@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/dist/_chunks/{primitives-DLAnvsrk.js → actions-BerlqoXA.js}

@@ -1,134 +1,294 @@
-import { r as requestContextAls, s as waitUntilAls } from "./als-registry-C6kcfprT.js";
+import { r as canonicalize } from "./canonicalize-CgHoscYO.js";
+import { a as requestContextAls, i as reactCacheScopeAls, o as revalidationAls } from "./als-registry-DaxkVjt5.js";
+import { C as isDebug, P as withSpan, S as isRedirectSignal, v as DENY_BRAND, w as isDevMode, x as isDenySignal, y as REDIRECT_BRAND } from "./logger-DiDt5ppH.js";
 import { n as _setGetSegmentParamsFn, t as _setGetSearchParamsFn } from "./als-slots-BEEIPKYm.js";
-import { a as assertValidCookieOptions, i as assertValidCookieName, n as parseSetCookie$1, o as assertValidCookieValue, r as stringifySetCookie, t as parseCookie } from "./dist-DtrJyBbw.js";
 import { r as appVisibleSearch } from "./rsc-cache-key-ClUiXQnK.js";
 import { a as mergePreservedSearchParams, o as resolveSegmentParams, r as validateExternalRedirectUrl, t as assertRelativeRedirectPath } from "./href-validation-BIrxavIy.js";
-//#region src/server/waituntil-bridge.ts
+import { a as assertValidCookieOptions, i as assertValidCookieName, n as parseSetCookie$1, o as assertValidCookieValue, r as stringifySetCookie, t as parseCookie } from "./dist-DtrJyBbw.js";
+import { t as cache, x as getWaitUntil } from "./cache-api-CR23J_NC.js";
+//#region src/server/react-cache-scope.ts
 /**
-* Per-request waitUntil bridge — ALS bridge for platform adapters.
+* React.cache scopes — opening, resuming, and leaving the per-request
+* `React.cache` scope that `react-cache-bridge.ts` makes Flight read.
 *
-* The generated entry point (Nitro, Cloudflare) wraps the handler with
-* `runWithWaitUntil`, binding the platform's lifecycle extension function
-* (e.g., h3's `event.waitUntil()` or CF's `ctx.waitUntil()`) for the
-* request duration. The `waitUntil()` primitive reads from this ALS to
-* dispatch background work to the correct platform API.
-*
-* Design doc: design/11-platform.md §"waitUntil()"
+* Kept apart from the bridge so request-context and cookie code can use
+* it without importing `react`. See design/spike-TIM-1529-react-cache-bridge.md.
+*/
+/** A new, empty `React.cache` scope. */
+function createReactCacheScope() {
+	return /* @__PURE__ */ new Map();
+}
+/**
+* Run `fn` in a `React.cache` scope — a fresh one unless `scope` is given.
+* Every `React.cache` call made from `fn` — synchronously, in its async
+* continuations, and in any Flight render it starts — shares one memo table.
+*
+* Opened by `runWithRequestContext`, so each request context gets its own
+* scope. Pass `scope` to resume one across two ALS runs: the post-action
+* revalidation opens a fresh scope for the target route's middleware and
+* renders the revalidated tree in that same scope later.
 */
+function runWithReactCacheScope(fn, scope = createReactCacheScope()) {
+	return reactCacheScopeAls.run(scope, fn);
+}
 /**
-* Get the current request's waitUntil function, if available.
-*
-* Returns undefined when no platform adapter has installed a waitUntil
-* handler for the current request (e.g., on platforms that don't support
-* lifecycle extension, or outside a request context).
+* Run `fn` with no timber scope, so `React.cache` behaves as stock React:
+* no dedupe outside a render, Flight's own per-render cache inside one.
+*
+* Used for server action bodies — an action reads, writes cookies, and
+* mutates, so memoized reads would go stale mid-action (the same choice
+* Next.js makes) — and for renders whose output outlives the request
+* (`cache.component` capture), which must not bake request-memoized values
+* into a cross-request cache entry.
 */
-function getWaitUntil() {
-	return waitUntilAls.getStore();
+function runOutsideReactCacheScope(fn) {
+	return reactCacheScopeAls.exit(fn);
+}
+var cookieReads = /* @__PURE__ */ new WeakMap();
+var warnedScopes = /* @__PURE__ */ new WeakSet();
+/**
+* Dev-only: record that cookie `name` (or {@link ANY_COOKIE}) was read
+* while `React.cache` held values in this request — the read may have
+* happened inside a cached function.
+*/
+function noteCookieReadForReactCache(name) {
+	if (!isDevMode()) return;
+	const scope = reactCacheScopeAls.getStore();
+	if (!scope || scope.size === 0) return;
+	let reads = cookieReads.get(scope);
+	if (!reads) {
+		reads = /* @__PURE__ */ new Set();
+		cookieReads.set(scope, reads);
+	}
+	reads.add(name);
+}
+/**
+* Dev-only: warn (once per request) when a cookie recorded by
+* {@link noteCookieReadForReactCache} is written. `name` is the written
+* cookie, or {@link ANY_COOKIE} for `clear()`. Dev-only because reads are
+* only recorded in dev.
+*/
+function warnIfCachedCookieIsWritten(name) {
+	const scope = reactCacheScopeAls.getStore();
+	if (!scope || warnedScopes.has(scope)) return;
+	const reads = cookieReads.get(scope);
+	if (!reads) return;
+	if (!(name === "*" ? reads.size > 0 : reads.has(name) || reads.has("*"))) return;
+	warnedScopes.add(scope);
+	const which = name === "*" ? "Cookies were cleared" : `Cookie "${name}" was written`;
+	console.warn(`[timber] ${which} after being read while React.cache held values for this request. A cached function that read it keeps returning the old result — pass the cookie value in as an argument (e.g. getUser(sessionToken)) so a change is a new cache key.`);
 }
 //#endregion
-//#region src/server/debug.ts
+//#region src/server/request-context.ts
 /**
-* Runtime debug flag for timber.js.
+* Returns a read-only view of the current request's headers.
 *
-* Two distinct functions for two distinct security levels:
+* Available in middleware, access checks, server components, and server actions.
+* Throws if called outside a request context (security principle #2: no global fallback).
+*/
+function getHeaders() {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getHeaders() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	return store.headers;
+}
+/**
+* Returns the value of a single request header, or undefined if absent.
