@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/dist/server/build-manifest.d.ts

@@ -33,8 +33,32 @@ export interface BuildManifest {
     modulepreload: Record<string, string[]>;
     /** Map from input file path to font assets used by that module. */
     fonts: Record<string, ManifestFontEntry[]>;
+    /**
+     * Cache-busting hashes for metadata route files (opengraph-image, etc.).
+     * Map from file path (relative to project root) to short content hash.
+     * In dev mode this is empty — a startup nonce is used instead.
+     */
+    metadataRouteHashes?: Record<string, string>;
+    /**
+     * Static request-dependency map from the Vite plugin's module-graph analysis.
+     * Map from segment entry file path to whether it's request-dependent.
+     * Used by buildSegmentInfo() for X-Timber-Segments in production.
+     */
+    requestDep?: Record<string, boolean>;
 }
-/** Empty build manifest used in dev mode. */
+/**
+ * Empty build manifest used in dev mode, and the single source of truth for
+ * what an empty manifest contains.
+ *
+ * `virtual:timber-build-manifest` serializes this constant into its generated
+ * source rather than restating it — one literal for the dev module, one for the
+ * production module's `globalThis.__TIMBER_BUILD_MANIFEST__ ?? …` fallback.
+ * They were three hand-written objects that had already drifted: this one and
+ * the dev literal were missing `requestDep` while the production fallback had
+ * it, so a reader who grepped the built bundle for `requestDep` found the one
+ * copy that mentioned it and read the fallback as the shipped map (TIM-1300).
+ * A field added here now reaches every copy.
+ */
 export declare const EMPTY_BUILD_MANIFEST: BuildManifest;
 /** Segment shape expected by collectRouteCss (matches ManifestSegmentNode). */
 interface SegmentWithFiles {
@@ -59,16 +83,6 @@ export declare function collectRouteCss(segments: SegmentWithFiles[], manifest:
  * via injectHead() before </head>.
  */
 export declare function buildCssLinkTags(cssUrls: string[]): string;
-/**
- * Generate a Link header value for CSS preload hints.
- *
- * Cloudflare CDN automatically converts Link headers with rel=preload
- * into 103 Early Hints responses. This avoids platform-specific 103
- * sending code.
- *
- * Example output: `</assets/root.css>; rel=preload; as=style, </assets/page.css>; rel=preload; as=style`
- */
-export declare function buildLinkHeaders(cssUrls: string[]): string;
 /**
  * Collect all font entries needed for a matched route's segment chain.
  *
@@ -83,21 +97,6 @@ export declare function collectRouteFonts(segments: SegmentWithFiles[], manifest
  * for font preloads even for same-origin resources per the spec).
  */
 export declare function buildFontPreloadTags(fonts: ManifestFontEntry[]): string;
-/**
- * Generate Link header values for font preload hints.
- *
- * Cloudflare CDN converts Link headers with rel=preload into 103 Early Hints.
- *
- * Example: `</fonts/inter.woff2>; rel=preload; as=font; crossorigin`
- */
-export declare function buildFontLinkHeaders(fonts: ManifestFontEntry[]): string;
-/**
- * Collect JS chunk URLs for a matched route's segment chain.
- *
- * Walks segments root → leaf, collecting the JS chunk for each layout
- * and page. Deduplicates while preserving order.
- */
-export declare function collectRouteJs(segments: SegmentWithFiles[], manifest: BuildManifest): string[];
 /**
  * Collect modulepreload URLs for a matched route's segment chain.
  *
@@ -112,9 +111,5 @@ export declare function collectRouteModulepreloads(segments: SegmentWithFiles[],
  * before they're needed, reducing waterfall latency for dynamic imports.
  */
 export declare function buildModulepreloadTags(urls: string[]): string;
-/**
- * Generate a <script type="module"> tag for a JS entry point.
- */
-export declare function buildEntryScriptTag(url: string): string;
 export {};
 //# sourceMappingURL=build-manifest.d.ts.map

package/dist/server/build-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;CAC5C;AAED,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,EAAE,aAKlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAEvE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAiB9F;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"build-manifest.d.ts","sourceRoot":"","sources":["../../src/server/build-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAOlC,CAAC;AAEF,+EAA+E;AAC/E,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAmB/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1D;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,iBAAiB,EAAE,CAmBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAOvE;AAID;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,QAAQ,EAAE,aAAa,GACtB,MAAM,EAAE,CAmBV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D"}

