@timber-js/app 0.2.0-alpha.2 → 0.2.0-alpha.200

package/dist/server/route-module-loader.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Route module loading — loads layout, page, and access.ts modules from
+ * a matched route's segment chain in a single pass.
+ *
+ * Extracted from `route-element-builder.ts` to keep that file focused on
+ * element-tree construction.
+ *
+ * See design/02-rendering-pipeline.md, design/07-routing.md.
+ */
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { Metadata } from './types.ts';
+import { type LayoutComponentEntry } from './route-element-builder.ts';
+/** Metadata export from a layout or page module, with its segment context. */
+export interface MetadataSource {
+    metadataExport: Metadata | (() => Promise<Metadata>);
+    segmentName: string;
+    isPage: boolean;
+    segmentIndex: number;
+}
+/** Access function loaded from a segment's access.ts. */
+export type AccessFn = (() => unknown) | undefined;
+/** Result of the module-loading phase. */
+export interface LoadedRouteModules {
+    metadataSources: MetadataSource[];
+    layoutComponents: LayoutComponentEntry[];
+    PageComponent: (...args: unknown[]) => unknown;
+    deferSuspenseFor: number;
+    accessFns: Array<AccessFn>;
+}
+/**
+ * Load all route modules (layouts, page, access functions) in a single pass.
+ *
+ * Access functions are loaded eagerly here so the wrapping loop does not need
+ * to await `loadModule(segment.access)` at each iteration.
+ */
+export declare function loadRouteModules(segments: ManifestSegmentNode[], requestUrl: string): Promise<LoadedRouteModules>;
+//# sourceMappingURL=route-module-loader.d.ts.map

package/dist/server/route-module-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-module-loader.d.ts","sourceRoot":"","sources":["../../src/server/route-module-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC;AAEnD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;CAC5B;AAuDD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CA+D7B"}

package/dist/server/rsc-cache-key-guard.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Origin-side binding of the `_rsc` cache key to the request that produced
+ * the response (TIM-1268).
+ *
+ * The key is deterministic, and deliberately so — that is what makes RSC
+ * payloads cacheable. But deterministic also means *predictable*: anyone can
+ * compute the key another client will request. Without this guard, a caller
+ * could request `/about?_rsc=<victim's key>` while sending its own
+ * `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+ * environment this feature targets — would store that variant under the
+ * victim's key. Every subsequent legitimate navigation would then be served
+ * a payload rendered for someone else's segment tree or deployment.
+ *
+ * The guard is a *storability* rule, not a rejection: if the claimed key
+ * does not match the key derived from the received headers, the response
+ * loses its shared-cache directives. Mismatched requests are still served
+ * normally, they just cannot be stored for anyone else.
+ *
+ * Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+ * right, costs a round trip on every legitimate miss, and would make the
+ * server's behaviour depend on a parameter it otherwise never reads. This
+ * rule closes the same hole by making the poisoned entry unstorable at the
+ * source, in the response the developer already has to opt into sharing.
+ *
+ * See design/19-client-navigation.md §"The `_rsc` cache key".
+ */
+/**
+ * Whether the request's `_rsc` parameter matches the key derived from its
+ * own headers.
+ *
+ * Requests without the parameter are not claiming a key at all, so they are
+ * left alone — the bare document URL is the developer's declared territory
+ * (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+ * whose value could not be one of our digests: `_rsc` is not reserved, and
+ * an application that already uses it for its own search state
+ * (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+ * guard that mistook that for a forgery.
+ */
+export declare function hasValidRscCacheKey(req: Request): Promise<boolean>;
+/**
+ * Ensure a Flight payload can never be interpreted as a document.
+ *
+ * Applied here, at the pipeline's single exit, rather than where each
+ * payload response is built. Six places build one — the success path, three
+ * in `deny-renderer.ts`, the action paths — and hardening them one at a time
+ * is how you end up hardening five of six. The response is Flight if it says
+ * it is; that is the only test that covers every producer, including ones
+ * added later.
+ *
+ * Matters because the payload URL is observable and, on a shared-cache hit,
+ * the origin is never consulted — so a top-level navigation can be handed
+ * these bytes with no request-time check available. See design/13-security.md
+ * #36c.
+ */
+export declare function hardenRscPayloadResponse(response: Response): void;
+/**
+ * Make a response unstorable by any shared cache when its request claimed an
+ * `_rsc` key that does not match its own headers.
+ *
+ * The end state is unconditional and therefore statable: **a mismatched
+ * response is never stored by any cache.** Every targeted cache-control
+ * field is removed and `Cache-Control` is replaced outright, rather than
+ * downgrading only when a shared directive is spotted. Conditional variants
+ * of this were tried and were wrong twice over — they missed the CDN-
+ * specific headers, and leaving `Cache-Control` alone when it looked
+ * harmless lets a CDN apply heuristic caching to a response that has none.
+ *
+ * The cost is that a mismatched request loses developer-chosen *browser*
+ * caching too. That is a request no timber client ever makes.
+ *
+ * Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+ * they address stored entries, and this response is not stored.
+ *
+ * Mutates `response.headers` in place; the pipeline guarantees mutable
+ * headers at this point (see TIM-866).
+ */
+export declare function enforceRscCacheKey(req: Request, response: Response): Promise<void>;
+//# sourceMappingURL=rsc-cache-key-guard.d.ts.map

