npm - @timber-js/app - Versions diffs - 0.2.0-alpha.36 → 0.2.0-alpha.38 - Mend

@timber-js/app 0.2.0-alpha.36 → 0.2.0-alpha.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (110) hide show

package/LICENSE +8 -0
package/dist/_chunks/als-registry-Ba7URUIn.js.map +1 -1
package/dist/_chunks/{define-cookie-w5GWm_bL.js → define-cookie-BmKbSyp0.js} +4 -4
package/dist/_chunks/{define-cookie-w5GWm_bL.js.map → define-cookie-BmKbSyp0.js.map} +1 -1
package/dist/_chunks/{error-boundary-TYEQJZ1-.js → error-boundary-BAN3751q.js} +1 -1
package/dist/_chunks/{error-boundary-TYEQJZ1-.js.map → error-boundary-BAN3751q.js.map} +1 -1
package/dist/_chunks/{request-context-CZz_T0Bc.js → request-context-BxYIJM24.js} +59 -4
package/dist/_chunks/request-context-BxYIJM24.js.map +1 -0
package/dist/_chunks/segment-context-C6byCyZU.js +69 -0
package/dist/_chunks/segment-context-C6byCyZU.js.map +1 -0
package/dist/_chunks/{tracing-BPyIzIdu.js → tracing-CuXiCP5p.js} +1 -1
package/dist/_chunks/{tracing-BPyIzIdu.js.map → tracing-CuXiCP5p.js.map} +1 -1
package/dist/_chunks/{wrappers-C1SN725w.js → wrappers-C6J0nNji.js} +2 -2
package/dist/_chunks/{wrappers-C1SN725w.js.map → wrappers-C6J0nNji.js.map} +1 -1
package/dist/adapters/nitro.d.ts.map +1 -1
package/dist/adapters/nitro.js +27 -4
package/dist/adapters/nitro.js.map +1 -1
package/dist/cache/index.d.ts +5 -2
package/dist/cache/index.d.ts.map +1 -1
package/dist/cache/index.js +33 -9
package/dist/cache/index.js.map +1 -1
package/dist/cache/singleflight.d.ts +18 -1
package/dist/cache/singleflight.d.ts.map +1 -1
package/dist/cache/timber-cache.d.ts.map +1 -1
package/dist/client/error-boundary.js +1 -1
package/dist/client/index.d.ts +1 -0
package/dist/client/index.d.ts.map +1 -1
package/dist/client/index.js +25 -8
package/dist/client/index.js.map +1 -1
package/dist/client/link.d.ts +15 -1
package/dist/client/link.d.ts.map +1 -1
package/dist/cookies/index.js +1 -1
package/dist/index.d.ts +12 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +53 -4
package/dist/index.js.map +1 -1
package/dist/params/index.js +1 -1
package/dist/plugins/dev-error-overlay.d.ts +26 -1
package/dist/plugins/dev-error-overlay.d.ts.map +1 -1
package/dist/plugins/entries.d.ts.map +1 -1
package/dist/search-params/index.js +1 -1
package/dist/server/access-gate.d.ts.map +1 -1
package/dist/server/als-registry.d.ts +14 -0
package/dist/server/als-registry.d.ts.map +1 -1
package/dist/server/html-injectors.d.ts +2 -2
package/dist/server/html-injectors.d.ts.map +1 -1
package/dist/server/index.d.ts +4 -2
package/dist/server/index.d.ts.map +1 -1
package/dist/server/index.js +68 -26
package/dist/server/index.js.map +1 -1
package/dist/server/node-stream-transforms.d.ts +13 -1
