hono-preact 0.2.0 → 0.3.0

package/dist/iso/internal/route-boundary.d.ts

@@ -1,6 +1,6 @@
 import { Component } from 'preact';
-import type { ComponentChildren, FunctionComponent, JSX } from 'preact';
-type ErrorFallback = JSX.Element | ((error: Error, reset: () => void) => JSX.Element);
+import type { ComponentChildren, FunctionComponent } from 'preact';
+type ErrorFallback = ComponentChildren | ((error: Error, reset: () => void) => ComponentChildren);
 type ErrorBoundaryProps = {
     fallback?: ErrorFallback;
     children: ComponentChildren;
@@ -16,10 +16,10 @@ export declare class ErrorBoundary extends Component<ErrorBoundaryProps, {
     };
     componentDidCatch(error: unknown): void;
     reset: () => void;
-    render(): ComponentChildren;
+    render(): any;
 }
 export declare const RouteBoundary: FunctionComponent<{
-    fallback?: JSX.Element;
+    fallback?: ComponentChildren;
     errorFallback?: ErrorFallback;
     children: ComponentChildren;
 }>;

package/dist/iso/internal/safe-redirect.d.ts

@@ -0,0 +1,7 @@
+export declare function isSameOrigin(target: string): boolean;
+/**
+ * Navigate to `target` only when it resolves same-origin against the current
+ * window. Cross-origin targets log a console error and are not followed.
+ * Returns true when the navigation was issued.
+ */
+export declare function assignSafeRedirect(target: string): boolean;

package/dist/iso/internal/safe-redirect.js

@@ -0,0 +1,27 @@
+export function isSameOrigin(target) {
+    if (typeof window === 'undefined')
+        return true;
+    try {
+        // Relative URLs resolve against the current origin and are always same-origin.
+        const resolved = new URL(target, window.location.href);
+        return resolved.origin === window.location.origin;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Navigate to `target` only when it resolves same-origin against the current
+ * window. Cross-origin targets log a console error and are not followed.
+ * Returns true when the navigation was issued.
+ */
+export function assignSafeRedirect(target) {
+    if (typeof window === 'undefined')
+        return false;
+    if (!isSameOrigin(target)) {
+        console.error(`[hono-preact] refusing to navigate to cross-origin redirect target: ${target}`);
+        return false;
+    }
+    window.location.assign(target);
+    return true;
+}

package/dist/iso/internal/sse-decoder.d.ts

@@ -2,4 +2,4 @@ export type SSEEvent = {
     event: string;
     data: string;
 };
-export declare function readSSE(stream: ReadableStream<Uint8Array>): AsyncGenerator<SSEEvent, void, unknown>;
+export declare function readSSE(stream: ReadableStream<BufferSource>): AsyncGenerator<SSEEvent, void, unknown>;

