@timber-js/app 0.2.0-alpha.92 → 0.2.0-alpha.94

package/dist/adapters/nitro.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nitro.d.ts","sourceRoot":"","sources":["../../src/adapters/nitro.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAsBnE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,aAAa,GACb,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,KAAK,CAAC;AAEV,2CAA2C;AAC3C,UAAU,YAAY;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAgFD,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,mBAAwB,GAAG,qBAAqB,CA2F9E;AAID,sCAAsC;AACtC,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,QAAQ,UAAO,EACf,eAAe,UAAQ,GACtB,MAAM,CAwFR;AAED,sCAAsC;AACtC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAyBR;AAOD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CA6LnF;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sCAAsC;AACtC,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAClB,mBAAmB,GAAG,IAAI,CAY5B;AA8DD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjE"}
+{"version":3,"file":"nitro.d.ts","sourceRoot":"","sources":["../../src/adapters/nitro.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAsBnE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,aAAa,GACb,SAAS,GACT,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,KAAK,CAAC;AAEV,2CAA2C;AAC3C,UAAU,YAAY;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAgFD,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,OAAO,GAAE,mBAAwB,GAAG,qBAAqB,CA2F9E;AAID,sCAAsC;AACtC,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,QAAQ,UAAO,EACf,eAAe,UAAQ,GACtB,MAAM,CAwFR;AAED,sCAAsC;AACtC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAyBR;AAOD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAoNnF;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sCAAsC;AACtC,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAClB,mBAAmB,GAAG,IAAI,CAY5B;AA8DD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAEjE"}

package/dist/adapters/nitro.js

@@ -474,7 +474,30 @@ const server = createServer(async (req, res) => {
     const webResponse = compressResponse(webRequest, rawResponse);
 
     // Write the response back to the Node response.
-    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));
+    //
+    // Set-Cookie needs special handling: Headers.entries() joins multiple
+    // Set-Cookie values with ", " into a single entry, but each cookie must
+    // be its own header per RFC 6265 §4.1. Object.fromEntries() would then
+    // collapse them into one malformed Set-Cookie header that browsers reject
+    // (or only honor partially). Use getSetCookie() to preserve individual
+    // values, and pass them as an array — Node's writeHead accepts
+    // Record<string, string | string[]> and emits one header per array entry.
+    //
+    // Without this, EVERY cookie set by the framework on Node—/Nitro deployments
+    // is silently dropped: defineCookie().setCookie() in actions, middleware
+    // cookie writes, the framework's own session cookies, all of it. See
+    // LOCAL-741.
+    const responseHeaders: Record<string, string | string[]> = {};
+    webResponse.headers.forEach((value, key) => {
+      if (key.toLowerCase() !== 'set-cookie') {
+        responseHeaders[key] = value;
+      }
+    });
+    const setCookies = webResponse.headers.getSetCookie();
+    if (setCookies.length > 0) {
+      responseHeaders['set-cookie'] = setCookies;
+    }
+    res.writeHead(webResponse.status, responseHeaders);
 
     if (webResponse.body) {
       const reader = webResponse.body.getReader();