package/dist/server/rsc-cache-key-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-cache-key-guard.d.ts","sourceRoot":"","sources":["../../src/server/rsc-cache-key-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgCxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAGjE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF"}

package/dist/server/rsc-entry/action-middleware-runner.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Middleware runner for revalidation — runs a route's `middleware.ts`
+ * chain inside its own `runWithRequestContext` scope and returns a
+ * `MiddlewareOutcome` value the caller can translate.
+ *
+ * Used by the revalidation renderer (TIM-996) to run the TARGET route's
+ * middleware before building the revalidated element tree, ensuring that
+ * `revalidatePath('/admin')` from a public action honors admin's auth.
+ *
+ * NOT used for action dispatch itself — per-segment middleware does not
+ * run on action POSTs (TIM-1134). Actions are dispatched by action ID,
+ * not route segment, so `proxy.ts` and `createActionClient({ middleware })`
+ * are the correct auth mechanisms.
+ *
+ * The function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. Failure modes are encoded as
+ * outcome variants rather than thrown so the caller never has to wrap
+ * this in try/catch.
+ */
+import { DenySignal, RedirectSignal } from '../primitives.ts';
+import type { RouteMatch } from '../pipeline.ts';
+/** Coerce a matched route's segment params via its `params.ts` codecs. */
+export type CoerceSegmentParamsFn = (match: RouteMatch) => Promise<void>;
+/**
+ * Outcome of running middleware on an action request, surfaced from the
+ * inner `runWithRequestContext` scope so the outer dispatcher can convert
+ * it to a Response (short-circuit) or continue to the action handler.
+ *
+ * Each variant carries the post-middleware Set-Cookie snapshot so the
+ * outer scope can apply cookies to whichever Response it ultimately
+ * returns. The middleware ALS scope ends before the action ALS scope
+ * begins, so cookie state must be threaded explicitly across the boundary
+ * via `seedRequestCookies` (cookie reads) and `setCookieHeaders` (cookie
+ * writes).
+ */
+export type MiddlewareOutcome = {
+    kind: 'continue';
+    overlay: Headers;
+    cookies: Map<string, string>;
+    setCookieHeaders: string[];
+} | {
+    kind: 'short-circuit';
+    response: Response;
+    setCookieHeaders: string[];
+} | {
+    kind: 'redirect';
+    signal: RedirectSignal;
+    setCookieHeaders: string[];
+} | {
+    kind: 'deny';
+    signal: DenySignal;
+    match: RouteMatch;
+    setCookieHeaders: string[];
+} | {
+    kind: 'param-coercion-error';
+} | {
+    kind: 'error';
+    error: unknown;
+};
+/**
+ * Run the matched route's middleware chain inside a fresh request-context
+ * scope, captured as a `MiddlewareOutcome` value the outer dispatcher can
+ * translate to a Response or use as the seed for the action handler.
+ */
+export declare function runMiddlewareForAction(req: Request, match: RouteMatch, coerceSegmentParams: CoerceSegmentParamsFn): Promise<MiddlewareOutcome>;
+//# sourceMappingURL=action-middleware-runner.d.ts.map

