@timber-js/app 0.2.0-alpha.97 → 0.2.0-alpha.98

package/dist/server/route-matcher.d.ts

@@ -8,58 +8,32 @@
  * See design/07-routing.md §"Request Lifecycle"
  */
 import type { RouteMatch } from './pipeline.js';
+import type { SegmentNode, RouteTree } from '../routing/types.js';
 import { type MetadataRouteType } from './metadata-routes.js';
 /** A file reference in the manifest (lazy import + path). */
-interface ManifestFile {
+export interface ManifestFile {
     load: () => Promise<unknown>;
     filePath: string;
 }
-/** A segment node as it appears in the virtual:timber-route-manifest module. */
-export interface ManifestSegmentNode {
-    segmentName: string;
-    segmentType: 'static' | 'dynamic' | 'catch-all' | 'optional-catch-all' | 'group' | 'slot' | 'intercepting';
-    urlPath: string;
-    paramName?: string;
-    /** For intercepting segments: the marker used, e.g. "(.)". */
-    interceptionMarker?: '(.)' | '(..)' | '(...)' | '(..)(..)';
-    /** For intercepting segments: the segment name after stripping the marker. */
-    interceptedSegmentName?: string;
-    page?: ManifestFile;
-    layout?: ManifestFile;
-    middleware?: ManifestFile;
-    access?: ManifestFile;
-    route?: ManifestFile;
-    /** params.ts — isomorphic convention file for segmentParams + searchParams definitions. */
-    params?: ManifestFile;
-    error?: ManifestFile;
-    default?: ManifestFile;
-    denied?: ManifestFile;
-    statusFiles?: Record<string, ManifestFile>;
-    jsonStatusFiles?: Record<string, ManifestFile>;
-    legacyStatusFiles?: Record<string, ManifestFile>;
-    /** Metadata route files (sitemap.ts, robots.ts, icon.tsx, etc.) keyed by base name */
-    metadataRoutes?: Record<string, ManifestFile>;
-    children: ManifestSegmentNode[];
-    slots: Record<string, ManifestSegmentNode>;
-}
-/** The manifest shape from virtual:timber-route-manifest. */
-export interface ManifestRoot {
-    root: ManifestSegmentNode;
-    /**
-     * Absolute path to the Vite project root, captured at build/load time.
-     * Used by dev-only features (e.g., dev error page frame classification)
-     * that need a correct project root even when CWD differs (e.g., monorepo
-     * custom root). See TIM-807 / TIM-808.
-     */
+/**
+ * A segment node as it appears in the virtual:timber-route-manifest module.
+ *
+ * Type alias for `SegmentNode<ManifestFile>` — the same shape used by the
+ * scanner, only with lazy `load` functions instead of build-time extension
+ * metadata.
+ */
+export type ManifestSegmentNode = SegmentNode<ManifestFile>;
+/**
+ * The manifest shape from virtual:timber-route-manifest.
+ *
+ * Extends `RouteTree<ManifestFile>` with `viteRoot`, the absolute path
+ * to the Vite project root captured at build/load time. Used by dev-only
+ * features (e.g., dev error page frame classification) that need a
+ * correct project root even when CWD differs (e.g., monorepo custom root).
+ * See TIM-807 / TIM-808.
+ */
+export interface ManifestRoot extends RouteTree<ManifestFile> {
     viteRoot: string;
-    proxy?: ManifestFile;
-    /**
-     * Global error page: app/global-error.{tsx,ts,jsx,js}
-     * Tier 2 — standalone full-page replacement (no layouts) when no
-     * segment-level error file is found. SSR-only render.
-     * See design/10-error-handling.md §"Tier 2"
-     */
-    globalError?: ManifestFile;
 }
 /**
  * Create a route matcher function from a manifest.
@@ -93,5 +67,4 @@ export interface MetadataRouteMatch {
  * See design/16-metadata.md §"Metadata Routes"
  */
 export declare function createMetadataRouteMatcher(manifest: ManifestRoot): (pathname: string) => MetadataRouteMatch | null;
-export {};
 //# sourceMappingURL=route-matcher.d.ts.map

package/dist/server/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAM9B,6DAA6D;AAC7D,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EACP,QAAQ,GACR,SAAS,GACT,WAAW,GACX,oBAAoB,GACpB,OAAO,GACP,MAAM,GACN,cAAc,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3D,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC5C;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,mBAAmB,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;CAC5B;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AAyMD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAMjD"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAW9B,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,YAAY,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AAuMD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAMjD"}

