@timber-js/app 0.2.0-alpha.20 → 0.2.0-alpha.200

package/dist/server/canonicalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAW7F;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}

package/dist/server/chain-url-parts.d.ts

@@ -0,0 +1,82 @@
+/**
+ * How much of the URL a matched segment chain has consumed.
+ *
+ * One question — "which URL parts had been consumed by the time segment `i`
+ * rendered?" — asked by four things that must all agree:
+ *
+ * - the layout depth handed to `SegmentProvider` (`route-element-builder.ts`),
+ *   which `useSelectedLayoutSegment(s)` indexes the live pathname with;
+ * - `slotUrlParts`, which slices the destination pathname for slot matching;
+ * - `resolveSlotProps` and `skippable-prefix.ts`, which derive content keys
+ *   for slot skip decisions (TIM-1370).
+ *
+ * They were four separate `extractUrlParts(...).length` calls. That was fine
+ * while the answer was a plain walk, and stopped being fine when interception
+ * gave it a second term (TIM-1280): the fix landed on the layout depth alone
+ * and the other three kept the old walk, so a layout and the slots beside it
+ * disagreed about how deep they were. Hence one function, in its own module,
+ * rather than a helper on the side of whichever caller was fixed first.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { CoercedParams } from '../shared/param-value.ts';
+/**
+ * Extract raw URL path parts from a segment chain.
+ *
+ * Each dynamic segment consumed one URL part (its param value). Static
+ * segments consumed their own name. Groups are transparent. Catch-all segments
+ * consumed multiple parts (their param value is `string[]`).
+ *
+ * The root segment is named '' and consumes nothing, so it is skipped here
+ * rather than by each caller — callers that pass a chain including the root
+ * (interception anchoring, slot-skip slicing) would otherwise have to remember
+ * to filter it, and one that forgot would push an empty part and shift every
+ * subsequent index by one.
+ *
+ * Uses rawSegmentParams (pre-coercion) to get actual URL strings. Values are
+ * coerced to `String()` defensively in case a codec leaked a non-string value
+ * into the params map.
+ *
+ * Each node is read through `effectiveUrlSegment`, so an intercepting
+ * directory contributes the URL part it intercepts (`(.)item` → `item`,
+ * `(.)[id]` → the bound value). A children-path interception puts such a node
+ * in the *main* chain, and reading it directly would classify it as neither
+ * static nor param-bearing — it would contribute nothing, and every part after
+ * it would shift by one.
+ */
+export declare function extractUrlParts(segments: ManifestSegmentNode[], mainParams: CoercedParams): string[];
+/**
+ * The URL parts the chain has consumed through `index`, inclusive.
+ *
+ * For an ordinary chain this is just the walk. Two things make it more than
+ * that, and both are cases where a node stands for a different number of URL
+ * parts than itself:
+ *
+ * - A **catch-all** consumes as many parts as the request supplies, which the
+ *   walk already handles (its param value is an array).
+ * - An **interception with a climbing marker** intercepts a URL that starts
+ *   *above* its owner, so the owner's own URL segment — and any static
+ *   ancestor between the intercepted base and the owner — is not in the target
+ *   at all. `feed/(..)photo/[id]` at `/photo/42` still has `feed` in the
+ *   chain, and counting it puts everything after it off by one.
+ *
+ * So everything above the interception clamps to the anchor, and everything
+ * from it down counts forward from there. The owner chain is param-free by
+ * build-time rule and the intercepted base is a prefix of the owner's
+ * `urlPath`, so the target's leading `anchor` parts *are* the owner chain's
+ * leading `anchor` parts — which is what makes the clamped prefix real values
+ * rather than placeholders. For `(.)` the base is the owner's own path, so the
+ * clamp is a no-op and this reduces to the plain walk.
+ */
+export declare function consumedUrlParts(segments: ManifestSegmentNode[], index: number, match: RouteMatch): string[];
+/**
+ * The index in `match.segments` of a segment, or -1.
+ *
+ * Split out so the three slot call sites and the layout-depth one derive their
+ * slice point identically — `indexOf` plus `consumedUrlParts` — instead of
+ * each inlining the pair.
+ */
+export declare function consumedPartsThroughSegment(segment: ManifestSegmentNode, match: RouteMatch): string[];
+//# sourceMappingURL=chain-url-parts.d.ts.map