package/dist/server/node-stream-transforms.d.ts.map +1 -1
package/dist/server/pipeline.d.ts.map +1 -1
package/dist/server/primitives.d.ts +30 -3
package/dist/server/primitives.d.ts.map +1 -1
package/dist/server/render-timeout.d.ts +51 -0
package/dist/server/render-timeout.d.ts.map +1 -0
package/dist/server/request-context.d.ts +39 -0
package/dist/server/request-context.d.ts.map +1 -1
package/dist/server/route-element-builder.d.ts.map +1 -1
package/dist/server/rsc-entry/helpers.d.ts +46 -3
package/dist/server/rsc-entry/helpers.d.ts.map +1 -1
package/dist/server/rsc-entry/index.d.ts +6 -1
package/dist/server/rsc-entry/index.d.ts.map +1 -1
package/dist/server/rsc-entry/rsc-payload.d.ts.map +1 -1
package/dist/server/rsc-entry/rsc-stream.d.ts +3 -0
package/dist/server/rsc-entry/rsc-stream.d.ts.map +1 -1
package/dist/server/slot-resolver.d.ts +1 -1
package/dist/server/slot-resolver.d.ts.map +1 -1
package/dist/server/ssr-entry.d.ts.map +1 -1
package/dist/server/ssr-render.d.ts +2 -0
package/dist/server/ssr-render.d.ts.map +1 -1
package/dist/server/tree-builder.d.ts +7 -4
package/dist/server/tree-builder.d.ts.map +1 -1
package/dist/shared/merge-search-params.d.ts +22 -0
package/dist/shared/merge-search-params.d.ts.map +1 -0
package/package.json +6 -7
package/src/adapters/nitro.ts +27 -4
package/src/cache/index.ts +5 -2
package/src/cache/singleflight.ts +54 -4
package/src/cache/timber-cache.ts +17 -16
package/src/cli.ts +0 -0
package/src/client/index.ts +1 -0
package/src/client/link.tsx +57 -3
package/src/index.ts +12 -0
package/src/plugins/dev-error-overlay.ts +70 -1
package/src/plugins/dev-server.ts +38 -4
package/src/plugins/entries.ts +1 -0
package/src/server/access-gate.tsx +6 -5
package/src/server/als-registry.ts +14 -0
package/src/server/html-injectors.ts +32 -7
package/src/server/index.ts +7 -0
package/src/server/node-stream-transforms.ts +49 -13
package/src/server/pipeline.ts +6 -0
package/src/server/primitives.ts +47 -5
package/src/server/render-timeout.ts +108 -0
package/src/server/request-context.ts +69 -1
package/src/server/route-element-builder.ts +10 -16
package/src/server/rsc-entry/helpers.ts +122 -3
package/src/server/rsc-entry/index.ts +34 -4
package/src/server/rsc-entry/rsc-payload.ts +11 -3
package/src/server/rsc-entry/rsc-stream.ts +24 -3
package/src/server/slot-resolver.ts +10 -19
package/src/server/ssr-entry.ts +9 -2
package/src/server/ssr-render.ts +94 -13
package/src/server/tree-builder.ts +13 -15
package/src/shared/merge-search-params.ts +48 -0
package/dist/_chunks/request-context-CZz_T0Bc.js.map +0 -1
package/dist/_chunks/segment-context-Dpq2XOKg.js +0 -34
package/dist/_chunks/segment-context-Dpq2XOKg.js.map +0 -1

