@timber-js/app 0.2.0-alpha.145 → 0.2.0-alpha.147

package/src/server/deny-renderer.ts

@@ -19,8 +19,10 @@ import { createElement } from 'react';
 import { renderToReadableStream } from '../rsc-runtime/rsc.js';
 
 import { DenySignal } from './primitives.js';
+import { renderDenyEntry, type DenyPageEntry } from './deny-boundary.js';
 import { logRenderError } from './logger.js';
 import { loadModule } from './safe-load.js';
+import { isMdxFilePath } from './utils/mdx-file.js';
 import { isDebug } from './debug.js';
 import { escapeHtml } from './utils/escape-html.js';
 import { resolveMetadata, renderMetadataToElements } from './metadata.js';
@@ -62,6 +64,29 @@ function isApiRoute(segments: ReadonlyArray<ManifestSegmentNode>): boolean {
   return !!leaf?.route;
 }
 
+/**
+ * Build the deny page element for a resolved status file with the correct
+ * props contract for the file's convention. Delegates to renderDenyEntry
+ * (deny-boundary.ts) so the in-tree and re-render deny paths render
+ * identical elements — in particular, error.tsx serving a deny gets
+ * { error, digest, reset } via ErrorReconstituter, not bare deny props.
+ * See TIM-1081.
+ */
+function buildDenyElement(
+  deny: DenySignal,
+  component: (...args: unknown[]) => unknown,
+  resolutionKind: 'exact' | 'category' | 'legacy' | 'error',
+  filePath: string
+): React.ReactElement {
+  const entry: DenyPageEntry = {
+    status: deny.status,
+    component,
+    kind: resolutionKind === 'error' ? 'error' : resolutionKind === 'legacy' ? 'legacy' : 'status',
+    isMdx: isMdxFilePath(filePath),
+  };
+  return renderDenyEntry(entry, deny.status, deny.data);
+}
+
 /**
  * Render a status-code error page for a DenySignal.
  *
@@ -120,12 +145,15 @@ export async function renderDenyPage(
   const ErrorPageComponent = mod.default as (...args: unknown[]) => unknown;
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  // 4xx status-code pages receive { status, dangerouslyPassData }
-  // per design/10-error-handling.md §"Status-Code File Props"
-  let element = h(ErrorPageComponent, {
-    status: deny.status,
-    dangerouslyPassData: deny.data,
-  });
+  // 4xx status-code pages receive { status, dangerouslyPassData }; an
+  // error.tsx match gets { error, digest, reset } via ErrorReconstituter.
+  // See design/10-error-handling.md §"Status-Code File Props" and TIM-1081.
+  let element = buildDenyElement(
+    deny,
+    ErrorPageComponent,
+    resolution.kind,
+    resolution.file.filePath
+  );
 
   // Always wrap in layout shell.
   // NOTE: Shell opt-out (export const shell = false) is a future feature
@@ -207,10 +235,12 @@ export async function renderDenyPageAsRsc(
   const ErrorPageComponent = mod.default as (...args: unknown[]) => unknown;
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  let element = h(ErrorPageComponent, {
-    status: deny.status,
-    dangerouslyPassData: deny.data,
-  });
+  let element = buildDenyElement(
+    deny,
+    ErrorPageComponent,
+    resolution.kind,
+    resolution.file.filePath
+  );
 
   // Always wrap in layout shell.
   const resolvedSegments = new Set(segments.slice(0, resolution.segmentIndex + 1));

package/src/server/error-boundary-wrapper.ts

@@ -8,20 +8,7 @@
 import { TimberErrorBoundary } from '../client/error-boundary.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
 import { loadModule } from './safe-load.js';
-
-/** MDX/markdown extensions — server components that cannot be passed as function props. */
-const MDX_EXTENSIONS = new Set(['.mdx', '.md']);
-
-/**
- * Check if a manifest file path ends with an MDX/markdown extension.
- * MDX components are server components and cannot cross the RSC→client
- * boundary as function props to TimberErrorBoundary.
- */
-function isMdxFilePath(filePath: string): boolean {
-  const dotIndex = filePath.lastIndexOf('.');
-  if (dotIndex === -1) return false;
-  return MDX_EXTENSIONS.has(filePath.slice(dotIndex));
-}
+import { isMdxFilePath } from './utils/mdx-file.js';
 