package/dist/iso/internal/sse-decoder.js

@@ -1,39 +1,53 @@
-export async function* readSSE(stream) {
-    const reader = stream.getReader();
-    const decoder = new TextDecoder();
+function lineSplitTransform() {
     let buffer = '';
+    return new TransformStream({
+        transform(chunk, controller) {
+            buffer += chunk;
+            let nl;
+            while ((nl = buffer.indexOf('\n')) !== -1) {
+                controller.enqueue(buffer.slice(0, nl).replace(/\r$/, ''));
+                buffer = buffer.slice(nl + 1);
+            }
+        },
+        flush(controller) {
+            if (buffer.length) {
+                controller.enqueue(buffer.replace(/\r$/, ''));
+                buffer = '';
+            }
+        },
+    });
+}
+export async function* readSSE(stream) {
+    const lines = stream
+        .pipeThrough(new TextDecoderStream())
+        .pipeThrough(lineSplitTransform());
     let event = 'message';
     let dataLines = [];
+    const reader = lines.getReader();
     try {
         while (true) {
-            const { done, value } = await reader.read();
+            const { done, value: line } = await reader.read();
             if (done) {
-                buffer += decoder.decode();
-                if (dataLines.length)
+                if (dataLines.length) {
                     yield { event, data: dataLines.join('\n') };
+                }
                 return;
             }
-            buffer += decoder.decode(value, { stream: true });
-            let nl;
-            while ((nl = buffer.indexOf('\n')) !== -1) {
-                const line = buffer.slice(0, nl).replace(/\r$/, '');
-                buffer = buffer.slice(nl + 1);
-                if (line === '') {
-                    if (dataLines.length) {
-                        yield { event, data: dataLines.join('\n') };
-                    }
-                    event = 'message';
-                    dataLines = [];
-                }
-                else if (line.startsWith(':')) {
-                    // SSE comment / keepalive, ignore
-                }
-                else if (line.startsWith('event:')) {
-                    event = line.slice(6).trim();
-                }
-                else if (line.startsWith('data:')) {
-                    dataLines.push(line.slice(5).replace(/^ /, ''));
+            if (line === '') {
+                if (dataLines.length) {
+                    yield { event, data: dataLines.join('\n') };
                 }
+                event = 'message';
+                dataLines = [];
+            }
+            else if (line.startsWith(':')) {
+                // SSE comment / keepalive, ignore
+            }
+            else if (line.startsWith('event:')) {
+                event = line.slice(6).trim();
+            }
+            else if (line.startsWith('data:')) {
+                dataLines.push(line.slice(5).replace(/^ /, ''));
             }
         }
     }

package/dist/iso/internal.d.ts

@@ -2,11 +2,12 @@ export { Loader } from './internal/loader.js';
 export { Envelope } from './internal/envelope.js';
 export { RouteBoundary } from './internal/route-boundary.js';
 export { OptimisticOverlay } from './internal/optimistic-overlay.js';
+export { serializeActionOutcome, type ActionEnvelope, type ActionResolution, type SerializedEnvelope, } from './internal/action-envelope.js';
 export { LoaderIdContext, LoaderDataContext } from './internal/contexts.js';
 export { ReloadContext } from './reload-context.js';
 export { RouteLocationsContext, RouteLocationsProvider, } from './internal/route-locations.js';
 export { getPreloadedData, deletePreloadedData } from './internal/preload.js';
-export { runRequestScope, getRequestStore, captureRequestScope, } from './cache.js';
+export { runRequestScope, getRequestStore, captureRequestScope, getActionResultSlot, setActionResultSlot, type ActionResultSlot, } from './cache.js';
 export { default as wrapPromise } from './internal/wrap-promise.js';
 export { HonoRequestContext } from './internal/contexts.js';
 export { PageMiddlewareHost } from './internal/page-middleware-host.js';
@@ -14,7 +15,12 @@ export { __dispatchRouteChange, __subscribeRouteChange, } from './internal/route
 export { installStreamRegistry, subscribeToLoaderStream, } from './internal/stream-registry.js';
 export { registerServerStreamingLoader, takeServerStreamingLoaders, } from './internal/streaming-ssr.js';
 export type { ServerLoaderStream } from './internal/streaming-ssr.js';
+export { beginSubmit, endSubmit, isPending, subscribe as subscribeFormSubmit, } from './internal/form-submit-store.js';
+export { assignSafeRedirect, isSameOrigin } from './internal/safe-redirect.js';
+export { setLastActionResult, clearLastActionResult, getLastActionResult, subscribeActionResults, type StoredActionResult, } from './internal/action-result-store.js';
 export { dispatchServer, dispatchClient, type DispatchResult, } from './internal/middleware-runner.js';
 export { partitionUse } from './internal/use-partitioner.js';
 export { fanStart, fanChunk, fanEnd, fanError, fanAbort, } from './internal/stream-observer-runner.js';
 export { __$createLoaderStub_hpiso } from './internal/loader-stub.js';
+export { readSSE } from './internal/sse-decoder.js';
+export type { SSEEvent } from './internal/sse-decoder.js';

