@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/dist/_chunks/actions-Rjk4htmA.js

@@ -0,0 +1,1199 @@
+import { r as canonicalize } from "./canonicalize-CgHoscYO.js";
+import { a as requestContextAls, i as reactCacheScopeAls, o as revalidationAls } from "./als-registry-DaxkVjt5.js";
+import { C as isRedirectSignal, F as withSpan, S as isDenySignal, T as isDevMode, b as REDIRECT_BRAND, w as isDebug, y as DENY_BRAND } from "./logger-BP0LN6vP.js";
+import { n as _setGetSegmentParamsFn, t as _setGetSearchParamsFn } from "./als-slots-BEEIPKYm.js";
+import { r as appVisibleSearch } from "./rsc-cache-key-ClUiXQnK.js";
+import { a as mergePreservedSearchParams, o as resolveSegmentParams, r as validateExternalRedirectUrl, t as assertRelativeRedirectPath } from "./href-validation-BIrxavIy.js";
+import { a as assertValidCookieOptions, i as assertValidCookieName, n as parseSetCookie$1, o as assertValidCookieValue, r as stringifySetCookie, t as parseCookie } from "./dist-DtrJyBbw.js";
+import { t as cache, x as getWaitUntil } from "./cache-api-DGdYfNJn.js";
+//#region src/server/react-cache-scope.ts
+/**
+* React.cache scopes — opening, resuming, and leaving the per-request
+* `React.cache` scope that `react-cache-bridge.ts` makes Flight read.
+*
+* Kept apart from the bridge so request-context and cookie code can use
+* it without importing `react`. See design/spike-TIM-1529-react-cache-bridge.md.
+*/
+/** A new, empty `React.cache` scope. */
+function createReactCacheScope() {
+	return /* @__PURE__ */ new Map();
+}
+/**
+* Run `fn` in a `React.cache` scope — a fresh one unless `scope` is given.
+* Every `React.cache` call made from `fn` — synchronously, in its async
+* continuations, and in any Flight render it starts — shares one memo table.
+*
+* Opened by `runWithRequestContext`, so each request context gets its own
+* scope. Pass `scope` to resume one across two ALS runs: the post-action
+* revalidation opens a fresh scope for the target route's middleware and
+* renders the revalidated tree in that same scope later.
+*/
+function runWithReactCacheScope(fn, scope = createReactCacheScope()) {
+	return reactCacheScopeAls.run(scope, fn);
+}
+/**
+* Run `fn` with no timber scope, so `React.cache` behaves as stock React:
+* no dedupe outside a render, Flight's own per-render cache inside one.
+*
+* Used for server action bodies — an action reads, writes cookies, and
+* mutates, so memoized reads would go stale mid-action (the same choice
+* Next.js makes) — and for renders whose output outlives the request
+* (`cache.component` capture), which must not bake request-memoized values
+* into a cross-request cache entry.
+*/
+function runOutsideReactCacheScope(fn) {
+	return reactCacheScopeAls.exit(fn);
+}
+var cookieReads = /* @__PURE__ */ new WeakMap();
+var warnedScopes = /* @__PURE__ */ new WeakSet();
+/**
+* Dev-only: record that cookie `name` (or {@link ANY_COOKIE}) was read
+* while `React.cache` held values in this request — the read may have
+* happened inside a cached function.
+*/
+function noteCookieReadForReactCache(name) {
+	if (!isDevMode()) return;
+	const scope = reactCacheScopeAls.getStore();
+	if (!scope || scope.size === 0) return;
+	let reads = cookieReads.get(scope);
+	if (!reads) {
+		reads = /* @__PURE__ */ new Set();
+		cookieReads.set(scope, reads);
+	}
+	reads.add(name);
+}
+/**
+* Dev-only: warn (once per request) when a cookie recorded by
+* {@link noteCookieReadForReactCache} is written. `name` is the written
+* cookie, or {@link ANY_COOKIE} for `clear()`. Dev-only because reads are
+* only recorded in dev.
+*/
+function warnIfCachedCookieIsWritten(name) {
+	const scope = reactCacheScopeAls.getStore();
+	if (!scope || warnedScopes.has(scope)) return;
+	const reads = cookieReads.get(scope);
+	if (!reads) return;
+	if (!(name === "*" ? reads.size > 0 : reads.has(name) || reads.has("*"))) return;
+	warnedScopes.add(scope);
+	const which = name === "*" ? "Cookies were cleared" : `Cookie "${name}" was written`;
+	console.warn(`[timber] ${which} after being read while React.cache held values for this request. A cached function that read it keeps returning the old result — pass the cookie value in as an argument (e.g. getUser(sessionToken)) so a change is a new cache key.`);
+}
+//#endregion
+//#region src/server/request-context.ts
+/**
+* Returns a read-only view of the current request's headers.
+*
+* Available in middleware, access checks, server components, and server actions.
+* Throws if called outside a request context (security principle #2: no global fallback).
+*/
+function getHeaders() {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getHeaders() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	return store.headers;
+}
+/**
+* Returns the value of a single request header, or undefined if absent.
+*
+* Thin wrapper over `getHeaders().get(name)` for the common case where
+* you need exactly one header.
+*
+* @internal — not part of the public API. Use `getHeaders().get(name)` instead.
+*/
+function getHeader(name) {
+	return getHeaders().get(name) ?? void 0;
+}
+/**
+* Returns the current request's raw URLSearchParams.
+*
+* @internal — not part of the public API. Use `defineSearchParams().get()` instead.
+*/
+function getSearchParams() {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getSearchParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	return store.searchParams;
+}
+_setGetSearchParamsFn(getSearchParams);
+_setGetSegmentParamsFn(getSegmentParams);
+/**
+* Returns the current request's coerced segment params.
+*
+* The optional `segmentPath` argument exists only for TypeScript narrowing —
+* it does not affect the runtime return value. Pass a segment path
+* (e.g. `'/(browse)/[artistSlug]/[year]'`) to narrow the return type to the
+* exact params shape for that segment.
+*
+* Without an argument, returns all coerced params with optional types.
