@timber-js/app 0.2.0-alpha.97 → 0.2.0-alpha.99

package/dist/server/port-resolution.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Port resolution for the dev server, Vite preview, and the Node
+ * production preview server.
+ *
+ * Behavior (see TIM-842):
+ *
+ *   1. Default port is **3000** for both dev and prod.
+ *   2. If the user did NOT set an explicit port, auto-bump from 3000
+ *      until a free port is found (3000 → 3001 → 3002 → …).
+ *   3. If the user DID set an explicit port (via `--port`, `PORT` env
+ *      var, or `vite.config.ts` `server.port`), use it as-is and let
+ *      the bind fail loudly on conflict (`strictPort: true`).
+ *
+ * The port-bump probe is performed by binding the **actual** server
+ * (e.g. the dev holding server) — not a throwaway probe — so there is
+ * no time-of-check / time-of-use race between probing and listening.
+ *
+ * Design doc: 21-dev-server.md §"Default Port and Auto-Bump".
+ */
+/** Default port used by `timber dev` and `timber preview`. */
+export declare const DEFAULT_PORT = 3000;
+/**
+ * A function that attempts to bind to a given port.
+ *
+ * Resolves with the bound port on success. Rejects with an error
+ * (typically with `code === 'EADDRINUSE'`) on failure.
+ */
+export type ListenFn = (port: number) => Promise<number>;
+export interface ResolvePortInput {
+    /**
+     * Port read from `vite.config.ts` `server.port` or the `--port` CLI
+     * flag (Vite merges `--port` into `userConfig.server.port` before
+     * plugins see it).
+     */
+    configPort?: number | undefined;
+    /** Raw value of `process.env.PORT`. */
+    envPort?: string | undefined;
+    /** Default port to use when neither `configPort` nor `envPort` is set. */
+    defaultPort?: number;
+}
+export interface ResolvedPortInput {
+    /** Port to start binding from. */
+    port: number;
+    /**
+     * `true` if the port came from an explicit user override (config or
+     * env). When `true`, callers must NOT auto-bump and must surface
+     * `EADDRINUSE` to the user.
+     */
+    explicit: boolean;
+}
+/**
+ * Pure: compute the starting port from config / env / defaults.
+ *
+ * Performs no I/O — pair with {@link bindWithBump} to actually listen.
+ */
+export declare function resolveStartPort(input: ResolvePortInput): ResolvedPortInput;
+export interface BindWithBumpOptions {
+    /** First port to attempt. */
+    startPort: number;
+    /**
+     * If `true`, increment the port and retry on `EADDRINUSE`. If
+     * `false`, attempt once and let the error propagate.
+     */
+    autoBump: boolean;
+    /** Maximum number of port attempts when `autoBump` is `true`. */
+    maxAttempts?: number;
+}
+export interface BindWithBumpResult {
+    /** Port that was actually bound. */
+    port: number;
+    /** `true` if the bound port differs from `startPort`. */
+    bumped: boolean;
+}
+/**
+ * Bind a server starting at `startPort`, optionally bumping the port
+ * on `EADDRINUSE` until a free one is found.
+ *
+ * Use this with the actual server you intend to keep listening (e.g.
+ * the dev holding server). Pairing the probe with the real listen
+ * eliminates the TOCTOU race that a throwaway probe would introduce.
+ */
+export declare function bindWithBump(listen: ListenFn, options: BindWithBumpOptions): Promise<BindWithBumpResult>;
+/** True if `err` is a Node `EADDRINUSE` error from `server.listen()`. */
+export declare function isAddrInUse(err: unknown): boolean;
+export interface StartDevServerPortInput {
+    /** Resolved port from `userConfig.server?.port` (or `--port`), or undefined. */
+    configPort: number | undefined;
+    /** Raw `process.env.PORT` value. */
+    envPort: string | undefined;
+    /** ListenFn for the holding server (or any pre-bind probe target). */
+    listen: ListenFn;
+    /** Logger — defaults to `console`. Injected for tests. */
+    log?: (msg: string) => void;
+    warn?: (msg: string) => void;
+}
+export interface StartDevServerPortResult {
+    /** Port chosen for both the holding server and Vite's dev server. */
+    port: number;
+    /** True if the user explicitly set the port (=> Vite must `strictPort: true`). */
+    explicit: boolean;
+    /** True if the holding server actually bound the port. */
+    bound: boolean;
+}
+/**
+ * Run the full dev-server port resolution + holding-server bind sequence.
+ *
+ * Resolves the port from config / env / default, attempts to bind the
+ * holding server (auto-bumping when the port came from the default),
+ * and logs the chosen URL. On a clean failure for an explicit port, it
+ * warns and falls back to the requested port so Vite can surface the
+ * conflict via `strictPort: true`.
+ *
+ * Extracted from `index.ts` so the rootSync `config()` hook stays
+ * focused on plugin assembly.
+ */
+export declare function startDevServerPort(input: StartDevServerPortInput): Promise<StartDevServerPortResult>;
+//# sourceMappingURL=port-resolution.d.ts.map