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AA0C/C,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAoCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAmnBD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;8BA7UrC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA+UhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AAwC/C,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAoCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAukBD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;;AAE1D,wBAAiE"}

package/dist/server/rsc-entry/wrap-action-dispatch.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Action-dispatch wrapper around the route pipeline.
+ *
+ * Extracted from rsc-entry/index.ts so the wiring can be unit-tested in
+ * isolation from Vite's virtual modules. The wrapper is responsible for
+ * three things, in order:
+ *
+ *   1. **Pipeline-boundary CSRF validation** — runs on EVERY unsafe-method
+ *      request, before any dispatch decision. This is the only line of
+ *      defense for `route.ts` API handlers, which never see the action
+ *      handler. See LOCAL-773.
+ *
+ *   2. **Server action interception** — POST requests carrying an
+ *      `x-rsc-action` header or React's `$ACTION_REF` form fields are
+ *      handed to `handleActionRequest`, which executes the action and
+ *      returns either an RSC response or a no-JS rerender signal.
+ *
+ *   3. **No-JS validation rerender** — when an action returns flash data
+ *      instead of a redirect, the wrapper re-runs the page render via the
+ *      pipeline with the post-action cookie state and `runWithFormFlash`
+ *      so server components can read the flash. See TIM-836 / TIM-837.
+ *
+ * Anything else falls through to `pipeline(req)` for normal route handling.
+ *
+ * The wrapper takes its dependencies as parameters (no module-level
+ * imports of virtual modules) so tests can construct it with stub
+ * pipelines and stub revalidate renderers.
+ */
+import type { BodyLimitsConfig } from '../body-limits.js';
+import { type CsrfConfig } from '../csrf.js';
+import type { SensitiveFieldsOption } from '../sensitive-fields.js';
+import type { RevalidateRenderer } from '../actions.js';
+/**
+ * Build a `RevalidateRenderer` for a specific request.
+ *
+ * The renderer needs to forward cookies/headers from the originating
+ * request when fetching the revalidated route. We pass the request in
+ * via a builder so the wrapper doesn't need to know about route matching,
+ * segment param coercion, or element building — those concerns stay in
+ * `rsc-entry/index.ts`.
+ */
+export type RevalidateRendererFactory = (req: Request) => RevalidateRenderer;
+/** Dependencies for the action-dispatch wrapper. */
+export interface ActionDispatchDeps {
+    /** CSRF configuration (Origin allow-list, on/off switch). */
+    csrfConfig: CsrfConfig;
+    /** Body size limits forwarded to `handleActionRequest`. */
+    bodyLimits?: BodyLimitsConfig['limits'];
+    /** Sensitive-field deny-list forwarded to `handleActionRequest`. */
+    sensitiveFields?: SensitiveFieldsOption;
+    /** Per-request factory that builds a `RevalidateRenderer`. */
+    buildRevalidateRenderer: RevalidateRendererFactory;
+}
+/**
+ * Wrap a pipeline function with CSRF validation and server-action dispatch.
+ *
+ * The returned handler is the framework's outermost request entry point.
+ * Its responsibilities, in order:
+ *
+ *   1. CSRF (Origin/Host) validation on every unsafe-method request.
+ *      Safe methods (GET/HEAD/OPTIONS) short-circuit inside `validateCsrf`,
+ *      so this is a no-op for reads.
+ *   2. Server-action interception for POSTs that match `isActionRequest`.
+ *   3. No-JS validation rerender when an action returns a `FormRerender`
+ *      signal instead of a redirect.
+ *   4. Otherwise, delegate to `pipeline(req)`.
+ *
+ * The duplicate `validateCsrf` call inside `handleActionRequest` is left in
+ * place as defense-in-depth (no-op on the happy path) so the action handler
+ * remains safe to call from any future entry point that bypasses this
+ * wrapper. See LOCAL-773.
+ */
+export declare function wrapPipelineWithActionDispatch(pipeline: (req: Request) => Promise<Response>, deps: ActionDispatchDeps): (req: Request) => Promise<Response>;
+//# sourceMappingURL=wrap-action-dispatch.d.ts.map

