@timber-js/app 0.2.0-alpha.146 → 0.2.0-alpha.148

package/src/search-params/define.ts

@@ -11,7 +11,7 @@
  */
 
 import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.js';
-import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.js';
+import { fromSchema, isStandardSchema, isCodec, validateSync } from '../schema-bridge.js';
 import type { StandardSchemaV1 } from '../schema-bridge.js';
 import type { Codec } from '../codec.js';
 
@@ -184,7 +184,7 @@ function normalizeRaw(
   raw: URLSearchParams | Record<string, string | string[] | undefined>
 ): Record<string, string | string[] | undefined> {
   if (raw instanceof URLSearchParams) {
-    const result: Record<string, string | string[] | undefined> = {};
+    const result: Record<string, string | string[] | undefined> = Object.create(null);
     for (const key of new Set(raw.keys())) {
       const values = raw.getAll(key);
       result[key] = values.length === 1 ? values[0] : values;
@@ -220,6 +220,20 @@ function resolveField(
 
   // Auto-detect Standard Schema
   if (isStandardSchema(value)) {
+    // Validate that the schema handles absent params (undefined input).
+    // Search params are optional — the URL might not contain the param.
+    // If the schema rejects undefined and has no default, the codec would
+    // return `undefined as T`, making the type lie. Catch this at definition
+    // time instead. design/23-search-params.md §"Default Validation"
+    const absentCheck = validateSync(value, undefined);
+    if (absentCheck.issues) {
+      throw new Error(
+        `[timber] defineSearchParams: field '${fieldName}' has no default value and rejects undefined input.\n` +
+          `  Search params are optional — the URL might not contain ?${fieldName}=anything.\n` +
+          `  Add .default() to your schema: z.coerce.number().int().min(1).default(1)\n` +
+          `  Or use .optional() if the field is truly optional.`
+      );
+    }
     return { codec: fromSchema(value) };
   }
 
@@ -470,6 +484,11 @@ function buildDefinition<T extends Record<string, unknown>>(
     // Merge URL keys: base keys + new codec urlKeys from withUrlKey
     const combinedUrlKeys: Record<string, string> = { ...urlKeys, ...newUrlKeys };
 
+    // Same definition-time guard as defineSearchParams — a throw-on-absent
+    // codec added via extend() gets the friendly guidance error, not a
+    // crash on first parse (TIM-1066).
+    validateDefaults(combinedCodecs as Record<string, SearchParamCodec<unknown>>);
+
     return buildDefinition<Combined>(combinedCodecs, combinedUrlKeys);
   }
 
@@ -479,12 +498,25 @@ function buildDefinition<T extends Record<string, unknown>>(
     const pickedUrlKeys: Record<string, string> = {};
 
     for (const key of keys) {
+      // Explicit guard — TypeScript prevents this, but JS callers and
+      // casts reach here, and "Cannot read properties of undefined
+      // (reading 'serialize')" is no help (TIM-1066).
+      if (!(key in codecMap)) {
+        throw new Error(
+          `[timber] pick('${key}'): unknown key. ` +
+            `Available keys: ${Object.keys(codecMap)
+              .map((k) => `'${k}'`)
+              .join(', ')}.`
+        );
+      }
       pickedCodecs[key] = codecMap[key] as SearchParamCodec<unknown>;
       if (key in urlKeys) {
         pickedUrlKeys[key] = urlKeys[key];
       }
     }
 