package/dist/adapters/nitro.js.map

@@ -1 +1 @@
-{"version":3,"file":"nitro.js","names":[],"sources":["../../src/adapters/compress-module.ts","../../src/adapters/nitro.ts"],"sourcesContent":["// Generated compression module template for self-hosted deployments.\n//\n// This file generates a standalone ESM module (_compress.mjs) that is\n// written to the build output during adapter buildOutput(). It's imported\n// by the Nitro entry and preview server at runtime.\n//\n// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal and\n// node:zlib buffers output internally, breaking streaming.\n// Cloudflare Workers don't need this — the edge auto-compresses.\n//\n// See design/25-production-deployments.md.\n\n/**\n * Generate a standalone ESM module that exports compressResponse().\n *\n * Written to `_compress.mjs` during buildOutput. Imported by the Nitro entry\n * and preview server.\n *\n * @internal Exported for testing.\n */\nexport function generateCompressModule(): string {\n  return `// Generated by @timber-js/app — response compression for self-hosted deployments.\n// Do not edit — this file is regenerated on each build.\n// Uses node:zlib createGzip() (C++ native) on Node.js, falls back to\n// CompressionStream (Web API) on other runtimes. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal.\nimport { Readable } from 'node:stream';\nimport { createGzip, constants } from 'node:zlib';\n\nconst COMPRESSIBLE_TYPES = new Set([\n  'text/html', 'text/css', 'text/plain', 'text/xml', 'text/javascript',\n  'text/x-component', 'application/json', 'application/javascript',\n  'application/xml', 'application/xhtml+xml', 'application/rss+xml',\n  'application/atom+xml', 'image/svg+xml',\n]);\n\nconst NO_COMPRESS_STATUSES = new Set([204, 304]);\n\nfunction negotiateEncoding(acceptEncoding) {\n  if (!acceptEncoding) return null;\n  // Parse tokens with quality values. Per RFC 9110 §12.5.3, q=0 means\n  // \"not acceptable\" — the client explicitly rejects that encoding.\n  // Brotli (br) is intentionally not handled at the application level.\n  const parts = acceptEncoding.split(',');\n  for (const part of parts) {\n    const [token, ...params] = part.split(';');\n    const name = token.trim().toLowerCase();\n    if (name !== 'gzip') continue;\n    let qValue = 1;\n    for (const param of params) {\n      const trimmed = param.trim().toLowerCase();\n      if (trimmed.startsWith('q=')) {\n        qValue = parseFloat(trimmed.slice(2));\n        if (Number.isNaN(qValue)) qValue = 1;\n        break;\n      }\n    }\n    if (qValue > 0) return 'gzip';\n  }\n  return null;\n}\n\nfunction shouldCompress(response) {\n  if (!response.body) return false;\n  if (NO_COMPRESS_STATUSES.has(response.status)) return false;\n  if (response.headers.has('Content-Encoding')) return false;\n  const contentType = response.headers.get('Content-Type');\n  if (!contentType) return false;\n  const mimeType = contentType.split(';')[0].trim().toLowerCase();\n  if (mimeType === 'text/event-stream') return false;\n  return COMPRESSIBLE_TYPES.has(mimeType);\n}\n\nfunction compressWithGzip(body) {\n  // Use node:zlib (C++ native) for gzip compression. The Web Streams\n  // CompressionStream works but every chunk crosses the JS/Promise boundary.\n  // node:zlib.createGzip() compresses entirely in C++ with zero per-chunk\n  // Promise overhead.\n  //\n  // Convert: Web ReadableStream → Node Readable → pipe through gzip →\n  //          Node Readable → Readable.toWeb() → Web ReadableStream\n  try {\n    const nodeReadable = Readable.fromWeb(body);\n    // Z_SYNC_FLUSH ensures each chunk is flushed immediately so the browser\n    // receives the HTML shell before Suspense boundaries resolve. Without it,\n    // gzip buffers internally and breaks streaming.\n    const gzip = createGzip({ flush: constants.Z_SYNC_FLUSH });\n    const compressed = nodeReadable.pipe(gzip);\n    return Readable.toWeb(compressed);\n  } catch {\n    // Fallback: CompressionStream (CF Workers, or if node:stream unavailable)\n    return body.pipeThrough(new CompressionStream('gzip'));\n  }\n}\n\nexport function compressResponse(request, response) {\n  if (!shouldCompress(response)) return response;\n  const acceptEncoding = request.headers.get('Accept-Encoding') || '';\n  const encoding = negotiateEncoding(acceptEncoding);\n  if (!encoding) return response;\n  const compressedBody = compressWithGzip(response.body);\n  const headers = new Headers(response.headers);\n  headers.set('Content-Encoding', encoding);\n  headers.delete('Content-Length');\n  const existingVary = headers.get('Vary');\n  if (existingVary) {\n    if (!existingVary.toLowerCase().includes('accept-encoding')) {\n      headers.set('Vary', existingVary + ', Accept-Encoding');\n    }\n  } else {\n    headers.set('Vary', 'Accept-Encoding');\n  }\n  return new Response(compressedBody, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n`;\n}\n","// Nitro adapter — multi-platform deployment\n//\n// Covers everything except Cloudflare Workers: Node.js, Bun, Vercel,\n// Netlify, AWS Lambda, Deno Deploy, Azure Functions. Nitro handles\n// compression, graceful shutdown, static file serving, and platform quirks.\n// See design/11-platform.md and design/25-production-deployments.md.\n\nimport { writeFile, readFile, mkdir, cp } from 'node:fs/promises';\nimport { execFile } from 'node:child_process';\nimport { join, relative } from 'node:path';\nimport type { TimberPlatformAdapter, TimberConfig } from './types';\nimport { generateCompressModule } from './compress-module.js';\n// Inlined from server/asset-headers.ts — adapters are loaded by Node at\n// Vite startup time, before Vite's module resolver is available, so cross-\n// directory .ts imports don't resolve.\nconst IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';\nconst STATIC_CACHE = 'public, max-age=3600, must-revalidate';\n\nfunction generateHeadersFile(): string {\n  return `# Auto-generated by @timber-js/app — static asset cache headers.\n# See design/25-production-deployments.md §\"CDN / Edge Cache\"\n\n/assets/*\n  Cache-Control: ${IMMUTABLE_CACHE}\n\n/*\n  Cache-Control: ${STATIC_CACHE}\n`;\n}\n\n// ─── Presets ─────────────────────────────────────────────────────────────────\n\n/**\n * Supported Nitro deployment presets.\n *\n * Each preset maps to a Nitro deployment target. The adapter generates\n * the appropriate configuration and entry point for the selected platform.\n */\nexport type NitroPreset =\n  | 'vercel'\n  | 'vercel-edge'\n  | 'netlify'\n  | 'netlify-edge'\n  | 'aws-lambda'\n  | 'deno-deploy'\n  | 'azure-functions'\n  | 'node-server'\n  | 'bun';\n\n/** Preset-specific Nitro configuration. */\ninterface PresetConfig {\n  /** Nitro preset name passed to the Nitro build. */\n  nitroPreset: string;\n  /** Output directory name within the build dir. */\n  outputDir: string;\n  /** Whether the runtime supports waitUntil. */\n  supportsWaitUntil: boolean;\n  /** Whether the runtime supports application-level 103 Early Hints. */\n  supportsEarlyHints: boolean;\n  /** Value for TIMBER_RUNTIME env var. See design/25-production-deployments.md. */\n  runtimeName: string;\n  /** Additional nitro.config fields for this preset. */\n  extraConfig?: Record<string, unknown>;\n}\n\nconst PRESET_CONFIGS: Record<NitroPreset, PresetConfig> = {\n  'vercel': {\n    nitroPreset: 'vercel',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel',\n    extraConfig: { vercel: { functions: { maxDuration: 30 } } },\n  },\n  'vercel-edge': {\n    nitroPreset: 'vercel-edge',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel-edge',\n  },\n  'netlify': {\n    nitroPreset: 'netlify',\n    outputDir: '.netlify/functions-internal',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify',\n  },\n  'netlify-edge': {\n    nitroPreset: 'netlify-edge',\n    outputDir: '.netlify/edge-functions',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify-edge',\n  },\n  'aws-lambda': {\n    nitroPreset: 'aws-lambda',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'aws-lambda',\n  },\n  'deno-deploy': {\n    nitroPreset: 'deno-deploy',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'deno-deploy',\n  },\n  'azure-functions': {\n    nitroPreset: 'azure-functions',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'azure-functions',\n  },\n  'node-server': {\n    nitroPreset: 'node-server',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled by default: most node-server deployments sit behind a\n    // reverse proxy (nginx, caddy, traefik) that doesn't support 103\n    // Early Hints over HTTP/1.1. Sending 103 causes nginx to intermittently\n    // treat the response as an error and retry after proxy_connect_timeout\n    // (~5s stalls on ~23% of requests). Link headers on the 200 response\n    // are the safe fallback — Cloudflare and other CDNs convert them to\n    // 103 automatically at the edge (over HTTP/2+ to the browser).\n    supportsEarlyHints: false,\n    runtimeName: 'node-server',\n  },\n  'bun': {\n    nitroPreset: 'bun',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled for same reason as node-server — reverse proxies choke on 103.\n    // Link headers on the 200 response are converted to 103 by CDNs.\n    supportsEarlyHints: false,\n    runtimeName: 'bun',\n  },\n};\n\n// ─── Options ─────────────────────────────────────────────────────────────────\n\n/** Options for the Nitro adapter. */\nexport interface NitroAdapterOptions {\n  /**\n   * Deployment preset. Determines the target platform.\n   * @default 'node-server'\n   */\n  preset?: NitroPreset;\n\n  /**\n   * Enable application-level gzip compression for HTML and RSC responses.\n   *\n   * When `true` (default), the origin compresses responses using the Web\n   * `CompressionStream` API. This is useful for self-hosted deployments\n   * where no reverse proxy or CDN handles compression.\n   *\n   * Set to `false` when deploying behind a reverse proxy (nginx, caddy)\n   * or CDN (Cloudflare, Fastly, Vercel) that compresses at the edge.\n   * Disabling origin compression saves CPU on the Node.js event loop —\n   * compressing 1MB+ streaming HTML responses takes 10-15ms of main\n   * thread time per request, directly reducing throughput under load.\n   *\n   * @default true\n   */\n  compress?: boolean;\n\n  /**\n   * Additional Nitro configuration to merge into the generated config.\n   * Overrides default values for the selected preset.\n   */\n  nitroConfig?: Record<string, unknown>;\n}\n\n// ─── Adapter ─────────────────────────────────────────────────────────────────\n\n/**\n * Create a Nitro-based adapter for multi-platform deployment.\n *\n * Nitro abstracts deployment targets — the same timber.js app can deploy\n * to Vercel, Netlify, AWS, Deno Deploy, or Azure by changing the preset.\n *\n * @example\n * ```ts\n * import { nitro } from '@timber-js/app/adapters/nitro'\n *\n * export default {\n *   output: 'server',\n *   adapter: nitro({ preset: 'vercel' }),\n * }\n * ```\n */\nexport function nitro(options: NitroAdapterOptions = {}): TimberPlatformAdapter {\n  const preset = options.preset ?? 'node-server';\n  const compress = options.compress ?? true;\n  const presetConfig = PRESET_CONFIGS[preset];\n  const pendingPromises: Promise<unknown>[] = [];\n\n  return {\n    name: `nitro-${preset}`,\n\n    async buildOutput(config: TimberConfig, buildDir: string) {\n      const outDir = join(buildDir, 'nitro');\n      await mkdir(outDir, { recursive: true });\n\n      // Copy client assets to public directory.