@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/dist/server/action-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-client.d.ts","sourceRoot":"","sources":["../../src/server/action-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;;GAOG;AACH,qBAAa,WAAW,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,KAAK;IACnE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBAEvC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMxD;AAID;;;;;;;GAOG;AACH,UAAU,gBAAgB,CAAC,MAAM,GAAG,OAAO;IACzC,WAAW,EAAE;QACX,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;KAChG,CAAC;CACH;AAED,KAAK,oBAAoB,CAAC,MAAM,IAC5B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CAAE,CAAC;AAEtE,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,GAAG;QAAE,GAAG,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CAC1D;AAcD;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEpF,4DAA4D;AAC5D,UAAU,kBAAkB,CAAC,CAAC,GAAG,OAAO;IACtC,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC;IAC1B,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAC;IAEjG,WAAW,CAAC,EAAE,KAAK,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1F,8CAA8C;AAC9C,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,OAAO,IACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAAC,eAAe,CAAC,EAAE,KAAK,CAAA;CAAE,GACvF;IACE,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,CAAC,EAAE,KAAK,CAAC;IACpB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,GACD;IACE,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAC9D,eAAe,CAAC,EAAE,KAAK,CAAC;CACzB,CAAC;AAEN,yCAAyC;AACzC,MAAM,WAAW,aAAa,CAAC,IAAI,EAAE,MAAM;IACzC,GAAG,EAAE,IAAI,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAID,UAAU,kBAAkB,CAAC,IAAI;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAClF,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa,CAAC,IAAI;IACjC,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpF,uDAAuD;IACvD,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;CAC7F;AAED,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB,CAAC,IAAI,EAAE,MAAM;IACnD,mDAAmD;IACnD,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;CAC1F;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,KAAK,IAAI;IAC5B,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;CAC3F,CAAC;AA2EF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAC7D,MAAM,GAAE,kBAAkB,CAAC,IAAI,CAAM,GACpC,aAAa,CAAC,IAAI,CAAC,CAuGrB;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,EACrC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,GACzC,QAAQ,CAAC,KAAK,CAAC,CAIjB"}
+{"version":3,"file":"action-client.d.ts","sourceRoot":"","sources":["../../src/server/action-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;;GAOG;AACH,qBAAa,WAAW,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,KAAK;IACnE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAEnD,YAAY,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAKtD;CACF;AAID;;;;;;;GAOG;AACH,UAAU,gBAAgB,CAAC,MAAM,GAAG,OAAO;IACzC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,OAAO,KACX,oBAAoB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;KAC3E,CAAC;CACH;AAED,KAAK,oBAAoB,CAAC,MAAM,IAC5B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CAAE,CAAC;AAEtE,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,GAAG;QAAE,GAAG,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CAC1D;AAcD;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEpF,4DAA4D;AAC5D,UAAU,kBAAkB,CAAC,CAAC,GAAG,OAAO;IACtC,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC;IAC1B,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAC;IAEjG,WAAW,CAAC,EAAE,KAAK,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAExD,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1F,8CAA8C;AAC9C,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,OAAO,IACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAAC,eAAe,CAAC,EAAE,KAAK,CAAA;CAAE,GACvF;IACE,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,CAAC,EAAE,KAAK,CAAC;IACpB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,GACD;IACE,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAC9D,eAAe,CAAC,EAAE,KAAK,CAAC;CACzB,CAAC;AAEN,yCAAyC;AACzC,MAAM,WAAW,aAAa,CAAC,IAAI,EAAE,MAAM;IACzC,GAAG,EAAE,IAAI,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAID,UAAU,kBAAkB,CAAC,IAAI;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAClF,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa,CAAC,IAAI;IACjC,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpF,uDAAuD;IACvD,MAAM,CAAC,KAAK,EACV,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,GAC1D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;CAC/B;AAED,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB,CAAC,IAAI,EAAE,MAAM;IACnD,mDAAmD;IACnD,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;CAClG;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IACrB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS;CAAE,GAAG,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO,IAAI;IACxD,0EAA0E;IAC1E,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,kGAAkG;IAClG,CACE,GAAG,IAAI,EAAE,SAAS,SAAS,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GACrE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,wDAAwD;IACxD,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;CAC3F,CAAC;AA+BF,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AA8C/B;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAC7D,MAAM,GAAE,kBAAkB,CAAC,IAAI,CAAM,GACpC,aAAa,CAAC,IAAI,CAAC,CAmIrB;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,EACrC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,GACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAIzB"}

package/dist/server/action-encryption.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Server action bound args encryption utilities.