+    validateDefaults(pickedCodecs);
+
     return buildDefinition<Pick<T, K>>(
       pickedCodecs as unknown as CodecMap<Pick<T, K>>,
       pickedUrlKeys

package/src/search-params/wrappers.ts

@@ -9,7 +9,23 @@
  */
 
 import type { SearchParamCodec, SearchParamCodecWithUrlKey, SearchParamField } from './define.js';
-import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.js';
+import { isCodec, isStandardSchema, fromSchema, validateSync } from '../schema-bridge.js';
+import type { StandardSchemaV1 } from '../schema-bridge.js';
+
+function validateSchemaAbsentParam<T>(
+  schema: StandardSchemaV1<T>,
+  fieldHint: string
+): SearchParamCodec<T> {
+  const absentCheck = validateSync(schema, undefined);
+  if (absentCheck.issues) {
+    throw new Error(
+      `[timber] withUrlKey: schema for '${fieldHint}' has no default value and rejects undefined input.\n` +
+        `  Search params are optional — the URL might not contain ?${fieldHint}=anything.\n` +
+        `  Add .default() to your schema or use .optional().`
+    );
+  }
+  return fromSchema(schema);
+}
 
 // ---------------------------------------------------------------------------
 // withDefault
@@ -78,11 +94,13 @@ export function withUrlKey<T>(
   codecOrSchema: SearchParamField<T>,
   urlKey: string
 ): SearchParamCodecWithUrlKey<T> {
-  // Auto-detect Standard Schema (Zod, Valibot, ArkType) and wrap
+  // Auto-detect Standard Schema (Zod, Valibot, ArkType) and wrap.
+  // Validate absent-param handling here since withUrlKey converts to a codec
+  // before resolveField sees it. design/23-search-params.md §"Default Validation"
   const codec: SearchParamCodec<T> = isCodec(codecOrSchema)
     ? codecOrSchema
     : isStandardSchema(codecOrSchema)
-      ? fromSchema(codecOrSchema)
+      ? validateSchemaAbsentParam(codecOrSchema, urlKey)
       : (codecOrSchema as SearchParamCodec<T>);
   return {
     parse: codec.parse.bind(codec),

package/src/segment-params/define.ts

@@ -14,12 +14,7 @@
  */
 
 import type { Codec } from '../codec.js';
-import {
-  type StandardSchemaV1,
-  validateSync,
-  isStandardSchema,
-  isCodec,
-} from '../schema-bridge.js';
+import { type StandardSchemaV1, resolveCodecOrSchema } from '../schema-bridge.js';
 import { useSegmentParams as clientUseSegmentParams } from '../client/use-segment-params.js';
 
 // ---------------------------------------------------------------------------
@@ -114,61 +109,6 @@ export interface ParamsDefinition<T extends Record<string, unknown>> {
 // Internal helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Wrap a Standard Schema into a Codec for route params.
- *
- * Unlike fromSchema for search params:
- * - Parse throws on failure (no fallback to default)
- * - Serialize returns string (not null)
- */
-function fromParamSchema<T>(fieldName: string, schema: StandardSchemaV1<T>): Codec<T> {
-  return {
-    parse(value: string | string[] | undefined): T {
-      // Route params are always strings (single segment) or string[] (catch-all)
-      const input = Array.isArray(value) ? value : value;
-
-      const result = validateSync(schema, input);
-      if (!result.issues) {
-        return result.value;
-      }
-
-      // For route params, parse failure means the param is invalid → throw
-      const messages = result.issues.map((i) => i.message).join(', ');
-      throw new Error(`[timber] Param '${fieldName}' coercion failed: ${messages}`);
-    },
-
-    serialize(value: T): string | null {
-      if (value === null || value === undefined) {
-        return null;
-      }
-      // Catch-all segments produce arrays — join with '/' for path reconstruction
-      if (Array.isArray(value)) {
-        return value.join('/');
-      }
-      return String(value);
-    },
-  };
-}
-
-/**
- * Resolve a field value to a Codec. Auto-detects Standard Schema objects.
- */
-function resolveField(fieldName: string, value: ParamField): Codec<unknown> {
-  if (isCodec(value)) {
-    return value;
-  }
-
-  if (isStandardSchema(value)) {
-    return fromParamSchema(fieldName, value);
-  }
-
-  throw new Error(
-    `[timber] defineSegmentParams: field '${fieldName}' is not a valid codec or Standard Schema. ` +
-      `Expected an object with { parse, serialize } methods, or a Standard Schema object ` +
-      `(Zod, Valibot, ArkType).`
-  );
-}
-
 /**
  * Validate that no codec's serialize returns null.
  * Route params are structural — they must produce a valid path segment.
@@ -224,7 +164,7 @@ export function defineSegmentParams<C extends Record<string, ParamField>>(
   const resolvedCodecs: Record<string, Codec<unknown>> = {};
 