package/dist/server/rsc-entry/action-middleware-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-middleware-runner.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/action-middleware-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,OAAO,EAAkC,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD,0EAA0E;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,sBAAsB,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEN;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,qBAAqB,GACzC,OAAO,CAAC,iBAAiB,CAAC,CAoF5B"}

package/dist/server/rsc-entry/api-handler.d.ts

@@ -5,7 +5,16 @@
  * pass, no AccessGate component). Then dispatches to the route handler.
  * See design/04-authorization.md §"Auth in API Routes".
  */
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-export declare function handleApiRoute(req: Request, match: RouteMatch, segments: ManifestSegmentNode[], responseHeaders: Headers): Promise<Response>;
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+/**
+ * Handle a `route.ts` request.
+ *
+ * Segment-param coercion has already run (in pipeline-phases.ts), and the
+ * coerced values + raw URLSearchParams are seeded into the request-context
+ * ALS — so `segmentParams.get()` / `searchParams.get()` work inside
+ * `middleware.ts`, `access.ts`, and the HTTP method handler. This function
+ * only runs the access chain and dispatches; it does not duplicate the
+ * coercion or ALS setup the pipeline already performed.
+ */
+export declare function handleApiRoute(req: Request, segments: ManifestSegmentNode[], responseHeaders: Headers): Promise<Response>;
 //# sourceMappingURL=api-handler.d.ts.map

package/dist/server/rsc-entry/api-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-handler.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyDnB"}
+{"version":3,"file":"api-handler.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAS/D;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,QAAQ,CAAC,CAsDnB"}

package/dist/server/rsc-entry/deny-fallback.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Deny fallback renderer — renders the deny page (403.tsx, 404.tsx, etc.)
+ * for DenySignals that escape from middleware or the render phase.
+ *
+ * Extracted from index.ts (TIM-968) as a pure move. The factory captures
+ * the root segment and client bootstrap config once at handler creation;
+ * the returned function is wired into `PipelineConfig.renderDenyFallback`
+ * and reused by the action-dispatch wrapper.
+ *
+ * Design docs: 04-authorization.md, 10-error-handling.md
+ */
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { PipelineConfig } from '../pipeline.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+/**
+ * Create the pipeline's deny fallback renderer.
+ *
+ * When the pipeline already matched a route (the common case — matching
+ * runs before middleware and rendering), resolve the status file against
+ * the matched chain so colocated files like a nested `403.tsx` or an API
+ * route's `401.json` are picked up. Fall back to the root chain when no
+ * match is available (e.g. proxy-stage deny before route matching).
+ * See TIM-822, design/04-authorization.md, design/10-error-handling.md.
+ */
+export declare function createDenyFallbackRenderer(options: {
+    rootSegment: ManifestSegmentNode;
+    clientBootstrap: ClientBootstrapConfig;
+}): NonNullable<PipelineConfig['renderDenyFallback']>;
+//# sourceMappingURL=deny-fallback.d.ts.map

package/dist/server/rsc-entry/deny-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-fallback.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/deny-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM/D;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,mBAAmB,CAAC;IACjC,eAAe,EAAE,qBAAqB,CAAC;CACxC,GAAG,WAAW,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAwDpD"}

