@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/dist/server/internal.js

@@ -0,0 +1,4645 @@
+import { r as RenderTimeoutError, t as DEFAULT_RENDER_TIMEOUT_MS } from "../_chunks/render-timeout-DOf_BBcO.js";
+import { n as isRscContentType, r as isRscRequest } from "../_chunks/rsc-media-type-DDc7duTD.js";
+import { n as classifyUrlSegment, r as effectiveUrlSegment } from "../_chunks/segment-classify-C539Pa2O.js";
+import { t as computeSegmentTreePaths } from "../_chunks/segment-keys-D5hu1hz4.js";
+import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-DSDjM_hJ.js";
+import { r as canonicalize } from "../_chunks/canonicalize-CgHoscYO.js";
+import { a as requestContextAls, r as prebuiltCaptureAls, s as timingAls, t as earlyHintsSenderAls } from "../_chunks/als-registry-DaxkVjt5.js";
+import { C as isRedirectSignal, F as withSpan, M as replaceTraceId, N as runWithTraceId, O as generateTraceId, P as setSpanAttribute, S as isDenySignal, _ as setLogger, a as logMiddlewareError, c as logRenderError, d as logRouteError, f as logRouteSetupError, g as logWaitUntilUnsupported, h as logWaitUntilRejected, j as getTraceId, k as getOtelTraceId, l as logRequestCompleted, m as logSwrRefetchFailed, n as logCacheMiss, o as logMiddlewareShortCircuit, p as logSlowRequest, r as logCsrfRejected, s as logProxyError, t as getLogger, u as logRequestReceived, v as swallow, w as isDebug, x as isControlFlowSignal } from "../_chunks/logger-BP0LN6vP.js";
+import { i as collectRouteModulepreloads, n as collectRouteCss, r as collectRouteFonts } from "../_chunks/build-manifest-DWppEdLB.js";
+import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-ClUiXQnK.js";
+import { C as setMutableCookieContext, S as setMatchedSegmentPath, T as runOutsideReactCacheScope, b as markResponseFlushed, f as getCookie, g as getHeader, h as applyRequestHeaderOverlay, i as coerce, m as getSetCookieHeaders, o as DenySignal, s as RedirectSignal, t as executeAction, v as getSearchParams, w as setSegmentParams, x as runWithRequestContext, y as getSegmentParams } from "../_chunks/actions-Rjk4htmA.js";
+import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as getWaitUntil, y as lastInvalidationEpochFor } from "../_chunks/cache-api-DGdYfNJn.js";
+import { n as createSingleflight } from "../_chunks/singleflight-BeVMMKi0.js";
+import { n as toBracketKey } from "../_chunks/resolve-schema-CBR6Lm4i.js";
+import { t as normalizeParamValue } from "../_chunks/param-value-C8TNYchQ.js";
+import { l as TIMBER_ERROR_HEADER, t as StatusPageMarker } from "../_chunks/status-page-marker-BRX9Ib-d.js";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import React, { createElement, useContext } from "react";
+//#region src/server/render-utils.ts
+/**
+* Check if an error is an abort error (connection closed by client).
+*
+* When the browser aborts a request (page refresh, navigation away),
+* the AbortSignal fires and React/streams throw an AbortError. This
+* is not an application error — suppress it from error boundaries and logs.
+*/
+function isAbortError(error) {
+	if (error instanceof DOMException && error.name === "AbortError") return true;
+	if (error instanceof Error && error.name === "AbortError") return true;
+	return false;
+}
+//#endregion
+//#region src/server/server-timing.ts
+/**
+* Server-Timing header — dev-mode timing breakdowns for Chrome DevTools.
+*
+* Collects timing entries per request using ALS. Each pipeline phase
+* (proxy, middleware, render, SSR, access, fetch) records an entry.
+* Before response flush, entries are formatted into a Server-Timing header.
+*
+* Only active in dev mode — zero overhead in production.
+*
+* See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing
+* Task: LOCAL-290
+*/
+/**
+* Run a callback with a per-request timing collector.
+* Must be called at the top of the request pipeline (wraps the full request).
+*/
+function runWithTimingCollector(fn) {
+	return timingAls.run({ entries: [] }, fn);
+}
+/**
+* Run a function and automatically record its duration as a timing entry.
+* Returns the function's result. No-ops the recording if outside a collector.
+*/
+async function withTiming(name, desc, fn) {
+	const store = timingAls.getStore();
+	if (!store) return fn();
+	const start = performance.now();
+	try {
+		return await fn();
+	} finally {
+		const dur = Math.round(performance.now() - start);
+		store.entries.push({
+			name,
+			dur,
+			desc
+		});
+	}
+}
+/**
+* Get the Server-Timing header value for the current request.
+* Returns null if no entries exist or outside a collector.
+*
+* Format: `name;dur=123;desc="description", name2;dur=456`
+* See RFC 6797 / Server-Timing spec for format details.
+*/
+function getServerTimingHeader() {
+	const store = timingAls.getStore();
+	if (!store || store.entries.length === 0) return null;
+	const nameCounts = /* @__PURE__ */ new Map();
+	const parts = store.entries.map((entry) => {
+		const count = nameCounts.get(entry.name) ?? 0;
+		nameCounts.set(entry.name, count + 1);
+		const uniqueName = count > 0 ? `${entry.name}-${count}` : entry.name;
+		return {
+			...entry,
+			name: uniqueName
+		};
+	}).map((entry) => {
+		let part = `${entry.name};dur=${entry.dur}`;
+		if (entry.desc) {
+			const safeDesc = entry.desc.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+			part += `;desc="${safeDesc}"`;
+		}
+		return part;
+	});
+	const MAX_HEADER_SIZE = 4096;
+	let result = "";
+	for (let i = 0; i < parts.length; i++) {
+		const candidate = result ? `${result}, ${parts[i]}` : parts[i];
+		if (candidate.length > MAX_HEADER_SIZE) break;
+		result = candidate;
+	}
+	return result || null;
+}
+//#endregion
+//#region src/server/stream-utils.ts
+/**
+* Stream utilities for the RSC rendering pipeline.
+*
+* teeWithErrorPropagation — wraps native ReadableStream.tee() with:
+* 1. Cross-branch error propagation (error on one branch cancels the other)
+* 2. Buffer divergence monitoring (warns + cancels when threshold exceeded)
+*
+* This prevents two classes of bugs:
+* - Silent stalls when one tee branch errors and the other hangs indefinitely
+* - Unbounded memory growth when one consumer (SSR) is much slower than the other
+*
+* Design doc: 02-rendering-pipeline.md §"RSC → SSR → Client Hydration"
+*/
+/**
+* Wrap a response body with stream-lifecycle timing instrumentation.
+*
+* Logs firstChunk, lastChunk, close, maxGap (largest inter-chunk gap),
+* chunk count, and byte count on stream termination (clean close OR
+* cancellation/disconnect). Gated behind `serverTiming: 'detailed'`.
+*
+* Uses a manual reader pump to guarantee logging on all termination
+* paths — TransformStream.flush() is not called on cancellation.
+*/
+function wrapResponseWithStreamTiming(body, startTime) {
+	let firstChunkMs = 0;
+	let lastChunkMs = 0;
+	let maxGapMs = 0;
+	let prevChunkTime = 0;
+	let chunks = 0;
+	let bytes = 0;
+	let cancelled = false;
+	function emitLog() {
+		const closeMs = Math.round(performance.now() - startTime);
+		getLogger().debug("stream-lifecycle", {
+			firstChunkMs,
+			lastChunkMs,
+			closeMs,
+			maxGapMs,
+			chunks,
+			bytes,
+			...cancelled ? { cancelled: true } : {}
+		});
+	}
+	const reader = body.getReader();
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				const { done, value } = await reader.read();
+				if (done) {
+					emitLog();
+					controller.close();
+					return;
+				}
+				const now = performance.now();
+				const relativeMs = Math.round(now - startTime);
+				if (chunks === 0) firstChunkMs = relativeMs;
+				else {
+					const gap = Math.round(now - prevChunkTime);
+					if (gap > maxGapMs) maxGapMs = gap;
+				}
+				prevChunkTime = now;
+				lastChunkMs = relativeMs;
+				chunks++;
+				bytes += value.byteLength;
+				controller.enqueue(value);
+			} catch (err) {
+				emitLog();
+				controller.error(err);
+			}
+		},
+		cancel(reason) {
+			cancelled = true;
+			emitLog();
+			reader.cancel(reason).catch(() => {});
+		}
+	});
+}
+/**
+* Read a byte stream to completion under one overall deadline and return
+* the concatenated bytes. Every read is raced against the time remaining,
+* and the reader is cancelled on every exit, so a stalled upstream never
+* outlives the deadline. See design/02-rendering-pipeline.md §"Always
+* Timeout-Guard Stream Reads".
+*
+* @param label - Prefix for the timeout error message. Both ways the deadline
+*   can pass (between reads, or while a read is pending) reject with the same
+*   `${label} did not complete within ${timeoutMs}ms`.
+*/
+async function readAllBytesWithDeadline(stream, timeoutMs, label) {
+	const reader = stream.getReader();
+	const chunks = [];
+	let totalLength = 0;
+	const deadline = Date.now() + timeoutMs;
+	const deadlineError = () => /* @__PURE__ */ new Error(`${label} did not complete within ${timeoutMs}ms`);
+	try {
+		for (;;) {
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) throw deadlineError();
+			let timer;
+			const timeout = new Promise((_, reject) => {
+				timer = setTimeout(() => reject(deadlineError()), remaining);
+			});
+			let result;
+			try {
+				result = await Promise.race([reader.read(), timeout]);
+			} finally {
+				clearTimeout(timer);
+			}
+			if (result.done) break;
+			chunks.push(result.value);
+			totalLength += result.value.byteLength;
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+	}
+	const bytes = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+//#endregion
+//#region src/server/instrumentation.ts
+/**
+* Instrumentation — loads and runs the user's instrumentation.ts file.
+*
+* instrumentation.ts is a file convention at the project root that exports:
+* - register() — called once at server startup, before the first request
+* - onRequestError() — called for every unhandled server error
+* - logger — any object with info/warn/error/debug methods
+*
+* See design/17-logging.md §"instrumentation.ts — The Entry Point"
+*/
+var _initialized = false;
+var _onRequestError = null;
+/**
+* Load and initialize the user's instrumentation.ts module.
+*
+* - Awaits register() before returning (server blocks on this).
+* - Picks up the logger export and wires it into the framework logger.
+* - Stores onRequestError for later invocation.
+*
+* @param loader - Function that dynamically imports the user's instrumentation module.
+*                 Returns null if no instrumentation.ts exists.
+*/
+async function loadInstrumentation(loader) {
+	if (_initialized) return;
+	_initialized = true;
+	let mod;
+	try {
+		mod = await loader();
+	} catch (error) {
+		console.error("[timber] Failed to load instrumentation.ts:", error);
+		return;
+	}
+	if (!mod) return;
+	if (mod.logger && typeof mod.logger.info === "function") setLogger(mod.logger);
+	if (typeof mod.onRequestError === "function") _onRequestError = mod.onRequestError;
+	if (typeof mod.register === "function") try {
+		await mod.register();
+	} catch (error) {
+		console.error("[timber] instrumentation.ts register() threw:", error);
+		throw error;
+	}
+}
+/**
+* Call the user's onRequestError hook. Catches and logs any errors thrown
+* by the hook itself — it must not affect the response.
+*/
+async function callOnRequestError(error, request, context) {
+	if (!_onRequestError) return;
+	try {
+		await _onRequestError(error, request, context);
+	} catch (hookError) {
+		console.error("[timber] onRequestError hook threw:", hookError);
+	}
+}
+/**
+* Check if onRequestError is registered.
+*/
+function hasOnRequestError() {
+	return _onRequestError !== null;
+}
+//#endregion
+//#region src/server/safe-load.ts
+/**
+* Custom error class for module load failures.
+*
+* Preserves the original error as `cause` while providing a
+* human-readable message with the file path.
+*/
+var ModuleLoadError = class extends Error {
+	/** The file path that failed to load. */
+	filePath;
+	constructor(filePath, cause) {
+		const originalMessage = cause instanceof Error ? cause.message : String(cause);
+		super(`[timber] Failed to load module ${filePath}\n  ${originalMessage}`, { cause });
+		this.name = "ModuleLoadError";
+		this.filePath = filePath;
+	}
+};
+/**
+* Load a route manifest module with enriched error context.
+*
+* On success: returns the module object (same as `loader.load()`).
+* On failure: throws `ModuleLoadError` with file path and original cause.
+*
+* Error rendering paths that need fallthrough use `loadFallbackModule()`.
+*/
+async function loadModule(loader) {
+	try {
+		return await loader.load();
+	} catch (error) {
+		throw new ModuleLoadError(loader.filePath, error);
+	}
+}
+//#endregion
+//#region src/server/route-matcher.ts
+/**
+* Whether a matched chain renders as an API route: its leaf has a
+* `route.ts` and no `page.tsx`. The same test `renderRoute` dispatches on,
+* so every answer about a route's format — early hints, deny format, error
+* format, error reporting — agrees with what actually ran.
+*/
+function isApiRouteChain(segments) {
+	const leaf = segments[segments.length - 1];
+	return !!leaf?.route && !leaf.page;
+}
+/**
+* Whether a matched chain is a route.ts handler that opted out of the CSRF
+* check with `export const csrf = false`. Keyed on the same leaf
+* `isApiRouteChain` dispatches on, so the exemption can only ever apply to
+* the route.ts that will actually run — never to a page, and so never to a
+* server action. See design/08-forms-and-actions.md §"Per-route exemption".
+*/
+function isCsrfExemptRoute(segments) {
+	return isApiRouteChain(segments) && segments[segments.length - 1]?.csrfExempt === true;
+}
+var SERVE_PATH_TO_CONVENTION = /* @__PURE__ */ new Map();
+for (const [baseName, convention] of Object.entries(METADATA_ROUTE_CONVENTIONS)) if (convention.serveExtension) for (const ext of [...convention.staticExtensions, convention.serveExtension]) SERVE_PATH_TO_CONVENTION.set(`${convention.servePath}.${ext}`, baseName);
+else SERVE_PATH_TO_CONVENTION.set(convention.servePath, baseName);
+//#endregion
+//#region src/shared/csrf-reject.ts
+/**
+* Marker header on CSRF rejections.
+*
+* A CSRF rejection is a 403, the same status as an access-control denial.
+* The server stamps this header on every CSRF 403 so callers — the browser
+* action runtime, a same-origin `fetch` in user code, a curl session — can
+* tell the two apart without parsing the body. A cross-origin `fetch` cannot
+* read it: the rejection returns before proxy.ts, so no CORS headers are set
+* and the browser reports a network error instead. Shared so the server writer and the client
+* reader cannot drift.
+*
+* See design/08-forms-and-actions.md §"CSRF Protection" (TIM-1459).
+*/
+var CSRF_REJECT_HEADER = "X-Timber-Reject";
+var CSRF_REJECT_VALUE = "csrf";
+//#endregion
+//#region src/server/csrf.ts
+/**
+* CSRF protection — Fetch Metadata first, Origin as the fallback.
+*
+* CSRF needs a victim's browser to attach cookies, and browsers mark the
+* requests they send: `Sec-Fetch-Site` on HTTPS (and localhost) pages in
+* every current browser, `Origin` on cross-site POSTs everywhere else. So
+* the check trusts those two headers in that order, and lets a request
+* carrying neither through — a webhook, curl, or a server-to-server
+* `fetch`. The residual risk is browsers old enough to send neither on a
+* form POST (Firefox < 70, IE11); SameSite cookies are the defense there.
+* See design/08-forms-and-actions.md §"CSRF Protection".
+*
+* Prior art: Go's `net/http.CrossOriginProtection` (Go 1.25) and the OWASP
+* CSRF cheat sheet (Fetch Metadata as a primary defense).
+*
+* The per-route exemption (`export const csrf = false` in route.ts) is not
+* decided here: the caller owns route matching and applies it to a
+* rejection. Disable globally with csrf: false (not recommended).
+*
+* See design/08-forms-and-actions.md §"CSRF Protection"
+* See design/13-security.md §"Security Testing Checklist" #6
+*/
+/** HTTP methods that are considered safe (no mutation). */
+var SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* `Sec-Fetch-Site` values that mean the browser itself vouches for the
+* request: `same-origin`, or `none` (user-initiated — typed URL, bookmark).
+* Every other value, including ones no browser sends, is not same-origin.
+* The header is forbidden to page scripts, so a page cannot forge it.
+*/
+var TRUSTED_FETCH_SITES = /* @__PURE__ */ new Set(["same-origin", "none"]);
+/**
+* Derive the request's scheme from trusted sources.
+*
+* Priority:
+* 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+* 2. Request URL protocol
+*
+* Falls back to 'https' (fail closed) if neither is available.
+*/
+function deriveRequestScheme(req) {
+	const forwarded = req.headers.get("X-Forwarded-Proto");
+	if (forwarded) {
+		const proto = forwarded.split(",")[0].trim().toLowerCase();
+		if (proto === "http" || proto === "https") return proto;
+	}
+	try {
+		return new URL(req.url).protocol.replace(":", "");
+	} catch {
+		return "https";
+	}
+}
+/**
+* Decide whether an unsafe-method request may proceed.
+*
+* In order:
+* 1. `Sec-Fetch-Site` is `same-origin` or `none` → allow.
+* 2. `Sec-Fetch-Site` has any other value → allow only if `Origin` is in
+*    `allowedOrigins`.
+* 3. No `Sec-Fetch-Site`, `Origin` present (a plain-HTTP page, or an
+*    older browser) → `Origin` must be in `allowedOrigins` or equal the
+*    origin derived from the scheme and `Host`.
+* 4. Neither header → allow: not a browser, so no ambient cookies to abuse.
+*
+* Safe methods (GET, HEAD, OPTIONS) and `csrf: false` always pass.
+*/
+function validateCsrf(req, config) {
+	if (SAFE_METHODS.has(req.method)) return { ok: true };
+	if (config.csrf === false) return { ok: true };
+	const fetchSite = req.headers.get("Sec-Fetch-Site");
+	const origin = req.headers.get("Origin");
+	const rejection = (reason, expected) => ({
+		ok: false,
+		status: 403,
+		reason,
+		origin,
+		fetchSite,
+		expected
+	});
+	if (fetchSite !== null) {
+		if (TRUSTED_FETCH_SITES.has(fetchSite)) return { ok: true };
+		if (origin !== null && config.allowedOrigins?.includes(origin)) return { ok: true };
+		return rejection("cross-origin", config.allowedOrigins ?? []);
+	}
+	if (origin === null) return { ok: true };
+	const allowed = config.allowedOrigins ?? [];
+	if (allowed.includes(origin)) return { ok: true };
+	const host = req.headers.get("Host");
+	if (!host) return rejection("missing-host", allowed);
+	let originOrigin;
+	try {
+		originOrigin = new URL(origin).origin;
+	} catch {
+		return rejection("invalid-origin", allowed);
+	}
+	let expectedOrigin;
+	try {
+		expectedOrigin = new URL(`${deriveRequestScheme(req)}://${host}`).origin;
+	} catch {
+		return rejection("invalid-host", allowed);
+	}
+	return originOrigin === expectedOrigin ? { ok: true } : rejection("origin-mismatch", [expectedOrigin, ...allowed]);
+}
+/**
+* Longest request-derived value echoed into the server log. Origin, Host,
+* Sec-Fetch-Site, and the path are attacker-controlled; a request can carry
+* kilobytes in each, and every rejection writes a log line. Real values are
+* far shorter.
+*/
+var MAX_LOGGED_VALUE = 200;
+function clip(value) {
+	return value.length > MAX_LOGGED_VALUE ? `${value.slice(0, MAX_LOGGED_VALUE)}…` : value;
+}
+/**
+* Clip and quote a request-derived value for the log. JSON quoting escapes
+* quotes and control characters, so a crafted header cannot close the quote
+* and forge `key=value` fields or a second line.
+*/
+function quote(value) {
+	return JSON.stringify(clip(value));
+}
+var PROXY_HINT = "If the app runs behind a proxy that rewrites Host or terminates TLS, forward the original Host and X-Forwarded-Proto, or list the public origin in allowedOrigins in timber.config.ts.";
+var EXEMPTION_HINT = "If this route.ts must accept cross-site browser requests (OIDC form_post, SAML, 3-D Secure returns), add `export const csrf = false` to it.";
+/**
+* Browsers send `Origin: null` from opaque contexts: sandboxed iframes, a POST
+* redirected across origins, file: pages. Every such context shares the one
+* value — an attacker's `<iframe sandbox>` included — so config validation
+* refuses it in `allowedOrigins` and the hint points at the exemption instead.
+*/
+var OPAQUE_ORIGIN_DETAIL = `origin "null" is an opaque origin (sandboxed iframe, a POST redirected across origins, or a file: page). allowedOrigins cannot admit it: every opaque context sends "null", including an attacker's sandboxed iframe. ${EXEMPTION_HINT}`;
+/** One sentence per rejection path: what was observed, and what to change. */
+function describeRejection(r, host) {
+	const opaque = r.origin === "null";
+	const origin = quote(r.origin ?? "");
+	const expected = r.expected.map(quote).join(", ");
+	switch (r.reason) {
+		case "cross-origin": {
+			if (opaque) return OPAQUE_ORIGIN_DETAIL;
+			const from = r.origin === null ? "with no Origin header" : `from origin ${origin}`;
+			const allowed = r.expected.length > 0 ? ` and is not in allowedOrigins [${expected}]` : "";
+			return `Sec-Fetch-Site ${quote(r.fetchSite ?? "")} request ${from}: the browser reports it is not same-origin${allowed}. If this origin is legitimate, add it to allowedOrigins in timber.config.ts. ${EXEMPTION_HINT}`;
+		}
+		case "missing-host": return `origin ${origin} could not be checked: request has no Host header. ${PROXY_HINT}`;
+		case "invalid-host": return `origin ${origin} could not be checked: Host header ${quote(host ?? "")} is not a valid host. ${PROXY_HINT}`;
+		case "invalid-origin":
+			if (opaque) return OPAQUE_ORIGIN_DETAIL;
+			return `Origin header ${origin} is not a valid origin.`;
+		case "origin-mismatch": {
+			const [own, ...listed] = r.expected.map(quote);
+			return `origin ${origin} does not match the request origin ${own}${listed.length > 0 ? ` or allowedOrigins [${listed.join(", ")}]` : ""}. ${PROXY_HINT}`;
+		}
+	}
+}
+/**
+* Turn a failed check into the response the client sees, and log why.
+*
+* The response is a 403 marked as a CSRF rejection (header + plain-text
+* body) so it cannot be mistaken for an access-control 403. It never
+* carries the observed or expected origins — `allowedOrigins` is server
+* configuration, and a Host-derived origin can be an internal hostname
+* behind a proxy. The server log gets the full diagnosis.
+*/
+function csrfRejectionResponse(req, rejection) {
+	logCsrfRejected(describeRejection(rejection, req.headers.get("Host")), {
+		method: req.method,
+		path: clip(new URL(req.url).pathname),
+		reason: rejection.reason
+	});
+	return new Response("Forbidden: CSRF origin check failed\n", {
+		status: rejection.status,
+		headers: {
+			"Content-Type": "text/plain; charset=utf-8",
+			[CSRF_REJECT_HEADER]: CSRF_REJECT_VALUE
+		}
+	});
+}
+//#endregion
+//#region src/server/pipeline-helpers.ts
+/**
+* The pipeline-boundary CSRF gate: the 403 to answer with, or null to go on.