package/dist/iso/internal.js

@@ -28,17 +28,21 @@ export { Loader } from './internal/loader.js';
 export { Envelope } from './internal/envelope.js';
 export { RouteBoundary } from './internal/route-boundary.js';
 export { OptimisticOverlay } from './internal/optimistic-overlay.js';
+export { serializeActionOutcome, } from './internal/action-envelope.js';
 export { LoaderIdContext, LoaderDataContext } from './internal/contexts.js';
 export { ReloadContext } from './reload-context.js';
 export { RouteLocationsContext, RouteLocationsProvider, } from './internal/route-locations.js';
 export { getPreloadedData, deletePreloadedData } from './internal/preload.js';
-export { runRequestScope, getRequestStore, captureRequestScope, } from './cache.js';
+export { runRequestScope, getRequestStore, captureRequestScope, getActionResultSlot, setActionResultSlot, } from './cache.js';
 export { default as wrapPromise } from './internal/wrap-promise.js';
 export { HonoRequestContext } from './internal/contexts.js';
 export { PageMiddlewareHost } from './internal/page-middleware-host.js';
 export { __dispatchRouteChange, __subscribeRouteChange, } from './internal/route-change.js';
 export { installStreamRegistry, subscribeToLoaderStream, } from './internal/stream-registry.js';
 export { registerServerStreamingLoader, takeServerStreamingLoaders, } from './internal/streaming-ssr.js';
+export { beginSubmit, endSubmit, isPending, subscribe as subscribeFormSubmit, } from './internal/form-submit-store.js';
+export { assignSafeRedirect, isSameOrigin } from './internal/safe-redirect.js';
+export { setLastActionResult, clearLastActionResult, getLastActionResult, subscribeActionResults, } from './internal/action-result-store.js';
 // Middleware dispatcher + observer fanout. Internal-stability subpath.
 export { dispatchServer, dispatchClient, } from './internal/middleware-runner.js';
 export { partitionUse } from './internal/use-partitioner.js';
@@ -49,3 +53,6 @@ export { fanStart, fanChunk, fanEnd, fanError, fanAbort, } from './internal/stre
 // (serverOnlyPlugin's loader stubs, guardStripPlugin's no-op replacement).
 // User code that imports them couples to plugin internals.
 export { __$createLoaderStub_hpiso } from './internal/loader-stub.js';
+// SSE decoder; useful in tests and advanced consumers that need to read
+// a streaming loader/action response as a sequence of typed SSE events.
+export { readSSE } from './internal/sse-decoder.js';

package/dist/iso/optimistic-action.d.ts

@@ -1,14 +1,23 @@
 import { type UseActionOptions, type UseActionResult, type ActionStub } from './action.js';
+import { type OptimisticHandle } from './optimistic.js';
 import type { LoaderRef } from './define-loader.js';
+export declare const OPTIMISTIC_BRAND: unique symbol;
+export type OptimisticBinding<TPayload, TBase> = {
+    apply: (current: TBase, payload: TPayload) => TBase;
+    addOptimistic: (payload: TPayload) => OptimisticHandle;
+};
 export type UseOptimisticActionOptions<TPayload, TResult, TBase, TChunk = never> = Omit<UseActionOptions<TPayload, TResult, TChunk>, 'invalidate' | 'onMutate' | 'onError' | 'onSuccess'> & {
     base: TBase;
     apply: (current: TBase, payload: TPayload) => TBase;
     invalidate?: 'auto' | ReadonlyArray<LoaderRef<unknown>>;
     onSuccess?: (data: TResult) => void;
     onError?: (err: Error) => void;
+    /** Forwarded to the internal `useOptimistic` call. */
+    transition?: boolean;
 };
-export type UseOptimisticActionResult<TPayload, TResult, TBase> = UseActionResult<TPayload, TResult> & {
+export type UseOptimisticActionResult<TPayload, TResult, TBase> = ActionStub<TPayload, TResult, never> & UseActionResult<TPayload, TResult> & {
     value: TBase;
+    readonly [OPTIMISTIC_BRAND]: OptimisticBinding<TPayload, TBase>;
 };
 /**
  * Like `useAction`, but with an optimistic-update wrapper. `TChunk` defaults