 *
-* ## `isDebug()` — server-side logging only
+* Thin wrapper over `getHeaders().get(name)` for the common case where
+* you need exactly one header.
 *
-* Returns true when timber's debug/warning messages should be written to
-* stderr / the server console. This NEVER affects what is sent to the
-* client (no error details, no timing headers, no stack traces).
+* @internal — not part of the public API. Use `getHeaders().get(name)` instead.
+*/
+function getHeader(name) {
+	return getHeaders().get(name) ?? void 0;
+}
+/**
+* Returns the current request's raw URLSearchParams.
 *
-* Active when any of:
-* - `NODE_ENV !== 'production'` (standard dev mode)
-* - `TIMBER_DEBUG` env var is set to a truthy value at runtime
-* - `timber.config.ts` has `debug: true`
+* @internal — not part of the public API. Use `defineSearchParams().get()` instead.
+*/
+function getSearchParams() {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getSearchParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	return store.searchParams;
+}
+_setGetSearchParamsFn(getSearchParams);
+_setGetSegmentParamsFn(getSegmentParams);
+/**
+* Returns the current request's coerced segment params.
 *
-* ## `isDevMode()` — client-visible dev behavior
+* The optional `segmentPath` argument exists only for TypeScript narrowing —
+* it does not affect the runtime return value. Pass a segment path
+* (e.g. `'/(browse)/[artistSlug]/[year]'`) to narrow the return type to the
+* exact params shape for that segment.
 *
-* Returns true ONLY when `NODE_ENV !== 'production'`. This gates anything
-* that changes what clients can observe:
-* - Dev error pages with stack traces (fallback-error.ts)
-* - Detailed Server-Timing headers (pipeline.ts)
-* - Error messages in action INTERNAL_ERROR payloads (action-client.ts)
-* - Pipeline error handler wiring (Vite overlay)
+* Without an argument, returns all coerced params with optional types.
 *
-* `isDevMode()` is statically replaced in production builds → the guarded
-* code is tree-shaken to zero bytes. TIMBER_DEBUG cannot enable it.
+* See design/41-global-params.md §Function Signatures
+*/
+function getSegmentParams(segmentPath) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getSegmentParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	if (!store.segmentParams) throw new Error("[timber] getSegmentParams() called before route matching completed. Segment params are not available until after the route is matched.");
+	const slotResolved = resolveSegmentParams(store.segmentParams, store.slotParams, segmentPath);
+	if (slotResolved !== store.segmentParams) return slotResolved;
+	if (segmentPath && isDebug() && store.matchedSegmentPath) {
+		const expected = extractDynamicSegments(segmentPath);
+		const actual = extractDynamicSegments(store.matchedSegmentPath);
+		const missing = expected.filter((s) => !actual.includes(s));
+		if (missing.length > 0) console.warn(`[timber] getSegmentParams('${segmentPath}') called but current segment is '${store.matchedSegmentPath}'\n  Missing params: ${missing.join(", ")}\n  These will be undefined at runtime despite the type annotation.`);
+	}
+	return store.segmentParams;
+}
+/**
+* Set the segment params on the current request context.
+* Called by the pipeline after route matching and param coercion.
 *
-* Usage:
-*   In Cloudflare Workers wrangler.toml:
-*     [vars]
-*     TIMBER_DEBUG = "1"
+* @internal — framework use only
+*/
+function setSegmentParams(params) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] setSegmentParams() called outside of a request context.");
+	store.segmentParams = params;
+}
+/**
+* Store the matched segment path (e.g. '/(browse)/[artistSlug]/[year]') for
+* dev-mode validation in getSegmentParams().
 *
-*   In Node.js:
-*     TIMBER_DEBUG=1 node server.js
+* @internal — framework use only
+*/
+function setMatchedSegmentPath(segmentPath) {
+	const store = requestContextAls.getStore();
+	if (!store) return;
+	store.matchedSegmentPath = segmentPath;
+}
+/**
+* Extract dynamic segment names from a route pattern.
+* '/[artistSlug]/[year]' → ['artistSlug', 'year']
+* '/docs/[...slug]'      → ['slug']
+*/
+function extractDynamicSegments(route) {
+	const segments = [];
+	const re = /\[{1,2}\.{0,3}(\w+)\]{1,2}/g;
+	let m;
+	while ((m = re.exec(route)) !== null) segments.push(m[1]);
+	return segments;
+}
+/**
+* Returns the raw search string from the current request URL (e.g. "?foo=bar").
+* Synchronous — safe for use in `redirect()` which throws synchronously.
 *
-*   In timber.config.ts:
-*     export default { debug: true }
+* Returns empty string if called outside a request context (non-throwing for
+* use in redirect's optional preserveSearchParams path).
 *
-* See design/13-security.md for the security taxonomy.
-* See design/18-build-system.md for build pipeline details.
+* @internal — used by redirect() for preserveSearchParams support.
 */
+function getRequestSearchString() {
+	return requestContextAls.getStore()?.searchString ?? "";
+}
 /**
-* Check if the application is running in development mode.
+* Run a callback within a request context. Used by the pipeline to establish
+* per-request ALS scope so that `getHeaders()` and `getCookies()` work.
 *
-* This is the ONLY function that should gate client-visible dev behavior:
-* - Dev error pages with stack traces
-* - Server-Timing mode default (`'detailed'` in dev, `'total'` in prod)
-* - Error messages in action `INTERNAL_ERROR` payloads
-* - Pipeline error handler wiring (Vite overlay)
+* When `options.cookies` is given, the context's `parsedCookies` map is a
+* copy of it and the raw `cookieHeader` is left empty, so
+* `parseCookieHeader` never runs for that request. Re-entry callers pass the
+* action's post-mutation cookie state this way (TIM-868).
 *
-* Returns `process.env.NODE_ENV !== 'production'`, which is statically
-* replaced by the bundler in production builds. Code guarded by this
-* function is tree-shaken to zero bytes in production.
+* Each request context also opens its own `React.cache` scope, shared by
+* everything that runs inside it — proxy.ts, middleware.ts, route handlers,
+* and the render (design/02-rendering-pipeline.md §"Cache Scoping Model").
 *
-* TIMBER_DEBUG does NOT enable this — that would leak server internals
-* to clients. Use `isDebug()` for server-side-only logging.
+* @param req - The incoming Request object.
+* @param fn - The function to run within the request context.