   for (const [key, value] of Object.entries(codecs)) {
-    resolvedCodecs[key] = resolveField(key, value as ParamField);
+    resolvedCodecs[key] = resolveCodecOrSchema(key, value, 'param');
   }
 
   // Validate that serialize doesn't return null

package/src/server/access-gate.tsx

@@ -45,6 +45,14 @@ export function AccessGate(props: AccessGateProps): ReactNode | Promise<ReactNod
     if (verdict === 'pass') {
       return children;
     }
+    // Render deny page in-tree when possible (same as the fallback path).
+    if (verdict instanceof DenySignal && denyPages) {
+      const denyElement = renderMatchingDenyPage(denyPages, verdict.status, verdict.data);
+      if (denyElement) {
+        setDenyStatus(verdict.status);
+        return denyElement;
+      }
+    }
     throw verdict;
   }
 

package/src/server/actions.ts

@@ -14,7 +14,7 @@
  * See design/08-forms-and-actions.md
  */
 
-import { getCacheHandler } from '../cache/handler-store';
+import { cache } from '../cache/cache-api';
 import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
@@ -161,12 +161,14 @@ export async function executeAction(
     }
   });
 
-  // Process tag invalidation via the module-level cache handler singleton.
-  // setCacheHandler() is called at boot from rsc-entry when timber.config.ts
-  // provides a cacheHandler; otherwise falls back to in-memory LRU (TIM-599).
+  // Process tag invalidation through cache.invalidate so it records the
+  // invalidation epoch — an in-flight cached fn must not re-store data this
+  // mutation just invalidated (TIM-1028). cache.invalidate resolves the
+  // module-level handler singleton: setCacheHandler() is called at boot from
+  // rsc-entry when timber.config.ts provides a cacheHandler; otherwise falls
+  // back to in-memory LRU (TIM-599).
   if (state.tags.length > 0) {
-    const handler = getCacheHandler();
-    await Promise.all(state.tags.map((tag) => handler.invalidate({ tag })));
+    await Promise.all(state.tags.map((tag) => cache.invalidate({ tag })));
   }
 
   // Process path revalidation — build element tree (not yet serialized)
@@ -212,28 +214,3 @@ export async function executeAction(
     ...(redirectTo ? { redirectTo, redirectStatus } : {}),
   };
 }
-
-/**
- * Build an HTTP Response for a no-JS form submission.
- * Standard POST → 302 redirect pattern.
- *
- * @param redirectPath - Where to redirect after the action executes.
- */
-export function buildNoJsResponse(redirectPath: string, status: number = 302): Response {
-  return new Response(null, {
-    status,
-    headers: { Location: redirectPath },
-  });
-}
-
-/**
- * Detect whether the incoming request is an RSC action request (with JS)
- * or a plain HTML form POST (no JS).
- *
- * RSC action requests use Accept: text/x-component or Content-Type: text/x-component.
- */
-export function isRscActionRequest(req: Request): boolean {
-  const accept = req.headers.get('Accept') ?? '';
-  const contentType = req.headers.get('Content-Type') ?? '';
-  return accept.includes('text/x-component') || contentType.includes('text/x-component');
-}

package/src/server/build-manifest.ts

@@ -101,19 +101,6 @@ export function buildCssLinkTags(cssUrls: string[]): string {
   return cssUrls.map((url) => `<link rel="stylesheet" href="${url}">`).join('');
 }
 
