@timber-js/app 0.2.0-alpha.207 → 0.2.0-alpha.209

package/dist/server/internal.js

@@ -1,22 +1,36 @@
+import { r as RenderTimeoutError, t as DEFAULT_RENDER_TIMEOUT_MS } from "../_chunks/render-timeout-DOf_BBcO.js";
 import { n as isRscContentType, r as isRscRequest } from "../_chunks/rsc-media-type-DDc7duTD.js";
-import { a as timingAls, r as requestContextAls, t as earlyHintsSenderAls } from "../_chunks/als-registry-C6kcfprT.js";
-import { D as getWaitUntil, S as getCookie, T as isDebug, _ as markResponseFlushed, b as setMutableCookieContext, f as applyRequestHeaderOverlay, g as getSegmentParams, h as getSearchParams, n as RedirectSignal, o as isDenySignal, p as getHeader, r as RenderError, s as isRedirectSignal, t as DenySignal, v as runWithRequestContext, w as getSetCookieHeaders, x as setSegmentParams, y as setMatchedSegmentPath } from "../_chunks/primitives-DLAnvsrk.js";
-import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-ClUiXQnK.js";
 import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-DSDjM_hJ.js";
 import { r as canonicalize } from "../_chunks/canonicalize-CgHoscYO.js";
 import { n as classifyUrlSegment, r as effectiveUrlSegment } from "../_chunks/segment-classify-C539Pa2O.js";
 import { t as computeSegmentTreePaths } from "../_chunks/segment-keys-D5hu1hz4.js";
-import { C as runWithTraceId, S as replaceTraceId, T as withSpan, a as logProxyError, c as logRequestReceived, d as logSwrRefetchFailed, f as logWaitUntilRejected, h as swallow, i as logMiddlewareShortCircuit, l as logRouteError, m as setLogger, n as logCacheMiss, o as logRenderError, p as logWaitUntilUnsupported, r as logMiddlewareError, s as logRequestCompleted, t as getLogger, u as logSlowRequest, v as generateTraceId, w as setSpanAttribute, x as getTraceId, y as getOtelTraceId } from "../_chunks/logger-k2DQ4EUf.js";
-import { a as requestCspNonce, i as collectRouteModulepreloads, n as collectRouteCss, r as collectRouteFonts } from "../_chunks/build-manifest-DTmSGLRz.js";
-import { i as coerce, t as executeAction } from "../_chunks/actions-jNrXdzgs.js";
-import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, y as lastInvalidationEpochFor } from "../_chunks/cache-api-CUD9Ezaq.js";
-import { n as createSingleflight } from "../_chunks/singleflight-2lUWfcAk.js";
+import { a as requestContextAls, r as prebuiltCaptureAls, s as timingAls, t as earlyHintsSenderAls } from "../_chunks/als-registry-DaxkVjt5.js";
+import { A as getTraceId, C as isDebug, D as generateTraceId, M as runWithTraceId, N as setSpanAttribute, O as getOtelTraceId, P as withSpan, S as isRedirectSignal, _ as swallow, a as logMiddlewareShortCircuit, b as isControlFlowSignal, c as logRequestCompleted, d as logRouteSetupError, f as logSlowRequest, g as setLogger, h as logWaitUntilUnsupported, i as logMiddlewareError, j as replaceTraceId, l as logRequestReceived, m as logWaitUntilRejected, n as logCacheMiss, o as logProxyError, p as logSwrRefetchFailed, s as logRenderError, t as getLogger, u as logRouteError, x as isDenySignal } from "../_chunks/logger-DiDt5ppH.js";
+import { i as collectRouteModulepreloads, n as collectRouteCss, r as collectRouteFonts } from "../_chunks/build-manifest-DWppEdLB.js";
+import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-ClUiXQnK.js";
+import { C as setMutableCookieContext, S as setMatchedSegmentPath, T as runOutsideReactCacheScope, b as markResponseFlushed, f as getCookie, g as getHeader, h as applyRequestHeaderOverlay, i as coerce, m as getSetCookieHeaders, o as DenySignal, s as RedirectSignal, t as executeAction, v as getSearchParams, w as setSegmentParams, x as runWithRequestContext, y as getSegmentParams } from "../_chunks/actions-BerlqoXA.js";
+import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as getWaitUntil, y as lastInvalidationEpochFor } from "../_chunks/cache-api-CR23J_NC.js";
+import { n as createSingleflight } from "../_chunks/singleflight-BeVMMKi0.js";
 import { n as toBracketKey } from "../_chunks/resolve-schema-CBR6Lm4i.js";
 import { t as normalizeParamValue } from "../_chunks/param-value-C8TNYchQ.js";
-import { s as TIMBER_ERROR_HEADER, t as StatusPageMarker } from "../_chunks/status-page-marker-DwQBrLBz.js";
+import { l as TIMBER_ERROR_HEADER, t as StatusPageMarker } from "../_chunks/status-page-marker-gaihi0KZ.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import React, { createElement, useContext } from "react";
+//#region src/server/render-utils.ts
+/**
+* Check if an error is an abort error (connection closed by client).
+*
+* When the browser aborts a request (page refresh, navigation away),
+* the AbortSignal fires and React/streams throw an AbortError. This
+* is not an application error — suppress it from error boundaries and logs.
+*/
+function isAbortError(error) {
+	if (error instanceof DOMException && error.name === "AbortError") return true;
+	if (error instanceof Error && error.name === "AbortError") return true;
+	return false;
+}
+//#endregion
 //#region src/server/server-timing.ts
 /**
 * Server-Timing header — dev-mode timing breakdowns for Chrome DevTools.
@@ -171,6 +185,52 @@ function wrapResponseWithStreamTiming(body, startTime) {
 		}
 	});
 }
+/**
+* Read a byte stream to completion under one overall deadline and return
+* the concatenated bytes. Every read is raced against the time remaining,
+* and the reader is cancelled on every exit, so a stalled upstream never
+* outlives the deadline. See design/02-rendering-pipeline.md §"Always
+* Timeout-Guard Stream Reads".
+*
+* @param label - Prefix for the timeout error message. Both ways the deadline
+*   can pass (between reads, or while a read is pending) reject with the same
+*   `${label} did not complete within ${timeoutMs}ms`.
+*/
+async function readAllBytesWithDeadline(stream, timeoutMs, label) {
+	const reader = stream.getReader();
+	const chunks = [];
+	let totalLength = 0;
+	const deadline = Date.now() + timeoutMs;
+	const deadlineError = () => /* @__PURE__ */ new Error(`${label} did not complete within ${timeoutMs}ms`);
+	try {
+		for (;;) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) throw deadlineError();
+			let timer;
+			const timeout = new Promise((_, reject) => {
+				timer = setTimeout(() => reject(deadlineError()), remaining);
+			});
+			let result;
+			try {
+				result = await Promise.race([reader.read(), timeout]);
+			} finally {
+				clearTimeout(timer);
+			}
+			if (result.done) break;
+			chunks.push(result.value);
+			totalLength += result.value.byteLength;
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+	}
+	const bytes = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
 //#endregion
 //#region src/server/instrumentation.ts
 /**
@@ -234,6 +294,63 @@ function hasOnRequestError() {
 	return _onRequestError !== null;
 }
 //#endregion
+//#region src/server/safe-load.ts
+/**
+* Custom error class for module load failures.
+*
+* Preserves the original error as `cause` while providing a
+* human-readable message with the file path.
+*/
+var ModuleLoadError = class extends Error {
+	/** The file path that failed to load. */
+	filePath;
+	constructor(filePath, cause) {
+		const originalMessage = cause instanceof Error ? cause.message : String(cause);
+		super(`[timber] Failed to load module ${filePath}\n  ${originalMessage}`, { cause });
+		this.name = "ModuleLoadError";
+		this.filePath = filePath;
+	}
+};
+/**
+* Load a route manifest module with enriched error context.
+*
+* On success: returns the module object (same as `loader.load()`).
+* On failure: throws `ModuleLoadError` with file path and original cause.
+*
+* For error rendering paths that need fallthrough instead of throwing,
+* callers should catch at the call site:
+*
+* ```ts
+* // Throwing (default) — route-element-builder, api-handler, etc.
+* const mod = await loadModule(segment.page);
+*
+* // Fallthrough — error-renderer, error-boundary-wrapper
+* const mod = await loadModule(segment.error).catch(() => null);
+* ```
+*/
+async function loadModule(loader) {
+	try {
+		return await loader.load();
+	} catch (error) {
+		throw new ModuleLoadError(loader.filePath, error);
+	}
+}
+//#endregion
+//#region src/server/route-matcher.ts
+/**
+* Whether a matched chain renders as an API route: its leaf has a
+* `route.ts` and no `page.tsx`. The same test `renderRoute` dispatches on,
+* so every answer about a route's format — early hints, deny format, error
+* format, error reporting — agrees with what actually ran.
+*/
+function isApiRouteChain(segments) {
+	const leaf = segments[segments.length - 1];
+	return !!leaf?.route && !leaf.page;
+}
+var SERVE_PATH_TO_CONVENTION = /* @__PURE__ */ new Map();
+for (const [baseName, convention] of Object.entries(METADATA_ROUTE_CONVENTIONS)) if (convention.serveExtension) for (const ext of [...convention.staticExtensions, convention.serveExtension]) SERVE_PATH_TO_CONVENTION.set(`${convention.servePath}.${ext}`, baseName);
+else SERVE_PATH_TO_CONVENTION.set(convention.servePath, baseName);
+//#endregion
 //#region src/server/pipeline-helpers.ts
 /**
 * Build a proxy resolver closure from the declared source. Called exactly
@@ -269,6 +386,30 @@ function applyCookieJar(headers) {
 	for (const value of getSetCookieHeaders()) headers.append("Set-Cookie", value);
 }
 /**
+* Bring a bag the jar was already applied to up to date with the jar.
+*
+* `applied` is what `getSetCookieHeaders()` returned when the jar was
+* applied to `headers`. Values the jar no longer holds (a later write to the
+* same name replaced them) are removed, and values it gained are appended.
+* Every cookie then appears once, with its last write (design/29-cookies.md
+* §"Last-Write-Wins for Same Name"). `Set-Cookie` values that did not come
+* from the jar, such as a middleware appending to `ctx.headers` directly,
+* are left alone.
+*/
+function syncCookieJar(headers, applied) {
+	const current = getSetCookieHeaders();
+	const stale = applied.filter((value) => !current.includes(value));
+	const added = current.filter((value) => !applied.includes(value));
+	if (stale.length === 0 && added.length === 0) return;
+	const kept = headers.getSetCookie();
+	for (const value of stale) {
+		const index = kept.indexOf(value);
+		if (index !== -1) kept.splice(index, 1);
+	}
+	headers.delete("Set-Cookie");
+	for (const value of [...kept, ...added]) headers.append("Set-Cookie", value);
+}
+/**
 * Merge framework-managed response headers onto a terminal response without
 * overwriting headers the terminal response already set itself.
 */
@@ -302,15 +443,31 @@ function cloneWithMutableHeaders(response) {
 	});
 }
 /**
+* A fresh response header bag for a page the pipeline renders, seeded with
+* the default dynamic-page cache policy.
