@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/src/server/request-context.ts

@@ -1,230 +1,295 @@
 /**
- * Request Context — per-request ALS store for headers() and cookies().
+ * Request Context — per-request ALS store for headers, search params,
+ * segment params, and request scope lifecycle.
  *
  * Follows the same pattern as tracing.ts: a module-level AsyncLocalStorage
  * instance, public accessor functions that throw outside request scope,
  * and a framework-internal `runWithRequestContext()` to establish scope.
  *
+ * Cookie state lives in `cookie-context.ts` (split out in TIM-853). The
+ * scope set up here owns the cookie jar / parsedCookies fields on the
+ * store, but the cookie API and helpers are in the cookie module.
+ *
  * See design/04-authorization.md §"AccessContext does not include cookies or headers"
  * and design/11-platform.md §"AsyncLocalStorage".
- * See design/29-cookies.md for cookie mutation semantics.
  */
 
-import { createHmac, timingSafeEqual } from 'node:crypto';
-import type { Routes } from '#/index.js';
-import { requestContextAls, type RequestContextStore, type CookieEntry } from './als-registry.js';
-import { isDebug } from './debug.js';
+import type { CoercedParams } from '../shared/param-value.ts';
+import { requestContextAls, type RequestContextStore } from './als-registry.ts';
+import { _setGetSearchParamsFn, _setGetSegmentParamsFn } from '../shared/als-slots.ts';
+import { appVisibleSearch } from '../shared/rsc-cache-key.ts';
+import {
+  mergeSlotParams,
+  resolveSegmentParams,
+  type SlotParamsRecord,
+} from '../shared/slot-params.ts';
+import { isDebug } from './debug.ts';
+import { runWithReactCacheScope, type ReactCacheScope } from './react-cache-scope.ts';
 
 // Re-export the ALS for framework-internal consumers that need direct access.
 export { requestContextAls };
 
-// No fallback needed — we use enterWith() instead of run() to ensure
-// the ALS context persists for the entire request lifecycle including
-// async stream consumption by React's renderToReadableStream.
-
-// ─── Cookie Signing Secrets ──────────────────────────────────────────────
+// ─── Public API ───────────────────────────────────────────────────────────
 
 /**
- * Module-level cookie signing secrets. Index 0 is the newest (used for signing).
- * All entries are tried for verification (key rotation support).
+ * Returns a read-only view of the current request's headers.
  *
- * Set by the framework at startup via `setCookieSecrets()`.
- * See design/29-cookies.md §"Signed Cookies"
+ * Available in middleware, access checks, server components, and server actions.
+ * Throws if called outside a request context (security principle #2: no global fallback).
  */
-let _cookieSecrets: string[] = [];
+export function getHeaders(): ReadonlyHeaders {
+  const store = requestContextAls.getStore();
+  if (!store) {
+    throw new Error(
+      '[timber] getHeaders() called outside of a request context. ' +
+        'It can only be used in middleware, access checks, server components, and server actions.'
+    );
+  }
+
+  return store.headers;
+}
 
 /**
- * Configure the cookie signing secrets.
+ * Returns the value of a single request header, or undefined if absent.
  *
- * Called by the framework during server initialization with values from
- * `cookies.secret` or `cookies.secrets` in timber.config.ts.
+ * Thin wrapper over `getHeaders().get(name)` for the common case where
+ * you need exactly one header.
  *
- * The first secret (index 0) is used for signing new cookies.
- * All secrets are tried for verification (supports key rotation).
+ * @internal — not part of the public API. Use `getHeaders().get(name)` instead.
  */
-export function setCookieSecrets(secrets: string[]): void {
-  _cookieSecrets = secrets.filter(Boolean);
+export function getHeader(name: string): string | undefined {
+  const headers = getHeaders();
+  return headers.get(name) ?? undefined;
 }
 