\n      // When client JavaScript is disabled, skip .js files — only CSS,\n      // fonts, images, and other static assets are needed.\n      const clientDir = join(buildDir, 'client');\n      const publicDir = join(outDir, 'public');\n      await mkdir(publicDir, { recursive: true });\n      await cp(clientDir, publicDir, {\n        recursive: true,\n        filter: config.clientJavascriptDisabled ? (src: string) => !src.endsWith('.js') : undefined,\n      }).catch(() => {\n        // Client dir may not exist when client JavaScript is disabled\n      });\n\n      // Write _headers file for platforms that support it (Netlify, etc.).\n      // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n      await writeFile(join(publicDir, '_headers'), generateHeadersFile());\n\n      // Write the build manifest init module (if manifest data was produced).\n      if (config.manifestInit) {\n        await writeFile(join(outDir, '_timber-manifest-init.js'), config.manifestInit);\n      }\n\n      // Write the compression helper module for runtime use.\n      // See design/25-production-deployments.md — self-hosted deployments\n      // need application-level compression (Cloudflare handles it at the edge).\n      await writeFile(join(outDir, '_compress.mjs'), generateCompressModule());\n\n      // Copy rsc/ssr build output into the nitro dir so imports stay local\n      // during the Nitro bundling step (avoids broken relative paths in output).\n      await cp(join(buildDir, 'rsc'), join(outDir, 'rsc'), { recursive: true });\n      await cp(join(buildDir, 'ssr'), join(outDir, 'ssr'), { recursive: true }).catch(() => {});\n\n      // Prepend the manifest assignment directly into the RSC entry so\n      // globalThis.__TIMBER_BUILD_MANIFEST__ is set before any module reads it.\n      // This must be top-level code, not an import, because rollup tree-shakes\n      // side-effect-only globalThis assignments from imported modules.\n      if (config.manifestInit) {\n        const rscEntry = join(outDir, 'rsc', 'index.js');\n        const rscContent = await readFile(rscEntry, 'utf-8');\n        await writeFile(rscEntry, `${config.manifestInit}\\n${rscContent}`);\n      }\n\n      // Generate the Nitro entry point (imports from ./rsc/ within nitro dir)\n      const entry = generateNitroEntry(buildDir, outDir, preset, compress);\n      await writeFile(join(outDir, 'entry.ts'), entry);\n\n      // Run the Nitro build to produce a production-ready server bundle.\n      // The output goes to dist/nitro/.output/server/index.mjs (for node-server preset).\n      // Config is passed programmatically — no nitro.config.ts file needed.\n      await runNitroBuild(outDir, preset, options.nitroConfig);\n    },\n\n    // Only presets that produce a locally-runnable server get preview().\n    // Serverless presets (vercel, netlify, aws-lambda, etc.) have no\n    // local runtime — Vite's built-in preview is the fallback.\n    preview: LOCALLY_PREVIEWABLE.has(preset)\n      ? async (_config: TimberConfig, buildDir: string) => {\n          // Generate a standalone preview server that uses Node's built-in\n          // HTTP server. The Nitro entry.ts can't be run directly because\n          // it imports h3 (a Nitro dependency not available at runtime).\n          const previewScript = generatePreviewScript(buildDir, preset);\n          const scriptPath = join(buildDir, 'nitro', '_preview-server.mjs');\n          await writeFile(scriptPath, previewScript);\n\n          const command = preset === 'bun' ? 'bun' : 'node';\n          await spawnNitroPreview(command, [scriptPath], join(buildDir, 'nitro'));\n        }\n      : undefined,\n\n    waitUntil: presetConfig.supportsWaitUntil\n      ? (promise: Promise<unknown>) => {\n          const tracked = promise.catch((err) => {\n            console.error('[timber] waitUntil promise rejected:', err);\n          });\n          pendingPromises.push(tracked);\n        }\n      : undefined,\n  };\n}\n\n// ─── Entry Generation ────────────────────────────────────────────────────────\n\n/** @internal Exported for testing. */\nexport function generateNitroEntry(\n  buildDir: string,\n  outDir: string,\n  preset: NitroPreset,\n  compress = true,\n  hasManifestInit = false\n): string {\n  // The RSC entry is the main request handler — it exports the fetch handler as default.\n  // rsc/ is copied into the nitro dir so the import is local.\n  // The manifest init is prepended to rsc/index.js before the nitro build,\n  // so globalThis.__TIMBER_BUILD_MANIFEST__ is set before any code reads it.\n  const serverEntryRelative = './rsc/index.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n  const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;\n  const supportsWaitUntil = PRESET_CONFIGS[preset].supportsWaitUntil;\n\n  // On node-server and bun, wrap the handler with ALS so the pipeline\n  // can send 103 Early Hints via res.writeEarlyHints(). Other presets\n  // either don't support 103 or handle it at the CDN level.\n  //\n  // For presets that support waitUntil, bridge h3's event.waitUntil()\n  // to timber's waitUntil() primitive via the ALS bridge.\n  // See design/11-platform.md §\"waitUntil()\".\n  let handlerCall: string;\n  if (earlyHints && supportsWaitUntil) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const callHandler = () => handler(webRequest)\n  let wrappedHandler = earlyHintsSender\n    ? () => runWithEarlyHintsSender(earlyHintsSender, callHandler)\n    : callHandler\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, wrappedHandler)\n    : await wrappedHandler()`;\n  } else if (earlyHints) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const webResponse = earlyHintsSender\n    ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else if (supportsWaitUntil) {\n    handlerCall = `  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else {\n    handlerCall = `  const webResponse = await handler(webRequest)`;\n  }\n\n  // Build manifest init must be imported before the handler so that\n  // globalThis.__TIMBER_BUILD_MANIFEST__ is set when the virtual module evaluates.\n  // ESM guarantees imports are evaluated in order.\n  const manifestImport = hasManifestInit ? \"import './_timber-manifest-init.js'\\n\" : '';\n\n  // Import runWithWaitUntil only when the preset supports it.\n  const waitUntilImport = supportsWaitUntil ? ', runWithWaitUntil' : '';\n\n  const compressImport = compress ? \"import { compressResponse } from './_compress.mjs'\\n\" : '';\n  const compressCall = compress ? 'compressResponse(webRequest, webResponse)' : 'webResponse';\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\n${manifestImport}import handler, { runWithEarlyHintsSender${waitUntilImport} } from '${serverEntryRelative}'\n${compressImport}\n// Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.\n// See design/25-production-deployments.md §\"TIMBER_RUNTIME\".\nprocess.env.TIMBER_RUNTIME = '${runtimeName}'\n\n// Nitro's index.mjs wraps this import with defineLazyEventHandler, which\n// already handles the event handler protocol. We export a plain async\n// function — no defineEventHandler wrapper needed.\n// Nitro bundles h3 into its internal _libs/ directory but doesn't make\n// it available as a bare specifier in the output's node_modules.\nexport default async function timberHandler(event) {\n  // h3 v2: event.req is the Web Request\n  const webRequest = event.req\n${handlerCall}\n  return ${compressCall}\n}\n`;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroConfig(\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): string {\n  const presetConfig = PRESET_CONFIGS[preset];\n\n  const config: Record<string, unknown> = {\n    preset: presetConfig.nitroPreset,\n    entry: './entry.ts',\n    output: { dir: presetConfig.outputDir },\n    // Static asset cache headers — hashed assets are immutable, others get 1h.\n    // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  };\n\n  const configJson = JSON.stringify(config, null, 2);\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\nimport { defineNitroConfig } from 'nitro/config'\n\nexport default defineNitroConfig(${configJson})\n`;\n}\n\n// ─── Preview ─────────────────────────────────────────────────────────────────\n\n/** Presets that produce a locally-runnable server entry. */\nconst LOCALLY_PREVIEWABLE = new Set<NitroPreset>(['node-server', 'bun']);\n\n/**\n * Generate a standalone preview server script that uses Node's built-in\n * HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports\n * h3 which isn't available outside a Nitro build. For local preview we\n * just need to serve static files and route requests to the RSC handler.\n *\n * @internal Exported for testing.\n */\nexport function generatePreviewScript(buildDir: string, preset: NitroPreset): string {\n  const rscEntryRelative = relative(join(buildDir, 'nitro'), join(buildDir, 'rsc', 'index.js'));\n  const rscEntry = rscEntryRelative.startsWith('.') ? rscEntryRelative : './' + rscEntryRelative;\n  const publicDir = './public';\n  const manifestInitPath = './_timber-manifest-init.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n\n  return `// Generated by @timber-js/app — standalone preview server.\n// Uses Node's built-in HTTP server to serve static assets and route\n// dynamic requests through the RSC handler. No Nitro/h3 dependency.\n\nimport { createServer } from 'node:http';\nimport { readFile, stat } from 'node:fs/promises';\nimport { join, extname } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { existsSync } from 'node:fs';\n\n// Set runtime before importing the handler.\nprocess.env.TIMBER_RUNTIME = '${runtimeName}';\n\n// Load the build manifest if it exists.\nconst __dirname = fileURLToPath(new URL('.', import.meta.url));\nconst manifestPath = join(__dirname, '${manifestInitPath}');\nif (existsSync(manifestPath)) {\n  await import('${manifestInitPath}');\n}\n\n// Import the RSC handler (default export is the fetch-like handler).\nconst { default: handler, runWithEarlyHintsSender } = await import('${rscEntry}');\n\n// Import compression helper for self-hosted response compression.\nconst { compressResponse } = await import('./_compress.mjs');\n\nconst MIME_TYPES = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.otf': 'font/otf',\n  '.webp': 'image/webp',\n  '.avif': 'image/avif',\n  '.webm': 'video/webm',\n  '.mp4': 'video/mp4',\n  '.txt': 'text/plain',\n  '.xml': 'application/xml',\n  '.wasm': 'application/wasm',\n};\n\nconst publicDir = join(__dirname, '${publicDir}');\nconst port = parseInt(process.env.PORT || '3000', 10);\nconst host = process.env.HOST || process.env.HOSTNAME || 'localhost';\n\nconst server = createServer(async (req, res) => {\n  const url = new URL(req.url || '/', \\`http://\\${host}:\\${port}\\`);\n\n  // Try serving static files from the public directory first.\n  const filePath = join(publicDir, url.pathname);\n  // Prevent path traversal.\n  if (filePath.startsWith(publicDir)) {\n    try {\n      const fileStat = await stat(filePath);\n      if (fileStat.isFile()) {\n        const ext = extname(filePath);\n        const contentType = MIME_TYPES[ext] || 'application/octet-stream';\n        const body = await readFile(filePath);\n        // Hashed assets get immutable cache, others get short cache.