+ *
+ * Provides key management for the RSC plugin's built-in bound args encryption.
+ * The RSC plugin (@vitejs/plugin-rsc) handles the actual encrypt/decrypt via
+ * AES-256-GCM — this module handles:
+ *
+ * 1. Key sourcing: auto-generated at build time (embedded in bundle), overridable
+ *    via env var for cross-build key sharing (rolling/blue-green deployments)
+ * 2. Build-time key expression generation for the RSC plugin's `defineEncryptionKey`
+ *
+ * Encryption is always on in production. In dev mode, it's on by default
+ * (matching the RSC plugin's behavior) but can be disabled for debugging.
+ *
+ * ## Known Security Considerations
+ *
+ * 1. **defineEncryptionKey is a raw JS expression.** The RSC plugin inlines it
+ *    verbatim into generated code. We only emit the hardcoded string
+ *    `process.env.TIMBER_ACTIONS_ENCRYPTION_KEY` — never user-controlled input.
+ *    If this function is ever extended to accept configurable env var names,
+ *    the expression MUST be validated against a safe pattern.
+ *
+ * 2. **Key material lives in GC-visible JS strings.** `atob()` decodes the key
+ *    into a regular JavaScript string on the V8 heap. JavaScript has no
+ *    `SecureString` or memory-zeroing primitive — this is an inherent platform
+ *    limitation. Acceptable for web server use; would need review for FIPS.
+ *
+ * 3. **TIMBER_ACTIONS_ENCRYPTION_KEY must be set at both build time and runtime.**
+ *    At build time, we validate the key format and emit a runtime expression.
+ *    If the env var is present at build time but missing at runtime, the server
+ *    will crash on first action invocation with an opaque `atob(undefined)` error.
+ *    If the env var is present at runtime but was absent at build time, the RSC
+ *    plugin will have generated its own key and the env var is silently ignored.
+ *
+ * See design/08-forms-and-actions.md §"Security"
+ * See design/13-security.md
+ */
+/** User-facing configuration for action bound args encryption. */
+export interface ActionEncryptionConfig {
+    /**
+     * Disable encryption in dev mode for easier debugging.
+     * Has no effect in production — encryption is always enabled.
+     * Default: false (encryption is on in dev too).
+     */
+    disableInDev?: boolean;
+}
+/**
+ * Build the `defineEncryptionKey` expression for the RSC plugin.
+ *
+ * The RSC plugin accepts a JavaScript expression string that will be
+ * inlined into the encryption runtime module. At runtime, this expression
+ * must evaluate to the base64-encoded encryption key.
+ *
+ * Priority:
+ * 1. `TIMBER_ACTIONS_ENCRYPTION_KEY` env var (for cross-build key sharing
+ *    in rolling/blue-green deployments)
+ * 2. Auto-generated at build time (RSC plugin default — embedded in bundle,
+ *    consistent across all instances of the same build)
+ *
+ * For env var keys, we generate a runtime expression that reads the env var.
+ * For auto-generated keys, we return undefined and let the RSC plugin handle it.
+ */
+export declare function resolveEncryptionKeyExpression(): string | undefined;
+/**
+ * Determine whether action encryption should be enabled.
+ *
+ * Encryption is always enabled in production. In dev mode, it's enabled
+ * by default but can be disabled via config for debugging.
+ */
+export declare function shouldEnableEncryption(isDev: boolean, config?: ActionEncryptionConfig): boolean;
+/**
+ * Validate that a key string is a valid base64-encoded 256-bit key.
+ * Throws a descriptive error if the key is malformed.
