@timber-js/app 0.1.9 → 0.1.11

package/src/server/route-matcher.ts

@@ -10,10 +10,7 @@
 
 import type { RouteMatch } from './pipeline.js';
 import type { MiddlewareFn } from './middleware-runner.js';
-import {
-  METADATA_ROUTE_CONVENTIONS,
-  type MetadataRouteType,
-} from './metadata-routes.js';
+import { METADATA_ROUTE_CONVENTIONS, type MetadataRouteType } from './metadata-routes.js';
 
 // ─── Manifest Types ───────────────────────────────────────────────────────
 // The virtual module manifest has a slightly different shape than SegmentNode:
@@ -127,6 +124,43 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
   };
 }
 
+/**
+ * An effective child flattened through group segments.
+ * Includes the chain of group nodes that must be added to the segments
+ * array before the child itself (to preserve the group → child nesting
+ * that the renderer expects).
+ */
+interface EffectiveChild {
+  child: ManifestSegmentNode;
+  groupChain: ManifestSegmentNode[];
+}
+
+/**
+ * Collect effective children by flattening through group segments.
+ *
+ * Groups are transparent for URL matching — their non-group descendants
+ * are returned with the chain of group nodes that lead to them. This
+ * allows the caller to apply priority ordering (static > dynamic > ...)
+ * across all groups uniformly instead of per-group.
+ */
+function collectEffectiveChildren(
+  node: ManifestSegmentNode,
+  groupChain: ManifestSegmentNode[] = []
+): EffectiveChild[] {
+  const result: EffectiveChild[] = [];
+  for (const child of node.children) {
+    if (child.segmentType === 'group') {
+      // Look through the group — its children become effective children
+      // with this group prepended to their chain
+      const nested = collectEffectiveChildren(child, [...groupChain, child]);
+      result.push(...nested);
+    } else {
+      result.push({ child, groupChain });
+    }
+  }
+  return result;
+}
+
 /**
  * Recursively match URL segments against the segment tree.
  *
@@ -136,8 +170,10 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
  *   3. Catch-all segments ([...param])
  *   4. Optional catch-all segments ([[...param]])
  *
- * Groups are transparent — they don't consume URL segments but their
- * children are checked as if they were direct children of the parent.
+ * Groups are transparent — they don't consume URL segments. Children
+ * are flattened through groups so that priority ordering applies across
+ * all groups uniformly (a static in group A always beats a dynamic in
+ * group B, regardless of group ordering).
  */
 function matchSegments(
   node: ManifestSegmentNode,
@@ -163,11 +199,12 @@ function matchSegments(
       }
     }
 
-    // Check optional catch-all children (they can match zero segments)
-    for (const child of node.children) {
+    // Check optional catch-all children (direct and through groups)
+    const effective = collectEffectiveChildren(node);
+    for (const { child, groupChain } of effective) {
       if (child.segmentType === 'optional-catch-all') {
         if (child.page || child.route) {
-          segments.push(child);
+          segments.push(...groupChain, child);
           // Zero segments → param is undefined (not set), matching Next.js semantics
           return true;
         }
@@ -180,35 +217,33 @@ function matchSegments(
 
   const part = parts[index];
 
-  // Try children in priority order
+  // Flatten children through groups so priority ordering applies globally
+  // across all groups, not per-group.
+  const effective = collectEffectiveChildren(node);
 
   // 1. Static segments
-  for (const child of node.children) {
+  for (const { child, groupChain } of effective) {
     if (child.segmentType === 'static' && child.segmentName === part) {
+      segments.push(...groupChain);
       if (matchSegments(child, parts, index + 1, segments, params)) {
         return true;
       }
+      // Backtrack group chain
+      segments.length -= groupChain.length;
     }
   }
 