package/dist/server/chain-url-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-url-parts.d.ts","sourceRoot":"","sources":["../../src/server/chain-url-parts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAI9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,aAAa,GACxB,MAAM,EAAE,CA0BV;AAsBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAgBV;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAIV"}

package/dist/server/children-interception.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Children-path interception — the sibling layout swap (TIM-1280).
+ *
+ * The second shape interception has. An intercepting directory that is a
+ * direct child of an ordinary segment or route group renders *in place of*
+ * `children` for that directory's own layout chain:
+ *
+ * ```
+ * app/(landing)/layout.tsx
+ * app/(landing)/[artistSlug]/[year]/[month]/[day]/page.tsx      ← hard nav
+ * app/(browse)/layout.tsx
+ * app/(browse)/(...)[artistSlug]/[year]/[month]/[day]/page.tsx  ← soft nav from (browse)
+ * ```
+ *
+ * There is no overlay, no slot, and no `default.tsx`. Nothing is re-matched
+ * either — and that is the point. The modal shape re-matches
+ * `interceptingPrefix`, a URL, and route groups contribute nothing to a URL,
+ * so an owner like `app/(browse)/` serializes to "/" and re-matching it
+ * resolves through whichever group owns the canonical page. This resolver
+ * addresses the owner by **tree path** instead, which never collapses.
+ *
+ * The result is an ordinary `RouteMatch` whose chain runs
+ * `[…owner ancestors, interceptingNode, …its matched descendants]`. Every
+ * consumer downstream — `route-element-builder.ts`, access gates,
+ * middleware — sees a segment chain and needs to know nothing about
+ * interception. That is why this feature adds no rendering path: the chain
+ * *is* the feature.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { RouteMatch } from './pipeline.ts';
+import { type ManifestSegmentNode } from './route-matcher.ts';
+/**
+ * Resolve a children-path interception to a complete route match.
+ *
+ * `interceptingScope` is the rewrite's own build-time field — the tree path of
+ * the directory that owns the interception. The pipeline has already
+ * established that the client's rendered tree passes through it; this
+ * translates it into the chain to render.
+ *
+ * Returns null when the scope names no directory in this manifest, or when no
+ * intercepting child of that directory matches the target. Both are fail-safe:
+ * the caller keeps the canonical target match, so the page the user gets is
+ * the one a hard navigation would have produced.
+ */
+export type InterceptedRouteMatcher = (targetPathname: string, interceptingScope: string) => RouteMatch | null;
+/** Build a children-path interception resolver over a runtime manifest. */
+export declare function createInterceptedRouteMatcher(root: ManifestSegmentNode): InterceptedRouteMatcher;
+//# sourceMappingURL=children-interception.d.ts.map

package/dist/server/children-interception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"children-interception.d.ts","sourceRoot":"","sources":["../../src/server/children-interception.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,KACtB,UAAU,GAAG,IAAI,CAAC;AAEvB,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,mBAAmB,GAAG,uBAAuB,CA4BhG"}

package/dist/server/coalesce-tick.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Single-shot `setImmediate` coalescing primitive.
+ *
+ * Multiple synchronous `schedule()` calls within one event-loop tick
+ * result in exactly one `flush` invocation at the end of that tick.
+ * No recursive scheduling, no busy-wait, no polling loop.
+ *
+ * Both `createBufferedTransformStream` (Web) and
+ * `createNodeBufferedTransform` (Node) use this helper so the invariant
+ * — and this comment — live in one place.
+ *
+ * **Not a polling loop.** Uses a single-shot `setImmediate` per flush
+ * cycle — no recursive scheduling, no busy-wait. See design/02
+ * §"No Polling".
+ */
+export interface TickCoalescer {
+    /**
+     * Request a flush at the end of the current tick. If a flush is already
+     * scheduled, this is a no-op. Returns the pending promise (or undefined
+     * if the flush already fired and no new one has been scheduled).
+     */
+    schedule(): void;
+    /**
+     * The pending flush promise, if any. Callers (e.g. `flush()` in a
+     * TransformStream) can `await` this to wait for the scheduled flush
+     * to complete before closing the stream.
+     */
+    readonly pending: Promise<void> | undefined;
+    /**
+     * Cancel any pending scheduled flush and invoke the flush callback
+     * synchronously. Used by Node `Transform.flush()` which needs to
+     * drain the buffer immediately before calling back.
+     */
+    flushSync(): void;
+}
+/**
+ * Create a tick coalescer that calls `onFlush` at most once per tick.
+ */
+export declare function createTickCoalescer(onFlush: () => void): TickCoalescer;
+//# sourceMappingURL=coalesce-tick.d.ts.map