package/dist/server/rsc-entry/wrap-action-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap-action-dispatch.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/wrap-action-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,kBAAkB,CAAC;AAE7E,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,UAAU,CAAC;IACvB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,oEAAoE;IACpE,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,8DAA8D;IAC9D,uBAAuB,EAAE,yBAAyB,CAAC;CACpD;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC7C,IAAI,EAAE,kBAAkB,GACvB,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAqErC"}

package/dist/server/status-code-resolver.d.ts

@@ -5,6 +5,12 @@
  * correct file to render by walking the fallback chain described in
  * design/10-error-handling.md §"Status-Code Files".
  *
+ * **Generic over `TFile`** (TIM-848). Walks `SegmentNode<TFile>` trees
+ * regardless of whether `TFile` is the build-time `RouteFile` or the
+ * runtime `ManifestFile`. Before TIM-848 there were two near-identical
+ * resolvers — one for the Map-based scanner output and one for the
+ * object-based runtime manifest. Now there is one.
+ *
  * Supports two format families:
  * - 'component' (default): .tsx/.jsx/.mdx status files → React rendering pipeline
  * - 'json': .json status files → raw JSON response, no React
@@ -17,24 +23,23 @@
  *   Pass 3 — error.tsx (leaf → root)
  *   Pass 4 — framework default (returns null)
  *
- * **JSON chain (4xx):**
- *   Pass 1 — json status files (leaf → root): {status}.json → 4xx.json
+ * **JSON chain (4xx and 5xx):**
+ *   Pass 1 — json status files (leaf → root): {status}.json → {category}.json
  *   Pass 2 — framework default JSON (returns null, caller provides bare JSON)
  *
- * **5xx (component only):**
+ * **5xx component:**
  *   Per-segment (leaf → root): {status}.tsx → 5xx.tsx → error.tsx
- *   Then global-error.tsx (future)
  *   Then framework default (returns null)
  */
-import type { SegmentNode, RouteFile } from '../routing/types.js';
+import type { SegmentNode } from '../routing/types.js';
 /** How the status-code file was matched. */
 export type StatusFileKind = 'exact' | 'category' | 'legacy' | 'error';
 /** Response format family for status-code resolution. */
 export type StatusFileFormat = 'component' | 'json';
 /** Result of resolving a status-code file for a segment chain. */
-export interface StatusFileResolution {
+export interface StatusFileResolution<TFile> {
     /** The matched route file. */
-    file: RouteFile;
+    file: TFile;
     /** The HTTP status code (always the original status, not the file's code). */
     status: number;
     /** How the file was matched. */
@@ -45,9 +50,9 @@ export interface StatusFileResolution {
 /** How a slot denial file was matched. */
 export type SlotDeniedKind = 'denied' | 'default';
 /** Result of resolving a slot denied file. */
-export interface SlotDeniedResolution {
+export interface SlotDeniedResolution<TFile> {
     /** The matched route file (denied.tsx or default.tsx). */
-    file: RouteFile;
+    file: TFile;
     /** Slot name without @ prefix. */
     slotName: string;
     /** How the file was matched. */
@@ -64,7 +69,7 @@ export interface SlotDeniedResolution {
  * @param segments - The matched segment chain from root (index 0) to leaf (last).
  * @param format - The response format family ('component' or 'json'). Defaults to 'component'.
  */
-export declare function resolveStatusFile(status: number, segments: ReadonlyArray<SegmentNode>, format?: StatusFileFormat): StatusFileResolution | null;
+export declare function resolveStatusFile<TFile>(status: number, segments: ReadonlyArray<SegmentNode<TFile>>, format?: StatusFileFormat): StatusFileResolution<TFile> | null;
 /**
  * Resolve the denial file for a parallel route slot.
  *
@@ -73,5 +78,5 @@ export declare function resolveStatusFile(status: number, segments: ReadonlyArra
  *
  * @param slotNode - The segment node for the slot (segmentType === 'slot').
  */
-export declare function resolveSlotDenied(slotNode: SegmentNode): SlotDeniedResolution | null;
+export declare function resolveSlotDenied<TFile>(slotNode: SegmentNode<TFile>): SlotDeniedResolution<TFile> | null;
 //# sourceMappingURL=status-code-resolver.d.ts.map