 /**
  * Wrap an element in error boundaries defined by a route segment.

package/src/server/fallback-error.ts

@@ -34,14 +34,15 @@ export async function renderFallbackError(
   rootSegment: ManifestSegmentNode,
   clientBootstrap: ClientBootstrapConfig,
   globalError?: GlobalErrorFile,
-  projectRoot?: string
+  projectRoot?: string,
+  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
 ): Promise<Response> {
   // Source-map the error's stack trace in dev mode so the error page
   // shows original source positions. See TIM-811.
   sourceMapError(error);
 
   if (isDev) {
-    return renderDevErrorPage(error, projectRoot);
+    return renderDevErrorPage(error, projectRoot, hmrOptions);
   }
   // Lazy import to avoid loading error-renderer in the pipeline module
   const { renderErrorPage } = await import('./rsc-entry/error-renderer.js');
@@ -91,7 +92,11 @@ export async function renderFallbackError(
  *
  * Dev-only — the dynamic import has zero production cost.
  */
-export async function renderDevErrorPage(error: unknown, projectRoot?: string): Promise<Response> {
+export async function renderDevErrorPage(
+  error: unknown,
+  projectRoot?: string,
+  hmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions
+): Promise<Response> {
   const err = error instanceof Error ? error : new Error(String(error));
   const root = projectRoot ?? process.cwd();
 
@@ -100,7 +105,7 @@ export async function renderDevErrorPage(error: unknown, projectRoot?: string):
     // Dynamic import — keeps dev-error-page.ts and its transitive deps
     // (dev-error-overlay.ts, @jridgewell/trace-mapping) out of production bundles.
     const { generateDevErrorPage } = await import('../dev-tools/error-page.js');
-    html = generateDevErrorPage(err, 'render', root);
+    html = generateDevErrorPage(err, 'render', root, hmrOptions);
     // Inject Vite client script so the error overlay fires when HMR connects.
     html = html.replace(
       '</head>',

package/src/server/node-stream-transforms.ts

@@ -18,7 +18,8 @@
  * Readable.toWeb() conversion for the Response body.
  */
 
-import { Transform } from 'node:stream';
+import { PassThrough, Transform, type Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 import { createGzip, constants } from 'node:zlib';
 
 import {
@@ -265,37 +266,73 @@ export function createNodeFlightInjector(
 const NOINDEX_SCRIPT =
   '<script>document.head.appendChild(Object.assign(document.createElement("meta"),{name:"robots",content:"noindex"}))</script>';
 