+*
+* Without a Cache-Control header, CDNs (particularly Cloudflare) may attempt
+* to buffer/process the response differently, causing intermittent
+* multi-second delays. This matches Next.js's default behavior. Every bag a
+* rendered page can be written onto starts here — a matched route, the
+* no-match 404, and a deny page for a proxy-phase signal — so none of them
+* leaves without a cache policy. Middleware and route handlers may replace it.
+*/
+function dynamicResponseHeaders() {
+	return new Headers({ "Cache-Control": "private, no-cache, no-store, max-age=0, must-revalidate" });
+}
+/**
 * Build a redirect Response from a RedirectSignal.
 *
-* For RSC payload requests (client navigation), returns 204 + X-Timber-Redirect
-* so the client router can perform a soft SPA redirect. A raw 302 would be
-* turned into an opaque redirect by fetch({redirect:'manual'}), crashing
-* createFromFetch. See design/19-client-navigation.md.
+* For a client navigation (an RSC payload request for a page), returns 204 +
+* X-Timber-Redirect so the client router can perform a soft SPA redirect. A
+* raw 302 would be turned into an opaque redirect by
+* fetch({redirect:'manual'}), crashing createFromFetch. See
+* design/19-client-navigation.md. The caller decides what counts as a
+* navigation: a route.ts match answers with a real 3xx whatever it accepts.
 */
-function buildRedirectResponse(signal, req, headers) {
-	if (isRscRequest(req)) {
+function buildRedirectResponse(signal, headers, navigation) {
+	if (navigation) {
 		headers.set("X-Timber-Redirect", signal.location);
 		return new Response(null, {
 			status: 204,
@@ -325,25 +482,134 @@ function buildRedirectResponse(signal, req, headers) {
 }
 /**
 * Fire the user's onRequestError hook with request context.
-* Extracts request info from the Request object and calls the instrumentation hook.
+*
+* The one place a pipeline phase becomes the `phase` / `routeType` the hook
+* reports, so every caller agrees. A render-phase error on a route.ts match
+* is phase `'route'`, because the handler is what ran. Middleware reports
+* as `'handler'`, its public name.
+*/
+async function fireOnRequestError(error, req, source, segments) {
+	if (!isReportableError(error) || req.signal?.aborted) return;
+	if (isRepeatedLoadFailure(error)) return;
+	await callHook(error, req, source, segments);
+}
+/**
+* Module evaluations whose failure was already reported. A module that fails
+* to evaluate rethrows the same error on every later import, and
+* `loadModule()` wraps each one in a new `ModuleLoadError` with that error
+* as its `cause`. One broken module is one bug until it changes, however many
+* loads trip over it in a request or across requests: the page's boundaries,
+* then the fallback page, then the next request. A WeakSet, so a module that
+* is re-evaluated (an HMR edit) gets a new cause and is reported again.
+*/
+var reportedLoadFailures = /* @__PURE__ */ new WeakSet();
+/**
+* The same for a module that threw a primitive (`throw 'broken'`), which a
+* WeakSet cannot hold. Keyed on the file and the value instead, so a module
+* re-broken after an edit with the very same value is not reported again.
+* It grows with the number of broken modules, not with requests.
+*/
+var reportedPrimitiveLoadFailures = /* @__PURE__ */ new Set();
+function isRepeatedLoadFailure(error) {
+	if (!(error instanceof ModuleLoadError)) return false;
+	const cause = error.cause;
+	if (typeof cause === "object" && cause !== null) {
+		if (reportedLoadFailures.has(cause)) return true;
+		reportedLoadFailures.add(cause);
+		return false;
+	}
+	const key = `${error.filePath}\0${typeof cause}\0${String(cause)}`;
+	if (reportedPrimitiveLoadFailures.has(key)) return true;
+	reportedPrimitiveLoadFailures.add(key);
+	return false;
+}
+/**
+* Call the hook with request context, with no filtering. Only
+* `fireOnRequestError()` and background reporting call it: background work
+* runs after the response, so its request having aborted says nothing about
+* the failure.
 */
-async function fireOnRequestError(error, req, phase) {
+async function callHook(error, req, source, segments) {
+	if (!hasOnRequestError()) return;
 	const url = new URL(req.url);
 	const headersObj = {};
 	req.headers.forEach((v, k) => {
 		headersObj[k] = v;
 	});
+	const apiRoute = source === "route" || segments !== void 0 && isApiRouteChain(segments);
 	await callOnRequestError(error, {
 		method: req.method,
 		path: url.pathname,
 		headers: headersObj
 	}, {
-		phase,
+		phase: reportedPhase(source, apiRoute),
 		routePath: url.pathname,
-		routeType: "page",
+		routeType: source === "action" ? "action" : apiRoute ? "route" : "page",
 		traceId: getTraceId()
 	});
 }
+/**
+* Whether an error is a failure `onRequestError` should hear about.
+*
+* Control-flow signals are outcomes the code chose — a `deny()` picks the
+* page's status and data — and an abort is the client leaving. Callers answering
+* a live request also skip everything once `req.signal` has aborted: a
+* driver that throws "connection closed" after a disconnect is not a bug.
+*/
+function isReportableError(error) {
+	return !isControlFlowSignal(error) && !isAbortError(error);
+}
+/**
+* Fire the hook without making the caller wait, for callers that cannot:
+* Flight's `onError` is synchronous, and background work has no caller.
+* The promise is registered with the request's `waitUntil` so platforms
+* that stop work when the response ends (Workers, Lambda) let the hook
+* finish. The hook's own failures are caught in `callOnRequestError()`.
+*/
+function fireInBackground(report) {
+	getWaitUntil()?.(report.catch((hookError) => swallow(hookError, "onRequestError could not be called")));
+}
+/**
+* Run a `cache.component` stale-while-revalidate re-render as a singleflight
+* body, and log and report its failure once for the flight. The stale
+* payload already answered, so nothing else sees the failure.
+*
+* - **Once per flight.** A `.catch` on the flight's promise would run once
+*   per request that joined it, so the report happens inside the body. A
+*   body still running when the singleflight times out is reported then,
+*   with the timeout error (the signal's reason), and its later rejection
+*   is dropped.
+* - **Against the request whose stale read started it**, read from the
+*   request context the work runs in. With no request (the build-time
+*   capture store) it is only logged.
+* - **As phase `'render'`, route type `'page`.** A `cache.component` is a
+*   server component, so the read that started this was a page render (a
+*   revalidated page tree included). The request's own abort does not
+*   suppress the report: the work runs after the response either way.
+*/
+async function runBackgroundFlight(signal, work, log) {
+	const failed = (error) => {
+		log(error);
+		const request = requestContextAls.getStore()?.request;
+		if (request && isReportableError(error)) fireInBackground(callHook(error, request, "render"));
+	};
+	const onTimeout = () => failed(signal.reason);
+	signal.addEventListener("abort", onTimeout, { once: true });
+	try {
+		await work();
+	} catch (error) {
+		if (!signal.aborted) failed(error);
+	} finally {
+		signal.removeEventListener("abort", onTimeout);
+	}
+}
+function reportedPhase(source, apiRoute) {
+	switch (source) {
+		case "middleware": return "handler";
+		case "render": return apiRoute ? "route" : "render";
+		default: return source;
+	}
+}
 //#endregion
 //#region src/server/proxy.ts
 /**
@@ -399,6 +665,54 @@ async function runMiddlewareChain(chain, ctx) {
 	}
 }
 //#endregion
+//#region src/server/csp-nonce.ts
+/**
+* CSP nonce — per-request, generated on demand.
+*
+* timber emits several inline `<script>` tags per HTML response — React's
+* bootstrap script and Fizz runtime, the Flight init/chunk scripts, the
+* segment-tree script, and the post-flush noindex script. Under a strict
+* `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every
+* one of them needs the request's nonce or the browser refuses to run it.
+*
+* The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it
+* in the CSP header it sets through `ctx.headers`. The first read generates
+* the value and stores it on the request context; the render pipeline reads
+* it back with `getCspNonce()` and stamps it on every inline script. A
+* request whose middleware never reads `ctx.nonce` has no nonce, and its
+* markup is byte-identical to a render without this feature. timber does
+* not parse the CSP header — the app owns the policy, timber owns the
+* markup, and `ctx.nonce` is the one value both are built from.
+*
+* `proxy.ts` cannot participate: it only sees the finished response from
+* `next()`, after the markup exists.
+*
+* See design/13-security.md §"Content Security Policy" (TIM-1414).
+*/
+/**
+* Generate a CSP nonce: 128 random bits, base64. Matches CSP's
+* `base64-value` grammar, so it is valid in the header verbatim and safe
+* inside a double-quoted HTML attribute without escaping.
+*/
+function generateNonce() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary);
+}
+/**
+* The request's CSP nonce, creating it on first call. Backs the
+* `ctx.nonce` getter on `MiddlewareContext`. Outside a request context
+* (tests, build-time rendering) a fresh value is returned but not
+* retained, since there is no request for it to belong to.
+*/
+function requestCspNonce() {
+	const store = requestContextAls.getStore();
+	if (!store) return generateNonce();
+	store.cspNonce ??= generateNonce();
+	return store.cspNonce;
+}
+//#endregion
 //#region src/server/param-coercion.ts
 /**
 * Thrown when an app/schema.ts segment-param codec's parse() fails.
@@ -413,7 +727,12 @@ var ParamCoercionError = class extends Error {
 /** Global schema codecs, set once at startup from virtual:timber-schema. */
 var _globalCodecs = null;
 /**
-* Run segment param coercion on the matched route's segments.
+* Coerce the matched route's raw segment params and return the result.
+*
+* Reads `match.rawSegmentParams` and never writes to `match`: the caller
+* decides where the coerced params go. Reading the raw record makes the call
+* repeatable — coercing a match twice runs every codec on the URL value both
+* times, never on its own output.
 *
 * Codecs come from `app/schema.ts` and nowhere else (TIM-1342 completed
 * design/41-global-params.md migration step 9). A route with no schema, or
@@ -427,16 +746,15 @@ var _globalCodecs = null;
 * See design/41-global-params.md §"Pipeline Integration"
 *
 * Stays `async` with nothing to await: it is injected as a
-* `CoerceSegmentParamsFn` into the revalidation renderer and the action
-* middleware runner, both of which await it. Narrowing the return type to
-* `void` would break those contracts and remove a microtask boundary the
-* pipeline's ordering has always had, for no gain.
+* `CoerceSegmentParamsFn` into the revalidation renderer, which awaits
+* it. Making it synchronous would
+* change that contract and remove a microtask boundary the pipeline's
+* ordering has always had, for no gain.
 */
 async function coerceSegmentParams(match) {
 	const globalCodecs = _globalCodecs;
 	const mergeTarget = Object.create(null);
-	for (const key of Object.keys(match.segmentParams)) if (key !== "__proto__") mergeTarget[key] = match.segmentParams[key];
-	match.segmentParams = mergeTarget;
+	for (const key of Object.keys(match.rawSegmentParams)) if (key !== "__proto__") mergeTarget[key] = match.rawSegmentParams[key];
 	if (globalCodecs) for (const node of match.segments) {
 		const segment = effectiveUrlSegment(node);
 		if (!segment.paramName) continue;
@@ -455,6 +773,7 @@ async function coerceSegmentParams(match) {
 		}
 		mergeTarget[key] = normalizeParamValue(parsed, key);
 	}
+	return mergeTarget;
 }
 //#endregion
 //#region src/server/pipeline-metadata.ts
@@ -522,45 +841,48 @@ function escapeXml(str) {
 	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
 //#endregion
-//#region src/server/safe-load.ts
+//#region src/server/state-tree-diff.ts
 /**
-* Custom error class for module load failures.