package/dist/server/port-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-resolution.d.ts","sourceRoot":"","sources":["../../src/server/port-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8DAA8D;AAC9D,eAAO,MAAM,YAAY,OAAO,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAIzD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CAiB3E;AAID,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIjD;AAID,MAAM,WAAW,uBAAuB;IACtC,gFAAgF;IAChF,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oCAAoC;IACpC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,sEAAsE;IACtE,MAAM,EAAE,QAAQ,CAAC;IACjB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAqCnC"}

package/dist/server/request-context.d.ts

@@ -1,13 +1,17 @@
 /**
- * Request Context — per-request ALS store for getHeaders() and getCookies().
+ * Request Context — per-request ALS store for headers, search params,
+ * segment params, and request scope lifecycle.
  *
  * Follows the same pattern as tracing.ts: a module-level AsyncLocalStorage
  * instance, public accessor functions that throw outside request scope,
  * and a framework-internal `runWithRequestContext()` to establish scope.
  *
+ * Cookie state lives in `cookie-context.ts` (split out in TIM-853). The
+ * scope set up here owns the cookie jar / parsedCookies fields on the
+ * store, but the cookie API and helpers are in the cookie module.
+ *
  * See design/04-authorization.md §"AccessContext does not include cookies or headers"
  * and design/11-platform.md §"AsyncLocalStorage".
- * See design/29-cookies.md for cookie mutation semantics.
  */
 import { requestContextAls } from './als-registry.js';
 export { requestContextAls };
@@ -17,97 +21,28 @@ export { requestContextAls };
  * Available in middleware, access checks, server components, and server actions.
  * Throws if called outside a request context (security principle #2: no global fallback).
  */
-export declare function getHeaders(): Promise<ReadonlyHeaders>;
+export declare function getHeaders(): ReadonlyHeaders;
 /**
  * Returns the value of a single request header, or undefined if absent.
  *
- * Thin wrapper over `(await getHeaders()).get(name)` for the common
- * case where you need exactly one header.
- *
- * ```ts
- * import { getHeader } from '@timber-js/app/server'
+ * Thin wrapper over `getHeaders().get(name)` for the common case where
+ * you need exactly one header.
  *
- * export default async function Page() {
- *   const auth = await getHeader('authorization');
- * }
- * ```
+ * @internal — not part of the public API. Use `getHeaders().get(name)` instead.
  */
-export declare function getHeader(name: string): Promise<string | undefined>;
+export declare function getHeader(name: string): string | undefined;
 /**
- * Returns a cookie accessor for the current request.
- *
- * Available in middleware, access checks, server components, and server actions.
- * Throws if called outside a request context (security principle #2: no global fallback).
- *
- * Read methods (.get, .has, .getAll) are always available and reflect
- * read-your-own-writes from .set() calls in the same request.
- *
- * Mutation methods (.set, .delete, .clear) are only available in mutable
- * contexts (middleware.ts, server actions, route.ts handlers). Calling them
- * in read-only contexts (access.ts, server components) throws.
- *
- * See design/29-cookies.md
- */
-export declare function getCookies(): Promise<RequestCookies>;
-/**
- * Returns the value of a single cookie, or undefined if absent.
- *
- * Thin wrapper over `(await getCookies()).get(name)` for the common
- * case where you need exactly one cookie.
- *
- * ```ts
- * import { getCookie } from '@timber-js/app/server'
- *
- * export default async function Page() {
- *   const session = await getCookie('session_id');
- * }
- * ```
- */
-export declare function getCookie(name: string): Promise<string | undefined>;
-/**
- * Returns a Promise resolving to the current request's raw URLSearchParams.
- *
- * For typed, parsed search params, import the definition from params.ts
- * and call `.load()` or `.parse()`:
- *
- * ```ts
- * import { searchParams } from './params'
- * const parsed = await searchParams.get()
- * ```
+ * Returns the current request's raw URLSearchParams.
  *
- * Or explicitly:
- *
- * ```ts
- * import { getSearchParams } from '@timber-js/app/server'
- * import { searchParams } from './params'
- * const parsed = searchParams.parse(await getSearchParams())
- * ```
- *
- * Throws if called outside a request context.
+ * @internal — not part of the public API. Use `defineSearchParams().get()` instead.
  */
-export declare function getSearchParams(): Promise<URLSearchParams>;
+export declare function getSearchParams(): URLSearchParams;
 /**
- * Returns a Promise resolving to the current request's coerced segment params.
- *
- * Segment params are set by the pipeline after route matching and param
- * coercion (via params.ts codecs). When no params.ts exists, values are
- * raw strings. When codecs are defined, values are already coerced
- * (e.g., `id` is a `number` if `defineSegmentParams({ id: z.coerce.number() })`).
- *