+*
+* Runs on every request after canonicalization and before proxy.ts, so it
+* covers route.ts handlers and server actions alike, and no user code has
+* run when it decides. The per-route exemption is looked up only for a
+* request the check would reject — the common accepted request never pays
+* for a match. The lookup uses the pipeline's own matcher on the canonical
+* path, the same match `handleRequest` dispatches on, and reads a flag the
+* scanner took from route.ts source, so deciding it loads no module.
+*
+* A matcher that throws leaves the request unexempted: fail closed.
+*
+* See design/08-forms-and-actions.md §"CSRF Protection".
+*/
+function csrfGate(req, canonicalPath, csrf, matchRoute) {
+	const result = validateCsrf(req, csrf);
+	if (result.ok) return null;
+	let exempt = false;
+	try {
+		const match = matchRoute(canonicalPath);
+		exempt = match !== null && isCsrfExemptRoute(match.segments);
+	} catch (err) {
+		swallow(err, "csrf gate: route match for exemption lookup threw");
+	}
+	return exempt ? null : csrfRejectionResponse(req, result);
+}
+/**
+* Build a proxy resolver closure from the declared source. Called exactly
+* once at `createPipeline` setup time, so the hot path sees only the branch
+* that corresponds to this pipeline's configured variant.
+*
+* Returns `null` when the app has no proxy.ts — the hot path short-circuits
+* around `runProxyPhase` entirely in that case.
+*
+* Accepts the sugar form (a bare `ProxyExport` — function or function array)
+* and normalises it to the static variant. Functions and arrays are
+* structurally distinct from the tagged `{ kind: 'lazy', loader }` object,
+* so discrimination is unambiguous.
+*/
+function makeProxyResolver(proxy) {
+	if (proxy === void 0) return null;
+	if (typeof proxy === "function" || Array.isArray(proxy)) {
+		const exp = proxy;
+		return () => exp;
+	}
+	if (proxy.kind === "static") {
+		const exp = proxy.export;
+		return () => exp;
+	}
+	const loader = proxy.loader;
+	return async () => (await loader()).default;
+}
+/**
+* Apply all Set-Cookie headers from the cookie jar to a Headers object.
+* Each cookie gets its own Set-Cookie header per RFC 6265 §4.1.
+*/
+function applyCookieJar(headers) {
+	for (const value of getSetCookieHeaders()) headers.append("Set-Cookie", value);
+}
+/**
+* Bring a bag the jar was already applied to up to date with the jar.
+*
+* `applied` is what `getSetCookieHeaders()` returned when the jar was
+* applied to `headers`. Values the jar no longer holds (a later write to the
+* same name replaced them) are removed, and values it gained are appended.
+* Every cookie then appears once, with its last write (design/29-cookies.md
+* §"Last-Write-Wins for Same Name"). `Set-Cookie` values that did not come
+* from the jar, such as a middleware appending to `ctx.headers` directly,
+* are left alone.
+*/
+function syncCookieJar(headers, applied) {
+	const current = getSetCookieHeaders();
+	const stale = applied.filter((value) => !current.includes(value));
+	const added = current.filter((value) => !applied.includes(value));
+	if (stale.length === 0 && added.length === 0) return;
+	const kept = headers.getSetCookie();
+	for (const value of stale) {
+		const index = kept.indexOf(value);
+		if (index !== -1) kept.splice(index, 1);
+	}
+	headers.delete("Set-Cookie");
+	for (const value of [...kept, ...added]) headers.append("Set-Cookie", value);
+}
+/**
+* Merge framework-managed response headers onto a terminal response without
+* overwriting headers the terminal response already set itself.
+*/
+function mergeMissingHeaders(target, source) {
+	const existingKeys = new Set([...target.keys()].map((key) => key.toLowerCase()));
+	for (const [key, value] of source.entries()) if (!existingKeys.has(key.toLowerCase())) target.append(key, value);
+}
+/**
+* Clone a Response into a fresh one whose header bag is guaranteed mutable.
+*
+* `Response.redirect()` and some platform-level passthrough responses (notably
+* on Cloudflare Workers) return objects with frozen header bags. Calling
+* `.set()` or `.append()` on them throws `TypeError: immutable`, which the
+* pipeline can hit when it appends Set-Cookie or Server-Timing entries.
+*
+* The pipeline calls this at the producer sites where user-controlled
+* responses enter the framework — `outcomeToResponse` for all phase outcomes,
+* and `handleRequest` for metadata-route and auto-sitemap user handlers — so
+* downstream code can write headers without runtime feature-detection.
+*
+* The clone is unconditional. This is a deliberate trade: we avoid a
+* try/catch + thrown `TypeError` on every request (the previous probe-based
+* approach paid that cost on the hot path) and accept one cheap Response
+* rewrap at the framework boundary instead.
+*/
+function cloneWithMutableHeaders(response) {
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers)
+	});
+}
+/**
+* A fresh response header bag for a page the pipeline renders, seeded with
+* the default dynamic-page cache policy.
+*
+* Without a Cache-Control header, CDNs (particularly Cloudflare) may attempt
+* to buffer/process the response differently, causing intermittent
+* multi-second delays. This matches Next.js's default behavior. Every bag a
+* rendered page can be written onto starts here — a matched route, the
+* no-match 404, and a deny page for a proxy-phase signal — so none of them
+* leaves without a cache policy. Middleware and route handlers may replace it.
+*/
+function dynamicResponseHeaders() {
+	return new Headers({ "Cache-Control": "private, no-cache, no-store, max-age=0, must-revalidate" });
+}
+/**
+* Build a redirect Response from a RedirectSignal.
+*
+* For a client navigation (an RSC payload request for a page), returns 204 +
+* X-Timber-Redirect so the client router can perform a soft SPA redirect. A
+* raw 302 would be turned into an opaque redirect by
+* fetch({redirect:'manual'}), crashing createFromFetch. See
+* design/19-client-navigation.md. The caller decides what counts as a
+* navigation: a route.ts match answers with a real 3xx whatever it accepts.
+*/
+function buildRedirectResponse(signal, headers, navigation) {
+	if (navigation) {
+		headers.set("X-Timber-Redirect", signal.location);
+		return new Response(null, {
+			status: 204,
+			headers
+		});
+	}
+	headers.set("Location", signal.location);
+	return new Response(null, {
+		status: signal.status,
+		headers
+	});
+}
+/**
+* Fire the user's onRequestError hook with request context.
+*
+* The one place a pipeline phase becomes the `phase` / `routeType` the hook
+* reports, so every caller agrees. A render-phase error on a route.ts match
+* is phase `'route'`, because the handler is what ran. Middleware reports
+* as `'handler'`, its public name.
+*/
+async function fireOnRequestError(error, req, source, segments) {
+	if (!isReportableError(error) || req.signal?.aborted) return;
+	if (isRepeatedLoadFailure(error)) return;
+	await callHook(error, req, source, segments);
+}
+/**
+* Module evaluations whose failure was already reported. A module that fails
+* to evaluate rethrows the same error on every later import, and
+* `loadModule()` wraps each one in a new `ModuleLoadError` with that error
+* as its `cause`. One broken module is one bug until it changes, however many
+* loads trip over it in a request or across requests: the page's boundaries,
+* then the fallback page, then the next request. A WeakSet, so a module that
+* is re-evaluated (an HMR edit) gets a new cause and is reported again.
+*/
+var reportedLoadFailures = /* @__PURE__ */ new WeakSet();
+/**
+* The same for a module that threw a primitive (`throw 'broken'`), which a
+* WeakSet cannot hold. Keyed on the file and the value instead, so a module
+* re-broken after an edit with the very same value is not reported again.
+* It grows with the number of broken modules, not with requests.
+*/
+var reportedPrimitiveLoadFailures = /* @__PURE__ */ new Set();
+function isRepeatedLoadFailure(error) {
+	if (!(error instanceof ModuleLoadError)) return false;
+	const cause = error.cause;
+	if (typeof cause === "object" && cause !== null) {
+		if (reportedLoadFailures.has(cause)) return true;
+		reportedLoadFailures.add(cause);
+		return false;
+	}
+	const key = `${error.filePath}\0${typeof cause}\0${String(cause)}`;
+	if (reportedPrimitiveLoadFailures.has(key)) return true;
+	reportedPrimitiveLoadFailures.add(key);
+	return false;
+}
+/**
+* Call the hook with request context, with no filtering. Only
+* `fireOnRequestError()` and background reporting call it: background work
+* runs after the response, so its request having aborted says nothing about
+* the failure.
+*/
+async function callHook(error, req, source, segments) {
+	if (!hasOnRequestError()) return;
+	const url = new URL(req.url);
+	const headersObj = {};
+	req.headers.forEach((v, k) => {
+		headersObj[k] = v;
+	});
+	const apiRoute = source === "route" || segments !== void 0 && isApiRouteChain(segments);
+	await callOnRequestError(error, {
+		method: req.method,
+		path: url.pathname,
+		headers: headersObj
+	}, {
+		phase: reportedPhase(source, apiRoute),
+		routePath: url.pathname,
+		routeType: source === "action" ? "action" : apiRoute ? "route" : "page",
+		traceId: getTraceId()
+	});
+}
+/**
+* Whether an error is a failure `onRequestError` should hear about.
+*
+* Control-flow signals are outcomes the code chose — a `deny()` picks the
+* page's status and data — and an abort is the client leaving. Callers answering
+* a live request also skip everything once `req.signal` has aborted: a
+* driver that throws "connection closed" after a disconnect is not a bug.
+*/
+function isReportableError(error) {
+	return !isControlFlowSignal(error) && !isAbortError(error);
+}
+/**
+* Fire the hook without making the caller wait, for callers that cannot:
+* Flight's `onError` is synchronous, and background work has no caller.
+* The promise is registered with the request's `waitUntil` so platforms
+* that stop work when the response ends (Workers, Lambda) let the hook
+* finish. The hook's own failures are caught in `callOnRequestError()`.
+*/
+function fireInBackground(report) {
+	getWaitUntil()?.(report.catch((hookError) => swallow(hookError, "onRequestError could not be called")));
+}
+/**
+* Run a `cache.component` stale-while-revalidate re-render as a singleflight
+* body, and log and report its failure once for the flight. The stale
+* payload already answered, so nothing else sees the failure.
+*
+* - **Once per flight.** A `.catch` on the flight's promise would run once
+*   per request that joined it, so the report happens inside the body. A
+*   body still running when the singleflight times out is reported then,
+*   with the timeout error (the signal's reason), and its later rejection
+*   is dropped.
+* - **Against the request whose stale read started it**, read from the
+*   request context the work runs in. With no request (the build-time
+*   capture store) it is only logged.
+* - **As phase `'render'`, route type `'page`.** A `cache.component` is a
+*   server component, so the read that started this was a page render (a
+*   revalidated page tree included). The request's own abort does not
+*   suppress the report: the work runs after the response either way.
+*/
+async function runBackgroundFlight(signal, work, log) {
+	const failed = (error) => {
+		log(error);
+		const request = requestContextAls.getStore()?.request;
+		if (request && isReportableError(error)) fireInBackground(callHook(error, request, "render"));
+	};
+	const onTimeout = () => failed(signal.reason);
+	signal.addEventListener("abort", onTimeout, { once: true });
+	try {
+		await work();
+	} catch (error) {
+		if (!signal.aborted) failed(error);
+	} finally {
+		signal.removeEventListener("abort", onTimeout);
+	}
+}
+function reportedPhase(source, apiRoute) {
+	switch (source) {
+		case "middleware": return "handler";
+		case "render": return apiRoute ? "route" : "render";
+		default: return source;
+	}
+}
+//#endregion
+//#region src/server/proxy.ts
+/**
+* Run the proxy pipeline.
+*
+* @param proxyExport - The default export from proxy.ts (function or array)
+* @param req - The incoming request
+* @param next - The continuation that proceeds to route matching and rendering
+* @returns The final response
+*/
+async function runProxy(proxyExport, req, next) {
+	const fns = Array.isArray(proxyExport) ? proxyExport : [proxyExport];
+	let i = fns.length;
+	let composed = next;
+	while (i--) {
+		const fn = fns[i];
+		const downstream = composed;
+		composed = () => Promise.resolve(fn(req, downstream));
+	}
+	return composed();
+}
+//#endregion
+//#region src/server/middleware-runner.ts
+/**
+* Run a route's middleware function.
+*
+* @param middlewareFn - The default export from the route's middleware.ts
+* @param ctx - The middleware context (req, params, headers, requestHeaders, searchParams)
+* @returns A Response if middleware short-circuited, or undefined to continue
+*/
+async function runMiddleware(middlewareFn, ctx) {
+	const result = await middlewareFn(ctx);
+	if (result instanceof Response) return result;
+}
+/**
+* Run all middleware functions in the segment chain, root to leaf.
+*
+* Execution is top-down: root middleware runs first, leaf middleware runs last.
+* All middleware share the same MiddlewareContext — a parent that sets
+* ctx.requestHeaders makes it visible to child middleware and downstream components.
+*
+* Short-circuits on the first middleware that returns a Response.
+* Remaining middleware in the chain do not execute.
+*
+* @param chain - Middleware functions ordered root-to-leaf
+* @param ctx - Shared middleware context
+* @returns A Response if any middleware short-circuited, or undefined to continue
+*/
+async function runMiddlewareChain(chain, ctx) {
+	for (const fn of chain) {
+		const result = await fn(ctx);
+		if (result instanceof Response) return result;
+	}
+}
+//#endregion
+//#region src/server/csp-nonce.ts
+/**
+* CSP nonce — per-request, generated on demand.
+*
+* timber emits several inline `<script>` tags per HTML response — React's
+* bootstrap script and Fizz runtime, the Flight init/chunk scripts, the
+* segment-tree script, and the post-flush noindex script. Under a strict
+* `Content-Security-Policy` (`script-src 'nonce-…' 'strict-dynamic'`) every
+* one of them needs the request's nonce or the browser refuses to run it.
+*
+* The app opts in by reading `ctx.nonce` in `middleware.ts` and putting it
+* in the CSP header it sets through `ctx.headers`. The first read generates
+* the value and stores it on the request context; the render pipeline reads
+* it back with `getCspNonce()` and stamps it on every inline script. A
+* request whose middleware never reads `ctx.nonce` has no nonce, and its
+* markup is byte-identical to a render without this feature. timber does
+* not parse the CSP header — the app owns the policy, timber owns the
+* markup, and `ctx.nonce` is the one value both are built from.
+*
+* `proxy.ts` cannot participate: it only sees the finished response from
+* `next()`, after the markup exists.
+*
+* See design/13-security.md §"Content Security Policy" (TIM-1414).
+*/
+/**
+* Generate a CSP nonce: 128 random bits, base64. Matches CSP's
+* `base64-value` grammar, so it is valid in the header verbatim and safe
+* inside a double-quoted HTML attribute without escaping.
+*/
+function generateNonce() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary);
+}
+/**
+* The request's CSP nonce, creating it on first call. Backs the
+* `ctx.nonce` getter on `MiddlewareContext`. Outside a request context
+* (tests, build-time rendering) a fresh value is returned but not
+* retained, since there is no request for it to belong to.
+*/
+function requestCspNonce() {
+	const store = requestContextAls.getStore();
+	if (!store) return generateNonce();
+	store.cspNonce ??= generateNonce();
+	return store.cspNonce;
+}
+//#endregion
+//#region src/server/param-coercion.ts
+/**
+* Thrown when an app/schema.ts segment-param codec's parse() fails.
+* The pipeline catches this and responds with 404.
+*/
+var ParamCoercionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ParamCoercionError";
+	}
+};
+/** Global schema codecs, set once at startup from virtual:timber-schema. */
+var _globalCodecs = null;
+/**
+* Coerce the matched route's raw segment params and return the result.
+*
+* Reads `match.rawSegmentParams` and never writes to `match`: the caller
+* decides where the coerced params go. Reading the raw record makes the call
+* repeatable — coercing a match twice runs every codec on the URL value both
+* times, never on its own output.
+*
+* Codecs come from `app/schema.ts` and nowhere else (TIM-1342 completed
+* design/41-global-params.md migration step 9). A route with no schema, or
+* a param the schema does not declare, keeps its raw string — which is the
+* honest type for an uninterpreted URL segment.
+*
+* Throws ParamCoercionError if any codec fails (→ 404).
+*
+* This runs BEFORE middleware, so ctx.segmentParams is already typed.
+* See design/07-routing.md §"Where Coercion Runs"
+* See design/41-global-params.md §"Pipeline Integration"
+*
+* Stays `async` with nothing to await: it is injected as a
+* `CoerceSegmentParamsFn` into the revalidation renderer, which awaits
+* it. Making it synchronous would
+* change that contract and remove a microtask boundary the pipeline's
+* ordering has always had, for no gain.
+*/
+async function coerceSegmentParams(match) {
+	const globalCodecs = _globalCodecs;
+	const mergeTarget = Object.create(null);
+	for (const key of Object.keys(match.rawSegmentParams)) if (key !== "__proto__") mergeTarget[key] = match.rawSegmentParams[key];
+	if (globalCodecs) for (const node of match.segments) {
+		const segment = effectiveUrlSegment(node);
+		if (!segment.paramName) continue;
+		const bracketKey = toBracketKey(segment.segmentType, segment.paramName);
+		const codec = globalCodecs[bracketKey];
+		if (!codec) continue;
+		const key = segment.paramName;
+		if (!(key in mergeTarget)) continue;
+		let parsed;
+		try {
+			parsed = codec.parse(mergeTarget[key]);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (isDebug()) console.warn(`[timber] Global schema codec rejected value for param "${key}"\n  Error: ${message}\n  Raw value: ${JSON.stringify(mergeTarget[key])}\n  Hint: check the codec in app/schema.ts for key '${bracketKey}'.`);
+			throw new ParamCoercionError(message);
+		}
+		mergeTarget[key] = normalizeParamValue(parsed, key);
+	}
+	return mergeTarget;
+}
+//#endregion
+//#region src/server/pipeline-metadata.ts
+/**
+* Metadata route helpers for the request pipeline.
+*
+* Handles serving static metadata files and serializing sitemap responses.
+* Extracted from pipeline.ts to keep files under 500 lines.
+*
+* See design/16-metadata.md §"Metadata Routes"
+*/
+/**
+* Content types that are text-based and should include charset=utf-8.
+* Binary formats (images) should not include charset.
+*/
+var TEXT_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	"application/xml",
+	"text/plain",
+	"application/json",
+	"application/manifest+json",
+	"image/svg+xml"
+]);
+/**
+* Serve a static metadata file by reading it from disk.
+*
+* Static metadata route files (.xml, .txt, .json, .png, .ico, .svg, etc.)
+* are served as-is with the appropriate Content-Type header.
+* Text files include charset=utf-8; binary files do not.
+*
+* See design/16-metadata.md §"Metadata Routes"
+*/
+async function serveStaticMetadataFile(metaMatch) {
+	const { contentType, file } = metaMatch;
+	const isText = TEXT_CONTENT_TYPES.has(contentType);
+	const body = await readFile(file.filePath);
+	const headers = {
+		"Content-Type": isText ? `${contentType}; charset=utf-8` : contentType,
+		"Content-Length": String(body.byteLength),
+		"Cache-Control": "public, max-age=14400, must-revalidate"
+	};
+	return new Response(body, {
+		status: 200,
+		headers
+	});
+}
+/**
+* Serialize a sitemap array to XML.
+* Follows the sitemap.org protocol: https://www.sitemaps.org/protocol.html
+*/
+function serializeSitemap(entries) {
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${entries.map((e) => {
+		let xml = `  <url>\n    <loc>${escapeXml(e.url)}</loc>`;
+		if (e.lastModified) {
+			const date = e.lastModified instanceof Date ? e.lastModified.toISOString() : e.lastModified;
+			xml += `\n    <lastmod>${escapeXml(date)}</lastmod>`;
+		}
+		if (e.changeFrequency) xml += `\n    <changefreq>${escapeXml(e.changeFrequency)}</changefreq>`;
+		if (e.priority !== void 0) xml += `\n    <priority>${e.priority}</priority>`;
+		xml += "\n  </url>";
+		return xml;
+	}).join("\n")}\n</urlset>`;
+}
+/** Escape special XML characters. */
+function escapeXml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+//#endregion
+//#region src/server/state-tree-diff.ts
+/**
+* State Tree Diffing — Server-side parsing and diffing of X-Timber-State-Tree.
+*
+* The client sends X-Timber-State-Tree on navigation requests, listing
+* the sync segments it has cached. The server diffs this against the
+* target route's segments to skip re-rendering unchanged sync layouts.
+*
+* This is a performance optimization only — NOT a security boundary.
+* All access.ts files run regardless of the state tree content.
+* A fabricated state tree can only cause extra rendering work or stale
+* layouts — never auth bypass.
+*
+* See design/19-client-navigation.md §"X-Timber-State-Tree Header"
+* See design/13-security.md §"State tree manipulation"
+*/
+/**
+* Parse the X-Timber-State-Tree header from a request.
+*
+* Returns a Set of segment paths the client has cached (with an
+* additional `slots` property for cached slot paths), or null if
+* the header is missing, malformed, or empty. Parsing happens before
+* renderToReadableStream — not inside the React render pass.
+*
+* @returns ClientStateTree with segments and slots, or null if no valid state tree
+*/
+function parseClientStateTree(req) {
+	const header = req.headers.get("X-Timber-State-Tree");
+	if (!header) return null;
+	try {
+		const parsed = JSON.parse(header);
+		const hasSegments = Array.isArray(parsed.segments) && parsed.segments.length > 0;
+		const hasSlots = Array.isArray(parsed.slots) && parsed.slots.length > 0;
+		const hasTreePaths = Array.isArray(parsed.treePaths) && parsed.treePaths.length > 0;
+		if (!hasSegments && !hasSlots && !hasTreePaths) return null;
+		const result = new Set(hasSegments ? parsed.segments : []);
+		result.slots = hasSlots ? new Set(parsed.slots) : null;
+		result.treePaths = hasTreePaths ? new Set(parsed.treePaths) : null;
+		return result;
+	} catch (err) {
+		swallow(err, "malformed X-Timber-State-Tree header");
+		return null;
+	}
+}
+//#endregion
+//#region src/server/pipeline-interception.ts
+/**
+* Interception route matching for the request pipeline.
+*
+* Matches target URLs against interception rewrites to support the
+* modal route pattern (soft navigation intercepts).
+*
+* Extracted from pipeline.ts to keep files under 500 lines.
+*
+* See design/07-routing.md §"Intercepting Routes"
+*/
+/**
+* Check if an intercepting route applies for this soft navigation.
+*
+* Two conditions must hold:
+*
+* 1. The **target** pathname matches the rewrite's intercepted pattern.
+* 2. The **source** route — the page the user is navigating FROM, per the
+*    validated X-Timber-URL header — renders the segment that owns the slot
+*    holding the intercepting page (`interceptingScope`). Only then does that
+*    slot exist in the rendered tree, so only then can the intercepting page
+*    render.
