@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/dist/server/route-matcher.d.ts

@@ -7,45 +7,34 @@
  *
  * See design/07-routing.md §"Request Lifecycle"
  */
-import type { RouteMatch } from './pipeline.js';
-import { type MetadataRouteType } from './metadata-routes.js';
+import type { RouteMatch } from './pipeline.ts';
+import type { MiddlewareFn } from './middleware-runner.ts';
+import type { SegmentNode, RouteTree } from '../routing/types.ts';
+import { type MetadataRouteType } from './metadata-routes.ts';
 /** A file reference in the manifest (lazy import + path). */
-interface ManifestFile {
+export interface ManifestFile {
     load: () => Promise<unknown>;
     filePath: string;
 }
-/** A segment node as it appears in the virtual:timber-route-manifest module. */
-export interface ManifestSegmentNode {
-    segmentName: string;
-    segmentType: 'static' | 'dynamic' | 'catch-all' | 'optional-catch-all' | 'group' | 'slot' | 'intercepting';
-    urlPath: string;
-    paramName?: string;
-    /** For intercepting segments: the marker used, e.g. "(.)". */
-    interceptionMarker?: '(.)' | '(..)' | '(...)' | '(..)(..)';
-    /** For intercepting segments: the segment name after stripping the marker. */
-    interceptedSegmentName?: string;
-    page?: ManifestFile;
-    layout?: ManifestFile;
-    middleware?: ManifestFile;
-    access?: ManifestFile;
-    route?: ManifestFile;
-    error?: ManifestFile;
-    default?: ManifestFile;
-    denied?: ManifestFile;
-    searchParams?: ManifestFile;
-    statusFiles?: Record<string, ManifestFile>;
-    jsonStatusFiles?: Record<string, ManifestFile>;
-    legacyStatusFiles?: Record<string, ManifestFile>;
-    prerender?: ManifestFile;
-    /** Metadata route files (sitemap.ts, robots.ts, icon.tsx, etc.) keyed by base name */
-    metadataRoutes?: Record<string, ManifestFile>;
-    children: ManifestSegmentNode[];
-    slots: Record<string, ManifestSegmentNode>;
-}
-/** The manifest shape from virtual:timber-route-manifest. */
-export interface ManifestRoot {
-    root: ManifestSegmentNode;
-    proxy?: ManifestFile;
+/**
+ * A segment node as it appears in the virtual:timber-route-manifest module.
+ *
+ * Type alias for `SegmentNode<ManifestFile>` — the same shape used by the
+ * scanner, only with lazy `load` functions instead of build-time extension
+ * metadata.
+ */
+export type ManifestSegmentNode = SegmentNode<ManifestFile>;
+/**
+ * The manifest shape from virtual:timber-route-manifest.
+ *
+ * Extends `RouteTree<ManifestFile>` with `viteRoot`, the absolute path
+ * to the Vite project root captured at build/load time. Used by dev-only
+ * features (e.g., dev error page frame classification) that need a
+ * correct project root even when CWD differs (e.g., monorepo custom root).
+ * See TIM-807 / TIM-808.
+ */
+export interface ManifestRoot extends RouteTree<ManifestFile> {
+    viteRoot: string;
 }
 /**
  * Create a route matcher function from a manifest.
@@ -54,6 +43,33 @@ export interface ManifestRoot {
  * or null if no route matches.
  */
 export declare function createRouteMatcher(manifest: ManifestRoot): (pathname: string) => RouteMatch | null;
+/**
+ * Collect middleware from a matched segment chain, root to leaf.
+ *
+ * Each entry is lazy-loaded via dynamic import on first invocation.
+ *
+ * Shared with the children-path interception resolver
+ * (`children-interception.ts`), which assembles a chain from the tree rather
+ * than from a pathname but produces the same kind of `RouteMatch` — every
+ * `middleware.ts` above an intercepted page must run exactly as it does for
+ * the canonical route.
+ */
+export declare function collectMiddlewareChain(chain: ManifestSegmentNode[]): MiddlewareFn[];
+/**
+ * Whether a matched chain renders as an API route: its leaf has a
+ * `route.ts` and no `page.tsx`. The same test `renderRoute` dispatches on,
+ * so every answer about a route's format — early hints, deny format, error
+ * format, error reporting — agrees with what actually ran.
+ */
+export declare function isApiRouteChain(segments: readonly ManifestSegmentNode[]): boolean;
+/**
+ * Whether a matched chain is a route.ts handler that opted out of the CSRF
+ * check with `export const csrf = false`. Keyed on the same leaf
+ * `isApiRouteChain` dispatches on, so the exemption can only ever apply to
+ * the route.ts that will actually run — never to a page, and so never to a
+ * server action. See design/08-forms-and-actions.md §"Per-route exemption".
+ */
+export declare function isCsrfExemptRoute(segments: readonly ManifestSegmentNode[]): boolean;
 /** Result of matching a metadata route. */
 export interface MetadataRouteMatch {
     /** The metadata route type (sitemap, robots, icon, etc.) */
@@ -69,15 +85,16 @@ export interface MetadataRouteMatch {
      * that should be served from disk rather than executed as a handler.
      */
     isStatic: boolean;
+    /** Extracted segment params from dynamic segments in the URL prefix. */
+    segmentParams: Record<string, string | string[]>;
 }
 /**
  * Create a metadata route matcher from a manifest.
  *
- * Walks the segment tree and builds a map from serve paths to handler modules.
- * Metadata routes are matched by exact pathname (e.g., /sitemap.xml, /blog/sitemap.xml).
+ * Uses dynamic tree matching to resolve metadata routes, supporting
+ * dynamic segments like /docs/[slug]/opengraph-image.
  *
  * See design/16-metadata.md §"Metadata Routes"
  */
 export declare function createMetadataRouteMatcher(manifest: ManifestRoot): (pathname: string) => MetadataRouteMatch | null;
-export {};
 //# sourceMappingURL=route-matcher.d.ts.map