package/dist/server/canonicalize.d.ts

@@ -14,6 +14,16 @@ export type CanonicalizeResult = {
     ok: false;
     status: 400;
 };
+/**
+ * Encoded separators that produce a 400 rejection.
+ * %2f (/) and %5c (\) cause path-confusion attacks.
+ *
+ * Shared between the runtime canonicalizer and the build-time route scanner
+ * to ensure both enforce identical security rules. See design/13-security.md.
+ */
+export declare const ENCODED_SEPARATOR_RE: RegExp;
+/** Null byte — rejected. Shared with the route scanner. */
+export declare const NULL_BYTE_RE: RegExp;
 /**
  * Canonicalize a URL pathname.
  *

package/dist/server/canonicalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAW7F;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}

package/dist/server/chain-url-parts.d.ts

@@ -0,0 +1,82 @@
+/**
+ * How much of the URL a matched segment chain has consumed.
+ *
+ * One question — "which URL parts had been consumed by the time segment `i`
+ * rendered?" — asked by four things that must all agree:
+ *
+ * - the layout depth handed to `SegmentProvider` (`route-element-builder.ts`),
+ *   which `useSelectedLayoutSegment(s)` indexes the live pathname with;
+ * - `slotUrlParts`, which slices the destination pathname for slot matching;
+ * - `resolveSlotProps` and `skippable-prefix.ts`, which derive content keys
+ *   for slot skip decisions (TIM-1370).
+ *
+ * They were four separate `extractUrlParts(...).length` calls. That was fine
+ * while the answer was a plain walk, and stopped being fine when interception
+ * gave it a second term (TIM-1280): the fix landed on the layout depth alone
+ * and the other three kept the old walk, so a layout and the slots beside it
+ * disagreed about how deep they were. Hence one function, in its own module,
+ * rather than a helper on the side of whichever caller was fixed first.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { CoercedParams } from '../shared/param-value.ts';
+/**
+ * Extract raw URL path parts from a segment chain.
+ *
+ * Each dynamic segment consumed one URL part (its param value). Static
+ * segments consumed their own name. Groups are transparent. Catch-all segments
+ * consumed multiple parts (their param value is `string[]`).
+ *
+ * The root segment is named '' and consumes nothing, so it is skipped here
+ * rather than by each caller — callers that pass a chain including the root
+ * (interception anchoring, slot-skip slicing) would otherwise have to remember
+ * to filter it, and one that forgot would push an empty part and shift every
+ * subsequent index by one.
+ *
+ * Uses rawSegmentParams (pre-coercion) to get actual URL strings. Values are
+ * coerced to `String()` defensively in case a codec leaked a non-string value
+ * into the params map.
+ *
+ * Each node is read through `effectiveUrlSegment`, so an intercepting
+ * directory contributes the URL part it intercepts (`(.)item` → `item`,
+ * `(.)[id]` → the bound value). A children-path interception puts such a node
+ * in the *main* chain, and reading it directly would classify it as neither
+ * static nor param-bearing — it would contribute nothing, and every part after
+ * it would shift by one.
+ */
+export declare function extractUrlParts(segments: ManifestSegmentNode[], mainParams: CoercedParams): string[];
+/**
+ * The URL parts the chain has consumed through `index`, inclusive.
+ *
+ * For an ordinary chain this is just the walk. Two things make it more than
+ * that, and both are cases where a node stands for a different number of URL
+ * parts than itself:
+ *
+ * - A **catch-all** consumes as many parts as the request supplies, which the
+ *   walk already handles (its param value is an array).
+ * - An **interception with a climbing marker** intercepts a URL that starts
+ *   *above* its owner, so the owner's own URL segment — and any static
+ *   ancestor between the intercepted base and the owner — is not in the target
+ *   at all. `feed/(..)photo/[id]` at `/photo/42` still has `feed` in the
+ *   chain, and counting it puts everything after it off by one.
+ *
+ * So everything above the interception clamps to the anchor, and everything
+ * from it down counts forward from there. The owner chain is param-free by
+ * build-time rule and the intercepted base is a prefix of the owner's
+ * `urlPath`, so the target's leading `anchor` parts *are* the owner chain's
+ * leading `anchor` parts — which is what makes the clamped prefix real values
+ * rather than placeholders. For `(.)` the base is the owner's own path, so the
+ * clamp is a no-op and this reduces to the plain walk.
+ */
+export declare function consumedUrlParts(segments: ManifestSegmentNode[], index: number, match: RouteMatch): string[];
+/**
+ * The index in `match.segments` of a segment, or -1.
+ *
+ * Split out so the three slot call sites and the layout-depth one derive their
+ * slice point identically — `indexOf` plus `consumedUrlParts` — instead of
+ * each inlining the pair.
+ */
+export declare function consumedPartsThroughSegment(segment: ManifestSegmentNode, match: RouteMatch): string[];
+//# sourceMappingURL=chain-url-parts.d.ts.map