+*
+* Condition 2 replaced a URL-prefix check (TIM-1279). A prefix cannot
+* distinguish a route-group-scoped interception from a genuinely root-level
+* one — route groups are invisible in `urlPath`, so both collapse to "/" and
+* the guard degenerates to always-true. Tree paths carry group identity.
+* The scope check also subsumes the old segment-boundary rule: a source route
+* under /feed-private has no "/feed" in its chain.
+*
+* A third condition lives with the caller, which owns route matching, and it
+* applies to the `'slot'` shape only: the route produced by re-matching
+* `interceptingPrefix` must pass through the scope too. Conditions 1–2 are
+* about the route the user is leaving; the slot has to exist in the tree that
+* actually renders. The `'children'` shape resolves its owner from the scope
+* directly rather than from a pathname, so it satisfies that by construction.
+*
+* `resolveSourceScopes` is a thunk so its inputs are only resolved when some
+* rewrite's pattern actually matches the target — the common case is no match
+* at all. It returns the two client-supplied answers to "what is on screen?"
+* as **separate sets, most authoritative first**: the tree paths the client
+* says it has mounted, then those of the route the departing URL matches. It
+* returns null only when neither yields anything, which is not a soft
+* navigation this can reason about.
+*
+* They are two sets rather than one union because ranking needs a chain
+* (TIM-1318). Each channel describes a single rendered chain, so within one the
+* scopes are strictly nested and the deepest is the innermost owner. Unioned
+* they are not: once a modal is open the address bar holds the *intercepted*
+* URL, so the second channel describes the canonical branch — possibly an
+* exclusive route group the client never mounted — and a deeper scope from
+* there would outrank the owner actually on screen. Trying the mounted channel
+* to exhaustion first keeps the fallback the union was there to provide while
+* ranking only within one chain.
+*
+* Returns the winning build-time rewrite, or null. Only build-time values ever
+* reach the renderer: the client-supplied header selects a rewrite but never
+* becomes a rendered route or pathname.
+*
+* The **first** matching rewrite wins, and the caller does not fall back to the
+* next one when the winner fails to resolve. That is deliberate and pre-dates
+* the two shapes: a rewrite that matched the target and the scope described the
+* author's intent, and quietly rendering some other author's interception
+* instead would be harder to explain than rendering the canonical route.
+*
+* "First" is meaningful because the list arrives **deepest scope first** —
+* `collectInterceptionRewrites` sorts it at build time, so the deepest owner a
+* single chain passes through wins and nothing here has to score (TIM-1318).
+* Tree-walk order used to decide it, which meant renaming a route group flipped
+* which modal opened. The precondition is a property of the manifest this reads
+* rather than something it can re-derive, so it is asserted at its source:
+* `tests/interception.test.ts` §"rewrite order is decided by scope depth".
+*/
+function findInterceptionMatch(targetPathname, resolveSourceScopes, rewrites) {
+	const candidates = rewrites.filter((rewrite) => pathnameMatchesPattern(targetPathname, rewrite.interceptedPattern));
+	if (candidates.length === 0) return null;
+	const scopes = resolveSourceScopes();
+	if (!scopes) return null;
+	for (const scope of scopes) for (const rewrite of candidates) if (scope.has(rewrite.interceptingScope)) return rewrite;
+	return null;
+}
+/**
+* Check if a pathname matches a URL pattern with dynamic segments.
+*
+* Supports [param] (single segment) and [...param] (one or more segments).
+* Static segments must match exactly.
+*/
+function pathnameMatchesPattern(pathname, pattern) {
+	const pathParts = pathname === "/" ? [] : pathname.slice(1).split("/");
+	const patternParts = pattern === "/" ? [] : pattern.slice(1).split("/");
+	let pi = 0;
+	for (let i = 0; i < patternParts.length; i++) {
+		const seg = classifyUrlSegment(patternParts[i]);
+		switch (seg.kind) {
+			case "catch-all": return pi < pathParts.length;
+			case "optional-catch-all": return true;
+			case "dynamic": {
+				if (pi >= pathParts.length) return false;
+				const prefix = seg.prefix ?? "";
+				const suffix = seg.suffix ?? "";
+				const pathPart = pathParts[pi];
+				if (prefix || suffix) {
+					if (pathPart.length <= prefix.length + suffix.length || prefix && !pathPart.startsWith(prefix) || suffix && !pathPart.endsWith(suffix)) return false;
+				}
+				pi++;
+				continue;
+			}
+			case "static":
+				if (pi >= pathParts.length || pathParts[pi] !== seg.value) return false;
+				pi++;
+				continue;
+		}
+	}
+	return pi === pathParts.length;
+}
+/**
+* Resolve which route renders a soft navigation that an intercepting route
+* may claim. Returns the canonical match unchanged when no rewrite applies.
+*
+* Runs during route setup, so anything it throws is a `'setup'` outcome.
+*/
+function resolveInterceptedRoute(config, req, canonicalPathname, canonicalMatch) {
+	const stripTrailingSlash = config.stripTrailingSlash ?? true;
+	let match = canonicalMatch;
+	let interception;
+	if (isRscRequest(req) && config.interceptionRewrites?.length) {
+		const rawSourceUrl = req.headers.get("X-Timber-URL");
+		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
+		if (validatedSourceUrl) {
+			const resolveSourceScopes = () => {
+				const mounted = new Set(parseClientStateTree(req)?.treePaths ?? []);
+				const sourceRoute = config.matchRoute(validatedSourceUrl);
+				const scopes = [mounted, new Set(sourceRoute ? computeSegmentTreePaths(sourceRoute.segments) : [])].filter((scope) => scope.size > 0);
+				return scopes.length > 0 ? scopes : null;
+			};
+			const rewrite = findInterceptionMatch(canonicalPathname, resolveSourceScopes, config.interceptionRewrites);
+			if (rewrite?.mode === "children") {
+				const interceptedMatch = config.matchInterceptedRoute?.(canonicalPathname, rewrite.interceptingScope);
+				if (interceptedMatch) match = interceptedMatch;
+			} else if (rewrite) {
+				const sourceMatch = config.matchRoute(rewrite.interceptingPrefix);
+				if (sourceMatch !== null && computeSegmentTreePaths(sourceMatch.segments).includes(rewrite.interceptingScope)) {
+					match = sourceMatch;
+					interception = { targetPathname: canonicalPathname };
+				}
+			}
+		}
+	}
+	return {
+		match,
+		interception
+	};
+}
+/**
+* Validate and canonicalize the X-Timber-URL header value.
+*
+* Returns the canonical pathname if valid, or null if rejected:
+* - Must start with '/' (relative pathname, no scheme/authority)
+* - Must not contain control characters
+* - Must pass canonicalization (no encoded separators, null bytes, etc.)
+*/
+function validateInterceptionHeader(raw, stripTrailingSlash) {
+	if (!raw.startsWith("/")) return null;
+	if (raw.startsWith("//")) return null;
+	for (let i = 0; i < raw.length; i++) {
+		const code = raw.charCodeAt(i);
+		if (code <= 31 || code === 127) return null;
+	}
+	const result = canonicalize(raw, stripTrailingSlash);
+	if (!result.ok) return null;
+	return result.pathname;
+}
+//#endregion
+//#region src/server/response-cache-policy.ts
+/**
+* Legacy shared-cache control fields that predate RFC 9213 and so do not
+* follow the `<target>-Cache-Control` naming pattern — the one part of this
+* rule that cannot be matched by shape. `X-Accel-Expires` is nginx
+* `proxy_cache`, which gives it precedence over `Cache-Control`.
+*
+* A closed historical set, unlike the vendor `*-Cache-Control` names, which
+* keep being minted and are handled by pattern below.
+*/
+var LEGACY_CDN_CACHE_HEADERS = [
+	"Surrogate-Control",
+	"Edge-Control",
+	"X-Accel-Expires"
+];
+/**
+* Whether a response header overrides `Cache-Control` at a shared cache.
+*
+* Matched by *shape*, not by vendor name. RFC 9213 defines targeted fields
+* as `<target>-Cache-Control`, and every CDN spells its own: `CDN-`,
+* `Cloudflare-CDN-`, `Netlify-CDN-`, `Vercel-CDN-`, and whichever ships
+* next. A vendor list here is a denylist with an unbounded tail — it was
+* extended twice during review, each time by one name, which is the signal
+* that enumeration is the wrong shape. The suffix rule is total.
+*
+* `Cache-Control` itself does not match (no `-` prefix) and is replaced
+* separately.
+*/
+function isSharedCacheOverride(name) {
+	const lowered = name.toLowerCase();
+	return lowered.endsWith("-cache-control") || LEGACY_CDN_CACHE_HEADERS.some((legacy) => legacy.toLowerCase() === lowered);
+}
+/** Disable caching, including CDN overrides that take precedence over Cache-Control. */
+function preventResponseCaching(headers) {
+	const overrides = [];
+	for (const name of headers.keys()) if (isSharedCacheOverride(name)) overrides.push(name);
+	for (const name of overrides) headers.delete(name);
+	headers.set("Cache-Control", "private, no-store");
+}
+//#endregion
+//#region src/server/error-response-headers.ts
+/** Preserve request-wide metadata when replacing a failed response body. */
+function errorResponseHeaders(responseHeaders) {
+	const headers = new Headers(responseHeaders);
+	headers.delete("Content-Length");
+	headers.delete("Content-Encoding");
+	headers.delete("Transfer-Encoding");
+	preventResponseCaching(headers);
+	headers.delete("ETag");
+	headers.delete("Last-Modified");
+	headers.delete("Expires");
+	headers.delete("Age");
+	return headers;
+}
+//#endregion
+//#region src/server/rsc-error-envelope.ts
+/**
+* Build the hard-navigate envelope for a status code.
+*
+* Preserve middleware's request-wide headers and cookies, but discard the
+* abandoned body's framing, validators, and cache policy. Every producer,
+* including errors returned normally during render, gets this cleanup here.
+* The input header bag is left intact. The body deliberately carries no message —
+* only the status already on the wire (design/13-security.md principle 4).
+*/
+function rscErrorEnvelope(status, responseHeaders) {
+	const headers = errorResponseHeaders(responseHeaders);
+	headers.set(TIMBER_ERROR_HEADER, "1");
+	headers.set("content-type", "application/json; charset=utf-8");
+	return new Response(JSON.stringify({
+		error: true,
+		status
+	}), {
+		status,
+		headers
+	});
+}
+//#endregion
+//#region src/server/pipeline-outcome.ts
+/**
+* Pipeline outcome translator — converts a `PhaseOutcome` (the value
+* each phase function returns) into a final `Response`.
+*
+* Lifted out of `pipeline-phases.ts` (TIM-853) so the per-phase try /
+* catch logic and the terminal Response-building logic each live in
+* their own file. The phases produce values; this module is the single
+* source of truth for how those values become wire responses.
+*
+* See design/07-routing.md §"Request Lifecycle".
+*/
+function rscErrorResponse(isRsc, status, headers) {
+	if (isRsc) return rscErrorEnvelope(status, headers);
+	return new Response(null, {
+		status,
+		headers: errorResponseHeaders(headers)
+	});
+}
+/**
+* Resolve the header bag a signal/error outcome is written onto, with the
+* cookie jar applied exactly once.
+*
+* Ownership rule (design/49 §P0b): the phase that owns `responseHeaders`
+* applies the jar to it once; the translator applies it only for outcomes
+* that arrive without it. Render-phase outcomes already carry the jar —
+* `runRenderPhase()` applies it on entry, with or without a middleware
+* chain — so re-applying here emitted every middleware `Set-Cookie` twice
+* (TIM-1491).
+*
+* The guard is "not render", not "only middleware": proxy-phase signals
+* reach the translator with no `responseHeaders` at all, and for a
+* `proxy.ts` that awaits `next()` and then throws, this is the only place
+* the cookies downstream middleware set can reach the wire
+* (design/29-cookies.md §"proxy.ts Cookie Access"). Middleware-phase
+* signals throw before that phase's own application, so they need it too,
+* and so do setup-phase outcomes, which come before any phase applied it.
+*
+* `fresh` creates the bag for an outcome that arrives without one.
+*/
+function outcomeHeaders(outcome, ctx, fresh = () => new Headers()) {
+	const headers = ctx.responseHeaders ?? fresh();
+	if (outcome.phase !== "render") applyCookieJar(headers);
+	return headers;
+}
+/** Whether the outcome is for a route.ts match, which answers in its own format. */
+function isApiRouteMatch(ctx) {
+	return ctx.match !== void 0 && isApiRouteChain(ctx.match.segments);
+}
+/**
+* Report an error outcome once: log it under its phase, fire
+* `onRequestError`, and hand it to the dev overlay. An error from a
+* route.ts handler — or anything else in its render phase — logs as a route
+* error and reports as phase `'route'`.
+*/
+async function reportError(config, error, phase, ctx) {
+	const { method, path } = ctx;
+	switch (phase) {
+		case "proxy":
+			logProxyError({ error });
+			break;
+		case "setup":
+			logRouteSetupError({
+				method,
+				path,
+				error
+			});
+			break;
+		case "middleware":
+			logMiddlewareError({
+				method,
+				path,
+				error
+			});
+			break;
+		case "render": if (isApiRouteMatch(ctx)) logRouteError({
+			method,
+			path,
+			error
+		});
+		else logRenderError({
+			method,
+			path,
+			error
+		});
+	}
+	await fireOnRequestError(error, ctx.req, phase, ctx.match?.segments);
+	if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, phase);
+}
+/** The outcome for a value a phase threw: a signal, or an error. */
+function thrownOutcome(phase, thrown) {
+	if (isRedirectSignal(thrown)) return {
+		kind: "redirect",
+		phase,
+		signal: thrown
+	};
+	if (isDenySignal(thrown)) return {
+		kind: "deny",
+		phase,
+		signal: thrown
+	};
+	return {
+		kind: "error",
+		phase,
+		error: thrown
+	};
+}
+/**
+* Terminal outcome handler — converts a `PhaseOutcome` into a final
+* `Response`, applying cookies, building redirects, rendering deny pages
+* and fallback error pages, and firing instrumentation hooks.
+*
+* This is the single source of truth for how phase outputs become wire
+* responses; the per-phase try/catch blocks now produce values, not
+* Responses, so the conversion logic lives in exactly one place.
+*/
+async function outcomeToResponse(config, outcome, ctx) {
+	switch (outcome.kind) {
+		case "response": {
+			const finalResponse = cloneWithMutableHeaders(outcome.response);
+			if (outcome.phase === "proxy") return finalResponse;
+			if (outcome.phase === "middleware" && ctx.responseHeaders) {
+				applyCookieJar(finalResponse.headers);
+				mergeMissingHeaders(finalResponse.headers, ctx.responseHeaders);
+				logMiddlewareShortCircuit({
+					method: ctx.method,
+					path: ctx.path,
+					status: finalResponse.status
+				});
+			}
+			if (outcome.phase === "render") markResponseFlushed();
+			return finalResponse;
+		}
+		case "redirect": {
+			const headers = outcomeHeaders(outcome, ctx);
+			const navigation = isRscRequest(ctx.req) && !isApiRouteMatch(ctx);
+			return buildRedirectResponse(outcome.signal, headers, navigation);
+		}
+		case "deny": {
+			const headers = outcomeHeaders(outcome, ctx, dynamicResponseHeaders);
+			if (config.renderDenyFallback) try {
+				return cloneWithMutableHeaders(await config.renderDenyFallback(outcome.signal, ctx.req, headers, ctx.match));
+			} catch (denyRenderError) {
+				logRenderError({
+					method: ctx.method,
+					path: ctx.path,
+					error: denyRenderError
+				});
+				await fireOnRequestError(denyRenderError, ctx.req, "render", ctx.match?.segments);
+				if (config.onPipelineError && denyRenderError instanceof Error) config.onPipelineError(denyRenderError, "render");
+				if (isRscRequest(ctx.req)) return rscErrorEnvelope(outcome.signal.status, headers);
+			}
+			if (isDebug()) console.warn(`[timber] DenySignal(${outcome.signal.status}) from ${outcome.phase} phase — no renderDenyFallback configured, returning bare ${outcome.signal.status} response\n  Request: ${ctx.method} ${ctx.path}\n  Add a status-code file (e.g. 404.tsx) or error.tsx to render a custom deny page.`);
+			return new Response(null, {
+				status: outcome.signal.status,
+				headers
+			});
+		}
+		case "error": {
+			const isRsc = isRscRequest(ctx.req);
+			const headers = outcomeHeaders(outcome, ctx);
+			await reportError(config, outcome.error, outcome.phase, ctx);
+			if (outcome.phase === "proxy" || outcome.phase === "middleware") return rscErrorResponse(isRsc, 500, headers);
+			if (isRsc && !isApiRouteMatch(ctx)) return rscErrorResponse(true, 500, headers);
+			if (config.renderFallbackError) try {
+				return cloneWithMutableHeaders(await config.renderFallbackError(outcome.error, ctx.req, errorResponseHeaders(headers), ctx.match));
+			} catch (fallbackRenderError) {
+				logRenderError({
+					method: ctx.method,
+					path: ctx.path,
+					error: fallbackRenderError
+				});
+				await fireOnRequestError(fallbackRenderError, ctx.req, "render", ctx.match?.segments);
+				if (config.onPipelineError && fallbackRenderError instanceof Error) config.onPipelineError(fallbackRenderError, "render");
+			}
+			return rscErrorResponse(false, 500, headers);
+		}
+	}
+}
+//#endregion
+//#region src/server/pipeline-phases.ts
+/**
+* Pipeline phase functions — module-level free functions that take their
+* dependencies as explicit parameters. Each phase returns a `PhaseOutcome`
+* (a discriminated union over response / redirect / deny / error) defined
+* in `pipeline-outcome.ts`. The terminal `outcomeToResponse` (also in
+* `pipeline-outcome.ts`) translates outcomes into Responses.
+*
+* Lifted out of `createPipeline` so each phase can be unit-tested in
+* isolation. The lift is mechanical — these functions used to be closures
+* over `config`; they now take `config` as an explicit parameter.
+*
+* See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow".
+*/
+/**
+* Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
+*
+* When `next` is provided, it replaces the default `handleRequest` as the
+* continuation — this lets the pipeline inject action dispatch between proxy
+* and route matching (TIM-1213). The proxy resolver was picked at pipeline
+* construction time so the hot path sees no per-request branching on the
+* `ProxyConfig` discriminant.
+*/
+async function runProxyPhase(config, getProxy, req, method, path, next) {
+	const detailed = config.serverTiming === "detailed";
+	try {
+		const proxyExport = await getProxy();
+		const continuation = next ?? (() => handleRequest(config, req, method, path, true));
+		const proxyFn = () => runProxy(proxyExport, req, continuation);
+		return {
+			kind: "response",
+			phase: "proxy",
+			response: await withSpan("timber.proxy", {}, () => detailed ? withTiming("proxy", "proxy.ts", proxyFn) : proxyFn())
+		};
+	} catch (error) {
+		return thrownOutcome("proxy", error);
+	}
+}
+/**
+* Run the middleware chain phase. If the chain short-circuits with a Response,
+* returns it as a 'response' outcome. Otherwise applies the request header
+* overlay and falls through to the render phase.
+*/
+async function runMiddlewarePhase(config, req, match, responseHeaders, renderContext) {
+	const detailed = config.serverTiming === "detailed";
+	const requestHeaderOverlay = new Headers();
+	const ctx = {
+		req,
+		requestHeaders: requestHeaderOverlay,
+		headers: responseHeaders,
+		segmentParams: match.segmentParams,
+		get nonce() {
+			return requestCspNonce();
+		},
+		earlyHints: (hints) => {
+			for (const hint of hints) {
+				let value;
+				if (hint.as !== void 0) value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
+				else value = `<${hint.href}>; rel=${hint.rel}`;
+				if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+				if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+				responseHeaders.append("Link", value);
+			}
+		}
+	};
+	try {
+		const chainFn = () => runMiddlewareChain(match.middlewareChain, ctx);
+		const middlewareResponse = await (async () => {
+			setMutableCookieContext(true);
+			try {
+				return await withSpan("timber.middleware", {}, () => detailed ? withTiming("mw", "middleware.ts", chainFn) : chainFn());
+			} finally {
+				setMutableCookieContext(false);
+			}
+		})();
+		if (middlewareResponse) return {
+			kind: "response",
+			phase: "middleware",
+			response: middlewareResponse
+		};
+		applyRequestHeaderOverlay(requestHeaderOverlay);
+		return runRenderPhase(config, req, match, responseHeaders, renderContext);
+	} catch (error) {
+		return thrownOutcome("middleware", error);
+	}
+}
+/**
+* Run the render phase. Wraps the configured renderer in a span and a
+* timing scope, and translates thrown signals into outcome variants.
+*
+* The render phase owns `responseHeaders` from here on, so it is the one
+* place the cookie jar is applied to that bag (design/29-cookies.md
+* §"Applied Exactly Once"). Doing it here rather than in the middleware
+* phase means every render-phase outcome — a 200, or a deny / redirect /
+* error thrown from render — carries the jar whether or not a middleware
+* chain ran, and `outcomeToResponse` can skip render-phase outcomes
+* unconditionally (TIM-1491). Application precedes `config.render` so
+* middleware cookie writes are visible to route-handler header merging,
+* while handler `Set-Cookie` values still come after them and take
+* precedence.
+*/
+async function runRenderPhase(config, req, match, responseHeaders, { canonicalPathname, interception }) {
+	const detailed = config.serverTiming === "detailed";
+	applyCookieJar(responseHeaders);
+	try {
+		const renderFn = () => config.render(req, match, responseHeaders, interception);
+		return {
+			kind: "response",
+			phase: "render",
+			response: await withSpan("timber.render", { "http.route": canonicalPathname }, () => detailed ? withTiming("render", "RSC + SSR render", renderFn) : renderFn())
+		};
+	} catch (error) {
+		return thrownOutcome("render", error);
+	}
+}
+/**
+* Process a single request from canonicalization through phase dispatch.
+*
+* Stages: canonicalize → metadata routes → auto-sitemap → version skew →
+* route match → interception → early hints → param coercion → middleware →
+* render → outcome translation. Pre-routing short-circuits return Responses
+* directly; post-match dispatch goes through `outcomeToResponse`.
+*
+* Used both as the top-level entry (when no proxy.ts is configured) and as
+* the `next()` continuation passed to `runProxy()`.
+*
+* @param pathIsCanonical When true, `path` has already been canonicalized by
+*   `createPipeline` — skip re-canonicalization to prevent double-decode.
+*   When false (default), runs canonicalize as a safety net for direct callers.