+function isAbortError(error: unknown): boolean {
+  if (error instanceof DOMException && error.name === 'AbortError') return true;
+  if (error instanceof Error && error.name === 'AbortError') return true;
+  return false;
+}
+
 /**
- * Node.js Transform that catches post-shell streaming errors.
+ * Run the Node SSR post-processing pipeline with post-shell error handling.
+ *
+ * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts: when the
+ * stream errors after the shell has flushed (deny/throw inside Suspense,
+ * an RSC read timeout in the flight injector, or an upstream Fizz error),
+ * the response closes cleanly with a trailing noindex script instead of
+ * aborting the connection mid-body. Abort errors (client disconnect,
+ * render-timeout abort) close the output silently — no noindex, no log.
  *
- * Equivalent to wrapStreamWithErrorHandling() in ssr-render.ts.
- * Catches errors from React's streaming phase (deny/throw inside Suspense
- * after the shell has flushed) and closes the stream cleanly.
+ * Why this is a pump function and not a Transform stage (TIM-1019):
+ * stream.promises.pipeline() destroys every stage in the chain when any
+ * stage errors, so a Transform *inside* the pipeline can never append
+ * bytes after a failure — by the time its 'error' listener fires, the
+ * transform and everything downstream are already destroyed and push()/
+ * end() are no-ops. The output PassThrough therefore lives OUTSIDE the
+ * pipeline() call: the last stage pipes into it (pipe() ends the output
+ * on upstream success but leaves it open on upstream error), and the
+ * pipeline's rejection handler appends the noindex script.
+ *
+ * Consumer cancellation (e.g. Readable.toWeb() cancel on client
+ * disconnect) is wired back into the pipeline via an AbortSignal so the
+ * source and all stages are torn down — the teardown that membership in
+ * pipeline() used to provide.
  */
-export function createNodeErrorHandler(signal?: AbortSignal): Transform {
-  const transform = new Transform({
-    transform(chunk, _encoding, callback) {
-      callback(null, chunk);
-    },
-  });
-
-  transform.on('error', (error) => {
-    const isAbort =
-      (error instanceof DOMException && error.name === 'AbortError') ||
-      (error instanceof Error && error.name === 'AbortError') ||
-      signal?.aborted;
-
-    if (isAbort) {
-      transform.end();
+export function runNodePipelineWithErrorHandling(
+  source: Readable,
+  transforms: readonly [Transform, ...Transform[]],
+  signal?: AbortSignal
+): PassThrough {
+  const output = new PassThrough();
+  const last = transforms[transforms.length - 1]!;
+  last.pipe(output);
+
+  // If the consumer destroys the output (client disconnect), abort the
+  // pipeline so the Fizz source and flight injector release their
+  // resources. On normal completion the pipeline has already settled and
+  // the abort is a no-op.
+  const consumerGone = new AbortController();
+  output.once('close', () => consumerGone.abort());
+
+  // The cast satisfies pipeline()'s [source, ...transforms, destination]
+  // tuple overload — TS can't prove the shape across a spread, but the
+  // signature above guarantees a non-empty transform list at compile time.
+  const stages = [source, ...transforms] as unknown as readonly [
+    Readable,
+    ...Transform[],
+    Transform,
+  ];
+
+  pipeline(stages, { signal: consumerGone.signal }).catch((error: unknown) => {
+    if (output.writableEnded || output.destroyed) return;
+    if (isAbortError(error) || signal?.aborted || consumerGone.signal.aborted) {
+      output.end();
       return;
     }
-
     logStreamingError({ error });
-    transform.push(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
-    transform.end();
+    output.end(Buffer.from(NOINDEX_SCRIPT, 'utf-8'));
   });
 
-  return transform;
+  return output;
 }
 
 // ─── Compression ─────────────────────────────────────────────────────────────

package/src/server/pipeline.ts

@@ -187,6 +187,18 @@ export interface PipelineConfig {
     debugComponents?: Array<{ name: string; env: string | null; stack: unknown[] | null }>
   ) => void;
 
+  /**
+   * HMR connection options for dev-only HTML pages (dev 404 page, fallback
+   * error page) — set by the dev server after the RSC entry module is
+   * imported, like `devPipelineErrorHandler`. The RSC environment can't
+   * read the Vite server config (separate module graph), so the dev server
+   * plumbs the resolved HMR endpoint (protocol/host/port/path/token) here
+   * for the pages' auto-reload WebSocket. See TIM-1067.
+   *
+   * Undefined in production — zero overhead.
+   */
+  devHmrOptions?: import('../dev-tools/dev-page-shell.js').DevErrorHmrOptions;
+
   /**
    * Fallback error renderer — called when a catastrophic error escapes the
    * render phase. Produces an HTML Response instead of a bare empty 500.

package/src/server/primitives.ts

@@ -8,7 +8,10 @@ import { getWaitUntil as _getWaitUntil } from './waituntil-bridge.js';
 import { isDebug } from './debug.js';
 import { getRequestSearchString } from './request-context.js';
 import { mergePreservedSearchParams } from '../shared/merge-search-params.js';
-import { validateExternalRedirectUrl } from '../shared/href-validation.js';
+import {
+  assertRelativeRedirectPath,
+  validateExternalRedirectUrl,
+} from '../shared/href-validation.js';
 
 // ─── Dev-mode validation ────────────────────────────────────────────────────
 
@@ -207,17 +210,9 @@ export function notFound(): never {
   deny(404);
 }
 
-/**
- * Next.js redirect type discriminator.
- *
- * Provided for API compatibility with libraries that import `RedirectType`
- * from `next/navigation`. In timber, `redirect()` always uses `replace`
- * semantics (no history entry for the redirect itself).
- */
-export const RedirectType = {
-  push: 'push',
-  replace: 'replace',
-} as const;
+// Single source of truth shared with the client next/navigation shim —
+// see shared/redirect-type.ts.
+export { RedirectType } from '../shared/redirect-type.js';
 