package/dist/server/rsc-entry/error-renderer.d.ts

@@ -1,24 +1,49 @@
 /**
  * RSC Error & No-Match Renderers — handles error pages and 404s.
  *
- * Renders error.tsx / status files and 404 pages through the RSC → SSR pipeline.
+ * All error pages (TSX and MDX) render through the RSC → SSR pipeline:
+ * - TSX ('use client'): Error is converted to SerializableError, wrapped
+ *   with ErrorReconstituter to reconstitute a real Error on the client.
+ * - MDX (server component): Receives plain props ({ status }), no wrapper needed.
+ *
+ * This unified approach replaces the former SSR-only bypass for TSX error
+ * pages. See design/spike-TIM-565-unify-error-pages.md for the full analysis.
+ *
+ * Design docs: 10-error-handling.md §"Three-Tier Error Page Rendering"
+ */
+import type { RouteMatch } from '../pipeline.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { DefaultPageRenderer, LayoutEntry } from '../deny-renderer.ts';
+/**
+ * A manifest file reference with lazy import and path.
+ * Mirrors the shape from ManifestSegmentNode but kept local to avoid
+ * exporting internal types from route-matcher.
  */
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import type { LayoutEntry } from '#/server/deny-renderer.js';
+export interface GlobalErrorFile {
+    load: () => Promise<unknown>;
+    filePath: string;
+}
 /**
  * Render an error page for unhandled throws or RenderError outside Suspense.
  *
- * Walks the segment chain from leaf to root looking for:
- *   1. Specific status file (e.g. 503.tsx) matching the error's status
- *   2. 5xx.tsx category catch-all
- *   3. error.tsx
+ * All error pages (TSX and MDX) go through RSC → SSR:
+ * - TSX: ErrorReconstituter wrapper converts SerializableError → real Error
+ * - MDX: Plain props ({ status }), no wrapper needed
  *
- * Renders the found component with { error, digest, reset } props
- * wrapped in layouts, with the correct HTTP status code.
+ * ...except for a client-navigation request, which gets the hard-navigate
+ * envelope instead. Every tier below produces an HTML document, and the
+ * client's Flight decoder is waiting for `text/x-component`; handing it HTML
+ * crashes the decode. The check lives here rather than at the call sites
+ * because it holds for all five of them, and the deny path's equivalent split
+ * (`renderDenyPage` / `renderDenyPageAsRsc`) had already been forgotten at one
+ * of this function's — the synchronous render-error exit in `render-route.ts`
+ * (TIM-1322). Four of the five are unreachable for an RSC request today
+ * (`render-route.ts` returns the payload before it reaches SSR, and
+ * `outcomeToResponse` answers RSC errors itself), so this fires on one path
+ * and guards the rest against drift.
  */
-export declare function renderErrorPage(error: unknown, status: number, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig): Promise<Response>;
+export declare function renderErrorPage(error: unknown, status: number, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, globalError?: GlobalErrorFile, firstDeniedIndex?: number): Promise<Response>;
 /**
  * Render a 404 page for URLs that don't match any route.
  *
@@ -26,5 +51,5 @@ export declare function renderErrorPage(error: unknown, status: number, segments
  * wrapped in the root layout, via the same renderDenyPage path
  * used for in-route deny() calls.
  */
-export declare function renderNoMatchPage(req: Request, rootSegment: ManifestSegmentNode, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig): Promise<Response>;
+export declare function renderNoMatchPage(req: Request, rootSegment: ManifestSegmentNode, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, defaultPage?: DefaultPageRenderer): Promise<Response>;
 //# sourceMappingURL=error-renderer.d.ts.map

package/dist/server/rsc-entry/error-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/error-renderer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAK7D;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,GACrC,OAAO,CAAC,QAAQ,CAAC,CA6FnB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,GACrC,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}
+{"version":3,"file":"error-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/error-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAiB5E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkHD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,WAAW,CAAC,EAAE,eAAe,EAC7B,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA6DnB;AA6ID;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,WAAW,CAAC,EAAE,mBAAmB,GAChC,OAAO,CAAC,QAAQ,CAAC,CA2CnB"}