+*
+* See design/41-global-params.md §Function Signatures
+*/
+function getSegmentParams(segmentPath) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getSegmentParams() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	if (!store.segmentParams) throw new Error("[timber] getSegmentParams() called before route matching completed. Segment params are not available until after the route is matched.");
+	const slotResolved = resolveSegmentParams(store.segmentParams, store.slotParams, segmentPath);
+	if (slotResolved !== store.segmentParams) return slotResolved;
+	if (segmentPath && isDebug() && store.matchedSegmentPath) {
+		const expected = extractDynamicSegments(segmentPath);
+		const actual = extractDynamicSegments(store.matchedSegmentPath);
+		const missing = expected.filter((s) => !actual.includes(s));
+		if (missing.length > 0) console.warn(`[timber] getSegmentParams('${segmentPath}') called but current segment is '${store.matchedSegmentPath}'\n  Missing params: ${missing.join(", ")}\n  These will be undefined at runtime despite the type annotation.`);
+	}
+	return store.segmentParams;
+}
+/**
+* Set the segment params on the current request context.
+* Called by the pipeline after route matching and param coercion.
+*
+* @internal — framework use only
+*/
+function setSegmentParams(params) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] setSegmentParams() called outside of a request context.");
+	store.segmentParams = params;
+}
+/**
+* Store the matched segment path (e.g. '/(browse)/[artistSlug]/[year]') for
+* dev-mode validation in getSegmentParams().
+*
+* @internal — framework use only
+*/
+function setMatchedSegmentPath(segmentPath) {
+	const store = requestContextAls.getStore();
+	if (!store) return;
+	store.matchedSegmentPath = segmentPath;
+}
+/**
+* Extract dynamic segment names from a route pattern.
+* '/[artistSlug]/[year]' → ['artistSlug', 'year']
+* '/docs/[...slug]'      → ['slug']
+*/
+function extractDynamicSegments(route) {
+	const segments = [];
+	const re = /\[{1,2}\.{0,3}(\w+)\]{1,2}/g;
+	let m;
+	while ((m = re.exec(route)) !== null) segments.push(m[1]);
+	return segments;
+}
+/**
+* Returns the raw search string from the current request URL (e.g. "?foo=bar").
+* Synchronous — safe for use in `redirect()` which throws synchronously.
+*
+* Returns empty string if called outside a request context (non-throwing for
+* use in redirect's optional preserveSearchParams path).
+*
+* @internal — used by redirect() for preserveSearchParams support.
+*/
+function getRequestSearchString() {
+	return requestContextAls.getStore()?.searchString ?? "";
+}
+/**
+* Run a callback within a request context. Used by the pipeline to establish
+* per-request ALS scope so that `getHeaders()` and `getCookies()` work.
+*
+* When `options.cookies` is given, the context's `parsedCookies` map is a
+* copy of it and the raw `cookieHeader` is left empty, so
+* `parseCookieHeader` never runs for that request. Re-entry callers pass the
+* action's post-mutation cookie state this way (TIM-868).
+*
+* Each request context also opens its own `React.cache` scope, shared by
+* everything that runs inside it — proxy.ts, middleware.ts, route handlers,
+* and the render (design/02-rendering-pipeline.md §"Cache Scoping Model").
+*
+* @param req - The incoming Request object.
+* @param fn - The function to run within the request context.
+*/
+function runWithRequestContext(req, fn, { reactCacheScope, cookies } = {}) {
+	const originalCopy = new Headers(req.headers);
+	const appVisible = appVisibleSearch(new URL(req.url));
+	const seed = cookies ? new Map(cookies) : void 0;
+	const store = {
+		request: req,
+		headers: freezeHeaders(req.headers),
+		originalHeaders: originalCopy,
+		cookieHeader: seed ? "" : req.headers.get("cookie") ?? "",
+		parsedCookies: seed,
+		searchParams: appVisible.params,
+		searchString: appVisible.search,
+		cookieJar: /* @__PURE__ */ new Map(),
+		flushed: false,
+		mutableContext: false
+	};
+	return requestContextAls.run(store, () => runWithReactCacheScope(fn, reactCacheScope));
+}
+/**
+* Enable cookie mutation for the current context. Called by the framework
+* when entering middleware.ts, server actions, or route.ts handlers.
+*
+* See design/29-cookies.md §"Context Tracking"
+*/
+function setMutableCookieContext(mutable) {
+	const store = requestContextAls.getStore();
+	if (store) store.mutableContext = mutable;
+}
+/**
+* Mark the response as flushed (headers committed). After this point,
+* cookie mutations log a warning instead of throwing.
+*
+* See design/29-cookies.md §"Streaming Constraint: Post-Flush Cookie Warning"
+*/
+function markResponseFlushed() {
+	const store = requestContextAls.getStore();
+	if (store) store.flushed = true;
+}
+/**
+* Apply middleware-injected request headers to the current request context.
+*
+* Called by the pipeline after middleware.ts runs. Merges overlay headers
+* on top of the original request headers so downstream code (access.ts,
+* server components, server actions) sees them via `getHeaders()`.
+*
+* The original request headers are never mutated — a new frozen Headers
+* object is created with the overlay applied on top.
+*
+* See design/07-routing.md §"Request Header Injection"
+*/
+function applyRequestHeaderOverlay(overlay) {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] applyRequestHeaderOverlay() called outside of a request context.");
+	let hasOverlay = false;
+	overlay.forEach(() => {
+		hasOverlay = true;
+	});
+	if (!hasOverlay) return;
+	const merged = new Headers(store.originalHeaders);
+	overlay.forEach((value, key) => {
+		merged.set(key, value);
+	});
+	store.headers = freezeHeaders(merged);
+}
+var MUTATING_METHODS = /* @__PURE__ */ new Set([
+	"set",
+	"append",
+	"delete"
+]);
+/**
+* Wrap a Headers object in a Proxy that throws on mutating methods.
+* Object.freeze doesn't work on Headers (native internal slots), so we
+* intercept property access and reject set/append/delete at runtime.
+*
+* Read methods (get, has, entries, etc.) must be bound to the underlying
+* Headers instance because they access private #headersList slots.