package/dist/iso/optimistic-action.js

@@ -1,5 +1,6 @@
 import { useAction, } from './action.js';
 import { useOptimistic } from './optimistic.js';
+export const OPTIMISTIC_BRAND = Symbol('hono-preact.optimistic');
 /**
  * Like `useAction`, but with an optimistic-update wrapper. `TChunk` defaults
  * to `never` so existing non-streaming call sites are unaffected. Pass the
@@ -7,8 +8,8 @@ import { useOptimistic } from './optimistic.js';
  * when the action is streaming and you need a typed `onChunk` callback.
  */
 export function useOptimisticAction(stub, options) {
-    const { base, apply, onSuccess, onError, ...actionOpts } = options;
-    const [value, addOptimistic] = useOptimistic(base, apply);
+    const { base, apply, onSuccess, onError, transition, ...actionOpts } = options;
+    const [value, addOptimistic] = useOptimistic(base, apply, { transition });
     const action = useAction(stub, {
         ...actionOpts,
         onMutate: (payload) => addOptimistic(payload),
@@ -21,5 +22,12 @@ export function useOptimisticAction(stub, options) {
             onError?.(err);
         },
     });
-    return { ...action, value };
+    return {
+        __module: stub.__module,
+        __action: stub.__action,
+        useAction: stub.useAction,
+        ...action,
+        value,
+        [OPTIMISTIC_BRAND]: { apply, addOptimistic },
+    };
 }

package/dist/iso/optimistic.d.ts

@@ -2,4 +2,13 @@ export type OptimisticHandle = {
     settle: () => void;
     revert: () => void;
 };
-export declare function useOptimistic<TBase, TPayload>(base: TBase, reducer: (current: TBase, payload: TPayload) => TBase): [TBase, (payload: TPayload) => OptimisticHandle];
+export type UseOptimisticOptions = {
+    /**
+     * When true, the settle and revert paths are wrapped in
+     * `document.startViewTransition`. The initial optimistic update is never
+     * wrapped (it must paint same-frame). Falls back to a synchronous update
+     * when `document.startViewTransition` is unavailable.
+     */
+    transition?: boolean;
+};
+export declare function useOptimistic<TBase, TPayload>(base: TBase, reducer: (current: TBase, payload: TPayload) => TBase, options?: UseOptimisticOptions): [TBase, (payload: TPayload) => OptimisticHandle];