 */
-function isDevMode() {
-	return process.env.NODE_ENV !== "production";
+function runWithRequestContext(req, fn, { reactCacheScope, cookies } = {}) {
+	const originalCopy = new Headers(req.headers);
+	const appVisible = appVisibleSearch(new URL(req.url));
+	const seed = cookies ? new Map(cookies) : void 0;
+	const store = {
+		request: req,
+		headers: freezeHeaders(req.headers),
+		originalHeaders: originalCopy,
+		cookieHeader: seed ? "" : req.headers.get("cookie") ?? "",
+		parsedCookies: seed,
+		searchParams: appVisible.params,
+		searchString: appVisible.search,
+		cookieJar: /* @__PURE__ */ new Map(),
+		flushed: false,
+		mutableContext: false
+	};
+	return requestContextAls.run(store, () => runWithReactCacheScope(fn, reactCacheScope));
 }
 /**
-* Config-level debug override. Set via `setDebugFromConfig()` during
-* initialization when timber.config.ts has `debug: true`.
+* Enable cookie mutation for the current context. Called by the framework
+* when entering middleware.ts, server actions, or route.ts handlers.
+*
+* See design/29-cookies.md §"Context Tracking"
+*/
+function setMutableCookieContext(mutable) {
+	const store = requestContextAls.getStore();
+	if (store) store.mutableContext = mutable;
+}
+/**
+* Mark the response as flushed (headers committed). After this point,
+* cookie mutations log a warning instead of throwing.
+*
+* See design/29-cookies.md §"Streaming Constraint: Post-Flush Cookie Warning"
 */
-var _configDebug = false;
+function markResponseFlushed() {
+	const store = requestContextAls.getStore();
+	if (store) store.flushed = true;
+}
 /**
-* Check if timber debug logging is active (server-side only).
+* Apply middleware-injected request headers to the current request context.
 *
-* Returns true if ANY of these conditions hold:
-* - NODE_ENV is not 'production' (standard dev mode)
-* - TIMBER_DEBUG environment variable is set to a truthy value at runtime
-* - timber.config.ts has `debug: true`
+* Called by the pipeline after middleware.ts runs. Merges overlay headers
+* on top of the original request headers so downstream code (access.ts,
+* server components, server actions) sees them via `getHeaders()`.
 *
-* This function controls ONLY server-side logging — messages written to
-* stderr or the server console. It NEVER affects client-visible behavior
-* (error pages, response headers, action payloads). For client-visible
-* behavior, use `isDevMode()`.
+* The original request headers are never mutated — a new frozen Headers
+* object is created with the overlay applied on top.
 *
-* The TIMBER_DEBUG check is deliberately written as a dynamic property
-* access so bundlers cannot statically replace it.
+* See design/07-routing.md §"Request Header Injection"
 */
-function isDebug() {
-	if (process.env.NODE_ENV !== "production") return true;
-	if (_configDebug) return true;
-	return _readTimberDebugEnv();
+function applyRequestHeaderOverlay(overlay) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] applyRequestHeaderOverlay() called outside of a request context.");
+	let hasOverlay = false;
+	overlay.forEach(() => {
+		hasOverlay = true;
+	});
+	if (!hasOverlay) return;
+	const merged = new Headers(store.originalHeaders);
+	overlay.forEach((value, key) => {
+		merged.set(key, value);
+	});
+	store.headers = freezeHeaders(merged);
 }
+var MUTATING_METHODS = /* @__PURE__ */ new Set([
+	"set",
+	"append",
+	"delete"
+]);
 /**
-* Read TIMBER_DEBUG from the environment at runtime.
+* Wrap a Headers object in a Proxy that throws on mutating methods.
+* Object.freeze doesn't work on Headers (native internal slots), so we
+* intercept property access and reject set/append/delete at runtime.
 *
-* Extracted to a separate function to:
-* 1. Prevent bundler inlining (cross-module function calls are not inlined)
-* 2. Handle platforms where `process` may not exist (Cloudflare Workers)
-* 3. Support globalThis.__TIMBER_DEBUG for programmatic control
+* Read methods (get, has, entries, etc.) must be bound to the underlying
+* Headers instance because they access private #headersList slots.
 */
-function _readTimberDebugEnv() {
-	if (globalThis.__TIMBER_DEBUG) return true;
-	try {
-		const val = typeof process !== "undefined" && process.env ? process.env["TIMBER_DEBUG"] : void 0;
-		if (val && val !== "0" && val !== "false") return true;
-	} catch {}
-	return false;
+function freezeHeaders(source) {
+	const copy = new Headers(source);
+	return new Proxy(copy, { get(target, prop) {
+		if (typeof prop === "string" && MUTATING_METHODS.has(prop)) return () => {
+			throw new Error(`[timber] getHeaders() returns a read-only Headers object. Calling .${prop}() is not allowed. Use ctx.requestHeaders in middleware to inject headers for downstream components.`);
+		};
+		const value = Reflect.get(target, prop);
+		if (typeof value === "function") return value.bind(target);
+		return value;
+	} });
 }
 //#endregion
 //#region src/server/cookie-parsing.ts
@@ -261,8 +421,8 @@ function parseSetCookie(header) {
 * Cookie Context — per-request cookie API and on-the-wire helpers.
 *
 * Split out of `request-context.ts` (TIM-853) so the cookie subsystem
-* — encoding contract, options grammar, parser, serializer, RYW map,
-* and rerender seed — lives in one file. The headers/scope/params APIs
+* — encoding contract, options grammar, parser, serializer, and RYW map
+* — lives in one file. The headers/scope/params APIs
 * stay in `request-context.ts` and call into this module via the
 * exported helpers.