-// ─── Public API ───────────────────────────────────────────────────────────
-
 /**
- * Returns a read-only view of the current request's headers.
+ * Returns the current request's raw URLSearchParams.
  *
- * Available in middleware, access checks, server components, and server actions.
- * Throws if called outside a request context (security principle #2: no global fallback).
+ * @internal — not part of the public API. Use `defineSearchParams().get()` instead.
  */
-export function headers(): ReadonlyHeaders {
+export function getSearchParams(): URLSearchParams {
   const store = requestContextAls.getStore();
   if (!store) {
     throw new Error(
-      '[timber] headers() called outside of a request context. ' +
+      '[timber] getSearchParams() called outside of a request context. ' +
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
-  return store.headers;
+
+  return store.searchParams;
 }
 
+// Eagerly register getSearchParams with the search-params module so
+// searchParams.get() can call it without a dynamic import.
+// Dynamic imports lose ALS context in React's RSC Flight renderer,
+// breaking getSearchParams() in parallel slot pages. See TIM-523.
+_setGetSearchParamsFn(getSearchParams);
+
+// Eagerly register getSegmentParams with the segment-params module so
+// segmentParams.get() can call it without a dynamic import.
+// Same pattern as search params — dynamic imports lose ALS context. See TIM-523.
+_setGetSegmentParamsFn(getSegmentParams);
+
 /**
- * Returns a cookie accessor for the current request.
- *
- * Available in middleware, access checks, server components, and server actions.
- * Throws if called outside a request context (security principle #2: no global fallback).
+ * Returns the current request's coerced segment params.
  *
- * Read methods (.get, .has, .getAll) are always available and reflect
- * read-your-own-writes from .set() calls in the same request.
+ * The optional `segmentPath` argument exists only for TypeScript narrowing —
+ * it does not affect the runtime return value. Pass a segment path
+ * (e.g. `'/(browse)/[artistSlug]/[year]'`) to narrow the return type to the
+ * exact params shape for that segment.
  *
- * Mutation methods (.set, .delete, .clear) are only available in mutable
- * contexts (middleware.ts, server actions, route.ts handlers). Calling them
- * in read-only contexts (access.ts, server components) throws.
+ * Without an argument, returns all coerced params with optional types.
  *
- * See design/29-cookies.md
+ * See design/41-global-params.md §Function Signatures
  */
-export function cookies(): RequestCookies {
+export function getSegmentParams(segmentPath?: string): CoercedParams {
   const store = requestContextAls.getStore();
   if (!store) {
     throw new Error(
-      '[timber] cookies() called outside of a request context. ' +
+      '[timber] getSegmentParams() called outside of a request context. ' +
         'It can only be used in middleware, access checks, server components, and server actions.'
     );
   }
-
-  // Parse cookies lazily on first access
-  if (!store.parsedCookies) {
-    store.parsedCookies = parseCookieHeader(store.cookieHeader);
+  if (!store.segmentParams) {
+    throw new Error(
+      '[timber] getSegmentParams() called before route matching completed. ' +
+        'Segment params are not available until after the route is matched.'
+    );
   }
 
-  const map = store.parsedCookies;
-  return {
-    get(name: string): string | undefined {
-      return map.get(name);
-    },
-    has(name: string): boolean {
-      return map.has(name);
-    },
-    getAll(): Array<{ name: string; value: string }> {
-      return Array.from(map.entries()).map(([name, value]) => ({ name, value }));
-    },
-    get size(): number {
-      return map.size;
-    },
+  // Parallel slots may derive a param the main route never had, or the same
+  // name with a different type (catch-all [...year] → string[] vs dynamic
+  // [year] → string). `resolveSegmentParams` is the shared definition the
+  // client's useSegmentParams() also reads, so the two halves of one
+  // documented API cannot drift (TIM-1285).
+  const slotResolved = resolveSegmentParams(store.segmentParams, store.slotParams, segmentPath);
+  if (slotResolved !== store.segmentParams) return slotResolved;
+
+  // Dev-mode validation: warn when the segment path expects dynamic
+  // segments that don't exist on the actual matched segment. This catches
+  // bugs like passing a child segment's $segment to a parent layout.
+  // Skip for slot paths — they're validated against their own chain.
+  // See design/41-global-params.md §Runtime Validation
+  if (segmentPath && isDebug() && store.matchedSegmentPath) {
+    const expected = extractDynamicSegments(segmentPath);
+    const actual = extractDynamicSegments(store.matchedSegmentPath);
+    const missing = expected.filter((s) => !actual.includes(s));
+
+    if (missing.length > 0) {
+      console.warn(
+        `[timber] getSegmentParams('${segmentPath}') called but current segment is '${store.matchedSegmentPath}'\n` +
+          `  Missing params: ${missing.join(', ')}\n` +
+          `  These will be undefined at runtime despite the type annotation.`
+      );
+    }
+  }
 