package/dist/iso/optimistic.js

@@ -1,14 +1,50 @@
 import { useCallback, useReducer, useRef } from 'preact/hooks';
-export function useOptimistic(base, reducer) {
+export function useOptimistic(base, reducer, options) {
     const queueRef = useRef([]);
     const lastBaseRef = useRef(base);
     const idRef = useRef(0);
     const [, forceRender] = useReducer((c) => c + 1, 0);
+    const transitionRef = useRef(options?.transition === true);
+    transitionRef.current = options?.transition === true;
     if (!Object.is(lastBaseRef.current, base)) {
         queueRef.current = queueRef.current.filter((e) => e.status !== 'ready');
         lastBaseRef.current = base;
     }
     const value = queueRef.current.reduce((acc, e) => reducer(acc, e.payload), base);
+    // Reads `transitionRef.current` at invocation time, not capture time, so it
+    // is safe to close over from the memoized `addOptimistic` (useCallback([]))
+    // below. Each render rebinds this function and writes the latest option
+    // value into the ref; settle/revert created by the stale memoized callback
+    // still see the up-to-date `transition` setting through the ref.
+    //
+    // The callback returns a promise that resolves on the next animation frame
+    // so the browser snapshots Preact's POST-render DOM as "new state". Without
+    // the rAF wait, `forceRender()` (an async dispatch through useReducer) has
+    // not yet flushed when `startViewTransition` snapshots, and the transition
+    // captures identical before/after frames with no visible animation.
+    const runWithTransition = (mutator) => {
+        if (transitionRef.current &&
+            typeof document !== 'undefined' &&
+            typeof document.startViewTransition === 'function') {
+            document.startViewTransition(async () => {
+                mutator();
+                await new Promise((resolve) => {
+                    if (typeof requestAnimationFrame === 'function') {
+                        requestAnimationFrame(() => resolve());
+                    }
+                    else {
+                        // Non-DOM environment (shouldn't reach this branch given the
+                        // outer check, but defensive). Resolve on next microtask so
+                        // Preact's scheduled render runs.
+                        queueMicrotask(resolve);
+                    }
+                });
+            });
+        }
+        else {
+            mutator();
+        }
+    };
     const addOptimistic = useCallback((payload) => {
         const id = ++idRef.current;
         queueRef.current = [...queueRef.current, { id, payload, status: 'active' }];
@@ -17,13 +53,17 @@ export function useOptimistic(base, reducer) {
             settle: () => {
                 const entry = queueRef.current.find((e) => e.id === id);
                 if (entry && entry.status === 'active') {
-                    entry.status = 'ready';
-                    forceRender();
+                    runWithTransition(() => {
+                        entry.status = 'ready';
+                        forceRender();
+                    });
                 }
             },
             revert: () => {
-                queueRef.current = queueRef.current.filter((e) => e.id !== id);
-                forceRender();
+                runWithTransition(() => {
+                    queueRef.current = queueRef.current.filter((e) => e.id !== id);
+                    forceRender();
+                });
             },
         };
     }, []);

package/dist/iso/outcomes.d.ts

@@ -13,12 +13,17 @@ export type DenyOutcome = {
     status: ErrorStatusCode;
     message: string;
     headers: Record<string, string> | undefined;
+    data?: unknown;
 };
 export type RenderOutcome = {
     __outcome: 'render';
     Component: FunctionComponent;
 };
-export type Outcome = RedirectOutcome | DenyOutcome | RenderOutcome;
+export type TimeoutOutcome = {
+    __outcome: 'timeout';
+    timeoutMs: number;
+};
+export type Outcome = RedirectOutcome | DenyOutcome | RenderOutcome | TimeoutOutcome;
 type RedirectInput = string | {
     to: string;
     status?: RedirectStatusCode;
@@ -29,10 +34,17 @@ type DenyInput = {
     status: ErrorStatusCode;
     message?: string;
     headers?: Record<string, string>;
+    data?: unknown;
+};
+type DenyOpts = {
+    headers?: Record<string, string>;
+    data?: unknown;
 };
-export declare function deny(status: ErrorStatusCode, message?: string): DenyOutcome;
+export declare function deny(status: ErrorStatusCode, message?: string, opts?: DenyOpts): DenyOutcome;
 export declare function deny(spec: DenyInput): DenyOutcome;
 export declare function isOutcome(value: unknown): value is Outcome;
 export declare function isRedirect(value: unknown): value is RedirectOutcome;
 export declare function isDeny(value: unknown): value is DenyOutcome;
 export declare function isRender(value: unknown): value is RenderOutcome;
+export declare function timeoutOutcome(timeoutMs: number): TimeoutOutcome;
+export declare function isTimeout(value: unknown): value is TimeoutOutcome;