+* State Tree Diffing — Server-side parsing and diffing of X-Timber-State-Tree.
 *
-* Preserves the original error as `cause` while providing a
-* human-readable message with the file path.
-*/
-var ModuleLoadError = class extends Error {
-	/** The file path that failed to load. */
-	filePath;
-	constructor(filePath, cause) {
-		const originalMessage = cause instanceof Error ? cause.message : String(cause);
-		super(`[timber] Failed to load module ${filePath}\n  ${originalMessage}`, { cause });
-		this.name = "ModuleLoadError";
-		this.filePath = filePath;
-	}
-};
-/**
-* Load a route manifest module with enriched error context.
+* The client sends X-Timber-State-Tree on navigation requests, listing
+* the sync segments it has cached. The server diffs this against the
+* target route's segments to skip re-rendering unchanged sync layouts.
 *
-* On success: returns the module object (same as `loader.load()`).
-* On failure: throws `ModuleLoadError` with file path and original cause.
+* This is a performance optimization only — NOT a security boundary.
+* All access.ts files run regardless of the state tree content.
+* A fabricated state tree can only cause extra rendering work or stale
+* layouts — never auth bypass.
 *
-* For error rendering paths that need fallthrough instead of throwing,
-* callers should catch at the call site:
+* See design/19-client-navigation.md §"X-Timber-State-Tree Header"
+* See design/13-security.md §"State tree manipulation"
+*/
+/**
+* Parse the X-Timber-State-Tree header from a request.
 *
-* ```ts
-* // Throwing (default) — route-element-builder, api-handler, etc.
-* const mod = await loadModule(segment.page);
+* Returns a Set of segment paths the client has cached (with an
+* additional `slots` property for cached slot paths), or null if
+* the header is missing, malformed, or empty. Parsing happens before
+* renderToReadableStream — not inside the React render pass.
 *
-* // Fallthrough — error-renderer, error-boundary-wrapper
-* const mod = await loadModule(segment.error).catch(() => null);
-* ```
+* @returns ClientStateTree with segments and slots, or null if no valid state tree
 */
-async function loadModule(loader) {
+function parseClientStateTree(req) {
+	const header = req.headers.get("X-Timber-State-Tree");
+	if (!header) return null;
 	try {
-		return await loader.load();
-	} catch (error) {
-		throw new ModuleLoadError(loader.filePath, error);
+		const parsed = JSON.parse(header);
+		const hasSegments = Array.isArray(parsed.segments) && parsed.segments.length > 0;
+		const hasSlots = Array.isArray(parsed.slots) && parsed.slots.length > 0;
+		const hasTreePaths = Array.isArray(parsed.treePaths) && parsed.treePaths.length > 0;
+		if (!hasSegments && !hasSlots && !hasTreePaths) return null;
+		const result = new Set(hasSegments ? parsed.segments : []);
+		result.slots = hasSlots ? new Set(parsed.slots) : null;
+		result.treePaths = hasTreePaths ? new Set(parsed.treePaths) : null;
+		return result;
+	} catch (err) {
+		swallow(err, "malformed X-Timber-State-Tree header");
+		return null;
 	}
 }
 //#endregion
@@ -679,50 +1001,62 @@ function pathnameMatchesPattern(pathname, pattern) {
 	}
 	return pi === pathParts.length;
 }
-//#endregion
-//#region src/server/state-tree-diff.ts
 /**
-* State Tree Diffing — Server-side parsing and diffing of X-Timber-State-Tree.
+* Resolve which route renders a soft navigation that an intercepting route
+* may claim. Returns the canonical match unchanged when no rewrite applies.
 *
-* The client sends X-Timber-State-Tree on navigation requests, listing
-* the sync segments it has cached. The server diffs this against the
-* target route's segments to skip re-rendering unchanged sync layouts.
-*
-* This is a performance optimization only — NOT a security boundary.
-* All access.ts files run regardless of the state tree content.
-* A fabricated state tree can only cause extra rendering work or stale
-* layouts — never auth bypass.
-*
-* See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-* See design/13-security.md §"State tree manipulation"
+* Runs during route setup, so anything it throws is a `'setup'` outcome.
 */
+function resolveInterceptedRoute(config, req, canonicalPathname, canonicalMatch) {
+	const stripTrailingSlash = config.stripTrailingSlash ?? true;
+	let match = canonicalMatch;
+	let interception;
+	if (isRscRequest(req) && config.interceptionRewrites?.length) {
+		const rawSourceUrl = req.headers.get("X-Timber-URL");
+		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
+		if (validatedSourceUrl) {
+			const resolveSourceScopes = () => {
+				const mounted = new Set(parseClientStateTree(req)?.treePaths ?? []);
+				const sourceRoute = config.matchRoute(validatedSourceUrl);
+				const scopes = [mounted, new Set(sourceRoute ? computeSegmentTreePaths(sourceRoute.segments) : [])].filter((scope) => scope.size > 0);
+				return scopes.length > 0 ? scopes : null;
+			};
+			const rewrite = findInterceptionMatch(canonicalPathname, resolveSourceScopes, config.interceptionRewrites);
+			if (rewrite?.mode === "children") {
+				const interceptedMatch = config.matchInterceptedRoute?.(canonicalPathname, rewrite.interceptingScope);
+				if (interceptedMatch) match = interceptedMatch;
+			} else if (rewrite) {
+				const sourceMatch = config.matchRoute(rewrite.interceptingPrefix);
+				if (sourceMatch !== null && computeSegmentTreePaths(sourceMatch.segments).includes(rewrite.interceptingScope)) {
+					match = sourceMatch;
+					interception = { targetPathname: canonicalPathname };
+				}
+			}
+		}
+	}
+	return {
+		match,
+		interception
+	};
+}
 /**
-* Parse the X-Timber-State-Tree header from a request.
-*
-* Returns a Set of segment paths the client has cached (with an
-* additional `slots` property for cached slot paths), or null if
-* the header is missing, malformed, or empty. Parsing happens before
-* renderToReadableStream — not inside the React render pass.
+* Validate and canonicalize the X-Timber-URL header value.
 *
-* @returns ClientStateTree with segments and slots, or null if no valid state tree
+* Returns the canonical pathname if valid, or null if rejected:
+* - Must start with '/' (relative pathname, no scheme/authority)
+* - Must not contain control characters
+* - Must pass canonicalization (no encoded separators, null bytes, etc.)
 */
-function parseClientStateTree(req) {
-	const header = req.headers.get("X-Timber-State-Tree");
-	if (!header) return null;
-	try {
-		const parsed = JSON.parse(header);
-		const hasSegments = Array.isArray(parsed.segments) && parsed.segments.length > 0;
-		const hasSlots = Array.isArray(parsed.slots) && parsed.slots.length > 0;
-		const hasTreePaths = Array.isArray(parsed.treePaths) && parsed.treePaths.length > 0;
-		if (!hasSegments && !hasSlots && !hasTreePaths) return null;
-		const result = new Set(hasSegments ? parsed.segments : []);
-		result.slots = hasSlots ? new Set(parsed.slots) : null;
-		result.treePaths = hasTreePaths ? new Set(parsed.treePaths) : null;
-		return result;
-	} catch (err) {
-		swallow(err, "malformed X-Timber-State-Tree header");
-		return null;
+function validateInterceptionHeader(raw, stripTrailingSlash) {
+	if (!raw.startsWith("/")) return null;
+	if (raw.startsWith("//")) return null;
+	for (let i = 0; i < raw.length; i++) {
+		const code = raw.charCodeAt(i);
+		if (code <= 31 || code === 127) return null;
 	}
+	const result = canonicalize(raw, stripTrailingSlash);
+	if (!result.ok) return null;
+	return result.pathname;
 }
 //#endregion
 //#region src/server/response-cache-policy.ts
@@ -838,13 +1172,78 @@ function rscErrorResponse(isRsc, status, headers) {
 * `proxy.ts` that awaits `next()` and then throws, this is the only place
 * the cookies downstream middleware set can reach the wire
 * (design/29-cookies.md §"proxy.ts Cookie Access"). Middleware-phase
-* signals throw before that phase's own application, so they need it too.
+* signals throw before that phase's own application, so they need it too,
+* and so do setup-phase outcomes, which come before any phase applied it.
+*
+* `fresh` creates the bag for an outcome that arrives without one.
 */
-function outcomeHeaders(outcome, ctx) {
-	const headers = ctx.responseHeaders ?? new Headers();
+function outcomeHeaders(outcome, ctx, fresh = () => new Headers()) {
+	const headers = ctx.responseHeaders ?? fresh();
 	if (outcome.phase !== "render") applyCookieJar(headers);
 	return headers;
 }
+/** Whether the outcome is for a route.ts match, which answers in its own format. */
+function isApiRouteMatch(ctx) {
+	return ctx.match !== void 0 && isApiRouteChain(ctx.match.segments);
+}
+/**
+* Report an error outcome once: log it under its phase, fire
+* `onRequestError`, and hand it to the dev overlay. An error from a
+* route.ts handler — or anything else in its render phase — logs as a route
+* error and reports as phase `'route'`.