\n        const cacheControl = url.pathname.startsWith('/assets/')\n          ? 'public, max-age=31536000, immutable'\n          : 'public, max-age=3600, must-revalidate';\n        res.writeHead(200, {\n          'Content-Type': contentType,\n          'Content-Length': body.length,\n          'Cache-Control': cacheControl,\n        });\n        res.end(body);\n        return;\n      }\n    } catch {\n      // File not found — fall through to the RSC handler.\n    }\n  }\n\n  // Convert Node request to Web Request.\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value) {\n      if (Array.isArray(value)) {\n        for (const v of value) headers.append(key, v);\n      } else {\n        headers.set(key, value);\n      }\n    }\n  }\n\n  let body = undefined;\n  if (req.method !== 'GET' && req.method !== 'HEAD') {\n    body = await new Promise((resolve) => {\n      const chunks = [];\n      req.on('data', (chunk) => chunks.push(chunk));\n      req.on('end', () => resolve(Buffer.concat(chunks)));\n    });\n  }\n\n  const webRequest = new Request(url.href, {\n    method: req.method,\n    headers,\n    body,\n    duplex: body ? 'half' : undefined,\n  });\n\n  try {\n    // Support 103 Early Hints when available.\n    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')\n      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }\n      : undefined;\n\n    const rawResponse = earlyHintsSender && runWithEarlyHintsSender\n      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n      : await handler(webRequest);\n\n    // Compress the response for self-hosted deployments.\n    const webResponse = compressResponse(webRequest, rawResponse);\n\n    // Write the response back to the Node response.\n    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));\n\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n\n      // Cancel the reader when the client disconnects. This causes any\n      // pending reader.read() to reject, breaking the pump loop. Critical\n      // for SSE and other infinite streams — without this, disconnected\n      // clients leak readers.\n      let clientDisconnected = false;\n      const onClose = () => {\n        clientDisconnected = true;\n        reader.cancel('Client disconnected').catch(() => {});\n      };\n      res.on('close', onClose);\n\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          res.write(value);\n        }\n      } catch (err) {\n        // reader.cancel() from the close handler causes read() to reject.\n        // This is expected on client disconnect — not an error.\n        if (!clientDisconnected) {\n          throw err;\n        }\n      } finally {\n        res.off('close', onClose);\n        reader.releaseLock();\n        if (!res.writableEnded) {\n          res.end();\n        }\n      }\n    } else {\n      res.end();\n    }\n  } catch (err) {\n    console.error('[timber preview] Request error:', err);\n    if (!res.headersSent) {\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n    }\n    res.end('Internal Server Error');\n  }\n});\n\nserver.listen(port, host, () => {\n  console.log();\n  console.log('  ⚡ timber preview server running at:');\n  console.log();\n  console.log(\\`    ➜  http://\\${host}:\\${port}\\`);\n  console.log();\n});\n`;\n}\n\n/** Command descriptor for Nitro preview — testable without spawning. */\nexport interface NitroPreviewCommand {\n  command: string;\n  args: string[];\n  cwd: string;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroPreviewCommand(\n  buildDir: string,\n  preset: NitroPreset\n): NitroPreviewCommand | null {\n  if (!LOCALLY_PREVIEWABLE.has(preset)) return null;\n\n  const nitroDir = join(buildDir, 'nitro');\n  const entryPath = join(nitroDir, 'entry.ts');\n\n  const command = preset === 'bun' ? 'bun' : 'node';\n  return {\n    command,\n    args: [entryPath],\n    cwd: nitroDir,\n  };\n}\n\n/**\n * Run the Nitro production build using the programmatic API.\n * Uses dynamic import so nitro is only loaded at build time.\n * Externalizes the timber RSC/SSR output — those files are pre-built\n * by timber and have internal references that nitro's bundler can't follow.\n */\nasync function runNitroBuild(\n  nitroDir: string,\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): Promise<void> {\n  const presetConfig = PRESET_CONFIGS[preset];\n  const {\n    createNitro,\n    build: nitroBuild,\n    prepare,\n    copyPublicAssets,\n  } = await import('nitro/builder');\n\n  const nitro = await createNitro({\n    rootDir: nitroDir,\n    preset: presetConfig.nitroPreset,\n    // Use renderer.entry so Nitro wraps our handler with its server runtime\n    // (HTTP server, static file serving, graceful shutdown, etc.).\n    // Using `entry` directly would bypass the Nitro server runtime.\n    renderer: { handler: join(nitroDir, 'entry.ts') },\n    output: { dir: join(nitroDir, presetConfig.outputDir) },\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    // Don't bundle the timber RSC/SSR build output — it has its own\n    // internal file references that nitro's bundler can't follow.\n    // Mark them as external so rollup leaves the imports as-is.\n    rollupConfig: {\n      external: [/\\.\\.\\/rsc\\//],\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  });\n\n  await prepare(nitro);\n  await copyPublicAssets(nitro);\n  await nitroBuild(nitro);\n  await nitro.close();\n}\n\n/** Spawn a Nitro preview process and pipe stdio. */\nfunction spawnNitroPreview(command: string, args: string[], cwd: string): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const child = execFile(command, args, { cwd }, (err) => {\n      if (err) reject(err);\n      else resolve();\n    });\n    child.stdout?.pipe(process.stdout);\n    child.stderr?.pipe(process.stderr);\n  });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Get the preset configuration for a given preset name.\n * @internal Exported for testing.\n */\nexport function getPresetConfig(preset: NitroPreset): PresetConfig {\n  return PRESET_CONFIGS[preset];\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,SAAgB,yBAAiC;AAC/C,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACPT,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAErB,SAAS,sBAA8B;AACrC,QAAO;;;;mBAIU,gBAAgB;;;mBAGhB,aAAa;;;AAuChC,IAAM,iBAAoD;CACxD,UAAU;EACR,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACb,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,IAAI,EAAE,EAAE;EAC5D;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,WAAW;EACT,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,gBAAgB;EACd,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,cAAc;EACZ,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,mBAAmB;EACjB,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EAQnB,oBAAoB;EACpB,aAAa;EACd;CACD,OAAO;EACL,aAAa;EACb,WAAW;EACX,mBAAmB;EAGnB,oBAAoB;EACpB,aAAa;EACd;CACF;;;;;;;;;;;;;;;;;AAsDD,SAAgB,MAAM,UAA+B,EAAE,EAAyB;CAC9E,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,eAAe,eAAe;CACpC,MAAM,kBAAsC,EAAE;AAE9C,QAAO;EACL,MAAM,SAAS;EAEf,MAAM,YAAY,QAAsB,UAAkB;GACxD,MAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,SAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;GAKxC,MAAM,YAAY,KAAK,UAAU,SAAS;GAC1C,MAAM,YAAY,KAAK,QAAQ,SAAS;AACxC,SAAM,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;AAC3C,SAAM,GAAG,WAAW,WAAW;IAC7B,WAAW;IACX,QAAQ,OAAO,4BAA4B,QAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,KAAA;IACnF,CAAC,CAAC,YAAY,GAEb;AAIF,SAAM,UAAU,KAAK,WAAW,WAAW,EAAE,qBAAqB,CAAC;AAGnE,OAAI,OAAO,aACT,OAAM,UAAU,KAAK,QAAQ,2BAA2B,EAAE,OAAO,aAAa;AAMhF,SAAM,UAAU,KAAK,QAAQ,gBAAgB,EAAE,wBAAwB,CAAC;AAIxE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC;AACzE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC,CAAC,YAAY,GAAG;AAMzF,OAAI,OAAO,cAAc;IACvB,MAAM,WAAW,KAAK,QAAQ,OAAO,WAAW;IAChD,MAAM,aAAa,MAAM,SAAS,UAAU,QAAQ;AACpD,UAAM,UAAU,UAAU,GAAG,OAAO,aAAa,IAAI,aAAa;;GAIpE,MAAM,QAAQ,mBAAmB,UAAU,QAAQ,QAAQ,SAAS;AACpE,SAAM,UAAU,KAAK,QAAQ,WAAW,EAAE,MAAM;AAKhD,SAAM,cAAc,QAAQ,QAAQ,QAAQ,YAAY;;EAM1D,SAAS,oBAAoB,IAAI,OAAO,GACpC,OAAO,SAAuB,aAAqB;GAIjD,MAAM,gBAAgB,sBAAsB,UAAU,OAAO;GAC7D,MAAM,aAAa,KAAK,UAAU,SAAS,sBAAsB;AACjE,SAAM,UAAU,YAAY,cAAc;AAG1C,SAAM,kBADU,WAAW,QAAQ,QAAQ,QACV,CAAC,WAAW,EAAE,KAAK,UAAU,QAAQ,CAAC;MAEzE,KAAA;EAEJ,WAAW,aAAa,qBACnB,YAA8B;GAC7B,MAAM,UAAU,QAAQ,OAAO,QAAQ;AACrC,YAAQ,MAAM,wCAAwC,IAAI;KAC1D;AACF,mBAAgB,KAAK,QAAQ;MAE/B,KAAA;EACL;;;AAMH,SAAgB,mBACd,UACA,QACA,QACA,WAAW,MACX,kBAAkB,OACV;CAKR,MAAM,sBAAsB;CAC5B,MAAM,cAAc,eAAe,QAAQ;CAC3C,MAAM,aAAa,eAAe,QAAQ;CAC1C,MAAM,oBAAoB,eAAe,QAAQ;CASjD,IAAI;AACJ,KAAI,cAAc,kBAChB,eAAc;;;;;;;;;;;;;;;;UAgBL,WACT,eAAc;;;;;;;;UAQL,kBACT,eAAc;;;;;;;KAQd,eAAc;AAchB,QAAO;;;EARgB,kBAAkB,0CAA0C,GAWpE,2CARS,oBAAoB,uBAAuB,GAQO,WAAW,oBAAoB;EANlF,WAAW,yDAAyD,GAO5E;;;gCAGe,YAAY;;;;;;;;;;EAU1C,YAAY;WAnBS,WAAW,8CAA8C,cAoBxD;;;;;AAMxB,SAAgB,oBACd,QACA,YACQ;CACR,MAAM,eAAe,eAAe;CAEpC,MAAM,SAAkC;EACtC,QAAQ,aAAa;EACrB,OAAO;EACP,QAAQ,EAAE,KAAK,aAAa,WAAW;EAGvC,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EACD,GAAG,aAAa;EAChB,GAAG;EACJ;AAID,QAAO;;;;;mCAFY,KAAK,UAAU,QAAQ,MAAM,EAAE,CAON;;;;AAO9C,IAAM,sBAAsB,IAAI,IAAiB,CAAC,eAAe,MAAM,CAAC;;;;;;;;;AAUxE,SAAgB,sBAAsB,UAAkB,QAA6B;CACnF,MAAM,mBAAmB,SAAS,KAAK,UAAU,QAAQ,EAAE,KAAK,UAAU,OAAO,WAAW,CAAC;CAC7F,MAAM,WAAW,iBAAiB,WAAW,IAAI,GAAG,mBAAmB,OAAO;CAC9E,MAAM,YAAY;CAClB,MAAM,mBAAmB;AAGzB,QAAO;;;;;;;;;;;gCAFa,eAAe,QAAQ,YAaD;;;;wCAIJ,iBAAiB;;kBAEvC,iBAAiB;;;;sEAImC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B1C,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6I/C,SAAgB,4BACd,UACA,QAC4B;AAC5B,KAAI,CAAC,oBAAoB,IAAI,OAAO,CAAE,QAAO;CAE7C,MAAM,WAAW,KAAK,UAAU,QAAQ;CACxC,MAAM,YAAY,KAAK,UAAU,WAAW;AAG5C,QAAO;EACL,SAFc,WAAW,QAAQ,QAAQ;EAGzC,MAAM,CAAC,UAAU;EACjB,KAAK;EACN;;;;;;;;AASH,eAAe,cACb,UACA,QACA,YACe;CACf,MAAM,eAAe,eAAe;CACpC,MAAM,EACJ,aACA,OAAO,YACP,SACA,qBACE,MAAM,OAAO;CAEjB,MAAM,QAAQ,MAAM,YAAY;EAC9B,SAAS;EACT,QAAQ,aAAa;EAIrB,UAAU,EAAE,SAAS,KAAK,UAAU,WAAW,EAAE;EACjD,QAAQ,EAAE,KAAK,KAAK,UAAU,aAAa,UAAU,EAAE;EACvD,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EAID,cAAc,EACZ,UAAU,CAAC,cAAc,EAC1B;EACD,GAAG,aAAa;EAChB,GAAG;EACJ,CAAC;AAEF,OAAM,QAAQ,MAAM;AACpB,OAAM,iBAAiB,MAAM;AAC7B,OAAM,WAAW,MAAM;AACvB,OAAM,MAAM,OAAO;;;AAIrB,SAAS,kBAAkB,SAAiB,MAAgB,KAA4B;AACtF,QAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,KAAK,GAAG,QAAQ;AACtD,OAAI,IAAK,QAAO,IAAI;OACf,UAAS;IACd;AACF,QAAM,QAAQ,KAAK,QAAQ,OAAO;AAClC,QAAM,QAAQ,KAAK,QAAQ,OAAO;GAClC;;;;;;AASJ,SAAgB,gBAAgB,QAAmC;AACjE,QAAO,eAAe"}