+ */
+export declare function validateKeyFormat(key: string): void;
+//# sourceMappingURL=action-encryption.d.ts.map

package/dist/server/action-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-encryption.d.ts","sourceRoot":"","sources":["../../src/server/action-encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAaD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,SAAS,CAwBnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAI/F;AAID;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsBnD"}

package/dist/server/action-handler.d.ts

@@ -12,10 +12,11 @@
  *
  * See design/08-forms-and-actions.md
  */
-import { type CsrfConfig } from './csrf.js';
-import { type RevalidateRenderer } from './actions.js';
-import { type BodyLimitsConfig } from './body-limits.js';
-import type { FormFlashData } from './form-flash.js';
+import { type CsrfConfig } from './csrf.ts';
+import { type RevalidateRenderer } from './actions.ts';
+import { type BodyLimitsConfig } from './body-limits.ts';
+import { type SensitiveFieldsOption } from './sensitive-fields.ts';
+import type { FormFlashData } from './form-flash.ts';
 /** Configuration for the action handler. */
 export interface ActionDispatchConfig {
     /** CSRF configuration. */
@@ -24,6 +25,12 @@ export interface ActionDispatchConfig {
     revalidateRenderer?: RevalidateRenderer;
     /** Body size limits (from timber.config.ts). */
     bodyLimits?: BodyLimitsConfig;
+    /**
+     * Override the sensitive-field deny-list for the no-JS form POST path.
+     * Defaults to the global `forms.stripSensitiveFields` from `timber.config.ts`.
+     * See `SensitiveFieldsOption` in `./sensitive-fields.ts` and TIM-816.
+     */
+    sensitiveFields?: SensitiveFieldsOption;
 }
 /**
  * Check if a request is a server action invocation.
@@ -32,11 +39,39 @@ export interface ActionDispatchConfig {
  * - With JS: POST with `x-rsc-action` header (client callServer dispatch)
  * - Without JS: POST with form data containing `$ACTION_REF` or `$ACTION_KEY`
  *   (React's progressive enhancement hidden fields)
+ *
+ * **Important:** This function returns true for ANY POST with a form
+ * Content-Type, including non-action POSTs to route.ts API handlers.
+ * The caller (rsc-entry/action-dispatcher.ts) MUST check the matched route type
+ * before entering the action path — route.ts matches skip action detection
+ * entirely so their body is not pre-parsed. See TIM-870.
  */
 export declare function isActionRequest(req: Request): boolean;
-/** Signal from handleFormAction to re-render the page with flash data instead of redirecting. */
+/**
+ * Signal from handleFormAction to re-render the page with flash data instead of redirecting.
+ *
+ * Carries two cookie-related snapshots taken before the action's ALS scope
+ * exits, so the rerender pipeline (which establishes its own fresh cookie
+ * jar from the original request) doesn't lose the action's mutations:
+ *
+ *   - `setCookieHeaders`: serialized Set-Cookie headers to append to the
+ *     final HTML response. Without this, cookies set inside the action are
+ *     silently dropped from the response. See TIM-836 (LOCAL-740).
+ *
+ *   - `cookies`: the post-action read-your-own-writes view of the cookie
+ *     jar, as the same `Map<string, string>` shape used by the request
+ *     context's `parsedCookies`. The rerender dispatcher passes this map to
+ *     the pipeline's re-entry, which makes it the rerender request
+ *     context's cookies, bypassing any string round-trip through a
+ *     `Cookie:` header. The
+ *     direct Map eliminates the value-smuggling primitive that the
+ *     previous `cookieHeader: string` shape carried — see
+ *     ONGOING_SECURITY.md H-3 (TIM-868) and TIM-837.
+ */
 export interface FormRerender {
     rerender: FormFlashData;
+    setCookieHeaders: string[];
+    cookies: Map<string, string>;
 }
 /**
  * Handle a server action request.

package/dist/server/action-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CAwCzC"}
+{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEjF,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAKtE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAUrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CAuFzC"}

package/dist/server/actions.d.ts

@@ -2,10 +2,10 @@
  * Server action primitives: revalidatePath, revalidateTag, and the action handler.
  *
  * - revalidatePath(path) re-renders the route at that path and returns the RSC
- *   flight payload for inline reconciliation.
- * - revalidateTag(tag) invalidates cached shells and 'use cache' entries by tag.
- *
- * Both are callable from anywhere on the server — actions, API routes, handlers.
+ *   flight payload for inline reconciliation. Server actions only.
+ * - revalidateTag(tag) invalidates timber.cache entries by tag. Callable from
+ *   any server code: deferred to the end of the action inside one, immediate
+ *   anywhere else.