package/dist/server/chain-url-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-url-parts.d.ts","sourceRoot":"","sources":["../../src/server/chain-url-parts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAI9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,aAAa,GACxB,MAAM,EAAE,CA0BV;AAsBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAgBV;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,UAAU,GAChB,MAAM,EAAE,CAIV"}

package/dist/server/children-interception.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Children-path interception — the sibling layout swap (TIM-1280).
+ *
+ * The second shape interception has. An intercepting directory that is a
+ * direct child of an ordinary segment or route group renders *in place of*
+ * `children` for that directory's own layout chain:
+ *
+ * ```
+ * app/(landing)/layout.tsx
+ * app/(landing)/[artistSlug]/[year]/[month]/[day]/page.tsx      ← hard nav
+ * app/(browse)/layout.tsx
+ * app/(browse)/(...)[artistSlug]/[year]/[month]/[day]/page.tsx  ← soft nav from (browse)
+ * ```
+ *
+ * There is no overlay, no slot, and no `default.tsx`. Nothing is re-matched
+ * either — and that is the point. The modal shape re-matches
+ * `interceptingPrefix`, a URL, and route groups contribute nothing to a URL,
+ * so an owner like `app/(browse)/` serializes to "/" and re-matching it
+ * resolves through whichever group owns the canonical page. This resolver
+ * addresses the owner by **tree path** instead, which never collapses.
+ *
+ * The result is an ordinary `RouteMatch` whose chain runs
+ * `[…owner ancestors, interceptingNode, …its matched descendants]`. Every
+ * consumer downstream — `route-element-builder.ts`, access gates,
+ * middleware — sees a segment chain and needs to know nothing about
+ * interception. That is why this feature adds no rendering path: the chain
+ * *is* the feature.
+ *
+ * See design/07-routing.md §"Intercepting Routes".
+ */
+import type { RouteMatch } from './pipeline.ts';
+import { type ManifestSegmentNode } from './route-matcher.ts';
+/**
+ * Resolve a children-path interception to a complete route match.
+ *
+ * `interceptingScope` is the rewrite's own build-time field — the tree path of
+ * the directory that owns the interception. The pipeline has already
+ * established that the client's rendered tree passes through it; this
+ * translates it into the chain to render.
+ *
+ * Returns null when the scope names no directory in this manifest, or when no
+ * intercepting child of that directory matches the target. Both are fail-safe:
+ * the caller keeps the canonical target match, so the page the user gets is
+ * the one a hard navigation would have produced.
+ */
+export type InterceptedRouteMatcher = (targetPathname: string, interceptingScope: string) => RouteMatch | null;
+/** Build a children-path interception resolver over a runtime manifest. */
+export declare function createInterceptedRouteMatcher(root: ManifestSegmentNode): InterceptedRouteMatcher;
+//# sourceMappingURL=children-interception.d.ts.map

package/dist/server/children-interception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"children-interception.d.ts","sourceRoot":"","sources":["../../src/server/children-interception.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,cAAc,EAAE,MAAM,EACtB,iBAAiB,EAAE,MAAM,KACtB,UAAU,GAAG,IAAI,CAAC;AAEvB,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,mBAAmB,GAAG,uBAAuB,CA6BhG"}