+{"version":3,"file":"nitro.js","names":[],"sources":["../../src/adapters/compress-module.ts","../../src/adapters/nitro.ts"],"sourcesContent":["// Generated compression module template for self-hosted deployments.\n//\n// This file generates a standalone ESM module (_compress.mjs) that is\n// written to the build output during adapter buildOutput(). It's imported\n// by the Nitro entry and preview server at runtime.\n//\n// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal and\n// node:zlib buffers output internally, breaking streaming.\n// Cloudflare Workers don't need this — the edge auto-compresses.\n//\n// See design/25-production-deployments.md.\n\n/**\n * Generate a standalone ESM module that exports compressResponse().\n *\n * Written to `_compress.mjs` during buildOutput. Imported by the Nitro entry\n * and preview server.\n *\n * @internal Exported for testing.\n */\nexport function generateCompressModule(): string {\n  return `// Generated by @timber-js/app — response compression for self-hosted deployments.\n// Do not edit — this file is regenerated on each build.\n// Uses node:zlib createGzip() (C++ native) on Node.js, falls back to\n// CompressionStream (Web API) on other runtimes. Brotli is left to CDNs/reverse\n// proxies — at streaming quality levels its ratio advantage is marginal.\nimport { Readable } from 'node:stream';\nimport { createGzip, constants } from 'node:zlib';\n\nconst COMPRESSIBLE_TYPES = new Set([\n  'text/html', 'text/css', 'text/plain', 'text/xml', 'text/javascript',\n  'text/x-component', 'application/json', 'application/javascript',\n  'application/xml', 'application/xhtml+xml', 'application/rss+xml',\n  'application/atom+xml', 'image/svg+xml',\n]);\n\nconst NO_COMPRESS_STATUSES = new Set([204, 304]);\n\nfunction negotiateEncoding(acceptEncoding) {\n  if (!acceptEncoding) return null;\n  // Parse tokens with quality values. Per RFC 9110 §12.5.3, q=0 means\n  // \"not acceptable\" — the client explicitly rejects that encoding.\n  // Brotli (br) is intentionally not handled at the application level.\n  const parts = acceptEncoding.split(',');\n  for (const part of parts) {\n    const [token, ...params] = part.split(';');\n    const name = token.trim().toLowerCase();\n    if (name !== 'gzip') continue;\n    let qValue = 1;\n    for (const param of params) {\n      const trimmed = param.trim().toLowerCase();\n      if (trimmed.startsWith('q=')) {\n        qValue = parseFloat(trimmed.slice(2));\n        if (Number.isNaN(qValue)) qValue = 1;\n        break;\n      }\n    }\n    if (qValue > 0) return 'gzip';\n  }\n  return null;\n}\n\nfunction shouldCompress(response) {\n  if (!response.body) return false;\n  if (NO_COMPRESS_STATUSES.has(response.status)) return false;\n  if (response.headers.has('Content-Encoding')) return false;\n  const contentType = response.headers.get('Content-Type');\n  if (!contentType) return false;\n  const mimeType = contentType.split(';')[0].trim().toLowerCase();\n  if (mimeType === 'text/event-stream') return false;\n  return COMPRESSIBLE_TYPES.has(mimeType);\n}\n\nfunction compressWithGzip(body) {\n  // Use node:zlib (C++ native) for gzip compression. The Web Streams\n  // CompressionStream works but every chunk crosses the JS/Promise boundary.\n  // node:zlib.createGzip() compresses entirely in C++ with zero per-chunk\n  // Promise overhead.\n  //\n  // Convert: Web ReadableStream → Node Readable → pipe through gzip →\n  //          Node Readable → Readable.toWeb() → Web ReadableStream\n  try {\n    const nodeReadable = Readable.fromWeb(body);\n    // Z_SYNC_FLUSH ensures each chunk is flushed immediately so the browser\n    // receives the HTML shell before Suspense boundaries resolve. Without it,\n    // gzip buffers internally and breaks streaming.\n    const gzip = createGzip({ flush: constants.Z_SYNC_FLUSH });\n    const compressed = nodeReadable.pipe(gzip);\n    return Readable.toWeb(compressed);\n  } catch {\n    // Fallback: CompressionStream (CF Workers, or if node:stream unavailable)\n    return body.pipeThrough(new CompressionStream('gzip'));\n  }\n}\n\nexport function compressResponse(request, response) {\n  if (!shouldCompress(response)) return response;\n  const acceptEncoding = request.headers.get('Accept-Encoding') || '';\n  const encoding = negotiateEncoding(acceptEncoding);\n  if (!encoding) return response;\n  const compressedBody = compressWithGzip(response.body);\n  const headers = new Headers(response.headers);\n  headers.set('Content-Encoding', encoding);\n  headers.delete('Content-Length');\n  const existingVary = headers.get('Vary');\n  if (existingVary) {\n    if (!existingVary.toLowerCase().includes('accept-encoding')) {\n      headers.set('Vary', existingVary + ', Accept-Encoding');\n    }\n  } else {\n    headers.set('Vary', 'Accept-Encoding');\n  }\n  return new Response(compressedBody, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n`;\n}\n","// Nitro adapter — multi-platform deployment\n//\n// Covers everything except Cloudflare Workers: Node.js, Bun, Vercel,\n// Netlify, AWS Lambda, Deno Deploy, Azure Functions. Nitro handles\n// compression, graceful shutdown, static file serving, and platform quirks.\n// See design/11-platform.md and design/25-production-deployments.md.\n\nimport { writeFile, readFile, mkdir, cp } from 'node:fs/promises';\nimport { execFile } from 'node:child_process';\nimport { join, relative } from 'node:path';\nimport type { TimberPlatformAdapter, TimberConfig } from './types';\nimport { generateCompressModule } from './compress-module.js';\n// Inlined from server/asset-headers.ts — adapters are loaded by Node at\n// Vite startup time, before Vite's module resolver is available, so cross-\n// directory .ts imports don't resolve.\nconst IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';\nconst STATIC_CACHE = 'public, max-age=3600, must-revalidate';\n\nfunction generateHeadersFile(): string {\n  return `# Auto-generated by @timber-js/app — static asset cache headers.\n# See design/25-production-deployments.md §\"CDN / Edge Cache\"\n\n/assets/*\n  Cache-Control: ${IMMUTABLE_CACHE}\n\n/*\n  Cache-Control: ${STATIC_CACHE}\n`;\n}\n\n// ─── Presets ─────────────────────────────────────────────────────────────────\n\n/**\n * Supported Nitro deployment presets.\n *\n * Each preset maps to a Nitro deployment target. The adapter generates\n * the appropriate configuration and entry point for the selected platform.\n */\nexport type NitroPreset =\n  | 'vercel'\n  | 'vercel-edge'\n  | 'netlify'\n  | 'netlify-edge'\n  | 'aws-lambda'\n  | 'deno-deploy'\n  | 'azure-functions'\n  | 'node-server'\n  | 'bun';\n\n/** Preset-specific Nitro configuration. */\ninterface PresetConfig {\n  /** Nitro preset name passed to the Nitro build. */\n  nitroPreset: string;\n  /** Output directory name within the build dir. */\n  outputDir: string;\n  /** Whether the runtime supports waitUntil. */\n  supportsWaitUntil: boolean;\n  /** Whether the runtime supports application-level 103 Early Hints. */\n  supportsEarlyHints: boolean;\n  /** Value for TIMBER_RUNTIME env var. See design/25-production-deployments.md. */\n  runtimeName: string;\n  /** Additional nitro.config fields for this preset. */\n  extraConfig?: Record<string, unknown>;\n}\n\nconst PRESET_CONFIGS: Record<NitroPreset, PresetConfig> = {\n  'vercel': {\n    nitroPreset: 'vercel',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel',\n    extraConfig: { vercel: { functions: { maxDuration: 30 } } },\n  },\n  'vercel-edge': {\n    nitroPreset: 'vercel-edge',\n    outputDir: '.vercel/output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'vercel-edge',\n  },\n  'netlify': {\n    nitroPreset: 'netlify',\n    outputDir: '.netlify/functions-internal',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify',\n  },\n  'netlify-edge': {\n    nitroPreset: 'netlify-edge',\n    outputDir: '.netlify/edge-functions',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'netlify-edge',\n  },\n  'aws-lambda': {\n    nitroPreset: 'aws-lambda',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'aws-lambda',\n  },\n  'deno-deploy': {\n    nitroPreset: 'deno-deploy',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    supportsEarlyHints: false,\n    runtimeName: 'deno-deploy',\n  },\n  'azure-functions': {\n    nitroPreset: 'azure-functions',\n    outputDir: '.output',\n    supportsWaitUntil: false,\n    supportsEarlyHints: false,\n    runtimeName: 'azure-functions',\n  },\n  'node-server': {\n    nitroPreset: 'node-server',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled by default: most node-server deployments sit behind a\n    // reverse proxy (nginx, caddy, traefik) that doesn't support 103\n    // Early Hints over HTTP/1.1. Sending 103 causes nginx to intermittently\n    // treat the response as an error and retry after proxy_connect_timeout\n    // (~5s stalls on ~23% of requests). Link headers on the 200 response\n    // are the safe fallback — Cloudflare and other CDNs convert them to\n    // 103 automatically at the edge (over HTTP/2+ to the browser).\n    supportsEarlyHints: false,\n    runtimeName: 'node-server',\n  },\n  'bun': {\n    nitroPreset: 'bun',\n    outputDir: '.output',\n    supportsWaitUntil: true,\n    // Disabled for same reason as node-server — reverse proxies choke on 103.\n    // Link headers on the 200 response are converted to 103 by CDNs.\n    supportsEarlyHints: false,\n    runtimeName: 'bun',\n  },\n};\n\n// ─── Options ─────────────────────────────────────────────────────────────────\n\n/** Options for the Nitro adapter. */\nexport interface NitroAdapterOptions {\n  /**\n   * Deployment preset. Determines the target platform.\n   * @default 'node-server'\n   */\n  preset?: NitroPreset;\n\n  /**\n   * Enable application-level gzip compression for HTML and RSC responses.\n   *\n   * When `true` (default), the origin compresses responses using the Web\n   * `CompressionStream` API. This is useful for self-hosted deployments\n   * where no reverse proxy or CDN handles compression.\n   *\n   * Set to `false` when deploying behind a reverse proxy (nginx, caddy)\n   * or CDN (Cloudflare, Fastly, Vercel) that compresses at the edge.\n   * Disabling origin compression saves CPU on the Node.js event loop —\n   * compressing 1MB+ streaming HTML responses takes 10-15ms of main\n   * thread time per request, directly reducing throughput under load.\n   *\n   * @default true\n   */\n  compress?: boolean;\n\n  /**\n   * Additional Nitro configuration to merge into the generated config.\n   * Overrides default values for the selected preset.\n   */\n  nitroConfig?: Record<string, unknown>;\n}\n\n// ─── Adapter ─────────────────────────────────────────────────────────────────\n\n/**\n * Create a Nitro-based adapter for multi-platform deployment.\n *\n * Nitro abstracts deployment targets — the same timber.js app can deploy\n * to Vercel, Netlify, AWS, Deno Deploy, or Azure by changing the preset.\n *\n * @example\n * ```ts\n * import { nitro } from '@timber-js/app/adapters/nitro'\n *\n * export default {\n *   output: 'server',\n *   adapter: nitro({ preset: 'vercel' }),\n * }\n * ```\n */\nexport function nitro(options: NitroAdapterOptions = {}): TimberPlatformAdapter {\n  const preset = options.preset ?? 'node-server';\n  const compress = options.compress ?? true;\n  const presetConfig = PRESET_CONFIGS[preset];\n  const pendingPromises: Promise<unknown>[] = [];\n\n  return {\n    name: `nitro-${preset}`,\n\n    async buildOutput(config: TimberConfig, buildDir: string) {\n      const outDir = join(buildDir, 'nitro');\n      await mkdir(outDir, { recursive: true });\n\n      // Copy client assets to public directory.\n      // When client JavaScript is disabled, skip .js files — only CSS,\n      // fonts, images, and other static assets are needed.\n      const clientDir = join(buildDir, 'client');\n      const publicDir = join(outDir, 'public');\n      await mkdir(publicDir, { recursive: true });\n      await cp(clientDir, publicDir, {\n        recursive: true,\n        filter: config.clientJavascriptDisabled ? (src: string) => !src.endsWith('.js') : undefined,\n      }).catch(() => {\n        // Client dir may not exist when client JavaScript is disabled\n      });\n\n      // Write _headers file for platforms that support it (Netlify, etc.).