+*/
+function freezeHeaders(source) {
+	const copy = new Headers(source);
+	return new Proxy(copy, { get(target, prop) {
+		if (typeof prop === "string" && MUTATING_METHODS.has(prop)) return () => {
+			throw new Error(`[timber] getHeaders() returns a read-only Headers object. Calling .${prop}() is not allowed. Use ctx.requestHeaders in middleware to inject headers for downstream components.`);
+		};
+		const value = Reflect.get(target, prop);
+		if (typeof value === "function") return value.bind(target);
+		return value;
+	} });
+}
+//#endregion
+//#region src/server/cookie-parsing.ts
+/**
+* Cookie parsing and serialization helpers — pure string ↔ structure
+* functions with no ALS dependency. Split out of `cookie-context.ts`
+* (TIM-853) so the API surface and the wire-format codecs can each be
+* read on their own.
+*
+* The functions in this module are total over arbitrary input. They
+* never throw and never call `assertValid*` (the security validators
+* live in the API surface — `cookie-context.ts` invokes them at every
+* jar entry point so the smuggling-primitive invariant from TIM-868
+* is enforced regardless of which path produced the bytes).
+*
+* Delegates to the `cookie` package (RFC 6265, dependency-free,
+* browser-safe) for wire codecs. Adapts at the boundary to preserve
+* timber's Map-based API and never-throw contract.
+*/
+/**
+* Parse a Cookie header string into a Map of name → value pairs.
+* Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
+*
+* Values are auto-decoded with `decodeURIComponent` so they round-trip
+* losslessly with `getCookies().set()` (which auto-encodes). Malformed
+* `%`-escapes from third-party cookies fall back to the raw byte sequence
+* — the parser must be total over arbitrary inbound headers, including
+* non-conforming values from other servers, browser extensions, etc.
+*/
+function parseCookieHeader(header) {
+	const map = /* @__PURE__ */ new Map();
+	if (!header) return map;
+	const parsed = parseCookie(header);
+	for (const name in parsed) {
+		const value = parsed[name];
+		if (value !== void 0) map.set(name, value);
+	}
+	return map;
+}
+/**
+* Decode a single cookie value with `decodeURIComponent`, falling back to
+* the raw byte sequence if the input contains a malformed `%`-escape.
+*
+* Used by both `parseCookieHeader` (incoming Cookie: header) and the
+* `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
+* Total — never throws.
+*
+* cookie's internal decode has identical semantics but is not exported,
+* so we keep this standalone helper.
+*/
+function safeDecodeCookieValue(raw) {
+	try {
+		return decodeURIComponent(raw);
+	} catch {
+		return raw;
+	}
+}
+/**
+* Serialize a CookieEntry into a Set-Cookie header value.
+*
+* Total — never throws. If the cookie package's serializer rejects
+* the input (e.g. non-integer maxAge, forbidden chars in name/value),
+* falls back to a minimal hand-rolled serialization so the response
+* path is never interrupted by a codec error.
+*/
+function serializeCookieEntry(entry) {
+	try {
+		return stringifySetCookie({
+			name: entry.name,
+			value: entry.value,
+			domain: entry.options.domain,
+			path: entry.options.path,
+			expires: entry.options.expires,
+			maxAge: entry.options.maxAge,
+			httpOnly: entry.options.httpOnly,
+			secure: entry.options.secure,
+			sameSite: entry.options.sameSite,
+			partitioned: entry.options.partitioned
+		}, { encode: (v) => v });
+	} catch {
+		return serializeCookieEntryFallback(entry);
+	}
+}
+function serializeCookieEntryFallback(entry) {
+	const parts = [`${entry.name}=${entry.value}`];
+	const opts = entry.options;
+	if (opts.domain) parts.push(`Domain=${opts.domain}`);
+	if (opts.path) parts.push(`Path=${opts.path}`);
+	if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
+	if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
+	if (opts.httpOnly) parts.push("HttpOnly");
+	if (opts.secure) parts.push("Secure");
+	if (opts.sameSite) parts.push(`SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`);
+	if (opts.partitioned) parts.push("Partitioned");
+	return parts.join("; ");
+}
+/**
+* Parse a raw `Set-Cookie` header string into name, value, and options.
+* Handles all standard attributes: Path, Domain, Max-Age, Expires,
+* SameSite, Secure, HttpOnly, Partitioned.
+*
+* Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether
+* to merge defaults (e.g. `set()` does, but `setRaw()` should preserve
+* the original header's intent).
+*/
+function parseSetCookie(header) {
+	const parsed = parseSetCookie$1(header, { decode: (v) => v });
+	if (!parsed.name) return null;
+	const options = {};
+	if (parsed.path !== void 0) options.path = parsed.path || "/";
+	if (parsed.domain !== void 0) options.domain = parsed.domain;
+	if (parsed.maxAge !== void 0 && Number.isFinite(parsed.maxAge)) options.maxAge = parsed.maxAge;
+	if (parsed.expires !== void 0) options.expires = parsed.expires;
+	if (parsed.sameSite !== void 0 && parsed.sameSite !== true) {
+		const sameSite = parsed.sameSite.toLowerCase();
+		if (sameSite === "strict" || sameSite === "lax" || sameSite === "none") options.sameSite = sameSite;
+	}
+	if (parsed.secure) options.secure = true;
+	if (parsed.httpOnly) options.httpOnly = true;
+	if (parsed.partitioned) options.partitioned = true;
+	return {
+		name: parsed.name,
+		value: parsed.value ?? "",
+		options
+	};
+}
+//#endregion
+//#region src/server/cookie-context.ts
+/**
+* Cookie Context — per-request cookie API and on-the-wire helpers.
+*
+* Split out of `request-context.ts` (TIM-853) so the cookie subsystem
+* — encoding contract, options grammar, parser, serializer, and RYW map
+* — lives in one file. The headers/scope/params APIs
+* stay in `request-context.ts` and call into this module via the
+* exported helpers.
+*
+* See design/29-cookies.md for the encoding contract and read-your-own-
+* writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the
+* smuggling primitive that the encoding contract closes.
+*/
+/**
+* Returns a cookie accessor for the current request.
+*
+* Available in middleware, access checks, server components, and server actions.
+* Throws if called outside a request context (security principle #2: no global fallback).
+*
+* Read methods (.get, .has, .getAll) are always available and reflect
+* read-your-own-writes from .set() calls in the same request.
+*
+* Mutation methods (.set, .delete, .clear) are only available in mutable
+* contexts (middleware.ts, server actions, route.ts handlers). Calling them
+* in read-only contexts (access.ts, server components) throws.