+*/
+async function handleRequest(config, req, method, path, pathIsCanonical) {
+	const stripTrailingSlash = config.stripTrailingSlash ?? true;
+	let canonicalPathname;
+	if (pathIsCanonical) canonicalPathname = path;
+	else {
+		const result = canonicalize(path, stripTrailingSlash);
+		if (!result.ok) {
+			if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${path} — responding with ${result.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+			return new Response(null, { status: result.status });
+		}
+		canonicalPathname = result.pathname;
+	}
+	if (config.matchMetadataRoute) {
+		const metaMatch = config.matchMetadataRoute(canonicalPathname);
+		if (metaMatch) try {
+			if (metaMatch.isStatic) return await serveStaticMetadataFile(metaMatch);
+			setSegmentParams(metaMatch.segmentParams);
+			const mod = await loadModule(metaMatch.file);
+			if (typeof mod.default !== "function") {
+				if (isDebug()) console.warn(`[timber] Metadata route ${metaMatch.file} does not export a default function — responding with 500\n  Metadata routes must export a default function that returns the metadata content.`);
+				return new Response("Metadata route must export a default function", { status: 500 });
+			}
+			const handlerResult = await mod.default();
+			if (handlerResult instanceof Response) return cloneWithMutableHeaders(handlerResult);
+			const contentType = metaMatch.contentType;
+			let body;
+			if (typeof handlerResult === "string") body = handlerResult;
+			else if (contentType === "application/xml") body = serializeSitemap(handlerResult);
+			else if (contentType === "application/manifest+json") body = JSON.stringify(handlerResult, null, 2);
+			else body = String(handlerResult);
+			return new Response(body, {
+				status: 200,
+				headers: {
+					"Content-Type": `${contentType}; charset=utf-8`,
+					"Cache-Control": "public, max-age=14400, must-revalidate"
+				}
+			});
+		} catch (error) {
+			if (isRedirectSignal(error)) return new Response(null, {
+				status: error.status,
+				headers: { Location: error.location }
+			});
+			if (isDenySignal(error)) return new Response(null, { status: error.status });
+			logRenderError({
+				method,
+				path,
+				error
+			});
+			await fireOnRequestError(error, req, "route");
+			if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "metadata-route");
+			return new Response(null, { status: 500 });
+		}
+	}
+	if (config.autoSitemapHandler) try {
+		const sitemapResponse = await config.autoSitemapHandler(canonicalPathname);
+		if (sitemapResponse) return cloneWithMutableHeaders(sitemapResponse);
+	} catch (error) {
+		logRenderError({
+			method,
+			path,
+			error
+		});
+		await fireOnRequestError(error, req, "route");
+		if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "auto-sitemap");
+		return new Response(null, { status: 500 });
+	}
+	const isRsc = isRscRequest(req);
+	if (isRsc) {
+		if (!checkVersionSkew(req).ok) {
+			const reloadHeaders = new Headers();
+			applyReloadHeaders(reloadHeaders);
+			return new Response(null, {
+				status: 204,
+				headers: reloadHeaders
+			});
+		}
+	}
+	const responseHeaders = dynamicResponseHeaders();
+	const renderNotFound = async (headers) => {
+		if (!config.renderNoMatch) return new Response(null, { status: 404 });
+		try {
+			return cloneWithMutableHeaders(await config.renderNoMatch(req, headers));
+		} catch (error) {
+			return outcomeToResponse(config, thrownOutcome("render", error), {
+				req,
+				method,
+				path,
+				responseHeaders: headers
+			});
+		}
+	};
+	let match = null;
+	let interception;
+	try {
+		match = config.matchRoute(canonicalPathname);
+		({match, interception} = resolveInterceptedRoute(config, req, canonicalPathname, match));
+		if (!match) {
+			if (isDebug()) console.warn(`[timber] No route matched for pathname: ${canonicalPathname}\n  Input path: ${path}\n  Method: ${method}`);
+			return await renderNotFound(responseHeaders);
+		}
+		if (config.earlyHints && !isRsc && !isApiRouteChain(match.segments)) try {
+			await config.earlyHints(match, req, responseHeaders);
+		} catch (err) {
+			swallow(err, "early hints hook threw");
+		}
+		try {
+			match = {
+				...match,
+				segmentParams: await coerceSegmentParams(match)
+			};
+		} catch (error) {
+			if (error instanceof ParamCoercionError) {
+				if (isDebug()) {
+					const segmentChain = match.segments.map((s) => s.segmentName || "/").join(" → ");
+					console.warn(`[timber] Param coercion failed for ${method} ${canonicalPathname} — responding with 404\n  Matched segments: ${segmentChain}\n  Error: ${error.message}\n  This usually means a codec in app/schema.ts rejected the URL value.\n  Check the codec for the bracket key of the segment named above.`);
+				}
+				if (isApiRouteChain(match.segments)) return new Response(null, { status: 404 });
+				return await renderNotFound(responseHeaders);
+			}
+			throw error;
+		}
+		setSegmentParams(match.segmentParams);
+		const segmentPath = match.segments.map((s) => s.segmentName).filter(Boolean).join("/") || "/";
+		setMatchedSegmentPath(segmentPath.startsWith("/") ? segmentPath : `/${segmentPath}`);
+	} catch (error) {
+		return outcomeToResponse(config, thrownOutcome("setup", error), {
+			req,
+			method,
+			path,
+			responseHeaders,
+			match: match ?? void 0
+		});
+	}
+	return outcomeToResponse(config, match.middlewareChain.length > 0 ? await runMiddlewarePhase(config, req, match, responseHeaders, {
+		canonicalPathname,
+		interception
+	}) : await runRenderPhase(config, req, match, responseHeaders, {
+		canonicalPathname,
+		interception
+	}), {
+		req,
+		method,
+		path,
+		responseHeaders,
+		match
+	});
+}
+//#endregion
+//#region src/server/rsc-cache-key-guard.ts
+/**
+* Origin-side binding of the `_rsc` cache key to the request that produced
+* the response (TIM-1268).
+*
+* The key is deterministic, and deliberately so — that is what makes RSC
+* payloads cacheable. But deterministic also means *predictable*: anyone can
+* compute the key another client will request. Without this guard, a caller
+* could request `/about?_rsc=<victim's key>` while sending its own
+* `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+* environment this feature targets — would store that variant under the
+* victim's key. Every subsequent legitimate navigation would then be served
+* a payload rendered for someone else's segment tree or deployment.
+*
+* The guard is a *storability* rule, not a rejection: if the claimed key
+* does not match the key derived from the received headers, the response
+* loses its shared-cache directives. Mismatched requests are still served
+* normally, they just cannot be stored for anyone else.
+*
+* Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+* right, costs a round trip on every legitimate miss, and would make the
+* server's behaviour depend on a parameter it otherwise never reads. This
+* rule closes the same hole by making the poisoned entry unstorable at the
+* source, in the response the developer already has to opt into sharing.
+*
+* See design/19-client-navigation.md §"The `_rsc` cache key".
+*/
+/**
+* Whether the request's `_rsc` parameter matches the key derived from its
+* own headers.
+*
+* Requests without the parameter are not claiming a key at all, so they are
+* left alone — the bare document URL is the developer's declared territory
+* (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+* whose value could not be one of our digests: `_rsc` is not reserved, and
+* an application that already uses it for its own search state
+* (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+* guard that mistook that for a forgery.
+*/
+async function hasValidRscCacheKey(req) {
+	if (!req.url.includes("?")) return true;
+	let values;
+	try {
+		values = new URL(req.url).searchParams.getAll(RSC_KEY_PARAM);
+	} catch {
+		return false;
+	}
+	const claims = values.filter(isRscCacheKeyShape);
+	if (claims.length === 0) return true;
+	const expected = await rscCacheKey((name) => req.headers.get(name));
+	if (expected === null) return false;
+	return claims.every((claim) => claim === expected);
+}
+/**
+* Ensure a Flight payload can never be interpreted as a document.
+*
+* Applied here, at the pipeline's single exit, rather than where each
+* payload response is built. Six places build one — the success path, three
+* in `deny-renderer.ts`, the action paths — and hardening them one at a time
+* is how you end up hardening five of six. The response is Flight if it says
+* it is; that is the only test that covers every producer, including ones
+* added later.
+*
+* Matters because the payload URL is observable and, on a shared-cache hit,
+* the origin is never consulted — so a top-level navigation can be handed
+* these bytes with no request-time check available. See design/13-security.md
+* #36c.
+*/
+function hardenRscPayloadResponse(response) {
+	if (!isRscContentType(response.headers.get("content-type"))) return;
+	response.headers.set("X-Content-Type-Options", "nosniff");
+}
+/**
+* Make a response unstorable by any shared cache when its request claimed an
+* `_rsc` key that does not match its own headers.
+*
+* The end state is unconditional and therefore statable: **a mismatched
+* response is never stored by any cache.** Every targeted cache-control
+* field is removed and `Cache-Control` is replaced outright, rather than
+* downgrading only when a shared directive is spotted. Conditional variants
+* of this were tried and were wrong twice over — they missed the CDN-
+* specific headers, and leaving `Cache-Control` alone when it looked
+* harmless lets a CDN apply heuristic caching to a response that has none.
+*
+* The cost is that a mismatched request loses developer-chosen *browser*
+* caching too. That is a request no timber client ever makes.
+*
+* Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+* they address stored entries, and this response is not stored.
+*
+* Mutates `response.headers` in place; the pipeline guarantees mutable
+* headers at this point (see TIM-866).
+*/
+async function enforceRscCacheKey(req, response) {
+	if (await hasValidRscCacheKey(req)) return;
+	preventResponseCaching(response.headers);
+}
+//#endregion
+//#region src/server/head-response.ts
+/**
+* HEAD body stripping — RFC 9110 §9.3.2.
+*
+* "The HEAD method is identical to GET except that the server MUST NOT send
+* content in the response." The headers, however, must be the ones the
+* corresponding GET would have produced — which is why timber renders the
+* route in full and discards the body here rather than short-circuiting the
+* render. Content-Type, Content-Length, Set-Cookie, cache directives and
+* everything else ride through untouched.
+*
+* Node's `ServerResponse` happens to discard writes for HEAD, so the wire is
+* usually correct even without this. That is a property of one adapter, not of
+* the `Response` object: static generation, the Cloudflare and Nitro adapters,
+* tests, and anything calling the pipeline handler as a function all observe
+* the `Response` directly and saw the full body before TIM-1324.
+*
+* The pipeline applies this at its single exit so every response shape is
+* covered — page render, API route, metadata route, deny page, error page,
+* proxy short-circuit. The unit-level producer that is also reachable as a
+* standalone function (`handleRouteRequest`) calls it too, so it honours HEAD
+* on its own; it shares this implementation rather than repeating it, and
+* applying it twice is a no-op.
+*/
+/**
+* Return a bodyless copy of `response` when `method` is HEAD.
+*
+* A no-op for every other method and for responses that already carry no body
+* (204, 304, redirects), so callers do not need to pre-check either.
+*
+* The discarded stream is cancelled: an SSR render that reached this point has
+* a live producer attached, and dropping the reference without cancelling
+* leaks it for the lifetime of the render (design/13-security.md A4).
+*/
+function stripHeadBody(response, method) {
+	if (method.toUpperCase() !== "HEAD") return response;
+	const body = response.body;
+	if (body === null) return response;
+	try {
+		body.cancel().catch(() => {});
+	} catch {}
+	return new Response(null, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
+//#endregion
+//#region src/server/pipeline.ts
+/**
+* Create the request handler from a pipeline configuration.
+*
+* Returns a function that processes an incoming Request through all pipeline
+* stages and produces a Response. This is the top-level entry point for the
+* server. The body is intentionally small — phase logic lives in
+* `pipeline-phases.ts`. This function only owns the per-request setup that
+* has to wrap the entire dispatch: trace ID, request context ALS, span
+* scope, Server-Timing header emission, and the active-request counter.
+*/
+function createPipeline(config) {
+	const proxyResolver = makeProxyResolver(config.proxy);
+	const slowRequestMs = config.slowRequestMs ?? 3e3;
+	const serverTiming = config.serverTiming ?? "total";
+	let activeRequests = 0;
+	const pipelineFn = async (req, cookies) => {
+		const url = new URL(req.url);
+		const method = req.method;
+		const path = url.pathname;
+		const startTime = performance.now();
+		const traceIdValue = generateTraceId();
+		return runWithTraceId(traceIdValue, async () => {
+			const inRequestContext = async () => {
+				const runRequest = async () => {
+					logRequestReceived({
+						method,
+						path
+					});
+					activeRequests++;
+					let concurrency = activeRequests;
+					let response;
+					try {
+						response = await withSpan("http.server.request", {
+							"http.request.method": method,
+							"url.path": path
+						}, async () => {
+							const otelTraceId = await getOtelTraceId();
+							if (otelTraceId) replaceTraceId(otelTraceId);
+							const stripTrailingSlash = config.stripTrailingSlash ?? true;
+							const canonResult = canonicalize(url.pathname, stripTrailingSlash);
+							if (!canonResult.ok) {
+								if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+								await setSpanAttribute("http.response.status_code", canonResult.status);
+								return new Response(null, { status: canonResult.status });
+							}
+							const canonicalPath = canonResult.pathname;
+							let canonicalReq = req;
+							if (url.pathname !== canonicalPath) {
+								const canonicalUrl = new URL(req.url);
+								canonicalUrl.pathname = canonicalPath;
+								canonicalReq = new Request(canonicalUrl.toString(), req);
+							}
+							const csrfRejection = csrfGate(canonicalReq, canonicalPath, config.csrf ?? {}, config.matchRoute);
+							if (csrfRejection) {
+								await setSpanAttribute("http.response.status_code", csrfRejection.status);
+								return csrfRejection;
+							}
+							const innerHandler = async () => {
+								if (config.dispatchAction) {
+									const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
+									if (actionResult) return actionResult;
+								}
+								return handleRequest(config, canonicalReq, method, canonicalPath, true);
+							};
+							let result;
+							if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath, innerHandler), {
+								req: canonicalReq,
+								method,
+								path: canonicalPath
+							});
+							else result = await innerHandler();
+							await setSpanAttribute("http.response.status_code", result.status);
+							const varyTokens = [...RSC_KEY_HEADERS];
+							const existingVary = result.headers.get("Vary");
+							const existingTokens = existingVary ? existingVary.toLowerCase().split(",").map((t) => t.trim()) : [];
+							const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+							if (newTokens.length > 0) result.headers.set("Vary", existingVary ? `${existingVary}, ${newTokens.join(", ")}` : newTokens.join(", "));
+							await enforceRscCacheKey(canonicalReq, result);
+							hardenRscPayloadResponse(result);
+							result = stripHeadBody(result, method);
+							if (serverTiming === "detailed") {
+								const timingHeader = getServerTimingHeader();
+								if (timingHeader) result.headers.set("Server-Timing", timingHeader);
+							} else if (serverTiming === "total") {
+								const totalMs = Math.round(performance.now() - startTime);
+								result.headers.set("Server-Timing", `total;dur=${totalMs}`);
+							}
+							if (serverTiming === "detailed" && result.body) result = new Response(wrapResponseWithStreamTiming(result.body, startTime), {
+								status: result.status,
+								statusText: result.statusText,
+								headers: result.headers
+							});
+							return result;
+						});
+					} finally {
+						concurrency = activeRequests;
+						activeRequests--;
+					}
+					const durationMs = Math.round(performance.now() - startTime);
+					const status = response.status;
+					logRequestCompleted({
+						method,
+						path,
+						status,
+						durationMs,
+						concurrency
+					});
+					if (slowRequestMs > 0 && durationMs > slowRequestMs) logSlowRequest({
+						method,
+						path,
+						durationMs,
+						threshold: slowRequestMs,
+						concurrency
+					});
+					return response;
+				};
+				return serverTiming === "detailed" ? runWithTimingCollector(runRequest) : runRequest();
+			};
+			return runWithRequestContext(req, inRequestContext, { cookies });
+		});
+	};
+	return pipelineFn;
+}
+//#endregion
+//#region src/server/early-hints.ts
+/**
+* 103 Early Hints utilities.
+*
+* Early Hints are sent before the final response to let the browser
+* start fetching critical resources (CSS, fonts, JS) while the server
+* is still rendering.
+*
+* The framework collects hints from two sources:
+* 1. Build manifest — CSS, fonts, and JS chunks known at route-match time
+* 2. ctx.earlyHints() — explicit hints added by middleware or route handlers
+*
+* Both are emitted as Link headers. Cloudflare CDN automatically converts
+* Link headers into 103 Early Hints responses.
+*
+* Design docs: 02-rendering-pipeline.md §"Early Hints (103)"
+*/
+/**
+* Format a single EarlyHint as a Link header value.
+*
+* Attribute order: `as` before `rel` to match Cloudflare CDN's cached
+* Early Hints format. Cloudflare caches Link headers from 200 responses
+* and re-emits them as 103 Early Hints on subsequent requests. If our
+* attribute order differs from Cloudflare's cached copy, the browser
+* sees two preload headers for the same URL (different attribute order)
+* and warns "Preload was ignored." Matching the order ensures the
+* browser deduplicates them correctly.
+*
+* Examples:
+*   `</styles/root.css>; as=style; rel=preload`
+*   `</fonts/inter.woff2>; as=font; rel=preload; crossorigin=anonymous`
+*   `</_timber/client.js>; rel=modulepreload`
+*   `<https://fonts.googleapis.com>; rel=preconnect`
+*/
+function formatLinkHeader(hint) {
+	if (hint.as !== void 0) {
+		let value = `<${hint.href}>; as=${hint.as}; rel=${hint.rel}`;
+		if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+		if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+		return value;
+	}
+	let value = `<${hint.href}>; rel=${hint.rel}`;
+	if (hint.crossOrigin !== void 0) value += `; crossorigin=${hint.crossOrigin}`;
+	if (hint.fetchPriority !== void 0) value += `; fetchpriority=${hint.fetchPriority}`;
+	return value;
+}
+/**
+* Collect all Link header strings for a matched route's segment chain.
+*
+* Walks the build manifest to emit hints for:
+* - CSS stylesheets (as=style; rel=preload)
+* - Font assets (as=font; rel=preload; crossorigin)
+* - JS modulepreload hints (rel=modulepreload) — unless skipJs is set
+*
+* Returns formatted Link header strings, deduplicated by URL, root → leaf order.
+* Returns an empty array in dev mode (manifest is empty).
+*/
+function collectEarlyHintHeaders(segments, manifest, options) {
+	const result = [];
+	const seenUrls = /* @__PURE__ */ new Set();
+	const add = (url, header) => {
+		if (!seenUrls.has(url)) {
+			seenUrls.add(url);
+			result.push(header);
+		}
+	};
+	for (const url of collectRouteCss(segments, manifest)) add(url, formatLinkHeader({
+		href: url,
+		rel: "preload",
+		as: "style"
+	}));
+	for (const font of collectRouteFonts(segments, manifest)) add(font.href, formatLinkHeader({
+		href: font.href,
+		rel: "preload",
+		as: "font",
+		crossOrigin: "anonymous"
+	}));
+	if (!options?.skipJs) for (const url of collectRouteModulepreloads(segments, manifest)) add(url, formatLinkHeader({
+		href: url,
+		rel: "modulepreload"
+	}));
+	return result;
+}
+//#endregion
+//#region src/server/early-hints-sender.ts
+/**
+* Per-request 103 Early Hints sender — ALS bridge for platform adapters.
+*
+* The pipeline collects Link headers for CSS, fonts, and JS chunks at
+* route-match time. On platforms that support it (Node.js v18.11+, Bun),
+* the adapter can send these as a 103 Early Hints interim response before
+* the final response is ready.
+*
+* This module provides an ALS-based bridge: the generated entry point
+* (e.g., the Nitro entry) wraps the handler with `runWithEarlyHintsSender`,
+* binding a per-request sender function. The pipeline calls
+* `sendEarlyHints103()` to fire the 103 if a sender is available.
+*
+* On platforms where 103 is handled at the CDN level (e.g., Cloudflare
+* converts Link headers into 103 automatically), no sender is installed
+* and `sendEarlyHints103()` is a no-op.
+*
+* Design doc: 02-rendering-pipeline.md §"Early Hints (103)"
+*/
+/**
+* Run a function with a per-request early hints sender installed.
+*
+* Called by generated entry points (e.g., Nitro node-server/bun) to
+* bind the platform's writeEarlyHints capability for the request duration.
+*/
+function runWithEarlyHintsSender(sender, fn) {
+	return earlyHintsSenderAls.run(sender, fn);
+}
+/**
+* Send collected Link headers as a 103 Early Hints response.
+*
+* No-op if no sender is installed for the current request (e.g., on
+* Cloudflare where the CDN handles 103 automatically, or in dev mode).
+*
+* Non-fatal: errors from the sender are caught and silently ignored.
+*/
+function sendEarlyHints103(links) {
+	if (!links.length) return;
+	const sender = earlyHintsSenderAls.getStore();
+	if (!sender) return;
+	try {
+		sender(links);
+	} catch (err) {
+		swallow(err, "early hints 103 send failed");
+	}
+}
+//#endregion
+//#region src/client/error-reconstituter.tsx
+/**
+* Reconstitutes a SerializableError into a real Error instance before
+* passing to the user's error component.
+*
+* TSX error pages are 'use client' components that receive { error: Error, digest, reset }.
+* Error objects are not RSC-serializable (React Flight throws "Only plain objects
+* can be passed to Client Components"). This wrapper receives the error as a plain
+* SerializableError object, reconstitutes a real Error instance, and passes it
+* to the user's error component — ensuring error instanceof Error works correctly.
+*
+* See design/spike-TIM-565-unify-error-pages.md §"Edge Case B"
+* See design/10-error-handling.md §"RSC → SSR for Error Pages via SerializableError"
+*/
+/**
+* Reconstitute a SerializableError into a real Error instance and render
+* the user's error component with the proper props.
+*/
+function ErrorReconstituter({ error: serialized, digest, reset, component, status, data }) {
+	const error = Object.assign(new Error(serialized.message), {
+		name: serialized.name,
+		stack: serialized.stack ?? `${serialized.name}: ${serialized.message}`
+	});
+	return createElement(component, {
+		error,
+		digest,
+		reset,
+		...status != null ? {
+			status,
+			data
+		} : {}
+	});
+}
+//#endregion
+//#region src/server/deny-boundary.ts
+/**
+* Deny boundary subsystem — the in-tree DenySignal flow.
+*
+* Three things live together here because they form a single flow:
+*
+* 1. **Chain construction** (`buildDenyPageChain`) — walks the matched
+*    segment chain at element-tree build time and produces a list of
+*    `DenyPageEntry` records ordered by specificity (specific status →
+*    category catch-all → `error.tsx`).
+*
+* 2. **Runtime matching and placement** (`matchDenyEntry`, `placeDenyPage`,
+*    `handleCaughtDeny`) — picks the first chain entry whose status filter
+*    matches the thrown DenySignal, then decides whether the catch site may
+*    render it where it stands. A chain spans the catcher outward to root,
+*    so a match may belong to an ancestor segment; rendering it in place
+*    would wrap it in every layout in between. Ancestor-owned matches are
+*    re-thrown with `ownerKey` stamped on the signal so the error boundary
+*    at the owning segment renders it. See TIM-1356.
+*
+* 3. **The page boundary itself** (`PageDenyBoundary`) — the async server
+*    component that wraps a server-component page, calls it, and catches
+*    `DenySignal` so the deny page renders in-tree (no throw reaches
+*    React Flight, single render pass).
+*
+* Plus the ALS helpers (`setDenyStatus` / `getDenyStatus`) the boundary
+* uses to thread the matched status code back to the pipeline so the
+* HTTP status reflects the deny.
+*
+* Folded into one module from the former `deny-page-resolver.ts` and
+* `page-deny-boundary.tsx` (TIM-853) — the names were misleading and the
+* three pieces only made sense together.