\n      // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n      await writeFile(join(publicDir, '_headers'), generateHeadersFile());\n\n      // Write the build manifest init module (if manifest data was produced).\n      if (config.manifestInit) {\n        await writeFile(join(outDir, '_timber-manifest-init.js'), config.manifestInit);\n      }\n\n      // Write the compression helper module for runtime use.\n      // See design/25-production-deployments.md — self-hosted deployments\n      // need application-level compression (Cloudflare handles it at the edge).\n      await writeFile(join(outDir, '_compress.mjs'), generateCompressModule());\n\n      // Copy rsc/ssr build output into the nitro dir so imports stay local\n      // during the Nitro bundling step (avoids broken relative paths in output).\n      await cp(join(buildDir, 'rsc'), join(outDir, 'rsc'), { recursive: true });\n      await cp(join(buildDir, 'ssr'), join(outDir, 'ssr'), { recursive: true }).catch(() => {});\n\n      // Prepend the manifest assignment directly into the RSC entry so\n      // globalThis.__TIMBER_BUILD_MANIFEST__ is set before any module reads it.\n      // This must be top-level code, not an import, because rollup tree-shakes\n      // side-effect-only globalThis assignments from imported modules.\n      if (config.manifestInit) {\n        const rscEntry = join(outDir, 'rsc', 'index.js');\n        const rscContent = await readFile(rscEntry, 'utf-8');\n        await writeFile(rscEntry, `${config.manifestInit}\\n${rscContent}`);\n      }\n\n      // Generate the Nitro entry point (imports from ./rsc/ within nitro dir)\n      const entry = generateNitroEntry(buildDir, outDir, preset, compress);\n      await writeFile(join(outDir, 'entry.ts'), entry);\n\n      // Run the Nitro build to produce a production-ready server bundle.\n      // The output goes to dist/nitro/.output/server/index.mjs (for node-server preset).\n      // Config is passed programmatically — no nitro.config.ts file needed.\n      await runNitroBuild(outDir, preset, options.nitroConfig);\n    },\n\n    // Only presets that produce a locally-runnable server get preview().\n    // Serverless presets (vercel, netlify, aws-lambda, etc.) have no\n    // local runtime — Vite's built-in preview is the fallback.\n    preview: LOCALLY_PREVIEWABLE.has(preset)\n      ? async (_config: TimberConfig, buildDir: string) => {\n          // Generate a standalone preview server that uses Node's built-in\n          // HTTP server. The Nitro entry.ts can't be run directly because\n          // it imports h3 (a Nitro dependency not available at runtime).\n          const previewScript = generatePreviewScript(buildDir, preset);\n          const scriptPath = join(buildDir, 'nitro', '_preview-server.mjs');\n          await writeFile(scriptPath, previewScript);\n\n          const command = preset === 'bun' ? 'bun' : 'node';\n          await spawnNitroPreview(command, [scriptPath], join(buildDir, 'nitro'));\n        }\n      : undefined,\n\n    waitUntil: presetConfig.supportsWaitUntil\n      ? (promise: Promise<unknown>) => {\n          const tracked = promise.catch((err) => {\n            console.error('[timber] waitUntil promise rejected:', err);\n          });\n          pendingPromises.push(tracked);\n        }\n      : undefined,\n  };\n}\n\n// ─── Entry Generation ────────────────────────────────────────────────────────\n\n/** @internal Exported for testing. */\nexport function generateNitroEntry(\n  buildDir: string,\n  outDir: string,\n  preset: NitroPreset,\n  compress = true,\n  hasManifestInit = false\n): string {\n  // The RSC entry is the main request handler — it exports the fetch handler as default.\n  // rsc/ is copied into the nitro dir so the import is local.\n  // The manifest init is prepended to rsc/index.js before the nitro build,\n  // so globalThis.__TIMBER_BUILD_MANIFEST__ is set before any code reads it.\n  const serverEntryRelative = './rsc/index.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n  const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;\n  const supportsWaitUntil = PRESET_CONFIGS[preset].supportsWaitUntil;\n\n  // On node-server and bun, wrap the handler with ALS so the pipeline\n  // can send 103 Early Hints via res.writeEarlyHints(). Other presets\n  // either don't support 103 or handle it at the CDN level.\n  //\n  // For presets that support waitUntil, bridge h3's event.waitUntil()\n  // to timber's waitUntil() primitive via the ALS bridge.\n  // See design/11-platform.md §\"waitUntil()\".\n  let handlerCall: string;\n  if (earlyHints && supportsWaitUntil) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const callHandler = () => handler(webRequest)\n  let wrappedHandler = earlyHintsSender\n    ? () => runWithEarlyHintsSender(earlyHintsSender, callHandler)\n    : callHandler\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, wrappedHandler)\n    : await wrappedHandler()`;\n  } else if (earlyHints) {\n    handlerCall = `  const nodeRes = event.node?.res\n  const earlyHintsSender = (typeof nodeRes?.writeEarlyHints === 'function')\n    ? (links) => { try { nodeRes.writeEarlyHints({ link: links }) } catch {} }\n    : undefined\n\n  const webResponse = earlyHintsSender\n    ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else if (supportsWaitUntil) {\n    handlerCall = `  const waitUntilFn = (typeof event.waitUntil === 'function')\n    ? (p) => event.waitUntil(p)\n    : undefined\n\n  const webResponse = waitUntilFn\n    ? await runWithWaitUntil(waitUntilFn, () => handler(webRequest))\n    : await handler(webRequest)`;\n  } else {\n    handlerCall = `  const webResponse = await handler(webRequest)`;\n  }\n\n  // Build manifest init must be imported before the handler so that\n  // globalThis.__TIMBER_BUILD_MANIFEST__ is set when the virtual module evaluates.\n  // ESM guarantees imports are evaluated in order.\n  const manifestImport = hasManifestInit ? \"import './_timber-manifest-init.js'\\n\" : '';\n\n  // Import runWithWaitUntil only when the preset supports it.\n  const waitUntilImport = supportsWaitUntil ? ', runWithWaitUntil' : '';\n\n  const compressImport = compress ? \"import { compressResponse } from './_compress.mjs'\\n\" : '';\n  const compressCall = compress ? 'compressResponse(webRequest, webResponse)' : 'webResponse';\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\n${manifestImport}import handler, { runWithEarlyHintsSender${waitUntilImport} } from '${serverEntryRelative}'\n${compressImport}\n// Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.\n// See design/25-production-deployments.md §\"TIMBER_RUNTIME\".\nprocess.env.TIMBER_RUNTIME = '${runtimeName}'\n\n// Nitro's index.mjs wraps this import with defineLazyEventHandler, which\n// already handles the event handler protocol. We export a plain async\n// function — no defineEventHandler wrapper needed.\n// Nitro bundles h3 into its internal _libs/ directory but doesn't make\n// it available as a bare specifier in the output's node_modules.\nexport default async function timberHandler(event) {\n  // h3 v2: event.req is the Web Request\n  const webRequest = event.req\n${handlerCall}\n  return ${compressCall}\n}\n`;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroConfig(\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): string {\n  const presetConfig = PRESET_CONFIGS[preset];\n\n  const config: Record<string, unknown> = {\n    preset: presetConfig.nitroPreset,\n    entry: './entry.ts',\n    output: { dir: presetConfig.outputDir },\n    // Static asset cache headers — hashed assets are immutable, others get 1h.\n    // See design/25-production-deployments.md §\"CDN / Edge Cache\"\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  };\n\n  const configJson = JSON.stringify(config, null, 2);\n\n  return `// Generated by @timber-js/app/adapters/nitro\n// Do not edit — this file is regenerated on each build.\n\nimport { defineNitroConfig } from 'nitro/config'\n\nexport default defineNitroConfig(${configJson})\n`;\n}\n\n// ─── Preview ─────────────────────────────────────────────────────────────────\n\n/** Presets that produce a locally-runnable server entry. */\nconst LOCALLY_PREVIEWABLE = new Set<NitroPreset>(['node-server', 'bun']);\n\n/**\n * Generate a standalone preview server script that uses Node's built-in\n * HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports\n * h3 which isn't available outside a Nitro build. For local preview we\n * just need to serve static files and route requests to the RSC handler.\n *\n * @internal Exported for testing.\n */\nexport function generatePreviewScript(buildDir: string, preset: NitroPreset): string {\n  const rscEntryRelative = relative(join(buildDir, 'nitro'), join(buildDir, 'rsc', 'index.js'));\n  const rscEntry = rscEntryRelative.startsWith('.') ? rscEntryRelative : './' + rscEntryRelative;\n  const publicDir = './public';\n  const manifestInitPath = './_timber-manifest-init.js';\n  const runtimeName = PRESET_CONFIGS[preset].runtimeName;\n\n  return `// Generated by @timber-js/app — standalone preview server.\n// Uses Node's built-in HTTP server to serve static assets and route\n// dynamic requests through the RSC handler. No Nitro/h3 dependency.\n\nimport { createServer } from 'node:http';\nimport { readFile, stat } from 'node:fs/promises';\nimport { join, extname } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { existsSync } from 'node:fs';\n\n// Set runtime before importing the handler.\nprocess.env.TIMBER_RUNTIME = '${runtimeName}';\n\n// Load the build manifest if it exists.\nconst __dirname = fileURLToPath(new URL('.', import.meta.url));\nconst manifestPath = join(__dirname, '${manifestInitPath}');\nif (existsSync(manifestPath)) {\n  await import('${manifestInitPath}');\n}\n\n// Import the RSC handler (default export is the fetch-like handler).\nconst { default: handler, runWithEarlyHintsSender } = await import('${rscEntry}');\n\n// Import compression helper for self-hosted response compression.\nconst { compressResponse } = await import('./_compress.mjs');\n\nconst MIME_TYPES = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.otf': 'font/otf',\n  '.webp': 'image/webp',\n  '.avif': 'image/avif',\n  '.webm': 'video/webm',\n  '.mp4': 'video/mp4',\n  '.txt': 'text/plain',\n  '.xml': 'application/xml',\n  '.wasm': 'application/wasm',\n};\n\nconst publicDir = join(__dirname, '${publicDir}');\nconst port = parseInt(process.env.PORT || '3000', 10);\nconst host = process.env.HOST || process.env.HOSTNAME || 'localhost';\n\nconst server = createServer(async (req, res) => {\n  const url = new URL(req.url || '/', \\`http://\\${host}:\\${port}\\`);\n\n  // Try serving static files from the public directory first.\n  const filePath = join(publicDir, url.pathname);\n  // Prevent path traversal.\n  if (filePath.startsWith(publicDir)) {\n    try {\n      const fileStat = await stat(filePath);\n      if (fileStat.isFile()) {\n        const ext = extname(filePath);\n        const contentType = MIME_TYPES[ext] || 'application/octet-stream';\n        const body = await readFile(filePath);\n        // Hashed assets get immutable cache, others get short cache.\n        const cacheControl = url.pathname.startsWith('/assets/')\n          ? 'public, max-age=31536000, immutable'\n          : 'public, max-age=3600, must-revalidate';\n        res.writeHead(200, {\n          'Content-Type': contentType,\n          'Content-Length': body.length,\n          'Cache-Control': cacheControl,\n        });\n        res.end(body);\n        return;\n      }\n    } catch {\n      // File not found — fall through to the RSC handler.