  *
  * The action handler processes incoming action requests, validates CSRF,
  * enforces body limits, executes the action, and returns the response
@@ -13,24 +13,50 @@
  *
  * See design/08-forms-and-actions.md
  */
-import type { CacheHandler } from '#/cache/index';
-import { type RevalidationState } from './als-registry.js';
-/** Result of rendering a revalidation — element tree before RSC serialization. */
+import { type RevalidationState } from './als-registry.ts';
+import type { ReactCacheScope } from './react-cache-scope.ts';
+/** Result of rendering a revalidation — payload root before RSC serialization. */
 export interface RevalidationResult {
-    /** React element tree (pre-serialization — passed to renderToReadableStream). */
-    element: unknown;
-    /** Resolved head elements for metadata. */
-    headElements: unknown[];
+    /**
+     * The payload root — tree plus the params it rendered with, exactly as an
+     * ordinary route payload. The client splits it in `applyActionResult`.
+     */
+    payload: unknown;
+    /**
+     * The `React.cache` scope the target route's middleware ran in. The
+     * revalidated tree renders in it, so middleware, access.ts and components
+     * share one scope — fresh, never the action body's (TIM-1529).
+     */
+    reactCacheScope: ReactCacheScope;
 }
 /** Renderer function that builds a React element tree for a given path. */
 export type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;
-export type { RevalidationState } from './als-registry.js';
+/**
+ * Thrown by a `RevalidateRenderer` that decided not to render: the path
+ * was rejected, its params failed coercion, or its middleware answered
+ * with a `Response` that cannot become an element tree. `executeAction`
+ * drops the revalidation — the action result is still delivered, with no
+ * `_tree` piggybacked — and, because the drop was a decision, does not
+ * return it as an error to report. Identified by `instanceof`, so the
+ * message text never reaches clients.
+ */
+export declare class RevalidationDropped extends Error {
+    constructor(message: string);
+}
+export type { RevalidationState } from './als-registry.ts';
 /** Options for creating the action handler. */
 export interface ActionHandlerConfig {
-    /** Cache handler for tag invalidation. */
-    cacheHandler?: CacheHandler;
     /** Renderer for producing RSC payloads during revalidation. */
     renderer?: RevalidateRenderer;
+    /**
+     * Pathname of the page the action was submitted from. When set,
+     * revalidatePath renders are skipped for non-matching paths — the
+     * server cache is already invalidated, so the next navigation fetches
+     * fresh data. See TIM-1454.
+     */
+    requestPathname?: string;
+    /** Search string of the action request URL (e.g. `?page=1`). */
+    requestSearch?: string;
 }
 /** Result of handling a server action request. */
 export interface ActionHandlerResult {
@@ -38,37 +64,63 @@ export interface ActionHandlerResult {
     actionResult: unknown;
     /** Revalidation result if revalidatePath was called (element tree, not yet serialized). */
     revalidation?: RevalidationResult;
+    /**
+     * True when `revalidatePath()` was called only for pages other than the
+     * current one (TIM-1454). The client then evicts its caches and skips the
+     * refresh — nothing on screen was named. Whenever the current page was
+     * named this is false, even if other pages were named too: its re-render,
+     * or the refresh that replaces a dropped one, re-renders every layout it
+     * shares with them. Which paths were named is not reported: the client
+     * evicts every cached payload after any revalidation (TIM-1476), so a path
+     * list would carry nothing it acts on (TIM-1461).
+     */
+    onlyOtherPagesNamed: boolean;
     /** Redirect location if a RedirectSignal was thrown during revalidation. */
     redirectTo?: string;
     /** Redirect status code. */
     redirectStatus?: number;
+    /**
+     * Errors the action survived after its body returned: a `revalidateTag`
+     * invalidation that rejected, or a `revalidatePath` render that threw.
+     * Each is already logged. They are returned rather than reported here
+     * because reporting needs the request, which the caller owns; the caller
+     * passes each to `onRequestError` once.
+     */
+    revalidationErrors: unknown[];
 }
 /**
- * Set the revalidation state for the current action execution.
- * @internal — kept for test compatibility; prefer executeAction() which uses ALS.