-  // 2. Group segments (transparent — recurse without consuming)
-  for (const child of node.children) {
-    if (child.segmentType === 'group') {
-      if (matchSegments(child, parts, index, segments, params)) {
-        return true;
-      }
-    }
-  }
-
-  // 3. Dynamic segments ([param])
-  for (const child of node.children) {
+  // 2. Dynamic segments ([param])
+  for (const { child, groupChain } of effective) {
     if (child.segmentType === 'dynamic' && child.paramName) {
+      segments.push(...groupChain);
       const prevParam = params[child.paramName];
       params[child.paramName] = part;
       if (matchSegments(child, parts, index + 1, segments, params)) {
         return true;
       }
       // Backtrack
+      segments.length -= groupChain.length;
       if (prevParam !== undefined) {
         params[child.paramName] = prevParam;
       } else {
@@ -217,24 +252,24 @@ function matchSegments(
     }
   }
 
-  // 4. Catch-all segments ([...param])
-  for (const child of node.children) {
+  // 3. Catch-all segments ([...param])
+  for (const { child, groupChain } of effective) {
     if (child.segmentType === 'catch-all' && child.paramName) {
       if (child.page || child.route) {
         const remaining = parts.slice(index);
-        segments.push(child);
+        segments.push(...groupChain, child);
         params[child.paramName] = remaining;
         return true;
       }
     }
   }
 
-  // 5. Optional catch-all segments ([[...param]])
-  for (const child of node.children) {
+  // 4. Optional catch-all segments ([[...param]])
+  for (const { child, groupChain } of effective) {
     if (child.segmentType === 'optional-catch-all' && child.paramName) {
       if (child.page || child.route) {
         const remaining = parts.slice(index);
-        segments.push(child);
+        segments.push(...groupChain, child);
         params[child.paramName] = remaining;
         return true;
       }

package/src/server/rsc-entry/index.ts

@@ -24,49 +24,49 @@ import buildManifest from 'virtual:timber-build-manifest';
 
 import { renderToReadableStream } from '@vitejs/plugin-rsc/rsc';
 
-import React, { createElement } from 'react';
-import { createPipeline } from '#/server/pipeline.js';
-import { initDevTracing } from '#/server/tracing.js';
-import type { PipelineConfig, RouteMatch, InterceptionContext } from '#/server/pipeline.js';
-import { logRenderError } from '#/server/logger.js';
-import { resolveLogMode } from '#/server/dev-logger.js';
-import { createRouteMatcher, createMetadataRouteMatcher } from '#/server/route-matcher.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import { DenySignal, RedirectSignal, RenderError, SsrStreamError } from '#/server/primitives.js';
-import { buildClientScripts } from '#/server/html-injectors.js';
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import { renderDenyPage, renderDenyPageAsRsc } from '#/server/deny-renderer.js';
-import type { LayoutEntry } from '#/server/deny-renderer.js';
+import type { FormRerender } from '#/server/action-handler.js';
+import { handleActionRequest, isActionRequest } from '#/server/action-handler.js';
+import type { BodyLimitsConfig } from '#/server/body-limits.js';
+import type { BuildManifest } from '#/server/build-manifest.js';
 import {
-  collectRouteCss,
-  collectRouteFonts,
-  collectRouteModulepreloads,
   buildCssLinkTags,
   buildFontPreloadTags,
   buildModulepreloadTags,
+  collectRouteCss,
+  collectRouteFonts,
+  collectRouteModulepreloads,
 } from '#/server/build-manifest.js';
-import type { BuildManifest } from '#/server/build-manifest.js';
-import { collectEarlyHintHeaders } from '#/server/early-hints.js';
+import type { LayoutEntry } from '#/server/deny-renderer.js';
+import { renderDenyPage, renderDenyPageAsRsc } from '#/server/deny-renderer.js';
+import { resolveLogMode } from '#/server/dev-logger.js';
 import { sendEarlyHints103 } from '#/server/early-hints-sender.js';
-import type { NavContext } from '#/server/ssr-entry.js';
-import { buildRouteElement, RouteSignalWithContext } from '#/server/route-element-builder.js';
-import { isActionRequest, handleActionRequest } from '#/server/action-handler.js';
-import type { FormRerender } from '#/server/action-handler.js';
-import type { BodyLimitsConfig } from '#/server/body-limits.js';
+import { collectEarlyHintHeaders } from '#/server/early-hints.js';
 import { runWithFormFlash } from '#/server/form-flash.js';
+import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
+import { buildClientScripts } from '#/server/html-injectors.js';
+import { logRenderError } from '#/server/logger.js';
+import type { InterceptionContext, PipelineConfig, RouteMatch } from '#/server/pipeline.js';
+import { createPipeline } from '#/server/pipeline.js';
+import { DenySignal, RedirectSignal, RenderError, SsrStreamError } from '#/server/primitives.js';
+import { buildRouteElement, RouteSignalWithContext } from '#/server/route-element-builder.js';
+import type { ManifestSegmentNode } from '#/server/route-matcher.js';
+import { createMetadataRouteMatcher, createRouteMatcher } from '#/server/route-matcher.js';
+import type { NavContext } from '#/server/ssr-entry.js';
+import { initDevTracing } from '#/server/tracing.js';
 