\n    }\n  }\n\n  // Convert Node request to Web Request.\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value) {\n      if (Array.isArray(value)) {\n        for (const v of value) headers.append(key, v);\n      } else {\n        headers.set(key, value);\n      }\n    }\n  }\n\n  let body = undefined;\n  if (req.method !== 'GET' && req.method !== 'HEAD') {\n    body = await new Promise((resolve) => {\n      const chunks = [];\n      req.on('data', (chunk) => chunks.push(chunk));\n      req.on('end', () => resolve(Buffer.concat(chunks)));\n    });\n  }\n\n  const webRequest = new Request(url.href, {\n    method: req.method,\n    headers,\n    body,\n    duplex: body ? 'half' : undefined,\n  });\n\n  try {\n    // Support 103 Early Hints when available.\n    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')\n      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }\n      : undefined;\n\n    const rawResponse = earlyHintsSender && runWithEarlyHintsSender\n      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))\n      : await handler(webRequest);\n\n    // Compress the response for self-hosted deployments.\n    const webResponse = compressResponse(webRequest, rawResponse);\n\n    // Write the response back to the Node response.\n    //\n    // Set-Cookie needs special handling: Headers.entries() joins multiple\n    // Set-Cookie values with \", \" into a single entry, but each cookie must\n    // be its own header per RFC 6265 §4.1. Object.fromEntries() would then\n    // collapse them into one malformed Set-Cookie header that browsers reject\n    // (or only honor partially). Use getSetCookie() to preserve individual\n    // values, and pass them as an array — Node's writeHead accepts\n    // Record<string, string | string[]> and emits one header per array entry.\n    //\n    // Without this, EVERY cookie set by the framework on Node—/Nitro deployments\n    // is silently dropped: defineCookie().setCookie() in actions, middleware\n    // cookie writes, the framework's own session cookies, all of it. See\n    // LOCAL-741.\n    const responseHeaders: Record<string, string | string[]> = {};\n    webResponse.headers.forEach((value, key) => {\n      if (key.toLowerCase() !== 'set-cookie') {\n        responseHeaders[key] = value;\n      }\n    });\n    const setCookies = webResponse.headers.getSetCookie();\n    if (setCookies.length > 0) {\n      responseHeaders['set-cookie'] = setCookies;\n    }\n    res.writeHead(webResponse.status, responseHeaders);\n\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n\n      // Cancel the reader when the client disconnects. This causes any\n      // pending reader.read() to reject, breaking the pump loop. Critical\n      // for SSE and other infinite streams — without this, disconnected\n      // clients leak readers.\n      let clientDisconnected = false;\n      const onClose = () => {\n        clientDisconnected = true;\n        reader.cancel('Client disconnected').catch(() => {});\n      };\n      res.on('close', onClose);\n\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          res.write(value);\n        }\n      } catch (err) {\n        // reader.cancel() from the close handler causes read() to reject.\n        // This is expected on client disconnect — not an error.\n        if (!clientDisconnected) {\n          throw err;\n        }\n      } finally {\n        res.off('close', onClose);\n        reader.releaseLock();\n        if (!res.writableEnded) {\n          res.end();\n        }\n      }\n    } else {\n      res.end();\n    }\n  } catch (err) {\n    console.error('[timber preview] Request error:', err);\n    if (!res.headersSent) {\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n    }\n    res.end('Internal Server Error');\n  }\n});\n\nserver.listen(port, host, () => {\n  console.log();\n  console.log('  ⚡ timber preview server running at:');\n  console.log();\n  console.log(\\`    ➜  http://\\${host}:\\${port}\\`);\n  console.log();\n});\n`;\n}\n\n/** Command descriptor for Nitro preview — testable without spawning. */\nexport interface NitroPreviewCommand {\n  command: string;\n  args: string[];\n  cwd: string;\n}\n\n/** @internal Exported for testing. */\nexport function generateNitroPreviewCommand(\n  buildDir: string,\n  preset: NitroPreset\n): NitroPreviewCommand | null {\n  if (!LOCALLY_PREVIEWABLE.has(preset)) return null;\n\n  const nitroDir = join(buildDir, 'nitro');\n  const entryPath = join(nitroDir, 'entry.ts');\n\n  const command = preset === 'bun' ? 'bun' : 'node';\n  return {\n    command,\n    args: [entryPath],\n    cwd: nitroDir,\n  };\n}\n\n/**\n * Run the Nitro production build using the programmatic API.\n * Uses dynamic import so nitro is only loaded at build time.\n * Externalizes the timber RSC/SSR output — those files are pre-built\n * by timber and have internal references that nitro's bundler can't follow.\n */\nasync function runNitroBuild(\n  nitroDir: string,\n  preset: NitroPreset,\n  userConfig?: Record<string, unknown>\n): Promise<void> {\n  const presetConfig = PRESET_CONFIGS[preset];\n  const {\n    createNitro,\n    build: nitroBuild,\n    prepare,\n    copyPublicAssets,\n  } = await import('nitro/builder');\n\n  const nitro = await createNitro({\n    rootDir: nitroDir,\n    preset: presetConfig.nitroPreset,\n    // Use renderer.entry so Nitro wraps our handler with its server runtime\n    // (HTTP server, static file serving, graceful shutdown, etc.).\n    // Using `entry` directly would bypass the Nitro server runtime.\n    renderer: { handler: join(nitroDir, 'entry.ts') },\n    output: { dir: join(nitroDir, presetConfig.outputDir) },\n    routeRules: {\n      '/assets/**': { headers: { 'Cache-Control': IMMUTABLE_CACHE } },\n    },\n    // Don't bundle the timber RSC/SSR build output — it has its own\n    // internal file references that nitro's bundler can't follow.\n    // Mark them as external so rollup leaves the imports as-is.\n    rollupConfig: {\n      external: [/\\.\\.\\/rsc\\//],\n    },\n    ...presetConfig.extraConfig,\n    ...userConfig,\n  });\n\n  await prepare(nitro);\n  await copyPublicAssets(nitro);\n  await nitroBuild(nitro);\n  await nitro.close();\n}\n\n/** Spawn a Nitro preview process and pipe stdio. */\nfunction spawnNitroPreview(command: string, args: string[], cwd: string): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    const child = execFile(command, args, { cwd }, (err) => {\n      if (err) reject(err);\n      else resolve();\n    });\n    child.stdout?.pipe(process.stdout);\n    child.stderr?.pipe(process.stderr);\n  });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────────────\n\n/**\n * Get the preset configuration for a given preset name.\n * @internal Exported for testing.\n */\nexport function getPresetConfig(preset: NitroPreset): PresetConfig {\n  return PRESET_CONFIGS[preset];\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,SAAgB,yBAAiC;AAC/C,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACPT,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAErB,SAAS,sBAA8B;AACrC,QAAO;;;;mBAIU,gBAAgB;;;mBAGhB,aAAa;;;AAuChC,IAAM,iBAAoD;CACxD,UAAU;EACR,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACb,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,IAAI,EAAE,EAAE;EAC5D;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,WAAW;EACT,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,gBAAgB;EACd,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,cAAc;EACZ,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,mBAAmB;EACjB,aAAa;EACb,WAAW;EACX,mBAAmB;EACnB,oBAAoB;EACpB,aAAa;EACd;CACD,eAAe;EACb,aAAa;EACb,WAAW;EACX,mBAAmB;EAQnB,oBAAoB;EACpB,aAAa;EACd;CACD,OAAO;EACL,aAAa;EACb,WAAW;EACX,mBAAmB;EAGnB,oBAAoB;EACpB,aAAa;EACd;CACF;;;;;;;;;;;;;;;;;AAsDD,SAAgB,MAAM,UAA+B,EAAE,EAAyB;CAC9E,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,eAAe,eAAe;CACpC,MAAM,kBAAsC,EAAE;AAE9C,QAAO;EACL,MAAM,SAAS;EAEf,MAAM,YAAY,QAAsB,UAAkB;GACxD,MAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,SAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;GAKxC,MAAM,YAAY,KAAK,UAAU,SAAS;GAC1C,MAAM,YAAY,KAAK,QAAQ,SAAS;AACxC,SAAM,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;AAC3C,SAAM,GAAG,WAAW,WAAW;IAC7B,WAAW;IACX,QAAQ,OAAO,4BAA4B,QAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,KAAA;IACnF,CAAC,CAAC,YAAY,GAEb;AAIF,SAAM,UAAU,KAAK,WAAW,WAAW,EAAE,qBAAqB,CAAC;AAGnE,OAAI,OAAO,aACT,OAAM,UAAU,KAAK,QAAQ,2BAA2B,EAAE,OAAO,aAAa;AAMhF,SAAM,UAAU,KAAK,QAAQ,gBAAgB,EAAE,wBAAwB,CAAC;AAIxE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC;AACzE,SAAM,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC,CAAC,YAAY,GAAG;AAMzF,OAAI,OAAO,cAAc;IACvB,MAAM,WAAW,KAAK,QAAQ,OAAO,WAAW;IAChD,MAAM,aAAa,MAAM,SAAS,UAAU,QAAQ;AACpD,UAAM,UAAU,UAAU,GAAG,OAAO,aAAa,IAAI,aAAa;;GAIpE,MAAM,QAAQ,mBAAmB,UAAU,QAAQ,QAAQ,SAAS;AACpE,SAAM,UAAU,KAAK,QAAQ,WAAW,EAAE,MAAM;AAKhD,SAAM,cAAc,QAAQ,QAAQ,QAAQ,YAAY;;EAM1D,SAAS,oBAAoB,IAAI,OAAO,GACpC,OAAO,SAAuB,aAAqB;GAIjD,MAAM,gBAAgB,sBAAsB,UAAU,OAAO;GAC7D,MAAM,aAAa,KAAK,UAAU,SAAS,sBAAsB;AACjE,SAAM,UAAU,YAAY,cAAc;AAG1C,SAAM,kBADU,WAAW,QAAQ,QAAQ,QACV,CAAC,WAAW,EAAE,KAAK,UAAU,QAAQ,CAAC;MAEzE,KAAA;EAEJ,WAAW,aAAa,qBACnB,YAA8B;GAC7B,MAAM,UAAU,QAAQ,OAAO,QAAQ;AACrC,YAAQ,MAAM,wCAAwC,IAAI;KAC1D;AACF,mBAAgB,KAAK,QAAQ;MAE/B,KAAA;EACL;;;AAMH,SAAgB,mBACd,UACA,QACA,QACA,WAAW,MACX,kBAAkB,OACV;CAKR,MAAM,sBAAsB;CAC5B,MAAM,cAAc,eAAe,QAAQ;CAC3C,MAAM,aAAa,eAAe,QAAQ;CAC1C,MAAM,oBAAoB,eAAe,QAAQ;CASjD,IAAI;AACJ,KAAI,cAAc,kBAChB,eAAc;;;;;;;;;;;;;;;;UAgBL,WACT,eAAc;;;;;;;;UAQL,kBACT,eAAc;;;;;;;KAQd,eAAc;AAchB,QAAO;;;EARgB,kBAAkB,0CAA0C,GAWpE,2CARS,oBAAoB,uBAAuB,GAQO,WAAW,oBAAoB;EANlF,WAAW,yDAAyD,GAO5E;;;gCAGe,YAAY;;;;;;;;;;EAU1C,YAAY;WAnBS,WAAW,8CAA8C,cAoBxD;;;;;AAMxB,SAAgB,oBACd,QACA,YACQ;CACR,MAAM,eAAe,eAAe;CAEpC,MAAM,SAAkC;EACtC,QAAQ,aAAa;EACrB,OAAO;EACP,QAAQ,EAAE,KAAK,aAAa,WAAW;EAGvC,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EACD,GAAG,aAAa;EAChB,GAAG;EACJ;AAID,QAAO;;;;;mCAFY,KAAK,UAAU,QAAQ,MAAM,EAAE,CAON;;;;AAO9C,IAAM,sBAAsB,IAAI,IAAiB,CAAC,eAAe,MAAM,CAAC;;;;;;;;;AAUxE,SAAgB,sBAAsB,UAAkB,QAA6B;CACnF,MAAM,mBAAmB,SAAS,KAAK,UAAU,QAAQ,EAAE,KAAK,UAAU,OAAO,WAAW,CAAC;CAC7F,MAAM,WAAW,iBAAiB,WAAW,IAAI,GAAG,mBAAmB,OAAO;CAC9E,MAAM,YAAY;CAClB,MAAM,mBAAmB;AAGzB,QAAO;;;;;;;;;;;gCAFa,eAAe,QAAQ,YAaD;;;;wCAIJ,iBAAiB;;kBAEvC,iBAAiB;;;;sEAImC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B1C,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoK/C,SAAgB,4BACd,UACA,QAC4B;AAC5B,KAAI,CAAC,oBAAoB,IAAI,OAAO,CAAE,QAAO;CAE7C,MAAM,WAAW,KAAK,UAAU,QAAQ;CACxC,MAAM,YAAY,KAAK,UAAU,WAAW;AAG5C,QAAO;EACL,SAFc,WAAW,QAAQ,QAAQ;EAGzC,MAAM,CAAC,UAAU;EACjB,KAAK;EACN;;;;;;;;AASH,eAAe,cACb,UACA,QACA,YACe;CACf,MAAM,eAAe,eAAe;CACpC,MAAM,EACJ,aACA,OAAO,YACP,SACA,qBACE,MAAM,OAAO;CAEjB,MAAM,QAAQ,MAAM,YAAY;EAC9B,SAAS;EACT,QAAQ,aAAa;EAIrB,UAAU,EAAE,SAAS,KAAK,UAAU,WAAW,EAAE;EACjD,QAAQ,EAAE,KAAK,KAAK,UAAU,aAAa,UAAU,EAAE;EACvD,YAAY,EACV,cAAc,EAAE,SAAS,EAAE,iBAAiB,iBAAiB,EAAE,EAChE;EAID,cAAc,EACZ,UAAU,CAAC,cAAc,EAC1B;EACD,GAAG,aAAa;EAChB,GAAG;EACJ,CAAC;AAEF,OAAM,QAAQ,MAAM;AACpB,OAAM,iBAAiB,MAAM;AAC7B,OAAM,WAAW,MAAM;AACvB,OAAM,MAAM,OAAO;;;AAIrB,SAAS,kBAAkB,SAAiB,MAAgB,KAA4B;AACtF,QAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,KAAK,GAAG,QAAQ;AACtD,OAAI,IAAK,QAAO,IAAI;OACf,UAAS;IACd;AACF,QAAM,QAAQ,KAAK,QAAQ,OAAO;AAClC,QAAM,QAAQ,KAAK,QAAQ,OAAO;GAClC;;;;;;AASJ,SAAgB,gBAAgB,QAAmC;AACjE,QAAO,eAAe"}

