@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/dist/server/rsc-entry/helpers.d.ts

@@ -3,71 +3,26 @@
  *
  * Small, stateless functions used across the RSC entry modules.
  */
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import { RedirectSignal } from '#/server/primitives.js';
-/** RSC content type for client navigation payload requests. */
-export declare const RSC_CONTENT_TYPE = "text/x-component";
-/**
- * Create a debug channel sink that discards all debug data.
- *
- * React Flight's dev mode serializes server component source code as `$E`
- * entries for DevTools. Without a separate debugChannel, this data is
- * embedded inline in the main RSC stream — leaking source code to the
- * browser. By providing a debug channel, debug data goes to a separate
- * stream that we drain and discard.
- *
- * See design/13-security.md §"Server component source leak"
- *
- * TODO: In the future, expose this debug data to the browser in dev mode
- * for inline error overlays (e.g. component stack traces).
- */
-export declare function createDebugChannelSink(): {
-    readable: ReadableStream;
-    writable: WritableStream;
-};
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { SegmentInfo } from '../../shared/segment-info.ts';
+import type { SlotSkipEntry } from '../slot-resolver.ts';
 /**
  * Build segment metadata for the X-Timber-Segments response header.
- * Describes the rendered segment chain with async status, enabling
- * the client to populate its segment cache for state tree diffing.
+ * Describes the rendered segment chain with request-dependency status,
+ * enabling the client to populate its segment cache for state tree diffing.
+ *
+ * Request-dependency is determined by static module-graph analysis: the
+ * Vite plugin walks each segment's import graph and marks it as
+ * request-dependent if any reachable module calls a request accessor.
+ * This replaces the previous runtime ALS-based taint tracking which
+ * couldn't attribute accessor calls in Flight-deferred child components.
  *
- * Async detection: server components defined as `async function` have
- * constructor.name === 'AsyncFunction'. These layouts always re-render
- * on navigation (they may depend on request context like cookies/params).
  * See design/07-routing.md §"Server Diffing Rules".
  */
 export declare function buildSegmentInfo(segments: ManifestSegmentNode[], layoutComponents: Array<{
     component: (...args: unknown[]) => unknown;
     segment: ManifestSegmentNode;
-}>): Array<{
-    path: string;
-    isAsync: boolean;
-}>;
-/**
- * Check if a request is asking for an RSC payload (client navigation)
- * rather than full HTML. Client-side navigation sends Accept: text/x-component.
- */
-export declare function isRscPayloadRequest(req: Request): boolean;
-/**
- * Build a redirect Response. For RSC payload requests (client navigation),
- * return 204 + X-Timber-Redirect header instead of a raw 302. The browser's
- * fetch with redirect: "manual" turns a 302 into an opaque redirect (status 0,
- * null body, inaccessible headers), which crashes createFromFetch when it
- * tries to call .body.getReader(). The X-Timber-Redirect header lets the
- * client detect the redirect and perform a soft SPA navigation.
- */
-export declare function buildRedirectResponse(req: Request, signal: RedirectSignal, responseHeaders: Headers): Response;
-/**
- * Check if an error is an abort error (connection closed by client).
- *
- * When the browser aborts a request (page refresh, navigation away),
- * the AbortSignal fires and React/streams throw an AbortError. This
- * is not an application error — suppress it from error boundaries and logs.
- */
-export declare function isAbortError(error: unknown): boolean;
-export declare function escapeHtml(str: string): string;
-/**
- * Parse a Cookie header string into a name→value Map.
- * Used to populate NavContext.cookies for SSR hooks (useCookie).
- */
-export declare function parseCookiesFromHeader(header: string): Map<string, string>;
+}>, slotSkipInfo?: SlotSkipEntry[], skippedSegmentKeys?: string[], firstDeniedIndex?: number): SegmentInfo[];
+export { isAbortError } from '../render-utils.ts';
+export { escapeHtml } from '../utils/escape-html.ts';
 //# sourceMappingURL=helpers.d.ts.map

package/dist/server/rsc-entry/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,GACvB,QAAQ,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1E"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,EACF,YAAY,CAAC,EAAE,aAAa,EAAE,EAC9B,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAC7B,gBAAgB,SAAW,GAC1B,WAAW,EAAE,CAsEf;AAKD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server/rsc-entry/index.d.ts