package/dist/server/coalesce-tick.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Single-shot `setImmediate` coalescing primitive.
+ *
+ * Multiple synchronous `schedule()` calls within one event-loop tick
+ * result in exactly one `flush` invocation at the end of that tick.
+ * No recursive scheduling, no busy-wait, no polling loop.
+ *
+ * Both `createBufferedTransformStream` (Web) and
+ * `createNodeBufferedTransform` (Node) use this helper so the invariant
+ * — and this comment — live in one place.
+ *
+ * **Not a polling loop.** Uses a single-shot `setImmediate` per flush
+ * cycle — no recursive scheduling, no busy-wait. See design/02
+ * §"No Polling".
+ */
+export interface TickCoalescer {
+    /**
+     * Request a flush at the end of the current tick. If a flush is already
+     * scheduled, this is a no-op. Returns the pending promise (or undefined
+     * if the flush already fired and no new one has been scheduled).
+     */
+    schedule(): void;
+    /**
+     * The pending flush promise, if any. Callers (e.g. `flush()` in a
+     * TransformStream) can `await` this to wait for the scheduled flush
+     * to complete before closing the stream.
+     */
+    readonly pending: Promise<void> | undefined;
+    /**
+     * Cancel any pending scheduled flush and invoke the flush callback
+     * synchronously. Used by Node `Transform.flush()` which needs to
+     * drain the buffer immediately before calling back.
+     */
+    flushSync(): void;
+}
+/**
+ * Create a tick coalescer that calls `onFlush` at most once per tick.
+ */
+export declare function createTickCoalescer(onFlush: () => void): TickCoalescer;
+//# sourceMappingURL=coalesce-tick.d.ts.map

package/dist/server/coalesce-tick.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesce-tick.d.ts","sourceRoot":"","sources":["../../src/server/coalesce-tick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,IAAI,IAAI,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE5C;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,aAAa,CAgCtE"}

package/dist/server/compress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}