 // ─── RedirectSignal ─────────────────────────────────────────────────────────
 
@@ -237,12 +232,6 @@ export class RedirectSignal extends Error {
   }
 }
 
-/** Pattern matching absolute URLs: http(s):// or protocol-relative // */
-const ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
-
-// eslint-disable-next-line no-control-regex -- must match all C0 controls to prevent bypass
-const REDIRECT_CONTROL_CHARS_RE = /[\x00-\x1f]/g;
-
 /**
  * Options for redirect() — alternative to passing a bare status code.
  */
@@ -303,19 +292,9 @@ export function redirect(path: string, statusOrOptions?: number | RedirectOption
   if (status < 300 || status > 399) {
     throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
   }
-  // Strip C0 control characters and trim whitespace before checking — browsers
-  // do this during URL resolution, so " \thttp://evil.com" resolves as absolute.
-  // Normalize for validation only: strip C0 controls, trim, then replace backslashes
-  // with forward slashes. Browsers normalize \ → / during URL resolution, so
-  // "/\evil.com" becomes "//evil.com" (protocol-relative open redirect).
-  const cleaned = path.replace(REDIRECT_CONTROL_CHARS_RE, '').trimStart().replaceAll('\\', '/');
-
-  if (ABSOLUTE_URL_RE.test(cleaned)) {
-    throw new Error(
-      `redirect() only accepts relative URLs. Got absolute URL: "${path}". ` +
-        'Use redirectExternal(url, allowList) for external redirects.'
-    );
-  }
+  // Relative-only validation shared with the client next/navigation shim —
+  // strips C0 controls and normalizes backslashes before the scheme check.
+  assertRelativeRedirectPath(path);
 
   let resolvedPath = path;
   if (preserveSearchParams) {

package/src/server/route-matcher.ts

@@ -185,7 +185,7 @@ function matchMetadataPathname(
   // Non-nestable routes (robots, manifest, favicon) only serve from root
   if (!convention.nestable && segment !== root) return null;
 
-  const file = findMetadataRouteInSegment(segment, baseName);
+  const file = findMetadataRouteInSegment(segment, baseName, convention.nestable);
   if (!file) return null;
 
   const ext = file.filePath.slice(file.filePath.lastIndexOf('.') + 1);
@@ -205,19 +205,35 @@ function matchMetadataPathname(
 }
 
 /**
- * Find a metadata route file in a segment, including transparent group children.
- * Groups don't add URL depth, so their metadata routes are reachable at the parent's path.
+ * Find a metadata route file in a segment, including children that match
+ * zero URL segments at the segment's own path:
+ *
+ * - Group children are transparent — they don't add URL depth.
+ * - Optional catch-all children ([[...slug]]) match zero segments, so
+ *   `app/docs/[[...path]]/icon.tsx` serves `/docs/icon`. The non-zero
+ *   case is handled by the tree walker (requireTerminal:false), but the
+ *   zero-segment case never reaches the walker — the parent node accepts
+ *   the fully-consumed prefix first, so the fallback lives here.
+ *
+ * Optional catch-all descent applies to NESTABLE conventions only. A
+ * non-nestable file (robots, manifest, favicon) inside `[[...slug]]` is
+ * not at the root — serving it there would bypass the root-only rule.
+ * Group descent is unconditional: groups are transparent and a group
+ * child of the root IS at the root.
+ *
+ * The segment's own metadata file wins over a zero-segment child's.
  */
 function findMetadataRouteInSegment(
   node: ManifestSegmentNode,
-  baseName: string
+  baseName: string,
+  nestable: boolean
 ): ManifestFile | null {
   if (node.metadataRoutes?.[baseName]) {
     return node.metadataRoutes[baseName];
   }
   for (const child of node.children) {
-    if (child.segmentType === 'group') {
-      const found = findMetadataRouteInSegment(child, baseName);
+    if (child.segmentType === 'group' || (nestable && child.segmentType === 'optional-catch-all')) {
+      const found = findMetadataRouteInSegment(child, baseName, nestable);
       if (found) return found;
     }
   }

package/src/server/rsc-entry/error-renderer.ts

@@ -33,6 +33,7 @@ import { ErrorReconstituter } from '../../client/error-reconstituter.js';
 import type { SerializableError } from '../../client/error-reconstituter.js';
 import { loadModule } from '../safe-load.js';
 import { sourceMapError } from '../dev-source-map.js';
+import { isMdxFilePath as isMdxFile } from '../utils/mdx-file.js';
 