-    getSigned(name: string): string | undefined {
-      const raw = map.get(name);
-      if (!raw || _cookieSecrets.length === 0) return undefined;
-      return verifySignedCookie(raw, _cookieSecrets);
-    },
+  return store.segmentParams;
+}
 
-    set(name: string, value: string, options?: CookieOptions): void {
-      assertMutable(store, 'set');
-      if (store.flushed) {
-        if (isDebug()) {
-          console.warn(
-            `[timber] warn: cookies().set('${name}') called after response headers were committed.\n` +
-              `  The cookie will NOT be sent. Move cookie mutations to middleware.ts, a server action,\n` +
-              `  or a route.ts handler.`
-          );
-        }
-        return;
-      }
-      let storedValue = value;
-      if (options?.signed) {
-        if (_cookieSecrets.length === 0) {
-          throw new Error(
-            `[timber] cookies().set('${name}', ..., { signed: true }) requires ` +
-              `cookies.secret or cookies.secrets in timber.config.ts.`
-          );
-        }
-        storedValue = signCookieValue(value, _cookieSecrets[0]);
-      }
-      const opts = { ...DEFAULT_COOKIE_OPTIONS, ...options };
-      store.cookieJar.set(name, { name, value: storedValue, options: opts });
-      // Read-your-own-writes: update the parsed cookies map with the signed value
-      // so getSigned() can verify it in the same request
-      map.set(name, storedValue);
-    },
+/**
+ * Set the segment params on the current request context.
+ * Called by the pipeline after route matching and param coercion.
+ *
+ * @internal — framework use only
+ */
+export function setSegmentParams(params: CoercedParams): void {
+  const store = requestContextAls.getStore();
+  if (!store) {
+    throw new Error('[timber] setSegmentParams() called outside of a request context.');
+  }
+  store.segmentParams = params;
+}
 
-    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void {
-      assertMutable(store, 'delete');
-      if (store.flushed) {
-        if (isDebug()) {
-          console.warn(
-            `[timber] warn: cookies().delete('${name}') called after response headers were committed.\n` +
-              `  The cookie will NOT be deleted. Move cookie mutations to middleware.ts, a server action,\n` +
-              `  or a route.ts handler.`
-          );
-        }
-        return;
-      }
-      const opts: CookieOptions = {
-        ...DEFAULT_COOKIE_OPTIONS,
-        ...options,
-        maxAge: 0,
-        expires: new Date(0),
-      };
-      store.cookieJar.set(name, { name, value: '', options: opts });
-      // Remove from read view
-      map.delete(name);
-    },
+/**
+ * Store per-slot coerced segment params in the current request context.
+ * Called by the route element builder when resolving parallel slots.
+ *
+ * @param segmentPath — The slot's full tree path (e.g. '/(browse)/@shows/[artistSlug]/[...year]')
+ * @param params — The slot's coerced segment params
+ * @internal — framework use only
+ */
+export function setSlotParams(segmentPath: string, params: CoercedParams): void {
+  const store = requestContextAls.getStore();
+  if (!store) return; // non-throwing — optional diagnostic
+  if (!store.slotParams) store.slotParams = Object.create(null) as SlotParamsRecord;
+  store.slotParams[segmentPath] = params;
+}
 