@@ -1,12 +1,36 @@
+import type { DevHooks } from '../../dev-tools/dev-page-shell.ts';
 /**
- * Set the dev pipeline error handler.
+ * Set the dev hooks. Called by the dev server after it imports this module;
+ * the handler reads them at request time, so a later call takes effect on
+ * the next request.
+ */
+export declare function setDevHooks(hooks: DevHooks): void;
+export { runWithEarlyHintsSender } from '../early-hints-sender.ts';
+export { runWithWaitUntil } from '../waituntil-bridge.ts';
+export { runWithWorkersCachePurge } from '../workers-cache-bridge.ts';
+export { stripHeadBody } from '../head-response.ts';
+/**
+ * Post-build flight capture entry point (TIM-1119). The capture pass must
+ * run inside the built RSC bundle — the prebuilt component registry, the
+ * ALS instances, and the flight renderer are module instances in THIS
+ * bundle's graph; an outside import of the framework package would get
+ * fresh, empty copies. The timber-prebuilt plugin imports the built
+ * `rsc/index.js` after the 5-step build and calls this export.
+ * See design/44-render-at-build-time.md §Build Phase.
+ */
+export declare function __timber_capturePrebuilt(options: import('../prebuilt-builder.ts').CaptureOptions): Promise<import('../prebuilt-builder.ts').CaptureSummary>;
+/**
+ * Post-build static site generation entry point (TIM-1238). Renders every
+ * route in the manifest to HTML + RSC flight payloads. Must run inside the
+ * built RSC bundle — the handler, route manifest, and page module loaders
+ * are module instances in THIS bundle's graph.
+ *
+ * Unlike capture mode, this needs the full pipeline handler, so it must
+ * NOT run when __TIMBER_CAPTURE_MODE__ is set.
  *
- * Called by the dev server after importing this module to wire pipeline
- * errors into the Vite browser error overlay. No-op in production.
+ * See design/11-platform.md §"static output mode".
  */
-export declare function setDevPipelineErrorHandler(handler: (error: Error, phase: string) => void): void;
-export { runWithEarlyHintsSender } from '#/server/early-hints-sender.js';
-export { runWithWaitUntil } from '#/server/waituntil-bridge.js';
+export declare function __timber_generateStaticSite(options: import('../static-generator.ts').StaticGenerationOptions): Promise<import('../static-generator.ts').StaticGenerationSummary>;
 declare const _default: (req: Request) => Promise<Response>;
 export default _default;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AA0FA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE/F;AAoZD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;8BAtQ3C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AAwQhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AA8ClE;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEjD;AAgVD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAItE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,wBAAwB,EAAE,cAAc,GACvD,OAAO,CAAC,OAAO,wBAAwB,EAAE,cAAc,CAAC,CAE1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,wBAAwB,EAAE,uBAAuB,GAChE,OAAO,CAAC,OAAO,wBAAwB,EAAE,uBAAuB,CAAC,CAQnE;8BAwCoB,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC"}