-/**
- * Generate a Link header value for CSS preload hints.
- *
- * Cloudflare CDN automatically converts Link headers with rel=preload
- * into 103 Early Hints responses. This avoids platform-specific 103
- * sending code.
- *
- * Example output: `</assets/root.css>; as=style; rel=preload, </assets/page.css>; as=style; rel=preload`
- */
-export function buildLinkHeaders(cssUrls: string[]): string {
-  return cssUrls.map((url) => `<${url}>; as=style; rel=preload`).join(', ');
-}
-
 // ─── Font utilities ──────────────────────────────────────────────────────
 
 /**
@@ -161,44 +148,8 @@ export function buildFontPreloadTags(fonts: ManifestFontEntry[]): string {
     .join('');
 }
 
-/**
- * Generate Link header values for font preload hints.
- *
- * Cloudflare CDN converts Link headers with rel=preload into 103 Early Hints.
- *
- * Example: `</fonts/inter.woff2>; as=font; rel=preload; crossorigin`
- */
-export function buildFontLinkHeaders(fonts: ManifestFontEntry[]): string {
-  return fonts.map((f) => `<${f.href}>; as=font; rel=preload; crossorigin`).join(', ');
-}
-
 // ─── JS chunk utilities ──────────────────────────────────────────────────
 
-/**
- * Collect JS chunk URLs for a matched route's segment chain.
- *
- * Walks segments root → leaf, collecting the JS chunk for each layout
- * and page. Deduplicates while preserving order.
- */
-export function collectRouteJs(segments: SegmentWithFiles[], manifest: BuildManifest): string[] {
-  const seen = new Set<string>();
-  const result: string[] = [];
-
-  for (const segment of segments) {
-    for (const file of [segment.layout, segment.page]) {
-      if (!file) continue;
-      const jsUrl = manifest.js[file.filePath];
-      if (!jsUrl) continue;
-      if (!seen.has(jsUrl)) {
-        seen.add(jsUrl);
-        result.push(jsUrl);
-      }
-    }
-  }
-
-  return result;
-}
-
 /**
  * Collect modulepreload URLs for a matched route's segment chain.
  *
@@ -238,10 +189,3 @@ export function collectRouteModulepreloads(
 export function buildModulepreloadTags(urls: string[]): string {
   return urls.map((url) => `<link rel="modulepreload" href="${url}">`).join('');
 }
-
-/**
- * Generate a <script type="module"> tag for a JS entry point.
- */
-export function buildEntryScriptTag(url: string): string {
-  return `<script type="module" src="${url}"></script>`;
-}

package/src/server/canonicalize.ts

@@ -13,11 +13,14 @@ export type CanonicalizeResult = { ok: true; pathname: string } | { ok: false; s
 /**
  * Encoded separators that produce a 400 rejection.
  * %2f (/) and %5c (\) cause path-confusion attacks.
+ *
+ * Shared between the runtime canonicalizer and the build-time route scanner
+ * to ensure both enforce identical security rules. See design/13-security.md.
  */
-const ENCODED_SEPARATOR_RE = /%2f|%5c/i;
+export const ENCODED_SEPARATOR_RE = /%2f|%5c/i;
 
-/** Null byte — rejected. */
-const NULL_BYTE_RE = /%00/i;
+/** Null byte — rejected. Shared with the route scanner. */
+export const NULL_BYTE_RE = /%00/i;
 
 /**
  * Canonicalize a URL pathname.

package/src/server/deny-boundary.ts

@@ -31,10 +31,14 @@
 
 import { createElement } from 'react';
 