package/dist/server/status-code-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-code-resolver.d.ts","sourceRoot":"","sources":["../../src/server/status-code-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIlE,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,UAAU,GACV,QAAQ,GACR,OAAO,CAAC;AAEZ,yDAAyD;AACzD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEpD,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,IAAI,EAAE,SAAS,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,IAAI,EAAE,SAAS,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,IAAI,EAAE,cAAc,CAAC;CACtB;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EACpC,MAAM,GAAE,gBAA8B,GACrC,oBAAoB,GAAG,IAAI,CAS7B;AA2JD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,oBAAoB,GAAG,IAAI,CAYpF"}
+{"version":3,"file":"status-code-resolver.d.ts","sourceRoot":"","sources":["../../src/server/status-code-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,UAAU,GACV,QAAQ,GACR,OAAO,CAAC;AAEZ,yDAAyD;AACzD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEpD,kEAAkE;AAClE,MAAM,WAAW,oBAAoB,CAAC,KAAK;IACzC,8BAA8B;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB,CAAC,KAAK;IACzC,0DAA0D;IAC1D,IAAI,EAAE,KAAK,CAAC;IACZ,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,IAAI,EAAE,cAAc,CAAC;CACtB;AA8DD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EACrC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAC3C,MAAM,GAAE,gBAA8B,GACrC,oBAAoB,CAAC,KAAK,CAAC,GAAG,IAAI,CAKpC;AA0FD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EACrC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAC3B,oBAAoB,CAAC,KAAK,CAAC,GAAG,IAAI,CAYpC"}

package/dist/server/tree-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tree-builder.d.ts","sourceRoot":"","sources":["../../src/server/tree-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIlE,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAErF,gFAAgF;AAEhF,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC;AAE/B,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAC1B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACrC,GAAG,QAAQ,EAAE,OAAO,EAAE,KACnB,YAAY,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mCAAmC;IACnC,UAAU,EAAE,YAAY,CAAC;IACzB,yCAAyC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EACJ,MAAM,GACN,OAAO,iBAAiB,EAAE,UAAU,GACpC,OAAO,iBAAiB,EAAE,cAAc,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,yBAAyB,EAAE,aAAa,EAAE,CAAC;IAC9D,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,wFAAwF;IACxF,eAAe,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC,eAAe,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAID;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,YAAY,CAAC;IACnB,gFAAgF;IAChF,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkF1F"}
+{"version":3,"file":"tree-builder.d.ts","sourceRoot":"","sources":["../../src/server/tree-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIlE,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAErF,gFAAgF;AAEhF,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC;AAE/B,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAC1B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACrC,GAAG,QAAQ,EAAE,OAAO,EAAE,KACnB,YAAY,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mCAAmC;IACnC,UAAU,EAAE,YAAY,CAAC;IACzB,yCAAyC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EACJ,MAAM,GACN,OAAO,iBAAiB,EAAE,UAAU,GACpC,OAAO,iBAAiB,EAAE,cAAc,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,yBAAyB,EAAE,aAAa,EAAE,CAAC;IAC9D,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,wFAAwF;IACxF,eAAe,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACxC,eAAe,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAID;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,YAAY,CAAC;IACnB,gFAAgF;IAChF,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoF1F"}