- * This is the primary way page and layout components access route params:
- *
- * ```ts
- * import { getSegmentParams } from '@timber-js/app/server'
+ * Returns the current request's coerced segment params.
  *
- * export default async function Page() {
- *   const { slug } = await getSegmentParams()
- *   // ...
- * }
- * ```
- *
- * Throws if called outside a request context.
+ * @internal — not part of the public API. Use `defineSegmentParams().get()` instead.
  */
-export declare function getSegmentParams(): Promise<Record<string, string | string[]>>;
+export declare function getSegmentParams(): Record<string, string | string[]>;
 /**
  * Set the segment params promise on the current request context.
  * Called by the pipeline after route matching and param coercion.
@@ -131,68 +66,15 @@ export declare function getRequestSearchString(): string;
  * still a Headers instance, but user code should not mutate it.
  */
 export type ReadonlyHeaders = Pick<Headers, 'get' | 'has' | 'entries' | 'keys' | 'values' | 'forEach' | typeof Symbol.iterator>;
-/** Options for setting a cookie. See design/29-cookies.md. */
-export interface CookieOptions {
-    /** Domain scope. Default: omitted (current domain only). */
-    domain?: string;
-    /** URL path scope. Default: '/'. */
-    path?: string;
-    /** Expiration date. Mutually exclusive with maxAge. */
-    expires?: Date;
-    /** Max age in seconds. Mutually exclusive with expires. */
-    maxAge?: number;
-    /** Prevent client-side JS access. Default: true. */
-    httpOnly?: boolean;
-    /** Only send over HTTPS. Default: true. */
-    secure?: boolean;
-    /** Cross-site request policy. Default: 'lax'. */
-    sameSite?: 'strict' | 'lax' | 'none';
-    /** Partitioned (CHIPS) — isolate cookie per top-level site. Default: false. */
-    partitioned?: boolean;
-}
-/**
- * Cookie accessor returned by `getCookies()`.
- *
- * Read methods are always available. Mutation methods throw in read-only
- * contexts (access.ts, server components).
- */
-export interface RequestCookies {
-    /** Get a cookie value by name. Returns undefined if not present. */
-    get(name: string): string | undefined;
-    /** Check if a cookie exists. */
-    has(name: string): boolean;
-    /** Get all cookies as an array of { name, value } pairs. */
-    getAll(): Array<{
-        name: string;
-        value: string;
-    }>;
-    /** Number of cookies. */
-    readonly size: number;
-    /** Set a cookie. Only available in mutable contexts (middleware, actions, route handlers). */
-    set(name: string, value: string, options?: CookieOptions): void;
-    /**
-     * Copy all `Set-Cookie` headers from a `Headers` object.
-     * Parses each header and forwards name, value, and all attributes
-     * (path, domain, max-age, expires, sameSite, secure, httpOnly, partitioned).
-     *
-     * Useful when forwarding cookies from an internal `fetch()` or auth handler:
-     * ```ts
-     * const response = await auth.handler(req);
-     * getCookies().then(c => c.setFromHeaders(response.headers));
-     * ```
-     */
-    setFromHeaders(headers: Headers): void;
-    /** Delete a cookie. Only available in mutable contexts. */
-    delete(name: string, options?: Pick<CookieOptions, 'path' | 'domain'>): void;
-    /** Delete all cookies. Only available in mutable contexts. */
-    clear(): void;
-    /** Serialize cookies as a Cookie header string. */
-    toString(): string;
-}
 /**
  * Run a callback within a request context. Used by the pipeline to establish
  * per-request ALS scope so that `getHeaders()` and `getCookies()` work.
  *
+ * If the request was previously registered via `seedRequestCookies`, the
+ * resulting context's `parsedCookies` map is initialized from the seed and
+ * the raw `cookieHeader` is left empty — `parseCookieHeader` is never called
+ * for that request. This is the no-JS form-rerender path. See TIM-868.
+ *
  * @param req - The incoming Request object.
  * @param fn - The function to run within the request context.
  */
@@ -211,25 +93,6 @@ export declare function setMutableCookieContext(mutable: boolean): void;
  * See design/29-cookies.md §"Streaming Constraint: Post-Flush Cookie Warning"
  */
 export declare function markResponseFlushed(): void;
-/**
- * Build a Map of cookie name → value reflecting the current request's
- * read-your-own-writes state. Includes incoming cookies plus any
- * mutations from getCookies().set() / getCookies().delete() in the same request.
- *
- * Used by SSR renderers to populate NavContext.cookies so that
- * useCookie()'s server snapshot matches the actual response state.
- *
- * See design/29-cookies.md §"Read-Your-Own-Writes"
- * See design/triage/TIM-441-cookie-api-triage.md §4
- */
-export declare function getCookiesForSsr(): Map<string, string>;
-/**
- * Collect all Set-Cookie headers from the cookie jar.
- * Called by the framework at flush time to apply cookies to the response.
- *
- * Returns an array of serialized Set-Cookie header values.
- */
-export declare function getSetCookieHeaders(): string[];
 /**
  * Apply middleware-injected request headers to the current request context.
  *