package/dist/server/coalesce-tick.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce-tick.d.ts","sourceRoot":"","sources":["../../src/server/coalesce-tick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,IAAI,IAAI,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE5C;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,aAAa,CAgCtE"}

package/dist/server/compress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}

package/dist/server/cookie-context.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Cookie Context — per-request cookie API and on-the-wire helpers.
+ *
+ * Split out of `request-context.ts` (TIM-853) so the cookie subsystem
+ * — encoding contract, options grammar, parser, serializer, RYW map,
+ * and rerender seed — lives in one file. The headers/scope/params APIs
+ * stay in `request-context.ts` and call into this module via the
+ * exported helpers.
+ *
+ * See design/29-cookies.md for the encoding contract and read-your-own-
+ * writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the
+ * smuggling primitive that the encoding contract closes.
+ */
+import { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions } from '../cookies/validation.ts';
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
+/**
+ * Returns a cookie accessor for the current request.
+ *
+ * Available in middleware, access checks, server components, and server actions.
+ * Throws if called outside a request context (security principle #2: no global fallback).
+ *
+ * Read methods (.get, .has, .getAll) are always available and reflect
+ * read-your-own-writes from .set() calls in the same request.
+ *
+ * Mutation methods (.set, .delete, .clear) are only available in mutable
+ * contexts (middleware.ts, server actions, route.ts handlers). Calling them
+ * in read-only contexts (access.ts, server components) throws.
+ *
+ * This is the escape hatch for direct cookie jar operations. For typed
+ * cookie access, use `defineCookie()` instead.
+ *
+ * See design/29-cookies.md
+ */
+export declare function getCookieJar(): RequestCookies;
+/**
+ * Returns the value of a single cookie, or undefined if absent.
+ *
+ * @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.
+ */
+export declare function getCookie(name: string): string | undefined;
+/**
+ * Per-call options for `getCookies().set()`. Extends the persistent
+ * `CookieOptions` (HTTP cookie attributes) with framework-only flags
+ * that are NOT serialized into the Set-Cookie header.
+ *
+ * The `raw` flag is the escape hatch for the auto-encoding contract.
+ * See design/29-cookies.md §"Encoding Contract".
+ */
+export interface SetCookieOptions extends CookieOptions {
+    /**
+     * Skip the framework's `encodeURIComponent` pass and store the value
+     * verbatim. The value is then validated against the strict RFC 6265
+     * §4.1.1 `cookie-octet` grammar — the H-3 smuggling primitive cannot
+     * sneak in via this opt-out.
+     *
+     * Use this when forwarding a cookie value that is already in its
+     * intended on-the-wire form (e.g. mirroring an upstream service's
+     * Set-Cookie). Default: `false` (auto-encode).
+     */
+    raw?: boolean;
+}
+/** Options for setting a cookie. See design/29-cookies.md. */
+export interface CookieOptions {
+    /** Domain scope. Default: omitted (current domain only). */
+    domain?: string;
+    /** URL path scope. Default: '/'. */
+    path?: string;
+    /** Expiration date. Mutually exclusive with maxAge. */
+    expires?: Date;
+    /** Max age in seconds. Mutually exclusive with expires. */
+    maxAge?: number;
+    /** Prevent client-side JS access. Default: true. */
+    httpOnly?: boolean;
+    /** Only send over HTTPS. Default: true. */
+    secure?: boolean;
+    /** Cross-site request policy. Default: 'lax'. */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
