@timber-js/app 0.2.0-alpha.213 → 0.2.0-alpha.214

package/dist/index.js

@@ -1,13 +1,13 @@
-import { a as reportConfigErrors, i as formatMissingPeers, n as timberDevServer, o as validateConfig, r as checkPeerDependencies } from "./_chunks/dev-server-FKxptbnI.js";
+import { a as reportConfigErrors, i as formatMissingPeers, n as timberDevServer, o as validateConfig, r as checkPeerDependencies } from "./_chunks/dev-server-_9L4KWC-.js";
 import { i as resolveRenderTimeoutMs } from "./_chunks/render-timeout-DOf_BBcO.js";
 import { t as writeFileAtomic } from "./_chunks/write-file-atomic-D1qWqHb4.js";
-import { d as collectInterceptionRewrites, l as getPrerenderExport, n as scanRoutes } from "./_chunks/scanner-CQt12vE2.js";
+import { d as collectInterceptionRewrites, l as getPrerenderExport, n as scanRoutes } from "./_chunks/scanner-CKAT5gRx.js";
 import { a as isDynamicMetadataExtension } from "./_chunks/metadata-routes-DSDjM_hJ.js";
 import { v as swallow } from "./_chunks/logger-CbLdcy-W.js";
-import { c as buildDirToRouteMap, n as formatConventionWarnings, o as flushCodegenWrites, r as lintConventions, s as writeRouteCodegen, t as checkAppDirExists } from "./_chunks/convention-lint-BEVW4EID.js";
+import { c as buildDirToRouteMap, n as formatConventionWarnings, o as flushCodegenWrites, r as lintConventions, s as writeRouteCodegen, t as checkAppDirExists } from "./_chunks/convention-lint-B3QEGJX7.js";
 import { a as loadTimberConfigFile, c as resolveAppDir, d as createNoopTimer, l as resolveBuildDir, n as contextAdapter, o as mergeFileConfig, r as createPluginContext, t as adapterConfig, u as resolveClientJavascript } from "./_chunks/plugin-context-BPBPc3lL.js";
 import { i as withBasePath, n as normalizeBasePath, t as isRelativeBase } from "./_chunks/base-path-DaQrzbez.js";
-import { r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "./_chunks/walkers-DAT4avhZ.js";
+import { r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "./_chunks/walkers-DwCXEyRu.js";
 import { i as poisonPillSource, r as markerFor, t as EXPLICIT_MARKERS } from "./_chunks/poison-rules-DoEhbqaY.js";
 import { n as rscPayloadPath, t as RSC_PAYLOAD_DIR } from "./_chunks/rsc-payload-path-dffcs4jp.js";
 import { a as REDIRECTS_FILE, n as detectFsIdentity, o as RESERVED_OUTPUT_PATHS, r as fsKey, t as EXACT_FS_IDENTITY } from "./_chunks/fs-identity-BRKuL215.js";
@@ -9637,7 +9637,7 @@ function timber(config) {
 			let environments = envOutDirs;
 			if (!isPreview) {
 				ctx.timer.start("client-deps-scan");
-				const { clientOptimizeDepsEntries } = await import("./_chunks/client-dep-entries-CQwpb8dI.js");
+				const { clientOptimizeDepsEntries } = await import("./_chunks/client-dep-entries-DyDqXOF9.js");
 				const entries = await clientOptimizeDepsEntries(resolvedRoot, BROWSER_ENTRY_FILE, buildDir);
 				ctx.timer.end("client-deps-scan");
 				environments = {

package/dist/routing/index.js

@@ -1,5 +1,5 @@
 import { a as INTERCEPTION_MARKERS, i as DEFAULT_PAGE_EXTENSIONS, n as classifyUrlSegment, t as classifySegment } from "../_chunks/segment-classify-C539Pa2O.js";
-import { d as collectInterceptionRewrites, n as scanRoutes } from "../_chunks/scanner-CQt12vE2.js";
+import { d as collectInterceptionRewrites, n as scanRoutes } from "../_chunks/scanner-CKAT5gRx.js";
 import { t as generateRouteMap } from "../_chunks/codegen-Bps1sLKJ.js";
-import { n as collectDynamicSegmentsFromTree, r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "../_chunks/walkers-DAT4avhZ.js";
+import { n as collectDynamicSegmentsFromTree, r as validateSchemaAgainstRoutes, t as collectLeafRoutes } from "../_chunks/walkers-DwCXEyRu.js";
 export { DEFAULT_PAGE_EXTENSIONS, INTERCEPTION_MARKERS, classifySegment, classifyUrlSegment, collectDynamicSegmentsFromTree, collectInterceptionRewrites, collectLeafRoutes, generateRouteMap, scanRoutes, validateSchemaAgainstRoutes };