package/src/server/node-stream-transforms.ts CHANGED Viewed

@@ -30,6 +30,7 @@ import {
   type FlightInjectionState,
   type FlightInjectionEvent,
 } from './flight-injection-state.js';
+import { withTimeout, RenderTimeoutError } from './render-timeout.js';
 // ─── Head Injection ──────────────────────────────────────────────────────────
@@ -108,8 +109,22 @@ export function createNodeHeadInjector(headHtml: string): Transform {
  * stream). We read from it using the Web API — this is the one bridge
  * point between Web Streams and Node.js streams in the pipeline.
  */
+/**
+ * Options for the Node.js flight injector.
+ */
+export interface NodeFlightInjectorOptions {
+  /**
+   * Timeout in milliseconds for individual RSC stream reads.
+   * If a single `rscReader.read()` call does not resolve within
+   * this duration, the read is aborted and the stream errors with
+   * a RenderTimeoutError. Default: 30000 (30s).
+   */
+  renderTimeoutMs?: number;
+}
 export function createNodeFlightInjector(
-  rscStream: ReadableStream<Uint8Array> | undefined
+  rscStream: ReadableStream<Uint8Array> | undefined,
+  options?: NodeFlightInjectorOptions
 ): Transform {
   if (!rscStream) {
     return new Transform({
@@ -119,6 +134,7 @@ export function createNodeFlightInjector(
     });
   }
+  const timeoutMs = options?.renderTimeoutMs ?? 30_000;
   const suffix = '</body></html>';
   const suffixBuf = Buffer.from(suffix, 'utf-8');
   const rscReader = rscStream.getReader();
@@ -129,6 +145,11 @@ export function createNodeFlightInjector(
     transitions: flightInjectionTransitions,
   });
+  // Stored promise from pullLoop — awaited in flush() via .then()
+  // instead of polling. Matches the Web Streams pattern in
+  // html-injectors.ts (pullPromise.then(finish)).
+  let pullPromise: Promise<void> | null = null;
   // pullLoop reads RSC chunks and pushes them directly to the transform
   // output as <script> tags. This ensures RSC data is delivered to the
   // browser as soon as it's available — not deferred until the next HTML
@@ -141,7 +162,16 @@ export function createNodeFlightInjector(
     await new Promise<void>((r) => setImmediate(r));
     try {
       for (;;) {
-        const { done, value } = await rscReader.read();
+        // Guard each RSC read with a timeout so a permanently hung
+        // RSC stream (e.g. a Suspense component with a fetch that
+        // never resolves) eventually aborts instead of blocking
+        // forever. When timeoutMs <= 0, the guard is disabled.
+        // See design/02-rendering-pipeline.md §"Streaming Constraints".
+        const readPromise = rscReader.read();
+        const { done, value } =
+          timeoutMs > 0
+            ? await withTimeout(readPromise, timeoutMs, 'RSC stream read timed out')
+            : await readPromise;
         if (done) {
           machine.send({ type: 'PULL_DONE' });
           return;
@@ -160,6 +190,10 @@ export function createNodeFlightInjector(
         }
       }
     } catch (err) {
+      // On timeout, cancel the RSC reader to release resources.
+      if (err instanceof RenderTimeoutError) {
+        rscReader.cancel(err).catch(() => {});
+      }
       machine.send({ type: 'PULL_ERROR', error: err });
     }
   }
@@ -196,8 +230,9 @@ export function createNodeFlightInjector(
       // Start the pull loop on the first HTML chunk to stream RSC
       // data chunks alongside the HTML. The __timber_f init script is
       // already in <head> (via flightInitScript), so no bootstrap needed.
+      // Store the promise so flush() can await it instead of polling.
       if (isFirst) {
-        pullLoop(transform);
+        pullPromise = pullLoop(transform);
       }
       callback();
     },
@@ -226,16 +261,17 @@ export function createNodeFlightInjector(
         finish();
         return;
       }
-      // Wait for the RSC stream to finish before closing.
-      // pullLoop is already running and pushing directly.
-      const waitForPull = () => {
-        if (isPullDone(machine.state)) {
-          finish();
-        } else {
-          setImmediate(waitForPull);
-        }
-      };
-      waitForPull();
+      // Wait for the RSC pull loop promise to resolve instead of
+      // polling with setImmediate. This matches the Web Streams
+      // pattern in html-injectors.ts: `pullPromise.then(finish)`.
+      // No CPU spin, no busy-poll — just a Promise chain.
+      if (!pullPromise) {
+        pullPromise = pullLoop(transform);
+      }
+      pullPromise.then(finish, (err) => {
+        machine.send({ type: 'PULL_ERROR', error: err });
+        finish();
+      });
     },
   });