package/dist/server/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAM9B,6DAA6D;AAC7D,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EACP,QAAQ,GACR,SAAS,GACT,WAAW,GACX,oBAAoB,GACpB,OAAO,GACP,MAAM,GACN,cAAc,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3D,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC5C;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AA4MD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAMjD"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAY9B,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,YAAY,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,YAAY,EAAE,CAcnF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GAAG,OAAO,CAGjF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GAAG,OAAO,CAEnF;AAID,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAClD;AAcD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAEjD"}

package/dist/server/route-module-loader.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Route module loading — loads layout, page, and access.ts modules from
+ * a matched route's segment chain in a single pass.
+ *
+ * Extracted from `route-element-builder.ts` to keep that file focused on
+ * element-tree construction.
+ *
+ * See design/02-rendering-pipeline.md, design/07-routing.md.
+ */
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { Metadata } from './types.ts';
+import { type LayoutComponentEntry } from './route-element-builder.ts';
+/** Metadata export from a layout or page module, with its segment context. */
+export interface MetadataSource {
+    metadataExport: Metadata | (() => Promise<Metadata>);
+    segmentName: string;
+    isPage: boolean;
+    segmentIndex: number;
+}
+/** Access function loaded from a segment's access.ts. */
+export type AccessFn = (() => unknown) | undefined;
+/** Result of the module-loading phase. */
+export interface LoadedRouteModules {
+    metadataSources: MetadataSource[];
+    layoutComponents: LayoutComponentEntry[];
+    PageComponent: (...args: unknown[]) => unknown;
+    deferSuspenseFor: number;
+    accessFns: Array<AccessFn>;
+}
+/**
+ * Load all route modules (layouts, page, access functions) in a single pass.
+ *
+ * Access functions are loaded eagerly here so the wrapping loop does not need
+ * to await `loadModule(segment.access)` at each iteration.
+ */
+export declare function loadRouteModules(segments: ManifestSegmentNode[], requestUrl: string): Promise<LoadedRouteModules>;
+//# sourceMappingURL=route-module-loader.d.ts.map