-    clear(): void {
-      assertMutable(store, 'clear');
-      if (store.flushed) return;
-      // Delete every incoming cookie
-      for (const name of Array.from(map.keys())) {
-        store.cookieJar.set(name, {
-          name,
-          value: '',
-          options: { ...DEFAULT_COOKIE_OPTIONS, maxAge: 0, expires: new Date(0) },
-        });
-      }
-      map.clear();
+/**
+ * Run `fn` with the segment params a parallel slot's own chain produced, so
+ * a no-arg `getSegmentParams()` inside that slot returns the slot's params
+ * rather than the main route's.
+ *
+ * ALS is the only channel available: the slot's page and layouts are plain
+ * components that receive no params prop and cannot know their own tree
+ * path, so they have no way to ask for the keyed overload. The slot resolver
+ * invokes each of them itself (page through `SafeSlotPage`, layouts and
+ * access functions through their wrappers), and this scopes those calls.
+ *
+ * The store is wrapped in a Proxy rather than cloned. Everything a slot
+ * renders can write to the *live* request store — `setDenyStatus` from an
+ * access gate, cookie writes, the flush flag — and a clone would silently
+ * strand those writes in a copy the pipeline never reads. Only the two
+ * params fields are shadowed; every other read and every write passes
+ * straight through to the real store.
+ *
+ * Returns `fn()`'s result unchanged, and no-ops outside a request context or
+ * before route matching has set the main params. See TIM-1283.
+ *
+ * @internal — framework use only
+ */
+export function runWithSlotSegmentParams<T>(
+  slotSegmentPath: string | undefined,
+  slotParams: CoercedParams,
+  fn: () => T
+): T {
+  const store = requestContextAls.getStore();
+  if (!store?.segmentParams) return fn();
+
+  const merged = mergeSlotParams(store.segmentParams, slotParams);
+  const matchedSegmentPath = slotSegmentPath ?? store.matchedSegmentPath;
+  const scoped = new Proxy(store, {
+    get(target, prop, receiver) {
+      if (prop === 'segmentParams') return merged;
+      if (prop === 'matchedSegmentPath') return matchedSegmentPath;
+      return Reflect.get(target, prop, receiver);
     },
+  });
+  return requestContextAls.run(scoped, fn);
+}
 
-    toString(): string {
-      return Array.from(map.entries())
-        .map(([name, value]) => `${name}=${value}`)
-        .join('; ');
-    },
-  };
+/**
+ * The main route's coerced params, or an empty record before route matching.
+ *
+ * Non-throwing, unlike `getSegmentParams()`: the deny payload path publishes
+ * params from wherever the pipeline happened to fail, which may be before
+ * matching completed.
+ *
+ * @internal — framework use only. See TIM-1285.
+ */
+export function getSegmentParamsForClient(): CoercedParams {
+  return requestContextAls.getStore()?.segmentParams ?? {};
 }
 
 /**
- * Returns a Promise resolving to the current request's search params.
+ * The per-slot params to publish to the client, or `undefined` when the
+ * request rendered no slot with params of its own.
  *
- * In `page.tsx`, `middleware.ts`, and `access.ts` the framework pre-parses the
- * route's `search-params.ts` definition and the Promise resolves to the typed
- * object. In all other server component contexts it resolves to raw
- * `URLSearchParams`.
+ * The client cannot derive these: a slot matches the URL through its own
+ * sub-tree, and the browser only ever sees the main route's record. Reading
+ * the map here — rather than threading it back out of the element builder —
+ * keeps one producer, since `setSlotParams` already writes it during slot
+ * resolution and every serialization site runs after that completes.
  *
- * Returned as a Promise to match the `params` prop convention and to allow
- * future partial pre-rendering support where param resolution may be deferred.
+ * @internal — framework use only. See TIM-1285.
+ */
+export function getSlotParamsForClient(): SlotParamsRecord | undefined {
+  const store = requestContextAls.getStore();
+  if (!store?.slotParams) return undefined;
+  return Object.keys(store.slotParams).length > 0 ? store.slotParams : undefined;
+}
+
+/**
+ * Store the matched segment path (e.g. '/(browse)/[artistSlug]/[year]') for
+ * dev-mode validation in getSegmentParams().
  *
- * Throws if called outside a request context.
+ * @internal — framework use only
  */
-export function searchParams<R extends keyof Routes>(): Promise<Routes[R]['searchParams']>;
-export function searchParams(): Promise<URLSearchParams | Record<string, unknown>>;
-export function searchParams(): Promise<URLSearchParams | Record<string, unknown>> {
+export function setMatchedSegmentPath(segmentPath: string): void {
   const store = requestContextAls.getStore();
-  if (!store) {
-    throw new Error(
-      '[timber] searchParams() called outside of a request context. ' +
-        'It can only be used in middleware, access checks, server components, and server actions.'
-    );
+  if (!store) return; // non-throwing — optional diagnostic
+  store.matchedSegmentPath = segmentPath;
+}
+
+/**
+ * Extract dynamic segment names from a route pattern.
+ * '/[artistSlug]/[year]' → ['artistSlug', 'year']
+ * '/docs/[...slug]'      → ['slug']
+ */
+function extractDynamicSegments(route: string): string[] {
+  const segments: string[] = [];
+  // Match [paramName], [...paramName], [[...paramName]]
+  const re = /\[{1,2}\.{0,3}(\w+)\]{1,2}/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(route)) !== null) {
+    segments.push(m[1]);
   }
-  return store.searchParamsPromise;
+  return segments;
 }
 