 /**
  * A manifest file reference with lazy import and path.
@@ -44,18 +45,6 @@ export interface GlobalErrorFile {
   filePath: string;
 }
 
-/** MDX/markdown extensions — server components that need RSC rendering. */
-const MDX_EXTENSIONS = new Set(['.mdx', '.md']);
-
-/**
- * Check if a file path ends with an MDX/markdown extension.
- */
-function isMdxFile(filePath: string): boolean {
-  const dotIndex = filePath.lastIndexOf('.');
-  if (dotIndex === -1) return false;
-  return MDX_EXTENSIONS.has(filePath.slice(dotIndex));
-}
-
 /**
  * Result of walking the segment chain for an error file.
  */

package/src/server/rsc-entry/index.ts

@@ -268,7 +268,9 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         const { generateDev404Page, collectRoutes } = await import('../../dev-tools/404-page.js');
         const routes = collectRoutes(manifest.root);
         const pathname = new URL(req.url).pathname;
-        const html = generateDev404Page(pathname, routes);
+        // devHmrOptions is set by the dev server after this module is
+        // imported (read at request time, not closure-capture time).
+        const html = generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
         return new Response(html, {
           status: 404,
           headers: {
@@ -316,7 +318,10 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         // (TIM-807). Passing manifest.root (segment tree object) here would
         // stringify to "[object Object]" and misclassify app frames as
         // internal, dropping source locations from the dev error page (TIM-808).
-        isDev ? manifest.viteRoot : undefined
+        isDev ? manifest.viteRoot : undefined,
+        // HMR options for the dev error page's auto-reload WebSocket —
+        // set by the dev server after import, read at request time.
+        isDev ? pipelineConfig.devHmrOptions : undefined
       ),
     renderDenyFallback: async (deny, req, responseHeaders, matchedRoute) => {
       // Render the deny page (403.tsx, 404.tsx, etc.) for DenySignals

package/src/server/rsc-entry/rsc-payload.ts

@@ -12,6 +12,7 @@
 import type { LayoutEntry } from '../deny-renderer.js';
 import { renderDenyPageAsRsc } from '../deny-renderer.js';
 import type { RouteMatch } from '../pipeline.js';
+import { encodeHeadHeader, HEAD_HEADER } from '../../shared/head-header.js';
 import type { RedirectSignal } from '../primitives.js';
 import type { HeadElement, LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
@@ -175,9 +176,9 @@ export async function buildRscPayloadResponse(
 
   // Send resolved head elements so the client can update document.title
   // and <meta> tags after SPA navigation. See design/16-metadata.md.
-  const encoded = encodeURIComponent(JSON.stringify(headElements));
-  if (encoded.length <= 4096) {
-    responseHeaders.set('X-Timber-Head', encoded);
+  const encodedHead = encodeHeadHeader(headElements);
+  if (encodedHead !== null) {
+    responseHeaders.set(HEAD_HEADER, encodedHead);
   }
 
   // Send segment metadata so the client can populate its segment cache

package/src/server/slot-resolver.ts

@@ -68,10 +68,12 @@ async function renderDefaultFallback(
  * Finds a matching page in the slot's sub-tree for the current route.
  * Falls back to default.tsx if no match, or null if no default.
  *
- * When a match is found, the element is wrapped with:
- * 1. Error boundaries from each segment in the slot's matched chain
- * 2. Layouts from each segment in the slot's matched chain
- * 3. SlotAccessGate if the slot root has access.ts
+ * When a match is found, the element is wrapped per segment in the slot's
+ * matched chain with (innermost → outermost):
+ * 1. Error boundaries
+ * 2. Layout
+ * 3. SlotAccessGate if the segment has access.ts (gate OUTSIDE the layout,
+ *    so a denied layout never executes — see TIM-1074)
  */
 export async function resolveSlotElement(
   slotNode: ManifestSegmentNode,
@@ -155,20 +157,25 @@ export async function resolveSlotElement(
         element = h(SafeSlotPage, {});
       }
 