+    partitioned?: boolean;
+}
+/**
+ * Cookie accessor returned by `getCookies()`.
+ *
+ * Read methods are always available. Mutation methods throw in read-only
+ * contexts (access.ts, server components).
+ */
+export interface RequestCookies {
+    /** Get a cookie value by name. Returns undefined if not present. */
+    get(name: string): string | undefined;
+    /** Check if a cookie exists. */
+    has(name: string): boolean;
+    /** Get all cookies as an array of { name, value } pairs. */
+    getAll(): Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Number of cookies. */
+    readonly size: number;
+    /**
+     * Set a cookie. Only available in mutable contexts (middleware, actions,
+     * route handlers).
+     *
+     * The value is auto-encoded with `encodeURIComponent` so the on-the-wire
+     * bytes always satisfy RFC 6265 §4.1.1 cookie-octet — `cookies().get()`
+     * returns the same logical value the developer wrote. Pass `{ raw: true }`
+     * to skip the encoder; the raw path validates against the strict
+     * cookie-octet grammar instead. See design/29-cookies.md §"Encoding
+     * Contract" and ONGOING_SECURITY.md H-3 (TIM-868).
+     */
+    set(name: string, value: string, options?: SetCookieOptions): void;
+    /**
+     * Copy all `Set-Cookie` headers from a `Headers` object.
+     * Parses each header and forwards name, value, and all attributes
+     * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).
+     *
+     * Useful when forwarding cookies from an internal `fetch()` or auth handler:
+     * ```ts
+     * const response = await auth.handler(req);
+     * getCookies().then(c => c.setFromHeaders(response.headers));
+     * ```
+     */
+    setFromHeaders(headers: Headers): void;
+    /** Delete a cookie. Only available in mutable contexts. */
+    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
+    /** Delete all cookies. Only available in mutable contexts. */
+    clear(): void;
+    /** Serialize cookies as a Cookie header string. */
+    toString(): string;
+}
+/**
+ * Register a pre-parsed cookie map to use as the request context seed for
+ * the next `runWithRequestContext(req, …)` call with this exact `req`.
+ *
+ * Used by the no-JS form-rerender dispatcher in
+ * `rsc-entry/wrap-action-dispatch.ts` to thread the action's post-mutation
+ * cookie state into the rerender scope without serializing back through a
+ * `Cookie:` header. See TIM-868 / TIM-837.
+ *
+ * @internal — framework use only.
+ */
+export declare function seedRequestCookies(req: Request, cookies: Map<string, string>): void;
+/**
+ * Pop the seed (if any) for `req` and return it. Called from
+ * `runWithRequestContext` exactly once per request — the seed is consumed
+ * eagerly so it cannot leak into a hypothetical future re-use of the same
+ * Request reference.
+ *
+ * @internal — framework use only.
+ */
+export declare function consumeSeededCookies(req: Request): Map<string, string> | undefined;
+/**
+ * Build a Map of cookie name → value reflecting the current request's
+ * read-your-own-writes state. Includes incoming cookies plus any
+ * mutations from getCookies().set() / getCookies().delete() in the same request.
+ *
+ * Used by SSR renderers to populate NavContext.cookies so that
+ * useCookie()'s server snapshot matches the actual response state.
+ *
+ * See design/29-cookies.md §"Read-Your-Own-Writes"
+ * See design/triage/TIM-441-cookie-api-triage.md §4
+ */
+export declare function getCookiesForSsr(): Map<string, string>;
+/**
+ * Collect all Set-Cookie headers from the cookie jar.
+ * Called by the framework at flush time to apply cookies to the response.
+ *
+ * Returns an array of serialized Set-Cookie header values.
+ */
+export declare function getSetCookieHeaders(): string[];
+//# sourceMappingURL=cookie-context.d.ts.map