+import { renderFallbackError as renderFallback } from '#/server/fallback-error.js';
+import { handleApiRoute } from './api-handler.js';
+import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
 import {
-  createDebugChannelSink,
-  buildSegmentInfo,
-  isRscPayloadRequest,
   buildRedirectResponse,
+  buildSegmentInfo,
+  createDebugChannelSink,
   escapeHtml,
   isAbortError,
+  isRscPayloadRequest,
   parseCookiesFromHeader,
   RSC_CONTENT_TYPE,
 } from './helpers.js';
-import { handleApiRoute } from './api-handler.js';
-import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
 import { callSsr } from './ssr-bridge.js';
 
 // Dev-only pipeline error handler, set by the dev server after import.
@@ -183,6 +183,8 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
           if (_devPipelineErrorHandler) _devPipelineErrorHandler(error, phase);
         }
       : undefined,
+    renderFallbackError: (error, req, responseHeaders) =>
+      renderFallback(error, req, responseHeaders, isDev, manifest.root, clientBootstrap),
   };
 
   const pipeline = createPipeline(pipelineConfig);
@@ -664,15 +666,28 @@ async function renderRoute(
     if (sig) return buildRedirectResponse(_req, sig, responseHeaders);
     if (denySignal) {
       return renderDenyPage(
-        denySignal, segments, layoutComponents as LayoutEntry[],
-        _req, match, responseHeaders, clientBootstrap, createDebugChannelSink, callSsr
+        denySignal,
+        segments,
+        layoutComponents as LayoutEntry[],
+        _req,
+        match,
+        responseHeaders,
+        clientBootstrap,
+        createDebugChannelSink,
+        callSsr
       );
     }
     const err = renderError as { error: unknown; status: number } | null;
     if (err) {
       return renderErrorPage(
-        err.error, err.status, segments, layoutComponents as LayoutEntry[],
-        _req, match, responseHeaders, clientBootstrap
+        err.error,
+        err.status,
+        segments,
+        layoutComponents as LayoutEntry[],
+        _req,
+        match,
+        responseHeaders,
+        clientBootstrap
       );
     }
     return null;
@@ -712,15 +727,28 @@ async function renderRoute(
       if (denySignal) {
         // Render deny page without layouts — pass empty layout list
         return renderDenyPage(
-          denySignal, segments, [] as LayoutEntry[],
-          _req, match, responseHeaders, clientBootstrap, createDebugChannelSink, callSsr
+          denySignal,
+          segments,
+          [] as LayoutEntry[],
+          _req,
+          match,
+          responseHeaders,
+          clientBootstrap,
+          createDebugChannelSink,
+          callSsr
         );
       }
       const err = renderError as { error: unknown; status: number } | null;
       if (err) {
         return renderErrorPage(
-          err.error, err.status, segments, [] as LayoutEntry[],
-          _req, match, responseHeaders, clientBootstrap
+          err.error,
+          err.status,
+          segments,
+          [] as LayoutEntry[],
+          _req,
+          match,
+          responseHeaders,
+          clientBootstrap
         );
       }
       // No captured signal — return bare 500

package/src/server/slot-resolver.ts

@@ -16,12 +16,13 @@
  * See design/02-rendering-pipeline.md §"Parallel Slots"
  */
 