+*
+* This is the escape hatch for direct cookie jar operations. For typed
+* cookie access, use `defineCookie()` instead.
+*
+* See design/29-cookies.md
+*/
+function getCookieJar() {
+	const store = requestContextAls.getStore();
+	if (!store) throw new Error("[timber] getCookieJar() called outside of a request context. It can only be used in middleware, access checks, server components, and server actions.");
+	if (!store.parsedCookies) store.parsedCookies = parseCookieHeader(store.cookieHeader);
+	const map = store.parsedCookies;
+	return {
+		get(name) {
+			noteCookieReadForReactCache(name);
+			return map.get(name);
+		},
+		has(name) {
+			noteCookieReadForReactCache(name);
+			return map.has(name);
+		},
+		getAll() {
+			noteCookieReadForReactCache("*");
+			return Array.from(map.entries()).map(([name, value]) => ({
+				name,
+				value
+			}));
+		},
+		get size() {
+			noteCookieReadForReactCache("*");
+			return map.size;
+		},
+		set(name, value, options) {
+			assertMutable(store, "set");
+			assertValidCookieName(name);
+			if (typeof value !== "string") throw new Error(`[timber] getCookieJar().set(${JSON.stringify(name)}, …): value must be a string, got ${typeof value}.\n  To store a JSON-serializable value, use defineCookie + jsonCookieCodec:\n\n    import { defineCookie, jsonCookieCodec } from '@timber-js/app/cookies';\n\n    export const ${name}Cookie = defineCookie(${JSON.stringify(name)}, {\n      codec: jsonCookieCodec(),\n    });\n\n    ${name}Cookie.set(value);\n\n  See design/29-cookies.md §"Typed Cookies with Schema Validation".`);
+			const raw = options?.raw === true;
+			const wireValue = raw ? value : encodeURIComponent(value);
+			if (raw) assertValidCookieValue(name, wireValue);
+			if (store.flushed) {
+				if (isDebug()) console.warn(`[timber] warn: getCookieJar().set('${name}') called after response headers were committed.\n  The cookie will NOT be sent. Move cookie mutations to middleware.ts, a server action,\n  or a route.ts handler.`);
+				return;
+			}
+			const { raw: _raw, ...attributeOptions } = options ?? {};
+			const opts = {
+				...DEFAULT_COOKIE_OPTIONS,
+				...attributeOptions
+			};
+			assertValidCookieOptions(opts);
+			store.cookieJar.set(name, {
+				name,
+				value: wireValue,
+				options: opts
+			});
+			map.set(name, raw ? wireValue : value);
+			warnIfCachedCookieIsWritten(name);
+		},
+		setFromHeaders(headers) {
+			assertMutable(store, "setFromHeaders");
+			if (store.flushed) {
+				console.warn("[timber] warn: getCookieJar().setFromHeaders() called after response headers were committed.\n  The cookies will NOT be sent. Move cookie mutations to middleware.ts, a server action,\n  or a route.ts handler.");
+				return;
+			}
+			for (const raw of headers.getSetCookie()) {
+				const parsed = parseSetCookie(raw);
+				if (parsed) setRaw(store, map, parsed.name, parsed.value, parsed.options);
+			}
+		},
+		delete(name, options) {
+			assertMutable(store, "delete");
+			assertValidCookieName(name);
+			if (store.flushed) {
+				if (isDebug()) console.warn(`[timber] warn: getCookieJar().delete('${name}') called after response headers were committed.\n  The cookie will NOT be deleted. Move cookie mutations to middleware.ts, a server action,\n  or a route.ts handler.`);
+				return;
+			}
+			const opts = {
+				...DEFAULT_COOKIE_OPTIONS,
+				...options,
+				maxAge: 0,
+				expires: /* @__PURE__ */ new Date(0)
+			};
+			assertValidCookieOptions(opts);
+			store.cookieJar.set(name, {
+				name,
+				value: "",
+				options: opts
+			});
+			map.delete(name);
+			warnIfCachedCookieIsWritten(name);
+		},
+		clear() {
+			assertMutable(store, "clear");
+			if (store.flushed) return;
+			for (const name of Array.from(map.keys())) store.cookieJar.set(name, {
+				name,
+				value: "",
+				options: {
+					...DEFAULT_COOKIE_OPTIONS,
+					maxAge: 0,
+					expires: /* @__PURE__ */ new Date(0)
+				}
+			});
+			map.clear();
+			warnIfCachedCookieIsWritten("*");
+		},
+		toString() {
+			noteCookieReadForReactCache("*");
+			return Array.from(map.entries()).map(([name, value]) => `${name}=${encodeURIComponent(value)}`).join("; ");
+		}
+	};
+}
+/**
+* Returns the value of a single cookie, or undefined if absent.
+*
+* @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.
+*/
+function getCookie(name) {
+	return getCookieJar().get(name);
+}
+var DEFAULT_COOKIE_OPTIONS = {
+	path: "/",
+	httpOnly: true,
+	secure: true,
+	sameSite: "lax"
+};
+/**
+* Collect all Set-Cookie headers from the cookie jar.
+* Called by the framework at flush time to apply cookies to the response.
+*
+* Returns an array of serialized Set-Cookie header values.
+*/
+function getSetCookieHeaders() {
+	const store = requestContextAls.getStore();
+	if (!store) return [];
+	return Array.from(store.cookieJar.values()).map(serializeCookieEntry);
+}
+/** Throw if cookie mutation is attempted in a read-only context. */
+function assertMutable(store, method) {
+	if (!store.mutableContext) throw new Error(`[timber] getCookieJar().${method}() cannot be called in this context.\n  Set cookies in middleware.ts, server actions, or route.ts handlers.`);
+}
+/**
+* Write a cookie to the jar WITHOUT merging DEFAULT_COOKIE_OPTIONS.
+* Used by setFromHeaders to preserve the original header's attributes exactly.
+*
+* For deletion cookies (maxAge=0), the jar entry is still created so the
+* Set-Cookie header is emitted, but the cookie is NOT added to the read map
+* (it would be misleading — the cookie is being deleted).