package/dist/server/cookie-context.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Cookie Context — per-request cookie API and on-the-wire helpers.
+ *
+ * Split out of `request-context.ts` (TIM-853) so the cookie subsystem
+ * — encoding contract, options grammar, parser, serializer, and RYW map
+ * — lives in one file. The headers/scope/params APIs
+ * stay in `request-context.ts` and call into this module via the
+ * exported helpers.
+ *
+ * See design/29-cookies.md for the encoding contract and read-your-own-
+ * writes semantics. See ONGOING_SECURITY.md H-3 (TIM-868) for the
+ * smuggling primitive that the encoding contract closes.
+ */
+import { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions } from '../cookies/validation.ts';
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
+/**
+ * Returns a cookie accessor for the current request.
+ *
+ * Available in middleware, access checks, server components, and server actions.
+ * Throws if called outside a request context (security principle #2: no global fallback).
+ *
+ * Read methods (.get, .has, .getAll) are always available and reflect
+ * read-your-own-writes from .set() calls in the same request.
+ *
+ * Mutation methods (.set, .delete, .clear) are only available in mutable
+ * contexts (middleware.ts, server actions, route.ts handlers). Calling them
+ * in read-only contexts (access.ts, server components) throws.
+ *
+ * This is the escape hatch for direct cookie jar operations. For typed
+ * cookie access, use `defineCookie()` instead.
+ *
+ * See design/29-cookies.md
+ */
+export declare function getCookieJar(): RequestCookies;
+/**
+ * Returns the value of a single cookie, or undefined if absent.
+ *
+ * @internal — not part of the public API. Use `defineCookie().get()` or `getCookieJar().get()` instead.
+ */
+export declare function getCookie(name: string): string | undefined;
+/**
+ * Per-call options for `getCookies().set()`. Extends the persistent
+ * `CookieOptions` (HTTP cookie attributes) with framework-only flags
+ * that are NOT serialized into the Set-Cookie header.
+ *
+ * The `raw` flag is the escape hatch for the auto-encoding contract.
+ * See design/29-cookies.md §"Encoding Contract".
+ */
+export interface SetCookieOptions extends CookieOptions {
+    /**
+     * Skip the framework's `encodeURIComponent` pass and store the value
+     * verbatim. The value is then validated against the strict RFC 6265
+     * §4.1.1 `cookie-octet` grammar — the H-3 smuggling primitive cannot
+     * sneak in via this opt-out.
+     *
+     * Use this when forwarding a cookie value that is already in its
+     * intended on-the-wire form (e.g. mirroring an upstream service's
+     * Set-Cookie). Default: `false` (auto-encode).
+     */
+    raw?: boolean;
+}
+/** Options for setting a cookie. See design/29-cookies.md. */
+export interface CookieOptions {
+    /** Domain scope. Default: omitted (current domain only). */
+    domain?: string;
+    /** URL path scope. Default: '/'. */
+    path?: string;
+    /** Expiration date. Mutually exclusive with maxAge. */
+    expires?: Date;
+    /** Max age in seconds. Mutually exclusive with expires. */
+    maxAge?: number;
+    /** Prevent client-side JS access. Default: true. */
+    httpOnly?: boolean;
+    /** Only send over HTTPS. Default: true. */
+    secure?: boolean;
+    /** Cross-site request policy. Default: 'lax'. */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
+    partitioned?: boolean;
+}
+/**
+ * Cookie accessor returned by `getCookies()`.
+ *
+ * Read methods are always available. Mutation methods throw in read-only
+ * contexts (access.ts, server components).
+ */
+export interface RequestCookies {
+    /** Get a cookie value by name. Returns undefined if not present. */
+    get(name: string): string | undefined;
+    /** Check if a cookie exists. */
+    has(name: string): boolean;
+    /** Get all cookies as an array of { name, value } pairs. */
+    getAll(): Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Number of cookies. */
+    readonly size: number;
+    /**
+     * Set a cookie. Only available in mutable contexts (middleware, actions,
+     * route handlers).
+     *
+     * The value is auto-encoded with `encodeURIComponent` so the on-the-wire
+     * bytes always satisfy RFC 6265 §4.1.1 cookie-octet — `cookies().get()`
+     * returns the same logical value the developer wrote. Pass `{ raw: true }`
+     * to skip the encoder; the raw path validates against the strict
+     * cookie-octet grammar instead. See design/29-cookies.md §"Encoding
+     * Contract" and ONGOING_SECURITY.md H-3 (TIM-868).
+     */
+    set(name: string, value: string, options?: SetCookieOptions): void;
+    /**
+     * Copy all `Set-Cookie` headers from a `Headers` object.
+     * Parses each header and forwards name, value, and all attributes
+     * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).
+     *
+     * Useful when forwarding cookies from an internal `fetch()` or auth handler:
+     * ```ts
+     * const response = await auth.handler(req);
+     * getCookies().then(c => c.setFromHeaders(response.headers));
+     * ```
+     */
+    setFromHeaders(headers: Headers): void;
+    /** Delete a cookie. Only available in mutable contexts. */
+    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
+    /** Delete all cookies. Only available in mutable contexts. */
+    clear(): void;
+    /** Serialize cookies as a Cookie header string. */
+    toString(): string;
+}
+/**
+ * Build a Map of cookie name → value reflecting the current request's
+ * read-your-own-writes state. Includes incoming cookies plus any
+ * mutations from getCookies().set() / getCookies().delete() in the same request.
+ *
+ * Used by SSR renderers to populate NavContext.cookies so that
+ * useCookie()'s server snapshot matches the actual response state.
+ *
+ * See design/29-cookies.md §"Read-Your-Own-Writes"
+ * See design/triage/TIM-441-cookie-api-triage.md §4
+ */
+export declare function getCookiesForSsr(): Map<string, string>;
+/**
+ * Collect all Set-Cookie headers from the cookie jar.
+ * Called by the framework at flush time to apply cookies to the response.
+ *
+ * Returns an array of serialized Set-Cookie header values.
+ */
+export declare function getSetCookieHeaders(): string[];
+//# sourceMappingURL=cookie-context.d.ts.map

package/dist/server/cookie-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-context.d.ts","sourceRoot":"","sources":["../../src/server/cookie-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;AAInF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,cAAc,CA0L7C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,2DAA2D;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,mDAAmD;IACnD,QAAQ,IAAI,MAAM,CAAC;CACpB;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAI9C"}