package/dist/utils/directive-parser.d.ts

@@ -5,10 +5,6 @@
  * avoiding false positives from regex matching inside string literals,
  * comments, or template expressions.
  *
- * The function-body directive detection (findFunctionsWithDirective) is a
- * general-purpose utility kept for future use. Custom directives like
- * 'use cache' are not currently implemented — see design/06-caching.md.
- *
  * @module
  */
 export interface FileDirective {
@@ -17,30 +13,6 @@ export interface FileDirective {
     /** 1-based line number where the directive appears */
     line: number;
 }
-export interface FunctionWithDirective {
-    /** Function name (or 'default' for anonymous default exports) */
-    name: string;
-    /** The directive found in the function body */
-    directive: string;
-    /** 1-based line number of the directive */
-    directiveLine: number;
-    /** Start offset of the function in the source */
-    start: number;
-    /** End offset of the function in the source */
-    end: number;
-    /** Start offset of the function body block (after the '{') */
-    bodyStart: number;
-    /** End offset of the function body block (the '}') */
-    bodyEnd: number;
-    /** Content between { and } of the function body */
-    bodyContent: string;
-    /** 'export ', 'export default ', or '' */
-    prefix: string;
-    /** Whether this is an arrow function */
-    isArrow: boolean;
-    /** The function signature (everything before the body '{') */
-    declaration: string;
-}
 /**
  * Detect a file-level directive ('use client', 'use server', etc.).
  *
@@ -53,21 +25,4 @@ export interface FunctionWithDirective {
  * Returns the first matching directive, or null if none found.
  */
 export declare function detectFileDirective(code: string, directives?: string[]): FileDirective | null;
-/**
- * Find all functions in the source code that contain a directive
- * (e.g. 'use cache', 'use dynamic') as their first body statement.
- *
- * Parses the source with acorn and walks the AST looking for function
- * declarations and arrow function expressions whose body is a
- * BlockStatement with a directive prologue.
- *
- * Returns an array of function info objects, sorted by position
- * (descending) for safe end-to-start replacement.
- */
-export declare function findFunctionsWithDirective(code: string, directive: string): FunctionWithDirective[];
-/**
- * Quick regex check for whether code contains a directive string.
- * Use as a fast bail-out before calling the AST-based functions.
- */
-export declare function containsDirective(code: string, directive: string): boolean;
 //# sourceMappingURL=directive-parser.d.ts.map

package/dist/utils/directive-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directive-parser.d.ts","sourceRoot":"","sources":["../../src/utils/directive-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAM,EAAiC,GAClD,aAAa,GAAG,IAAI,CAmCtB;AAiED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,qBAAqB,EAAE,CAqBzB;AA4TD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1E"}
+{"version":3,"file":"directive-parser.d.ts","sourceRoot":"","sources":["../../src/utils/directive-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;CACd;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAM,EAAiC,GAClD,aAAa,GAAG,IAAI,CAmCtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.2.0-alpha.97",
+  "version": "0.2.0-alpha.98",
   "description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",
@@ -110,6 +110,11 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "vite build --config vite.lib.config.ts && tsc --emitDeclarationOnly --project tsconfig.json --outDir dist",
+    "typecheck": "tsgo --noEmit",
+    "prepublishOnly": "pnpm run build"
+  },
   "dependencies": {
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/context-async-hooks": "^2.6.1",
@@ -152,9 +157,5 @@
   },
   "engines": {
     "node": ">=22.12.0"
-  },
-  "scripts": {
-    "build": "vite build --config vite.lib.config.ts && tsc --emitDeclarationOnly --project tsconfig.json --outDir dist",
-    "typecheck": "tsgo --noEmit"
   }
-}
+}

package/src/adapters/nitro.ts

@@ -486,11 +486,25 @@ const MIME_TYPES = {
 };
 
 const publicDir = join(__dirname, '${publicDir}');
-const port = parseInt(process.env.PORT || '3000', 10);
+
+// Port resolution (TIM-842):
+//   - Default to 3000
+//   - If PORT env var is set, honor it strictly (fail loudly on conflict)
+//   - Otherwise auto-bump from 3000 until a free port is found
+// Mirrors the dev server behavior so timber dev/preview/production all
+// behave the same way around port selection.
+const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : null;
+const portIsExplicit = envPort != null && Number.isFinite(envPort) && envPort > 0;
+const startPort = portIsExplicit ? envPort : 3000;
 const host = process.env.HOST || process.env.HOSTNAME || 'localhost';
 
+// Set after listenWithBump() resolves so request handlers can build
+// absolute URLs from the actual bound port (which may differ from
+// startPort after an auto-bump).
+let boundPort = startPort;
+
 const server = createServer(async (req, res) => {
-  const url = new URL(req.url || '/', \`http://\${host}:\${port}\`);
+  const url = new URL(req.url || '/', \`http://\${host}:\${boundPort}\`);
 