package/dist/server/cookie-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-context.d.ts","sourceRoot":"","sources":["../../src/server/cookie-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;AAInF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,cAAc,CAgL7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,2DAA2D;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,mDAAmD;IACnD,QAAQ,IAAI,MAAM,CAAC;CACpB;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKnF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAI9C"}

package/dist/server/cookie-parsing.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cookie parsing and serialization helpers — pure string ↔ structure
+ * functions with no ALS dependency. Split out of `cookie-context.ts`
+ * (TIM-853) so the API surface and the wire-format codecs can each be
+ * read on their own.
+ *
+ * The functions in this module are total over arbitrary input. They
+ * never throw and never call `assertValid*` (the security validators
+ * live in the API surface — `cookie-context.ts` invokes them at every
+ * jar entry point so the smuggling-primitive invariant from TIM-868
+ * is enforced regardless of which path produced the bytes).
+ *
+ * Delegates to the `cookie` package (RFC 6265, dependency-free,
+ * browser-safe) for wire codecs. Adapts at the boundary to preserve
+ * timber's Map-based API and never-throw contract.
+ */
+import type { CookieEntry } from './als-registry.ts';
+import type { CookieOptions } from './cookie-context.ts';
+/**
+ * Parse a Cookie header string into a Map of name → value pairs.
+ * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
+ *
+ * Values are auto-decoded with `decodeURIComponent` so they round-trip
+ * losslessly with `getCookies().set()` (which auto-encodes). Malformed
+ * `%`-escapes from third-party cookies fall back to the raw byte sequence
+ * — the parser must be total over arbitrary inbound headers, including
+ * non-conforming values from other servers, browser extensions, etc.
+ */
+export declare function parseCookieHeader(header: string): Map<string, string>;
+/**
+ * Decode a single cookie value with `decodeURIComponent`, falling back to
+ * the raw byte sequence if the input contains a malformed `%`-escape.
+ *
+ * Used by both `parseCookieHeader` (incoming Cookie: header) and the
+ * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
+ * Total — never throws.
+ *
+ * cookie's internal decode has identical semantics but is not exported,
+ * so we keep this standalone helper.
+ */
+export declare function safeDecodeCookieValue(raw: string): string;
+/**
+ * Serialize a CookieEntry into a Set-Cookie header value.
+ *
+ * Total — never throws. If the cookie package's serializer rejects
+ * the input (e.g. non-integer maxAge, forbidden chars in name/value),
+ * falls back to a minimal hand-rolled serialization so the response
+ * path is never interrupted by a codec error.
+ */
+export declare function serializeCookieEntry(entry: CookieEntry): string;
+/**
+ * Parse a raw `Set-Cookie` header string into name, value, and options.
+ * Handles all standard attributes: Path, Domain, Max-Age, Expires,
+ * SameSite, Secure, HttpOnly, Partitioned.
+ *
+ * Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether
+ * to merge defaults (e.g. `set()` does, but `setRaw()` should preserve
+ * the original header's intent).
+ */
+export declare function parseSetCookie(header: string): {
+    name: string;
+    value: string;
+    options: CookieOptions;
+} | null;
+//# sourceMappingURL=cookie-parsing.d.ts.map

package/dist/server/cookie-parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-parsing.d.ts","sourceRoot":"","sources":["../../src/server/cookie-parsing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0B/D;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CA8BhE"}

package/dist/server/csp-nonce.d.ts

@@ -0,0 +1,45 @@
+/**
+ * CSP nonce — per-request, generated on demand.
+ *
+ * timber emits several inline `<script>` tags per HTML response — React's
+ * bootstrap script and Fizz runtime, the Flight init/chunk scripts, the
+ * segment-tree script, and the post-flush noindex script. Under a strict
+ * `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every
+ * one of them needs the request's nonce or the browser refuses to run it.
+ *
+ * The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it
+ * in the CSP header it sets through `ctx.headers`. The first read generates
+ * the value and stores it on the request context; the render pipeline reads
+ * it back with `getCspNonce()` and stamps it on every inline script. A
+ * request whose middleware never reads `ctx.nonce` has no nonce, and its
+ * markup is byte-identical to a render without this feature. timber does
+ * not parse the CSP header — the app owns the policy, timber owns the
+ * markup, and `ctx.nonce` is the one value both are built from.
+ *
+ * `proxy.ts` cannot participate: it only sees the finished response from
+ * `next()`, after the markup exists.
+ *
+ * See design/13-security.md §"Content Security Policy" (TIM-1414).
+ */
+/**
+ * The request's CSP nonce, creating it on first call. Backs the
+ * `ctx.nonce` getter on `MiddlewareContext`. Outside a request context
+ * (tests, build-time rendering) a fresh value is returned but not
+ * retained, since there is no request for it to belong to.
+ */
+export declare function requestCspNonce(): string;
+/**
+ * The request's CSP nonce if middleware asked for one, else `undefined` —
+ * in which case the pipeline emits bare `<script>` tags.
+ */
+export declare function getCspNonce(): string | undefined;
+/**
+ * The ` nonce="…"` attribute fragment for a timber-generated `<script>` tag,
+ * or `''` when the request has no nonce. Callers interpolate it directly
+ * after the tag name: `` `<script${nonceAttr(nonce)}>` ``.
+ *
+ * The value comes from `generateNonce` and is base64, so no attribute
+ * escaping is required.
+ */
+export declare function nonceAttr(nonce: string | undefined): string;
+//# sourceMappingURL=csp-nonce.d.ts.map

package/dist/server/csp-nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-nonce.d.ts","sourceRoot":"","sources":["../../src/server/csp-nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgBH;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAEhD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAE3D"}

package/dist/server/csrf.d.ts

@@ -21,12 +21,13 @@ export type CsrfResult = {
     status: 403;
 };
 /**
- * Validate the Origin header against the request's Host.
+ * Validate the Origin header against the request's full origin
+ * (scheme + host + port).
  *
  * For mutation methods (POST, PUT, PATCH, DELETE):
  * - If `csrf: false`, skip validation.
  * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * - Otherwise, Origin must match the derived request origin.
  *
  * Safe methods (GET, HEAD, OPTIONS) always pass.
  */