+*/
+async function reportError(config, error, phase, ctx) {
+	const { method, path } = ctx;
+	switch (phase) {
+		case "proxy":
+			logProxyError({ error });
+			break;
+		case "setup":
+			logRouteSetupError({
+				method,
+				path,
+				error
+			});
+			break;
+		case "middleware":
+			logMiddlewareError({
+				method,
+				path,
+				error
+			});
+			break;
+		case "render": if (isApiRouteMatch(ctx)) logRouteError({
+			method,
+			path,
+			error
+		});
+		else logRenderError({
+			method,
+			path,
+			error
+		});
+	}
+	await fireOnRequestError(error, ctx.req, phase, ctx.match?.segments);
+	if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, phase);
+}
+/** The outcome for a value a phase threw: a signal, or an error. */
+function thrownOutcome(phase, thrown) {
+	if (isRedirectSignal(thrown)) return {
+		kind: "redirect",
+		phase,
+		signal: thrown
+	};
+	if (isDenySignal(thrown)) return {
+		kind: "deny",
+		phase,
+		signal: thrown
+	};
+	return {
+		kind: "error",
+		phase,
+		error: thrown
+	};
+}
 /**
 * Terminal outcome handler — converts a `PhaseOutcome` into a final
 * `Response`, applying cookies, building redirects, rendering deny pages
@@ -873,10 +1272,11 @@ async function outcomeToResponse(config, outcome, ctx) {
 		}
 		case "redirect": {
 			const headers = outcomeHeaders(outcome, ctx);
-			return buildRedirectResponse(outcome.signal, ctx.req, headers);
+			const navigation = isRscRequest(ctx.req) && !isApiRouteMatch(ctx);
+			return buildRedirectResponse(outcome.signal, headers, navigation);
 		}
 		case "deny": {
-			const headers = outcomeHeaders(outcome, ctx);
+			const headers = outcomeHeaders(outcome, ctx, dynamicResponseHeaders);
 			if (config.renderDenyFallback) try {
 				return cloneWithMutableHeaders(await config.renderDenyFallback(outcome.signal, ctx.req, headers, ctx.match));
 			} catch (denyRenderError) {
@@ -885,51 +1285,31 @@ async function outcomeToResponse(config, outcome, ctx) {
 					path: ctx.path,
 					error: denyRenderError
 				});
-				await fireOnRequestError(denyRenderError, ctx.req, "render");
+				await fireOnRequestError(denyRenderError, ctx.req, "render", ctx.match?.segments);
 				if (config.onPipelineError && denyRenderError instanceof Error) config.onPipelineError(denyRenderError, "render");
+				if (isRscRequest(ctx.req)) return rscErrorEnvelope(outcome.signal.status, headers);
 			}
 			if (isDebug()) console.warn(`[timber] DenySignal(${outcome.signal.status}) from ${outcome.phase} phase — no renderDenyFallback configured, returning bare ${outcome.signal.status} response\n  Request: ${ctx.method} ${ctx.path}\n  Add a status-code file (e.g. 404.tsx) or error.tsx to render a custom deny page.`);
 			return new Response(null, {
 				status: outcome.signal.status,
 				headers
 			});
-		}
-		case "error": {
-			const isRsc = isRscRequest(ctx.req);
-			if (outcome.phase === "proxy") {
-				logProxyError({ error: outcome.error });
-				await fireOnRequestError(outcome.error, ctx.req, "proxy");
-				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "proxy");
-				return rscErrorResponse(isRsc, 500, outcomeHeaders(outcome, ctx));
-			}
-			if (outcome.phase === "middleware") {
-				logMiddlewareError({
-					method: ctx.method,
-					path: ctx.path,
-					error: outcome.error
-				});
-				await fireOnRequestError(outcome.error, ctx.req, "handler");
-				if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "middleware");
-				return rscErrorResponse(isRsc, 500, outcomeHeaders(outcome, ctx));
-			}
-			const headers = outcomeHeaders(outcome, ctx);
-			logRenderError({
-				method: ctx.method,
-				path: ctx.path,
-				error: outcome.error
-			});
-			await fireOnRequestError(outcome.error, ctx.req, "render");
-			if (config.onPipelineError && outcome.error instanceof Error) config.onPipelineError(outcome.error, "render");
-			if (isRsc) return rscErrorResponse(true, 500, headers);
+		}
+		case "error": {
+			const isRsc = isRscRequest(ctx.req);
+			const headers = outcomeHeaders(outcome, ctx);
+			await reportError(config, outcome.error, outcome.phase, ctx);
+			if (outcome.phase === "proxy" || outcome.phase === "middleware") return rscErrorResponse(isRsc, 500, headers);
+			if (isRsc && !isApiRouteMatch(ctx)) return rscErrorResponse(true, 500, headers);
 			if (config.renderFallbackError) try {
-				return cloneWithMutableHeaders(await config.renderFallbackError(outcome.error, ctx.req, headers));
+				return cloneWithMutableHeaders(await config.renderFallbackError(outcome.error, ctx.req, errorResponseHeaders(headers), ctx.match));
 			} catch (fallbackRenderError) {
 				logRenderError({
 					method: ctx.method,
 					path: ctx.path,
 					error: fallbackRenderError
 				});
-				await fireOnRequestError(fallbackRenderError, ctx.req, "render");
+				await fireOnRequestError(fallbackRenderError, ctx.req, "render", ctx.match?.segments);
 				if (config.onPipelineError && fallbackRenderError instanceof Error) config.onPipelineError(fallbackRenderError, "render");
 			}
 			return rscErrorResponse(false, 500, headers);
@@ -952,25 +1332,6 @@ async function outcomeToResponse(config, outcome, ctx) {
 * See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow".
 */
 /**
-* Validate and canonicalize the X-Timber-URL header value.
-*
-* Returns the canonical pathname if valid, or null if rejected:
-* - Must start with '/' (relative pathname, no scheme/authority)
-* - Must not contain control characters
-* - Must pass canonicalization (no encoded separators, null bytes, etc.)
-*/
-function validateInterceptionHeader(raw, stripTrailingSlash) {
-	if (!raw.startsWith("/")) return null;
-	if (raw.startsWith("//")) return null;
-	for (let i = 0; i < raw.length; i++) {
-		const code = raw.charCodeAt(i);
-		if (code <= 31 || code === 127) return null;
-	}
-	const result = canonicalize(raw, stripTrailingSlash);
-	if (!result.ok) return null;
-	return result.pathname;
-}
-/**
 * Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
 *
 * When `next` is provided, it replaces the default `handleRequest` as the
@@ -991,21 +1352,7 @@ async function runProxyPhase(config, getProxy, req, method, path, next) {
 			response: await withSpan("timber.proxy", {}, () => detailed ? withTiming("proxy", "proxy.ts", proxyFn) : proxyFn())
 		};
 	} catch (error) {
-		if (isRedirectSignal(error)) return {
-			kind: "redirect",
-			phase: "proxy",
-			signal: error
-		};
-		if (isDenySignal(error)) return {
-			kind: "deny",
-			phase: "proxy",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "proxy",
-			error
-		};
+		return thrownOutcome("proxy", error);
 	}
 }
 /**
@@ -1013,8 +1360,9 @@ async function runProxyPhase(config, getProxy, req, method, path, next) {
 * returns it as a 'response' outcome. Otherwise applies the request header
 * overlay and falls through to the render phase.
 */
-async function runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext) {
+async function runMiddlewarePhase(config, req, match, responseHeaders, renderContext) {
 	const detailed = config.serverTiming === "detailed";
+	const requestHeaderOverlay = new Headers();
 	const ctx = {
 		req,
 		requestHeaders: requestHeaderOverlay,
@@ -1050,23 +1398,9 @@ async function runMiddlewarePhase(config, req, match, responseHeaders, requestHe
 			response: middlewareResponse
 		};
 		applyRequestHeaderOverlay(requestHeaderOverlay);
-		return runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext);
+		return runRenderPhase(config, req, match, responseHeaders, renderContext);
 	} catch (error) {
-		if (isRedirectSignal(error)) return {
-			kind: "redirect",
-			phase: "middleware",
-			signal: error
-		};
-		if (isDenySignal(error)) return {
-			kind: "deny",
-			phase: "middleware",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "middleware",
-			error
-		};
+		return thrownOutcome("middleware", error);
 	}
 }
 /**
@@ -1084,32 +1418,18 @@ async function runMiddlewarePhase(config, req, match, responseHeaders, requestHe
 * while handler `Set-Cookie` values still come after them and take
 * precedence.
 */
-async function runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, { canonicalPathname, interception }) {
+async function runRenderPhase(config, req, match, responseHeaders, { canonicalPathname, interception }) {
 	const detailed = config.serverTiming === "detailed";
 	applyCookieJar(responseHeaders);
 	try {
-		const renderFn = () => config.render(req, match, responseHeaders, requestHeaderOverlay, interception);
+		const renderFn = () => config.render(req, match, responseHeaders, interception);
 		return {
 			kind: "response",
 			phase: "render",
 			response: await withSpan("timber.render", { "http.route": canonicalPathname }, () => detailed ? withTiming("render", "RSC + SSR render", renderFn) : renderFn())
 		};
 	} catch (error) {
-		if (isDenySignal(error)) return {
-			kind: "deny",
-			phase: "render",
-			signal: error
-		};
-		if (isRedirectSignal(error)) return {
-			kind: "redirect",
-			phase: "render",
-			signal: error
-		};
-		return {
-			kind: "error",
-			phase: "render",
-			error
-		};
+		return thrownOutcome("render", error);
 	}
 }
 /**
@@ -1175,6 +1495,7 @@ async function handleRequest(config, req, method, path, pathIsCanonical) {
 				path,
 				error
 			});
+			await fireOnRequestError(error, req, "route");
 			if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "metadata-route");
 			return new Response(null, { status: 500 });
 		}
@@ -1188,6 +1509,7 @@ async function handleRequest(config, req, method, path, pathIsCanonical) {
 			path,
 			error
 		});
+		await fireOnRequestError(error, req, "route");
 		if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "auto-sitemap");
 		return new Response(null, { status: 500 });
 	}
@@ -1202,72 +1524,66 @@ async function handleRequest(config, req, method, path, pathIsCanonical) {
 			});
 		}
 	}
-	let match = config.matchRoute(canonicalPathname);
+	const responseHeaders = dynamicResponseHeaders();
+	const renderNotFound = async (headers) => {
+		if (!config.renderNoMatch) return new Response(null, { status: 404 });
+		try {
+			return cloneWithMutableHeaders(await config.renderNoMatch(req, headers));
+		} catch (error) {
+			return outcomeToResponse(config, thrownOutcome("render", error), {
+				req,
+				method,
+				path,
+				responseHeaders: headers
+			});
+		}
+	};
+	let match = null;
 	let interception;
-	if (isRsc && config.interceptionRewrites?.length) {
-		const rawSourceUrl = req.headers.get("X-Timber-URL");
-		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
-		if (validatedSourceUrl) {
-			const resolveSourceScopes = () => {
-				const mounted = new Set(parseClientStateTree(req)?.treePaths ?? []);
-				const sourceRoute = config.matchRoute(validatedSourceUrl);
-				const scopes = [mounted, new Set(sourceRoute ? computeSegmentTreePaths(sourceRoute.segments) : [])].filter((scope) => scope.size > 0);
-				return scopes.length > 0 ? scopes : null;
+	try {
+		match = config.matchRoute(canonicalPathname);
+		({match, interception} = resolveInterceptedRoute(config, req, canonicalPathname, match));
+		if (!match) {
+			if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
+			return await renderNotFound(responseHeaders);
+		}
+		if (config.earlyHints && !isRsc && !isApiRouteChain(match.segments)) try {
+			await config.earlyHints(match, req, responseHeaders);
+		} catch (err) {
+			swallow(err, "early hints hook threw");
+		}
+		try {
+			match = {
+				...match,
+				segmentParams: await coerceSegmentParams(match)
 			};
-			const rewrite = findInterceptionMatch(canonicalPathname, resolveSourceScopes, config.interceptionRewrites);
-			if (rewrite?.mode === "children") {
-				const interceptedMatch = config.matchInterceptedRoute?.(canonicalPathname, rewrite.interceptingScope);
-				if (interceptedMatch) match = interceptedMatch;
-			} else if (rewrite) {
-				const sourceMatch = config.matchRoute(rewrite.interceptingPrefix);
-				if (sourceMatch !== null && computeSegmentTreePaths(sourceMatch.segments).includes(rewrite.interceptingScope)) {
-					match = sourceMatch;
-					interception = { targetPathname: canonicalPathname };
+		} catch (error) {
+			if (error instanceof ParamCoercionError) {
+				if (isDebug()) {
+					const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
+					console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a codec in app/schema.ts rejected the URL value.\n  Check the codec for the bracket key of the segment named above.`);
 				}
+				if (isApiRouteChain(match.segments)) return new Response(null, { status: 404 });
+				return await renderNotFound(responseHeaders);
 			}
+			throw error;
 		}
-	}
-	if (!match) {
-		if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
-		if (config.renderNoMatch) {
-			const responseHeaders = new Headers();
-			return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
-		}
-		return new Response(null, { status: 404 });
-	}
-	const responseHeaders = new Headers();
-	const requestHeaderOverlay = new Headers();
-	responseHeaders.set("Cache-Control", "private, no-cache, no-store, max-age=0, must-revalidate");
-	const leafSegment = match.segments[match.segments.length - 1];
-	const isApiRoute = leafSegment?.route && !leafSegment?.page;
-	if (config.earlyHints && !isRsc && !isApiRoute) try {
-		await config.earlyHints(match, req, responseHeaders);
-	} catch (err) {
-		swallow(err, "early hints hook threw");
-	}
-	match.rawSegmentParams = { ...match.segmentParams };
-	try {
-		await coerceSegmentParams(match);
+		setSegmentParams(match.segmentParams);
+		const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
+		setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
 	} catch (error) {
-		if (error instanceof ParamCoercionError) {
-			if (isDebug()) {
-				const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
-				console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a codec in app/schema.ts rejected the URL value.\n  Check the codec for the bracket key of the segment named above.`);
-			}
-			const leafSegment = match.segments[match.segments.length - 1];
-			if (leafSegment.route && !leafSegment.page) return new Response(null, { status: 404 });
-			if (config.renderNoMatch) return cloneWithMutableHeaders(await config.renderNoMatch(req, responseHeaders));
-			return new Response(null, { status: 404 });
-		}
-		throw error;
+		return outcomeToResponse(config, thrownOutcome("setup", error), {
+			req,
+			method,
+			path,
+			responseHeaders,
+			match: match ?? void 0
+		});
 	}
-	setSegmentParams(match.segmentParams);
-	const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
-	setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
-	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
+	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, {
 		canonicalPathname,
 		interception
-	}) : await runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, {
+	}) : await runRenderPhase(config, req, match, responseHeaders, {
 		canonicalPathname,
 		interception
 	}), {
@@ -1396,10 +1712,10 @@ async function enforceRscCacheKey(req, response) {
 *
 * The pipeline applies this at its single exit so every response shape is
 * covered — page render, API route, metadata route, deny page, error page,
-* proxy short-circuit. The two unit-level producers that are also reachable as
-* standalone functions (`handleRouteRequest`, `handleApiRoute`) call it too, so
-* each honours HEAD on its own; they share this implementation rather than
-* repeating it, and applying it twice is a no-op.