 *
@@ -295,18 +455,22 @@ function getCookieJar() {
 	const map = store.parsedCookies;
 	return {
 		get(name) {
+			noteCookieReadForReactCache(name);
 			return map.get(name);
 		},
 		has(name) {
+			noteCookieReadForReactCache(name);
 			return map.has(name);
 		},
 		getAll() {
+			noteCookieReadForReactCache("*");
 			return Array.from(map.entries()).map(([name, value]) => ({
 				name,
 				value
 			}));
 		},
 		get size() {
+			noteCookieReadForReactCache("*");
 			return map.size;
 		},
 		set(name, value, options) {
@@ -332,6 +496,7 @@ function getCookieJar() {
 				options: opts
 			});
 			map.set(name, raw ? wireValue : value);
+			warnIfCachedCookieIsWritten(name);
 		},
 		setFromHeaders(headers) {
 			assertMutable(store, "setFromHeaders");
@@ -364,6 +529,7 @@ function getCookieJar() {
 				options: opts
 			});
 			map.delete(name);
+			warnIfCachedCookieIsWritten(name);
 		},
 		clear() {
 			assertMutable(store, "clear");
@@ -378,8 +544,10 @@ function getCookieJar() {
 				}
 			});
 			map.clear();
+			warnIfCachedCookieIsWritten("*");
 		},
 		toString() {
+			noteCookieReadForReactCache("*");
 			return Array.from(map.entries()).map(([name, value]) => `${name}=${encodeURIComponent(value)}`).join("; ");
 		}
 	};
@@ -399,32 +567,6 @@ var DEFAULT_COOKIE_OPTIONS = {
 	sameSite: "lax"
 };
 /**
-* Per-request seed map of cookie name → value, registered out-of-band so the
-* pipeline's `runWithRequestContext` call can pick it up without changing
-* the function's calling convention. Stored in a WeakMap keyed by the
-* synthetic Request object built for the rerender path, so the seed lives
-* exactly as long as the request and is collected with it.
-*
-* The seed exists to eliminate the parse/serialize round-trip on the no-JS
-* form-rerender path — see ONGOING_SECURITY.md H-3 (TIM-868). The action's
-* post-mutation RYW snapshot is threaded directly into the rerender scope's
-* `parsedCookies` map, bypassing `parseCookieHeader` entirely.
-*/
-var seededRequestCookies = /* @__PURE__ */ new WeakMap();
-/**
-* Pop the seed (if any) for `req` and return it. Called from
-* `runWithRequestContext` exactly once per request — the seed is consumed
-* eagerly so it cannot leak into a hypothetical future re-use of the same
-* Request reference.
-*
-* @internal — framework use only.
-*/
-function consumeSeededCookies(req) {
-	const seed = seededRequestCookies.get(req);
-	if (seed) seededRequestCookies.delete(req);
-	return seed;
-}
-/**
 * Collect all Set-Cookie headers from the cookie jar.
 * Called by the framework at flush time to apply cookies to the response.
 *
@@ -456,217 +598,11 @@ function setRaw(store, readMap, name, value, options) {
 		value,
 		options
 	});
+	warnIfCachedCookieIsWritten(name);
 	if (options.maxAge === 0) readMap.delete(name);
 	else readMap.set(name, safeDecodeCookieValue(value));
 }
 //#endregion
-//#region src/server/request-context.ts
-/**
-* Returns a read-only view of the current request's headers.
-*
-* Available in middleware, access checks, server components, and server actions.
-* Throws if called outside a request context (security principle #2: no global fallback).
-*/
-function getHeaders() {
-	const store = requestContextAls.getStore();
-	if (!store) throw new Error("[timber] getHeaders() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
-	return store.headers;
-}
-/**
-* Returns the value of a single request header, or undefined if absent.
-*
-* Thin wrapper over `getHeaders().get(name)` for the common case where
-* you need exactly one header.
-*
-* @internal — not part of the public API. Use `getHeaders().get(name)` instead.
-*/
-function getHeader(name) {
-	return getHeaders().get(name) ?? void 0;
-}
-/**
-* Returns the current request's raw URLSearchParams.
-*
-* @internal — not part of the public API. Use `defineSearchParams().get()` instead.
-*/
-function getSearchParams() {
-	const store = requestContextAls.getStore();
-	if (!store) throw new Error("[timber] getSearchParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
-	return store.searchParams;
-}
-_setGetSearchParamsFn(getSearchParams);
-_setGetSegmentParamsFn(getSegmentParams);
-/**
-* Returns the current request's coerced segment params.
-*
-* The optional `segmentPath` argument exists only for TypeScript narrowing —
-* it does not affect the runtime return value. Pass a segment path
-* (e.g. `'/(browse)/[artistSlug]/[year]'`) to narrow the return type to the
-* exact params shape for that segment.
-*
-* Without an argument, returns all coerced params with optional types.
-*
-* See design/41-global-params.md §Function Signatures
-*/
-function getSegmentParams(segmentPath) {
-	const store = requestContextAls.getStore();
-	if (!store) throw new Error("[timber] getSegmentParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
-	if (!store.segmentParams) throw new Error("[timber] getSegmentParams() called before route matching completed. Segment params are not available until after the route is matched.");
-	const slotResolved = resolveSegmentParams(store.segmentParams, store.slotParams, segmentPath);
-	if (slotResolved !== store.segmentParams) return slotResolved;
-	if (segmentPath && isDebug() && store.matchedSegmentPath) {
-		const expected = extractDynamicSegments(segmentPath);
-		const actual = extractDynamicSegments(store.matchedSegmentPath);
-		const missing = expected.filter((s) => !actual.includes(s));
-		if (missing.length > 0) console.warn(`[timber] getSegmentParams('${segmentPath}') called but current segment is '${store.matchedSegmentPath}'\n  Missing params: ${missing.join(", ")}\n  These will be undefined at runtime despite the type annotation.`);
-	}
-	return store.segmentParams;
-}
-/**
-* Set the segment params on the current request context.
-* Called by the pipeline after route matching and param coercion.
-*
-* @internal — framework use only
-*/
-function setSegmentParams(params) {
-	const store = requestContextAls.getStore();
-	if (!store) throw new Error("[timber] setSegmentParams() called outside of a request context.");
-	store.segmentParams = params;
-}
-/**
-* Store the matched segment path (e.g. '/(browse)/[artistSlug]/[year]') for
-* dev-mode validation in getSegmentParams().
-*
-* @internal — framework use only
-*/
-function setMatchedSegmentPath(segmentPath) {
-	const store = requestContextAls.getStore();
-	if (!store) return;
-	store.matchedSegmentPath = segmentPath;
-}
-/**
-* Extract dynamic segment names from a route pattern.
-* '/[artistSlug]/[year]' → ['artistSlug', 'year']
-* '/docs/[...slug]'      → ['slug']
-*/
-function extractDynamicSegments(route) {
-	const segments = [];
-	const re = /\[{1,2}\.{0,3}(\w+)\]{1,2}/g;
-	let m;
-	while ((m = re.exec(route)) !== null) segments.push(m[1]);
-	return segments;
-}
-/**
-* Returns the raw search string from the current request URL (e.g. "?foo=bar").