package/dist/iso/outcomes.js

@@ -14,7 +14,7 @@ export function redirect(input) {
         headers: input.headers,
     };
 }
-export function deny(a, b) {
+export function deny(a, b, c) {
     // `JSON.stringify` drops `undefined` properties, so a deny outcome with no
     // message would arrive at the client without a `message` field and the
     // client decoders would fall back to a generic "Loader/Action failed with
@@ -28,13 +28,15 @@ export function deny(a, b) {
             status: a.status,
             message: a.message ?? `Request denied (${a.status})`,
             headers: a.headers,
+            ...(a.data !== undefined ? { data: a.data } : {}),
         };
     }
     return {
         __outcome: 'deny',
         status: a,
         message: b ?? `Request denied (${a})`,
-        headers: undefined,
+        headers: c?.headers,
+        ...(c?.data !== undefined ? { data: c.data } : {}),
     };
 }
 export function isOutcome(value) {
@@ -43,7 +45,10 @@ export function isOutcome(value) {
     if (!('__outcome' in value))
         return false;
     const tag = value.__outcome;
-    return tag === 'redirect' || tag === 'deny' || tag === 'render';
+    return (tag === 'redirect' ||
+        tag === 'deny' ||
+        tag === 'render' ||
+        tag === 'timeout');
 }
 export function isRedirect(value) {
     return isOutcome(value) && value.__outcome === 'redirect';
@@ -54,3 +59,9 @@ export function isDeny(value) {
 export function isRender(value) {
     return isOutcome(value) && value.__outcome === 'render';
 }
+export function timeoutOutcome(timeoutMs) {
+    return { __outcome: 'timeout', timeoutMs };
+}
+export function isTimeout(value) {
+    return isOutcome(value) && value.__outcome === 'timeout';
+}

package/dist/iso/use-action-result.d.ts

@@ -0,0 +1,25 @@
+import type { ActionStub } from './action.js';
+export type ActionResult<TPayload, TResult> = {
+    kind: 'success';
+    data: TResult;
+    submittedPayload: TPayload;
+} | {
+    kind: 'deny';
+    status: number;
+    message: string;
+    data?: unknown;
+    /**
+     * The payload as parsed from the request. For form submissions, this is
+     * a `Record<string, FormDataEntryValue | FormDataEntryValue[]>` where
+     * each value is a string or File (never a parsed primitive like `number`
+     * or `boolean`). The `TPayload` typing reflects the dev-declared shape,
+     * not the runtime structural shape. Read individual fields knowing they
+     * arrive as form-data entries.
+     */
+    submittedPayload: TPayload;
+} | {
+    kind: 'error';
+    message: string;
+    submittedPayload: TPayload | null;
+} | null;
+export declare function useActionResult<TPayload = unknown, TResult = unknown>(stub?: ActionStub<TPayload, TResult, never>): ActionResult<TPayload, TResult>;

package/dist/iso/use-action-result.js

@@ -0,0 +1,39 @@
+import { useContext } from 'preact/hooks';
+import { useSyncExternalStore } from 'preact/compat';
+import { ActionResultContext } from './action-result-context.js';
+import { getLastActionResult, subscribeActionResults, } from './internal/action-result-store.js';
+import { isBrowser } from './is-browser.js';
+export function useActionResult(stub) {
+    const ssr = useContext(ActionResultContext);
+    const client = useSyncExternalStore(subscribeActionResults, () => isBrowser() ? getLastActionResult(stub) : null);
+    // Client store wins when populated: a JS-on submit has produced a result.
+    // SSR context is the fallback for the PE deny re-render path (no JS state).
+    const source = client ?? ssr;
+    if (!source)
+        return null;
+    if (stub &&
+        (source.module !== stub.__module || source.action !== stub.__action)) {
+        return null;
+    }
+    if (source.kind === 'success') {
+        return {
+            kind: 'success',
+            data: source.data,
+            submittedPayload: source.submittedPayload,
+        };
+    }
+    if (source.kind === 'deny') {
+        return {
+            kind: 'deny',
+            status: source.status,
+            message: source.message,
+            data: source.data,
+            submittedPayload: source.submittedPayload,
+        };
+    }
+    return {
+        kind: 'error',
+        message: source.message,
+        submittedPayload: source.submittedPayload,
+    };
+}