+ * Run `fn` inside a revalidation ALS scope.
+ * @internal — for tests that call revalidatePath/Tag directly without executeAction().
  */
-export declare function _setRevalidationState(state: RevalidationState): void;
-/**
- * Clear the revalidation state after action execution.
- * @internal — kept for test compatibility.
- */
-export declare function _clearRevalidationState(): void;
+export declare function _runWithRevalidationState<T>(state: RevalidationState, fn: () => T): T;
 /**
  * Re-render the route at `path` and include the RSC flight payload in the
  * action response. The client reconciles inline — no separate fetch needed.
  *
- * Can be called from server actions, API routes, or any server-side context.
+ * Only callable inside a server action: it attaches a render to the action
+ * response, and nothing else has one. To refresh cached data from a
+ * `route.ts` handler, a webhook, or a job, use `revalidateTag()` or
+ * `cache.invalidate()`.
  *
  * @param path - The path to re-render (e.g. '/dashboard', '/todos').
  */
 export declare function revalidatePath(path: string): void;
 /**
- * Invalidate all pre-rendered shells and 'use cache' entries tagged with `tag`.
- * Does not return a payload — the next request for an invalidated route re-renders fresh.
+ * Invalidate all timber.cache entries tagged with `tag`, and tombstone the
+ * pre-rendered component seeds that carry it.
+ * Does not return a payload — the next request for an invalidated entry re-executes.
+ *
+ * Callable from any server code. Inside a server action the invalidation is
+ * deferred until the action body returns, so a `revalidatePath()` render in
+ * the same action reads fresh data; the returned promise resolves at once.
+ * Anywhere else — a `route.ts` webhook, a job, or background work an action
+ * started that runs after the action body returned — it is
+ * `cache.invalidate({ tag })`, and the promise settles when the invalidation
+ * has. Await it before responding.
  *
  * @param tag - The cache tag to invalidate (e.g. 'products', 'user:123').
  */
-export declare function revalidateTag(tag: string): void;
+export declare function revalidateTag(tag: string): Promise<void>;
 /**
  * Execute a server action and process revalidation.
  *
@@ -86,18 +138,4 @@ export declare function executeAction(actionFn: (...args: unknown[]) => Promise<
     actionFile?: string;
     actionName?: string;
 }): Promise<ActionHandlerResult>;
-/**
- * Build an HTTP Response for a no-JS form submission.
- * Standard POST → 302 redirect pattern.
- *
- * @param redirectPath - Where to redirect after the action executes.
- */
-export declare function buildNoJsResponse(redirectPath: string, status?: number): Response;
-/**
- * Detect whether the incoming request is an RSC action request (with JS)
- * or a plain HTML form POST (no JS).
- *
- * RSC action requests use Accept: text/x-component or Content-Type: text/x-component.
- */
-export declare function isRscActionRequest(req: Request): boolean;
 //# sourceMappingURL=actions.d.ts.map

package/dist/server/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI5E,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,YAAY,EAAE,OAAO,EAAE,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAG/E,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAIpE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAmBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAK/C;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EAClD,IAAI,EAAE,OAAO,EAAE,EACf,MAAM,GAAE,mBAAwB,EAChC,QAAQ,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,GAAE,MAAY,GAAG,QAAQ,CAKtF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIxD"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAGD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;;;OASG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,EAAE,CAAC;CAC/B;AAQD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAErF;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAajD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxD;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EAClD,IAAI,EAAE,OAAO,EAAE,EACf,MAAM,GAAE,mBAAwB,EAChC,QAAQ,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC,CAkG9B"}

package/dist/server/als-registry.d.ts

@@ -6,23 +6,45 @@
  * this registry and re-export public accessor functions.
  *
  * Why: ALS instances require singleton semantics — if two copies of the
- * same ALS exist (one from a relative import, one from a barrel import),
- * one module writes to its copy and another reads from an empty copy.
- * Centralizing ALS creation in a single module eliminates this class of bug.
+ * same ALS exist (one from a relative import, one from a barrel import,
+ * or the same file re-evaluated by Vite after an HMR invalidation), one
+ * module writes to its copy and another reads from an empty copy.
