 and its API surface will change.
+ * By routing all transform-helper imports through this single file, a
+ * breaking upstream change only requires updating one place.
+ *
+ * Keep this as thin pass-through re-exports — the value is the single choke
+ * point, not abstraction.
+ */
+
+export { hasDirective } from '@vitejs/plugin-rsc/transforms';

package/src/rsc-runtime/vendor-types.d.ts

@@ -5,3 +5,15 @@ declare module '@vitejs/plugin-rsc/vendor/react-server-dom/client.node' {
     options?: Record<string, unknown>
   ): React.ReactNode;
 }
+
+declare module '@vitejs/plugin-rsc/vendor/react-server-dom/server.edge' {
+  export function renderToReadableStream(
+    model: unknown,
+    manifest: unknown,
+    options?: {
+      signal?: AbortSignal;
+      onError?: (error: unknown) => string | void;
+      onPostpone?: (reason: string) => void;
+    }
+  ): ReadableStream<Uint8Array>;
+}

package/src/schema-bridge.ts

@@ -24,7 +24,7 @@
  * Design doc: design/23a-search-params-triage.md §"Unify Codec<T> type"
  */
 
-import type { Codec } from './codec.js';
+import type { Codec } from './codec.ts';
 
 // ---------------------------------------------------------------------------
 // Standard Schema interface (subset)

package/src/search-params/define.ts

@@ -10,18 +10,18 @@
  * Design doc: design/23-search-params.md §"defineSearchParams — The Factory"
  */
 
-import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.js';
-import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.js';
-import type { StandardSchemaV1 } from '../schema-bridge.js';
-import type { Codec } from '../codec.js';
+import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.ts';
+import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.ts';
+import type { StandardSchemaV1 } from '../schema-bridge.ts';
+import type { Codec } from '../codec.ts';
 // Server-only reference for .get() — avoids pulling server ALS into client
 // bundles. In client environments, .get() throws before reaching this code
 // path. The slot lives in its own leaf module so that `request-context.ts`
 // can register the getter without importing this file, which would drag
 // `nuqs` into every server entry (TIM-1298). See shared/als-slots.ts.
-import { getSearchParamsFromAls } from '../shared/als-slots.js';
-import { parseTotal } from './parse-total.js';
-import { serializedEqual } from './serialize-equal.js';
+import { getSearchParamsFromAls } from '../shared/als-slots.ts';
+import { parseTotal } from './parse-total.ts';
+import { serializedEqual } from './serialize-equal.ts';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -186,7 +186,7 @@ export interface SearchParamsDefinition<T extends Record<string, unknown>> {
 
 // StandardSchemaV1 is imported from schema-bridge.ts — single source of truth.
 // Re-export for consumers that import it from this module.
-export type { StandardSchemaV1 } from '../schema-bridge.js';
+export type { StandardSchemaV1 } from '../schema-bridge.ts';
 
 // ---------------------------------------------------------------------------
 // Type-level helpers

package/src/search-params/index.ts

@@ -16,13 +16,13 @@ export type {
   SetParamsOptions,
   QueryStatesOptions,
   StandardSchemaV1,
-} from './define.js';
-export { defineSearchParams } from './define.js';
+} from './define.ts';
+export { defineSearchParams } from './define.ts';
 
 // Codec bridges moved to @timber-js/app/codec
 // Import fromSchema / fromArraySchema from '@timber-js/app/codec' instead.
 
 // Codec wrappers
-export { withDefault, withUrlKey } from './wrappers.js';
+export { withDefault, withUrlKey } from './wrappers.ts';
 
 // Runtime registry (route-scoped useQueryStates)

package/src/search-params/wrappers.ts

@@ -13,9 +13,9 @@ import type {
   SearchParamCodec,
   SearchParamCodecWithUrlKey,
   SearchParamField,
-} from './define.js';
-import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.js';
-import { parseTotal } from './parse-total.js';
+} from './define.ts';
+import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.ts';
+import { parseTotal } from './parse-total.ts';
 
 // ---------------------------------------------------------------------------
 // withDefault

package/src/server/access-gate.tsx

@@ -13,12 +13,12 @@
  * See design/04-authorization.md and design/02-rendering-pipeline.md §"AccessGate"
  */
 
-import { DenySignal, RedirectSignal } from './primitives.js';
-import type { AccessGateProps, SlotAccessGateProps } from './tree-builder.js';
-import { withSpan, setSpanAttribute } from './tracing.js';
-import { isDebug } from './debug.js';
-import type { DenyPageEntry } from './deny-boundary.js';
-import { handleCaughtDeny, setFirstDeniedSegmentIndex } from './deny-boundary.js';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import type { AccessGateProps, SlotAccessGateProps } from './tree-builder.ts';
+import { withSpan, setSpanAttribute } from './tracing.ts';
+import { isDebug } from './debug.ts';
+import type { DenyPageEntry } from './deny-boundary.ts';
+import { handleCaughtDeny, setFirstDeniedSegmentIndex } from './deny-boundary.ts';
 import type { ReactNode } from 'react';
 
 // ─── AccessGate ─────────────────────────────────────────────────────────────

package/src/server/action-client.ts

@@ -220,16 +220,16 @@ async function runActionMiddleware<TCtx>(
 }
 
 // Re-export parseFormData for use throughout the framework
-import { parseFormData } from './form-data.js';
-import { formatSize } from '../utils/format.js';
-import { isDebug, isDevMode } from './debug.js';
-import { RedirectSignal, DenySignal } from './primitives.js';
+import { parseFormData } from './form-data.ts';
+import { formatSize } from '../utils/format.ts';
+import { isDebug, isDevMode } from './debug.ts';
+import { RedirectSignal, DenySignal } from './primitives.ts';
 import {
   stripSensitiveFields,
   resolveSensitivePredicate,
   getGlobalSensitiveFieldsConfig,
   type SensitiveFieldsOption,
-} from './sensitive-fields.js';
+} from './sensitive-fields.ts';
 
 /**
  * Extract validation errors from a schema error.

package/src/server/action-handler.ts

@@ -18,27 +18,27 @@ import {
   decodeReply,
   decodeAction,
   renderToReadableStream,
-} from '../rsc-runtime/rsc.js';
-
-import { validateCsrf, type CsrfConfig } from './csrf.js';
-import { DenySignal, RedirectSignal } from './primitives.js';
-import { executeAction, type RevalidateRenderer } from './actions.js';
-import { runWithRequestContext, setMutableCookieContext } from './request-context.js';
-import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.js';
-import { handleActionError } from './action-client.js';
-import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.js';
-import { parseFormData } from './form-data.js';
+} from '../rsc-runtime/rsc.ts';
+
+import { validateCsrf, type CsrfConfig } from './csrf.ts';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import { executeAction, type RevalidateRenderer } from './actions.ts';
+import { runWithRequestContext, setMutableCookieContext } from './request-context.ts';
+import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.ts';
+import { handleActionError } from './action-client.ts';
+import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.ts';
+import { parseFormData } from './form-data.ts';
 import {
   stripSensitiveFields,
   resolveSensitivePredicate,
   getGlobalSensitiveFieldsConfig,
   type SensitiveFieldsOption,
-} from './sensitive-fields.js';
-import type { FormFlashData } from './form-flash.js';
-import { checkVersionSkew, applyReloadHeaders } from './version-skew.js';
-import { logActionError } from './logger.js';
-import { withTimeout, RenderTimeoutError } from './render-timeout.js';
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+} from './sensitive-fields.ts';
+import type { FormFlashData } from './form-flash.ts';
+import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
+import { logActionError } from './logger.ts';
+import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────