+*
+* See design/04-authorization.md, design/10-error-handling.md, TIM-666.
+*/
+/**
+* Find the first deny page in the chain whose status filter matches.
+* Returns null when nothing in the chain accepts this status.
+*
+* For 4xx statuses, the chain's stored order is correct: every status file
+* across all segments (inner→outer) before any error.tsx — so a root
+* `404.tsx` beats a leaf `error.tsx`. This matches `resolve4xx`.
+*
+* For 5xx statuses, the match walks per-segment (inner→outer): at each
+* segment, status files (`503.tsx` → `5xx.tsx`) then `error.tsx`, before
+* moving to the next segment outward. A leaf `error.tsx` therefore beats a
+* root `5xx.tsx` — the intentional inverse of the 4xx chain, matching
+* `resolve5xx`. See TIM-1360.
+*/
+function matchDenyEntry(chain, status) {
+	return matchDenyEntries(chain, status)[0] ?? null;
+}
+/**
+* Return ALL deny page entries whose status filter matches, in traversal
+* order (best match first). `matchDenyEntry` returns only the first;
+* late addressing (TIM-1450) needs the full list so the client can find
+* the first *reachable* owner via its ancestry context.
+*/
+function matchDenyEntries(chain, status) {
+	if (status >= 500) return matchDenyEntries5xx(chain, status);
+	const matches = [];
+	for (const entry of chain) if (entry.status === status) matches.push(entry);
+	else if (entry.status === 400 && status >= 400 && status <= 499) matches.push(entry);
+	else if (entry.status === null) matches.push(entry);
+	return matches;
+}
+/**
+* 5xx per-segment walk: at each segment (inner→outer), check status files
+* then error.tsx before moving outward. Mirrors `resolve5xx`.
+*/
+function matchDenyEntries5xx(chain, status) {
+	const segmentIndices = [];
+	for (const entry of chain) if (!segmentIndices.includes(entry.segmentIndex)) segmentIndices.push(entry.segmentIndex);
+	segmentIndices.sort((a, b) => b - a);
+	const matches = [];
+	for (const seg of segmentIndices) {
+		for (const entry of chain) {
+			if (entry.segmentIndex !== seg || entry.kind === "error") continue;
+			if (entry.status === status) matches.push(entry);
+			else if (entry.status === 500 && status >= 500 && status <= 599) matches.push(entry);
+		}
+		for (const entry of chain) {
+			if (entry.segmentIndex !== seg || entry.kind !== "error") continue;
+			matches.push(entry);
+		}
+	}
+	return matches;
+}
+/**
+* Decide where the deny page for `status` renders, from the perspective of
+* the catch site at `selfKey`.
+*
+* The match itself is unchanged — first entry in fallback order wins, so
+* every path picks the same file. What this adds is the position: a chain
+* built at segment i spans i outward to root, so a matched entry is owned
+* either by the catcher or by one of its ancestors.
+*
+* - Owned by the catcher → `render`. The catcher already sits at the
+*   owning segment's position.
+* - Owned by an ancestor → `hoist`. Rendering here would wrap the deny page
+*   in every layout between the owner and the catcher. The caller re-throws
+*   with `ownerKey` stamped on the signal so the boundary at that segment
+*   renders it instead — inside the owner's layout, outside the rest.
+*
+* Returns null when no entry matches; the caller re-throws unannotated and
+* the re-render fallback resolves it.
+*
+* See design/04-authorization.md §"Where a Deny Page Renders", TIM-1356.
+*/
+function placeDenyPage(chain, status, data, selfKey) {
+	const entry = matchDenyEntry(chain, status);
+	if (!entry) return null;
+	if (entry.ownerKey !== selfKey) return {
+		kind: "hoist",
+		ownerKey: entry.ownerKey
+	};
+	return {
+		kind: "render",
+		element: renderDenyEntry(entry, status, data)
+	};
+}
+/**
+* Build the element for a matched deny chain entry with the props contract
+* the file's convention documents:
+*
+* - Status-code files: { status, data }
+* - error.tsx (TSX): { error, digest, reset } via ErrorReconstituter, plus
+*   { status, data } for dual-shape implementations. Without
+*   the Error prop, any error.tsx written per the docs (reading
+*   error.message) crashes — turning a clean deny(404) into a 500. TIM-1081.
+* - error.mdx: plain { status } — server component, static content.
+*/
+function renderDenyEntry(entry, status, data) {
+	const h = createElement;
+	return h(StatusPageMarker, null, renderDenyPage(entry, status, data, h));
+}
+function renderDenyPage(entry, status, data, h) {
+	if (entry.kind !== "error") return h(entry.component, {
+		status,
+		data
+	});
+	return h(ErrorReconstituter, {
+		error: {
+			message: `Access denied with status ${status}`,
+			name: "DenySignal"
+		},
+		digest: null,
+		reset: void 0,
+		component: entry.component,
+		status,
+		data
+	});
+}
+/**
+* The whole of what an in-tree catch site does with a `DenySignal`, shared
+* by all three of them (`PageDenyBoundary`, `TracedLayout`, `AccessGate`).
+*
+* Returns the deny page element when this catch site owns the matched file.
+* Otherwise it throws — annotated with `ownerKey` when an ancestor owns the
+* file, bare when nothing matched at all.
+*
+* `setDenyStatus` runs on the hoist path too, *before* the throw, for one
+* case. Normally Flight's `onError` captures the rethrown signal within the
+* renderer's promotion cap, and the pipeline renders the deny page with
+* `deny.status` — the recorded status goes unread. When the signal lands
+* after the cap but within the detection window that follows, the renderer
+* discards it (never promoted) and streams the document it already has;
+* `getDenyStatus()`, read once as the renderer returns, gives that document
+* the deny's 4xx instead of a 200. A deny later than that commits 200. Pinned by
+* `tests/late-hoisted-deny-status.test.ts`. The RSC payload path never
+* reads it — a Flight payload response is always 200 and the row itself
+* carries the deny (TIM-1495).
+*
+* Either branch leaves part of the matched chain unmounted — hoisting sends
+* the render to a boundary that discards everything below it, and a layout
+* that denies returns the deny page instead of its own child outlet. What the
+* client then learns about the tree is decided by the boundary that renders
+* the page, at the commit that puts it on screen (`navigation-commit.ts`).
+*/
+function handleCaughtDeny(chain, error, selfKey) {
+	const placement = chain ? placeDenyPage(chain, error.status, error.data, selfKey) : null;
+	if (placement?.kind === "render") {
+		setDenyStatus(error.status);
+		return placement.element;
+	}
+	if (placement?.kind === "hoist") {
+		setDenyStatus(error.status);
+		error.owners = [placement.ownerKey];
+	}
+	throw error;
+}
+/**
+* Set the deny status in the request context ALS.
+* Called from AccessGate / PageDenyBoundary when a DenySignal is caught.
+* The document path reads this after render to set the HTTP status code.
+*/
+function setDenyStatus(status) {
+	const store = requestContextAls.getStore();
+	if (store) store.denyStatus = status;
+}
+/**
+* Record the first denied segment index in the request context ALS.
+* Called from AccessGate when a DenySignal is caught during render.
+* Only the first (shallowest) denial is recorded — deeper denials are
+* unreachable because the gate short-circuits the subtree.
+* See TIM-1363.
+*/
+function setFirstDeniedSegmentIndex(index) {
+	const store = requestContextAls.getStore();
+	if (store && store._firstDeniedSegmentIndex === void 0) store._firstDeniedSegmentIndex = index;
+}
+//#endregion
+//#region src/server/access-gate.tsx
+/**
+* Framework-injected access gate for segments.
+*
+* Calls accessFn during render — inside `renderToReadableStream`, sharing
+* the same `React.cache` scope as layouts and pages. A `requireUser()`
+* call in access.ts populates the cache; the same call in any layout is
+* a free hit. Access executes exactly once per request. See TIM-1363.
+*
+* access.ts is a pure gate — return values are discarded. The layout below
+* gets the same data by calling the same cached functions (React.cache dedup).
+*
+* On denial the gate renders the matching deny page only when this segment
+* owns it. Because the gate is wrapped OUTSIDE its own layout, that render
+* omits the denying segment's layout — deliberate, and the one place the
+* in-tree path diverges from `renderDenyPage`'s inclusive slice: a layout
+* whose access.ts denied must never run and serialize protected data into
+* the Flight stream (TIM-1074). An ancestor-owned page is hoisted instead,
+* because the gate also sits inside every layout above it and rendering
+* here would wrap the deny page in all of them (TIM-1356).
+*
+* For skipped segments (skippedSegment=true), deny pages are NOT rendered
+* in-tree — the client's cached layout chrome would wrap them incorrectly.
+* Instead, the deny is recorded in ALS and rethrown so the response path
+* can return rscErrorEnvelope for a client hard-navigate.
+*/
+function AccessGate(props) {
+	const { accessFn, segmentName, segmentKey, segmentIndex, denyPages, skippedSegment, children } = props;
+	return accessGateFallback(accessFn, segmentName, segmentKey, segmentIndex, skippedSegment ? void 0 : denyPages, skippedSegment, children);
+}
+/**
+* Calls accessFn during render with OTEL instrumentation.
+* Records the first denied segment index in ALS for post-render consumers.
+*/
+async function accessGateFallback(accessFn, segmentName, segmentKey, segmentIndex, denyPages, skippedSegment, children) {
+	try {
+		await withSpan("timber.access", { "timber.segment": segmentName ?? "unknown" }, async () => {
+			try {
+				await accessFn();
+				await setSpanAttribute("timber.result", "pass");
+			} catch (error) {
+				if (isDenySignal(error)) {
+					await setSpanAttribute("timber.result", "deny");
+					await setSpanAttribute("timber.deny_status", error.status);
+					if (error.sourceFile) await setSpanAttribute("timber.deny_file", error.sourceFile);
+				} else if (isRedirectSignal(error)) await setSpanAttribute("timber.result", "redirect");
+				throw error;
+			}
+		});
+	} catch (error) {
+		if (isDenySignal(error)) {
+			if (segmentIndex !== void 0) setFirstDeniedSegmentIndex(segmentIndex);
+			if (skippedSegment) {
+				error._hardNavigate = true;
+				throw error;
+			}
+			if (denyPages) return handleCaughtDeny(denyPages, error, segmentKey);
+		}
+		throw error;
+	}
+	return children;
+}
+/**
+* Framework-injected access gate for parallel slots.
+*
+* On denial, graceful degradation: denied.tsx → default.tsx → null.
+* The HTTP status code is unaffected — slot denial is a UI concern, not
+* a protocol concern. The parent layout and sibling slots still render.
+*
+* DeniedComponent is passed instead of a pre-built element so that
+* DenySignal.data can be forwarded as the data prop
+* and the slot name can be passed as the slot prop. See TIM-488.
+*
+* redirect() in slot access.ts is a dev-mode error — redirecting from a
+* slot doesn't make architectural sense.
+*/
+async function SlotAccessGate(props) {
+	const { accessFn, DeniedComponent, slotName, createElement, defaultFallback, children } = props;
+	try {
+		await accessFn();
+	} catch (error) {
+		if (isDenySignal(error)) return buildDeniedFallback(DeniedComponent, slotName, error.data, createElement) ?? defaultFallback ?? null;
+		if (isRedirectSignal(error)) {
+			if (isDebug()) console.error("[timber] redirect() is not allowed in slot access.ts. Slots use deny() for graceful degradation — denied.tsx → default.tsx → null. If you need to redirect, move the logic to the parent segment's access.ts.");
+			return buildDeniedFallback(DeniedComponent, slotName, void 0, createElement) ?? defaultFallback ?? null;
+		}
+		if (isDebug()) console.warn("[timber] Unhandled error in slot access.ts. Use deny() for access control, not unhandled throws.", error);
+		throw error;
+	}
+	return children;
+}
+/**
+* Build the denied fallback element dynamically with DenySignal data.
+* Returns null if no DeniedComponent is available.
+*/
+function buildDeniedFallback(DeniedComponent, slotName, data, createElement) {
+	if (!DeniedComponent) return null;
+	return createElement(DeniedComponent, {
+		slot: slotName,
+		data
+	});
+}
+//#endregion
+//#region src/server/status-code-resolver.ts
+/**
+* Look up `{statusStr}` then `{categoryKey}` (e.g. "4xx" / "5xx") in a
+* status-file group on a single segment. Shared by all three fallback
+* chains — the only structural difference between component 4xx,
+* component 5xx, and JSON resolution is *which* group is searched and
+* how the per-segment loop is layered around it.
+*/
+function lookupInGroup(group, statusStr, categoryKey, segmentIndex, status) {
+	if (!group) return null;
+	const exact = group[statusStr];
+	if (exact) return {
+		file: exact,
+		status,
+		kind: "exact",
+		segmentIndex
+	};
+	const category = group[categoryKey];
+	if (category) return {
+		file: category,
+		status,
+		kind: "category",
+		segmentIndex
+	};
+	return null;
+}
+/**
+* Resolve the status-code file to render for a given HTTP status code.
+*
+* Walks the segment chain from leaf to root following the fallback chain
+* defined in design/10-error-handling.md. Returns null if no file is found
+* (caller should render the framework default).
+*
+* @param status - The HTTP status code (4xx or 5xx).
+* @param segments - The matched segment chain from root (index 0) to leaf (last).
+* @param format - The response format family ('component' or 'json'). Defaults to 'component'.
+* @param maxIndex - Optional upper bound on the segment index to search.
+*   When set, the resolver only considers segments `0..maxIndex` (inclusive),
+*   skipping any segments deeper in the tree. Used by the deny renderers to
+*   prevent resolving a status file below a denied segment — matching
+*   `buildDenyPageChain`'s start-at-i semantics. The error renderers omit
+*   this parameter, so the full chain is searched — a 500 from a leaf page
+*   should use the leaf's own `5xx.tsx`. See TIM-1358.
+*/
+function resolveStatusFile(status, segments, format = "component", maxIndex) {
+	if (status < 400 || status > 599) return null;
+	if (format === "json") return resolveJson(status, segments, maxIndex);
+	if (status <= 499) return resolve4xx(status, segments, maxIndex);
+	return resolve5xx(status, segments, maxIndex);
+}
+/**
+* 4xx component fallback chain — two separate full passes leaf→root.
+*
+* The passes must be separate (not interleaved per-segment) so that a
+* root-level `404.tsx` beats a leaf-level `error.tsx`. The 5xx chain
+* inverts this and is per-segment: a leaf's `error.tsx` beats a root's
+* `5xx.tsx`. This asymmetry is the only reason these two functions exist
+* separately.
+*
+*   Pass 1 — {status}.tsx → 4xx.tsx           (statusFiles)
+*   Pass 2 — error.tsx                         (error)
+*/
+function resolve4xx(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const r = lookupInGroup(segments[i].statusFiles, statusStr, "4xx", i, status);
+		if (r) return r;
+	}
+	for (let i = start; i >= 0; i--) {
+		const errorFile = segments[i].error;
+		if (errorFile) return {
+			file: errorFile,
+			status,
+			kind: "error",
+			segmentIndex: i
+		};
+	}
+	return null;
+}
+/**
+* 5xx component fallback chain — single pass, per-segment leaf→root.
+*
+* At each segment: {status}.tsx → 5xx.tsx → error.tsx. A leaf's
+* `error.tsx` therefore beats a root's `5xx.tsx`, which is the
+* intentional inverse of the 4xx chain.
+*/
+function resolve5xx(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const segment = segments[i];
+		const r = lookupInGroup(segment.statusFiles, statusStr, "5xx", i, status);
+		if (r) return r;
+		if (segment.error) return {
+			file: segment.error,
+			status,
+			kind: "error",
+			segmentIndex: i
+		};
+	}
+	return null;
+}
+/**
+* JSON fallback chain (for both 4xx and 5xx) — single pass leaf→root.
+*
+* At each segment: {status}.json → {category}.json. No legacy compat,
+* no error.tsx — the JSON chain terminates at the category catch-all
+* and the caller falls back to a bare-JSON framework default.
+*/
+function resolveJson(status, segments, maxIndex) {
+	const statusStr = String(status);
+	const categoryKey = status >= 500 ? "5xx" : "4xx";
+	const start = maxIndex !== void 0 ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+	for (let i = start; i >= 0; i--) {
+		const r = lookupInGroup(segments[i].jsonStatusFiles, statusStr, categoryKey, i, status);
+		if (r) return r;
+	}
+	return null;
+}
+/**
+* Resolve the denial file for a parallel route slot.
+*
+* Slot denial is graceful degradation — no HTTP status on the wire.
+* Fallback chain: denied.tsx → default.tsx → null.
+*
+* @param slotNode - The segment node for the slot (segmentType === 'slot').
+*/
+function resolveSlotDenied(slotNode) {
+	const slotName = slotNode.segmentName.replace(/^@/, "");
+	if (slotNode.denied) return {
+		file: slotNode.denied,
+		slotName,
+		kind: "denied"
+	};
+	if (slotNode.default) return {
+		file: slotNode.default,
+		slotName,
+		kind: "default"
+	};
+	return null;
+}
+//#endregion
+//#region src/server/body-limits.ts
+var KB = 1024;
+var MB = 1024 * KB;
+var GB = 1024 * MB;
+var DEFAULT_LIMITS = {
+	actionBodySize: 1 * MB,
+	uploadBodySize: 10 * MB,
+	maxFields: 100
+};
+var SIZE_PATTERN = /^(\d+(?:\.\d+)?)\s*(kb|mb|gb)?$/i;
+/** Parse a human-readable size string ("1mb", "512kb", "1024") into bytes. */
+function parseBodySize(size) {
+	const match = SIZE_PATTERN.exec(size.trim());
+	if (!match) throw new Error(`Invalid body size format: "${size}". Expected format like "1mb", "512kb", or "1024".`);
+	const value = Number.parseFloat(match[1]);
+	const unit = (match[2] ?? "").toLowerCase();
+	switch (unit) {
+		case "kb": return Math.floor(value * KB);
+		case "mb": return Math.floor(value * MB);
+		case "gb": return Math.floor(value * GB);
+		case "": return Math.floor(value);
+		default: throw new Error(`Unknown size unit: "${unit}"`);
+	}
+}
+/** Strict integer pattern: one or more digits, nothing else. */
+var STRICT_INTEGER_RE = /^\d+$/;
+/** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
+function enforceBodyLimits(req, kind, config) {
+	const contentLength = req.headers.get("Content-Length");
+	if (!contentLength) return {
+		ok: false,
+		status: 411
+	};
+	const trimmed = contentLength.trim();
+	if (!STRICT_INTEGER_RE.test(trimmed)) return {
+		ok: false,
+		status: 411
+	};
+	return Number.parseInt(trimmed, 10) <= resolveLimit(kind, config) ? { ok: true } : {
+		ok: false,
+		status: 413
+	};
+}
+/**
+* Resolve the byte limit for a given body kind, using config overrides or defaults.
+*/
+function resolveLimit(kind, config) {
+	const userLimits = config.limits;
+	if (kind === "action") return userLimits?.actionBodySize ? parseBodySize(userLimits.actionBodySize) : DEFAULT_LIMITS.actionBodySize;
+	return userLimits?.uploadBodySize ? parseBodySize(userLimits.uploadBodySize) : DEFAULT_LIMITS.uploadBodySize;
+}
+//#endregion
+//#region src/server/metadata-social.ts
+/**
+* Render Open Graph metadata into head element descriptors.
+*
+* Handles og:title, og:description, og:image (with dimensions/alt),
+* og:video, og:audio, og:article:author, and other OG properties.
+*/
+function renderOpenGraph(og, elements) {
+	const simpleProps = [
+		["og:title", og.title],
+		["og:description", og.description],
+		["og:url", og.url],
+		["og:site_name", og.siteName],
+		["og:locale", og.locale],
+		["og:type", og.type],
+		["og:article:published_time", og.publishedTime],
+		["og:article:modified_time", og.modifiedTime]
+	];
+	for (const [property, content] of simpleProps) if (content) elements.push({
+		tag: "meta",
+		attrs: {
+			property,
+			content
+		}
+	});
+	if (og.images) {
+		if (typeof og.images === "string") elements.push({
+			tag: "meta",
+			attrs: {
+				property: "og:image",
+				content: og.images
+			}
+		});
+		else {
+			const imgList = Array.isArray(og.images) ? og.images : [og.images];
+			for (const img of imgList) {
+				elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image",
+						content: img.url
+					}
+				});
+				if (img.width) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:width",
+						content: String(img.width)
+					}
+				});
+				if (img.height) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:height",
+						content: String(img.height)
+					}
+				});
+				if (img.alt) elements.push({
+					tag: "meta",
+					attrs: {
+						property: "og:image:alt",
+						content: img.alt
+					}
+				});
+			}
+		}
+	}
+	if (og.videos) for (const video of og.videos) elements.push({
+		tag: "meta",
+		attrs: {
+			property: "og:video",
+			content: video.url
+		}
+	});
+	if (og.audio) for (const audio of og.audio) elements.push({
+		tag: "meta",
+		attrs: {
+			property: "og:audio",
+			content: audio.url
+		}
+	});
+	if (og.authors) for (const author of og.authors) elements.push({
+		tag: "meta",
+		attrs: {
+			property: "og:article:author",
+			content: author
+		}
+	});
+}
+/**
+* Render Twitter Card metadata into head element descriptors.
+*
+* Handles twitter:card, twitter:site, twitter:title, twitter:image,
+* twitter:player, and twitter:app (per-platform name/id/url).
+*/
+function renderTwitter(tw, elements) {
+	const simpleProps = [
+		["twitter:card", tw.card],
+		["twitter:site", tw.site],
+		["twitter:site:id", tw.siteId],
+		["twitter:title", tw.title],
+		["twitter:description", tw.description],
+		["twitter:creator", tw.creator],
+		["twitter:creator:id", tw.creatorId]
+	];
+	for (const [name, content] of simpleProps) if (content) elements.push({
+		tag: "meta",
+		attrs: {
+			name,
+			content
+		}
+	});
+	if (tw.images) {
+		if (typeof tw.images === "string") elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:image",
+				content: tw.images
+			}
+		});
+		else {
+			const imgList = Array.isArray(tw.images) ? tw.images : [tw.images];
+			for (const img of imgList) {
+				const url = typeof img === "string" ? img : img.url;
+				elements.push({
+					tag: "meta",
+					attrs: {
+						name: "twitter:image",
+						content: url
+					}
+				});
+			}
+		}
+	}
+	if (tw.players) for (const player of tw.players) {
+		elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:player",
+				content: player.playerUrl
+			}
+		});
+		if (player.width) elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:player:width",
+				content: String(player.width)
+			}
+		});
+		if (player.height) elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:player:height",
+				content: String(player.height)
+			}
+		});
+		if (player.streamUrl) elements.push({
+			tag: "meta",
+			attrs: {
+				name: "twitter:player:stream",
+				content: player.streamUrl
+			}
+		});
+	}
+	if (tw.app) {
+		const platforms = [
+			["iPhone", "iphone"],
+			["iPad", "ipad"],
+			["googlePlay", "googleplay"]
+		];
+		if (tw.app.name) {
+			for (const [key, tag] of platforms) if (tw.app.id?.[key]) elements.push({
+				tag: "meta",
+				attrs: {
+					name: `twitter:app:name:${tag}`,
+					content: tw.app.name
+				}
+			});
+		}
+		for (const [key, tag] of platforms) {
+			const id = tw.app.id?.[key];
+			if (id) elements.push({
+				tag: "meta",
+				attrs: {
+					name: `twitter:app:id:${tag}`,
+					content: id
+				}
+			});
+		}
+		for (const [key, tag] of platforms) {
+			const url = tw.app.url?.[key];
+			if (url) elements.push({
+				tag: "meta",
+				attrs: {
+					name: `twitter:app:url:${tag}`,
+					content: url
+				}
+			});
+		}
+	}
+}
+//#endregion
+//#region src/server/metadata-platform.ts
+/**
+* Render icon link elements (favicon, shortcut, apple-touch-icon, custom).