+ * Centralizing ALS creation in a single module + anchoring each instance
+ * on `globalThis` under a `Symbol.for(...)` key eliminates this class of
+ * bug, including the Vite-dev case where module instance split would
+ * otherwise hand two copies of this file out of a single evaluation cycle.
  *
- * The `timber-shims` plugin ensures `@timber-js/app/server` resolves to
- * src/ in RSC and SSR environments, so all import paths converge here.
+ * The `timber-shims` plugin remaps `@timber-js/app/server` to src/ in
+ * RSC and SSR environments so import-specifier paths converge here, and
+ * the `globalThis[SYMBOL_FOR]` anchor below closes the remaining gap: any
+ * second evaluation of this module picks up the ALS the first evaluation
+ * already stored rather than instantiating a fresh one. Same pattern the
+ * Cloudflare bindings ALS uses in `adapters/cloudflare.ts`.
  *
  * DO NOT create ALS instances outside this file. If you need a new ALS,
  * add it here and import from `./als-registry.js` in the consuming module.
+ * Inside this file, always route through `getOrCreateAls(symbol)` — a raw
+ * `new AsyncLocalStorage()` reintroduces the instance-split hazard.
  *
  * See design/18-build-system.md §"Module Singleton Strategy" and
- * §"Singleton State Registry".
+ * §"Singleton State Registry". Regression test:
+ * `tests/als-registry-singleton.test.ts`.
  */
+import '#server-only-guard';
+import type { CoercedParams } from '../shared/param-value.ts';
+import type { SlotParamsRecord } from '../shared/slot-params.ts';
 import { AsyncLocalStorage } from 'node:async_hooks';
 /** @internal — import via request-context.ts public API */
 export declare const requestContextAls: AsyncLocalStorage<RequestContextStore>;
 export interface RequestContextStore {
+    /**
+     * The request this context was opened for, or `null` in the build-time
+     * capture store, where there is none. Read only to report a failed
+     * `cache.component` background re-render, which outlives the code that had the request
+     * in hand (design/17 §"Which errors reach it"). Everything a page may read
+     * has its own field below.
+     */
+    request: Request | null;
     /** Incoming request headers (read-only view). */
     headers: Headers;
     /** Raw cookie header string, parsed lazily into a Map on first access. */
@@ -32,34 +54,121 @@ export interface RequestContextStore {
     /** Original (pre-overlay) frozen headers, kept for overlay merging. */
     originalHeaders: Headers;
     /**
-     * Promise resolving to the route's typed search params (when search-params.ts
-     * exists) or to the raw URLSearchParams. Stored as a Promise so the framework
-     * can later support partial pre-rendering where param resolution is deferred.
+     * CSP nonce, created the first time middleware reads `ctx.nonce`. Read by
+     * the renderers via `getCspNonce()` and stamped on every inline script.
+     * Absent when no middleware asked for one. See server/csp-nonce.ts.
      */
-    searchParamsPromise: Promise<URLSearchParams | Record<string, unknown>>;
+    cspNonce?: string;
+    /**
+     * Raw URLSearchParams for the current request.
+     * To get typed parsed params, import a search params definition and
+     * call `.parse(searchParams())`.
+     */
+    searchParams: URLSearchParams;
+    /**
+     * Raw search string from the request URL (e.g. "?foo=bar&baz=1").
+     * Available synchronously for use in `redirect()` with `preserveSearchParams`.
+     */
+    searchString: string;
+    /**
+     * Coerced segment params for the current request.
+     * Set by the pipeline after route matching and param coercion, before
+     * middleware and rendering. Pages and layouts read params via
+     * `getSegmentParams()` instead of receiving them as a prop.
+     *
+     * See design/07-routing.md §"params.ts — Convention File for Typed Params"
+     */
+    segmentParams?: CoercedParams;
+    /**
+     * The matched segment path (e.g. '/(browse)/[artistSlug]/[year]').
+     * Includes route groups and parallel slots — uniquely identifies the
+     * segment in the route tree. Set by the pipeline alongside segmentParams.
+     * Used by getSegmentParams() for dev-mode validation.
+     * See design/41-global-params.md §Runtime Validation
+     */
+    matchedSegmentPath?: string;
+    /**
+     * Per-slot coerced segment params, keyed by the slot's full tree path
+     * (e.g. '/(browse)/@shows/[artistSlug]/[...year]').