+*/
+function setRaw(store, readMap, name, value, options) {
+	assertValidCookieName(name);
+	assertValidCookieValue(name, value);
+	assertValidCookieOptions(options);
+	store.cookieJar.set(name, {
+		name,
+		value,
+		options
+	});
+	warnIfCachedCookieIsWritten(name);
+	if (options.maxAge === 0) readMap.delete(name);
+	else readMap.set(name, safeDecodeCookieValue(value));
+}
+//#endregion
+//#region src/server/primitives.ts
+/**
+* Check if a value is JSON-serializable without data loss.
+* Returns a description of the first non-serializable value found, or null if OK.
+*
+* @internal Exported for testing only.
+*/
+function findNonSerializable(value, path = "data") {
+	if (value === null || value === void 0) return null;
+	switch (typeof value) {
+		case "string":
+		case "number":
+		case "boolean": return null;
+		case "bigint": return `${path} contains a BigInt — BigInt throws in JSON.stringify`;
+		case "function": return `${path} is a function — functions are not JSON-serializable`;
+		case "symbol": return `${path} is a symbol — symbols are not JSON-serializable`;
+		case "object": break;
+		default: return `${path} has unsupported type "${typeof value}"`;
+	}
+	if (value instanceof Date) return `${path} is a Date — Dates silently coerce to strings in JSON.stringify`;
+	if (value instanceof Map) return `${path} is a Map — Maps serialize as {} in JSON.stringify (data loss)`;
+	if (value instanceof Set) return `${path} is a Set — Sets serialize as {} in JSON.stringify (data loss)`;
+	if (value instanceof RegExp) return `${path} is a RegExp — RegExps serialize as {} in JSON.stringify`;
+	if (value instanceof Error) return `${path} is an Error — Errors serialize as {} in JSON.stringify`;
+	if (Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) {
+			const result = findNonSerializable(value[i], `${path}[${i}]`);
+			if (result) return result;
+		}
+		return null;
+	}
+	const proto = Object.getPrototypeOf(value);
+	if (proto === null) return `${path} is a null-prototype object — React Flight rejects null prototypes`;
+	if (proto !== Object.prototype) return `${path} is a ${value.constructor?.name ?? "unknown"} instance — class instances may lose data in JSON.stringify`;
+	for (const key of Object.keys(value)) {
+		const result = findNonSerializable(value[key], `${path}.${key}`);
+		if (result) return result;
+	}
+	return null;
+}
+/**
+* Emit a dev-mode warning if data is not JSON-serializable.
+* No-op in production.
+*/
+function warnIfNotSerializable(data, callerName) {
+	if (!isDebug()) return;
+	if (data === void 0) return;
+	const issue = findNonSerializable(data);
+	if (issue) console.warn(`[timber] ${callerName}: ${issue}. Data passed to deny() must be JSON-serializable because the post-flush path uses JSON.stringify, not React Flight.`);
+}
+/**
+* Render-phase signal thrown by `deny()`. Caught by the framework to produce
+* the correct HTTP status code (segment context) or graceful degradation (slot context).
+*
+* Detect with `isDenySignal()`, never `instanceof` — see "Signal branding" in signal-identity.ts.
+*/
+var DenySignal = class extends Error {
+	[DENY_BRAND] = true;
+	status;
+	data;
+	/**
+	* Ordered list of segment keys that own matching deny pages for this
+	* signal, best match first. Present = addressed (a boundary should
+	* render it); absent = unplaced (the re-render fallback serves it).
+	*
+	* In-tree hoists stamp a single-element list (`[entry.ownerKey]`) —
+	* identical to the pre-TIM-1450 `ownerKey`. Late addressing (TIM-1450)
+	* stamps the full candidate list so the client can find the first
+	* *reachable* owner via its ancestry context, eliminating the
+	* owner-below-throw-site escape.
+	*
+	* See design/04-authorization.md §"Where a Deny Page Renders", TIM-1356.
+	*/
+	owners;
+	/**
+	* When true, the pipeline must respond with `rscErrorEnvelope` so the
+	* client hard-navigates instead of attempting to render a deny page
+	* from the RSC payload. Set by AccessGate when a skipped segment
+	* denies — rendering the deny page in-tree would appear inside the
+	* client's cached layout chrome (TIM-1074). See TIM-1363.
+	*/
+	_hardNavigate;
+	constructor(status, data) {
+		super(`Access denied with status ${status}`);
+		this.name = "DenySignal";
+		this.status = status;
+		this.data = data;
+	}
+	/**
+	* Extract the file that called deny() from the stack trace.
+	* Returns a short path (e.g. "app/auth/access.ts") or undefined if
+	* the stack can't be parsed. Dev-only — used for dev log output.
+	*/
+	get sourceFile() {
+		if (!this.stack) return void 0;
+		const frames = this.stack.split("\n");
+		for (let i = 2; i < frames.length; i++) {
+			const frame = frames[i];
+			if (!frame) continue;
+			if (frame.includes("primitives.ts") || frame.includes("node_modules")) continue;
+			const match = frame.match(/\(([^)]+?)(?::\d+:\d+)\)/) ?? frame.match(/at\s+([^\s]+?)(?::\d+:\d+)/);
+			if (match?.[1]) {
+				const full = match[1];
+				const appIdx = full.indexOf("/app/");
+				return appIdx >= 0 ? full.slice(appIdx + 1) : full;
+			}
+		}
+	}
+};
+/**
+* Universal denial/error primitive. Throws a `DenySignal` that the framework catches.
+*
+* - In segment context (outside Suspense): produces HTTP status code
+* - In slot context: graceful degradation → denied.tsx → default.tsx → null
+* - Inside Suspense (hold window): promoted to pre-flush behavior
+* - Inside Suspense (after flush): error boundary + noindex meta
+*
+* ```ts
+* deny()                                                        // 403 (default)
+* deny(404)                                                     // 404
+* deny(503, { message: 'Maintenance' })                         // server-only log message
+* deny(404, { dangerouslyPassData: { resourceId: params.id } }) // explicit client opt-in
+* ```
+*
+* Accepts any 4xx or 5xx status code — it is also how a page renders a 5xx
+* status file with data. An unplanned throw needs no primitive: it renders
+* the error page with a 500.
+*
+* @param status - HTTP status code (4xx or 5xx). Default: 403.
+* @param options - Optional message and/or data to pass to the client.