-* Synchronous — safe for use in `redirect()` which throws synchronously.
-*
-* Returns empty string if called outside a request context (non-throwing for
-* use in redirect's optional preserveSearchParams path).
-*
-* @internal — used by redirect() for preserveSearchParams support.
-*/
-function getRequestSearchString() {
-	return requestContextAls.getStore()?.searchString ?? "";
-}
-/**
-* Run a callback within a request context. Used by the pipeline to establish
-* per-request ALS scope so that `getHeaders()` and `getCookies()` work.
-*
-* If the request was previously registered via `seedRequestCookies`, the
-* resulting context's `parsedCookies` map is initialized from the seed and
-* the raw `cookieHeader` is left empty — `parseCookieHeader` is never called
-* for that request. This is the no-JS form-rerender path. See TIM-868.
-*
-* @param req - The incoming Request object.
-* @param fn - The function to run within the request context.
-*/
-function runWithRequestContext(req, fn) {
-	const originalCopy = new Headers(req.headers);
-	const appVisible = appVisibleSearch(new URL(req.url));
-	const seed = consumeSeededCookies(req);
-	const store = {
-		headers: freezeHeaders(req.headers),
-		originalHeaders: originalCopy,
-		cookieHeader: seed ? "" : req.headers.get("cookie") ?? "",
-		parsedCookies: seed,
-		searchParams: appVisible.params,
-		searchString: appVisible.search,
-		cookieJar: /* @__PURE__ */ new Map(),
-		flushed: false,
-		mutableContext: false
-	};
-	return requestContextAls.run(store, fn);
-}
-/**
-* Enable cookie mutation for the current context. Called by the framework
-* when entering middleware.ts, server actions, or route.ts handlers.
-*
-* See design/29-cookies.md §"Context Tracking"
-*/
-function setMutableCookieContext(mutable) {
-	const store = requestContextAls.getStore();
-	if (store) store.mutableContext = mutable;
-}
-/**
-* Mark the response as flushed (headers committed). After this point,
-* cookie mutations log a warning instead of throwing.
-*
-* See design/29-cookies.md §"Streaming Constraint: Post-Flush Cookie Warning"
-*/
-function markResponseFlushed() {
-	const store = requestContextAls.getStore();
-	if (store) store.flushed = true;
-}
-/**
-* Apply middleware-injected request headers to the current request context.
-*
-* Called by the pipeline after middleware.ts runs. Merges overlay headers
-* on top of the original request headers so downstream code (access.ts,
-* server components, server actions) sees them via `getHeaders()`.
-*
-* The original request headers are never mutated — a new frozen Headers
-* object is created with the overlay applied on top.
-*
-* See design/07-routing.md §"Request Header Injection"
-*/
-function applyRequestHeaderOverlay(overlay) {
-	const store = requestContextAls.getStore();
-	if (!store) throw new Error("[timber] applyRequestHeaderOverlay() called outside of a request context.");
-	let hasOverlay = false;
-	overlay.forEach(() => {
-		hasOverlay = true;
-	});
-	if (!hasOverlay) return;
-	const merged = new Headers(store.originalHeaders);
-	overlay.forEach((value, key) => {
-		merged.set(key, value);
-	});
-	store.headers = freezeHeaders(merged);
-}
-var MUTATING_METHODS = /* @__PURE__ */ new Set([
-	"set",
-	"append",
-	"delete"
-]);
-/**
-* Wrap a Headers object in a Proxy that throws on mutating methods.
-* Object.freeze doesn't work on Headers (native internal slots), so we
-* intercept property access and reject set/append/delete at runtime.
-*
-* Read methods (get, has, entries, etc.) must be bound to the underlying
-* Headers instance because they access private #headersList slots.
-*/
-function freezeHeaders(source) {
-	const copy = new Headers(source);
-	return new Proxy(copy, { get(target, prop) {
-		if (typeof prop === "string" && MUTATING_METHODS.has(prop)) return () => {
-			throw new Error(`[timber] getHeaders() returns a read-only Headers object. Calling .${prop}() is not allowed. Use ctx.requestHeaders in middleware to inject headers for downstream components.`);
-		};
-		const value = Reflect.get(target, prop);
-		if (typeof value === "function") return value.bind(target);
-		return value;
-	} });
-}
-//#endregion
 //#region src/server/primitives.ts
 /**
 * Check if a value is JSON-serializable without data loss.
@@ -715,36 +651,13 @@ function warnIfNotSerializable(data, callerName) {
 	if (!isDebug()) return;
 	if (data === void 0) return;
 	const issue = findNonSerializable(data);
-	if (issue) console.warn(`[timber] ${callerName}: ${issue}. Data passed to deny() or RenderError must be JSON-serializable because the post-flush path uses JSON.stringify, not React Flight.`);
-}
-var DENY_BRAND = Symbol.for("timber:signal.deny");
-var REDIRECT_BRAND = Symbol.for("timber:signal.redirect");
-var RENDER_ERROR_BRAND = Symbol.for("timber:signal.render-error");
-var SSR_STREAM_ERROR_BRAND = Symbol.for("timber:signal.ssr-stream-error");
-function hasBrand(value, brand) {
-	return typeof value === "object" && value !== null && brand in value;
-}
-/** True for any `DenySignal`, regardless of which module evaluation created it. */
-function isDenySignal(error) {
-	return hasBrand(error, DENY_BRAND);
-}
-/** True for any `RedirectSignal`, regardless of which module evaluation created it. */
-function isRedirectSignal(error) {
-	return hasBrand(error, REDIRECT_BRAND);
-}
-/**
-* True for any `SsrStreamError`. This one also crosses Vite environments:
-* it is thrown in SSR and caught in RSC, which are separate module graphs in
-* the same process — the brand is the only identity the two share.
-*/
-function isSsrStreamError(error) {
-	return hasBrand(error, SSR_STREAM_ERROR_BRAND);
+	if (issue) console.warn(`[timber] ${callerName}: ${issue}. Data passed to deny() must be JSON-serializable because the post-flush path uses JSON.stringify, not React Flight.`);
 }
 /**
 * Render-phase signal thrown by `deny()`. Caught by the framework to produce
 * the correct HTTP status code (segment context) or graceful degradation (slot context).