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAA8C,MAAM,mBAAmB,CAAC;AAMlG,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAQ7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,CASrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGzE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAiHpD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGzE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,CAS1D;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAe7E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAEF,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2FD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,gCAAgC;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,2DAA2D;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,mDAAmD;IACnD,QAAQ,IAAI,MAAM,CAAC;CACpB;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAcrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAI9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mBAAmB,CAAC;AAQhF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAQ7B;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAS5C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CASjD;AAkBD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAepE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAMhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,OAAO,EACP,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,CACnF,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAmBrE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBhE"}

package/dist/server/route-element-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-element-builder.d.ts","sourceRoot":"","sources":["../../src/server/route-element-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAS7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAezD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAM7D;AAID;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAID,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5B,2CAA2C;IAC3C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,qCAAqC;IACrC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,MAAM,EAAE,UAAU,GAAG,cAAc;aACnC,gBAAgB,EAAE,oBAAoB,EAAE;aACxC,QAAQ,EAAE,mBAAmB,EAAE;gBAF/B,MAAM,EAAE,UAAU,GAAG,cAAc,EACnC,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,QAAQ,EAAE,mBAAmB,EAAE;CAIlD;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,YAAY,CAAC,EAAE,mBAAmB,EAClC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAmV7B"}
+{"version":3,"file":"route-element-builder.d.ts","sourceRoot":"","sources":["../../src/server/route-element-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAa7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAezD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAM7D;AAID;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAID,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5B,2CAA2C;IAC3C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,qCAAqC;IACrC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,MAAM,EAAE,UAAU,GAAG,cAAc;aACnC,gBAAgB,EAAE,oBAAoB,EAAE;aACxC,QAAQ,EAAE,mBAAmB,EAAE;gBAF/B,MAAM,EAAE,UAAU,GAAG,cAAc,EACnC,gBAAgB,EAAE,oBAAoB,EAAE,EACxC,QAAQ,EAAE,mBAAmB,EAAE;CAIlD;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,YAAY,CAAC,EAAE,mBAAmB,EAClC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAmV7B"}