   // Try serving static files from the public directory first.
   const filePath = join(publicDir, url.pathname);
@@ -631,13 +645,49 @@ const server = createServer(async (req, res) => {
   }
 });
 
-server.listen(port, host, () => {
+function listenWithBump(port, attempt = 0) {
+  return new Promise((resolveListen, rejectListen) => {
+    const onError = (err) => {
+      server.removeListener('listening', onListening);
+      if (err && err.code === 'EADDRINUSE' && !portIsExplicit && attempt < 100) {
+        if (attempt === 0) {
+          console.log(\`  [timber] Port \${port} in use, trying \${port + 1}...\`);
+        }
+        listenWithBump(port + 1, attempt + 1).then(resolveListen, rejectListen);
+        return;
+      }
+      rejectListen(err);
+    };
+    const onListening = () => {
+      server.removeListener('error', onError);
+      resolveListen(port);
+    };
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen(port, host);
+  });
+}
+
+try {
+  boundPort = await listenWithBump(startPort);
+  if (boundPort !== startPort) {
+    console.log();
+    console.log(\`  [timber] Port \${startPort} in use, using \${boundPort}\`);
+  }
   console.log();
   console.log('  ⚡ timber preview server running at:');
   console.log();
-  console.log(\`    ➜  http://\${host}:\${port}\`);
+  console.log(\`    ➜  http://\${host}:\${boundPort}\`);
   console.log();
-});
+} catch (err) {
+  if (err && err.code === 'EADDRINUSE') {
+    console.error(\`[timber] Port \${startPort} is already in use. \` +
+      'Set PORT to a free port, or unset PORT to auto-pick.');
+  } else {
+    console.error('[timber] Failed to start preview server:', err);
+  }
+  process.exit(1);
+}
 `;
 }
 