package/dist/server/canonicalize.d.ts

@@ -37,4 +37,26 @@ export declare const NULL_BYTE_RE: RegExp;
  * @param stripTrailingSlash - Whether to strip trailing slashes. Default: true.
  */
 export declare function canonicalize(rawPathname: string, stripTrailingSlash?: boolean): CanonicalizeResult;
+/**
+ * The path a safe request for `rawPathname` should be redirected to — or
+ * `rawPathname` itself when it is already canonical.
+ *
+ * Applies the structural steps of `canonicalize()` — collapse `//` (step 3)
+ * and strip the trailing slash (step 5) — to the **encoded** path, without
+ * decoding. That is what the browser will send back, so the redirect is
+ * idempotent: `/%61dmin` differs from its canonical form `/admin` only by
+ * percent-encoding, and redirecting it to `/admin` would compare against the
+ * decoded form forever. Decoding cannot introduce a `/` (`%2f` is rejected),
+ * so the structure is the same before and after decoding.
+ *
+ * Dot segments are not handled here: the request URL is parsed by the WHATWG
+ * URL parser, which has already resolved `.`, `..` and their encoded forms.
+ *
+ * Only meaningful for a path `canonicalize()` accepted. The collapse also
+ * means the result can never start with `//`, so it is never a
+ * protocol-relative redirect target.
+ *
+ * See design/07-routing.md §"Non-Canonical URLs Redirect"
+ */
+export declare function canonicalRequestPath(rawPathname: string, stripTrailingSlash?: boolean): string;
 //# sourceMappingURL=canonicalize.d.ts.map

package/dist/server/canonicalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F"}
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/server/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,kBAAkB,CAwD/F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,UAAO,GAAG,MAAM,CAM3F"}

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import { A as getSpanId, C as isRedirectSignal, E as addSpanEvent, F as withSpan, S as isDenySignal, T as isDevMode, j as getTraceId, w as isDebug } from "../_chunks/logger-CbLdcy-W.js";
 import { t as formatSize } from "../_chunks/format-BKclgVbk.js";
-import { _ as getHeaders, a as parseFormData, c as deny, d as waitUntil, i as coerce, l as redirect, n as revalidatePath, p as getCookieJar, r as revalidateTag, u as redirectExternal, y as getSegmentParams } from "../_chunks/actions-CEootpB1.js";
+import { _ as getHeaders, a as parseFormData, c as deny, d as waitUntil, i as coerce, l as redirect, n as revalidatePath, p as getCookieJar, r as revalidateTag, u as redirectExternal, y as getSegmentParams } from "../_chunks/actions-CUh3cClk.js";
 //#region src/shared/redirect-type.ts
 /**
 * Next.js redirect type discriminator.