 *
-* Detect with `isDenySignal()`, never `instanceof` — see "Signal branding" above.
+* Detect with `isDenySignal()`, never `instanceof` — see "Signal branding" in signal-identity.ts.
 */
 var DenySignal = class extends Error {
 	[DENY_BRAND] = true;
@@ -814,9 +727,9 @@ var DenySignal = class extends Error {
 * deny(404, { dangerouslyPassData: { resourceId: params.id } }) // explicit client opt-in
 * ```
 *
-* Accepts any 4xx or 5xx status code. This replaces the need for
-* `throw new RenderError(...)` in user code — RenderError is now an
-* internal pipeline detail.
+* Accepts any 4xx or 5xx status code — it is also how a page renders a 5xx
+* status file with data. An unplanned throw needs no primitive: it renders
+* the error page with a 500.
 *
 * @param status - HTTP status code (4xx or 5xx). Default: 403.
 * @param options - Optional message and/or data to pass to the client.
@@ -832,7 +745,7 @@ function deny(status, options) {
 * Render-phase signal thrown by `redirect()` and `redirectExternal()`.
 * Caught by the framework to produce a 3xx response or client-side navigation.
 *
-* Detect with `isRedirectSignal()`, never `instanceof` — see "Signal branding" above.
+* Detect with `isRedirectSignal()`, never `instanceof` — see "Signal branding" in signal-identity.ts.
 */
 var RedirectSignal = class extends Error {
 	[REDIRECT_BRAND] = true;
@@ -846,24 +759,6 @@ var RedirectSignal = class extends Error {
 	}
 };
 /**
-* Returns true if the error is a framework control-flow signal (RedirectSignal
-* or DenySignal) rather than a genuine application error. Works both for direct
-* instances (RSC-side) and deserialized digest errors (SSR cross-boundary).
-*
-* See also: isFrameworkSignalError() in client/browser-dev.ts (client-only).
-*/
-function isControlFlowSignal(error) {
-	if (isDenySignal(error) || isRedirectSignal(error)) return true;
-	if (error && typeof error === "object") {
-		const digest = error.digest;
-		if (typeof digest === "string") try {
-			const parsed = JSON.parse(digest);
-			if (parsed && typeof parsed === "object") return parsed.type === "redirect" || parsed.type === "deny";
-		} catch {}
-	}
-	return false;
-}
-/**
 * Redirect to a relative path. Rejects absolute and protocol-relative URLs.
 * Use `redirectExternal()` for external redirects with an allow-list.
 *
@@ -911,41 +806,6 @@ function redirectExternal(url, allowList, status = 302) {
 	if (status < 300 || status > 399) throw new Error(`redirectExternal() requires a 3xx status code, got ${status}.`);
 	throw new RedirectSignal(validateExternalRedirectUrl(url, allowList), status);
 }
-/**
-* Typed throw for render-phase errors that carry structured context to error boundaries.
-*
-* The `digest` (code + data) is serialized into the RSC stream separately from the
-* Error instance — only the digest crosses the RSC → client boundary.
-*
-* @example
-* ```ts
-* throw new RenderError('PRODUCT_NOT_FOUND', {
-*   title: 'Product not found',
-*   resourceId: params.id,
-* })
-* ```
-*
-* Detect with `isRenderError()`, never `instanceof` — see "Signal branding" above.
-*/
-var RenderError = class extends Error {
-	[RENDER_ERROR_BRAND] = true;
-	code;
-	digest;
-	status;
-	constructor(code, data, options) {
-		super(`RenderError: ${code}`);
-		this.name = "RenderError";
-		this.code = code;
-		this.digest = {
-			code,
-			data
-		};
-		warnIfNotSerializable(data, "RenderError");
-		const status = options?.status ?? 500;
-		if (status < 400 || status > 599) throw new Error(`RenderError status must be 4xx or 5xx, got ${status}.`);
-		this.status = status;
-	}
-};
 var _waitUntilWarned = false;
 /**
 * Register a promise to be kept alive after the response is sent.
@@ -970,6 +830,376 @@ function waitUntil(promise) {
 	}
 }
 //#endregion
-export { getCookieJar as C, getWaitUntil as D, isDevMode as E, getCookie as S, isDebug as T, markResponseFlushed as _, isControlFlowSignal as a, setMutableCookieContext as b, isSsrStreamError as c, waitUntil as d, applyRequestHeaderOverlay as f, getSegmentParams as g, getSearchParams as h, deny as i, redirect as l, getHeaders as m, RedirectSignal as n, isDenySignal as o, getHeader as p, RenderError as r, isRedirectSignal as s, DenySignal as t, redirectExternal as u, runWithRequestContext as v, getSetCookieHeaders as w, setSegmentParams as x, setMatchedSegmentPath as y };
+//#region src/server/form-data.ts
+/**
+* FormData preprocessing — schema-agnostic conversion of FormData to typed objects.
+*
+* FormData is all strings. Schema validation expects typed values. This module
+* bridges the gap with intelligent coercion that runs *before* schema validation.
+*
+* Inspired by zod-form-data, but schema-agnostic — works with any Standard Schema
+* library (Zod, Valibot, ArkType).
+*
+* See design/08-forms-and-actions.md §"parseFormData() and coerce helpers"
+*/
+/**
+* Convert FormData into a plain object with intelligent coercion.
+*
+* Handles:
+* - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: ["js", "ts"] }`
+* - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: "Alice" } }`
+* - **Empty strings → undefined**: Enables `.optional()` semantics in schemas
+* - **Empty Files → undefined**: File inputs with no selection become `undefined`
+* - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded
+*/
+function parseFormData(formData) {
+	const flat = {};
+	for (const key of new Set(formData.keys())) {
+		if (key.startsWith("$ACTION_")) continue;
+		if (DANGEROUS_KEYS.has(key)) continue;
+		const processed = formData.getAll(key).map(normalizeValue);
+		if (processed.length === 1) flat[key] = processed[0];
+		else flat[key] = processed.filter((v) => v !== void 0 && v !== "");
+	}
+	return expandDotPaths(flat);
+}
+/**
+* Normalize a single FormData entry value.