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch, InterceptionContext } from './pipeline.js';
-import { SlotAccessGate } from './access-gate.js';
-import { wrapSegmentWithErrorBoundaries } from './error-boundary-wrapper.js';
 import { TimberErrorBoundary } from '#/client/error-boundary.js';
 import SlotErrorFallback from '#/client/slot-error-fallback.js';
+import { SlotAccessGate } from './access-gate.js';
+import { wrapSegmentWithErrorBoundaries } from './error-boundary-wrapper.js';
+import type { InterceptionContext, RouteMatch } from './pipeline.js';
+import { DenySignal } from './primitives.js';
+import type { ManifestSegmentNode } from './route-matcher.js';
 
 type CreateElementFn = (...args: unknown[]) => React.ReactElement;
 
@@ -56,7 +57,39 @@ export async function resolveSlotElement(
     const mod = (await slotMatch.page.load()) as Record<string, unknown>;
     if (mod.default) {
       const SlotPage = mod.default as (...args: unknown[]) => unknown;
-      let element: React.ReactElement = h(SlotPage, {
+
+      // Load default.tsx fallback for notFound() handling in the slot page.
+      // When a slot page calls notFound() or deny(), it should gracefully
+      // degrade to default.tsx or null — not crash the page. This matches
+      // Next.js behavior. See design/02-rendering-pipeline.md
+      // §"Slot Access Failure = Graceful Degradation"
+      let denyFallback: React.ReactElement | null = null;
+      if (slotNode.default) {
+        const defaultMod = (await slotNode.default.load()) as Record<string, unknown>;
+        const DefaultComp = defaultMod.default as ((...args: unknown[]) => unknown) | undefined;
+        if (DefaultComp) {
+          denyFallback = h(DefaultComp, { params: paramsPromise, searchParams: {} });
+        }
+      }
+
+      // Wrap the slot page to catch DenySignal (from notFound() or deny())
+      // at the component level. This prevents the signal from reaching the
+      // RSC onError callback and being tracked as a page-level denial, which
+      // would cause the pipeline to replace the entire successful SSR response
+      // with a deny page. Instead, the slot gracefully degrades.
+      const denyFallbackCapture = denyFallback;
+      const SafeSlotPage = async (props: Record<string, unknown>) => {
+        try {
+          return await (SlotPage as (props: Record<string, unknown>) => unknown)(props);
+        } catch (error) {
+          if (error instanceof DenySignal) {
+            return denyFallbackCapture;
+          }
+          throw error;
+        }
+      };
+
+      let element: React.ReactElement = h(SafeSlotPage, {
         params: paramsPromise,
         searchParams: {},
       });

package/src/server/ssr-entry.ts

@@ -156,7 +156,10 @@ export async function handleSsr(
         // Wrap in SsrStreamError so the RSC entry can handle it without
         // re-executing server components via renderDenyPage.
         // See LOCAL-293.
-        console.error('[timber] SSR shell failed from RSC stream error:', formatSsrError(renderError));
+        console.error(
+          '[timber] SSR shell failed from RSC stream error:',
+          formatSsrError(renderError)
+        );
         throw new SsrStreamError(
           'SSR renderToReadableStream failed due to RSC stream error',
           renderError

package/src/server/tree-builder.ts

@@ -79,7 +79,10 @@ export interface AccessGateProps {
    * - 'pass': render children
    * - DenySignal/RedirectSignal: throw synchronously
    */
-  verdict?: 'pass' | import('./primitives.js').DenySignal | import('./primitives.js').RedirectSignal;
+  verdict?:
+    | 'pass'
+    | import('./primitives.js').DenySignal
+    | import('./primitives.js').RedirectSignal;
   children: ReactElement;
 }
 

package/src/shims/server-only-noop.js

@@ -1,3 +1,4 @@
+// oxlint-disable
 // No-op shim for server-only/client-only packages.
 // In dev mode, Vite externalizes node_modules and loads them via Node's
 // require(). Deps like `bright` that import `server-only` would hit the