package/dist/server/route-module-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-module-loader.d.ts","sourceRoot":"","sources":["../../src/server/route-module-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC;AAEnD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;CAC5B;AAuDD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CA+D7B"}

package/dist/server/rsc-cache-key-guard.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Origin-side binding of the `_rsc` cache key to the request that produced
+ * the response (TIM-1268).
+ *
+ * The key is deterministic, and deliberately so — that is what makes RSC
+ * payloads cacheable. But deterministic also means *predictable*: anyone can
+ * compute the key another client will request. Without this guard, a caller
+ * could request `/about?_rsc=<victim's key>` while sending its own
+ * `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+ * environment this feature targets — would store that variant under the
+ * victim's key. Every subsequent legitimate navigation would then be served
+ * a payload rendered for someone else's segment tree or deployment.
+ *
+ * The guard is a *storability* rule, not a rejection: if the claimed key
+ * does not match the key derived from the received headers, the response
+ * loses its shared-cache directives. Mismatched requests are still served
+ * normally, they just cannot be stored for anyone else.
+ *
+ * Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+ * right, costs a round trip on every legitimate miss, and would make the
+ * server's behaviour depend on a parameter it otherwise never reads. This
+ * rule closes the same hole by making the poisoned entry unstorable at the
+ * source, in the response the developer already has to opt into sharing.
+ *
+ * See design/19-client-navigation.md §"The `_rsc` cache key".
+ */
+/**
+ * Whether the request's `_rsc` parameter matches the key derived from its
+ * own headers.
+ *
+ * Requests without the parameter are not claiming a key at all, so they are
+ * left alone — the bare document URL is the developer's declared territory
+ * (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+ * whose value could not be one of our digests: `_rsc` is not reserved, and
+ * an application that already uses it for its own search state
+ * (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+ * guard that mistook that for a forgery.
+ */
+export declare function hasValidRscCacheKey(req: Request): Promise<boolean>;
+/**
+ * Ensure a Flight payload can never be interpreted as a document.
+ *
+ * Applied here, at the pipeline's single exit, rather than where each
+ * payload response is built. Six places build one — the success path, three
+ * in `deny-renderer.ts`, the action paths — and hardening them one at a time
+ * is how you end up hardening five of six. The response is Flight if it says
+ * it is; that is the only test that covers every producer, including ones
+ * added later.
+ *
+ * Matters because the payload URL is observable and, on a shared-cache hit,
+ * the origin is never consulted — so a top-level navigation can be handed
+ * these bytes with no request-time check available. See design/13-security.md
+ * #36c.
+ */
+export declare function hardenRscPayloadResponse(response: Response): void;
+/**
+ * Make a response unstorable by any shared cache when its request claimed an
+ * `_rsc` key that does not match its own headers.
+ *
+ * The end state is unconditional and therefore statable: **a mismatched
+ * response is never stored by any cache.** Every targeted cache-control
+ * field is removed and `Cache-Control` is replaced outright, rather than
+ * downgrading only when a shared directive is spotted. Conditional variants
+ * of this were tried and were wrong twice over — they missed the CDN-
+ * specific headers, and leaving `Cache-Control` alone when it looked
+ * harmless lets a CDN apply heuristic caching to a response that has none.
+ *
+ * The cost is that a mismatched request loses developer-chosen *browser*
+ * caching too. That is a request no timber client ever makes.
+ *
+ * Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+ * they address stored entries, and this response is not stored.
+ *
+ * Mutates `response.headers` in place; the pipeline guarantees mutable
+ * headers at this point (see TIM-866).
+ */
+export declare function enforceRscCacheKey(req: Request, response: Response): Promise<void>;
+//# sourceMappingURL=rsc-cache-key-guard.d.ts.map

package/dist/server/rsc-cache-key-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-cache-key-guard.d.ts","sourceRoot":"","sources":["../../src/server/rsc-cache-key-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgCxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAGjE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxF"}