package/dist/iso/use-form-status.d.ts

@@ -0,0 +1,5 @@
+import type { ActionStub } from './action.js';
+export type FormStatus = {
+    pending: boolean;
+};
+export declare function useFormStatus<TPayload = unknown, TResult = unknown>(stub?: ActionStub<TPayload, TResult, never>): FormStatus;

package/dist/iso/use-form-status.js

@@ -0,0 +1,13 @@
+import { useSyncExternalStore } from 'preact/compat';
+import { isPending, subscribe } from './internal/form-submit-store.js';
+import { isBrowser } from './is-browser.js';
+// Generic over the stub's payload/result so callers can pass any
+// `ActionStub<TPayload, TResult, never>` without contravariant-position
+// assignment errors. The hook only reads `__module` and `__action`.
+export function useFormStatus(stub) {
+    // preact/compat (10.29) ships only the 2-arg signature of useSyncExternalStore.
+    // The SSR "always idle" behavior that React 18's getServerSnapshot would
+    // provide is achieved via the isBrowser() guard inside getSnapshot.
+    const pending = useSyncExternalStore(subscribe, () => isBrowser() ? isPending(stub) : false);
+    return { pending };
+}

package/dist/server/actions-handler.d.ts

@@ -42,6 +42,13 @@ export interface ActionsHandlerOptions {
      * awaits the result either way. Default returns an empty array.
      */
     resolvePageUse?: (moduleKey: string) => ReadonlyArray<unknown> | Promise<ReadonlyArray<unknown>>;
+    /**
+     * Default action timeout in milliseconds applied when an action does not
+     * declare its own `timeoutMs`. Defaults to 30000 (30 seconds). Pass
+     * `false` to disable the default (only action-level `timeoutMs` enforces
+     * a deadline).
+     */
+    defaultTimeoutMs?: number | false;
 }
 export declare function actionsHandler(glob: LazyGlob | EagerGlob, opts?: ActionsHandlerOptions): MiddlewareHandler;
 export {};