+import { ErrorReconstituter } from '../client/error-reconstituter.js';
+import type { SerializableError } from '../client/error-reconstituter.js';
 import { requestContextAls } from './als-registry.js';
 import { DenySignal } from './primitives.js';
 import { loadModule } from './safe-load.js';
+import { LEGACY_FILE_TO_STATUS } from './status-code-resolver.js';
 import { withSpan } from './tracing.js';
+import { isMdxFilePath } from './utils/mdx-file.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -45,6 +49,15 @@ export interface DenyPageEntry {
   status: number | null;
   /** The component to render (server or client — both work). */
   component: (...args: unknown[]) => unknown;
+  /**
+   * How the entry matched: a status-code file (404.tsx/4xx.tsx), a legacy
+   * compat file (not-found.tsx/forbidden.tsx/unauthorized.tsx), or the
+   * error.tsx catch-all. error.tsx entries render with their documented
+   * { error, digest, reset } contract, not bare deny props. See TIM-1081.
+   */
+  kind: 'status' | 'legacy' | 'error';
+  /** MDX files are server components — rendered with plain props, never ErrorReconstituter. */
+  isMdx: boolean;
 }
 
 // ─── Chain Construction ──────────────────────────────────────────────────
@@ -56,10 +69,14 @@ export interface DenyPageEntry {
  * status-code file components in fallback order:
  * 1. Specific status files (403.tsx, 404.tsx) — exact match
  * 2. Category catch-alls (4xx.tsx) — matches any 4xx
- * 3. error.tsx — catches everything
+ * 3. Legacy compat files (not-found.tsx → 404, forbidden.tsx → 403,
+ *    unauthorized.tsx → 401) — exact match
+ * 4. error.tsx — catches everything
  *
  * Each segment is checked in this order. The chain is ordered so the
- * FIRST match wins at catch time.
+ * FIRST match wins at catch time. This mirrors resolveStatusFile's 4xx
+ * component chain (status-code-resolver.ts) — the two walks must stay in
+ * sync or in-tree and re-render deny paths resolve different files.
  */
 export async function buildDenyPageChain(
   segments: ManifestSegmentNode[],
@@ -82,7 +99,12 @@ export async function buildDenyPageChain(
         if (!isNaN(status)) {
           const mod = await loadModule(file).catch(() => null);
           if (mod?.default) {
-            chain.push({ status, component: mod.default as (...args: unknown[]) => unknown });
+            chain.push({
+              status,
+              component: mod.default as (...args: unknown[]) => unknown,
+              kind: 'status',
+              isMdx: isMdxFilePath(file.filePath),
+            });
           }
         }
       }
@@ -97,21 +119,50 @@ export async function buildDenyPageChain(
           chain.push({
             status: categoryStatus,
             component: mod.default as (...args: unknown[]) => unknown,
+            kind: 'status',
+            isMdx: isMdxFilePath(file.filePath),
           });
         }
       }
     }
   }
 