+     *
+     * Each slot walks its own segment tree and may interpret URL parts
+     * differently from the main route (e.g. catch-all vs dynamic). This
+     * map stores slot-specific params so getSegmentParams(segmentPath)
+     * returns the correct types for slot pages.
+     *
+     * See design/07-routing.md §"Parallel Slot Params"
+     */
+    slotParams?: SlotParamsRecord;
     /** Outgoing Set-Cookie entries (name → serialized value + options). Last write wins. */
     cookieJar: Map<string, CookieEntry>;
     /** Whether the response has flushed (headers committed). */
     flushed: boolean;
     /** Whether the current context allows cookie mutation. */
     mutableContext: boolean;
+    /**
+     * Set by AccessGate or PageDenyBoundary when a DenySignal is caught
+     * server-side (inside the React tree, before React Flight sees it).
+     * The document path reads this after render to set the HTTP status code;
+     * the RSC payload path does not read it (a Flight payload response is always 200).
+     * See TIM-666, TIM-1495.
+     */
+    denyStatus?: number;
+    /**
+     * Index of the first segment whose AccessGate denied during render.
+     * Recorded by AccessGate when it catches a DenySignal so post-render
+     * consumers (buildSegmentInfo, X-Timber-Segments header) can bound
+     * the segment list without a pre-render access pass. Infinity when
+     * no segment denied. See TIM-1363.
+     */
+    _firstDeniedSegmentIndex?: number;
+    /**
+     * Metadata entries collected during render by MetadataCollector.
+     * Populated per-segment in tree order (root→page) during
+     * renderToReadableStream. Entries may contain promises for dynamic
+     * metadata (resolved concurrently with page rendering, TIM-1367).
+     * MetadataHead awaits all entries before merging.
+     * See TIM-1363, TIM-1367, design/16-metadata.md.
+     */
+    _metadataEntries?: Array<{
+        metadata: import('./types.ts').Metadata | Promise<import('./types.ts').Metadata | null>;
+        isPage: boolean;
+    }>;
 }
 /** A single outgoing cookie entry in the cookie jar. */
 export interface CookieEntry {
     name: string;
     value: string;
-    options: import('./request-context.js').CookieOptions;
+    options: import('./cookie-context.ts').CookieOptions;
 }
+/**
+ * One trace scope. The pipeline opens the request's scope; withSpan() opens a
+ * copy per span, so the span pointers below always name the span the code is
+ * running in, however sibling spans interleave (TIM-1538).
+ */
 export interface TraceStore {
-    /** 32-char lowercase hex trace ID (OTEL or UUID fallback). */
-    traceId: string;
-    /** OTEL span ID if available, undefined otherwise. */
+    /**
+     * The request's trace, shared by reference by every span scope in it.
+     * `traceId` is the 32-char lowercase hex trace ID (OTEL or UUID fallback);
+     * replaceTraceId() swaps it from inside the first span, and code outside
+     * that span (the request's completion log) sees the swap.
+     */
+    request: {
+        traceId: string;
+    };
+    /** The enclosing OTEL span's ID if an SDK is active, undefined otherwise. */
     spanId?: string;
+    /**
+     * The enclosing native platform span (e.g. Cloudflare's `Span` from
+     * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes
+     * after span creation — the platform API has no getActiveSpan() equivalent.
+     * See TIM-1135.
+     */
+    platformSpan?: import('./tracing.ts').PlatformSpan;
 }
 /** @internal — import via tracing.ts public API */
 export declare const traceAls: AsyncLocalStorage<TraceStore>;
 export interface TimingStore {
-    entries: import('./server-timing.js').TimingEntry[];
+    entries: import('./server-timing.ts').TimingEntry[];
 }
 /** @internal — import via server-timing.ts public API */
 export declare const timingAls: AsyncLocalStorage<TimingStore>;
@@ -68,11 +177,18 @@ export interface RevalidationState {
     paths: string[];
     /** Tags to invalidate (populated by revalidateTag calls). */
     tags: string[];
+    /**
+     * Set once the action body has settled. ALS still hands this state to
+     * work the action started and did not await (a `waitUntil()` job), but
+     * `paths` and `tags` are no longer read, so a late `revalidateTag` must
+     * invalidate immediately instead of queueing into a list nobody drains.