+*/
+function renderIcons(icons, elements) {
+	if (icons.icon) {
+		if (typeof icons.icon === "string") elements.push({
+			tag: "link",
+			attrs: {
+				rel: "icon",
+				href: icons.icon
+			}
+		});
+		else if (Array.isArray(icons.icon)) for (const icon of icons.icon) {
+			const attrs = {
+				rel: "icon",
+				href: icon.url
+			};
+			if (icon.sizes) attrs.sizes = icon.sizes;
+			if (icon.type) attrs.type = icon.type;
+			elements.push({
+				tag: "link",
+				attrs
+			});
+		}
+	}
+	if (icons.shortcut) {
+		const urls = Array.isArray(icons.shortcut) ? icons.shortcut : [icons.shortcut];
+		for (const url of urls) elements.push({
+			tag: "link",
+			attrs: {
+				rel: "shortcut icon",
+				href: url
+			}
+		});
+	}
+	if (icons.apple) {
+		if (typeof icons.apple === "string") elements.push({
+			tag: "link",
+			attrs: {
+				rel: "apple-touch-icon",
+				href: icons.apple
+			}
+		});
+		else if (Array.isArray(icons.apple)) for (const icon of icons.apple) {
+			const attrs = {
+				rel: "apple-touch-icon",
+				href: icon.url
+			};
+			if (icon.sizes) attrs.sizes = icon.sizes;
+			elements.push({
+				tag: "link",
+				attrs
+			});
+		}
+	}
+	if (icons.other) for (const icon of icons.other) {
+		const attrs = {
+			rel: icon.rel,
+			href: icon.url
+		};
+		if (icon.sizes) attrs.sizes = icon.sizes;
+		if (icon.type) attrs.type = icon.type;
+		elements.push({
+			tag: "link",
+			attrs
+		});
+	}
+}
+/**
+* Render alternate link elements (canonical, hreflang, media, types).
+*/
+function renderAlternates(alternates, elements) {
+	if (alternates.canonical) elements.push({
+		tag: "link",
+		attrs: {
+			rel: "canonical",
+			href: alternates.canonical
+		}
+	});
+	if (alternates.languages) for (const [lang, href] of Object.entries(alternates.languages)) elements.push({
+		tag: "link",
+		attrs: {
+			rel: "alternate",
+			hreflang: lang,
+			href
+		}
+	});
+	if (alternates.media) for (const [media, href] of Object.entries(alternates.media)) elements.push({
+		tag: "link",
+		attrs: {
+			rel: "alternate",
+			media,
+			href
+		}
+	});
+	if (alternates.types) for (const [type, href] of Object.entries(alternates.types)) elements.push({
+		tag: "link",
+		attrs: {
+			rel: "alternate",
+			type,
+			href
+		}
+	});
+}
+/**
+* Render site verification meta tags (Google, Yahoo, Yandex, custom).
+*/
+function renderVerification(verification, elements) {
+	const verificationProps = [
+		["google-site-verification", verification.google],
+		["y_key", verification.yahoo],
+		["yandex-verification", verification.yandex]
+	];
+	for (const [name, content] of verificationProps) if (content) elements.push({
+		tag: "meta",
+		attrs: {
+			name,
+			content
+		}
+	});
+	if (verification.other) for (const [name, value] of Object.entries(verification.other)) {
+		const content = Array.isArray(value) ? value.join(", ") : value;
+		elements.push({
+			tag: "meta",
+			attrs: {
+				name,
+				content
+			}
+		});
+	}
+}
+/**
+* Render Apple Web App meta tags and startup image links.
+*/
+function renderAppleWebApp(appleWebApp, elements) {
+	if (appleWebApp.capable) elements.push({
+		tag: "meta",
+		attrs: {
+			name: "apple-mobile-web-app-capable",
+			content: "yes"
+		}
+	});
+	if (appleWebApp.title) elements.push({
+		tag: "meta",
+		attrs: {
+			name: "apple-mobile-web-app-title",
+			content: appleWebApp.title
+		}
+	});
+	if (appleWebApp.statusBarStyle) elements.push({
+		tag: "meta",
+		attrs: {
+			name: "apple-mobile-web-app-status-bar-style",
+			content: appleWebApp.statusBarStyle
+		}
+	});
+	if (appleWebApp.startupImage) {
+		const images = Array.isArray(appleWebApp.startupImage) ? appleWebApp.startupImage : [{ url: appleWebApp.startupImage }];
+		for (const img of images) {
+			const attrs = {
+				rel: "apple-touch-startup-image",
+				href: typeof img === "string" ? img : img.url
+			};
+			if (typeof img === "object" && img.media) attrs.media = img.media;
+			elements.push({
+				tag: "link",
+				attrs
+			});
+		}
+	}
+}
+/**
+* Render App Links (al:*) meta tags for deep linking across platforms.
+*/
+function renderAppLinks(appLinks, elements) {
+	const platformEntries = [
+		["ios", appLinks.ios],
+		["android", appLinks.android],
+		["windows", appLinks.windows],
+		["windows_phone", appLinks.windowsPhone],
+		["windows_universal", appLinks.windowsUniversal]
+	];
+	for (const [platform, entries] of platformEntries) {
+		if (!entries) continue;
+		for (const entry of entries) for (const [key, value] of Object.entries(entry)) if (value !== void 0 && value !== null) elements.push({
+			tag: "meta",
+			attrs: {
+				property: `al:${platform}:${key}`,
+				content: String(value)
+			}
+		});
+	}
+	if (appLinks.web) {
+		if (appLinks.web.url) elements.push({
+			tag: "meta",
+			attrs: {
+				property: "al:web:url",
+				content: appLinks.web.url
+			}
+		});
+		if (appLinks.web.shouldFallback !== void 0) elements.push({
+			tag: "meta",
+			attrs: {
+				property: "al:web:should_fallback",
+				content: appLinks.web.shouldFallback ? "true" : "false"
+			}
+		});
+	}
+}
+/**
+* Render Apple iTunes smart banner meta tag.
+*/
+function renderItunes(itunes, elements) {
+	const parts = [`app-id=${itunes.appId}`];
+	if (itunes.affiliateData) parts.push(`affiliate-data=${itunes.affiliateData}`);
+	if (itunes.appArgument) parts.push(`app-argument=${itunes.appArgument}`);
+	elements.push({
+		tag: "meta",
+		attrs: {
+			name: "apple-itunes-app",
+			content: parts.join(", ")
+		}
+	});
+}
+//#endregion
+//#region src/server/metadata-render.ts
+/**
+* Convert resolved metadata into an array of head element descriptors.
+*
+* Each descriptor has a `tag` ('title', 'meta', 'link') and either
+* `content` (for <title>) or `attrs` (for <meta>/<link>).
+*
+* The framework's MetadataResolver component consumes these descriptors
+* and renders them into the <head>.
+*/
+function renderMetadataToElements(metadata) {
+	const elements = [];
+	if (typeof metadata.title === "string") elements.push({
+		tag: "title",
+		content: metadata.title
+	});
+	const simpleMetaProps = [
+		["description", metadata.description],
+		["generator", metadata.generator],
+		["application-name", metadata.applicationName],
+		["referrer", metadata.referrer],
+		["category", metadata.category],
+		["creator", metadata.creator],
+		["publisher", metadata.publisher]
+	];
+	for (const [name, content] of simpleMetaProps) if (content) elements.push({
+		tag: "meta",
+		attrs: {
+			name,
+			content
+		}
+	});
+	if (metadata.keywords) {
+		const content = Array.isArray(metadata.keywords) ? metadata.keywords.join(", ") : metadata.keywords;
+		elements.push({
+			tag: "meta",
+			attrs: {
+				name: "keywords",
+				content
+			}
+		});
+	}
+	if (metadata.robots) {
+		const content = typeof metadata.robots === "string" ? metadata.robots : renderRobotsObject(metadata.robots);
+		elements.push({
+			tag: "meta",
+			attrs: {
+				name: "robots",
+				content
+			}
+		});
+		if (typeof metadata.robots === "object" && metadata.robots.googleBot) {
+			const gbContent = typeof metadata.robots.googleBot === "string" ? metadata.robots.googleBot : renderRobotsObject(metadata.robots.googleBot);
+			elements.push({
+				tag: "meta",
+				attrs: {
+					name: "googlebot",
+					content: gbContent
+				}
+			});
+		}
+	}
+	if (metadata.openGraph) {
+		const og = { ...metadata.openGraph };
+		if (og.title === void 0 && typeof metadata.title === "string") og.title = metadata.title;
+		if (og.description === void 0 && metadata.description) og.description = metadata.description;
+		renderOpenGraph(og, elements);
+	}
+	if (metadata.twitter) {
+		const tw = { ...metadata.twitter };
+		if (tw.title === void 0) tw.title = metadata.openGraph?.title !== void 0 ? metadata.openGraph.title : typeof metadata.title === "string" ? metadata.title : void 0;
+		if (tw.description === void 0) tw.description = metadata.openGraph?.description !== void 0 ? metadata.openGraph.description : metadata.description;
+		renderTwitter(tw, elements);
+	}
+	if (metadata.icons) renderIcons(metadata.icons, elements);
+	if (metadata.manifest) elements.push({
+		tag: "link",
+		attrs: {
+			rel: "manifest",
+			href: metadata.manifest
+		}
+	});
+	if (metadata.alternates) renderAlternates(metadata.alternates, elements);
+	if (metadata.verification) renderVerification(metadata.verification, elements);
+	if (metadata.formatDetection) {
+		const parts = [];
+		if (metadata.formatDetection.telephone === false) parts.push("telephone=no");
+		if (metadata.formatDetection.email === false) parts.push("email=no");
+		if (metadata.formatDetection.address === false) parts.push("address=no");
+		if (parts.length > 0) elements.push({
+			tag: "meta",
+			attrs: {
+				name: "format-detection",
+				content: parts.join(", ")
+			}
+		});
+	}
+	if (metadata.authors) {
+		const authorList = Array.isArray(metadata.authors) ? metadata.authors : [metadata.authors];
+		for (const author of authorList) {
+			if (author.name) elements.push({
+				tag: "meta",
+				attrs: {
+					name: "author",
+					content: author.name
+				}
+			});
+			if (author.url) elements.push({
+				tag: "link",
+				attrs: {
+					rel: "author",
+					href: author.url
+				}
+			});
+		}
+	}
+	if (metadata.appleWebApp) renderAppleWebApp(metadata.appleWebApp, elements);
+	if (metadata.appLinks) renderAppLinks(metadata.appLinks, elements);
+	if (metadata.itunes) renderItunes(metadata.itunes, elements);
+	if (metadata.other) for (const [name, value] of Object.entries(metadata.other)) {
+		const content = Array.isArray(value) ? value.join(", ") : value;
+		elements.push({
+			tag: "meta",
+			attrs: {
+				name,
+				content
+			}
+		});
+	}
+	return elements;
+}
+function renderRobotsObject(robots) {
+	const parts = [];
+	if (robots.index === true) parts.push("index");
+	if (robots.index === false) parts.push("noindex");
+	if (robots.follow === true) parts.push("follow");
+	if (robots.follow === false) parts.push("nofollow");
+	return parts.join(", ");
+}
+//#endregion
+//#region src/server/metadata.ts
+/**
+* Resolve a title value with an optional template.
+*
+* - string → apply template if present
+* - { absolute: '...' } → use as-is, skip template
+* - { default: '...' } → use as fallback (no template applied)
+* - undefined → undefined
+*/
+function resolveTitle(title, template) {
+	if (title === void 0 || title === null) return;
+	if (typeof title === "string") return template ? template.replace("%s", title) : title;
+	if (title.absolute !== void 0) return title.absolute;
+	if (title.default !== void 0) return title.default;
+}
+/**
+* Resolve metadata from a segment chain.
+*
+* Processes entries from root layout to page (in segment order).
+* The merge algorithm:
+*   1. Shallow-merge all keys except title (later wins)
+*   2. Track the most recent title template
+*   3. Resolve the final title using the template
+*
+* In error state, the page entry is dropped and noindex is injected.
+*
+* See design/16-metadata.md §"Merge Algorithm"
+*/
+function resolveMetadata(entries, options = {}) {
+	const { errorState = false } = options;
+	const merged = {};
+	let titleTemplate;
+	let lastDefault;
+	let rawTitle;
+	for (const { metadata, isPage } of entries) {
+		if (errorState && isPage) continue;
+		if (metadata.title !== void 0 && typeof metadata.title === "object") {
+			if (metadata.title.template !== void 0) titleTemplate = metadata.title.template;
+			if (metadata.title.default !== void 0) lastDefault = metadata.title.default;
+		}
+		for (const key of Object.keys(metadata)) {
+			if (key === "title") continue;
+			merged[key] = metadata[key];
+		}
+		if (metadata.title !== void 0) rawTitle = metadata.title;
+	}
+	if (errorState) {
+		rawTitle = lastDefault !== void 0 ? { default: lastDefault } : rawTitle;
+		titleTemplate = void 0;
+	}
+	const resolvedTitle = resolveTitle(rawTitle, titleTemplate);
+	if (resolvedTitle !== void 0) merged.title = resolvedTitle;
+	if (errorState) merged.robots = "noindex";
+	return merged;
+}
+/**
+* Check if a string is an absolute URL.
+*/
+function isAbsoluteUrl(url) {
+	return url.startsWith("http://") || url.startsWith("https://") || url.startsWith("//");
+}
+/**
+* Resolve a relative URL against a base URL.
+*/
+function resolveUrl(url, base) {
+	if (isAbsoluteUrl(url)) return url;
+	return new URL(url, base).toString();
+}
+/**
+* Resolve relative URLs in metadata fields against metadataBase.
+*
+* Returns a new metadata object with URLs resolved. Absolute URLs are not modified.
+* If metadataBase is not set, returns the metadata unchanged.
+*/
+function resolveMetadataUrls(metadata) {
+	const base = metadata.metadataBase;
+	if (!base) return metadata;
+	const result = { ...metadata };
+	if (result.openGraph) {
+		result.openGraph = { ...result.openGraph };
+		if (typeof result.openGraph.images === "string") result.openGraph.images = resolveUrl(result.openGraph.images, base);
+		else if (Array.isArray(result.openGraph.images)) result.openGraph.images = result.openGraph.images.map((img) => ({
+			...img,
+			url: resolveUrl(img.url, base)
+		}));
+		else if (result.openGraph.images) result.openGraph.images = {
+			...result.openGraph.images,
+			url: resolveUrl(result.openGraph.images.url, base)
+		};
+		if (result.openGraph.url && !isAbsoluteUrl(result.openGraph.url)) result.openGraph.url = resolveUrl(result.openGraph.url, base);
+	}
+	if (result.twitter) {
+		result.twitter = { ...result.twitter };
+		if (typeof result.twitter.images === "string") result.twitter.images = resolveUrl(result.twitter.images, base);
+		else if (Array.isArray(result.twitter.images)) {
+			const resolved = result.twitter.images.map((img) => typeof img === "string" ? resolveUrl(img, base) : {
+				...img,
+				url: resolveUrl(img.url, base)
+			});
+			const allStrings = resolved.every((r) => typeof r === "string");
+			result.twitter.images = allStrings ? resolved : resolved;
+		} else if (result.twitter.images) result.twitter.images = {
+			...result.twitter.images,
+			url: resolveUrl(result.twitter.images.url, base)
+		};
+	}
+	if (result.alternates) {
+		result.alternates = { ...result.alternates };
+		if (result.alternates.canonical && !isAbsoluteUrl(result.alternates.canonical)) result.alternates.canonical = resolveUrl(result.alternates.canonical, base);
+		if (result.alternates.languages) {
+			const langs = {};
+			for (const [lang, url] of Object.entries(result.alternates.languages)) langs[lang] = isAbsoluteUrl(url) ? url : resolveUrl(url, base);
+			result.alternates.languages = langs;
+		}
+	}
+	if (result.icons) {
+		result.icons = { ...result.icons };
+		if (typeof result.icons.icon === "string") result.icons.icon = resolveUrl(result.icons.icon, base);
+		else if (Array.isArray(result.icons.icon)) result.icons.icon = result.icons.icon.map((i) => ({
+			...i,
+			url: resolveUrl(i.url, base)
+		}));
+		if (typeof result.icons.apple === "string") result.icons.apple = resolveUrl(result.icons.apple, base);
+		else if (Array.isArray(result.icons.apple)) result.icons.apple = result.icons.apple.map((i) => ({
+			...i,
+			url: resolveUrl(i.url, base)
+		}));
+	}
+	return result;
+}
+//#endregion
+//#region src/server/route-handler.ts
+/** All recognized HTTP method export names. */
+var HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS"
+];
+/**
+* Resolve the full list of allowed methods for a route module.
+*
+* Includes:
+* - All explicitly exported methods
+* - HEAD (implicit when GET is exported)
+* - OPTIONS (always implicit)
+*/
+function resolveAllowedMethods(mod) {
+	const methods = [];
+	for (const method of HTTP_METHODS) {
+		if (method === "HEAD" || method === "OPTIONS") continue;
+		if (mod[method]) methods.push(method);
+	}
+	if (mod.GET && !mod.HEAD) methods.push("HEAD");
+	else if (mod.HEAD) methods.push("HEAD");
+	if (!mod.OPTIONS) methods.push("OPTIONS");
+	else methods.push("OPTIONS");
+	return methods;
+}
+/**
+* Handle an incoming request against a route.ts module.
+*
+* Dispatches to the named method handler, auto-generates 405/OPTIONS,
+* and merges response headers from ctx.headers.
+*/
+async function handleRouteRequest(mod, ctx) {
+	const method = ctx.req.method.toUpperCase();
+	const allowHeader = resolveAllowedMethods(mod).join(", ");
+	if (method === "OPTIONS") {
+		if (mod.OPTIONS) return runHandler(mod.OPTIONS, ctx);
+		return mergeResponseHeaders(new Response(null, {
+			status: 204,
+			headers: { Allow: allowHeader }
+		}), ctx.headers);
+	}
+	if (method === "HEAD") {
+		if (mod.HEAD) return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
+		if (mod.GET) return stripHeadBody(await runHandler(mod.GET, ctx), method);
+	}
+	const handler = mod[method];
+	if (!handler) return mergeResponseHeaders(new Response(null, {
+		status: 405,
+		headers: { Allow: allowHeader }
+	}), ctx.headers);
+	return runHandler(handler, ctx);
+}
+/**
+* Run a handler with cookie writes enabled and merge ctx.headers into its
+* response.
+*
+* Cookies (design/29-cookies.md §"Where Cookies Can Be Set"): the render
+* phase applied the jar to `ctx.headers` before the handler ran, so on the
+* way out only what the handler changed is synced onto that bag. It happens
+* whether the handler returns or throws, so a cookie set before `redirect()`
+* rides the redirect, and the pipeline's 500 for a throw carries the same
+* bag.
+*
+* Nothing is caught. A signal goes to the pipeline, whose deny fallback
+* answers a route.ts match in JSON and whose redirect outcome sends the 3xx
+* (TIM-1533). Any other error goes to the pipeline, which logs it,
+* reports it to `onRequestError` as phase `'route'`, and answers it in the
+* same format as every other route.ts error (TIM-1537).
+*/
+async function runHandler(handler, ctx) {
+	const applied = getSetCookieHeaders();
+	setMutableCookieContext(true);
+	let res;
+	try {
+		res = await handler(ctx);
+	} finally {
+		setMutableCookieContext(false);
+		syncCookieJar(ctx.headers, applied);
+	}
+	return mergeResponseHeaders(res, ctx.headers);
+}
+/**
+* Merge response headers from ctx.headers into the handler's response.
+* ctx.headers (set by middleware or the handler) are applied to the final response.
+* Handler-set headers take precedence over ctx.headers.
+*/
+function mergeResponseHeaders(res, ctxHeaders) {
+	let hasCtxHeaders = false;
+	ctxHeaders.forEach(() => {
+		hasCtxHeaders = true;
+	});
+	if (!hasCtxHeaders) return res;
+	const merged = new Headers();
+	ctxHeaders.forEach((value, key) => {
+		if (key.toLowerCase() === "set-cookie") merged.append(key, value);
+		else merged.set(key, value);
+	});
+	const resCookies = res.headers.getSetCookie();
+	for (const cookie of resCookies) merged.append("Set-Cookie", cookie);
+	res.headers.forEach((value, key) => {
+		if (key.toLowerCase() !== "set-cookie") merged.set(key, value);
+	});
+	return new Response(res.body, {
+		status: res.status,
+		statusText: res.statusText,
+		headers: merged
+	});
+}
+//#endregion
+//#region src/server/prebuilt/cache-key.ts
+/**
+* Component cache-key hashing for prebuilt (cache.component) entries.
+*
+* Key: `sha256(canonicalJson({ props, params })).slice(0, 16)` — see
+* design/44-render-at-build-time.md §Cache Key. Both the request-time
+* lookup (prebuilt-runtime.ts) and the post-build capture pass (TIM-1119)
+* MUST use this exact function, or build artifacts become unaddressable.
+*
+* THE IDENTITY CONTRACT (design/44 §Cache Key): cache identity is **JSON
+* value semantics** — two inputs are the same entry iff they are the same
+* JSON value. This is an ALLOWLIST, not a denylist: a value participates
+* in caching iff it is plain JSON data — null, boolean, finite number,
+* string, dense array, or a plain `Object.prototype` object with only
+* enumerable string-keyed data properties — plus `undefined` and `-0`,
+* which hash as distinct sentinels because flight preserves them. Every
+* value outside that domain (functions, symbols, bigints, accessors,
+* hidden or symbol-keyed properties, non-`Object.prototype` prototypes
+* including null, aliased references, sparse arrays, cycles, non-finite
+* numbers) is UNKEYABLE by definition: `computeComponentCacheKey` returns
+* null and the caller renders live — slower, never wrong.
+*
+* The line between rejected and declared-out-of-domain: values are
+* REJECTED when the JSON projection itself would be ambiguous or lossy
+* (hidden/symbol/non-enumerable properties, accessors, exotic
+* prototypes). Observable state that leaves the projection intact — key
+* order, reference identity, descriptor metadata (writable/configurable,
+* frozen/sealed/extensible), proxy behavior — is DECLARED outside
+* cache.component's supported input domain rather than rejected:
+* key-order insensitivity is required for determinism, and rejecting
+* frozen objects would unkey ubiquitous legitimate inputs
+* (Object.freeze'd config props) to defend against components that
+* render differently based on property attributes.