-      // Wrap with error boundaries and layouts from intermediate slot segments
-      // (everything between slot root and leaf). Process innermost-first, same
-      // order as route-element-builder.ts handles main segments. The slot root
-      // (index 0) is handled separately after the access gate below.
+      // Wrap with error boundaries, layouts, and access gates from
+      // intermediate slot segments (everything between slot root and leaf).
+      // Process innermost-first, same order as route-element-builder.ts
+      // handles main segments. The slot root (index 0) is handled below.
       element = await wrapWithIntermediateSegments(slotMatch.chain, element, h);
 
-      // Wrap in SlotAccessGate if slot root has access.ts.
-      // On denial: denied.tsx → default.tsx → null (graceful degradation).
+      // Wrap with slot root's layout — INSIDE the access gate, so the layout
+      // server component never executes when access.ts denies. See TIM-1074.
+      element = await wrapWithLayout(slotNode, element, h);
+
+      // Wrap in SlotAccessGate if slot root has access.ts. The gate is
+      // OUTSIDE the layout, matching the segment model in
+      // route-element-builder.ts: a denied layout must not render, or it
+      // would fetch/serialize protected data into the RSC Flight stream.
+      // On denial: denied.tsx → default.tsx → null (graceful degradation),
+      // rendered WITHOUT the denied slot's own layout.
       // See design/04-authorization.md §"Slot-Level Auth".
       element = await wrapWithAccessGate(slotNode, element, h);
 
-      // Wrap with slot root's layout (outermost, outside access gate)
-      element = await wrapWithLayout(slotNode, element, h);
-
       // Wrap with slot root's error boundaries (outermost)
       element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
 
@@ -204,6 +211,12 @@ export async function resolveSlotElement(
  * not just the slot root. Without this, nested slot children (e.g.,
  * @admin/reports/access.ts) and intercepting route children with access.ts
  * would bypass authorization. See TIM-999.
+ *
+ * Wrap order per segment (innermost → outermost): error boundaries → layout
+ * → access gate. The gate must be OUTSIDE the layout so a denying access.ts
+ * prevents the layout server component from executing — otherwise the layout
+ * would fetch/serialize protected data into the RSC Flight stream. Matches
+ * route-element-builder.ts. See TIM-1074.
  */
 async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
@@ -213,8 +226,8 @@ async function wrapWithIntermediateSegments(
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
     element = await wrapSegmentWithErrorBoundaries(seg, element, h);
-    element = await wrapWithAccessGate(seg, element, h);
     element = await wrapWithLayout(seg, element, h);
+    element = await wrapWithAccessGate(seg, element, h);
   }
   return element;
 }

package/src/server/ssr-entry.ts

@@ -55,9 +55,7 @@ let _nodeStreamImports: {
   createNodeHeadInjector: typeof import('./node-stream-transforms.js').createNodeHeadInjector;
   createNodeMoveSuffixTransform: typeof import('./node-stream-transforms.js').createNodeMoveSuffixTransform;
   createNodeFlightInjector: typeof import('./node-stream-transforms.js').createNodeFlightInjector;
-  createNodeErrorHandler: typeof import('./node-stream-transforms.js').createNodeErrorHandler;
-  pipeline: typeof import('node:stream/promises').pipeline;
-  PassThrough: typeof import('node:stream').PassThrough;
+  runNodePipelineWithErrorHandling: typeof import('./node-stream-transforms.js').runNodePipelineWithErrorHandling;
   ReadableFromWeb: (
     webStream: import('stream/web').ReadableStream
   ) => import('node:stream').Readable;
@@ -65,9 +63,8 @@ let _nodeStreamImports: {
 