package/dist/server/actions-handler.js

@@ -1,4 +1,4 @@
-import { isOutcome, } from '../iso/index.js';
+import { isOutcome, timeoutOutcome, } from '../iso/index.js';
 import { runRequestScope, dispatchServer, partitionUse, } from '../iso/internal.js';
 import { sseGeneratorResponse, sseReadableStreamResponse, isAsyncGenerator, } from './sse.js';
 async function buildActionsMap(glob) {
@@ -8,11 +8,25 @@ async function buildActionsMap(glob) {
             ? await moduleOrLoader()
             : moduleOrLoader;
         const key = mod.__moduleKey;
-        if (typeof key === 'string' && mod.serverActions) {
-            result[key] = {
-                actions: mod.serverActions,
+        if (typeof key !== 'string' || !mod.serverActions)
+            continue;
+        const actions = {};
+        for (const [name, val] of Object.entries(mod.serverActions)) {
+            if (typeof val !== 'function')
+                continue;
+            // `defineAction` attaches `use` and `timeoutMs` as non-enumerable
+            // properties on the function (see `packages/iso/src/action.ts`). The
+            // structural read below is the single deserialization boundary; the
+            // handler body reads `entry.fn`, `entry.use`, `entry.timeoutMs`
+            // directly through the typed `ActionEntry` shape from here on.
+            const metadata = val;
+            actions[name] = {
+                fn: val,
+                use: metadata.use ?? [],
+                timeoutMs: metadata.timeoutMs,
             };
         }
+        result[key] = { actions };
     }
     return result;
 }
@@ -39,6 +53,9 @@ function translateOutcomeForAction(c, outcome) {
         }
         return c.json({ __outcome: 'deny', message: outcome.message }, outcome.status);
     }
+    if (outcome.__outcome === 'timeout') {
+        return c.json({ __outcome: 'timeout', timeoutMs: outcome.timeoutMs }, 504);
+    }
     // render outcome should never reach the action RPC.
     return c.json({
         __outcome: 'error',
@@ -46,7 +63,7 @@ function translateOutcomeForAction(c, outcome) {
     }, 500);
 }
 export function actionsHandler(glob, opts = {}) {
-    const { dev = false, onError, appConfig, resolvePageUse } = opts;
+    const { dev = false, onError, appConfig, resolvePageUse, defaultTimeoutMs = 30_000, } = opts;
     let cachedMapPromise = null;
     return async (c) => {
         const actionsMapPromise = dev
@@ -118,11 +135,18 @@ export function actionsHandler(glob, opts = {}) {
         if (!entry) {
             return c.json({ error: `Module '${module}' not found` }, 404);
         }
-        const fn = entry.actions[action];
-        if (typeof fn !== 'function') {
+        const actionEntry = entry.actions[action];
+        if (!actionEntry) {
             return c.json({ error: `Action '${action}' not found in module '${module}'` }, 404);
         }
-        const signal = c.req.raw.signal;
+        const { fn, use: actionUse, timeoutMs: actionTimeoutMs } = actionEntry;
+        const resolvedTimeoutMs = actionTimeoutMs !== undefined ? actionTimeoutMs : defaultTimeoutMs;
+        const timeoutSignal = resolvedTimeoutMs === false
+            ? undefined
+            : AbortSignal.timeout(resolvedTimeoutMs);
+        const signal = timeoutSignal
+            ? AbortSignal.any([c.req.raw.signal, timeoutSignal])
+            : c.req.raw.signal;
         const actionCtx = { c, signal };
         // Chain ordering is outer -> inner: app-level middleware wraps every
         // request, page-level wraps actions owned by that page, and per-action
@@ -133,7 +157,6 @@ export function actionsHandler(glob, opts = {}) {
         // page-layer lookup keys by module rather than by location path.
         const rootUse = appConfig?.use ?? [];
         const pageUse = (await resolvePageUse?.(module)) ?? [];
-        const actionUse = fn.use ?? [];
         const fullUse = [...rootUse, ...pageUse, ...actionUse];
         const { middleware: allMiddleware, observers } = partitionUse(fullUse);
         const serverMw = allMiddleware.filter((m) => m.runs === 'server');
@@ -173,6 +196,12 @@ export function actionsHandler(glob, opts = {}) {
             if (isOutcome(err)) {
                 return translateOutcomeForAction(c, err);
             }
+            if (timeoutSignal?.aborted &&
+                timeoutSignal.reason instanceof DOMException &&
+                timeoutSignal.reason.name === 'TimeoutError' &&
+                typeof resolvedTimeoutMs === 'number') {
+                return translateOutcomeForAction(c, timeoutOutcome(resolvedTimeoutMs));
+            }
             onError?.(err, { module, action });
             const message = dev && err instanceof Error ? err.message : 'Action failed';
             return c.json({ error: message }, 500);
@@ -182,12 +211,16 @@ export function actionsHandler(glob, opts = {}) {
                 emitResult: true,
                 observers,
                 observerCtx: ctx,
+                signal: timeoutSignal,
+                timeoutMs: typeof resolvedTimeoutMs === 'number' ? resolvedTimeoutMs : undefined,
             });
         }
         if (result instanceof ReadableStream) {
             return sseReadableStreamResponse(c, result, {
                 observers,
                 observerCtx: ctx,
+                signal: timeoutSignal,
+                timeoutMs: typeof resolvedTimeoutMs === 'number' ? resolvedTimeoutMs : undefined,
             });
         }
         return c.json(result);