+*
+* Two hard rules for this walk itself: it must be TOTAL (never throw
+* anything but UnkeyableValueError) and SIDE-EFFECT-FREE (descriptor
+* reads only; never invoke user code such as getters).
+*
+* Object keys sort recursively so `{a, b}` and `{b, a}` hash identically
+* (design/13-security.md checklist #14 — cache key determinism; key order
+* is deliberately NOT part of identity).
+*/
+var UnkeyableValueError = class extends Error {};
+function canonicalize$1(value, seen) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "string": return JSON.stringify(value);
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new UnkeyableValueError("non-finite number");
+			return Object.is(value, -0) ? "-0" : String(value);
+		case "object": break;
+		case "undefined": return "undefined";
+		default: throw new UnkeyableValueError(`unsupported type: ${typeof value}`);
+	}
+	const obj = value;
+	if (seen.has(obj)) throw new UnkeyableValueError("repeated object reference (cycle or alias)");
+	seen.add(obj);
+	if (Object.getOwnPropertySymbols(obj).length > 0) throw new UnkeyableValueError("symbol-keyed property");
+	{
+		if (Array.isArray(obj)) {
+			if (Object.getOwnPropertyNames(obj).length !== obj.length + 1) throw new UnkeyableValueError("non-index array property");
+			const parts = [];
+			for (let i = 0; i < obj.length; i++) {
+				const desc = Object.getOwnPropertyDescriptor(obj, i);
+				if (desc === void 0) throw new UnkeyableValueError("sparse array hole");
+				if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+				if (!desc.enumerable) throw new UnkeyableValueError("non-enumerable array element");
+				parts.push(canonicalize$1(desc.value, seen));
+			}
+			return "[" + parts.join(",") + "]";
+		}
+		if (Object.getPrototypeOf(obj) !== Object.prototype) throw new UnkeyableValueError("non-plain object");
+		const keys = Object.keys(obj).sort();
+		if (keys.length !== Object.getOwnPropertyNames(obj).length) throw new UnkeyableValueError("non-enumerable property");
+		const parts = [];
+		for (const key of keys) {
+			const desc = Object.getOwnPropertyDescriptor(obj, key);
+			if (desc.get !== void 0 || desc.set !== void 0) throw new UnkeyableValueError("accessor property");
+			parts.push(JSON.stringify(key) + ":" + canonicalize$1(desc.value, seen));
+		}
+		return "{" + parts.join(",") + "}";
+	}
+}
+/**
+* Canonicalize a single value, or null if it is unkeyable. The ONE
+* definition of "faithfully comparable" — every prebuilt code path that
+* needs value equality (cache keys, slot-param divergence) goes through
+* this, so the unkeyable rules (accessors, hidden props, aliases,
+* bigints, …) live in exactly one place.
+*/
+function tryCanonicalize(value) {
+	try {
+		return canonicalize$1(value, /* @__PURE__ */ new Set());
+	} catch (error) {
+		return toUnkeyable(error);
+	}
+}
+/**
+* Totality by construction: ANY throw from the walk means the input is
+* outside the keyable domain. The walk touches only user-controlled
+* values through reflection ops — and a Proxy trap can throw arbitrary
+* errors from any of them (codex review on PR #835) — so converting only
+* UnkeyableValueError would let hostile/exotic inputs abort a render
+* that plain live rendering would have served fine. Unexpected error
+* types are logged for visibility (they would indicate either a proxy
+* trap or a canonicalizer bug) but still degrade to unkeyable.
+*/
+function toUnkeyable(error) {
+	if (!(error instanceof UnkeyableValueError)) console.error("[timber] cache key canonicalization threw — treating input as unkeyable:", error);
+	return null;
+}
+/**
+* Split a props record into data props (participate in the cache key) and
+* slot values (React-element holes, excluded from the key) per the
+* component's declared `slots` option (TIM-1173).
+*
+* Every DECLARED slot lands in `slotValues` — present or not — because the
+* capture render always injects a SlotOutlet placeholder for each declared
+* slot: the cached shell is identical whether the caller passed the slot
+* or omitted it, so slot presence must not vary the key. `dataProps` is
+* everything else and is what gets hashed.
+*
+* Returns null when the props OBJECT itself is outside the identity
+* contract at the top level — accessors, symbol-keyed or non-enumerable
+* properties, or a non-`Object.prototype` prototype. Splitting such an
+* object would normalize away observable state (and reading an accessor
+* would invoke user code, which this walk must never do) BEFORE
+* `computeComponentCacheKey` gets the chance to reject it — a cached
+* shell could then be served for inputs a live render distinguishes.
+* Null means unkeyable: the caller renders live with the original props.
+* The walk is descriptor-reads only; getters are never invoked. Nested
+* data-prop values still face the full allowlist when hashed.
+*/
+/** Create an own enumerable data property — safe for keys like `__proto__`. */
+function defineOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
+function splitSlotProps(props, slots) {
+	try {
+		if (Object.getPrototypeOf(props) !== Object.prototype) return null;
+		if (Object.getOwnPropertySymbols(props).length > 0) return null;
+		const slotSet = new Set(slots);
+		const dataProps = {};
+		const slotValues = {};
+		for (const key of Object.getOwnPropertyNames(props)) {
+			const desc = Object.getOwnPropertyDescriptor(props, key);
+			if (desc === void 0 || desc.get !== void 0 || desc.set !== void 0 || !desc.enumerable) return null;
+			defineOwn(slotSet.has(key) ? slotValues : dataProps, key, desc.value);
+		}
+		for (const slot of slotSet) if (!Object.hasOwn(slotValues, slot)) defineOwn(slotValues, slot, void 0);
+		return {
+			dataProps,
+			slotValues
+		};
+	} catch (error) {
+		return toUnkeyable(error);
+	}
+}
+/**
+* Compute the cache-entry hash for a component render:
+* `sha256({props, params}).slice(0, 16)` over canonical JSON.
+*
+* Returns null when props (or params) contain unkeyable values — the
+* caller must fall back to dynamic rendering.
+*/
+function computeComponentCacheKey(props, params) {
+	let canonical;
+	try {
+		const seen = /* @__PURE__ */ new Set();
+		canonical = "{\"params\":" + canonicalize$1({ ...params }, seen) + ",\"props\":" + canonicalize$1(props, seen) + "}";
+	} catch (error) {
+		return toUnkeyable(error);
+	}
+	return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+//#endregion
+//#region src/client/slot-context.ts
+/**
+* SlotContext — delivers live slot content to SlotOutlet holes inside
+* cached component shells (TIM-1173).
+*
+* A `cache.component(Fn, { slots: [...] })` shell is captured with a
+* stable <SlotOutlet slot={name} /> client reference in place of each
+* declared slot prop. At request time the revived shell is wrapped in a
+* SlotsProvider carrying the live slot values; each outlet reads its
+* value from this context by name.
+*
+* Providers MERGE per-key with their parent: an inner SlotsProvider
+* inherits the outer's values and overrides only the keys it declares.
+* Two sibling instances each have their own provider and resolve
+* independently. Layouts use a reserved slot name (LAYOUT_CHILDREN_SLOT)
+* that cannot collide with user-declared slot names (TIM-1191).
+*
+* Generalizes the original layout children pattern (TIM-1181) from a
+* single implicit `children` hole on layouts to explicitly declared,
+* named slot props on any cached component. Layouts use this same
+* context with the reserved LAYOUT_CHILDREN_SLOT key (TIM-1191).
+*
+* SINGLETON GUARANTEE: globalThis + Symbol.for — the RSC client bundler
+* can duplicate this module across chunks; globalThis guarantees a single
+* context instance.
+*
+* See design/45-cache-lifetimes.md §Slot Components.
+*/
+var CTX_KEY = Symbol.for("__timber_slot_ctx");
+function getOrCreateContext() {
+	const existing = globalThis[CTX_KEY];
+	if (existing !== void 0) return existing;
+	if (typeof React.createContext === "function") {
+		const ctx = React.createContext(null);
+		globalThis[CTX_KEY] = ctx;
+		return ctx;
+	}
+}
+var SlotContext = getOrCreateContext();
+//#endregion
+//#region src/client/slot-outlet.tsx
+/**
+* SlotOutlet — the hole in a cached component shell (TIM-1173).
+*
+* At capture time the prebuilt runtime renders the wrapped component with
+* <SlotOutlet slot={name} /> in place of each declared slot prop. Being a
+* client component, it serializes into the flight payload as a stable,
+* deterministic client reference — the same bytes regardless of what live
+* content will fill the hole. At request time the revived shell sits under
+* a SlotsProvider and each outlet reads its live value from SlotContext.
+*
+* See design/45-cache-lifetimes.md §Slot Components.
+*/
+function SlotOutlet({ slot }) {
+	const values = useContext(SlotContext);
+	return values ? values[slot] ?? null : null;
+}
+//#endregion
+//#region src/client/slot-provider.tsx
+/**
+* SlotsProvider — wraps a revived cached shell to supply live slot content
+* to the SlotOutlet holes inside it (TIM-1173).
+*
+* Values MERGE with the nearest parent provider so that nesting a
+* cache.component SlotsProvider inside a layout SlotsProvider preserves
+* the layout's `children` slot while adding the component's own slots.
+* Inner values override outer ones with the same name (spread order).
+*
+* Tree structure per cached-component instance:
+*   SlotsProvider(values={children: <Live />})
+*     └── revived shell
+*          └── SlotOutlet(slot="children") → reads context → <Live />
+*
+* See design/45-cache-lifetimes.md §Slot Components.
+*/
+function SlotsProvider({ values, children }) {
+	const parent = useContext(SlotContext);
+	const merged = parent ? {
+		...parent,
+		...values
+	} : values;
+	return createElement(SlotContext.Provider, { value: merged }, children);
+}
+//#endregion
+//#region src/server/prebuilt/lifetime.ts
+/**
+* Lifetime declarations of a `cache.component` — `prerender`, `ttl`,
+* `tags` (design/45-cache-lifetimes.md) — and the nesting clamp between
+* two of them (§Nesting Semantics, TIM-1136).
+*
+* The clamp rule lives here once, for both places a capture can embed one
+* wrapped component in another: the post-build capture pass
+* (server/prebuilt-builder.ts) and request-time re-renders
+* (`captureComponentPayload()` in server/prebuilt-runtime.ts, TIM-1545).
+*/
+/** Whether the component has a runtime lifetime (ttl or tags). */
+function hasRuntimeLifetime(options) {
+	return options.ttl !== void 0 || options.tags != null;
+}
+/**
+* Resolve tags from options (may be static array or function of props).
+* Function-form tags receive DATA props only — slot props are excluded so
+* the tags fn never sees SlotOutlet placeholders (capture paths pass
+* placeholder-substituted props) and tags stay deterministic per key.
+*/
+function resolveTags(options, props) {
+	if (!options.tags) return [];
+	if (Array.isArray(options.tags)) return options.tags;
+	const slots = options.slots;
+	const fnProps = slots && slots.length > 0 ? splitSlotProps(props, slots)?.dataProps ?? props : props;
+	return options.tags(fnProps);
+}
+/**
+* Why an embedded copy of `inner` goes stale inside `outer`, or null when
+* the outer's refreshes cover every refresh channel the inner declares:
+*
+* - `shorterTtl`: the inner's ttl is shorter than the outer's effective
+*   lifetime (its ttl, or deploy-long without one).
+* - `missingTags`: tags the inner resolved to that the outer lacks —
+*   `revalidateTag` on them refreshes the inner's own entries, never the
+*   copy. `null` inner tags (a tags function threw) cannot be proven a
+*   subset, so they count as missing.
+*
+* Declaring the inner's tags on the outer is the documented fix, and it
+* silences the tag half by construction.
+*/
+function clampReasons(outer, inner) {
+	const outerTtl = outer.options.ttl ?? Infinity;
+	const shorterTtl = inner.options.ttl !== void 0 && inner.options.ttl < outerTtl;
+	const missingTags = inner.tags === null ? null : inner.tags.filter((t) => !outer.tags.includes(t));
+	if (!shorterTtl && missingTags !== null && missingTags.length === 0) return null;
+	return {
+		shorterTtl,
+		missingTags
+	};
+}
+/** Render a lifetime declaration for the clamp warning. */
+function describeLifetime(options, tags) {
+	const parts = [];
+	if (options.prerender) parts.push("prerender");
+	if (options.ttl !== void 0) parts.push(`ttl: ${options.ttl}`);
+	if (tags === null) parts.push("tags: fn");
+	else if (tags.length > 0) parts.push(`tags: ${JSON.stringify(tags)}`);
+	return parts.join(", ") || "no lifetime";
+}
+/** When the outer entry — and so every copy embedded in it — refreshes. */
+function describeRefresh(outer) {
+	const parts = [];
+	if (outer.options.ttl !== void 0) parts.push(`every ${outer.options.ttl}s`);
+	if (outer.tags.length > 0) parts.push(`on revalidateTag of its own tags`);
+	parts.push("on redeploy");
+	return parts.join(", or ");
+}
+/**
+* Warn for each wrapped component embedded in `outer`'s captured payload
+* whose refresh channels the outer cannot honor. Once per (outer, inner)
+* pair for the lifetime of `warnedPairs` — the builder passes one per
+* build, the runtime one per process, since re-renders repeat. The key is
+* the pair alone, not the reason: resolved tags vary with props, and a key
+* that included them would grow with the data. So the first clamp found
+* for a pair is the one reported. Returns the number of warnings emitted.
+*/
+function warnNestingClamps(outer, nested, warnedPairs, log) {
+	let count = 0;
+	for (const inner of nested) {
+		const reasons = clampReasons(outer, inner);
+		if (reasons === null) continue;
+		const pairKey = `${outer.id}\0${inner.innerId}`;
+		if (warnedPairs.has(pairKey)) continue;
+		warnedPairs.add(pairKey);
+		count++;
+		const outerLifetime = describeLifetime(outer.options, outer.tags);
+		const innerLifetime = describeLifetime(inner.options, inner.tags);
+		const consequences = [];
+		if (reasons.missingTags === null) consequences.push(`${inner.innerId}'s tags could not be resolved during the capture (its tags function threw or needed request context), so revalidating them may NOT update the embedded copy.`);
+		else if (reasons.missingTags.length > 0) {
+			const calls = reasons.missingTags.map((t) => `revalidateTag(${JSON.stringify(t)})`);
+			consequences.push(`${calls.join(", ")} will NOT update the embedded copy; tag ${outer.id} itself if you need that.`);
+		}
+		if (reasons.shorterTtl) consequences.push(`${inner.innerId}'s ttl: ${inner.options.ttl} does not apply to the embedded copy.`);
+		log(`[timber] ${inner.innerId} (${innerLifetime}) is embedded in ${outer.options.prerender ? "prerendered" : "cached"} ${outer.id} — the embedded copy refreshes only when ${outer.id} does (${describeRefresh(outer)}). ${consequences.join(" ")} Chain: ${outer.id} (${outerLifetime}) → ${inner.innerId} (${innerLifetime})`);
+	}
+	return count;
+}
+/**
+* Is this value the framework-injected layout children slot outlet
+* (`<SlotOutlet slot={LAYOUT_CHILDREN_SLOT} />`)? Layout components
+* receive this as their `children` prop — a stable client reference
+* whose cache key is stripped so layout `cache.component` hits work
+* (design/45 §Layout Propagation).
+*
+* Uses a framework-reserved slot name (LAYOUT_CHILDREN_SLOT) that
+* cannot collide with user-declared slot names, preventing context
+* shadowing when a cached component with its own SlotsProvider is
+* nested inside a layout. See TIM-1191.
+*
+* Total: the probes run against a user-controlled value, and a Proxy
+* trap can throw — that must classify as "not the outlet" (the
+* canonicalizer then rejects the value as unkeyable → live render), not
+* abort the request (codex P2 on PR #890).
+*/
+function isChildrenSlotOutletElement(value) {
+	try {
+		if (value == null || typeof value !== "object") return false;
+		if (!("type" in value)) return false;
+		const el = value;
+		return el.type === SlotOutlet && el.props?.slot === "\0timber:children";
+	} catch {
+		return false;
+	}
+}
+/**
+* `props` without the framework-injected children outlet — the key props
+* of a render. The outlet is the same client reference on every request,
+* so it never varies the cache key; user-provided children stay (and
+* leave the props unkeyable). See design/45 §Layout Propagation, TIM-1181.
+*/
+function withoutChildrenOutlet(props) {
+	if (!isChildrenSlotOutletElement(props.children)) return props;
+	const { children: _children, ...rest } = props;
+	return rest;
+}
+/**
+* Dense array of non-empty strings — no holes, no non-string entries.
+* Total: the reads run against a user-controlled value at module load,
+* and a throwing Proxy trap must classify as invalid, not crash startup.
+*/
+function isDenseStringArray(value) {
+	try {
+		if (!Array.isArray(value)) return false;
+		for (let i = 0; i < value.length; i++) {
+			if (!Object.hasOwn(value, i)) return false;
+			const entry = value[i];
+			if (typeof entry !== "string" || entry.length === 0) return false;
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate the `slots` option. Both the production and dev wrappers gate
+* on this — slot substitution is active in dev exactly when it would be
+* active in production, so the tree shape a component sees never
+* diverges between the two.
+*/
+function resolveSlotNames(id, options) {
+	const slots = options.slots;
+	if (slots === void 0) return { kind: "none" };
+	if (!isDenseStringArray(slots)) {
+		console.warn(`[timber] cache.component "${id}": invalid slots declaration — expected an array of non-empty prop-name strings. Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	if (slots.length === 0) return { kind: "none" };
+	if (!hasRuntimeLifetime(options)) {
+		console.warn(`[timber] cache.component "${id}": slots require a runtime lifetime (ttl and/or tags). Slot caching is disabled.`);
+		return { kind: "disabled" };
+	}
+	return {
+		kind: "active",
+		slots
+	};
+}
+/**
+* Split the live props into the cacheable shell render (data props plus a
+* deterministic SlotOutlet placeholder per declared slot — identical
+* whether or not the caller passed the slot) and the per-instance live
+* slot values.
+*
+* Null when the props object itself is unkeyable at the top level
+* (accessors, hidden properties, exotic prototype — see splitSlotProps):
+* the caller must render live with the original props.
+*/
+function prepareSlotRender(props, slots) {
+	const split = splitSlotProps(props ?? {}, slots);
+	if (split === null) return null;
+	const { dataProps, slotValues } = split;
+	const shellProps = { ...dataProps };
+	for (const slot of slots) Object.defineProperty(shellProps, slot, {
+		value: createElement(SlotOutlet, { slot }),
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	return {
+		shellProps,
+		dataProps,
+		slotValues
+	};
+}
+/**
+* Wrap a rendered shell (revived payload or live element) in a
+* per-instance SlotsProvider feeding the live values to its outlets.
+*/
+function wrapInSlotsProvider(shell, slotValues) {
+	return createElement(SlotsProvider, {
+		values: slotValues,
+		children: shell
+	});
+}
+//#endregion
+//#region src/server/prebuilt/key-discipline.ts
+var REQUEST_CONTEXT_FIELDS = {
+	headers: "headers()",
+	parsedCookies: "cookies()",
+	searchParams: "searchParams"
+};
+/** Rate-limit interval: one diagnostic per component per 60 seconds. */
+var RATE_LIMIT_MS = 6e4;
+/** Last emission timestamp per component ID. */
+var lastEmitted = /* @__PURE__ */ new Map();
+var strict = false;
+/**
+* Whether the proxy should be created for this component on this render.
+* Returns true when strict mode is on (always check) or enough time has
+* elapsed since the last diagnostic for this component.
+*/
+function shouldCheckKeyDiscipline(id) {
+	if (strict) return true;
+	const last = lastEmitted.get(id);
+	if (last === void 0) return true;
+	return Date.now() - last >= RATE_LIMIT_MS;
+}
+/**
+* Wrap a store with a proxy that records per-request field access.
+* The proxy forwards all reads/writes transparently — it only observes.
+*/
+function createKeyDisciplineProxy(store) {
+	const accessedApis = /* @__PURE__ */ new Set();
+	return {
+		proxy: new Proxy(store, { get(target, prop, receiver) {
+			const api = REQUEST_CONTEXT_FIELDS[prop];
+			if (api) accessedApis.add(api);
+			return Reflect.get(target, prop, receiver);
+		} }),
+		accessedApis
+	};
+}
+/**
+* Emit the key-discipline diagnostic or throw in strict mode.
+*
+* In strict mode: throws an error so the tainted payload is never cached.
+* In default mode: emits a structured error-level diagnostic through the
+* logger (same path as render errors), rate-limited per component.
+*/
+function emitKeyDisciplineWarning(id, apis) {
+	const apiList = Array.from(apis).join(", ");
+	if (strict) throw new Error(`[timber] cache.component key-discipline violation: "${id}" reads ${apiList} during a cache capture render. The cache key does not include request-derived values — caching this output would serve one user's data to another. Either pass request-derived values as props (included in the cache key) or remove the ${apiList} call. To downgrade this to a warning, set cache.strictKeyDiscipline: false in timber.config.ts.`);
+	const now = Date.now();
+	const last = lastEmitted.get(id);
+	if (last !== void 0 && now - last < RATE_LIMIT_MS) return;
+	lastEmitted.set(id, now);
+	getLogger().error("cache.component cross-user data leak risk", {
+		component: id,
+		accessedApis: Array.from(apis),
+		message: `cache.component "${id}" reads ${apiList} but the cache key is computed from props and segment params only. If the output varies by ${apiList}, different users may see each other's cached content. Either pass request-derived values as props (included in the cache key) or remove the ${apiList} call.`
+	});
+}
+//#endregion
+//#region src/server/prebuilt/capture-state.ts
+/**
+* Capture state — the channel between a payload capture and the
+* `__prebuilt` wrappers that render inside it (server/prebuilt-runtime.ts).
+*
+* Two callers capture a wrapped component's flight payload:
+*
+* - **Build time**: the post-build capture pass (server/prebuilt-builder.ts)
+*   renders each registry entry in turn.
+* - **Request time**: `captureComponentPayload()` in prebuilt-runtime.ts
+*   renders a component in isolation for an inline re-render (full miss,
+*   stale entry, tombstone) or an SWR background re-render. These run
+*   concurrently with other requests' renders — and with each other.
+*
+* During a capture, the component's subtree may render OTHER wrapped
+* components. Those inner wrappers render live and their output is baked
+* flat into the outer entry — the nesting clamp of
+* design/45-cache-lifetimes.md §Nesting Semantics (TIM-1136). The wrapper
+* reports every render that happens inside a capture:
+*
+* - **Cycle**: the inner render IS the entry being captured — same
+*   component id AND same props key (TIM-1547). Left alone this recurses
+*   until the render times out; instead the wrapper throws
+*   `PrebuiltCaptureCycleError`, failing that entry with an error naming
+*   the cycle (build continues per doc 44 skip-and-report policy; at
+*   request time the re-render fails and is not cached, and the wrapper
+*   falls back as for any failed re-render). A component that renders
+*   itself with different props (a comment thread, a tree) is legitimate
+*   recursion with a base case and bakes flat like any other nesting.
+* - **Nesting**: any other wrapper render is recorded per inner component
+*   with the tags it resolved to. Both capture callers run the clamp rule
+*   over those records when the entry completes (prebuilt/lifetime.ts).