package/dist/server/rsc-entry/helpers.d.ts

@@ -3,10 +3,9 @@
  *
  * Small, stateless functions used across the RSC entry modules.
  */
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import { RedirectSignal } from '#/server/primitives.js';
-/** RSC content type for client navigation payload requests. */
-export declare const RSC_CONTENT_TYPE = "text/x-component";
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { SegmentInfo } from '../../shared/segment-info.ts';
+import type { SlotSkipEntry } from '../slot-resolver.ts';
 /**
  * Create a debug channel sink that discards all debug data.
  *
@@ -17,57 +16,75 @@ export declare const RSC_CONTENT_TYPE = "text/x-component";
  * stream that we drain and discard.
  *
  * See design/13-security.md §"Server component source leak"
- *
- * TODO: In the future, expose this debug data to the browser in dev mode
- * for inline error overlays (e.g. component stack traces).
  */
 export declare function createDebugChannelSink(): {
     readable: ReadableStream;
     writable: WritableStream;
 };
 /**
- * Build segment metadata for the X-Timber-Segments response header.
- * Describes the rendered segment chain with async status, enabling
- * the client to populate its segment cache for state tree diffing.
+ * Parsed component debug info extracted from the Flight debug channel.
  *
- * Async detection: server components defined as `async function` have
- * constructor.name === 'AsyncFunction'. These layouts always re-render
- * on navigation (they may depend on request context like cookies/params).
- * See design/07-routing.md §"Server Diffing Rules".
- */
-export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layoutComponents: Array<{
-    component: (...args: unknown[]) => unknown;
-    segment: ManifestSegmentNode;
-}>): Array<{
-    path: string;
-    isAsync: boolean;
-}>;
-/**
- * Check if a request is asking for an RSC payload (client navigation)
- * rather than full HTML. Client-side navigation sends Accept: text/x-component.
+ * Contains only component names, environment labels, and stack frames —
+ * never source code or props. See design/13-security.md §"Server source
+ * never reaches the client".
  */
-export declare function isRscPayloadRequest(req: Request): boolean;
+export interface DebugComponentEntry {
+    name: string;
+    env: string | null;
+    key: string | null;
+    stack: unknown[] | null;
+}
 /**
- * Build a redirect Response. For RSC payload requests (client navigation),
- * return 204 + X-Timber-Redirect header instead of a raw 302. The browser's
- * fetch with redirect: "manual" turns a 302 into an opaque redirect (status 0,
- * null body, inaccessible headers), which crashes createFromFetch when it
- * tries to call .body.getReader(). The X-Timber-Redirect header lets the
- * client detect the redirect and perform a soft SPA navigation.
+ * A debug channel that collects Flight debug rows instead of discarding them.
+ *
+ * Used in dev mode to capture server component tree information for the
+ * Vite error overlay. The collector provides the same `{ readable, writable }`
+ * shape as the discard sink, plus methods to retrieve collected data.
+ *
+ * Security: only component names, environments, and stack frames are
+ * extracted — props and source code are stripped. In production builds,
+ * use `createDebugChannelSink()` instead (this function is never called).
  */
-export declare function buildRedirectResponse(req: Request, signal: RedirectSignal, responseHeaders: Headers): Response;
+export interface DebugChannelCollector {
+    readable: ReadableStream;
+    writable: WritableStream;
+    /** Get the raw collected text from the debug channel. */
+    getCollectedText(): string;
+    /** Get parsed component entries (names, stacks — no props or source). */
+    getComponents(): DebugComponentEntry[];
+}
+export declare function createDebugChannelCollector(): DebugChannelCollector;
 /**
- * Check if an error is an abort error (connection closed by client).
+ * Parse React Flight debug rows into component entries.
+ *
+ * The Flight debug channel writes rows in `hexId:json\n` format. Each row
+ * with a JSON object containing a `name` field is a component debug info
+ * entry. Rows without `name` (timing rows, reference rows like `D"$id"`)
+ * are skipped.
  *
- * When the browser aborts a request (page refresh, navigation away),
- * the AbortSignal fires and React/streams throw an AbortError. This
- * is not an application error — suppress it from error boundaries and logs.
+ * Security: `props` are explicitly stripped from parsed entries — they may
+ * contain rendered output or user data. Only `name`, `env`, `key`, and
+ * `stack` are retained.
  */
-export declare function isAbortError(error: unknown): boolean;
-export declare function escapeHtml(str: string): string;
+export declare function parseDebugRows(text: string): DebugComponentEntry[];
 /**
- * Parse a Cookie header string into a name→value Map.
- * Used to populate NavContext.cookies for SSR hooks (useCookie).
+ * Build segment metadata for the X-Timber-Segments response header.
+ * Describes the rendered segment chain with request-dependency status,
+ * enabling the client to populate its segment cache for state tree diffing.
+ *
+ * Request-dependency is determined by static module-graph analysis: the
+ * Vite plugin walks each segment's import graph and marks it as
+ * request-dependent if any reachable module calls a request accessor.
+ * This replaces the previous runtime ALS-based taint tracking which
+ * couldn't attribute accessor calls in Flight-deferred child components.
+ *
+ * See design/07-routing.md §"Server Diffing Rules".
  */
-export declare function parseCookiesFromHeader(header: string): Map<string, string>;
+export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layoutComponents: Array<{
+    component: (...args: unknown[]) => unknown;
+    segment: ManifestSegmentNode;
+}>, slotSkipInfo?: SlotSkipEntry[], skippedSegmentKeys?: string[], firstDeniedIndex?: number): SegmentInfo[];
+export { buildRedirectResponse } from '../pipeline-helpers.ts';
+export { isAbortError } from '../render-utils.ts';
+export { escapeHtml } from '../utils/escape-html.ts';
 //# sourceMappingURL=helpers.d.ts.map