package/dist/server/internal.js

@@ -3,12 +3,12 @@ import { n as isRscContentType, r as isRscRequest } from "../_chunks/rsc-media-t
 import { n as classifyUrlSegment, r as effectiveUrlSegment } from "../_chunks/segment-classify-C539Pa2O.js";
 import { t as computeSegmentTreePaths } from "../_chunks/segment-keys-D5hu1hz4.js";
 import { i as getMetadataRouteServePath, n as classifyMetadataRoute, r as getMetadataRouteAutoLink, t as METADATA_ROUTE_CONVENTIONS } from "../_chunks/metadata-routes-DSDjM_hJ.js";
-import { r as canonicalize } from "../_chunks/canonicalize-CgHoscYO.js";
+import { i as canonicalize, r as canonicalRequestPath } from "../_chunks/canonicalize-BAWkWiKK.js";
 import { i as requestContextAls, n as prebuiltCaptureAls, o as timingAls, t as earlyHintsSenderAls } from "../_chunks/als-registry-BZqHCtq-.js";
 import { C as isRedirectSignal, F as withSpan, M as replaceTraceId, N as runWithTraceId, O as generateTraceId, P as setSpanAttribute, S as isDenySignal, _ as setLogger, a as logMiddlewareError, c as logRenderError, d as logRouteError, f as logRouteSetupError, g as logWaitUntilUnsupported, h as logWaitUntilRejected, j as getTraceId, k as getOtelTraceId, l as logRequestCompleted, m as logSwrRefetchFailed, n as logCacheMiss, o as logMiddlewareShortCircuit, p as logSlowRequest, r as logCsrfRejected, s as logProxyError, t as getLogger, u as logRequestReceived, v as swallow, w as isDebug, x as isControlFlowSignal } from "../_chunks/logger-CbLdcy-W.js";
 import { i as collectRouteModulepreloads, n as collectRouteCss, r as collectRouteFonts } from "../_chunks/build-manifest-DWppEdLB.js";
-import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-ClUiXQnK.js";
-import { C as setMutableCookieContext, S as setMatchedSegmentPath, T as runOutsideReactCacheScope, b as markResponseFlushed, f as getCookie, g as getHeader, h as applyRequestHeaderOverlay, i as coerce, m as getSetCookieHeaders, o as DenySignal, s as RedirectSignal, t as executeAction, v as getSearchParams, w as setSegmentParams, x as runWithRequestContext, y as getSegmentParams } from "../_chunks/actions-CEootpB1.js";
+import { i as isRscCacheKeyShape, n as RSC_KEY_PARAM, r as appVisibleSearch, s as rscCacheKey, t as RSC_KEY_HEADERS } from "../_chunks/rsc-cache-key-ClUiXQnK.js";
+import { C as setMutableCookieContext, S as setMatchedSegmentPath, T as runOutsideReactCacheScope, b as markResponseFlushed, f as getCookie, g as getHeader, h as applyRequestHeaderOverlay, i as coerce, m as getSetCookieHeaders, o as DenySignal, s as RedirectSignal, t as executeAction, v as getSearchParams, w as setSegmentParams, x as runWithRequestContext, y as getSegmentParams } from "../_chunks/actions-CUh3cClk.js";
 import { a as getManifestEntry, b as wasInvalidatedSince, c as lookupPrebuiltPayload, d as checkVersionSkew, i as storeOverlayEntry, l as setPrebuiltPayloadSource, n as lookupOverlay, o as hasPrebuiltPayloadSource, r as overlayKey, s as isParamIndependent, u as applyReloadHeaders, v as currentInvalidationEpoch, x as getWaitUntil, y as lastInvalidationEpochFor } from "../_chunks/cache-api-LA3sBpUS.js";
 import { n as createSingleflight } from "../_chunks/singleflight-BeVMMKi0.js";
 import { n as toBracketKey } from "../_chunks/resolve-schema-CBR6Lm4i.js";
@@ -580,6 +580,55 @@ function csrfGate(req, canonicalPath, csrf, matchRoute) {
 	return exempt ? null : csrfRejectionResponse(req, result);
 }
 /**
+* The redirect for a safe request whose URL is not canonical, or null to
+* serve it.
+*
+* A GET for `/admin/` used to render with a 200 at that URL. The server
+* rendered with the canonical `/admin` while the browser hydrated with the
+* raw `/admin/`, so anything branching on `usePathname()` hydrated
+* mismatched (TIM-1571). Redirecting makes the address bar — the client's
+* copy of the URL — the canonical one, and leaves one URL per page for
+* caches and crawlers.
+*
+* Only GET and HEAD are redirected. Every other method — an action's POST,
+* a CORS preflight — is served at the canonical path, as before: a
+* redirected POST is re-sent by the browser, which an action must not
+* depend on.
+*
+* Runs inside proxy.ts's `next()`, not before it, so proxy.ts still runs
+* on every request and its headers land on the redirect. A cross-origin
+* `GET /api/items/` needs proxy.ts's CORS headers on the 308 itself:
+* browsers apply the CORS check to a redirect response.
+*
+* A document request gets a relative 308 (never built from `Host`). A page
+* navigation gets the router's soft redirect, decided exactly as for a
+* `redirect()` outcome: an RSC request that does not match a route.ts
+* handler (`buildRedirectResponse`). The framework's `_rsc` cache key is
+* dropped from the soft target; the router appends a fresh one when it
+* fetches the canonical URL.
+*
+* See design/07-routing.md §"Non-Canonical URLs Redirect".
+*/
+function canonicalRedirect(req, canonicalPath, stripTrailingSlash, matchRoute) {
+	if (req.method !== "GET" && req.method !== "HEAD") return null;
+	const url = new URL(req.url);
+	const target = canonicalRequestPath(url.pathname, stripTrailingSlash);
+	if (target === url.pathname) return null;
+	const navigation = isRscRequest(req) && !isApiRoutePath(canonicalPath, matchRoute);
+	const search = navigation ? appVisibleSearch(url).search : url.search;
+	return buildRedirectResponse(new RedirectSignal(target + search, 308), new Headers(), navigation);
+}
+/** Whether `path` matches a route.ts handler. A matcher that throws: no. */
+function isApiRoutePath(path, matchRoute) {
+	try {
+		const match = matchRoute(path);
+		return match !== null && isApiRouteChain(match.segments);
+	} catch (err) {
+		swallow(err, "canonical redirect: route match for route.ts lookup threw");
+		return false;
+	}
+}
+/**
 * Build a proxy resolver closure from the declared source. Called exactly
 * once at `createPipeline` setup time, so the hot path sees only the branch
 * that corresponds to this pipeline's configured variant.
@@ -2027,6 +2076,8 @@ function createPipeline(config) {
 								return csrfRejection;
 							}
 							const innerHandler = async () => {
+								const redirect = canonicalRedirect(req, canonicalPath, stripTrailingSlash, config.matchRoute);
+								if (redirect) return redirect;
 								if (config.dispatchAction) {
 									const actionResult = await config.dispatchAction(canonicalReq, canonicalPath, pipelineFn);
 									if (actionResult) return actionResult;