+*
+* Identity is the capture ROOT only. A wrapper cannot see the wrappers
+* between it and the root: Flight renders a component's children after
+* the wrapper has returned, in Flight's own async context, not in a frame
+* the wrapper could enter. So a same-key cycle that closes below the root
+* (`A(p1) → A(p2) → A(p2) → …`) is not detected here; it is also an
+* infinite recursion without caching, and the capture's render timeout
+* fails it.
+*
+* The props key is the props half of the cache key (data props only,
+* framework children outlet stripped — the same inputs the cache key
+* hashes). The params half is left out: every render inside one capture
+* reads the same segment params, so props decide identity. Unkeyable props
+* (live React elements, …) cannot be proven identical and are never a
+* cycle.
+*
+* Each capture's state lives in an AsyncLocalStorage store entered by
+* `CaptureScope.run()`, so it is visible only to renders started inside
+* that capture — including work Flight resumes after an await, which runs
+* in the context the awaited promise was created in. A concurrent request
+* rendering the same component is not a cycle, and a concurrent request
+* rendering a different cached component still revives it from cache
+* instead of baking it live (TIM-1536). Outside any capture
+* `noteWrapperRender` is a single store lookup.
+*/
+/** Thrown by the wrapper when a capture renders its own entry. */
+var PrebuiltCaptureCycleError = class extends Error {
+	constructor(componentId) {
+		super(`[timber] cache.component "${componentId}" renders itself with the same props (directly or through other components) — capturing its payload would recurse forever. Remove the cycle or stop caching this component with cache.component.`);
+		this.name = "PrebuiltCaptureCycleError";
+	}
+};
+/**
+* The props half of a render's cache key, or null when unkeyable. Same
+* inputs `tryRevivePayload` hashes: data props only for slot components,
+* the framework-injected children outlet stripped.
+*/
+function propsKey(options, props) {
+	let keyProps = props;
+	if (options.slots && options.slots.length > 0) {
+		const split = splitSlotProps(props, options.slots);
+		if (split === null) return null;
+		keyProps = split.dataProps;
+	}
+	return computeComponentCacheKey(withoutChildrenOutlet(keyProps), {});
+}
+/**
+* Open a capture of component `outerId` rendered with `props`. Its state
+* ends with the scope object.
+*/
+function createCaptureScope(outerId, options, props) {
+	const store = {
+		outerId,
+		outerPropsKey: propsKey(options, props),
+		nested: /* @__PURE__ */ new Map()
+	};
+	return {
+		run: (fn) => prebuiltCaptureAls.run(store, fn),
+		nestedRenders: () => Array.from(store.nested, ([innerId, record]) => ({
+			innerId,
+			options: record.options,
+			tags: record.tags && Array.from(record.tags)
+		}))
+	};
+}
+/** Whether the current render is inside a capture. */
+function isCaptureActive() {
+	return prebuiltCaptureAls.getStore() !== void 0;
+}
+/**
+* Called by the `__prebuilt` wrapper on every render. No-op outside a
+* capture. Throws `PrebuiltCaptureCycleError` when the render is the
+* entry the enclosing capture is producing.
+*/
+function noteWrapperRender(innerId, options, props) {
+	const capture = prebuiltCaptureAls.getStore();
+	if (capture === void 0) return;
+	if (innerId === capture.outerId && capture.outerPropsKey !== null) {
+		if (propsKey(options, props) === capture.outerPropsKey) throw new PrebuiltCaptureCycleError(innerId);
+	}
+	let record = capture.nested.get(innerId);
+	if (record === void 0) {
+		record = {
+			options,
+			tags: /* @__PURE__ */ new Set()
+		};
+		capture.nested.set(innerId, record);
+	}
+	if (record.tags !== null && options.tags) {
+		const tags = record.tags;
+		try {
+			for (const tag of requestContextAls.exit(() => resolveTags(options, props))) tags.add(tag);
+		} catch {
+			record.tags = null;
+		}
+	}
+}
+//#endregion
+//#region src/server/prebuilt-runtime.ts
+/**
+* Prebuilt component runtime — registration target for the timber-prebuilt
+* transform (plugins/prebuilt.ts) and the request-time half of
+* cache.component (TIM-1140).
+*
+* `cache.component(fn, opts)` call sites are rewritten at build time to
+* `__prebuilt(stableId, fn, opts)` (production) or `__prebuiltDev(name, fn)`
+* (dev). Both are exported via #server-internal — they are framework
+* plumbing, never called by user code directly.
+*
+* Cache hits are served by FLIGHT REVIVAL: the cached `.flight` payload is
+* decoded back into React elements inside the RSC environment with
+* `createFromReadableStream` (the flight client running in the flight
+* server — plugin-rsc wires the server-decode manifest so client
+* references revive as re-serializable reference proxies). The revived
+* element is returned from the wrapper and the outer render re-serializes
+* it like any other subtree. This is the same mechanism as Next.js
+* `"use cache"` (next/src/server/use-cache/use-cache-wrapper.ts).
+*
+* What a hit skips: all user work — data fetching, MDX compilation, the
+* component function itself never runs. What it re-pays: React
+* re-serializes the already-resolved tree (cost proportional to payload
+* size, not to data latency). The alternative — splicing raw payload bytes
+* into the outer stream — avoids re-serialization but requires byte-level
+* coupling to the flight wire format (row framing, ID rebasing, marker
+* detection); it was implemented and reviewed on PR #835 and deliberately
+* replaced by revival. See design/44-render-at-build-time.md
+* §Request-Time Injection.
+*
+* Misses render the original component live via the wrapper's own closure,
+* inside the React pass — segment params from ALS, deny()/redirect()
+* signals, Suspense, and error boundaries behave exactly as an unwrapped
+* component. `fallbackOnMissingSegmentParams: false` throws instead.
+*/
+/** Default timeout for component re-renders (overridden by renderTimeoutMs). */
+var DEFAULT_COMPONENT_TIMEOUT_MS = DEFAULT_RENDER_TIMEOUT_MS;
+/** Singleflight for component re-renders (inline and background). */
+var componentSingleflight = createSingleflight({ timeoutMs: DEFAULT_COMPONENT_TIMEOUT_MS });
+var componentTimeoutMs = DEFAULT_COMPONENT_TIMEOUT_MS;
+var warnedNoWaitUntil = false;
+/**
+* (outer, inner) pairs already warned about by request-time captures.
+* Process-wide: re-renders of a hot component repeat, and the warning is
+* about the code, not the request. Bounded by the number of wrapped
+* components in the app.
+*/
+var warnedNestingPairs = /* @__PURE__ */ new Set();
+/**
+* Server-side component registry, keyed by stable component ID. Populated at
+* module load time by `__prebuilt` calls; consumed by the post-build capture
+* pass (TIM-1119). Never serialized — component functions are not
+* Flight-serializable.
+*/
+var registry = /* @__PURE__ */ new Map();
+/**
+* Resolve the params the cache key may faithfully hash, or null if this
+* render is unkeyable.
+*
+* A wrapper rendered inside a parallel slot reads params merged with that
+* slot's overrides (`getSegmentParams`: `{...segmentParams, ...slotParams}`)
+* — but the cache key hashes only the route-level params, and the wrapper
+* cannot know which slot it renders under. The route params are usable
+* only when every slot's merged view canonicalizes identically to them;
+* otherwise two renders with the same key could see different effective
+* inputs and a hit could serve the WRONG cached subtree — so the render
+* goes live: slower, never wrong. (Build-time capture doesn't model slot
+* params either, so a divergent request could never have a faithful
+* entry. Codex review on PR #835; revisit with segment-path-scoped keys
+* if slot-scoped prebuilt is ever needed.)
+*
+* Comparison happens through `tryCanonicalize` — the same single
+* definition of value equality the cache key uses — so anything it
+* cannot represent faithfully (bigint-coerced codec params, accessors,
+* aliases, …) is unkeyable here too, and this guard can never throw.
+*/
+function resolveKeyParams(store) {
+	const main = store.segmentParams ?? {};
+	const slots = store.slotParams;
+	if (!slots || Object.keys(slots).length === 0) return main;
+	const mainCanonical = tryCanonicalize({ ...main });
+	if (mainCanonical === null) return null;
+	for (const slotParams of Object.values(slots)) {
+		const merged = tryCanonicalize({
+			...main,
+			...slotParams
+		});
+		if (merged === null || merged !== mainCanonical) return null;
+	}
+	return main;
+}
+/**
+* Mirror the production cache-key decision for a slot render, with no
+* cache IO — used by the dev wrapper so slot substitution happens in dev
+* exactly when production would serve the cache path rather than the
+* live fallback (dev/prod parity, codex P2 on PR #890): requires an ALS
+* store, keyable params (slot-param divergence unkeys), and keyable data
+* props (after the children slot outlet strip).
+*/
+function isSlotRenderKeyable(dataProps) {
+	const store = requestContextAls.getStore();
+	if (!store) return false;
+	const keyParams = resolveKeyParams(store);
+	if (keyParams === null) return false;
+	return computeComponentCacheKey(withoutChildrenOutlet(dataProps), keyParams) !== null;
+}
+/** Wrap payload bytes as a single-chunk ReadableStream for the decoder. */
+function bytesToStream(bytes) {
+	return new ReadableStream({ start(controller) {
+		controller.enqueue(bytes);
+		controller.close();
+	} });
+}
+/**
+* Serve a slot component from the cache: split live slot values out of the
+* props, look up / capture the shell (data props + a deterministic
+* SlotOutlet placeholder per slot), and wrap the revived shell in a
+* per-instance SlotsProvider that feeds the live values to the outlets.
+*
+* Null on any miss — the caller renders live with the original props.
+*/
+async function tryReviveSlotShell(id, options, slots, props) {
+	const render = prepareSlotRender(props, slots);
+	if (render === null) return null;
+	const { shellProps, dataProps, slotValues } = render;
+	const revived = await tryRevivePayload(id, options, shellProps, dataProps);
+	if (revived === null) return null;
+	return { element: wrapInSlotsProvider(revived.element, slotValues) };
+}
+var rscFns = null;
+function requireRscFunctions() {
+	if (!rscFns) throw new Error("[timber] RSC functions not wired — setRscFunctions() must be called at boot");
+	return rscFns;
+}
+/**
+* Revive flight payload bytes into a React element.
+* Returns null on any failure (corrupt payload, missing decoder).
+*/
+async function revivePayload(id, payload, outcome) {
+	try {
+		const { createFromReadableStream } = requireRscFunctions();
+		return { element: await createFromReadableStream(bytesToStream(payload)) };
+	} catch (error) {
+		console.error(`[timber] failed to revive prebuilt payload for "${id}" — ${outcome}:`, error);
+		return null;
+	}
+}
+/** Ceiling on component re-render capture (design/13 A2). Uses configured renderTimeoutMs. */
+function getCaptureTimeoutMs() {
+	return componentTimeoutMs;
+}
+/**
+* Render a component in isolation and capture its flight payload bytes.
+* Used for inline re-renders (tombstone/miss) and SWR background re-renders.
+*
+* The stream read is timeout-guarded and the reader is cancelled on
+* expiry (design/13 A2, A3).
+*/
+async function captureComponentPayload(id, component, props, options) {
+	const { renderToReadableStream } = requireRscFunctions();
+	const element = createElement(component, props);
+	const capture = createCaptureScope(id, options, props);
+	let renderError;
+	const store = requestContextAls.getStore();
+	const discipline = store && shouldCheckKeyDiscipline(id) ? createKeyDisciplineProxy(store) : null;
+	const doCapture = () => capture.run(async () => {
+		const bytes = await readAllBytesWithDeadline(runOutsideReactCacheScope(() => renderToReadableStream(element, { onError(error) {
+			renderError ??= { error };
+			return "";
+		} })), getCaptureTimeoutMs(), "[timber] component re-render capture");
+		if (renderError) throw renderError.error;
+		return bytes;
+	});
+	const bytes = discipline ? await requestContextAls.run(discipline.proxy, doCapture) : await doCapture();
+	if (discipline && discipline.accessedApis.size > 0) emitKeyDisciplineWarning(id, discipline.accessedApis);
+	return {
+		bytes,
+		nested: capture.nestedRenders()
+	};
+}
+/**
+* Store a captured entry in the overlay, then say which embedded
+* components it clamps (design/45 §Nesting Semantics, TIM-1545). The
+* warning follows the store: a capture that is discarded (aborted,
+* invalidated mid-render, failed store) holds no clamped copy, and must
+* not spend the pair's one warning.
+*/
+async function storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed) {
+	await storeOverlayEntry(id, cacheKey, captured.bytes, {
+		ttl: options.ttl,
+		tags,
+		hasSeed
+	});
+	warnNestingClamps({
+		id,
+		options,
+		tags
+	}, captured.nested, warnedNestingPairs, (m) => console.warn(m));
+}
+/**
+* Inline re-render: capture flight bytes, store in overlay, revive for
+* the current request. Singleflight-coalesced by overlay key.
+*/
+async function inlineRerender(id, component, props, cacheKey, options, hasSeed, outcome) {
+	const tags = resolveTags(options, props);
+	const oKey = overlayKey(id, cacheKey);
+	const sfKey = `prebuilt:${id}:${cacheKey}\0${lastInvalidationEpochFor(oKey, tags)}`;
+	try {
+		return await revivePayload(id, await componentSingleflight.do(sfKey, async (signal) => {
+			const startEpoch = currentInvalidationEpoch();
+			const captured = await captureComponentPayload(id, component, props, options);
+			if (!signal.aborted && hasRuntimeLifetime(options) && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed);
+			return captured.bytes;
+		}), outcome);
+	} catch (error) {
+		console.error(`[timber] cache.component re-render failed for "${id}" — ${outcome}:`, error);
+		return null;
+	}
+}
+/**
+* Snapshot the request context values needed for a background re-render.
+* Creates a FRESH store with copied values — the original ALS store is
+* not referenced after capture. The `Request` itself is shared, not
+* copied: the re-render reports its failure against it.
+*/
+function snapshotRequestContext(store) {
+	return {
+		request: store.request,
+		headers: new Headers(store.headers),
+		originalHeaders: new Headers(store.originalHeaders),
+		cookieHeader: store.cookieHeader,
+		parsedCookies: store.parsedCookies ? new Map(store.parsedCookies) : void 0,
+		searchParams: new URLSearchParams(store.searchParams),
+		searchString: store.searchString,
+		segmentParams: store.segmentParams ? { ...store.segmentParams } : void 0,
+		cookieJar: /* @__PURE__ */ new Map(),
+		flushed: false,
+		mutableContext: false
+	};
+}
+/**
+* Kick off a background re-render via waitUntil. The re-render runs inside
+* a fresh ALS scope with snapshotted request context.
+*/
+function backgroundRerender(id, component, props, cacheKey, options, hasSeed, snapshot) {
+	const waitUntil = getWaitUntil();
+	const tags = resolveTags(options, props);
+	const oKey = overlayKey(id, cacheKey);
+	const startEpoch = currentInvalidationEpoch();
+	const sfKey = `prebuilt-bg:${id}:${cacheKey}\0${lastInvalidationEpochFor(oKey, tags)}`;
+	const work = requestContextAls.run(snapshot, () => componentSingleflight.do(sfKey, (signal) => runBackgroundFlight(signal, async () => {
+		const captured = await captureComponentPayload(id, component, props, options);
+		if (!signal.aborted && !wasInvalidatedSince(startEpoch, oKey, tags)) await storeCapturedEntry(id, cacheKey, captured, options, tags, hasSeed);
+	}, (error) => console.error(`[timber] cache.component background re-render failed for "${id}":`, error))).catch(() => {}));
+	if (waitUntil) waitUntil(work);
+	else if (!warnedNoWaitUntil) {
+		warnedNoWaitUntil = true;
+		console.warn("[timber] cache.component SWR background re-render has no waitUntil — the re-render may be killed when the handler returns on serverless platforms. Ensure the adapter wires runWithWaitUntil().");
+	}
+}
+/**
+* Try to serve this render from the prebuilt cache: overlay → artifact →
+* live render. Handles ISR (SWR, tombstones, re-renders) per design/45.
+*
+* Null on any miss — the caller renders live.
+*/
+async function tryRevivePayload(id, options, props, keyPropsOverride) {
+	const hasSource = hasPrebuiltPayloadSource();
+	const hasRuntime = hasRuntimeLifetime(options);
+	if (!hasSource && !hasRuntime) return null;
+	const store = requestContextAls.getStore();
+	if (!store) return null;
+	const keyParams = (options.prerender ? await isParamIndependent(id) : false) ? {} : resolveKeyParams(store);
+	if (keyParams === null) return null;
+	const cacheKey = computeComponentCacheKey(withoutChildrenOutlet(keyPropsOverride ?? props ?? {}), keyParams);
+	if (cacheKey === null) return null;
+	const outcome = options.fallbackOnMissingSegmentParams === false ? "failing the render (fallbackOnMissingSegmentParams: false)" : "rendering dynamically";
+	const component = registry.get(id)?.component;
+	if (hasRuntime) {
+		const overlayResult = await lookupOverlay(id, cacheKey);
+		if (overlayResult) {
+			const overlayHasSeed = overlayResult.record?.s ?? false;
+			if (overlayResult.kind === "tombstone") {
+				if (component) return await inlineRerender(id, component, props, cacheKey, options, true, outcome);
+				return null;
+			}
+			if (overlayResult.kind === "fresh" && overlayResult.payload) return await revivePayload(id, overlayResult.payload, outcome);
+			if (overlayResult.kind === "stale" && overlayResult.payload) {
+				if (options.staleWhileRevalidate && component) {
+					backgroundRerender(id, component, props, cacheKey, options, overlayHasSeed, snapshotRequestContext(store));
+					return await revivePayload(id, overlayResult.payload, outcome);
+				}
+				if (component) return await inlineRerender(id, component, props, cacheKey, options, overlayHasSeed, outcome);
+				return null;
+			}
+		}
+	}
+	if (hasSource) {
+		const artifactPayload = await lookupPrebuiltPayload(id, cacheKey);
+		if (artifactPayload !== null) {
+			if (options.ttl !== void 0) {
+				const buildTs = (await getManifestEntry(id, cacheKey))?.buildTimestamp ?? 0;
+				if ((Date.now() - buildTs) / 1e3 > options.ttl) {
+					if (options.staleWhileRevalidate && component) {
+						backgroundRerender(id, component, props, cacheKey, options, true, snapshotRequestContext(store));
+						return await revivePayload(id, artifactPayload, outcome);
+					}
+					if (component) return await inlineRerender(id, component, props, cacheKey, options, true, outcome);
+					return null;
+				}
+			}
+			return await revivePayload(id, artifactPayload, outcome);
+		}
+		if (options.prerender) console.warn(`[timber] cache.component cache miss: "${id}" with params ${JSON.stringify(store.segmentParams ?? {})} — ${outcome}`);
+	}
+	if (hasRuntime && component && options.fallbackOnMissingSegmentParams !== false) return await inlineRerender(id, component, props, cacheKey, options, false, outcome);
+	return null;
+}
+/**
+* Production wrapper injected by the timber-prebuilt transform. Registers
+* the component under its stable ID and returns a wrapper component that
+* either revives the cached payload (hit) or renders the original
+* component live (miss).
+*/
+function __prebuilt(id, component, options = {}) {
+	const resolution = resolveSlotNames(id, options);
+	const slots = resolution.kind === "active" ? resolution.slots : null;
+	if (resolution.kind === "active" && options.prerender) {
+		console.warn(`[timber] cache.component "${id}": slots are runtime-tier only — prerender is ignored (the build cannot enumerate slot content). Use ttl/tags for the cache lifetime.`);
+		options = {
+			...options,
+			prerender: void 0
+		};
+	}
+	if (resolution.kind === "disabled") options = {
+		...options,
+		slots: void 0
+	};
+	registry.set(id, {
+		id,
+		component,
+		options
+	});
+	const wrapper = async (props) => {
+		noteWrapperRender(id, options, props);
+		if (isCaptureActive()) return createElement(component, props);
+		const revived = slots ? await tryReviveSlotShell(id, options, slots, props) : await tryRevivePayload(id, options, props);
+		if (revived !== null) return revived.element;
+		if (options.fallbackOnMissingSegmentParams === false) throw new Error(`[timber] cache.component "${id}": no prebuilt payload for the current params and fallbackOnMissingSegmentParams is false`);
+		return createElement(component, props);
+	};
+	Object.defineProperty(wrapper, "name", { value: `Prebuilt(${id})` });
+	return wrapper;
+}
+/** Look up a registration by stable component ID. */
+function getPrebuiltRegistration(id) {
+	return registry.get(id);
+}
+/** All registrations, for the post-build capture pass (TIM-1119). */
+function getPrebuiltRegistry() {
+	return registry;
+}
+/**
+* Dev-mode wrapper injected by the timber-prebuilt transform: a no-op that
+* renders the component dynamically on every request, logging once per
+* component on first render so the production behavior difference is visible.
+* See design/44 §Dev Mode.
+*/
+function __prebuiltDev(name, component, options = {}) {
+	const resolution = resolveSlotNames(name, options);
+	const slots = resolution.kind === "active" ? resolution.slots : null;
+	let logged = false;
+	const wrapper = (props) => {
+		if (!logged) {
+			logged = true;
+			console.log(`[timber] cache.component: "${name}" — rendering dynamically (dev mode)`);
+		}
+		if (slots) {
+			const render = prepareSlotRender(props, slots);
+			if (render !== null && isSlotRenderKeyable(render.dataProps)) return wrapInSlotsProvider(createElement(component, render.shellProps), render.slotValues);
+		}
+		return createElement(component, props);
+	};
+	return wrapper;
+}
+//#endregion
+export { AccessGate, DEFAULT_LIMITS, DenySignal, METADATA_ROUTE_CONVENTIONS, RedirectSignal, RenderTimeoutError, SlotAccessGate, __prebuilt, __prebuiltDev, callOnRequestError, canonicalize, classifyMetadataRoute, coerce, collectEarlyHintHeaders, computeComponentCacheKey, createPipeline, enforceBodyLimits, executeAction, formatLinkHeader, generateTraceId, getCookie, getHeader, getLogger, getMetadataRouteAutoLink, getMetadataRouteServePath, getPrebuiltRegistration, getPrebuiltRegistry, getSearchParams, getSegmentParams, getSetCookieHeaders, handleRouteRequest, hasOnRequestError, hasPrebuiltPayloadSource, loadInstrumentation, logCacheMiss, logMiddlewareError, logMiddlewareShortCircuit, logProxyError, logRenderError, logRequestCompleted, logRequestReceived, logSlowRequest, logSwrRefetchFailed, logWaitUntilRejected, logWaitUntilUnsupported, markResponseFlushed, parseBodySize, renderMetadataToElements, replaceTraceId, resolveAllowedMethods, resolveMetadata, resolveMetadataUrls, resolveSlotDenied, resolveStatusFile, resolveTitle, runMiddleware, runProxy, runWithEarlyHintsSender, runWithRequestContext, runWithTraceId, sendEarlyHints103, setLogger, setMutableCookieContext, setPrebuiltPayloadSource, setSegmentParams };
+
+//# sourceMappingURL=internal.js.map