package/src/server/pipeline.ts CHANGED Viewed

@@ -21,6 +21,7 @@ import {
   setMutableCookieContext,
   getSetCookieHeaders,
   markResponseFlushed,
+  setSegmentParams,
 } from './request-context.js';
 import {
   generateTraceId,
@@ -484,6 +485,11 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
       throw error;
     }
+    // Store coerced segment params in ALS so components can access them
+    // via rawSegmentParams() instead of receiving them as a prop.
+    // See design/07-routing.md §"params.ts — Convention File for Typed Params"
+    setSegmentParams(match.params);
     // Stage 3: Leaf middleware.ts (only the leaf route's middleware runs)
     if (match.middleware) {
       const ctx: MiddlewareContext = {

package/src/server/primitives.ts CHANGED Viewed

@@ -6,6 +6,8 @@
 import type { JsonSerializable } from './types.js';
 import { getWaitUntil as _getWaitUntil } from './waituntil-bridge.js';
 import { isDebug } from './debug.js';
+import { getRequestSearchString } from './request-context.js';
+import { mergePreservedSearchParams } from '#/shared/merge-search-params.js';
 // ─── Dev-mode validation ────────────────────────────────────────────────────
@@ -209,14 +211,46 @@ export class RedirectSignal extends Error {
 /** Pattern matching absolute URLs: http(s):// or protocol-relative // */
 const ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
+/**
+ * Options for redirect() — alternative to passing a bare status code.
+ */
+export interface RedirectOptions {
+  /** HTTP redirect status code (3xx). Defaults to 302. */
+  status?: number;
+  /**
+   * Preserve search params from the current request URL on the redirect target.
+   *
+   * - `true` — preserve ALL current search params (target params take precedence)
+   * - `string[]` — preserve only the named params (e.g. `['private', 'token']`)
+   *
+   * Target path's own query params always take precedence over preserved ones.
+   */
+  preserveSearchParams?: true | string[];
+}
 /**
  * Redirect to a relative path. Rejects absolute and protocol-relative URLs.
  * Use `redirectExternal()` for external redirects with an allow-list.
  *
  * @param path - Relative path (e.g. '/login', 'settings', '/login?returnTo=/dash')
- * @param status - HTTP redirect status code (3xx). Defaults to 302.
+ * @param statusOrOptions - HTTP status code (3xx, default 302) or options object.
+ *
+ * @example
+ * // Simple redirect
+ * redirect('/login');
+ *
+ * // With status code
+ * redirect('/login', 301);
+ *
+ * // With preserved search params
+ * redirect(`/docs/${version}/${slug}`, { preserveSearchParams: ['foo'] });
  */
-export function redirect(path: string, status: number = 302): never {
+export function redirect(path: string, statusOrOptions?: number | RedirectOptions): never {
+  const status =
+    typeof statusOrOptions === 'number' ? statusOrOptions : (statusOrOptions?.status ?? 302);
+  const preserveSearchParams =
+    typeof statusOrOptions === 'object' ? statusOrOptions.preserveSearchParams : undefined;
   if (status < 300 || status > 399) {
     throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
   }
@@ -226,7 +260,14 @@ export function redirect(path: string, status: number = 302): never {
         'Use redirectExternal(url, allowList) for external redirects.'
     );
   }
-  throw new RedirectSignal(path, status);
+  let resolvedPath = path;
+  if (preserveSearchParams) {
+    const currentSearch = getRequestSearchString();
+    resolvedPath = mergePreservedSearchParams(path, currentSearch, preserveSearchParams);
+  }
+  throw new RedirectSignal(resolvedPath, status);
 }
 /**
@@ -236,9 +277,10 @@ export function redirect(path: string, status: number = 302): never {
  * will replay POST requests to the new location. This matches Next.js behavior.
  *
  * @param path - Relative path (e.g. '/new-page', '/dashboard')
+ * @param options - Optional redirect options (e.g. preserveSearchParams).
  */
-export function permanentRedirect(path: string): never {
-  redirect(path, 308);
+export function permanentRedirect(path: string, options?: Omit<RedirectOptions, 'status'>): never {
+  redirect(path, { status: 308, ...options });
 }
 /**