package/dist/server/cookie-parsing.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Cookie parsing and serialization helpers — pure string ↔ structure
+ * functions with no ALS dependency. Split out of `cookie-context.ts`
+ * (TIM-853) so the API surface and the wire-format codecs can each be
+ * read on their own.
+ *
+ * The functions in this module are total over arbitrary input. They
+ * never throw and never call `assertValid*` (the security validators
+ * live in the API surface — `cookie-context.ts` invokes them at every
+ * jar entry point so the smuggling-primitive invariant from TIM-868
+ * is enforced regardless of which path produced the bytes).
+ *
+ * Delegates to the `cookie` package (RFC 6265, dependency-free,
+ * browser-safe) for wire codecs. Adapts at the boundary to preserve
+ * timber's Map-based API and never-throw contract.
+ */
+import type { CookieEntry } from './als-registry.ts';
+import type { CookieOptions } from './cookie-context.ts';
+/**
+ * Parse a Cookie header string into a Map of name → value pairs.
+ * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
+ *
+ * Values are auto-decoded with `decodeURIComponent` so they round-trip
+ * losslessly with `getCookies().set()` (which auto-encodes). Malformed
+ * `%`-escapes from third-party cookies fall back to the raw byte sequence
+ * — the parser must be total over arbitrary inbound headers, including
+ * non-conforming values from other servers, browser extensions, etc.
+ */
+export declare function parseCookieHeader(header: string): Map<string, string>;
+/**
+ * Decode a single cookie value with `decodeURIComponent`, falling back to
+ * the raw byte sequence if the input contains a malformed `%`-escape.
+ *
+ * Used by both `parseCookieHeader` (incoming Cookie: header) and the
+ * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
+ * Total — never throws.
+ *
+ * cookie's internal decode has identical semantics but is not exported,
+ * so we keep this standalone helper.
+ */
+export declare function safeDecodeCookieValue(raw: string): string;
+/**
+ * Serialize a CookieEntry into a Set-Cookie header value.
+ *
+ * Total — never throws. If the cookie package's serializer rejects
+ * the input (e.g. non-integer maxAge, forbidden chars in name/value),
+ * falls back to a minimal hand-rolled serialization so the response
+ * path is never interrupted by a codec error.
+ */
+export declare function serializeCookieEntry(entry: CookieEntry): string;
+/**
+ * Parse a raw `Set-Cookie` header string into name, value, and options.
+ * Handles all standard attributes: Path, Domain, Max-Age, Expires,
+ * SameSite, Secure, HttpOnly, Partitioned.
+ *
+ * Does NOT apply DEFAULT_COOKIE_OPTIONS — the caller decides whether
+ * to merge defaults (e.g. `set()` does, but `setRaw()` should preserve
+ * the original header's intent).
+ */
+export declare function parseSetCookie(header: string): {
+    name: string;
+    value: string;
+    options: CookieOptions;
+} | null;
+//# sourceMappingURL=cookie-parsing.d.ts.map

package/dist/server/cookie-parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-parsing.d.ts","sourceRoot":"","sources":["../../src/server/cookie-parsing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAcrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0B/D;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,IAAI,CA8BhE"}

package/dist/server/csp-nonce.d.ts

@@ -0,0 +1,36 @@
+/**
+ * CSP nonce — per-request, generated on demand.
+ *
+ * timber emits several inline `<script>` tags per HTML response — React's
+ * bootstrap script and Fizz runtime, the Flight init/chunk scripts, the
+ * segment-tree script, and the post-flush noindex script. Under a strict
+ * `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every
+ * one of them needs the request's nonce or the browser refuses to run it.
+ *
+ * The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it
+ * in the CSP header it sets through `ctx.headers`. The first read generates
+ * the value and stores it on the request context; the render pipeline reads
+ * it back with `getCspNonce()` and stamps it on every inline script. A
+ * request whose middleware never reads `ctx.nonce` has no nonce, and its
+ * markup is byte-identical to a render without this feature. timber does
+ * not parse the CSP header — the app owns the policy, timber owns the
+ * markup, and `ctx.nonce` is the one value both are built from.
+ *
+ * `proxy.ts` cannot participate: it only sees the finished response from
+ * `next()`, after the markup exists.
+ *
+ * See design/13-security.md §"Content Security Policy" (TIM-1414).
+ */
+/**
+ * The request's CSP nonce, creating it on first call. Backs the
+ * `ctx.nonce` getter on `MiddlewareContext`. Outside a request context
+ * (tests, build-time rendering) a fresh value is returned but not
+ * retained, since there is no request for it to belong to.
+ */
+export declare function requestCspNonce(): string;
+/**
+ * The request's CSP nonce if middleware asked for one, else `undefined` —
+ * in which case the pipeline emits bare `<script>` tags.
+ */
+export declare function getCspNonce(): string | undefined;
+//# sourceMappingURL=csp-nonce.d.ts.map

package/dist/server/csp-nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-nonce.d.ts","sourceRoot":"","sources":["../../src/server/csp-nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgBH;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAEhD"}