 /**
- * Replace the search params Promise for the current request with one that
- * resolves to the typed parsed result from the route's search-params.ts.
- * Called by the framework before rendering the page — not for app code.
+ * Returns the raw search string from the current request URL (e.g. "?foo=bar").
+ * Synchronous — safe for use in `redirect()` which throws synchronously.
+ *
+ * Returns empty string if called outside a request context (non-throwing for
+ * use in redirect's optional preserveSearchParams path).
+ *
+ * @internal — used by redirect() for preserveSearchParams support.
  */
-export function setParsedSearchParams(parsed: Record<string, unknown>): void {
+export function getRequestSearchString(): string {
   const store = requestContextAls.getStore();
-  if (store) {
-    store.searchParamsPromise = Promise.resolve(parsed);
-  }
+  return store?.searchString ?? '';
 }
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -239,93 +304,70 @@ export type ReadonlyHeaders = Pick<
   'get' | 'has' | 'entries' | 'keys' | 'values' | 'forEach' | typeof Symbol.iterator
 >;
 
-/** Options for setting a cookie. See design/29-cookies.md. */
-export interface CookieOptions {
-  /** Domain scope. Default: omitted (current domain only). */
-  domain?: string;
-  /** URL path scope. Default: '/'. */
-  path?: string;
-  /** Expiration date. Mutually exclusive with maxAge. */
-  expires?: Date;
-  /** Max age in seconds. Mutually exclusive with expires. */
-  maxAge?: number;
-  /** Prevent client-side JS access. Default: true. */
-  httpOnly?: boolean;
-  /** Only send over HTTPS. Default: true. */
-  secure?: boolean;
-  /** Cross-site request policy. Default: 'lax'. */
-  sameSite?: 'strict' | 'lax' | 'none';
-  /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
-  partitioned?: boolean;
+// ─── Framework-Internal Helpers ───────────────────────────────────────────
+
+/** Options for `runWithRequestContext()`. */
+export interface RequestContextOptions {
   /**
-   * Sign the cookie value with HMAC-SHA256 for integrity verification.
-   * Requires `cookies.secret` or `cookies.secrets` in timber.config.ts.
-   * See design/29-cookies.md §"Signed Cookies".
+   * Resume this `React.cache` scope instead of opening a fresh one. Only the
+   * post-action revalidation passes it.
    */
-  signed?: boolean;
-}
-
-const DEFAULT_COOKIE_OPTIONS: CookieOptions = {
-  path: '/',
-  httpOnly: true,
-  secure: true,
-  sameSite: 'lax',
-};
-
-/**
- * Cookie accessor returned by `cookies()`.
- *
- * Read methods are always available. Mutation methods throw in read-only
- * contexts (access.ts, server components).
- */
-export interface RequestCookies {
-  /** Get a cookie value by name. Returns undefined if not present. */
-  get(name: string): string | undefined;
-  /** Check if a cookie exists. */
-  has(name: string): boolean;
-  /** Get all cookies as an array of { name, value } pairs. */
-  getAll(): Array<{ name: string; value: string }>;
-  /** Number of cookies. */
-  readonly size: number;
+  reactCacheScope?: ReactCacheScope;
   /**
-   * Get a signed cookie value, verifying its HMAC-SHA256 signature.
-   * Returns undefined if the cookie is missing, the signature is invalid,
-   * or no secrets are configured. Never throws.
-   *
-   * See design/29-cookies.md §"Signed Cookies"
+   * The request's cookies, already parsed. Re-entry callers (the no-JS form
+   * rerender and the revalidation middleware) pass the action's
+   * post-mutation cookie state here instead of round-tripping it through a
+   * `Cookie:` header — the same parse the H-3 smuggling primitive abused
+   * (TIM-868).
    */
-  getSigned(name: string): string | undefined;
-  /** Set a cookie. Only available in mutable contexts (middleware, actions, route handlers). */
-  set(name: string, value: string, options?: CookieOptions): void;
-  /** Delete a cookie. Only available in mutable contexts. */
-  delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
-  /** Delete all cookies. Only available in mutable contexts. */
-  clear(): void;
-  /** Serialize cookies as a Cookie header string. */
-  toString(): string;
+  cookies?: Map<string, string>;
 }
 