package/src/server/render-timeout.ts ADDED Viewed

@@ -0,0 +1,108 @@
+/**
+ * Render timeout utilities for SSR streaming pipeline.
+ *
+ * Provides a RenderTimeoutError class and a helper to create
+ * timeout-guarded AbortSignals. Used to defend against hung RSC
+ * streams and infinite SSR renders.
+ *
+ * Design doc: 02-rendering-pipeline.md §"Streaming Constraints"
+ */
+/**
+ * Error thrown when an SSR render or RSC stream read exceeds the
+ * configured timeout. Callers can check `instanceof RenderTimeoutError`
+ * to distinguish timeout from other errors and return a 504 or close
+ * the connection cleanly.
+ */
+export class RenderTimeoutError extends Error {
+  readonly timeoutMs: number;
+  constructor(timeoutMs: number, context?: string) {
+    const message = context
+      ? `Render timeout after ${timeoutMs}ms: ${context}`
+      : `Render timeout after ${timeoutMs}ms`;
+    super(message);
+    this.name = 'RenderTimeoutError';
+    this.timeoutMs = timeoutMs;
+  }
+}
+/**
+ * Result of createRenderTimeout — an AbortSignal that fires after
+ * the given duration, plus a cancel function to clear the timer
+ * when the render completes normally.
+ */
+export interface RenderTimeout {
+  /** AbortSignal that aborts after timeoutMs. */
+  signal: AbortSignal;
+  /** Cancel the timeout timer. Call this when the render completes. */
+  cancel: () => void;
+}
+/**
+ * Create a render timeout that aborts after the given duration.
+ *
+ * Returns an AbortSignal and a cancel function. The signal fires
+ * with a RenderTimeoutError as the abort reason after `timeoutMs`.
+ * Call `cancel()` when the render completes to prevent the timeout
+ * from firing.
+ *
+ * If an existing `parentSignal` is provided, the returned signal
+ * aborts when either the parent signal or the timeout fires —
+ * whichever comes first.
+ */
+export function createRenderTimeout(timeoutMs: number, parentSignal?: AbortSignal): RenderTimeout {
+  const controller = new AbortController();
+  const reason = new RenderTimeoutError(timeoutMs, 'RSC stream read timed out');
+  const timer = setTimeout(() => {
+    controller.abort(reason);
+  }, timeoutMs);
+  // If there's a parent signal (e.g. request abort), chain it
+  if (parentSignal) {
+    if (parentSignal.aborted) {
+      clearTimeout(timer);
+      controller.abort(parentSignal.reason);
+    } else {
+      parentSignal.addEventListener(
+        'abort',
+        () => {
+          clearTimeout(timer);
+          controller.abort(parentSignal.reason);
+        },
+        { once: true }
+      );
+    }
+  }
+  return {
+    signal: controller.signal,
+    cancel: () => {
+      clearTimeout(timer);
+    },
+  };
+}
+/**
+ * Race a promise against a timeout. Rejects with RenderTimeoutError
+ * if the promise does not resolve within `timeoutMs`.
+ *
+ * Used to guard individual `rscReader.read()` calls inside pullLoop.
+ */
+export function withTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+  context?: string
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout>;
+  const timeoutPromise = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new RenderTimeoutError(timeoutMs, context));
+    }, timeoutMs);
+  });
+  return Promise.race([promise, timeoutPromise]).finally(() => {
+    clearTimeout(timer!);
+  });
+}