-  // Pass 2: error.tsx files — lowest priority catch-all.
-  // Only added AFTER all status files so they never shadow a specific
-  // or category status file from an ancestor segment.
+  // Pass 2: legacy compat files (not-found.tsx → 404, forbidden.tsx → 403,
+  // unauthorized.tsx → 401). Lower priority than status files (a root
+  // 4xx.tsx beats a leaf not-found.tsx) but higher than error.tsx — the
+  // same ordering as resolveStatusFile's resolve4xx. See TIM-1081.
+  for (let i = startIndex; i >= 0; i--) {
+    const segment = segments[i];
+    if (!segment.legacyStatusFiles) continue;
+    for (const [name, status] of Object.entries(LEGACY_FILE_TO_STATUS)) {
+      const file = segment.legacyStatusFiles[name];
+      if (!file) continue;
+      const mod = await loadModule(file).catch(() => null);
+      if (mod?.default) {
+        chain.push({
+          status,
+          component: mod.default as (...args: unknown[]) => unknown,
+          kind: 'legacy',
+          isMdx: isMdxFilePath(file.filePath),
+        });
+      }
+    }
+  }
+
+  // Pass 3: error.tsx files — lowest priority catch-all.
+  // Only added AFTER all status and legacy files so they never shadow a
+  // more specific file from an ancestor segment.
   for (let i = startIndex; i >= 0; i--) {
     const segment = segments[i];
     if (segment.error) {
       const mod = await loadModule(segment.error).catch(() => null);
       if (mod?.default) {
-        chain.push({ status: null, component: mod.default as (...args: unknown[]) => unknown });
+        chain.push({
+          status: null,
+          component: mod.default as (...args: unknown[]) => unknown,
+          kind: 'error',
+          isMdx: isMdxFilePath(segment.error.filePath),
+        });
       }
     }
   }
@@ -130,25 +181,67 @@ export function renderMatchingDenyPage(
   status: number,
   data: unknown
 ): React.ReactElement | null {
-  const h = createElement as (...args: unknown[]) => React.ReactElement;
-
   for (const entry of chain) {
     if (entry.status === status) {
-      return h(entry.component, { status, dangerouslyPassData: data });
+      return renderDenyEntry(entry, status, data);
     }
     if (entry.status === 400 && status >= 400 && status <= 499) {
-      return h(entry.component, { status, dangerouslyPassData: data });
+      return renderDenyEntry(entry, status, data);
     }
     if (entry.status === 500 && status >= 500 && status <= 599) {
-      return h(entry.component, { status, dangerouslyPassData: data });
+      return renderDenyEntry(entry, status, data);
     }
     if (entry.status === null) {
-      return h(entry.component, { status, dangerouslyPassData: data });
+      return renderDenyEntry(entry, status, data);
     }
   }
   return null;
 }
 
+/**
+ * Build the element for a matched deny chain entry with the props contract
+ * the file's convention documents:
+ *
+ * - Status-code and legacy files: { status, dangerouslyPassData }
+ * - error.tsx (TSX): { error, digest, reset } via ErrorReconstituter, plus
+ *   { status, dangerouslyPassData } for dual-shape implementations. Without
+ *   the Error prop, any error.tsx written per the docs (reading
+ *   error.message) crashes — turning a clean deny(404) into a 500. TIM-1081.
+ * - error.mdx: plain { status } — server component, static content.
+ */
+export function renderDenyEntry(
+  entry: DenyPageEntry,
+  status: number,
+  data: unknown
+): React.ReactElement {
+  const h = createElement as (...args: unknown[]) => React.ReactElement;
+
+  if (entry.kind !== 'error') {
+    return h(entry.component, { status, dangerouslyPassData: data });
+  }
+
+  // MDX error pages receive plain props — no Error serialization possible.
+  if (entry.isMdx) {
+    return h(entry.component, { status });
+  }
+
+  // The message is derived solely from the status code (already on the
+  // wire) — safe to cross the RSC→client boundary in production. No stack,
+  // no user data. See design/13-security.md §"Errors don't leak".
+  const serializableDeny: SerializableError = {
+    message: `Access denied with status ${status}`,
+    name: 'DenySignal',
+  };
+  return h(ErrorReconstituter, {
+    error: serializableDeny,
+    digest: null,
+    reset: undefined,
+    component: entry.component,
+    status,
+    dangerouslyPassData: data,
+  });
+}
+
 // ─── Page Boundary ────────────────────────────────────────────────────────
 
 /**

package/src/server/deny-renderer.ts

@@ -19,8 +19,11 @@ import { createElement } from 'react';
 import { renderToReadableStream } from '../rsc-runtime/rsc.js';
 
 import { DenySignal } from './primitives.js';
+import { renderDenyEntry, type DenyPageEntry } from './deny-boundary.js';
+import { getCookiesForSsr } from './cookie-context.js';
 import { logRenderError } from './logger.js';
 import { loadModule } from './safe-load.js';
+import { isMdxFilePath } from './utils/mdx-file.js';
 import { isDebug } from './debug.js';
 import { escapeHtml } from './utils/escape-html.js';
 import { resolveMetadata, renderMetadataToElements } from './metadata.js';
@@ -62,6 +65,29 @@ function isApiRoute(segments: ReadonlyArray<ManifestSegmentNode>): boolean {
   return !!leaf?.route;
 }
 