package/dist/server/rsc-entry/action-dispatcher.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Server action dispatcher — the `dispatchAction` callback for
+ * `PipelineConfig`.
+ *
+ * Extracted from rsc-entry/index.ts so the wiring can be unit-tested in
+ * isolation from Vite's virtual modules.
+ *
+ * `createPipeline` calls it after proxy.ts runs (TIM-1213), so proxy.ts
+ * sees action POSTs — "proxy.ts runs on every request, no exclusions." It
+ * encapsulates action detection, the route-type check, action handler
+ * dispatch, and the no-JS validation rerender path.
+ *
+ * The CSRF gate is not here: it runs in `createPipeline` before proxy.ts
+ * (`csrfGate` in pipeline-helpers.ts). The action handler repeats the
+ * check as defense-in-depth, with no per-route exemption.
+ *
+ * Per-segment `middleware.ts` does NOT run on action POSTs (TIM-1134).
+ * Actions are dispatched by action ID, not by route segment. Per-action
+ * auth/validation belongs in `createActionClient({ middleware })`.
+ */
+import type { BodyLimitsConfig } from '../body-limits.ts';
+import type { CsrfConfig } from '../csrf.ts';
+import type { RouteMatcher } from '../pipeline.ts';
+import type { SensitiveFieldsOption } from '../sensitive-fields.ts';
+import type { RevalidateRenderer } from '../actions.ts';
+/**
+ * Build a `RevalidateRenderer` for a specific request.
+ *
+ * The renderer needs to forward cookies/headers from the originating
+ * request when fetching the revalidated route. We pass the request in
+ * via a builder so the wrapper doesn't need to know about route matching,
+ * segment param coercion, or element building — those concerns stay in
+ * `rsc-entry/index.ts`.
+ */
+export type RevalidateRendererFactory = (req: Request) => RevalidateRenderer;
+/** Dependencies for the action dispatcher (used inside the pipeline). */
+export interface ActionDispatcherDeps {
+    /** CSRF configuration — defense-in-depth check inside the action handler. */
+    csrfConfig: CsrfConfig;
+    /** Body size limits forwarded to `handleActionRequest`. */
+    bodyLimits?: BodyLimitsConfig['limits'];
+    /** Sensitive-field deny-list forwarded to `handleActionRequest`. */
+    sensitiveFields?: SensitiveFieldsOption;
+    /** Per-request factory that builds a `RevalidateRenderer`. */
+    buildRevalidateRenderer: RevalidateRendererFactory;
+    /**
+     * Route matcher — used for the route-type check that skips action
+     * detection on `route.ts` API handlers (TIM-870). Required: without it,
+     * every form POST to a route.ts would enter the action handler, whose
+     * CSRF check has no per-route exemption, and a `csrf = false` route
+     * would 403 its cross-site callbacks.
+     */
+    matchRoute: RouteMatcher;
+}
+/**
+ * Build the `dispatchAction` callback for `PipelineConfig`.
+ *
+ * Called after proxy.ts runs (inside the pipeline) for every request.
+ * Checks if the request is a server action POST, handles the route-type
+ * check (TIM-870), dispatches to the action handler, and handles the
+ * no-JS validation rerender path.
+ *
+ * Returns `Response` if the request was handled as an action, `null` to
+ * fall through to normal routing.
+ */
+export declare function buildActionDispatcher(deps: ActionDispatcherDeps): (req: Request, canonicalPath: string, reenter: (req: Request, cookies: Map<string, string>) => Promise<Response>) => Promise<Response | null>;
+//# sourceMappingURL=action-dispatcher.d.ts.map

package/dist/server/rsc-entry/action-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-dispatcher.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/action-dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,kBAAkB,CAAC;AAE7E,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,UAAU,EAAE,UAAU,CAAC;IACvB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,oEAAoE;IACpE,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,8DAA8D;IAC9D,uBAAuB,EAAE,yBAAyB,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,EAAE,YAAY,CAAC;CAC1B;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,oBAAoB,GACzB,CACD,GAAG,EAAE,OAAO,EACZ,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,KACvE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0D5B"}