+* - Empty File objects (no selection) → undefined
+* - Strings pass through as-is (empty strings stay as empty strings so
+*   schema validators like `z.string().min(1, 'Required')` can produce
+*   their custom error messages instead of a generic type mismatch)
+* - Everything else passes through as-is
+*/
+function normalizeValue(value) {
+	if (value instanceof File && value.size === 0 && value.name === "") return;
+	return value;
+}
+/**
+* Expand dot-notation keys into nested objects.
+* `{ "user.name": "Alice", "user.age": "30" }` → `{ user: { name: "Alice", age: "30" } }`
+*
+* Keys without dots are left as-is. Bracket notation (e.g. `items[0]`) is NOT
+* supported — use dot notation (`items.0`) instead.
+*/
+function expandDotPaths(flat) {
+	const result = {};
+	let hasDotPaths = false;
+	for (const key of Object.keys(flat)) if (key.includes(".")) {
+		hasDotPaths = true;
+		break;
+	}
+	if (!hasDotPaths) return flat;
+	for (const [key, value] of Object.entries(flat)) {
+		const parts = key.split(".");
+		if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
+		if (parts.length === 1) {
+			result[parts[0]] = value;
+			continue;
+		}
+		let current = result;
+		for (let i = 0; i < parts.length - 1; i++) {
+			const part = parts[i];
+			if (current[part] === void 0 || current[part] === null) current[part] = {};
+			if (typeof current[part] !== "object" || current[part] instanceof File) current[part] = {};
+			current = current[part];
+		}
+		current[parts[parts.length - 1]] = value;
+	}
+	return result;
+}
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__"]);
+/**
+* Schema-agnostic coercion primitives for common FormData patterns.
+*
+* These are plain transform functions — they compose with any schema library's
+* `transform`/`preprocess` pipeline:
+*
+* ```ts
+* // Zod
+* z.preprocess(coerce.number, z.number())
+* // Valibot
+* v.pipe(v.unknown(), v.transform(coerce.number), v.number())
+* ```
+*/
+var coerce = {
+	/**
+	* Coerce an empty string to undefined for optional text fields.
+	* Use with `.optional()` schemas where an empty input means "not provided".
+	*
+	* ```ts
+	* // Zod
+	* z.unknown().transform(coerce.text).pipe(z.string().optional())
+	* // Valibot
+	* v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))
+	* ```
+	*/
+	text(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value === "string") return value;
+	},
+	/**
+	* Coerce a string to a number.
+	* - `"42"` → `42`
+	* - `"3.14"` → `3.14`
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Non-numeric strings → `undefined` (schema validation will catch this)
+	*/
+	number(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value === "number") return value;
+		if (typeof value !== "string") return void 0;
+		const num = Number(value);
+		if (Number.isNaN(num)) return void 0;
+		return num;
+	},
+	/**
+	* Coerce a checkbox value to a boolean.
+	* HTML checkboxes submit "on" when checked and are absent when unchecked.
+	* - `"on"` / any truthy string → `true`
+	* - `undefined` / `null` / `""` → `false`
+	*/
+	checkbox(value) {
+		if (value === void 0 || value === null || value === "") return false;
+		if (typeof value === "boolean") return value;
+		return typeof value === "string" && value.length > 0;
+	},
+	/**
+	* Parse a JSON string into an object.
+	* - Valid JSON string → parsed object
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Invalid JSON → `undefined` (schema validation will catch this)
+	*/
+	json(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value !== "string") return value;
+		try {
+			return JSON.parse(value);
+		} catch {
+			return;
+		}
+	},
+	/**
+	* Coerce a date string to a Date object.
+	* Handles `<input type="date">` (`"2024-01-15"`), `<input type="datetime-local">`
+	* (`"2024-01-15T10:30"`), and full ISO 8601 strings.
+	* - Valid date string → `Date`
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Invalid date strings → `undefined` (schema validation will catch this)
+	* - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`
+	*/
+	date(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (value instanceof Date) return value;
+		if (typeof value !== "string") return void 0;
+		const date = new Date(value);
+		if (Number.isNaN(date.getTime())) return void 0;
+		const ymdMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})/);
+		if (ymdMatch) {
+			const inputYear = Number(ymdMatch[1]);
+			const inputMonth = Number(ymdMatch[2]);
+			const inputDay = Number(ymdMatch[3]);
+			const isUTC = value.length === 10 || value.endsWith("Z");
+			const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();
+			const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;
+			const parsedDay = isUTC ? date.getUTCDate() : date.getDate();
+			if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) return;
+		}
+		return date;
+	},
+	/**
+	* Create a File coercion function with optional size and mime type validation.
+	* Returns the File if valid, `undefined` otherwise.
+	*
+	* ```ts
+	* // Basic — just checks it's a real File
+	* z.preprocess(coerce.file(), z.instanceof(File))
+	*
+	* // With constraints
+	* z.preprocess(
+	*   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),
+	*   z.instanceof(File)
+	* )
+	* ```
+	*/
+	file(options) {
+		return (value) => {
+			if (value === void 0 || value === null || value === "") return void 0;
+			if (!(value instanceof File)) return void 0;
+			if (value.size === 0 && value.name === "") return void 0;
+			if (options?.maxSize !== void 0 && value.size > options.maxSize) return;
+			if (options?.accept !== void 0 && !options.accept.includes(value.type)) return;
+			return value;
+		};
+	}
+};
+//#endregion
+//#region src/server/actions.ts
+/**
+* Server action primitives: revalidatePath, revalidateTag, and the action handler.
+*
+* - revalidatePath(path) re-renders the route at that path and returns the RSC
+*   flight payload for inline reconciliation. Server actions only.
+* - revalidateTag(tag) invalidates timber.cache entries by tag. Callable from
+*   any server code: deferred to the end of the action inside one, immediate
+*   anywhere else.
+*
+* The action handler processes incoming action requests, validates CSRF,
+* enforces body limits, executes the action, and returns the response
+* (with piggybacked RSC payload if revalidatePath was called).
+*
+* See design/08-forms-and-actions.md
+*/
+/**
+* Thrown by a `RevalidateRenderer` that decided not to render: the path
+* was rejected, its params failed coercion, or its middleware answered
+* with a `Response` that cannot become an element tree. `executeAction`
+* drops the revalidation — the action result is still delivered, with no
+* `_tree` piggybacked — and, because the drop was a decision, does not
+* return it as an error to report. Identified by `instanceof`, so the
+* message text never reaches clients.