+/**
+ * Build the deny page element for a resolved status file with the correct
+ * props contract for the file's convention. Delegates to renderDenyEntry
+ * (deny-boundary.ts) so the in-tree and re-render deny paths render
+ * identical elements — in particular, error.tsx serving a deny gets
+ * { error, digest, reset } via ErrorReconstituter, not bare deny props.
+ * See TIM-1081.
+ */
+function buildDenyElement(
+  deny: DenySignal,
+  component: (...args: unknown[]) => unknown,
+  resolutionKind: 'exact' | 'category' | 'legacy' | 'error',
+  filePath: string
+): React.ReactElement {
+  const entry: DenyPageEntry = {
+    status: deny.status,
+    component,
+    kind: resolutionKind === 'error' ? 'error' : resolutionKind === 'legacy' ? 'legacy' : 'status',
+    isMdx: isMdxFilePath(filePath),
+  };
+  return renderDenyEntry(entry, deny.status, deny.data);
+}
+
 /**
  * Render a status-code error page for a DenySignal.
  *
@@ -120,12 +146,15 @@ export async function renderDenyPage(
   const ErrorPageComponent = mod.default as (...args: unknown[]) => unknown;
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  // 4xx status-code pages receive { status, dangerouslyPassData }
-  // per design/10-error-handling.md §"Status-Code File Props"
-  let element = h(ErrorPageComponent, {
-    status: deny.status,
-    dangerouslyPassData: deny.data,
-  });
+  // 4xx status-code pages receive { status, dangerouslyPassData }; an
+  // error.tsx match gets { error, digest, reset } via ErrorReconstituter.
+  // See design/10-error-handling.md §"Status-Code File Props" and TIM-1081.
+  let element = buildDenyElement(
+    deny,
+    ErrorPageComponent,
+    resolution.kind,
+    resolution.file.filePath
+  );
 
   // Always wrap in layout shell.
   // NOTE: Shell opt-out (export const shell = false) is a future feature
@@ -156,6 +185,7 @@ export async function renderDenyPage(
 
   // Render the error page to a fresh RSC Flight stream.
   const rscStream = renderToReadableStream(element, {
+    signal: req.signal,
     onError(error: unknown) {
       logRenderError({ method: req.method, path: new URL(req.url).pathname, error });
     },
@@ -173,6 +203,8 @@ export async function renderDenyPage(
     headHtml: headHtml + flightInitScript(),
     bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
     rscStream: inlineStream,
+    signal: req.signal,
+    cookies: getCookiesForSsr(),
   };
 
   return callSsr(ssrStream, navContext);
@@ -188,6 +220,7 @@ export async function renderDenyPageAsRsc(
   deny: DenySignal,
   segments: ManifestSegmentNode[],
   layoutComponents: LayoutEntry[],
+  req: Request,
   responseHeaders: Headers,
   createDebugChannelSink: DebugChannelFactory
 ): Promise<Response> {
@@ -207,10 +240,12 @@ export async function renderDenyPageAsRsc(
   const ErrorPageComponent = mod.default as (...args: unknown[]) => unknown;
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  let element = h(ErrorPageComponent, {
-    status: deny.status,
-    dangerouslyPassData: deny.data,
-  });
+  let element = buildDenyElement(
+    deny,
+    ErrorPageComponent,
+    resolution.kind,
+    resolution.file.filePath
+  );
 
   // Always wrap in layout shell.
   const resolvedSegments = new Set(segments.slice(0, resolution.segmentIndex + 1));
@@ -221,6 +256,7 @@ export async function renderDenyPageAsRsc(
   }
 
   const rscStream = renderToReadableStream(element, {
+    signal: req.signal,
     onError(error: unknown) {
       console.error('[timber] Error page RSC render error:', error);
     },