+* proxy short-circuit. The unit-level producer that is also reachable as a
+* standalone function (`handleRouteRequest`) calls it too, so it honours HEAD
+* on its own; it shares this implementation rather than repeating it, and
+* applying it twice is a no-op.
 */
 /**
 * Return a bodyless copy of `response` when `method` is HEAD.
@@ -1441,80 +1757,85 @@ function createPipeline(config) {
 	const slowRequestMs = config.slowRequestMs ?? 3e3;
 	const serverTiming = config.serverTiming ?? "total";
 	let activeRequests = 0;
-	const pipelineFn = async (req) => {
+	const pipelineFn = async (req, cookies) => {
 		const url = new URL(req.url);
 		const method = req.method;
 		const path = url.pathname;
 		const startTime = performance.now();
-		activeRequests++;
 		const traceIdValue = generateTraceId();
 		return runWithTraceId(traceIdValue, async () => {
-			return runWithRequestContext(req, async () => {
+			const inRequestContext = async () => {
 				const runRequest = async () => {
 					logRequestReceived({
 						method,
 						path
 					});
-					const response = await withSpan("http.server.request", {
-						"http.request.method": method,
-						"url.path": path
-					}, async () => {
-						const otelIds = await getOtelTraceId();
-						if (otelIds) replaceTraceId(otelIds.traceId, otelIds.spanId);
-						const stripTrailingSlash = config.stripTrailingSlash ?? true;
-						const canonResult = canonicalize(url.pathname, stripTrailingSlash);
-						if (!canonResult.ok) {
-							if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
-							return new Response(null, { status: canonResult.status });
-						}
-						const canonicalPath = canonResult.pathname;
-						let canonicalReq = req;
-						if (url.pathname !== canonicalPath) {
-							const canonicalUrl = new URL(req.url);
-							canonicalUrl.pathname = canonicalPath;
-							canonicalReq = new Request(canonicalUrl.toString(), req);
-						}
-						const innerHandler = async () => {
-							if (config.dispatchAction) {
-								const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
-								if (actionResult) return actionResult;
+					activeRequests++;
+					let concurrency = activeRequests;
+					let response;
+					try {
+						response = await withSpan("http.server.request", {
+							"http.request.method": method,
+							"url.path": path
+						}, async () => {
+							const otelTraceId = await getOtelTraceId();
+							if (otelTraceId) replaceTraceId(otelTraceId);
+							const stripTrailingSlash = config.stripTrailingSlash ?? true;
+							const canonResult = canonicalize(url.pathname, stripTrailingSlash);
+							if (!canonResult.ok) {
+								if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+								return new Response(null, { status: canonResult.status });
 							}
-							return handleRequest(config, canonicalReq, method, canonicalPath, true);
-						};
-						let result;
-						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
-							req: canonicalReq,
-							method,
-							path: canonicalPath
-						});
-						else result = await innerHandler();
-						await setSpanAttribute("http.response.status_code", result.status);
-						const varyTokens = [...RSC_KEY_HEADERS];
-						const existingVary = result.headers.get("Vary");
-						const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
-						const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
-						if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
-						await enforceRscCacheKey(canonicalReq, result);
-						hardenRscPayloadResponse(result);
-						result = stripHeadBody(result, method);
-						if (serverTiming === "detailed") {
-							const timingHeader = getServerTimingHeader();
-							if (timingHeader) result.headers.set("Server-Timing", timingHeader);
-						} else if (serverTiming === "total") {
-							const totalMs = Math.round(performance.now() - startTime);
-							result.headers.set("Server-Timing", `total;dur=${totalMs}`);
-						}
-						if (serverTiming === "detailed" && result.body) result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
-							status: result.status,
-							statusText: result.statusText,
-							headers: result.headers
+							const canonicalPath = canonResult.pathname;
+							let canonicalReq = req;
+							if (url.pathname !== canonicalPath) {
+								const canonicalUrl = new URL(req.url);
+								canonicalUrl.pathname = canonicalPath;
+								canonicalReq = new Request(canonicalUrl.toString(), req);
+							}
+							const innerHandler = async () => {
+								if (config.dispatchAction) {
+									const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
+									if (actionResult) return actionResult;
+								}
+								return handleRequest(config, canonicalReq, method, canonicalPath, true);
+							};
+							let result;
+							if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
+								req: canonicalReq,
+								method,
+								path: canonicalPath
+							});
+							else result = await innerHandler();
+							await setSpanAttribute("http.response.status_code", result.status);
+							const varyTokens = [...RSC_KEY_HEADERS];
+							const existingVary = result.headers.get("Vary");
+							const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
+							const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+							if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
+							await enforceRscCacheKey(canonicalReq, result);
+							hardenRscPayloadResponse(result);
+							result = stripHeadBody(result, method);
+							if (serverTiming === "detailed") {
+								const timingHeader = getServerTimingHeader();
+								if (timingHeader) result.headers.set("Server-Timing", timingHeader);
+							} else if (serverTiming === "total") {
+								const totalMs = Math.round(performance.now() - startTime);
+								result.headers.set("Server-Timing", `total;dur=${totalMs}`);
+							}
+							if (serverTiming === "detailed" && result.body) result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
+								status: result.status,
+								statusText: result.statusText,
+								headers: result.headers
+							});
+							return result;
 						});
-						return result;
-					});
+					} finally {
+						concurrency = activeRequests;
+						activeRequests--;
+					}
 					const durationMs = Math.round(performance.now() - startTime);
 					const status = response.status;
-					const concurrency = activeRequests;
-					activeRequests--;
 					logRequestCompleted({
 						method,
 						path,
@@ -1532,7 +1853,8 @@ function createPipeline(config) {
 					return response;
 				};
 				return serverTiming === "detailed" ? runWithTimingCollector(runRequest) : runRequest();
-			});
+			};
+			return runWithRequestContext(req, inRequestContext, { cookies });
 		});
 	};
 	return pipelineFn;
@@ -1691,7 +2013,7 @@ function sendEarlyHints103(links) {
 function ErrorReconstituter({ error: serialized, digest, reset, component, status, data }) {
 	const error = Object.assign(new Error(serialized.message), {
 		name: serialized.name,
-		...serialized.stack != null ? { stack: serialized.stack } : {}
+		stack: serialized.stack ?? `${serialized.name}: ${serialized.message}`
 	});
 	return createElement(component, {
 		error,
@@ -1865,11 +2187,17 @@ function renderDenyPage(entry, status, data, h) {
 * Otherwise it throws — annotated with `ownerKey` when an ancestor owns the
 * file, bare when nothing matched at all.
 *
-* `setDenyStatus` runs on the hoist path too, and must run *before* the
-* throw: on the document path the hoisted row fails the Fizz shell and the
-* re-render fallback serves the page, and the ALS status is what the
-* pipeline commits for it. The RSC payload path never reads it — a Flight
-* payload response is always 200 and the row itself carries the deny (TIM-1495).
+* `setDenyStatus` runs on the hoist path too, *before* the throw, for one
+* case. Normally Flight's `onError` captures the rethrown signal within the
+* renderer's promotion cap, and the pipeline renders the deny page with
+* `deny.status` — the recorded status goes unread. When the signal lands
+* after the cap but within the detection window that follows, the renderer
+* discards it (never promoted) and streams the document it already has;
+* `getDenyStatus()`, read once as the renderer returns, gives that document
+* the deny's 4xx instead of a 200. A deny later than that commits 200. Pinned by
+* `tests/late-hoisted-deny-status.test.ts`. The RSC payload path never
+* reads it — a Flight payload response is always 200 and the row itself
+* carries the deny (TIM-1495).
 *
 * Either branch leaves part of the matched chain unmounted — hoisting sends
 * the render to a boundary that discards everything below it, and a layout
@@ -1912,20 +2240,6 @@ function setFirstDeniedSegmentIndex(index) {
 //#endregion
 //#region src/server/access-gate.tsx
 /**
-* AccessGate and SlotAccessGate — framework-injected async server components.
-*
-* AccessGate wraps each segment's layout in the element tree. It calls the
-* segment's access.ts before the layout renders. If access.ts calls deny()
-* or redirect(), the signal propagates as a render-phase throw — caught by
-* the flush controller to produce the correct HTTP status code.
-*
-* SlotAccessGate wraps parallel slot content. On denial, it renders the
-* graceful degradation chain: denied.tsx → default.tsx → null. Slot denial
-* does not affect the HTTP status code.
-*
-* See design/04-authorization.md and design/02-rendering-pipeline.md §"AccessGate"
-*/
-/**
 * Framework-injected access gate for segments.