package/dist/server/rsc-entry/render-route.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Route renderer — turns a matched route into a Response.
+ *
+ * Extracted from `rsc-entry/index.ts` so the entry can stay focused on
+ * pipeline construction. This module owns the steps that happen *after*
+ * the pipeline has matched a route and before it commits a response:
+ * element-tree build, RSC Flight render, and dispatch to either the SSR
+ * HTML path or the RSC payload path. A deny or redirect captured during the
+ * render is rethrown to the pipeline, which answers it.
+ *
+ * The function is parameterized over its dependencies — `clientBootstrap`,
+ * `clientJsDisabled`, `renderDenyFallback`, `globalError` — so the entry passes
+ * them in once at handler-construction time and they ride along on every
+ * call. No globals, no closures over the entry's createRequestHandler
+ * scope.
+ *
+ * Design docs: 02-rendering-pipeline.md, 19-client-navigation.md.
+ */
+import type { BuildManifest } from '../build-manifest.ts';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { InterceptionContext, RouteMatch } from '../pipeline.ts';
+import type { DenyFallbackRenderer } from './deny-fallback.ts';
+/**
+ * Static-per-handler dependencies for `renderRoute` — captured once at
+ * handler construction so each per-request call site only has to pass
+ * the request-specific arguments.
+ */
+export interface RenderRouteDeps {
+    clientBootstrap: ClientBootstrapConfig;
+    clientJsDisabled: boolean;
+    clientSegmentCache: boolean;
+    renderDenyFallback: DenyFallbackRenderer;
+    buildManifest: BuildManifest;
+    globalError?: {
+        load: () => Promise<unknown>;
+        filePath: string;
+    };
+}
+/**
+ * Render a matched route to an HTML Response via RSC → SSR pipeline,
+ * or return a raw RSC Flight stream for client-side navigation requests.
+ *
+ * 1. Load page/layout components from the segment chain
+ * 2. Resolve metadata
+ * 3. Render to RSC Flight stream (serializes "use client" as references)
+ * 4. If Accept: text/x-component → return RSC stream directly
+ *    Otherwise → pass RSC stream to SSR entry for HTML rendering
+ */
+export declare function renderRoute(req: Request, match: RouteMatch, responseHeaders: Headers, deps: RenderRouteDeps, interception?: InterceptionContext): Promise<Response>;
+//# sourceMappingURL=render-route.d.ts.map

package/dist/server/rsc-entry/render-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-route.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/render-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAS1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAOtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAM/D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,eAAe,EACrB,YAAY,CAAC,EAAE,mBAAmB,GACjC,OAAO,CAAC,QAAQ,CAAC,CA4JnB"}

package/dist/server/rsc-entry/render-signals.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Render signals — the deny / redirect / unhandled-error state one RSC
+ * render captures, and the recorder that writes it.
+ *
+ * Kept apart from `rsc-stream.ts` so the contract carries no Flight runtime:
+ * consumers and tests can hold signals without loading the renderer.
+ *
+ * Design docs: 02-rendering-pipeline.md §"Single-Pass Rendering",
+ *              49-explicit-subsystem-boundaries.md §"C"
+ */
+import type { DenySignal, RedirectSignal } from '../primitives.ts';
+/**
+ * Signal state captured during RSC rendering. Read-only for consumers: only
+ * the render that produced it records into it (`createSignalRecorder`).
+ *
+ * Signals fire asynchronously via `onError` during stream consumption.
+ * The first deny wins; a later redirect replaces an earlier one.
+ *
+ * The two notification channels are values the producer owns and returns,
+ * not callback slots a consumer assigns after the fact. A slot only works if
+ * no `await` separates `renderRscStream()` from the assignment — add one and
+ * an early signal fires into an empty slot with no trace. A promise that has
+ * already resolved, and an `AbortSignal` that is already aborted, carry the
+ * early event to a late reader.
+ */
+export interface RenderSignals {
+    readonly denySignal: DenySignal | null;
+    /**
+     * The first deny that no in-tree catch site could place — no `owners`, so
+     * no boundary may claim its error row and only the re-render fallback can
+     * produce a page for it.
+     *
+     * Tracked apart from `denySignal` because one render can produce both. A
+     * deep page can hoist a 404 to a boundary that will render it while an
+     * outer layout separately throws a 403 nothing matches; whichever lands in
+     * `denySignal` first, the unplaced one still needs the fallback, and
+     * deciding from `denySignal.owners` alone would strand it. See TIM-1356.
+     */
+    readonly unplacedDeny: DenySignal | null;
+    readonly redirectSignal: RedirectSignal | null;
+    /**
+     * Resolves when the first deny or redirect is captured; never rejects.
+     * Consumers race it to react the instant `onError` fires instead of
+     * polling with setTimeout/queueMicrotask.
+     */
+    readonly captured: Promise<void>;
+    /**
+     * Aborted when the first unhandled (non-signal) error is captured. Halts
+     * Flight data injection into the inline stream (TIM-938).
+     */
+    readonly unhandledError: AbortSignal;
+}
+/** The write side of `RenderSignals`, held by the render that captures. */
+export interface SignalRecorder {
+    readonly signals: RenderSignals;
+    deny(signal: DenySignal): void;
+    redirect(signal: RedirectSignal): void;
+    unhandledError(): void;
+}
+/**
+ * Create the signal state for one render. `renderRscStream()` records into
+ * it from Flight's `onError`; tests record into it to stand in for Flight.
+ */
+export declare function createSignalRecorder(): SignalRecorder;
+//# sourceMappingURL=render-signals.d.ts.map