package/dist/server/rsc-entry/action-middleware-runner.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Middleware runner for revalidation — runs a route's `middleware.ts`
+ * chain inside its own `runWithRequestContext` scope and returns a
+ * `MiddlewareOutcome` value the caller can translate.
+ *
+ * Used by the revalidation renderer (TIM-996) to run the TARGET route's
+ * middleware before building the revalidated element tree, ensuring that
+ * `revalidatePath('/admin')` from a public action honors admin's auth.
+ *
+ * NOT used for action dispatch itself — per-segment middleware does not
+ * run on action POSTs (TIM-1134). Actions are dispatched by action ID,
+ * not route segment, so `proxy.ts` and `createActionClient({ middleware })`
+ * are the correct auth mechanisms.
+ *
+ * The function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. Failure modes are encoded as
+ * outcome variants rather than thrown so the caller never has to wrap
+ * this in try/catch.
+ */
+import { DenySignal, RedirectSignal } from '../primitives.ts';
+import type { RouteMatch } from '../pipeline.ts';
+import type { ReactCacheScope } from '../react-cache-scope.ts';
+/**
+ * Outcome of running a route's middleware chain, surfaced from the inner
+ * `runWithRequestContext` scope as a value. Its one consumer is the
+ * revalidation renderer, which turns every variant but `continue` into
+ * a thrown signal or a dropped revalidation.
+ *
+ * Only `continue` carries state out of the scope: the request-header
+ * overlay, which the renderer applies to the action's scope so the
+ * revalidated tree sees middleware-injected headers. Cookies the chain sets
+ * stay in the inner scope and are discarded with it; see the renderer's
+ * docstring for why.
+ */
+export type MiddlewareOutcome = {
+    kind: 'continue';
+    overlay: Headers;
+} | {
+    kind: 'short-circuit';
+    response: Response;
+} | {
+    kind: 'redirect';
+    signal: RedirectSignal;
+} | {
+    kind: 'deny';
+    signal: DenySignal;
+} | {
+    kind: 'error';
+    error: unknown;
+};
+/** The inner request scope's inputs, besides the request itself. */
+export interface MiddlewareScope {
+    /** The `React.cache` scope the revalidated tree will render in. */
+    reactCacheScope: ReactCacheScope;
+    /** The action's post-mutation cookies, as the inner scope's cookies. */
+    cookies?: Map<string, string>;
+}
+/**
+ * Run the matched route's middleware chain inside a fresh request-context
+ * scope, captured as a `MiddlewareOutcome` value.
+ *
+ * `match` must already carry coerced segment params: coercion runs before
+ * middleware, in the caller, as it does in the page pipeline.
+ */
+export declare function runMiddlewareForAction(req: Request, match: RouteMatch, { reactCacheScope, cookies }: MiddlewareScope): Promise<MiddlewareOutcome>;
+//# sourceMappingURL=action-middleware-runner.d.ts.map

package/dist/server/rsc-entry/action-middleware-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-middleware-runner.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/action-middleware-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,eAAe,EAAE,eAAe,CAAC;IACjC,wEAAwE;IACxE,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,eAAe,GAC5C,OAAO,CAAC,iBAAiB,CAAC,CAyD5B"}

package/dist/server/rsc-entry/api-handler.d.ts

@@ -4,8 +4,24 @@
  * Runs access.ts standalone for all segments in the chain (no React render
  * pass, no AccessGate component). Then dispatches to the route handler.
  * See design/04-authorization.md §"Auth in API Routes".
+ *
+ * Nothing thrown here is answered here. A `deny()` or `redirect()` from
+ * `access.ts` or a method handler, and every other error, propagates to the
+ * pipeline: its deny fallback answers a route.ts match in the JSON status
+ * format, its redirect builder sends the 3xx, and its error outcome answers
+ * errors in the same JSON format. There is one translator for each, not one
+ * per route type (TIM-1537, TIM-1533).
+ */
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+/**
+ * Handle a `route.ts` request.
+ *
+ * Segment-param coercion has already run (in pipeline-phases.ts), and the
+ * coerced values + raw URLSearchParams are seeded into the request-context
+ * ALS — so `segmentParams.get()` / `searchParams.get()` work inside
+ * `middleware.ts`, `access.ts`, and the HTTP method handler. This function
+ * only runs the access chain and dispatches; it does not duplicate the
+ * coercion or ALS setup the pipeline already performed.
  */
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-export declare function handleApiRoute(req: Request, match: RouteMatch, segments: ManifestSegmentNode[], responseHeaders: Headers): Promise<Response>;
+export declare function handleApiRoute(req: Request, segments: ManifestSegmentNode[], responseHeaders: Headers): Promise<Response>;
 //# sourceMappingURL=api-handler.d.ts.map