 *
 * Calls accessFn during render — inside `renderToReadableStream`, sharing
@@ -2170,87 +2484,6 @@ function resolveSlotDenied(slotNode) {
 	return null;
 }
 //#endregion
-//#region src/server/csrf.ts
-/** HTTP methods that are considered safe (no mutation). */
-var SAFE_METHODS = /* @__PURE__ */ new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]);
-/**
-* Derive the request's scheme from trusted sources.
-*
-* Priority:
-* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
-* 2. Request URL protocol
-*
-* Falls back to 'https' (fail closed) if neither is available.
-*/
-function deriveRequestScheme(req) {
-	const forwarded = req.headers.get("X-Forwarded-Proto");
-	if (forwarded) {
-		const proto = forwarded.split(",")[0].trim().toLowerCase();
-		if (proto === "http" || proto === "https") return proto;
-	}
-	try {
-		return new URL(req.url).protocol.replace(":", "");
-	} catch {
-		return "https";
-	}
-}
-/**
-* Validate the Origin header against the request's full origin
-* (scheme + host + port).
-*
-* For mutation methods (POST, PUT, PATCH, DELETE):
-* - If `csrf: false`, skip validation.
-* - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
-* - Otherwise, Origin must match the derived request origin.
-*
-* Safe methods (GET, HEAD, OPTIONS) always pass.
-*/
-function validateCsrf(req, config) {
-	if (SAFE_METHODS.has(req.method)) return { ok: true };
-	if (config.csrf === false) return { ok: true };
-	const origin = req.headers.get("Origin");
-	if (!origin) return {
-		ok: false,
-		status: 403
-	};
-	if (config.allowedOrigins) return config.allowedOrigins.includes(origin) ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
-	const host = req.headers.get("Host");
-	if (!host) return {
-		ok: false,
-		status: 403
-	};
-	let originOrigin;
-	try {
-		originOrigin = new URL(origin).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
-	}
-	const scheme = deriveRequestScheme(req);
-	let expectedOrigin;
-	try {
-		expectedOrigin = new URL(`${scheme}://${host}`).origin;
-	} catch {
-		return {
-			ok: false,
-			status: 403
-		};
-	}
-	return originOrigin === expectedOrigin ? { ok: true } : {
-		ok: false,
-		status: 403
-	};
-}
-//#endregion
 //#region src/server/body-limits.ts
 var KB = 1024;
 var MB = 1024 * KB;
@@ -3044,37 +3277,50 @@ async function handleRouteRequest(mod, ctx) {
 	const allowHeader = resolveAllowedMethods(mod).join(", ");
 	if (method === "OPTIONS") {
 		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
-		return new Response(null, {
+		return mergeResponseHeaders(new Response(null, {
 			status: 204,
 			headers: { Allow: allowHeader }
-		});
+		}), ctx.headers);
 	}
 	if (method === "HEAD") {
 		if (mod.HEAD) return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
 		if (mod.GET) return stripHeadBody(await runHandler(mod.GET, ctx), method);
 	}
 	const handler = mod[method];
-	if (!handler) return new Response(null, {
+	if (!handler) return mergeResponseHeaders(new Response(null, {
 		status: 405,
 		headers: { Allow: allowHeader }
-	});
+	}), ctx.headers);
 	return runHandler(handler, ctx);
 }
 /**
-* Run a handler, merge ctx.headers into the response, and catch errors.
+* Run a handler with cookie writes enabled and merge ctx.headers into its
+* response.
+*
+* Cookies (design/29-cookies.md §"Where Cookies Can Be Set"): the render
+* phase applied the jar to `ctx.headers` before the handler ran, so on the
+* way out only what the handler changed is synced onto that bag. It happens
+* whether the handler returns or throws, so a cookie set before `redirect()`
+* rides the redirect, and the pipeline's 500 for a throw carries the same
+* bag.
+*
+* Nothing is caught. A signal goes to the pipeline, whose deny fallback
+* answers a route.ts match in JSON and whose redirect outcome sends the 3xx
+* (TIM-1533). Any other error goes to the pipeline, which logs it,
+* reports it to `onRequestError` as phase `'route'`, and answers it in the
+* same format as every other route.ts error (TIM-1537).
 */
 async function runHandler(handler, ctx) {
+	const applied = getSetCookieHeaders();
+	setMutableCookieContext(true);
+	let res;
 	try {
-		return mergeResponseHeaders(await handler(ctx), ctx.headers);
-	} catch (error) {
-		if (isDenySignal(error) || isRedirectSignal(error)) throw error;
-		logRouteError({
-			method: ctx.req.method,
-			path: new URL(ctx.req.url).pathname,
-			error
-		});
-		return new Response(null, { status: 500 });
+		res = await handler(ctx);
+	} finally {
+		setMutableCookieContext(false);
+		syncCookieJar(ctx.headers, applied);
 	}
+	return mergeResponseHeaders(res, ctx.headers);
 }
 /**
 * Merge response headers from ctx.headers into the handler's response.
@@ -3104,32 +3350,6 @@ function mergeResponseHeaders(res, ctxHeaders) {
 	});
 }
 //#endregion
-//#region src/server/render-timeout.ts
-/**
-* Render timeout utilities for SSR streaming pipeline.
-*
-* Provides a RenderTimeoutError class and a helper to create
-* timeout-guarded AbortSignals. Used to defend against hung RSC
-* streams and infinite SSR renders.
-*
-* Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
-*/
-/**
-* Error thrown when an SSR render or RSC stream read exceeds the
-* configured timeout. Callers can check `instanceof RenderTimeoutError`
-* to distinguish timeout from other errors and return a 504 or close
-* the connection cleanly.
-*/
-var RenderTimeoutError = class extends Error {
-	timeoutMs;
-	constructor(timeoutMs, context) {
-		const message = context ? `Render timeout after ${timeoutMs}ms: ${context}` : `Render timeout after ${timeoutMs}ms`;
-		super(message);
-		this.name = "RenderTimeoutError";
-		this.timeoutMs = timeoutMs;
-	}
-};
-//#endregion
 //#region src/server/prebuilt/cache-key.ts
 /**
 * Component cache-key hashing for prebuilt (cache.component) entries.
@@ -3395,6 +3615,107 @@ function SlotsProvider({ values, children }) {
 	} : values;
 	return createElement(SlotContext.Provider, { value: merged }, children);
 }
+//#endregion
+//#region src/server/prebuilt/lifetime.ts
+/**
+* Lifetime declarations of a `cache.component` — `prerender`, `ttl`,
+* `tags` (design/45-cache-lifetimes.md) — and the nesting clamp between
+* two of them (§Nesting Semantics, TIM-1136).
+*
+* The clamp rule lives here once, for both places a capture can embed one
+* wrapped component in another: the post-build capture pass
+* (server/prebuilt-builder.ts) and request-time re-renders
+* (`captureComponentPayload()` in server/prebuilt-runtime.ts, TIM-1545).
+*/
+/** Whether the component has a runtime lifetime (ttl or tags). */
+function hasRuntimeLifetime(options) {
+	return options.ttl !== void 0 || options.tags != null;
+}
+/**
+* Resolve tags from options (may be static array or function of props).
+* Function-form tags receive DATA props only — slot props are excluded so
+* the tags fn never sees SlotOutlet placeholders (capture paths pass
+* placeholder-substituted props) and tags stay deterministic per key.
+*/
+function resolveTags(options, props) {
+	if (!options.tags) return [];
+	if (Array.isArray(options.tags)) return options.tags;
+	const slots = options.slots;
+	const fnProps = slots && slots.length > 0 ? splitSlotProps(props, slots)?.dataProps ?? props : props;
+	return options.tags(fnProps);
+}
+/**
+* Why an embedded copy of `inner` goes stale inside `outer`, or null when
+* the outer's refreshes cover every refresh channel the inner declares:
+*
+* - `shorterTtl`: the inner's ttl is shorter than the outer's effective
+*   lifetime (its ttl, or deploy-long without one).
+* - `missingTags`: tags the inner resolved to that the outer lacks —
+*   `revalidateTag` on them refreshes the inner's own entries, never the
+*   copy. `null` inner tags (a tags function threw) cannot be proven a
+*   subset, so they count as missing.
+*
+* Declaring the inner's tags on the outer is the documented fix, and it
+* silences the tag half by construction.
+*/
+function clampReasons(outer, inner) {
+	const outerTtl = outer.options.ttl ?? Infinity;
+	const shorterTtl = inner.options.ttl !== void 0 && inner.options.ttl < outerTtl;
+	const missingTags = inner.tags === null ? null : inner.tags.filter((t) => !outer.tags.includes(t));
+	if (!shorterTtl && missingTags !== null && missingTags.length === 0) return null;
+	return {
+		shorterTtl,
+		missingTags
+	};
+}
+/** Render a lifetime declaration for the clamp warning. */
+function describeLifetime(options, tags) {
+	const parts = [];
+	if (options.prerender) parts.push("prerender");
+	if (options.ttl !== void 0) parts.push(`ttl: ${options.ttl}`);
+	if (tags === null) parts.push("tags: fn");
+	else if (tags.length > 0) parts.push(`tags: ${JSON.stringify(tags)}`);
+	return parts.join(", ") || "no lifetime";
+}
+/** When the outer entry — and so every copy embedded in it — refreshes. */
+function describeRefresh(outer) {
+	const parts = [];
+	if (outer.options.ttl !== void 0) parts.push(`every ${outer.options.ttl}s`);
+	if (outer.tags.length > 0) parts.push(`on revalidateTag of its own tags`);
+	parts.push("on redeploy");
+	return parts.join(", or ");
+}
+/**
+* Warn for each wrapped component embedded in `outer`'s captured payload
+* whose refresh channels the outer cannot honor. Once per (outer, inner)
+* pair for the lifetime of `warnedPairs` — the builder passes one per
+* build, the runtime one per process, since re-renders repeat. The key is
+* the pair alone, not the reason: resolved tags vary with props, and a key
+* that included them would grow with the data. So the first clamp found
+* for a pair is the one reported. Returns the number of warnings emitted.
+*/
+function warnNestingClamps(outer, nested, warnedPairs, log) {
+	let count = 0;
+	for (const inner of nested) {
+		const reasons = clampReasons(outer, inner);
+		if (reasons === null) continue;
+		const pairKey = `${outer.id}\0${inner.innerId}`;
+		if (warnedPairs.has(pairKey)) continue;
+		warnedPairs.add(pairKey);
+		count++;
+		const outerLifetime = describeLifetime(outer.options, outer.tags);
+		const innerLifetime = describeLifetime(inner.options, inner.tags);
+		const consequences = [];
+		if (reasons.missingTags === null) consequences.push(`${inner.innerId}'s tags could not be resolved during the capture (its tags function threw or needed request context), so revalidating them may NOT update the embedded copy.`);
+		else if (reasons.missingTags.length > 0) {
+			const calls = reasons.missingTags.map((t) => `revalidateTag(${JSON.stringify(t)})`);
+			consequences.push(`${calls.join(", ")} will NOT update the embedded copy; tag ${outer.id} itself if you need that.`);
+		}
+		if (reasons.shorterTtl) consequences.push(`${inner.innerId}'s ttl: ${inner.options.ttl} does not apply to the embedded copy.`);
+		log(`[timber] ${inner.innerId} (${innerLifetime}) is embedded in ${outer.options.prerender ? "prerendered" : "cached"} ${outer.id} — the embedded copy refreshes only when ${outer.id} does (${describeRefresh(outer)}). ${consequences.join(" ")} Chain: ${outer.id} (${outerLifetime}) → ${inner.innerId} (${innerLifetime})`);
+	}
+	return count;
+}
 /**
 * Is this value the framework-injected layout children slot outlet
 * (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
@@ -3423,6 +3744,17 @@ function isChildrenSlotOutletElement(value) {
 	}
 }
 /**
+* `props` without the framework-injected children outlet — the key props
+* of a render. The outlet is the same client reference on every request,
+* so it never varies the cache key; user-provided children stay (and
+* leave the props unkeyable). See design/45 §Layout Propagation, TIM-1181.