package/dist/server/rsc-entry/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,GACvB,QAAQ,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1E"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,EACF,YAAY,CAAC,EAAE,aAAa,EAAE,EAC9B,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAC7B,gBAAgB,SAAW,GAC1B,WAAW,EAAE,CAsEf;AAMD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/rsc-entry/index.d.ts

@@ -1,12 +1,46 @@
+import type { PipelineConfig } from '../pipeline.ts';
 /**
- * Set the dev pipeline error handler.
+ * Set the dev source-map handler.
  *
- * Called by the dev server after importing this module to wire pipeline
- * errors into the Vite browser error overlay. No-op in production.
+ * Called by the dev server after importing this module to wire Vite's
+ * module graph source-mapping into the error rendering pipeline. Errors
+ * rendered by renderErrorPage / renderFallbackError will have their
+ * stack traces rewritten to show original source positions.
+ *
+ * No-op in production.
+ */
+export declare function setDevSourceMapHandler(handler: (error: Error) => void): void;
+export { runWithEarlyHintsSender } from '../early-hints-sender.ts';
+export { runWithWaitUntil } from '../waituntil-bridge.ts';
+export { runWithWorkersCachePurge } from '../workers-cache-bridge.ts';
+export { stripHeadBody } from '../head-response.ts';
+/**
+ * Post-build flight capture entry point (TIM-1119). The capture pass must
+ * run inside the built RSC bundle — the prebuilt component registry, the
+ * ALS instances, and the flight renderer are module instances in THIS
+ * bundle's graph; an outside import of the framework package would get
+ * fresh, empty copies. The timber-prebuilt plugin imports the built
+ * `rsc/index.js` after the 5-step build and calls this export.
+ * See design/44-render-at-build-time.md §Build Phase.
+ */
+export declare function __timber_capturePrebuilt(options: import('../prebuilt-builder.ts').CaptureOptions): Promise<import('../prebuilt-builder.ts').CaptureSummary>;
+/**
+ * Post-build static site generation entry point (TIM-1238). Renders every
+ * route in the manifest to HTML + RSC flight payloads. Must run inside the
+ * built RSC bundle — the handler, route manifest, and page module loaders
+ * are module instances in THIS bundle's graph.
+ *
+ * Unlike capture mode, this needs the full pipeline handler, so it must
+ * NOT run when __TIMBER_CAPTURE_MODE__ is set.
+ *
+ * See design/11-platform.md §"static output mode".
+ */
+export declare function __timber_generateStaticSite(options: import('../static-generator.ts').StaticGenerationOptions): Promise<import('../static-generator.ts').StaticGenerationSummary>;
+/**
+ * The pipeline configuration object. Exported so the dev server can set
+ * `devPipelineErrorHandler` after import without a module-level singleton.
  */
-export declare function setDevPipelineErrorHandler(handler: (error: Error, phase: string) => void): void;
-export { runWithEarlyHintsSender } from '#/server/early-hints-sender.js';
-export { runWithWaitUntil } from '#/server/waituntil-bridge.js';
+export declare const pipelineConfig: PipelineConfig;
 declare const _default: (req: Request) => Promise<Response>;
 export default _default;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AA0EA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE/F;AAyXD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;8BA7P3C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA+PhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAuB,cAAc,EAAc,MAAM,gBAAgB,CAAC;AAsCtF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAyVD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAItE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,wBAAwB,EAAE,cAAc,GACvD,OAAO,CAAC,OAAO,wBAAwB,EAAE,cAAc,CAAC,CAE1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,wBAAwB,EAAE,uBAAuB,GAChE,OAAO,CAAC,OAAO,wBAAwB,EAAE,uBAAuB,CAAC,CAQnE;AAgDD;;;GAGG;AACH,eAAO,MAAM,cAAc,gBAAmB,CAAC;8BAb1B,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC"}