package/dist/server/rsc-entry/api-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-handler.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyDnB"}
+{"version":3,"file":"api-handler.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAO/D;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,QAAQ,CAAC,CA0CnB"}

package/dist/server/rsc-entry/deny-fallback.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Deny fallback renderer — renders the deny page (403.tsx, 404.tsx, etc.)
+ * for DenySignals that escape from proxy, middleware, or the render phase,
+ * and the 404 page for a URL no route matches.
+ *
+ * This is the one module that assembles deny pages. Renderers report a
+ * captured deny by rethrowing it; the pipeline's outcome translator calls
+ * this. See design/49-explicit-subsystem-boundaries.md §"C".
+ *
+ * Extracted from index.ts (TIM-968) as a pure move. The factory captures
+ * the root segment and client bootstrap config once at handler creation;
+ * the returned function is wired into `PipelineConfig.renderDenyFallback`.
+ *
+ * Design docs: 04-authorization.md, 10-error-handling.md
+ */
+import type { DefaultPageRenderer } from '../deny-renderer.ts';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { RouteMatch } from '../pipeline.ts';
+import type { DenySignal } from '../primitives.ts';
+import { type ManifestSegmentNode } from '../route-matcher.ts';
+/**
+ * Create the pipeline's deny fallback renderer.
+ *
+ * When the pipeline already matched a route (the common case — matching
+ * runs before middleware and rendering), resolve the status file against
+ * the matched chain so colocated files like a nested `403.tsx` or an API
+ * route's `401.json` are picked up. Fall back to the root chain when no
+ * match is available (e.g. proxy-stage deny before route matching).
+ * See TIM-822, design/04-authorization.md, design/10-error-handling.md.
+ *
+ * The page is clamped to the denied segment exactly as the renderer clamps a
+ * captured deny: the index an AccessGate or layout recorded in request ALS
+ * bounds the status-file walk and the layout shell, so a thrown deny never
+ * selects a status file below the denial or runs the denied segment's
+ * layout. It is read here, at call time, rather than passed by the pipeline:
+ * the store is RSC-owned and the pipeline does not know it exists.
+ *
+ * The index is a position in the matched chain, so it is applied only when
+ * there is one. A proxy-phase deny arrives with no match (root-only chain),
+ * and one thrown after `await next()` shares the request store with the
+ * render it replaced — that render's denied index describes a different
+ * deny and must not clamp this one. A middleware-phase deny runs before
+ * render, so no index has been recorded. See TIM-1525, design/49-explicit-subsystem-boundaries.md §P0.
+ */
+export declare function createDenyFallbackRenderer(options: {
+    rootSegment: ManifestSegmentNode;
+    clientBootstrap: ClientBootstrapConfig;
+}): DenyFallbackRenderer;
+/**
+ * The deny fallback. `defaultPage` replaces the framework default status
+ * page when no status file answers — the dev 404 route listing for an
+ * unmatched URL.
+ */
+export type DenyFallbackRenderer = (deny: DenySignal, req: Request, responseHeaders: Headers, matchedRoute?: RouteMatch, defaultPage?: DefaultPageRenderer) => Promise<Response>;
+//# sourceMappingURL=deny-fallback.d.ts.map