+*/
+function withoutChildrenOutlet(props) {
+	if (!isChildrenSlotOutletElement(props.children)) return props;
+	const { children: _children, ...rest } = props;
+	return rest;
+}
+/**
 * Dense array of non-empty strings — no holes, no non-string entries.
 * Total: the reads run against a user-controlled value at module load,
 * and a throwing Proxy trap must classify as invalid, not crash startup.
@@ -3454,7 +3786,7 @@ function resolveSlotNames(id, options) {
 		return { kind: "disabled" };
 	}
 	if (slots.length === 0) return { kind: "none" };
-	if (!(options.ttl !== void 0 || options.tags != null)) {
+	if (!hasRuntimeLifetime(options)) {
 		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
 		return { kind: "disabled" };
 	}
@@ -3560,50 +3892,133 @@ function emitKeyDisciplineWarning(id, apis) {
 }
 //#endregion
 //#region src/server/prebuilt/capture-state.ts
-/** Thrown by the wrapper when a capture renders its own component. */
+/**
+* Capture state — the channel between a payload capture and the
+* `__prebuilt` wrappers that render inside it (server/prebuilt-runtime.ts).
+*
+* Two callers capture a wrapped component's flight payload:
+*
+* - **Build time**: the post-build capture pass (server/prebuilt-builder.ts)
+*   renders each registry entry in turn.
+* - **Request time**: `captureComponentPayload()` in prebuilt-runtime.ts
+*   renders a component in isolation for an inline re-render (full miss,
+*   stale entry, tombstone) or an SWR background re-render. These run
+*   concurrently with other requests' renders — and with each other.
+*
+* During a capture, the component's subtree may render OTHER wrapped
+* components. Those inner wrappers render live and their output is baked
+* flat into the outer entry — the nesting clamp of
+* design/45-cache-lifetimes.md §Nesting Semantics (TIM-1136). The wrapper
+* reports every render that happens inside a capture:
+*
+* - **Cycle**: the inner render IS the entry being captured — same
+*   component id AND same props key (TIM-1547). Left alone this recurses
+*   until the render times out; instead the wrapper throws
+*   `PrebuiltCaptureCycleError`, failing that entry with an error naming
+*   the cycle (build continues per doc 44 skip-and-report policy; at
+*   request time the re-render fails and is not cached, and the wrapper
+*   falls back as for any failed re-render). A component that renders
+*   itself with different props (a comment thread, a tree) is legitimate
+*   recursion with a base case and bakes flat like any other nesting.
+* - **Nesting**: any other wrapper render is recorded per inner component
+*   with the tags it resolved to. Both capture callers run the clamp rule
+*   over those records when the entry completes (prebuilt/lifetime.ts).
+*
+* Identity is the capture ROOT only. A wrapper cannot see the wrappers
+* between it and the root: Flight renders a component's children after
+* the wrapper has returned, in Flight's own async context, not in a frame
+* the wrapper could enter. So a same-key cycle that closes below the root
+* (`A(p1) → A(p2) → A(p2) → …`) is not detected here; it is also an
+* infinite recursion without caching, and the capture's render timeout
+* fails it.
+*
+* The props key is the props half of the cache key (data props only,
+* framework children outlet stripped — the same inputs the cache key
+* hashes). The params half is left out: every render inside one capture
+* reads the same segment params, so props decide identity. Unkeyable props
+* (live React elements, …) cannot be proven identical and are never a
+* cycle.
+*
+* Each capture's state lives in an AsyncLocalStorage store entered by
+* `CaptureScope.run()`, so it is visible only to renders started inside
+* that capture — including work Flight resumes after an await, which runs
+* in the context the awaited promise was created in. A concurrent request
+* rendering the same component is not a cycle, and a concurrent request
+* rendering a different cached component still revives it from cache
+* instead of baking it live (TIM-1536). Outside any capture
+* `noteWrapperRender` is a single store lookup.
+*/
+/** Thrown by the wrapper when a capture renders its own entry. */
 var PrebuiltCaptureCycleError = class extends Error {
 	constructor(componentId) {
-		super(`[timber] cache.component "${componentId}" renders itself (directly or through other components) — prerendering it would recurse forever. Remove the cycle or drop { prerender: true } on this component.`);
+		super(`[timber] cache.component "${componentId}" renders itself with the same props (directly or through other components) — capturing its payload would recurse forever. Remove the cycle or stop caching this component with cache.component.`);
 		this.name = "PrebuiltCaptureCycleError";
 	}
 };
-var active = null;
 /**
-* Mark a capture as active. The builder calls this immediately before
-* rendering an entry and MUST pair it with `endCapture()` in a finally.
+* The props half of a render's cache key, or null when unkeyable. Same
+* inputs `tryRevivePayload` hashes: data props only for slot components,
+* the framework-injected children outlet stripped.
 */
-function beginCapture(outerId) {
-	active = {
-		outerId,
-		nested: /* @__PURE__ */ new Map()
-	};
+function propsKey(options, props) {
+	let keyProps = props;
+	if (options.slots && options.slots.length > 0) {
+		const split = splitSlotProps(props, options.slots);
+		if (split === null) return null;
+		keyProps = split.dataProps;
+	}
+	return computeComponentCacheKey(withoutChildrenOutlet(keyProps), {});
 }
 /**
-* End the active capture and return the wrapped components that rendered
-* inside it (first options object wins per inner ID).
+* Open a capture of component `outerId` rendered with `props`. Its state
+* ends with the scope object.
 */
-function endCapture() {
-	const nested = active?.nested;
-	active = null;
-	if (!nested) return [];
-	return Array.from(nested, ([innerId, options]) => ({
-		innerId,
-		options
-	}));
+function createCaptureScope(outerId, options, props) {
+	const store = {
+		outerId,
+		outerPropsKey: propsKey(options, props),
+		nested: /* @__PURE__ */ new Map()
+	};
+	return {
+		run: (fn) => prebuiltCaptureAls.run(store, fn),
+		nestedRenders: () => Array.from(store.nested, ([innerId, record]) => ({
+			innerId,
+			options: record.options,
+			tags: record.tags && Array.from(record.tags)
+		}))
+	};
 }
-/** Whether a build-time capture is currently rendering. */
+/** Whether the current render is inside a capture. */
 function isCaptureActive() {
-	return active !== null;
+	return prebuiltCaptureAls.getStore() !== void 0;
 }
 /**
-* Called by the `__prebuilt` wrapper on every render. No-op unless a
-* capture is active. Throws `PrebuiltCaptureCycleError` when the wrapper
-* belongs to the component currently being captured.
+* Called by the `__prebuilt` wrapper on every render. No-op outside a
+* capture. Throws `PrebuiltCaptureCycleError` when the render is the
+* entry the enclosing capture is producing.
 */
-function noteWrapperRender(innerId, options) {
-	if (active === null) return;
-	if (innerId === active.outerId) throw new PrebuiltCaptureCycleError(innerId);
-	if (!active.nested.has(innerId)) active.nested.set(innerId, options);
+function noteWrapperRender(innerId, options, props) {
+	const capture = prebuiltCaptureAls.getStore();
+	if (capture === void 0) return;
+	if (innerId === capture.outerId && capture.outerPropsKey !== null) {
+		if (propsKey(options, props) === capture.outerPropsKey) throw new PrebuiltCaptureCycleError(innerId);
+	}
+	let record = capture.nested.get(innerId);
+	if (record === void 0) {
+		record = {
+			options,
+			tags: /* @__PURE__ */ new Set()
+		};
+		capture.nested.set(innerId, record);
+	}
+	if (record.tags !== null && options.tags) {
+		const tags = record.tags;
+		try {
+			for (const tag of requestContextAls.exit(() => resolveTags(options, props))) tags.add(tag);
+		} catch {
+			record.tags = null;
+		}
+	}
 }
 //#endregion
 //#region src/server/prebuilt-runtime.ts
@@ -3642,12 +4057,19 @@ function noteWrapperRender(innerId, options) {
 * component. `fallbackOnMissingSegmentParams: false` throws instead.
 */
 /** Default timeout for component re-renders (overridden by renderTimeoutMs). */
-var DEFAULT_COMPONENT_TIMEOUT_MS = 3e4;
+var DEFAULT_COMPONENT_TIMEOUT_MS = DEFAULT_RENDER_TIMEOUT_MS;
 /** Singleflight for component re-renders (inline and background). */
 var componentSingleflight = createSingleflight({ timeoutMs: DEFAULT_COMPONENT_TIMEOUT_MS });
 var componentTimeoutMs = DEFAULT_COMPONENT_TIMEOUT_MS;
 var warnedNoWaitUntil = false;
 /**
+* (outer, inner) pairs already warned about by request-time captures.
+* Process-wide: re-renders of a hot component repeat, and the warning is
+* about the code, not the request. Bounded by the number of wrapped
+* components in the app.
+*/
+var warnedNestingPairs = /* @__PURE__ */ new Set();
+/**
 * Server-side component registry, keyed by stable component ID. Populated at
 * module load time by `__prebuilt` calls; consumed by the post-build capture
 * pass (TIM-1119). Never serialized — component functions are not
@@ -3703,12 +4125,7 @@ function isSlotRenderKeyable(dataProps) {
 	if (!store) return false;
 	const keyParams = resolveKeyParams(store);
 	if (keyParams === null) return false;
-	let keyProps = dataProps;
-	if (isChildrenSlotOutletElement(keyProps.children)) {
-		const { children: _children, ...rest } = keyProps;
-		keyProps = rest;
-	}
-	return computeComponentCacheKey(keyProps, keyParams) !== null;
+	return computeComponentCacheKey(withoutChildrenOutlet(dataProps), keyParams) !== null;
 }
 /** Wrap payload bytes as a single-chunk ReadableStream for the decoder. */
 function bytesToStream(bytes) {
@@ -3717,23 +4134,6 @@ function bytesToStream(bytes) {
 		controller.close();
 	} });
 }
-/** Whether the component has a runtime lifetime (ttl or tags). */
-function hasRuntimeLifetime(options) {
-	return options.ttl !== void 0 || options.tags !== void 0 && options.tags !== null;
-}
-/**
-* Resolve tags from options (may be static array or function of props).
-* Function-form tags receive DATA props only — slot props are excluded so
-* the tags fn never sees SlotOutlet placeholders (capture paths pass
-* placeholder-substituted props) and tags stay deterministic per key.