package/dist/server/rsc-entry/render-signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-signals.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/render-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,cAAc,IAAI,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAwCrD"}

package/dist/server/rsc-entry/revalidate-renderer.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Revalidation renderer — builds the React element tree for the target
+ * path requested by `revalidatePath()` from inside a server action, with
+ * the same security guarantees as a normal route render.
+ *
+ * Before this module existed, `revalidatePath()` matched the route, coerced
+ * params, and called `buildRouteElement()` directly. That bypassed the
+ * target route's `middleware.ts` chain entirely. An action that revalidated
+ * a higher-privilege or user-controlled path could leak an authenticated
+ * RSC tree to the action submitter even when middleware on that path
+ * would have denied them.
+ *
+ * The fix (TIM-996) is to run the target route's middleware chain inside
+ * a fresh `runWithRequestContext` scope BEFORE building the element tree,
+ * propagate `DenySignal` and `RedirectSignal` to `executeAction`, drop the
+ * revalidation when middleware returns a short-circuit `Response`, and
+ * lift the request-header overlay onto the action's ALS store so the
+ * revalidated component render sees middleware-injected headers via
+ * `getHeaders()`.
+ *
+ * The input `path` is also validated as a local root-relative pathname so
+ * `revalidatePath('//evil.com/admin')` and similar scheme/authority
+ * injections cannot smuggle a foreign host through `new URL(path, base)`.
+ *
+ * See design/08-forms-and-actions.md §"revalidatePath()" and
+ * design/13-security.md §"Server actions silently bypass middleware".
+ */
+import type { BuildManifest } from '../build-manifest.ts';
+import type { RouteMatch, RouteMatcher } from '../pipeline.ts';
+import { type RevalidateRenderer } from '../actions.ts';
+import type { CoercedParams } from '../../shared/param-value.ts';
+/** Result of validating a `revalidatePath()` argument. */
+type PathValidation = {
+    ok: true;
+    pathname: string;
+    search: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Validate a `revalidatePath()` argument.
+ *
+ * Accepts local root-relative pathnames only. Rejects anything that
+ * `new URL(path, base)` would resolve to a different host or scheme:
+ *
+ *   - Empty / non-string input
+ *   - Anything not starting with `/` (relative, scheme-bearing, etc.)
+ *   - Protocol-relative `//evil.com/admin` — resolves to scheme://evil.com
+ *   - Backslash-prefixed `/\evil.com` — some clients fold `\` into `/`
+ *   - Control characters and null bytes
+ *   - Paths that fail canonicalization (encoded separators, `..` escaping
+ *     root, malformed percent-encoding)
+ *
+ * The pathname is canonicalized so the rest of the renderer matches the
+ * same shape the page pipeline matches.
+ */
+export declare function validateRevalidatePath(path: unknown): PathValidation;
+/** Coerce a matched route's raw segment params via its `app/schema.ts` codecs. */
+export type CoerceSegmentParamsFn = (match: RouteMatch) => Promise<CoercedParams>;
+/** Dependencies for the revalidate renderer factory. */
+export interface RevalidateRendererDeps {
+    matchRoute: RouteMatcher;
+    coerceSegmentParams: CoerceSegmentParamsFn;
+    buildManifest: BuildManifest;
+}
+/**
+ * Build a per-request `RevalidateRenderer`.
+ *
+ * The returned renderer:
+ *   1. Validates the requested path.
+ *   2. Matches the canonicalized path against the route tree.
+ *   3. Coerces segment params via the `app/schema.ts` codecs.
+ *   4. Runs the matched route's `middleware.ts` chain inside a fresh
+ *      `runWithRequestContext` scope (via `runMiddlewareForAction`).
+ *      Deny/redirect signals are re-thrown so `executeAction` can apply
+ *      its existing redirect handling and the new deny-drop behavior.
+ *      A short-circuit `Response` becomes `RevalidationDropped`.
+ *   5. Lifts the request-header overlay onto the OUTER action's ALS store
+ *      so the revalidated component render (which happens later inside
+ *      `renderToReadableStream` in the action's scope) observes
+ *      middleware-injected headers via `getHeaders()`. Acceptable because
+ *      revalidation runs after the action body has returned — the only
+ *      remaining ALS readers are render-phase code that should see the
+ *      same overlay a normal page render would see.
+ *   6. Builds and returns the route element tree, ready for the action
+ *      handler to serialize alongside the action result.
+ *
+ * Cookies set inside the revalidation middleware are intentionally NOT
+ * propagated to the action response. The middleware on a *different* path
+ * setting cookies via the action's response is surprising semantics; the
+ * scoped cookie jar on the inner ALS run is discarded with the scope.
+ * The primary security boundary closed here is auth — `deny()` from the
+ * target's middleware now prevents the revalidated tree from leaking.
+ */
+export declare function createRevalidateRendererFactory(deps: RevalidateRendererDeps): (req: Request) => RevalidateRenderer;
+export {};
+//# sourceMappingURL=revalidate-renderer.d.ts.map