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AASnE;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAuCzE"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAgCnE;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAgDzE"}

package/dist/server/default-logger.d.ts

@@ -0,0 +1,22 @@
+/**
+ * DefaultLogger — human-readable stderr logging when no custom logger is configured.
+ *
+ * Ships as the fallback so production deployments always have error visibility,
+ * even without an `instrumentation.ts` logger export. Output is one line per
+ * event, designed for `fly logs`, `kubectl logs`, Cloudflare dashboard tails, etc.
+ *
+ * Format:
+ *   [timber] ERROR  message  key=value key=value  trace_id=4bf92f35
+ *   [timber] WARN   message  key=value key=value  trace_id=4bf92f35
+ *   [timber] INFO   message  method=GET path=/dashboard status=200 durationMs=43  trace_id=4bf92f35
+ *
+ * Behavior:
+ * - Suppressed entirely in dev mode (dev logging handles all output)
+ * - `debug` suppressed unless TIMBER_DEBUG is set
+ * - Replaced entirely when a custom logger is set via `setLogger()`
+ *
+ * See design/17-logging.md §"DefaultLogger"
+ */
+import type { TimberLogger } from './logger.ts';
+export declare function createDefaultLogger(): TimberLogger;
+//# sourceMappingURL=default-logger.d.ts.map

package/dist/server/default-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-logger.d.ts","sourceRoot":"","sources":["../../src/server/default-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0ChD,wBAAgB,mBAAmB,IAAI,YAAY,CAkClD"}

package/dist/server/default-status-page.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Framework default status page — the terminal fallback of the deny chain.
+ *
+ * design/10-error-handling.md §"Fallback Chain" ends every 4xx/5xx chain in a
+ * "framework default page". Before TIM-1258 that terminal did not exist: an app
+ * with no `404.tsx` / `4xx.tsx` / `error.tsx` got `Response(null, { status })` —
+ * a correct status code with an empty body. Browsers render that as a blank
+ * page, and static generation had nothing to write to `404.html`.
+ *
+ * This page is a plain HTML string rather than a React component on purpose:
+ * it is the *last* fallback, so it must not depend on the RSC → SSR pipeline
+ * (the machinery that may already have failed by the time we get here), and it
+ * must be renderable from the static build where no render environment exists.
+ * One builder is the single source of truth for both surfaces.
+ *
+ * Security: the page interpolates nothing but the status code, and the code is
+ * clamped to a plain integer before it reaches the markup. No request URL, no
+ * error message, no stack — see design/13-security.md principle 4.
+ */
+import { statusReasonPhrase } from '../shared/status-reason-phrase.ts';
+export { statusReasonPhrase };
+/** HTML content type used for every framework default page response. */
+export declare const DEFAULT_STATUS_PAGE_CONTENT_TYPE = "text/html; charset=utf-8";
+/**
+ * Build the framework default page for a status code as a full HTML document.
+ *
+ * The document is self-contained: no scripts, no external resources, no client
+ * JavaScript. It renders identically in `server` mode, in `static` mode's
+ * generated `404.html`, and with `clientJavascript: false`.
+ */
+export declare function defaultStatusPageHtml(status: number): string;
+/**
+ * Build the framework default page as an HTTP `Response`.
+ *
+ * `responseHeaders` carries whatever middleware/proxy already set (cookies,
+ * cache directives); the content type is overwritten because the body is
+ * always HTML regardless of what the route would have produced.
+ *
+ * The body is unconditional. HEAD is not this function's problem: the pipeline
+ * strips HEAD bodies at its single exit for every response shape, so a
+ * `method` parameter here would be one renderer's private copy of a rule that
+ * now holds framework-wide (TIM-1324).
+ */
+export declare function defaultStatusPageResponse(status: number, responseHeaders: Headers): Response;
+//# sourceMappingURL=default-status-page.d.ts.map

package/dist/server/default-status-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-status-page.d.ts","sourceRoot":"","sources":["../../src/server/default-status-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiB,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMtF,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgC5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAG,QAAQ,CAG5F"}