package/dist/server/route-matcher.d.ts

@@ -8,58 +8,32 @@
  * See design/07-routing.md §"Request Lifecycle"
  */
 import type { RouteMatch } from './pipeline.js';
+import type { SegmentNode, RouteTree } from '../routing/types.js';
 import { type MetadataRouteType } from './metadata-routes.js';
 /** A file reference in the manifest (lazy import + path). */
-interface ManifestFile {
+export interface ManifestFile {
     load: () => Promise<unknown>;
     filePath: string;
 }
-/** A segment node as it appears in the virtual:timber-route-manifest module. */
-export interface ManifestSegmentNode {
-    segmentName: string;
-    segmentType: 'static' | 'dynamic' | 'catch-all' | 'optional-catch-all' | 'group' | 'slot' | 'intercepting';
-    urlPath: string;
-    paramName?: string;
-    /** For intercepting segments: the marker used, e.g. "(.)". */
-    interceptionMarker?: '(.)' | '(..)' | '(...)' | '(..)(..)';
-    /** For intercepting segments: the segment name after stripping the marker. */
-    interceptedSegmentName?: string;
-    page?: ManifestFile;
-    layout?: ManifestFile;
-    middleware?: ManifestFile;
-    access?: ManifestFile;
-    route?: ManifestFile;
-    /** params.ts — isomorphic convention file for segmentParams + searchParams definitions. */
-    params?: ManifestFile;
-    error?: ManifestFile;
-    default?: ManifestFile;
-    denied?: ManifestFile;
-    statusFiles?: Record<string, ManifestFile>;
-    jsonStatusFiles?: Record<string, ManifestFile>;
-    legacyStatusFiles?: Record<string, ManifestFile>;
-    /** Metadata route files (sitemap.ts, robots.ts, icon.tsx, etc.) keyed by base name */
-    metadataRoutes?: Record<string, ManifestFile>;
-    children: ManifestSegmentNode[];
-    slots: Record<string, ManifestSegmentNode>;
-}
-/** The manifest shape from virtual:timber-route-manifest. */
-export interface ManifestRoot {
-    root: ManifestSegmentNode;
-    /**
-     * Absolute path to the Vite project root, captured at build/load time.
-     * Used by dev-only features (e.g., dev error page frame classification)
-     * that need a correct project root even when CWD differs (e.g., monorepo
-     * custom root). See TIM-807 / TIM-808.
-     */
+/**
+ * A segment node as it appears in the virtual:timber-route-manifest module.
+ *
+ * Type alias for `SegmentNode<ManifestFile>` — the same shape used by the
+ * scanner, only with lazy `load` functions instead of build-time extension
+ * metadata.
+ */
+export type ManifestSegmentNode = SegmentNode<ManifestFile>;
+/**
+ * The manifest shape from virtual:timber-route-manifest.
+ *
+ * Extends `RouteTree<ManifestFile>` with `viteRoot`, the absolute path
+ * to the Vite project root captured at build/load time. Used by dev-only
+ * features (e.g., dev error page frame classification) that need a
+ * correct project root even when CWD differs (e.g., monorepo custom root).
+ * See TIM-807 / TIM-808.
+ */
+export interface ManifestRoot extends RouteTree<ManifestFile> {
     viteRoot: string;
-    proxy?: ManifestFile;
-    /**
-     * Global error page: app/global-error.{tsx,ts,jsx,js}
-     * Tier 2 — standalone full-page replacement (no layouts) when no
-     * segment-level error file is found. SSR-only render.
-     * See design/10-error-handling.md §"Tier 2"
-     */
-    globalError?: ManifestFile;
 }
 /**
  * Create a route matcher function from a manifest.
@@ -93,5 +67,4 @@ export interface MetadataRouteMatch {
  * See design/16-metadata.md §"Metadata Routes"
  */
 export declare function createMetadataRouteMatcher(manifest: ManifestRoot): (pathname: string) => MetadataRouteMatch | null;
-export {};
 //# sourceMappingURL=route-matcher.d.ts.map