-// ─── Framework-Internal Helpers ───────────────────────────────────────────
-
 /**
  * Run a callback within a request context. Used by the pipeline to establish
- * per-request ALS scope so that `headers()` and `cookies()` work.
+ * per-request ALS scope so that `getHeaders()` and `getCookies()` work.
+ *
+ * When `options.cookies` is given, the context's `parsedCookies` map is a
+ * copy of it and the raw `cookieHeader` is left empty, so
+ * `parseCookieHeader` never runs for that request. Re-entry callers pass the
+ * action's post-mutation cookie state this way (TIM-868).
+ *
+ * Each request context also opens its own `React.cache` scope, shared by
+ * everything that runs inside it — proxy.ts, middleware.ts, route handlers,
+ * and the render (design/02-rendering-pipeline.md §"Cache Scoping Model").
  *
  * @param req - The incoming Request object.
  * @param fn - The function to run within the request context.
  */
-export function runWithRequestContext<T>(req: Request, fn: () => T): T {
+export function runWithRequestContext<T>(
+  req: Request,
+  fn: () => T,
+  { reactCacheScope, cookies }: RequestContextOptions = {}
+): T {
   const originalCopy = new Headers(req.headers);
+  const appVisible = appVisibleSearch(new URL(req.url));
+  // A copy: the caller keeps its map, and this request's writes stay here.
+  const seed = cookies ? new Map(cookies) : undefined;
   const store: RequestContextStore = {
+    request: req,
     headers: freezeHeaders(req.headers),
     originalHeaders: originalCopy,
-    cookieHeader: req.headers.get('cookie') ?? '',
-    searchParamsPromise: Promise.resolve(new URL(req.url).searchParams),
+    // Given parsed cookies, leave the raw header empty — parseCookieHeader is the
+    // exact code path the smuggling primitive abused, and lazy parsing is
+    // gated on `parsedCookies` being undefined.
+    cookieHeader: seed ? '' : (req.headers.get('cookie') ?? ''),
+    parsedCookies: seed,
+    // Not `parsedUrl.searchParams` / `parsedUrl.search`: this store is what
+    // `getSearchParams()` and `redirect({ preserveSearchParams })` read, and
+    // the RSC payload URL carries the framework's `_rsc` cache key that no
+    // other request has (TIM-1272).
+    searchParams: appVisible.params,
+    searchString: appVisible.search,
     cookieJar: new Map(),
     flushed: false,
     mutableContext: false,
   };
-  return requestContextAls.run(store, fn);
+  return requestContextAls.run(store, () => runWithReactCacheScope(fn, reactCacheScope));
 }
 