+*/
+function deny(status, options) {
+	const resolvedStatus = status ?? 403;
+	const resolvedData = options?.dangerouslyPassData;
+	if (resolvedStatus < 400 || resolvedStatus > 599) throw new Error(`deny() requires a 4xx or 5xx status code, got ${resolvedStatus}.`);
+	warnIfNotSerializable(resolvedData, "deny()");
+	throw new DenySignal(resolvedStatus, resolvedData);
+}
+/**
+* Render-phase signal thrown by `redirect()` and `redirectExternal()`.
+* Caught by the framework to produce a 3xx response or client-side navigation.
+*
+* Detect with `isRedirectSignal()`, never `instanceof` — see "Signal branding" in signal-identity.ts.
+*/
+var RedirectSignal = class extends Error {
+	[REDIRECT_BRAND] = true;
+	location;
+	status;
+	constructor(location, status) {
+		super(`Redirect to ${location}`);
+		this.name = "RedirectSignal";
+		this.location = location;
+		this.status = status;
+	}
+};
+/**
+* Redirect to a relative path. Rejects absolute and protocol-relative URLs.
+* Use `redirectExternal()` for external redirects with an allow-list.
+*
+* @param path - Relative path (e.g. '/login', 'settings', '/login?returnTo=/dash')
+* @param statusOrOptions - HTTP status code (3xx, default 302) or options object.
+*
+* @example
+* // Simple redirect
+* redirect('/login');
+*
+* // With status code
+* redirect('/login', 301);
+*
+* // With preserved search params
+* redirect(`/docs/${version}/${slug}`, { preserveSearchParams: ['foo'] });
+*/
+function redirect(path, statusOrOptions) {
+	let status;
+	let preserveSearchParams;
+	if (typeof statusOrOptions === "number") status = statusOrOptions;
+	else if (statusOrOptions) {
+		status = statusOrOptions.status ?? (statusOrOptions.permanent ? 308 : 302);
+		preserveSearchParams = statusOrOptions.preserveSearchParams;
+	} else status = 302;
+	if (status < 300 || status > 399) throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
+	assertRelativeRedirectPath(path);
+	let resolvedPath = path;
+	if (preserveSearchParams) {
+		const currentSearch = getRequestSearchString();
+		resolvedPath = mergePreservedSearchParams(path, currentSearch, preserveSearchParams);
+	}
+	throw new RedirectSignal(resolvedPath, status);
+}
+/**
+* Redirect to an external URL. The origin must be in the provided allow-list.
+*
+* Only http: and https: schemes are permitted. The allow-list is matched
+* against full origins (scheme + host + port), not bare hostnames.
+*
+* @param url - Absolute URL to redirect to.
+* @param allowList - Array of allowed origins (e.g. ['https://example.com', 'https://auth.example.com']).
+* @param status - HTTP redirect status code (3xx). Defaults to 302.
+*/
+function redirectExternal(url, allowList, status = 302) {
+	if (status < 300 || status > 399) throw new Error(`redirectExternal() requires a 3xx status code, got ${status}.`);
+	throw new RedirectSignal(validateExternalRedirectUrl(url, allowList), status);
+}
+var _waitUntilWarned = false;
+/**
+* Register a promise to be kept alive after the response is sent.
+* Maps to `ctx.waitUntil()` on Cloudflare Workers and similar platforms.
+*
+* The platform adapter installs a per-request waitUntil function via ALS
+* (see waituntil-bridge.ts). If no ALS handler is available, a warning
+* is logged once and the promise is left to resolve (or reject) without
+* being tracked.
+*
+* @param promise - The background work to keep alive.
+*/
+function waitUntil(promise) {
+	const alsFn = getWaitUntil();
+	if (alsFn) {
+		alsFn(promise);
+		return;
+	}
+	if (!_waitUntilWarned) {
+		_waitUntilWarned = true;
+		console.warn("[timber] waitUntil() is not supported by the current adapter. Background work will not be tracked. This warning is shown once.");
+	}
+}
+//#endregion
+//#region src/server/form-data.ts
+/**
+* FormData preprocessing — schema-agnostic conversion of FormData to typed objects.
+*
+* FormData is all strings. Schema validation expects typed values. This module
+* bridges the gap with intelligent coercion that runs *before* schema validation.
+*
+* Inspired by zod-form-data, but schema-agnostic — works with any Standard Schema
+* library (Zod, Valibot, ArkType).
+*
+* See design/08-forms-and-actions.md §"parseFormData() and coerce helpers"
+*/
+/**
+* Convert FormData into a plain object with intelligent coercion.
+*
+* Handles:
+* - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: ["js", "ts"] }`
+* - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: "Alice" } }`
+* - **Empty strings → undefined**: Enables `.optional()` semantics in schemas
+* - **Empty Files → undefined**: File inputs with no selection become `undefined`
+* - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded
+*/
+function parseFormData(formData) {
+	const flat = {};
+	for (const key of new Set(formData.keys())) {
+		if (key.startsWith("$ACTION_")) continue;
+		if (DANGEROUS_KEYS.has(key)) continue;
+		const processed = formData.getAll(key).map(normalizeValue);
+		if (processed.length === 1) flat[key] = processed[0];
+		else flat[key] = processed.filter((v) => v !== void 0 && v !== "");
+	}
+	return expandDotPaths(flat);
+}
+/**
+* Normalize a single FormData entry value.
+* - Empty File objects (no selection) → undefined
+* - Strings pass through as-is (empty strings stay as empty strings so
+*   schema validators like `z.string().min(1, 'Required')` can produce
+*   their custom error messages instead of a generic type mismatch)
+* - Everything else passes through as-is
+*/
+function normalizeValue(value) {
+	if (value instanceof File && value.size === 0 && value.name === "") return;
+	return value;
+}
+/**
+* Expand dot-notation keys into nested objects.
+* `{ "user.name": "Alice", "user.age": "30" }` → `{ user: { name: "Alice", age: "30" } }`
+*
+* Keys without dots are left as-is. Bracket notation (e.g. `items[0]`) is NOT
+* supported — use dot notation (`items.0`) instead.