package/src/server/request-context.ts CHANGED Viewed

@@ -178,6 +178,72 @@ export function rawSearchParams(): Promise<URLSearchParams> {
   return store.searchParamsPromise;
 }
+/**
+ * Returns a Promise resolving to the current request's coerced segment params.
+ *
+ * Segment params are set by the pipeline after route matching and param
+ * coercion (via params.ts codecs). When no params.ts exists, values are
+ * raw strings. When codecs are defined, values are already coerced
+ * (e.g., `id` is a `number` if `defineSegmentParams({ id: z.coerce.number() })`).
+ *
+ * This is the primary way page and layout components access route params:
+ *
+ * ```ts
+ * import { rawSegmentParams } from '@timber-js/app/server'
+ *
+ * export default async function Page() {
+ *   const { slug } = await rawSegmentParams()
+ *   // ...
+ * }
+ * ```
+ *
+ * Throws if called outside a request context.
+ */
+export function rawSegmentParams(): Promise<Record<string, string | string[]>> {
+  const store = requestContextAls.getStore();
+  if (!store) {
+    throw new Error(
+      '[timber] rawSegmentParams() called outside of a request context. ' +
+        'It can only be used in middleware, access checks, server components, and server actions.'
+    );
+  }
+  if (!store.segmentParamsPromise) {
+    throw new Error(
+      '[timber] rawSegmentParams() called before route matching completed. ' +
+        'Segment params are not available until after the route is matched.'
+    );
+  }
+  return store.segmentParamsPromise;
+}
+/**
+ * Set the segment params promise on the current request context.
+ * Called by the pipeline after route matching and param coercion.
+ *
+ * @internal — framework use only
+ */
+export function setSegmentParams(params: Record<string, string | string[]>): void {
+  const store = requestContextAls.getStore();
+  if (!store) {
+    throw new Error('[timber] setSegmentParams() called outside of a request context.');
+  }
+  store.segmentParamsPromise = Promise.resolve(params);
+}
+/**
+ * Returns the raw search string from the current request URL (e.g. "?foo=bar").
+ * Synchronous — safe for use in `redirect()` which throws synchronously.
+ *
+ * Returns empty string if called outside a request context (non-throwing for
+ * use in redirect's optional preserveSearchParams path).
+ *
+ * @internal — used by redirect() for preserveSearchParams support.
+ */
+export function getRequestSearchString(): string {
+  const store = requestContextAls.getStore();
+  return store?.searchString ?? '';
+}
 // ─── Types ────────────────────────────────────────────────────────────────
 /**
@@ -253,11 +319,13 @@ export interface RequestCookies {
  */
 export function runWithRequestContext<T>(req: Request, fn: () => T): T {
   const originalCopy = new Headers(req.headers);
+  const parsedUrl = new URL(req.url);
   const store: RequestContextStore = {
     headers: freezeHeaders(req.headers),
     originalHeaders: originalCopy,
     cookieHeader: req.headers.get('cookie') ?? '',
-    searchParamsPromise: Promise.resolve(new URL(req.url).searchParams),
+    searchParamsPromise: Promise.resolve(parsedUrl.searchParams),
+    searchString: parsedUrl.search,
     cookieJar: new Map(),
     flushed: false,
     mutableContext: false,