package/dist/server/rsc-entry/deny-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-fallback.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/deny-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAKhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,mBAAmB,CAAC;IACjC,eAAe,EAAE,qBAAqB,CAAC;CACxC,GAAG,oBAAoB,CAiFvB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,YAAY,CAAC,EAAE,UAAU,EACzB,WAAW,CAAC,EAAE,mBAAmB,KAC9B,OAAO,CAAC,QAAQ,CAAC,CAAC"}

package/dist/server/rsc-entry/error-renderer.d.ts

@@ -1,30 +1,44 @@
 /**
- * RSC Error & No-Match Renderers — handles error pages and 404s.
+ * RSC Error Renderer — handles error pages. (The 404 page for an unmatched
+ * URL is a deny page, assembled by `deny-fallback.ts`.)
  *
- * Renders error.tsx / status files and 404 pages through the RSC → SSR pipeline.
+ * Error pages are 'use client' components rendered through the RSC → SSR
+ * pipeline: the Error is converted to SerializableError, wrapped with
+ * ErrorReconstituter to reconstitute a real Error on the client.
+ *
+ * Design docs: 10-error-handling.md §"Three-Tier Error Page Rendering"
  */
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import type { LayoutEntry } from '#/server/deny-renderer.js';
+import type { RouteMatch } from '../pipeline.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { LayoutEntry } from '../deny-renderer.ts';
 /**
- * Render an error page for unhandled throws or RenderError outside Suspense.
- *
- * Walks the segment chain from leaf to root looking for:
- *   1. Specific status file (e.g. 503.tsx) matching the error's status
- *   2. 5xx.tsx category catch-all
- *   3. error.tsx
- *
- * Renders the found component with { error, digest, reset } props
- * wrapped in layouts, with the correct HTTP status code.
+ * A manifest file reference with lazy import and path.
+ * Mirrors the shape from ManifestSegmentNode but kept local to avoid
+ * exporting internal types from route-matcher.
  */
-export declare function renderErrorPage(error: unknown, status: number, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig): Promise<Response>;
+export interface GlobalErrorFile {
+    load: () => Promise<unknown>;
+    filePath: string;
+}
 /**
- * Render a 404 page for URLs that don't match any route.
+ * Render an error page for an unhandled throw outside Suspense.
+ *
+ * All error pages (TSX and MDX) go through RSC → SSR:
+ * - TSX: ErrorReconstituter wrapper converts SerializableError → real Error
+ * - MDX: Plain props ({ status }), no wrapper needed
  *
- * Uses the root segment's 404.tsx (or 4xx.tsx / error.tsx fallback)
- * wrapped in the root layout, via the same renderDenyPage path
- * used for in-route deny() calls.
+ * ...except for a client-navigation request, which gets the hard-navigate
+ * envelope instead. Every tier below produces an HTML document, and the
+ * client's Flight decoder is waiting for `text/x-component`; handing it HTML
+ * crashes the decode. The check lives here rather than at the call sites
+ * because it holds for every one of them, and the deny path's equivalent split
+ * (the deny fallback's page / Flight branches) had already been forgotten at one
+ * of this function's — a since-deleted synchronous render-error exit in
+ * `render-route.ts` (TIM-1322). Neither remaining caller is reachable for an
+ * RSC request today (`render-route.ts` returns the payload before it reaches
+ * SSR, and `outcomeToResponse` answers RSC errors itself), so this guards
+ * against drift rather than firing on a live path.
  */
-export declare function renderNoMatchPage(req: Request, rootSegment: ManifestSegmentNode, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig): Promise<Response>;
+export declare function renderErrorPage(error: unknown, status: number, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, globalError?: GlobalErrorFile, firstDeniedIndex?: number): Promise<Response>;
 //# sourceMappingURL=error-renderer.d.ts.map

package/dist/server/rsc-entry/error-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/error-renderer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAK7D;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,GACrC,OAAO,CAAC,QAAQ,CAAC,CA6FnB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,GACrC,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}
+{"version":3,"file":"error-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/error-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAcvD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AA+GD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,WAAW,CAAC,EAAE,eAAe,EAC7B,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA6DnB"}