+     */
+    closed?: boolean;
 }
 /** @internal — import via actions.ts public API */
 export declare const revalidationAls: AsyncLocalStorage<RevalidationState>;
 /** @internal — import via form-flash.ts public API */
-export declare const formFlashAls: AsyncLocalStorage<import("./form-flash.js").FormFlashData>;
+export declare const formFlashAls: AsyncLocalStorage<import("./form-flash.ts").FormFlashData>;
 /** Function that sends Link header values as a 103 Early Hints response. */
 export type EarlyHintsSenderFn = (links: string[]) => void;
 /** @internal — import via early-hints-sender.ts public API */
@@ -81,4 +197,38 @@ export declare const earlyHintsSenderAls: AsyncLocalStorage<EarlyHintsSenderFn>;
 export type WaitUntilFn = (promise: Promise<unknown>) => void;
 /** @internal — import via waituntil-bridge.ts public API */
 export declare const waitUntilAls: AsyncLocalStorage<WaitUntilFn>;
+/** Workers Cache purge function from Cloudflare ExecutionContext.cache. */
+export interface WorkersCachePurgeCtx {
+    purge(opts: {
+        tags: string[];
+    }): Promise<void>;
+}
+/** @internal — import via workers-cache-bridge.ts public API */
+export declare const workersCachePurgeAls: AsyncLocalStorage<WorkersCachePurgeCtx>;
+/**
+ * One request's `React.cache` storage — the Map React's `cache()` hands to
+ * `getCacheForType`, owned by timber instead of by a Flight `Request` so
+ * `middleware.ts`, `proxy.ts`, and route handlers share it with the render.
+ */
+export type ReactCacheScope = Map<() => unknown, unknown>;
+/** @internal — import via react-cache-bridge.ts public API */
+export declare const reactCacheScopeAls: AsyncLocalStorage<ReactCacheScope>;
+/**
+ * One in-flight `cache.component` payload capture — a build-time entry or
+ * a request-time re-render. Scoped to the capture's async context so a
+ * concurrent request's render does not observe it.
+ */
+export interface PrebuiltCaptureStore {
+    /** The component being captured. */
+    outerId: string;
+    /**
+     * Props half of the captured entry's cache key (null when unkeyable).
+     * Rendering `outerId` again with this key is a cycle (TIM-1547).
+     */
+    outerPropsKey: string | null;
+    /** Wrapped components that rendered inside this capture, by component id. */
+    nested: Map<string, import('./prebuilt/capture-state.ts').NestedRecord>;
+}
+/** @internal — import via prebuilt/capture-state.ts */
+export declare const prebuiltCaptureAls: AsyncLocalStorage<PrebuiltCaptureStore>;
 //# sourceMappingURL=als-registry.d.ts.map

package/dist/server/als-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAA+C,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,sBAAsB,EAAE,aAAa,CAAC;CACvD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAAsC,CAAC;AAM5D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAAuC,CAAC;AAM9D,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAA6C,CAAC;AAM1E,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAAmE,CAAC;AAM7F,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAA8C,CAAC;AAM/E,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAuC,CAAC"}
+{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA0BrD,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAE7B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,QAAQ,EAAE,OAAO,YAAY,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC;QACxF,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;CACtD;AAMD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAA6D,CAAC;AAMnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAMtF,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAE3B,CAAC;AAMF,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAExB,CAAC;AAMF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAE/B,CAAC;AAMF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAmE,CAAC;AAM7F,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,yCAEhC,CAAC;AAOF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,OAAO,EAAE,OAAO,CAAC,CAAC;AAE1D,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,oCAE9B,CAAC;AAMF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,6BAA6B,EAAE,YAAY,CAAC,CAAC;CACzE;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,yCAE9B,CAAC"}

package/dist/server/body-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAejB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}
+{"version":3,"file":"body-limits.d.ts","sourceRoot":"","sources":["../../src/server/body-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAM3C,eAAO,MAAM,cAAc;aACzB,cAAc;aACd,cAAc;aACd,SAAS,EAAE,GAAG;CACN,CAAC;AAIX,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBlD;AAKD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,gBAAgB,GACvB,eAAe,CAoBjB;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAM/F"}