+*/
+var RevalidationDropped = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RevalidationDropped";
+	}
+};
+/**
+* Re-render the route at `path` and include the RSC flight payload in the
+* action response. The client reconciles inline — no separate fetch needed.
+*
+* Only callable inside a server action: it attaches a render to the action
+* response, and nothing else has one. To refresh cached data from a
+* `route.ts` handler, a webhook, or a job, use `revalidateTag()` or
+* `cache.invalidate()`.
+*
+* @param path - The path to re-render (e.g. '/dashboard', '/todos').
+*/
+function revalidatePath(path) {
+	const state = revalidationAls.getStore();
+	if (!state || state.closed) throw new Error("revalidatePath() can only be called inside a server action: it re-renders the route into the action response, and there is no action response here. To refresh cached data from a route handler or other server code, call revalidateTag() or cache.invalidate() for the tags the route reads.");
+	if (!state.paths.includes(path)) state.paths.push(path);
+}
+/**
+* Invalidate all timber.cache entries tagged with `tag`, and tombstone the
+* pre-rendered component seeds that carry it.
+* Does not return a payload — the next request for an invalidated entry re-executes.
+*
+* Callable from any server code. Inside a server action the invalidation is
+* deferred until the action body returns, so a `revalidatePath()` render in
+* the same action reads fresh data; the returned promise resolves at once.
+* Anywhere else — a `route.ts` webhook, a job, or background work an action
+* started that runs after the action body returned — it is
+* `cache.invalidate({ tag })`, and the promise settles when the invalidation
+* has. Await it before responding.
+*
+* @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
+*/
+function revalidateTag(tag) {
+	const state = revalidationAls.getStore();
+	if (!state || state.closed) return cache.invalidate({ tag });
+	if (!state.tags.includes(tag)) state.tags.push(tag);
+	return Promise.resolve();
+}
+function stripFragment(path) {
+	const idx = path.indexOf("#");
+	return idx >= 0 ? path.slice(0, idx) : path;
+}
+/**
+* Execute a server action and process revalidation.
+*
+* 1. Sets up revalidation state
+* 2. Calls the action function
+* 3. Processes revalidateTag calls (invalidates cache entries)
+* 4. Processes revalidatePath calls (re-renders and captures RSC payload)
+* 5. Returns the action result + optional RSC payload
+*
+* @param actionFn - The server action function to execute.
+* @param args - Arguments to pass to the action.
+* @param config - Handler configuration (cache handler, renderer).
+*/
+async function executeAction(actionFn, args, config = {}, spanMeta) {
+	const state = {
+		paths: [],
+		tags: []
+	};
+	const revalidationErrors = [];
+	let actionResult;
+	let redirectTo;
+	let redirectStatus;
+	await revalidationAls.run(state, async () => {
+		try {
+			actionResult = await withSpan("timber.action", {
+				...spanMeta?.actionFile ? { "timber.action_file": spanMeta.actionFile } : {},
+				...spanMeta?.actionName ? { "timber.action_name": spanMeta.actionName } : {}
+			}, () => actionFn(...args));
+		} catch (error) {
+			if (isRedirectSignal(error)) {
+				redirectTo = error.location;
+				redirectStatus = error.status;
+			} else throw error;
+		} finally {
+			state.closed = true;
+		}
+	});
+	if (state.tags.length > 0) {
+		const results = await Promise.allSettled(state.tags.map((tag) => cache.invalidate({ tag })));
+		for (const r of results) if (r.status === "rejected") {
+			console.error("[timber] revalidateTag invalidation failed:", r.reason);
+			revalidationErrors.push(r.reason);
+		}
+	}
+	let revalidation;
+	let invalidatedPaths;
+	if (state.paths.length > 0) {
+		const path = state.paths[0];
+		if (config.requestPathname && !revalidationPathMatches(path, config.requestPathname, config.requestSearch)) invalidatedPaths = [stripFragment(path)];
+		else if (config.renderer) try {
+			revalidation = await config.renderer(path);
+		} catch (renderError) {
+			if (isRedirectSignal(renderError)) {
+				redirectTo = renderError.location;
+				redirectStatus = renderError.status;
+			} else if (isDenySignal(renderError)) console.error(`[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`);
+			else if (renderError instanceof RevalidationDropped) console.error(`[timber] ${renderError.message}`);
+			else {
+				console.error("[timber] revalidatePath render failed:", renderError);
+				revalidationErrors.push(renderError);
+			}
+		}
+	}
+	return {
+		actionResult,
+		revalidation,
+		invalidatedPaths,
+		revalidationErrors,
+		...redirectTo ? {
+			redirectTo,
+			redirectStatus
+		} : {}
+	};
+}
+/**
+* Check if a `revalidatePath(path)` argument matches the request pathname.
+/**
+* Canonicalizes the revalidated path the same way the renderer does so
+* equivalent paths compare equal. Returns true when the paths match or
+* when comparison is inconclusive (validation failure → render to be safe).
+*/
+function revalidationPathMatches(revalidatedPath, requestPathname, requestSearch) {
+	const hashIdx = revalidatedPath.indexOf("#");
+	const noFragment = hashIdx >= 0 ? revalidatedPath.slice(0, hashIdx) : revalidatedPath;
+	const queryIdx = noFragment.indexOf("?");
+	const pathnameOnly = queryIdx >= 0 ? noFragment.slice(0, queryIdx) : noFragment;
+	const search = queryIdx >= 0 ? noFragment.slice(queryIdx) : "";
+	const canonical = canonicalize(pathnameOnly, true);
+	if (!canonical.ok) return true;
+	if (canonical.pathname !== requestPathname) return false;
+	if (search && search !== (requestSearch ?? "")) return false;
+	return true;
+}
+//#endregion
+export { setMutableCookieContext as C, setMatchedSegmentPath as S, runOutsideReactCacheScope as T, getHeaders as _, parseFormData as a, markResponseFlushed as b, deny as c, waitUntil as d, getCookie as f, getHeader as g, applyRequestHeaderOverlay as h, coerce as i, redirect as l, getSetCookieHeaders as m, revalidatePath as n, DenySignal as o, getCookieJar as p, revalidateTag as r, RedirectSignal as s, executeAction as t, redirectExternal as u, getSearchParams as v, setSegmentParams as w, runWithRequestContext as x, getSegmentParams as y };
 
-//# sourceMappingURL=primitives-DLAnvsrk.js.map
+//# sourceMappingURL=actions-BerlqoXA.js.map