+*/
+function expandDotPaths(flat) {
+	const result = {};
+	let hasDotPaths = false;
+	for (const key of Object.keys(flat)) if (key.includes(".")) {
+		hasDotPaths = true;
+		break;
+	}
+	if (!hasDotPaths) return flat;
+	for (const [key, value] of Object.entries(flat)) {
+		const parts = key.split(".");
+		if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
+		if (parts.length === 1) {
+			result[parts[0]] = value;
+			continue;
+		}
+		let current = result;
+		for (let i = 0; i < parts.length - 1; i++) {
+			const part = parts[i];
+			if (current[part] === void 0 || current[part] === null) current[part] = {};
+			if (typeof current[part] !== "object" || current[part] instanceof File) current[part] = {};
+			current = current[part];
+		}
+		current[parts[parts.length - 1]] = value;
+	}
+	return result;
+}
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__"]);
+/**
+* Schema-agnostic coercion primitives for common FormData patterns.
+*
+* These are plain transform functions — they compose with any schema library's
+* `transform`/`preprocess` pipeline:
+*
+* ```ts
+* // Zod
+* z.preprocess(coerce.number, z.number())
+* // Valibot
+* v.pipe(v.unknown(), v.transform(coerce.number), v.number())
+* ```
+*/
+var coerce = {
+	/**
+	* Coerce an empty string to undefined for optional text fields.
+	* Use with `.optional()` schemas where an empty input means "not provided".
+	*
+	* ```ts
+	* // Zod
+	* z.unknown().transform(coerce.text).pipe(z.string().optional())
+	* // Valibot
+	* v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))
+	* ```
+	*/
+	text(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value === "string") return value;
+	},
+	/**
+	* Coerce a string to a number.
+	* - `"42"` → `42`
+	* - `"3.14"` → `3.14`
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Non-numeric strings → `undefined` (schema validation will catch this)
+	*/
+	number(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value === "number") return value;
+		if (typeof value !== "string") return void 0;
+		const num = Number(value);
+		if (Number.isNaN(num)) return void 0;
+		return num;
+	},
+	/**
+	* Coerce a checkbox value to a boolean.
+	* HTML checkboxes submit "on" when checked and are absent when unchecked.
+	* - `"on"` / any truthy string → `true`
+	* - `undefined` / `null` / `""` → `false`
+	*/
+	checkbox(value) {
+		if (value === void 0 || value === null || value === "") return false;
+		if (typeof value === "boolean") return value;
+		return typeof value === "string" && value.length > 0;
+	},
+	/**
+	* Parse a JSON string into an object.
+	* - Valid JSON string → parsed object
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Invalid JSON → `undefined` (schema validation will catch this)
+	*/
+	json(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (typeof value !== "string") return value;
+		try {
+			return JSON.parse(value);
+		} catch {
+			return;
+		}
+	},
+	/**
+	* Coerce a date string to a Date object.
+	* Handles `<input type="date">` (`"2024-01-15"`), `<input type="datetime-local">`
+	* (`"2024-01-15T10:30"`), and full ISO 8601 strings.
+	* - Valid date string → `Date`
+	* - `""` / `undefined` / `null` → `undefined`
+	* - Invalid date strings → `undefined` (schema validation will catch this)
+	* - Impossible dates that `new Date()` silently normalizes (e.g. Feb 31) → `undefined`
+	*/
+	date(value) {
+		if (value === void 0 || value === null || value === "") return void 0;
+		if (value instanceof Date) return value;
+		if (typeof value !== "string") return void 0;
+		const date = new Date(value);
+		if (Number.isNaN(date.getTime())) return void 0;
+		const ymdMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})/);
+		if (ymdMatch) {
+			const inputYear = Number(ymdMatch[1]);
+			const inputMonth = Number(ymdMatch[2]);
+			const inputDay = Number(ymdMatch[3]);
+			const isUTC = value.length === 10 || value.endsWith("Z");
+			const parsedYear = isUTC ? date.getUTCFullYear() : date.getFullYear();
+			const parsedMonth = isUTC ? date.getUTCMonth() + 1 : date.getMonth() + 1;
+			const parsedDay = isUTC ? date.getUTCDate() : date.getDate();
+			if (inputYear !== parsedYear || inputMonth !== parsedMonth || inputDay !== parsedDay) return;
+		}
+		return date;
+	},
+	/**
+	* Create a File coercion function with optional size and mime type validation.
+	* Returns the File if valid, `undefined` otherwise.
+	*
+	* ```ts
+	* // Basic — just checks it's a real File
+	* z.preprocess(coerce.file(), z.instanceof(File))
+	*
+	* // With constraints
+	* z.preprocess(
+	*   coerce.file({ maxSize: 5 * 1024 * 1024, accept: ['image/png', 'image/jpeg'] }),
+	*   z.instanceof(File)
+	* )
+	* ```
+	*/
+	file(options) {
+		return (value) => {
+			if (value === void 0 || value === null || value === "") return void 0;
+			if (!(value instanceof File)) return void 0;
+			if (value.size === 0 && value.name === "") return void 0;
+			if (options?.maxSize !== void 0 && value.size > options.maxSize) return;
+			if (options?.accept !== void 0 && !options.accept.includes(value.type)) return;
+			return value;
+		};
+	}
+};
+//#endregion
+//#region src/server/actions.ts
+/**
+* Server action primitives: revalidatePath, revalidateTag, and the action handler.
+*
+* - revalidatePath(path) re-renders the route at that path and returns the RSC
+*   flight payload for inline reconciliation. Server actions only.
+* - revalidateTag(tag) invalidates timber.cache entries by tag. Callable from
+*   any server code: deferred to the end of the action inside one, immediate
+*   anywhere else.
+*
+* The action handler processes incoming action requests, validates CSRF,
+* enforces body limits, executes the action, and returns the response
+* (with piggybacked RSC payload if revalidatePath was called).
+*
+* See design/08-forms-and-actions.md
+*/
+/**
+* Thrown by a `RevalidateRenderer` that decided not to render: the path
+* was rejected, its params failed coercion, or its middleware answered
+* with a `Response` that cannot become an element tree. `executeAction`
+* drops the revalidation — the action result is still delivered, with no
+* `_tree` piggybacked — and, because the drop was a decision, does not
+* return it as an error to report. Identified by `instanceof`, so the
+* message text never reaches clients.