 if (useNodeStreams) {
   try {
-    const [transforms, streamPromises, stream] = await Promise.all([
+    const [transforms, stream] = await Promise.all([
       import('./node-stream-transforms.js'),
-      import('node:stream/promises'),
       import('node:stream'),
     ]);
     _nodeStreamImports = {
@@ -75,9 +72,7 @@ if (useNodeStreams) {
       createNodeHeadInjector: transforms.createNodeHeadInjector,
       createNodeMoveSuffixTransform: transforms.createNodeMoveSuffixTransform,
       createNodeFlightInjector: transforms.createNodeFlightInjector,
-      createNodeErrorHandler: transforms.createNodeErrorHandler,
-      pipeline: streamPromises.pipeline,
-      PassThrough: stream.PassThrough,
+      runNodePipelineWithErrorHandling: transforms.runNodePipelineWithErrorHandling,
       ReadableFromWeb: (webStream: import('stream/web').ReadableStream) =>
         stream.Readable.fromWeb(webStream) as import('node:stream').Readable,
     };
@@ -192,9 +187,7 @@ export async function handleSsr(
           createNodeHeadInjector,
           createNodeMoveSuffixTransform,
           createNodeFlightInjector,
-          createNodeErrorHandler,
-          pipeline,
-          PassThrough,
+          runNodePipelineWithErrorHandling,
         } = _nodeStreamImports;
 
         const renderTimeoutMs = _runtimeConfig.renderTimeoutMs ?? undefined;
@@ -224,15 +217,18 @@ export async function handleSsr(
         // React 19.3+ emits <!DOCTYPE html> automatically when the root
         // element is <html>, so no framework-level doctype prepend needed.
         //
-        // Pipeline: buffer → errorHandler → headInjector → flightInjector → moveSuffix → output
+        // Pipeline: buffer → headInjector → flightInjector → moveSuffix → output
         //
         // 1. buffer: coalesces Fizz micro-chunks into coherent fragments (TIM-528)
-        // 2. errorHandler: catches post-shell streaming errors
-        // 3. headInjector: injects metadata before </head>
-        // 4. flightInjector: interleaves RSC scripts between HTML chunks (TIM-529)
-        // 5. moveSuffix: strips </body></html>, re-emits at end (TIM-530)
+        // 2. headInjector: injects metadata before </head>
+        // 3. flightInjector: interleaves RSC scripts between HTML chunks (TIM-529)
+        // 4. moveSuffix: strips </body></html>, re-emits at end (TIM-530)
+        //
+        // Post-shell error handling lives in the pump, not in a pipeline
+        // stage: pipeline() destroys every stage on failure, so only an
+        // output kept outside the pipeline can append the noindex script
+        // and close cleanly (TIM-1019).
         const bufferedTransform = createNodeBufferedTransform();
-        const errorHandler = createNodeErrorHandler(navContext.signal);
         const headInjector = createNodeHeadInjector(navContext.headHtml);
         const flightInjector = createNodeFlightInjector(navContext.rscStream, {
           renderTimeoutMs,
@@ -240,18 +236,11 @@ export async function handleSsr(
         });
         const moveSuffix = createNodeMoveSuffixTransform();
 
-        const output = new PassThrough();
-        pipeline(
+        const output = runNodePipelineWithErrorHandling(
           nodeHtmlStream,
-          bufferedTransform,
-          errorHandler,
-          headInjector,
-          flightInjector,
-          moveSuffix,
-          output
-        ).catch(() => {
-          // Pipeline errors are handled by errorHandler transform
-        });
+          [bufferedTransform, headInjector, flightInjector, moveSuffix],
+          navContext.signal
+        );
         const _pipelineEnd = performance.now();
 
         // Record SSR sub-timings for Server-Timing header (detailed mode).

package/src/server/status-code-resolver.ts

@@ -75,9 +75,10 @@ export interface SlotDeniedResolution<TFile> {
 
 /**
  * Maps legacy file convention names to their corresponding HTTP status codes.
- * Only used in the 4xx component fallback chain.
+ * Only used in the 4xx component fallback chain. Exported so the in-tree
+ * deny chain (deny-boundary.ts) uses the same mapping — see TIM-1081.
  */
-const LEGACY_FILE_TO_STATUS: Record<string, number> = {
+export const LEGACY_FILE_TO_STATUS: Record<string, number> = {
   'not-found': 404,
   'forbidden': 403,
   'unauthorized': 401,