package/dist/server/action-handler.d.ts

@@ -41,9 +41,18 @@ export interface ActionDispatchConfig {
  *   (React's progressive enhancement hidden fields)
  */
 export declare function isActionRequest(req: Request): boolean;
-/** Signal from handleFormAction to re-render the page with flash data instead of redirecting. */
+/**
+ * Signal from handleFormAction to re-render the page with flash data instead of redirecting.
+ *
+ * Carries `setCookieHeaders` snapshotted from the action's request-context ALS
+ * scope so the rerender pipeline (which establishes its own fresh cookie jar)
+ * can append them to the final HTML response. Without this, cookies set inside
+ * the action via `defineCookie().setCookie()` are silently dropped on the
+ * no-JS validation-failure path. See LOCAL-740.
+ */
 export interface FormRerender {
     rerender: FormFlashData;
+    setCookieHeaders: string[];
 }
 /**
  * Handle a server action request.

package/dist/server/action-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAMrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CAuDzC"}
+{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAMrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CAgEzC"}

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AA0C/C,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAoCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAqjBD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;8BA5SrC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA8ShD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AA0C/C,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAoCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AA4jBD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;8BAnTrC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AAqThD,wBAAiE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.92",
+  "version": "0.2.0-alpha.94",
   "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/adapters/nitro.ts

@@ -561,7 +561,30 @@ const server = createServer(async (req, res) => {
     const webResponse = compressResponse(webRequest, rawResponse);
 
     // Write the response back to the Node response.
-    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));
+    //
+    // Set-Cookie needs special handling: Headers.entries() joins multiple
+    // Set-Cookie values with ", " into a single entry, but each cookie must
+    // be its own header per RFC 6265 §4.1. Object.fromEntries() would then
+    // collapse them into one malformed Set-Cookie header that browsers reject
+    // (or only honor partially). Use getSetCookie() to preserve individual
+    // values, and pass them as an array — Node's writeHead accepts
+    // Record<string, string | string[]> and emits one header per array entry.
+    //
+    // Without this, EVERY cookie set by the framework on Node—/Nitro deployments
+    // is silently dropped: defineCookie().setCookie() in actions, middleware
+    // cookie writes, the framework's own session cookies, all of it. See
+    // LOCAL-741.
+    const responseHeaders: Record<string, string | string[]> = {};
+    webResponse.headers.forEach((value, key) => {
+      if (key.toLowerCase() !== 'set-cookie') {
+        responseHeaders[key] = value;
+      }
+    });
+    const setCookies = webResponse.headers.getSetCookie();
+    if (setCookies.length > 0) {
+      responseHeaders['set-cookie'] = setCookies;
+    }
+    res.writeHead(webResponse.status, responseHeaders);
 
     if (webResponse.body) {
       const reader = webResponse.body.getReader();

package/src/server/action-handler.ts

@@ -89,9 +89,18 @@ export function isActionRequest(req: Request): boolean {
 
 // ─── Handler ──────────────────────────────────────────────────────────────
 
-/** Signal from handleFormAction to re-render the page with flash data instead of redirecting. */
+/**
+ * Signal from handleFormAction to re-render the page with flash data instead of redirecting.
+ *
+ * Carries `setCookieHeaders` snapshotted from the action's request-context ALS
+ * scope so the rerender pipeline (which establishes its own fresh cookie jar)
+ * can append them to the final HTML response. Without this, cookies set inside
+ * the action via `defineCookie().setCookie()` are silently dropped on the
+ * no-JS validation-failure path. See LOCAL-740.
+ */
 export interface FormRerender {
   rerender: FormFlashData;
+  setCookieHeaders: string[];
 }
 
 /**
@@ -150,11 +159,20 @@ export async function handleActionRequest(
       result = await handleFormAction(req, config);
     }
 
-    // Apply cookie jar to action responses
+    // Apply cookie jar to action responses.
+    //
+    // For Response results we append Set-Cookie directly. For FormRerender
+    // signals we snapshot the headers here, before this ALS scope exits, so
+    // the caller can apply them to the rerender pipeline's response (which
+    // runs in its own request-context scope with a fresh cookie jar).
+    // See LOCAL-740 — without this snapshot, cookies set inside a no-JS
+    // form action that returns validation errors are silently dropped.
     if (result instanceof Response) {
       for (const value of getSetCookieHeaders()) {
         result.headers.append('Set-Cookie', value);
       }
+    } else if (result && 'rerender' in result) {
+      result.setCookieHeaders = getSetCookieHeaders();
     }
     return result;
   });
@@ -339,6 +357,8 @@ async function handleFormAction(
         ...errorResult,
         submittedValues,
       },
+      // Filled in by handleActionRequest before the ALS scope exits.
+      setCookieHeaders: [],
     };
   }
 
@@ -368,5 +388,6 @@ async function handleFormAction(
     );
   }
 
-  return { rerender: actionResult };
+  // setCookieHeaders is filled in by handleActionRequest before the ALS scope exits.
+  return { rerender: actionResult, setCookieHeaders: [] };
 }

package/src/server/rsc-entry/index.ts

@@ -447,6 +447,13 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
           // Server components read it via getFormFlash() and pass it to
           // client form components as the initial useActionState value.
           const response = await runWithFormFlash(formRerender.rerender, () => pipeline(req));
+          // Apply Set-Cookie headers snapshotted from the action's ALS scope.
+          // The pipeline above runs in its own request context with a fresh
+          // cookie jar, so cookies set inside the action would otherwise be
+          // silently dropped on the no-JS rerender path. See LOCAL-740.
+          for (const value of formRerender.setCookieHeaders) {
+            response.headers.append('Set-Cookie', value);
+          }
           return response;
         }
         return actionResponse;