package/dist/server/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAM9B,6DAA6D;AAC7D,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EACP,QAAQ,GACR,SAAS,GACT,WAAW,GACX,oBAAoB,GACpB,OAAO,GACP,MAAM,GACN,cAAc,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3D,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC5C;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,mBAAmB,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;CAC5B;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AAyMD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAMjD"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../../src/server/route-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAW9B,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS,CAAC,YAAY,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAEzC;AAuMD,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,iBAAiB,CAAC;IACxB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,GAAG,IAAI,CAMjD"}

package/dist/server/rsc-entry/action-middleware-runner.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Middleware-on-actions runner — runs the matched route's `middleware.ts`
+ * chain for an action POST inside its own `runWithRequestContext` scope
+ * and returns a `MiddlewareOutcome` value the dispatcher can translate.
+ *
+ * Lifted out of `wrap-action-dispatch.ts` (TIM-853) so the dispatcher
+ * can be read top-to-bottom without scrolling past the chain runner. The
+ * function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. It does not import virtual
+ * modules and does not call into the action handler — it owns exactly
+ * the "run middleware once" step and nothing else.
+ *
+ * Failure modes are encoded as outcome variants rather than thrown so the
+ * caller never has to wrap this in try/catch. The only thrown errors are
+ * truly unexpected (programmer bugs) and propagate naturally.
+ *
+ * See TIM-871 for the full design rationale (closing the
+ * CVE-2025-29927-class bug where actions silently bypass middleware).
+ */
+import { DenySignal, RedirectSignal } from '../primitives.js';
+import type { RouteMatch } from '../pipeline.js';
+/** Coerce a matched route's segment params via its `params.ts` codecs. */
+export type CoerceSegmentParamsFn = (match: RouteMatch) => Promise<void>;
+/**
+ * Outcome of running middleware on an action request, surfaced from the
+ * inner `runWithRequestContext` scope so the outer dispatcher can convert
+ * it to a Response (short-circuit) or continue to the action handler.
+ *
+ * Each variant carries the post-middleware Set-Cookie snapshot so the
+ * outer scope can apply cookies to whichever Response it ultimately
+ * returns. The middleware ALS scope ends before the action ALS scope
+ * begins, so cookie state must be threaded explicitly across the boundary
+ * via `seedRequestCookies` (cookie reads) and `setCookieHeaders` (cookie
+ * writes).
+ */
+export type MiddlewareOutcome = {
+    kind: 'continue';
+    overlay: Headers;
+    cookies: Map<string, string>;
+    setCookieHeaders: string[];
+} | {
+    kind: 'short-circuit';
+    response: Response;
+    setCookieHeaders: string[];
+} | {
+    kind: 'redirect';
+    signal: RedirectSignal;
+    setCookieHeaders: string[];
+} | {
+    kind: 'deny';
+    signal: DenySignal;
+    match: RouteMatch;
+    setCookieHeaders: string[];
+} | {
+    kind: 'param-coercion-error';
+} | {
+    kind: 'error';
+    error: unknown;
+};
+/**
+ * Run the matched route's middleware chain inside a fresh request-context
+ * scope, captured as a `MiddlewareOutcome` value the outer dispatcher can
+ * translate to a Response or use as the seed for the action handler.
+ */
+export declare function runMiddlewareForAction(req: Request, match: RouteMatch, coerceSegmentParams: CoerceSegmentParamsFn): Promise<MiddlewareOutcome>;
+//# sourceMappingURL=action-middleware-runner.d.ts.map

package/dist/server/rsc-entry/action-middleware-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-middleware-runner.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/action-middleware-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,0EAA0E;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,sBAAsB,CAAC;CAC9B,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEN;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,qBAAqB,GACzC,OAAO,CAAC,iBAAiB,CAAC,CA8E5B"}

package/dist/server/rsc-entry/helpers.d.ts

@@ -107,7 +107,7 @@ export declare function buildRedirectResponse(req: Request, signal: RedirectSign
  * is not an application error — suppress it from error boundaries and logs.
  */
 export declare function isAbortError(error: unknown): boolean;
-export declare function escapeHtml(str: string): string;
+export { escapeHtml } from '../utils/escape-html.js';
 /**
  * Parse a Cookie header string into a name→value Map.
  * Used to populate NavContext.cookies for SSR hooks (useCookie).