package/src/index.ts

@@ -35,6 +35,7 @@ import { timberBuildReport } from './plugins/build-report';
 import { createNoopTimer } from './utils/startup-timer';
 import { resolveEncryptionKeyExpression, shouldEnableEncryption } from './server/action-encryption';
 import { createHoldingServer } from './server/dev-holding-server.js';
+import { resolveStartPort, startDevServerPort } from './server/port-resolution.js';
 import type { TimberUserConfig } from './config-types.js';
 import type { PluginContext } from './plugin-context.js';
 import {
@@ -232,7 +233,7 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
   // config() hook must NOT return a `plugins` field (Vite ignores it).
   const rootSync: Plugin = {
     name: 'timber-root-sync',
-    config(userConfig, { command }) {
+    async config(userConfig, { command, isPreview }) {
       // ── Load timber.config.ts from the correct root ───────────────
       // Vite's `config` hook fires before `configResolved`. The user's
       // `root` option (if set) tells us where the project lives.
@@ -287,36 +288,60 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
       // We explicitly set `oxc.jsx.development: false` for builds so
       // the client bundle always uses jsx/jsxs from react/jsx-runtime,
       // regardless of the ambient NODE_ENV value.
-      // ── Start holding server for dev mode ───────────────────────
-      // Bind the port immediately so browsers see a loading page
-      // instead of ERR_CONNECTION_REFUSED during the ~6-8s startup.
-      // The holding server is closed in timber-dev-server's
-      // configureServer hook (the last plugin), right before Vite
-      // calls server.listen().
-      // See design/21-dev-server.md §"Startup Holding Server", TIM-665.
-      if (command === 'serve') {
-        const port = (userConfig.server?.port as number) ?? 5173;
-        try {
-          ctx.holdingServer = createHoldingServer();
-          // listen() is async but we fire-and-forget — the server
-          // starts binding immediately and will be ready well before
-          // any browser request arrives. We can't await here because
-          // config() must return synchronously.
-          ctx.holdingServer.listen(port).then(
-            (boundPort) => {
-              const url = `http://localhost:${boundPort}`;
-              console.log(
-                `\n  \x1b[2m🪵 timber.js dev server starting at\x1b[0m \x1b[36m${url}\x1b[0m\n`
-              );
-            },
-            () => {
-              // Port already in use — skip gracefully.
-              ctx.holdingServer = null;
-            }
-          );
-        } catch {
+      // ── Resolve dev/preview port (TIM-842) ───────────────────────
+      // Default port is 3000 with auto-bump on conflict. Explicit user
+      // overrides (`--port`, `PORT` env, `vite.config.ts` server.port)
+      // are honored as-is and fail loudly via `strictPort: true`.
+      //
+      // For dev (`command === 'serve' && !isPreview`) we start the
+      // holding server and use its `listen()` as the probe, pairing
+      // the probe with the real bind to eliminate TOCTOU races.
+      //
+      // For `vite preview` (`command === 'serve' && isPreview`) we
+      // resolve the config/env port but delegate the actual bind +
+      // auto-bump to Vite's own preview server. Starting the holding
+      // server in preview mode would self-conflict because the dev
+      // plugin's `configureServer` handoff does not run for preview;
+      // the holding server would keep the port occupied while Vite's
+      // preview tried to bind the same port.
+      //
+      // See design/21-dev-server.md §"Default Port and Auto-Bump".
+      let resolvedDevPort: number | null = null;
+      let resolvedDevPortExplicit = false;
+      if (command === 'serve' && !isPreview) {
+        ctx.holdingServer = createHoldingServer();
+        const holdingRef = ctx.holdingServer;
+        const result = await startDevServerPort({
+          configPort:
+            typeof userConfig.server?.port === 'number' ? userConfig.server.port : undefined,
+          envPort: process.env.PORT,
+          listen: (p) => holdingRef.listen(p),
+        });
+        resolvedDevPort = result.port;
+        resolvedDevPortExplicit = result.explicit;
+        if (!result.bound) {
+          // Holding server failed to bind. Drop the reference so the
+          // dev-server plugin doesn't try to close a server that was
+          // never listening, and let Vite surface the conflict.
           ctx.holdingServer = null;
         }
+      } else if (command === 'serve' && isPreview) {
+        // Preview mode: resolve the starting port from config/env/
+        // default but do NOT probe. Vite's preview server handles the
+        // bind itself, with `preview.strictPort` controlling whether
+        // an in-use port auto-bumps (implicit) or errors (explicit).
+        const previewConfigPort =
+          typeof userConfig.preview?.port === 'number'
+            ? userConfig.preview.port
+            : typeof userConfig.server?.port === 'number'
+              ? userConfig.server.port
+              : undefined;
+        const start = resolveStartPort({
+          configPort: previewConfigPort,
+          envPort: process.env.PORT,
+        });
+        resolvedDevPort = start.port;
+        resolvedDevPortExplicit = start.explicit;
       }
 
       // Return the resolved buildDir as Vite's build.outDir so the RSC
@@ -349,8 +374,36 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
         };
       }
 
-      // Dev mode: set outDir so dev-time references are consistent
-      return { build: { outDir: buildOutDir }, environments: envOutDirs };
+      // Dev/preview mode: set outDir so dev-time references are
+      // consistent, and surface the resolved port to Vite.
+      //
+      // For dev, we set strictPort: true so Vite uses exactly the port
+      // the holding server probed for — without strictPort, Vite would
+      // run its own auto-bump starting from `port`, which would skip
+      // straight past whatever holding-server-bumped port we picked.
+      //
+      // For `vite preview`, we set `preview.strictPort` based on
+      // whether the user explicitly set the port. Implicit (default)
+      // preview uses strictPort: false so Vite's preview server can
+      // auto-bump from 3000. Explicit preview uses strictPort: true
+      // so conflicts fail loudly, matching the dev behavior and the
+      // TIM-842 spec.
+      const serverConfig: { port?: number; strictPort?: boolean } = {};
+      const previewConfig: { port?: number; strictPort?: boolean } = {};
+      if (resolvedDevPort != null) {
+        if (!isPreview) {
+          serverConfig.port = resolvedDevPort;
+          serverConfig.strictPort = true;
+        }
+        previewConfig.port = resolvedDevPort;
+        previewConfig.strictPort = resolvedDevPortExplicit;
+      }
+      return {
+        build: { outDir: buildOutDir },
+        environments: envOutDirs,
+        server: serverConfig,
+        preview: previewConfig,
+      };
     },
     configResolved(resolved) {
       ctx.root = resolved.root;