-*/
-function resolveTags(options, props) {
-	if (!options.tags) return [];
-	if (Array.isArray(options.tags)) return options.tags;
-	const slots = options.slots;
-	const fnProps = slots && slots.length > 0 ? splitSlotProps(props, slots)?.dataProps ?? props : props;
-	return options.tags(fnProps);
-}
 /**
 * Serve a slot component from the cache: split live slot values out of the
 * props, look up / capture the shell (data props + a deterministic
@@ -3779,53 +4179,46 @@ function getCaptureTimeoutMs() {
 * The stream read is timeout-guarded and the reader is cancelled on
 * expiry (design/13 A2, A3).
 */
-async function captureComponentPayload(id, component, props) {
+async function captureComponentPayload(id, component, props, options) {
 	const { renderToReadableStream } = requireRscFunctions();
 	const element = createElement(component, props);
-	let renderErrored = false;
+	const capture = createCaptureScope(id, options, props);
+	let renderError;
 	const store = requestContextAls.getStore();
 	const discipline = store && shouldCheckKeyDiscipline(id) ? createKeyDisciplineProxy(store) : null;
-	const doCapture = async () => {
-		beginCapture(id);
-		try {
-			const reader = renderToReadableStream(element, { onError() {
-				renderErrored = true;
-				return "";
-			} }).getReader();
-			const chunks = [];
-			let totalLength = 0;
-			const deadline = Date.now() + getCaptureTimeoutMs();
-			try {
-				for (;;) {
-					const remaining = deadline - Date.now();
-					if (remaining <= 0) throw new Error(`[timber] component re-render capture exceeded ${getCaptureTimeoutMs()}ms`);
-					let timer;
-					const { done, value } = await Promise.race([reader.read(), new Promise((_, reject) => {
-						timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`[timber] component re-render stream read timed out`)), remaining);
-					})]);
-					clearTimeout(timer);
-					if (done) break;
-					chunks.push(value);
-					totalLength += value.byteLength;
-				}
-			} finally {
-				reader.cancel().catch(() => {});
-			}
-			if (renderErrored) throw new Error("[timber] component re-render produced error rows — not caching");
-			const result = new Uint8Array(totalLength);
-			let offset = 0;
-			for (const chunk of chunks) {
-				result.set(chunk, offset);
-				offset += chunk.byteLength;
-			}
-			return result;
-		} finally {
-			endCapture();
-		}
-	};
+	const doCapture = () => capture.run(async () => {
+		const bytes = await readAllBytesWithDeadline(runOutsideReactCacheScope(() => renderToReadableStream(element, { onError(error) {
+			renderError ??= { error };
+			return "";
+		} })), getCaptureTimeoutMs(), "[timber] component re-render capture");
+		if (renderError) throw renderError.error;
+		return bytes;
+	});
 	const bytes = discipline ? await requestContextAls.run(discipline.proxy, doCapture) : await doCapture();
 	if (discipline && discipline.accessedApis.size > 0) emitKeyDisciplineWarning(id, discipline.accessedApis);
-	return bytes;
+	return {
+		bytes,
+		nested: capture.nestedRenders()
+	};
+}
+/**
+* Store a captured entry in the overlay, then say which embedded
+* components it clamps (design/45 §Nesting Semantics, TIM-1545). The
+* warning follows the store: a capture that is discarded (aborted,
+* invalidated mid-render, failed store) holds no clamped copy, and must
+* not spend the pair's one warning.
+*/
+async function storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed) {
+	await storeOverlayEntry(id, cacheKey, captured.bytes, {
+		ttl: options.ttl,
+		tags,
+		hasSeed
+	});
+	warnNestingClamps({
+		id,
+		options,
+		tags
+	}, captured.nested, warnedNestingPairs, (m) => console.warn(m));
 }
 /**
 * Inline re-render: capture flight bytes, store in overlay, revive for
@@ -3838,13 +4231,9 @@ async function inlineRerender(id, component, props, cacheKey, options, hasSeed,
 	try {
 		return await revivePayload(id, await componentSingleflight.do(sfKey, async (signal) => {
 			const startEpoch = currentInvalidationEpoch();
-			const bytes = await captureComponentPayload(id, component, props);
-			if (!signal.aborted && hasRuntimeLifetime(options) && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeOverlayEntry(id, cacheKey, bytes, {
-				ttl: options.ttl,
-				tags,
-				hasSeed
-			});
-			return bytes;
+			const captured = await captureComponentPayload(id, component, props, options);
+			if (!signal.aborted && hasRuntimeLifetime(options) && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed);
+			return captured.bytes;
 		}), outcome);
 	} catch (error) {
 		console.error(`[timber] cache.component re-render failed for "${id}" — ${outcome}:`, error);
@@ -3854,10 +4243,12 @@ async function inlineRerender(id, component, props, cacheKey, options, hasSeed,
 /**
 * Snapshot the request context values needed for a background re-render.
 * Creates a FRESH store with copied values — the original ALS store is
-* not referenced after capture.
+* not referenced after capture. The `Request` itself is shared, not
+* copied: the re-render reports its failure against it.
 */
 function snapshotRequestContext(store) {
 	return {
+		request: store.request,
 		headers: new Headers(store.headers),
 		originalHeaders: new Headers(store.originalHeaders),
 		cookieHeader: store.cookieHeader,
@@ -3880,16 +4271,10 @@ function backgroundRerender(id, component, props, cacheKey, options, hasSeed, sn
 	const oKey = overlayKey(id, cacheKey);
 	const startEpoch = currentInvalidationEpoch();
 	const sfKey = `prebuilt-bg:${id}:${cacheKey}\0${lastInvalidationEpochFor(oKey, tags)}`;
-	const work = requestContextAls.run(snapshot, () => componentSingleflight.do(sfKey, async (signal) => {
-		const bytes = await captureComponentPayload(id, component, props);
-		if (!signal.aborted && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeOverlayEntry(id, cacheKey, bytes, {
-			ttl: options.ttl,
-			tags,
-			hasSeed
-		});
-	}).catch((error) => {
-		console.error(`[timber] cache.component background re-render failed for "${id}":`, error);
-	}));
+	const work = requestContextAls.run(snapshot, () => componentSingleflight.do(sfKey, (signal) => runBackgroundFlight(signal, async () => {
+		const captured = await captureComponentPayload(id, component, props, options);
+		if (!signal.aborted && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed);
+	}, (error) => console.error(`[timber] cache.component background re-render failed for "${id}":`, error))).catch(() => {}));
 	if (waitUntil) waitUntil(work);
 	else if (!warnedNoWaitUntil) {
 		warnedNoWaitUntil = true;
@@ -3910,12 +4295,7 @@ async function tryRevivePayload(id, options, props, keyPropsOverride) {
 	if (!store) return null;
 	const keyParams = (options.prerender ? await isParamIndependent(id) : false) ? {} : resolveKeyParams(store);
 	if (keyParams === null) return null;
-	let keyProps = keyPropsOverride ?? props ?? {};
-	if (isChildrenSlotOutletElement(keyProps.children)) {
-		const { children: _children, ...rest } = keyProps;
-		keyProps = rest;
-	}
-	const cacheKey = computeComponentCacheKey(keyProps, keyParams);
+	const cacheKey = computeComponentCacheKey(withoutChildrenOutlet(keyPropsOverride ?? props ?? {}), keyParams);
 	if (cacheKey === null) return null;
 	const outcome = options.fallbackOnMissingSegmentParams === false ? "failing the render (fallbackOnMissingSegmentParams: false)" : "rendering dynamically";
 	const component = registry.get(id)?.component;
@@ -3985,7 +4365,7 @@ function __prebuilt(id, component, options = {}) {
 		options
 	});
 	const wrapper = async (props) => {
-		noteWrapperRender(id, options);
+		noteWrapperRender(id, options, props);
 		if (isCaptureActive()) return createElement(component, props);
 		const revived = slots ? await tryReviveSlotShell(id, options, slots, props) : await tryRevivePayload(id, options, props);
 		if (revived !== null) return revived.element;
@@ -4027,6 +4407,6 @@ function __prebuiltDev(name, component, options = {}) {
 	return wrapper;
 }
 //#endregion
-export { AccessGate, DEFAULT_LIMITS, DenySignal, METADATA_ROUTE_CONVENTIONS, RedirectSignal, RenderError, RenderTimeoutError, SlotAccessGate, __prebuilt, __prebuiltDev, callOnRequestError, canonicalize, classifyMetadataRoute, coerce, collectEarlyHintHeaders, computeComponentCacheKey, createPipeline, enforceBodyLimits, executeAction, formatLinkHeader, generateTraceId, getCookie, getHeader, getLogger, getMetadataRouteAutoLink, getMetadataRouteServePath, getPrebuiltRegistration, getPrebuiltRegistry, getSearchParams, getSegmentParams, getSetCookieHeaders, handleRouteRequest, hasOnRequestError, hasPrebuiltPayloadSource, loadInstrumentation, logCacheMiss, logMiddlewareError, logMiddlewareShortCircuit, logProxyError, logRenderError, logRequestCompleted, logRequestReceived, logSlowRequest, logSwrRefetchFailed, logWaitUntilRejected, logWaitUntilUnsupported, markResponseFlushed, parseBodySize, renderMetadataToElements, replaceTraceId, resolveAllowedMethods, resolveMetadata, resolveMetadataUrls, resolveSlotDenied, resolveStatusFile, resolveTitle, runMiddleware, runProxy, runWithEarlyHintsSender, runWithRequestContext, runWithTraceId, sendEarlyHints103, setLogger, setMutableCookieContext, setPrebuiltPayloadSource, setSegmentParams, validateCsrf };
+export { AccessGate, DEFAULT_LIMITS, DenySignal, METADATA_ROUTE_CONVENTIONS, RedirectSignal, RenderTimeoutError, SlotAccessGate, __prebuilt, __prebuiltDev, callOnRequestError, canonicalize, classifyMetadataRoute, coerce, collectEarlyHintHeaders, computeComponentCacheKey, createPipeline, enforceBodyLimits, executeAction, formatLinkHeader, generateTraceId, getCookie, getHeader, getLogger, getMetadataRouteAutoLink, getMetadataRouteServePath, getPrebuiltRegistration, getPrebuiltRegistry, getSearchParams, getSegmentParams, getSetCookieHeaders, handleRouteRequest, hasOnRequestError, hasPrebuiltPayloadSource, loadInstrumentation, logCacheMiss, logMiddlewareError, logMiddlewareShortCircuit, logProxyError, logRenderError, logRequestCompleted, logRequestReceived, logSlowRequest, logSwrRefetchFailed, logWaitUntilRejected, logWaitUntilUnsupported, markResponseFlushed, parseBodySize, renderMetadataToElements, replaceTraceId, resolveAllowedMethods, resolveMetadata, resolveMetadataUrls, resolveSlotDenied, resolveStatusFile, resolveTitle, runMiddleware, runProxy, runWithEarlyHintsSender, runWithRequestContext, runWithTraceId, sendEarlyHints103, setLogger, setMutableCookieContext, setPrebuiltPayloadSource, setSegmentParams };
 
 //# sourceMappingURL=internal.js.map