package/src/server/route-element-builder.ts CHANGED Viewed

@@ -110,7 +110,7 @@ function rejectLegacyGenerateMetadata(mod: Record<string, unknown>, filePath: st
         `  // Before\n` +
         `  export async function generateMetadata({ params }) { ... }\n\n` +
         `  // After\n` +
-        `  export async function metadata({ params }) { ... }`
+        `  export async function metadata() { ... }`
     );
   }
 }
@@ -119,19 +119,21 @@ function rejectLegacyGenerateMetadata(mod: Record<string, unknown>, filePath: st
  * Extract and resolve metadata from a module (layout or page).
  * Handles both static metadata objects and async metadata functions.
  * Returns the resolved Metadata, or null if none exported.
+ *
+ * Metadata functions no longer receive { params } — they access params
+ * via rawSegmentParams() from ALS, same as page/layout components.
  */
 async function extractMetadata(
   mod: Record<string, unknown>,
-  segment: ManifestSegmentNode,
-  paramsPromise: Promise<Record<string, string | string[]>>
+  segment: ManifestSegmentNode
 ): Promise<Metadata | null> {
   if (typeof mod.metadata === 'function') {
-    type MetadataFn = (props: Record<string, unknown>) => Promise<Metadata>;
+    type MetadataFn = () => Promise<Metadata>;
     return (
       (await withSpan(
         'timber.metadata',
         { 'timber.segment': segment.segmentName ?? segment.urlPath },
-        () => (mod.metadata as MetadataFn)({ params: paramsPromise })
+        () => (mod.metadata as MetadataFn)()
       )) ?? null
     );
   }
@@ -172,9 +174,6 @@ export async function buildRouteElement(
 ): Promise<RouteElementResult> {
   const segments = match.segments as unknown as ManifestSegmentNode[];
-  // Params are passed as a Promise to match Next.js 15+ convention.
-  const paramsPromise = Promise.resolve(match.params);
   // Load all modules along the segment chain
   const metadataEntries: Array<{ metadata: Metadata; isPage: boolean }> = [];
   const layoutComponents: LayoutComponentEntry[] = [];
@@ -199,7 +198,7 @@ export async function buildRouteElement(
       // middleware and rendering. See coerceSegmentParams() in pipeline.ts.
       rejectLegacyGenerateMetadata(mod, segment.layout.filePath ?? segment.urlPath);
-      const layoutMetadata = await extractMetadata(mod, segment, paramsPromise);
+      const layoutMetadata = await extractMetadata(mod, segment);
       if (layoutMetadata) {
         metadataEntries.push({ metadata: layoutMetadata, isPage: false });
       }
@@ -217,7 +216,7 @@ export async function buildRouteElement(
         PageComponent = mod.default as (...args: unknown[]) => unknown;
       }
       rejectLegacyGenerateMetadata(mod, segment.page.filePath ?? segment.urlPath);
-      const pageMetadata = await extractMetadata(mod, segment, paramsPromise);
+      const pageMetadata = await extractMetadata(mod, segment);
       if (pageMetadata) {
         metadataEntries.push({ metadata: pageMetadata, isPage: true });
       }
@@ -317,9 +316,7 @@ export async function buildRouteElement(
     );
   };
-  let element = h(TracedPage, {
-    params: paramsPromise,
-  });
+  let element = h(TracedPage, {});
   // Build a lookup of layout components by segment for O(1) access.
   const layoutBySegment = new Map(
@@ -399,7 +396,6 @@ export async function buildRouteElement(
       if (accessFn) {
         element = h(AccessGate, {
           accessFn,
-          params: match.params,
           segmentName: segment.segmentName,
           verdict: accessVerdicts.get(i),
           children: element,
@@ -416,7 +412,6 @@ export async function buildRouteElement(
         slotProps[slotName] = await resolveSlotElement(
           slotNode as ManifestSegmentNode,
           match,
-          paramsPromise,
           h,
           interception
         );
@@ -447,7 +442,6 @@ export async function buildRouteElement(
         parallelRouteKeys,
         children: h(TracedLayout, {
           ...slotProps,
-          params: paramsPromise,
           children: element,
         }),
       });