package/dist/server/rsc-entry/revalidate-renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidate-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/revalidate-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAM/D,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAKjE,0DAA0D;AAC1D,KAAK,cAAc,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAiCpE;AAwBD,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElF,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,YAAY,CAAC;IACzB,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,sBAAsB,GAC3B,CAAC,GAAG,EAAE,OAAO,KAAK,kBAAkB,CAiLtC"}

package/dist/server/rsc-entry/rsc-payload.d.ts

@@ -5,13 +5,23 @@
  * returned directly without SSR HTML rendering. The client decodes it via
  * `createFromFetch` and renders into the hydrated React root.
  *
+ * The response's HTTP status carries no deny semantics: a payload response
+ * commits 200 when Flight's opening window closes (the first chunk plus one
+ * macrotask), and a deny, redirect, or error that lands after that rides
+ * the payload as a Flight error row for the client's boundaries — the same
+ * way a nested component's already did. The status
+ * code contract (design/05) is a document-path contract, enforced by Fizz's
+ * `onShellReady`; Flight has no such checkpoint, and the only reader of a
+ * payload response's status is the static generator's check for an error
+ * envelope — the client router reads the body. See TIM-1495.
+ *
  * Design docs: 19-client-navigation.md §"RSC Payload Handling",
- *              16-metadata.md §"Head Elements"
+ *              04-authorization.md §"Status codes on the RSC payload path"
  */
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { HeadElement, LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { RenderSignals } from './rsc-stream.js';
+import type { LayoutComponentEntry } from '../route-element-builder.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { SlotSkipEntry } from '../slot-resolver.ts';
+import type { RenderSignals } from './render-signals.ts';
 /**
  * Build an RSC payload Response for a client-side navigation request.
  *
@@ -20,6 +30,20 @@ import type { RenderSignals } from './rsc-stream.js';
  * renderToReadableStream. Reading one chunk triggers rendering of the
  * initial component tree, allowing onError to capture DenySignal/
  * RedirectSignal before we commit the response. See TIM-344.
+ *
+ * The commit point is the close of Flight's opening window: the first chunk
+ * plus one macrotask turn. Nothing is held for it. A signal that lands
+ * inside the window still gets a server-level answer — a redirect response,
+ * the fallback deny page, the hard-navigate envelope — because the race
+ * below and the one timer turn after it deliver it for free. This function
+ * reports that signal rather than answering it: it cancels the stream and
+ * rethrows, and the pipeline's outcome translator builds the redirect or
+ * calls the deny fallback (`rsc-entry/deny-fallback.ts`), exactly as for a
+ * signal thrown out of render (design/49 §"C"). A signal that
+ * lands after it is a row in the stream, and the client's boundaries answer
+ * it. Waiting for the shell components to settle (TIM-1045, TIM-1208) made
+ * the payload path pretend to a status contract it could not keep for
+ * nested components, and was removed in TIM-1495.
  */
-export declare function buildRscPayloadResponse(req: Request, rscStream: ReadableStream<Uint8Array>, signals: RenderSignals, segments: ManifestSegmentNode[], layoutComponents: LayoutComponentEntry[], headElements: HeadElement[], match: RouteMatch, responseHeaders: Headers, skippedSegments?: string[]): Promise<Response>;