+*/
+var RevalidationDropped = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RevalidationDropped";
+	}
+};
+/**
+* Re-render the route at `path` and include the RSC flight payload in the
+* action response. The client reconciles inline — no separate fetch needed.
+*
+* Only callable inside a server action: it attaches a render to the action
+* response, and nothing else has one. To refresh cached data from a
+* `route.ts` handler, a webhook, or a job, use `revalidateTag()` or
+* `cache.invalidate()`.
+*
+* @param path - The path to re-render (e.g. '/dashboard', '/todos').
+*/
+function revalidatePath(path) {
+	const state = revalidationAls.getStore();
+	if (!state || state.closed) throw new Error("revalidatePath() can only be called inside a server action: it re-renders the route into the action response, and there is no action response here. To refresh cached data from a route handler or other server code, call revalidateTag() or cache.invalidate() for the tags the route reads.");
+	if (!state.paths.includes(path)) state.paths.push(path);
+}
+/**
+* Invalidate all timber.cache entries tagged with `tag`, and tombstone the
+* pre-rendered component seeds that carry it.
+* Does not return a payload — the next request for an invalidated entry re-executes.
+*
+* Callable from any server code. Inside a server action the invalidation is
+* deferred until the action body returns, so a `revalidatePath()` render in
+* the same action reads fresh data; the returned promise resolves at once.
+* Anywhere else — a `route.ts` webhook, a job, or background work an action
+* started that runs after the action body returned — it is
+* `cache.invalidate({ tag })`, and the promise settles when the invalidation
+* has. Await it before responding.
+*
+* @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
+*/
+function revalidateTag(tag) {
+	const state = revalidationAls.getStore();
+	if (!state || state.closed) return cache.invalidate({ tag });
+	if (!state.tags.includes(tag)) state.tags.push(tag);
+	return Promise.resolve();
+}
+/**
+* Execute a server action and process revalidation.
+*
+* 1. Sets up revalidation state
+* 2. Calls the action function
+* 3. Processes revalidateTag calls (invalidates cache entries)
+* 4. Processes revalidatePath calls (re-renders and captures RSC payload)
+* 5. Returns the action result + optional RSC payload
+*
+* @param actionFn - The server action function to execute.
+* @param args - Arguments to pass to the action.
+* @param config - Handler configuration (cache handler, renderer).
+*/
+async function executeAction(actionFn, args, config = {}, spanMeta) {
+	const state = {
+		paths: [],
+		tags: []
+	};
+	const revalidationErrors = [];
+	let actionResult;
+	let redirectTo;
+	let redirectStatus;
+	await revalidationAls.run(state, async () => {
+		try {
+			actionResult = await withSpan("timber.action", {
+				...spanMeta?.actionFile ? { "timber.action_file": spanMeta.actionFile } : {},
+				...spanMeta?.actionName ? { "timber.action_name": spanMeta.actionName } : {}
+			}, () => actionFn(...args));
+		} catch (error) {
+			if (isRedirectSignal(error)) {
+				redirectTo = error.location;
+				redirectStatus = error.status;
+			} else throw error;
+		} finally {
+			state.closed = true;
+		}
+	});
+	if (state.tags.length > 0) {
+		const results = await Promise.allSettled(state.tags.map((tag) => cache.invalidate({ tag })));
+		for (const r of results) if (r.status === "rejected") {
+			console.error("[timber] revalidateTag invalidation failed:", r.reason);
+			revalidationErrors.push(r.reason);
+		}
+	}
+	let revalidation;
+	const { requestPathname, requestSearch } = config;
+	const isCurrentPage = (path) => !requestPathname || revalidationPathMatches(path, requestPathname, requestSearch);
+	const path = state.paths.find(isCurrentPage);
+	const onlyOtherPagesNamed = state.paths.length > 0 && path === void 0;
+	if (path !== void 0 && config.renderer) try {
+		revalidation = await config.renderer(path);
+	} catch (renderError) {
+		if (isRedirectSignal(renderError)) {
+			redirectTo = renderError.location;
+			redirectStatus = renderError.status;
+		} else if (isDenySignal(renderError)) console.error(`[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`);
+		else if (renderError instanceof RevalidationDropped) console.error(`[timber] ${renderError.message}`);
+		else {
+			console.error("[timber] revalidatePath render failed:", renderError);
+			revalidationErrors.push(renderError);
+		}
+	}
+	return {
+		actionResult,
+		revalidation,
+		onlyOtherPagesNamed,
+		revalidationErrors,
+		...redirectTo ? {
+			redirectTo,
+			redirectStatus
+		} : {}
+	};
+}
+/**
+* Check if a `revalidatePath(path)` argument matches the request pathname.
+* Canonicalizes the revalidated path the same way the renderer does so
+* equivalent paths compare equal. Returns true when the paths match or
+* when comparison is inconclusive (validation failure → render to be safe).
+*/
+function revalidationPathMatches(revalidatedPath, requestPathname, requestSearch) {
+	const hashIdx = revalidatedPath.indexOf("#");
+	const noFragment = hashIdx >= 0 ? revalidatedPath.slice(0, hashIdx) : revalidatedPath;
+	const queryIdx = noFragment.indexOf("?");
+	const pathnameOnly = queryIdx >= 0 ? noFragment.slice(0, queryIdx) : noFragment;
+	const search = queryIdx >= 0 ? noFragment.slice(queryIdx) : "";
+	const canonical = canonicalize(pathnameOnly, true);
+	if (!canonical.ok) return true;
+	if (canonical.pathname !== requestPathname) return false;
+	if (search && search !== (requestSearch ?? "")) return false;
+	return true;
+}
+//#endregion
+export { setMutableCookieContext as C, setMatchedSegmentPath as S, runOutsideReactCacheScope as T, getHeaders as _, parseFormData as a, markResponseFlushed as b, deny as c, waitUntil as d, getCookie as f, getHeader as g, applyRequestHeaderOverlay as h, coerce as i, redirect as l, getSetCookieHeaders as m, revalidatePath as n, DenySignal as o, getCookieJar as p, revalidateTag as r, RedirectSignal as s, executeAction as t, redirectExternal as u, getSearchParams as v, setSegmentParams as w, runWithRequestContext as x, getSegmentParams as y };
+
+//# sourceMappingURL=actions-Rjk4htmA.js.map