package/src/server/rsc-entry/helpers.ts CHANGED Viewed

@@ -20,9 +20,6 @@ export const RSC_CONTENT_TYPE = 'text/x-component';
  * stream that we drain and discard.
  *
  * See design/13-security.md §"Server component source leak"
- *
- * TODO: In the future, expose this debug data to the browser in dev mode
- * for inline error overlays (e.g. component stack traces).
  */
 export function createDebugChannelSink(): { readable: ReadableStream; writable: WritableStream } {
   const sink = new TransformStream();
@@ -34,6 +31,128 @@ export function createDebugChannelSink(): { readable: ReadableStream; writable:
   };
 }
+// ─── Debug Channel Collector (dev mode only) ────────────────────────────
+/**
+ * Parsed component debug info extracted from the Flight debug channel.
+ *
+ * Contains only component names, environment labels, and stack frames —
+ * never source code or props. See design/13-security.md §"Server source
+ * never reaches the client".
+ */
+export interface DebugComponentEntry {
+  name: string;
+  env: string | null;
+  key: string | null;
+  stack: unknown[] | null;
+}
+/**
+ * A debug channel that collects Flight debug rows instead of discarding them.
+ *
+ * Used in dev mode to capture server component tree information for the
+ * Vite error overlay. The collector provides the same `{ readable, writable }`
+ * shape as the discard sink, plus methods to retrieve collected data.
+ *
+ * Security: only component names, environments, and stack frames are
+ * extracted — props and source code are stripped. In production builds,
+ * use `createDebugChannelSink()` instead (this function is never called).
+ */
+export interface DebugChannelCollector {
+  readable: ReadableStream;
+  writable: WritableStream;
+  /** Get the raw collected text from the debug channel. */
+  getCollectedText(): string;
+  /** Get parsed component entries (names, stacks — no props or source). */
+  getComponents(): DebugComponentEntry[];
+}
+export function createDebugChannelCollector(): DebugChannelCollector {
+  const chunks: string[] = [];
+  const decoder = new TextDecoder();
+  const sink = new TransformStream();
+  // Collect chunks from the readable side instead of discarding them.
+  sink.readable
+    .pipeTo(
+      new WritableStream({
+        write(chunk: Uint8Array) {
+          chunks.push(decoder.decode(chunk, { stream: true }));
+        },
+        close() {
+          // Flush any remaining bytes in the decoder
+          const remaining = decoder.decode();
+          if (remaining) chunks.push(remaining);
+        },
+      })
+    )
+    .catch(() => {
+      // Stream abort — request cancelled. Not an error.
+    });
+  return {
+    readable: new ReadableStream(), // no commands to send to Flight
+    writable: sink.writable,
+    getCollectedText() {
+      return chunks.join('');
+    },
+    getComponents() {
+      return parseDebugRows(chunks.join(''));
+    },
+  };
+}
+/**
+ * Parse React Flight debug rows into component entries.
+ *
+ * The Flight debug channel writes rows in `hexId:json\n` format. Each row
+ * with a JSON object containing a `name` field is a component debug info
+ * entry. Rows without `name` (timing rows, reference rows like `D"$id"`)
+ * are skipped.
+ *
+ * Security: `props` are explicitly stripped from parsed entries — they may
+ * contain rendered output or user data. Only `name`, `env`, `key`, and
+ * `stack` are retained.
+ */
+export function parseDebugRows(text: string): DebugComponentEntry[] {
+  if (!text) return [];
+  const entries: DebugComponentEntry[] = [];
+  const lines = text.split('\n');
+  for (const line of lines) {
+    if (!line) continue;
+    // Flight row format: hexId:payload
+    const colonIdx = line.indexOf(':');
+    if (colonIdx === -1) continue;
+    const payload = line.slice(colonIdx + 1);
+    // Skip non-JSON payloads (e.g., D"$a" reference rows)
+    if (!payload.startsWith('{')) continue;
+    try {
+      const parsed = JSON.parse(payload);
+      if (typeof parsed !== 'object' || parsed === null) continue;
+      if (typeof parsed.name !== 'string') continue;
+      // Strip props — may contain source-derived data or user data.
+      // Only retain: name, env, key, stack.
+      entries.push({
+        name: parsed.name,
+        env: parsed.env ?? null,
+        key: parsed.key ?? null,
+        stack: Array.isArray(parsed.stack) ? parsed.stack : null,
+      });
+    } catch {
+      // Malformed JSON — skip this row
+    }
+  }
+  return entries;
+}
 /**
  * Build segment metadata for the X-Timber-Segments response header.
  * Describes the rendered segment chain with async status, enabling