+export declare function buildRscPayloadResponse(rscStream: ReadableStream<Uint8Array>, signals: RenderSignals, segments: ManifestSegmentNode[], layoutComponents: LayoutComponentEntry[], responseHeaders: Headers, skippedSegments?: string[], slotSkipInfo?: SlotSkipEntry[]): Promise<Response>;
 //# sourceMappingURL=rsc-payload.d.ts.map

package/dist/server/rsc-entry/rsc-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAQrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,YAAY,EAAE,WAAW,EAAE,EAC3B,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,QAAQ,CAAC,CA0HnB"}
+{"version":3,"file":"rsc-payload.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,eAAe,EAAE,OAAO,EACxB,eAAe,CAAC,EAAE,MAAM,EAAE,EAC1B,YAAY,CAAC,EAAE,aAAa,EAAE,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAuNnB"}

package/dist/server/rsc-entry/rsc-stream.d.ts

@@ -2,48 +2,30 @@
  * RSC Stream Renderer — Creates the RSC Flight stream with signal tracking.
  *
  * Wraps `renderToReadableStream` from `@vitejs/plugin-rsc/rsc` and captures
- * render-phase signals (DenySignal, RedirectSignal, RenderError) thrown by
+ * render-phase signals (DenySignal, RedirectSignal) thrown by
  * components during streaming. These signals are tracked in a shared
- * `RenderSignals` object so the caller can decide the HTTP response.
+ * read-only `RenderSignals` object so the caller can decide the HTTP response.
  *
  * Design docs: 02-rendering-pipeline.md §"Single-Pass Rendering",
  *              13-security.md §"Errors don't leak"
  */
-import { DenySignal, RedirectSignal } from '#/server/primitives.js';
-/**
- * Mutable signal state captured during RSC rendering.
- *
- * Signals fire asynchronously via `onError` during stream consumption.
- * The first signal of each type wins — subsequent signals are ignored.
- *
- * `onSignal` is an optional callback fired when a DenySignal or
- * RedirectSignal is captured. Consumers use it with Promise.race to
- * react immediately instead of polling with setTimeout/queueMicrotask.
- */
-export interface RenderSignals {
-    denySignal: DenySignal | null;
-    redirectSignal: RedirectSignal | null;
-    renderError: {
-        error: unknown;
-        status: number;
-    } | null;
-    /** Callback fired when a redirect or deny signal is captured in onError. */
-    onSignal?: () => void;
-}
+import type { RscPayloadRoot } from '../../shared/payload-root.ts';
+import { type DenyPageEntry } from '../deny-boundary.ts';
+import { type RenderSignals } from './render-signals.ts';
 export interface RscStreamResult {
-    rscStream: ReadableStream<Uint8Array> | undefined;
+    rscStream: ReadableStream<Uint8Array>;
     signals: RenderSignals;
 }
 /**
- * Render a React element tree to an RSC Flight stream.
+ * Render a payload root (tree plus its params) to an RSC Flight stream.
  *
  * The stream serializes server components as rendered output and client
  * components ("use client") as serialized references with module ID + export name.
  *
- * DenySignal detection: deny() in sync components throws during
- * renderToReadableStream (caught in try/catch). deny() in async components
- * fires onError during stream consumption. Signals are captured in the
- * returned `signals` object for the caller to handle.
+ * Signals are captured in the returned `signals` object for the caller to
+ * handle. Every one arrives through `onError`, never as a throw from this
+ * call: Flight starts rendering in a microtask after the stream is created,
+ * so even a component that throws synchronously is reported asynchronously.
  */
-export declare function renderRscStream(element: React.ReactElement, req: Request): RscStreamResult;
+export declare function renderRscStream(payload: RscPayloadRoot, req: Request, leafDenyChain?: DenyPageEntry[]): RscStreamResult;
 //# sourceMappingURL=rsc-stream.d.ts.map