 /**
@@ -354,24 +396,12 @@ export function markResponseFlushed(): void {
   }
 }
 
-/**
- * Collect all Set-Cookie headers from the cookie jar.
- * Called by the framework at flush time to apply cookies to the response.
- *
- * Returns an array of serialized Set-Cookie header values.
- */
-export function getSetCookieHeaders(): string[] {
-  const store = requestContextAls.getStore();
-  if (!store) return [];
-  return Array.from(store.cookieJar.values()).map(serializeCookieEntry);
-}
-
 /**
  * Apply middleware-injected request headers to the current request context.
  *
  * Called by the pipeline after middleware.ts runs. Merges overlay headers
  * on top of the original request headers so downstream code (access.ts,
- * server components, server actions) sees them via `headers()`.
+ * server components, server actions) sees them via `getHeaders()`.
  *
  * The original request headers are never mutated — a new frozen Headers
  * object is created with the overlay applied on top.
@@ -418,7 +448,7 @@ function freezeHeaders(source: Headers): Headers {
       if (typeof prop === 'string' && MUTATING_METHODS.has(prop)) {
         return () => {
           throw new Error(
-            `[timber] headers() returns a read-only Headers object. ` +
+            `[timber] getHeaders() returns a read-only Headers object. ` +
               `Calling .${prop}() is not allowed. ` +
               `Use ctx.requestHeaders in middleware to inject headers for downstream components.`
           );
@@ -433,96 +463,3 @@ function freezeHeaders(source: Headers): Headers {
     },
   });
 }
-
-// ─── Cookie Helpers ───────────────────────────────────────────────────────
-
-/** Throw if cookie mutation is attempted in a read-only context. */
-function assertMutable(store: RequestContextStore, method: string): void {
-  if (!store.mutableContext) {
-    throw new Error(
-      `[timber] cookies().${method}() cannot be called in this context.\n` +
-        `  Set cookies in middleware.ts, server actions, or route.ts handlers.`
-    );
-  }
-}
-
-/**
- * Parse a Cookie header string into a Map of name → value pairs.
- * Follows RFC 6265 §4.2.1: cookies are semicolon-separated key=value pairs.
- */
-function parseCookieHeader(header: string): Map<string, string> {
-  const map = new Map<string, string>();
-  if (!header) return map;
-
-  for (const pair of header.split(';')) {
-    const eqIndex = pair.indexOf('=');
-    if (eqIndex === -1) continue;
-    const name = pair.slice(0, eqIndex).trim();
-    const value = pair.slice(eqIndex + 1).trim();
-    if (name) {
-      map.set(name, value);
-    }
-  }
-
-  return map;
-}
-
-// ─── Cookie Signing ──────────────────────────────────────────────────────
-
-/**
- * Sign a cookie value with HMAC-SHA256.
- * Returns `value.hex_signature`.
- */
-function signCookieValue(value: string, secret: string): string {
-  const signature = createHmac('sha256', secret).update(value).digest('hex');
-  return `${value}.${signature}`;
-}
-
-/**
- * Verify a signed cookie value against an array of secrets.
- * Returns the original value if any secret produces a matching signature,
- * or undefined if none match. Uses timing-safe comparison.
- *
- * The signed format is `value.hex_signature` — split at the last `.`.
- */
-function verifySignedCookie(raw: string, secrets: string[]): string | undefined {
-  const lastDot = raw.lastIndexOf('.');
-  if (lastDot <= 0 || lastDot === raw.length - 1) return undefined;
-
-  const value = raw.slice(0, lastDot);
-  const signature = raw.slice(lastDot + 1);
-
-  // Hex-encoded SHA-256 is always 64 chars
-  if (signature.length !== 64) return undefined;
-
-  const signatureBuffer = Buffer.from(signature, 'hex');
-  // If the hex decode produced fewer bytes, the signature was not valid hex
-  if (signatureBuffer.length !== 32) return undefined;
-
-  for (const secret of secrets) {
-    const expected = createHmac('sha256', secret).update(value).digest();
-    if (timingSafeEqual(expected, signatureBuffer)) {
-      return value;
-    }
-  }
-  return undefined;
-}
-
-/** Serialize a CookieEntry into a Set-Cookie header value. */
-function serializeCookieEntry(entry: CookieEntry): string {
-  const parts = [`${entry.name}=${entry.value}`];
-  const opts = entry.options;
-
-  if (opts.domain) parts.push(`Domain=${opts.domain}`);
-  if (opts.path) parts.push(`Path=${opts.path}`);
-  if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
-  if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`);
-  if (opts.httpOnly) parts.push('HttpOnly');
-  if (opts.secure) parts.push('Secure');
-  if (opts.sameSite) {
-    parts.push(`SameSite=${opts.sameSite.charAt(0).toUpperCase()}${opts.sameSite.slice(1)}`);
-  }
-  if (opts.partitioned) parts.push('Partitioned');
-
-  return parts.join('; ');
-}