package/dist/server/rsc-entry/render-route.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Route renderer — turns a matched route into a Response.
+ *
+ * Extracted from `rsc-entry/index.ts` so the entry can stay focused on
+ * pipeline construction. This module owns the steps that happen *after*
+ * the pipeline has matched a route and before it commits a response:
+ * element-tree build, RSC Flight render, and dispatch to either the SSR
+ * HTML path or the RSC payload path. It also handles the
+ * synchronous-signal escape hatches (deny / redirect / render error
+ * thrown during stream creation) so the entry doesn't carry that logic.
+ *
+ * The function is parameterized over its dependencies — `clientBootstrap`,
+ * `clientJsDisabled`, `rootSegment`, `globalError` — so the entry passes
+ * them in once at handler-construction time and they ride along on every
+ * call. No globals, no closures over the entry's createRequestHandler
+ * scope.
+ *
+ * Design docs: 02-rendering-pipeline.md, 19-client-navigation.md.
+ */
+import type { BuildManifest } from '../build-manifest.ts';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { InterceptionContext, RouteMatch } from '../pipeline.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+/**
+ * Static-per-handler dependencies for `renderRoute` — captured once at
+ * handler construction so each per-request call site only has to pass
+ * the request-specific arguments.
+ */
+export interface RenderRouteDeps {
+    clientBootstrap: ClientBootstrapConfig;
+    clientJsDisabled: boolean;
+    clientSegmentCache: boolean;
+    rootSegment: ManifestSegmentNode;
+    buildManifest: BuildManifest;
+    globalError?: {
+        load: () => Promise<unknown>;
+        filePath: string;
+    };
+}
+/**
+ * Render a matched route to an HTML Response via RSC → SSR pipeline,
+ * or return a raw RSC Flight stream for client-side navigation requests.
+ *
+ * 1. Load page/layout components from the segment chain
+ * 2. Resolve metadata
+ * 3. Render to RSC Flight stream (serializes "use client" as references)
+ * 4. If Accept: text/x-component → return RSC stream directly
+ *    Otherwise → pass RSC stream to SSR entry for HTML rendering
+ */
+export declare function renderRoute(req: Request, match: RouteMatch, responseHeaders: Headers, deps: RenderRouteDeps, interception?: InterceptionContext): Promise<Response>;
+//# sourceMappingURL=render-route.d.ts.map

package/dist/server/rsc-entry/render-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-route.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/render-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAW1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAe/D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,eAAe,EACrB,YAAY,CAAC,EAAE,mBAAmB,GACjC,OAAO,CAAC,QAAQ,CAAC,CA+NnB"}