package/dist/server/rsc-entry/rsc-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc-stream.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAe,MAAM,wBAAwB,CAAC;AAMjF;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,WAAW,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CA4G1F"}
+{"version":3,"file":"rsc-stream.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/rsc-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAM3E,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI/E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EACvB,GAAG,EAAE,OAAO,EACZ,aAAa,CAAC,EAAE,aAAa,EAAE,GAC9B,eAAe,CAgHjB"}

package/dist/server/rsc-entry/ssr-bridge.d.ts

@@ -1,6 +1,10 @@
 /**
  * SSR Bridge — loads the SSR entry and passes the RSC stream for HTML rendering.
+ *
+ * This is the RSC → SSR environment hop. The two environments are separate
+ * Vite module graphs; `NavContext` is the serializable contract that crosses
+ * the boundary. See `../ssr-bridge-types.ts` for the contract definition.
  */
-import type { NavContext } from '#/server/ssr-entry.js';
-export declare function callSsr(rscStream: ReadableStream<Uint8Array>, navContext: NavContext): Promise<Response>;
+import type { NavContext, SsrRenderResult } from '../ssr-bridge-types.ts';
+export declare function callSsr(rscStream: ReadableStream<Uint8Array>, navContext: NavContext): Promise<SsrRenderResult>;
 //# sourceMappingURL=ssr-bridge.d.ts.map

package/dist/server/rsc-entry/ssr-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-bridge.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-bridge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,wBAAsB,OAAO,CAC3B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAMnB"}
+{"version":3,"file":"ssr-bridge.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE1E,wBAAsB,OAAO,CAC3B,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,eAAe,CAAC,CAe1B"}