package/dist/server/rsc-entry/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,GACvB,QAAQ,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1E"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAQ/F;AAID;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,gBAAgB,IAAI,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,IAAI,mBAAmB,EAAE,CAAC;CACxC;AAED,wBAAgB,2BAA2B,IAAI,qBAAqB,CAkCnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8ClE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,KAAK,CAAC;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,GACvB,QAAQ,CAOV;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAGD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1E"}

package/dist/server/rsc-entry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AA0C/C,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAoCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAmnBD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;8BA7UrC,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;AA+UhD,wBAAiE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/index.ts"],"names":[],"mappings":"AAuBA,OAAO,uCAAuC,CAAC;AAiC/C,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AAgCtB;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,mBAAmB,EAAE,KAAK,IAAI,GACtF,IAAI,CAEN;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAE5E;AAqWD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;;AAE1D,wBAAiE"}

package/dist/server/rsc-entry/render-route.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Route renderer — turns a matched route into a Response.
+ *
+ * Extracted from `rsc-entry/index.ts` so the entry can stay focused on
+ * pipeline construction. This module owns the steps that happen *after*
+ * the pipeline has matched a route and before it commits a response:
+ * element-tree build, RSC Flight render, and dispatch to either the SSR
+ * HTML path or the RSC payload path. It also handles the
+ * synchronous-signal escape hatches (deny / redirect / render error
+ * thrown during stream creation) so the entry doesn't carry that logic.
+ *
+ * The function is parameterized over its dependencies — `clientBootstrap`,
+ * `clientJsDisabled`, `rootSegment`, `globalError` — so the entry passes
+ * them in once at handler-construction time and they ride along on every
+ * call. No globals, no closures over the entry's createRequestHandler
+ * scope.
+ *
+ * Design docs: 02-rendering-pipeline.md, 19-client-navigation.md.
+ */
+import type { BuildManifest } from '../build-manifest.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import type { InterceptionContext, RouteMatch } from '../pipeline.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+/**
+ * Static-per-handler dependencies for `renderRoute` — captured once at
+ * handler construction so each per-request call site only has to pass
+ * the request-specific arguments.
+ */
+export interface RenderRouteDeps {
+    clientBootstrap: ClientBootstrapConfig;
+    clientJsDisabled: boolean;
+    rootSegment: ManifestSegmentNode;
+    buildManifest: BuildManifest;
+    globalError?: {
+        load: () => Promise<unknown>;
+        filePath: string;
+    };
+}
+/**
+ * Render a matched route to an HTML Response via RSC → SSR pipeline,
+ * or return a raw RSC Flight stream for client-side navigation requests.
+ *
+ * 1. Load page/layout components from the segment chain
+ * 2. Resolve metadata
+ * 3. Render to RSC Flight stream (serializes "use client" as references)
+ * 4. If Accept: text/x-component → return RSC stream directly
+ *    Otherwise → pass RSC stream to SSR entry for HTML rendering
+ */
+export declare function renderRoute(req: Request, match: RouteMatch, responseHeaders: Headers, deps: RenderRouteDeps, interception?: InterceptionContext): Promise<Response>;
+//# sourceMappingURL=render-route.d.ts.map

package/dist/server/rsc-entry/render-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-route.d.ts","sourceRoot":"","sources":["../../../src/server/rsc-entry/render-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAU1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAkB/D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,qBAAqB,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,IAAI,EAAE,eAAe,EACrB,YAAY,CAAC,EAAE,mBAAmB,GACjC,OAAO,CAAC,QAAQ,CAAC,CA+NnB"}