package/dist/server/rsc-entry/ssr-renderer.d.ts

@@ -11,11 +11,40 @@
  * Design docs: 02-rendering-pipeline.md §"RSC → SSR → Client Hydration",
  *              05-streaming.md §"deferSuspenseFor and the Hold Window"
  */
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-import type { LayoutComponentEntry } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { RenderSignals } from './rsc-stream.js';
+import type { ClientBootstrapConfig } from '../html-injectors.ts';
+import type { RouteMatch } from '../pipeline.ts';
+import type { LayoutComponentEntry } from '../route-element-builder.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import type { SlotSkipEntry } from '../slot-resolver.ts';
+import { type GlobalErrorFile } from './error-renderer.ts';
+import type { RenderSignals } from './render-signals.ts';
+/**
+ * Test-only observable: records how many microtask yields were consumed
+ * during the last signal promotion check. Import this in tests to assert
+ * the actual rejection chain depth and detect regressions if wrappers
+ * add more async hops.
+ *
+ * Only populated when the object is imported and exists — production
+ * bundles that don't import it pay zero cost (the typeof check is free).
+ */
+export declare const __test_only_signalPromotionDepth: {
+    value: number;
+};
+/**
+ * Test-only observable: true when the promotion loop hit the cap without
+ * capturing a signal (the silent-miss path — state 3 in TIM-970). False
+ * when the loop captured a signal at any depth, when it was skipped via
+ * `fizzAllReadyResolved`, or when no signal was ever expected at a depth
+ * shallower than the cap.
+ *
+ * Pairs with `__test_only_signalPromotionDepth`: depth alone cannot
+ * distinguish "cap hit with signal captured on yield 5" from "cap hit with
+ * signal arriving on yield 6+" — both read `.value === 5`. This flag closes
+ * that gap. See TIM-970, design/05-streaming.md §"Signal Promotion".
+ */
+export declare const __test_only_signalPromotionCapHit: {
+    value: boolean;
+};
 interface SsrRenderOptions {
     req: Request;
     rscStream: ReadableStream<Uint8Array>;
@@ -28,6 +57,9 @@ interface SsrRenderOptions {
     clientJsDisabled: boolean;
     headHtml: string;
     deferSuspenseFor: number;
+    /** Tier 2 global-error.tsx file, if present in app/. */
+    globalError?: GlobalErrorFile;
+    slotSkipInfo?: SlotSkipEntry[];
 }
 /**
  * Render the RSC stream to HTML via SSR.
@@ -39,13 +71,18 @@ interface SsrRenderOptions {
  * SSR will attempt to render the element tree progressively. Two outcomes:
  *
  * 1. deny() outside Suspense: the error appears in the RSC shell. SSR's
- *    renderToReadableStream fails (rejects). We catch the failure, check
- *    denySignal, and render the deny page with the correct status code.
+ *    renderToReadableStream fails (rejects). We catch the failure, find
+ *    the captured denySignal, and rethrow it to the pipeline.
  *
  * 2. deny() inside Suspense: the SSR shell succeeds (200 committed). The
  *    error streams into the connection as a React error boundary. The
  *    status is already committed — per design/05-streaming.md this is the
  *    expected degraded behavior for deny inside Suspense.
+ *
+ * @throws the captured `DenySignal` or `RedirectSignal` when one decides the
+ *   response. `runRenderPhase()` turns it into a `deny` / `redirect` outcome,
+ *   and the pipeline renders the deny page or builds the redirect, exactly as
+ *   for a signal thrown out of render (design/49 §"C").
  */
 export declare function renderSsrResponse(opts: SsrRenderOptions): Promise<Response>;
 export {};

package/dist/server/rsc-entry/ssr-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAYrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,UAAU,gBAAgB;IACxB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsKjF"}
+{"version":3,"file":"ssr-renderer.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/ssr-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAMlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOzD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA8BzD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAiB,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAqB,CAAC;AAEtF,UAAU,gBAAgB;IACxB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2QjF"}

package/dist/server/rsc-error-envelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Build the hard-navigate envelope for a status code.
+ *
+ * Preserve middleware's request-wide headers and cookies, but discard the
+ * abandoned body's framing, validators, and cache policy. Every producer,
+ * including errors returned normally during render, gets this cleanup here.
+ * The input header bag is left intact. The body deliberately carries no message —
+ * only the status already on the wire (design/13-security.md principle 4).
+ */
+export declare function rscErrorEnvelope(status: number, responseHeaders?: Headers): Response;
+//# sourceMappingURL=rsc-error-envelope.d.ts.map

package/dist/server/rsc-error-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsc-error-envelope.d.ts","sourceRoot":"","sources":["../../src/server/rsc-error-envelope.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAKpF"}