@timber-js/app 0.2.0-alpha.158 → 0.2.0-alpha.159

package/src/routing/export-detect.ts

@@ -0,0 +1,304 @@
+/**
+ * AST-based export detection for route files.
+ *
+ * Uses Vite's `parseAst` (backed by oxc) to precisely detect named and
+ * default exports, replacing the regex-based approach that was fragile
+ * with TypeScript syntax (type exports, `as` aliases, comments, etc.).
+ */
+
+import { existsSync } from 'node:fs';
+import { parseAst } from 'vite';
+import { readFileCached } from './file-cache.js';
+
+interface AstNode {
+  type: string;
+  exportKind?: string;
+  declaration?: AstNode;
+  specifiers?: Array<{
+    exported?: { name: string };
+    local?: { name: string };
+    exportKind?: string;
+  }>;
+  id?: { name: string };
+  declarations?: Array<{ id?: { name: string } }>;
+}
+
+interface ProgramNode {
+  body: AstNode[];
+}
+
+function tryParse(source: string): ProgramNode | null {
+  try {
+    return parseAst(source, { lang: 'tsx' }) as unknown as ProgramNode;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Collect all named export identifiers from a parsed program.
+ * Handles: `export function X`, `export const X`, `export { X }`,
+ * `export { X } from '...'`, `export { Y as X }`.
+ */
+function collectNamedExports(program: ProgramNode): Set<string> {
+  const names = new Set<string>();
+  for (const stmt of program.body) {
+    if (stmt.type !== 'ExportNamedDeclaration') continue;
+    // Skip `export type ...` declarations — they're erased at runtime
+    if (stmt.exportKind === 'type') continue;
+
+    if (stmt.declaration) {
+      if (stmt.declaration.id?.name) {
+        names.add(stmt.declaration.id.name);
+      }
+      if (stmt.declaration.declarations) {
+        for (const decl of stmt.declaration.declarations) {
+          if (decl.id?.name) names.add(decl.id.name);
+        }
+      }
+    }
+
+    if (stmt.specifiers) {
+      for (const spec of stmt.specifiers) {
+        // Skip `export { type X }` — per-specifier type exports
+        if (spec.exportKind === 'type') continue;
+        if (spec.exported?.name && spec.exported.name !== 'default') {
+          names.add(spec.exported.name);
+        }
+      }
+    }
+  }
+  return names;
+}
+
+/**
+ * Check whether a program has a default export.
+ * Handles: `export default ...`, `export { X as default }`,
+ * `export { default } from '...'`.
+ */
+function hasDefaultExport(program: ProgramNode): boolean {
+  for (const stmt of program.body) {
+    if (stmt.type === 'ExportDefaultDeclaration') return true;
+    if (stmt.type === 'ExportNamedDeclaration' && stmt.specifiers) {
+      for (const spec of stmt.specifiers) {
+        if (spec.exported?.name === 'default') return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Check whether a program has any bare `export * from '...'` declarations.
+ * Excludes `export * as X from '...'` (namespace re-exports) since those
+ * create a namespace object, not individual top-level exports.
+ */
+function hasStarExport(program: ProgramNode): boolean {
+  return program.body.some(
+    (stmt) =>
+      stmt.type === 'ExportAllDeclaration' && !(stmt as any).exported && stmt.exportKind !== 'type'
+  );
+}
+
+/**
+ * Check if a file exports a specific named export.
+ * Returns false if the file doesn't exist or can't be parsed.
+ */
+export function fileHasExport(filePath: string, exportName: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return false;
+    return collectNamedExports(program).has(exportName);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if a file has any of the given named exports.
+ * Returns the set of matching export names.
+ */
+export function fileHasAnyExport(filePath: string, exportNames: readonly string[]): Set<string> {
+  const matches = new Set<string>();
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return matches;
+    const exports = collectNamedExports(program);
+    for (const name of exportNames) {
+      if (exports.has(name)) matches.add(name);
+    }
+  } catch {
+    // Graceful fallback: return empty set
+  }
+  return matches;
+}
+
+/**
+ * Check if a file has a default export.
+ * Returns false if the file doesn't exist or can't be parsed.
+ */
+export function fileHasDefaultExport(filePath: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return false;
+    return hasDefaultExport(program);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if a file has any `export * from '...'` declarations.
+ * Returns false if the file doesn't exist or can't be parsed.
+ */
+export function fileHasStarExport(filePath: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return false;
+    return hasStarExport(program);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Parsed value of `export const prerender` from a route file.
+ *
+ * - `true` / `false` — literal boolean
+ * - `{ ttl?, tags? }` — ISR options object (prerender: true is implied)
+ * - `undefined` — no `export const prerender` found
+ *
+ * See design/45-cache-lifetimes.md §"Route-Level Static".
+ */
+export type PrerenderExportValue = boolean | { ttl?: number; tags?: string[] };
+
+function extractLiteralValue(node: AstNode): unknown {
+  if (!node) return undefined;
+  const n = node as any;
+  if (n.type === 'Literal') return n.value;
+  if (n.type === 'UnaryExpression' && n.operator === '-' && n.argument?.type === 'Literal') {
+    return -(n.argument.value as number);
+  }
+  if (n.type === 'ArrayExpression') {
+    const elements = n.elements as AstNode[] | undefined;
+    if (!elements) return undefined;
+    const result: unknown[] = [];
+    for (const el of elements) {
+      const v = extractLiteralValue(el);
+      if (v === undefined) return undefined;
+      result.push(v);
+    }
+    return result;
+  }
+  return undefined;
+}
+
+function extractObjectLiteral(node: AstNode): Record<string, unknown> | undefined {
+  if ((node as any).type !== 'ObjectExpression') return undefined;
+  const props = (node as any).properties as AstNode[] | undefined;
+  if (!props) return undefined;
+  const result: Record<string, unknown> = {};
+  for (const prop of props) {
+    const p = prop as any;
+    if (p.type === 'SpreadElement') return undefined;
+    if (p.type !== 'Property' || p.computed) return undefined;
+    const key =
+      p.key?.type === 'Identifier'
+        ? p.key.name
+        : p.key?.type === 'Literal'
+          ? String(p.key.value)
+          : undefined;
+    if (!key) return undefined;
+    const value = extractLiteralValue(p.value);
+    if (value === undefined) return undefined;
+    result[key] = value;
+  }
+  return result;
+}
+
+/**
+ * Extract the value of `export const prerender` from a file.
+ * Returns undefined if the file doesn't export `prerender` or can't be parsed.
+ *
+ * Supports:
+ *   export const prerender = true;
+ *   export const prerender = false;
+ *   export const prerender = { ttl: 3600, tags: ['docs'] };
+ */
+export function getPrerenderExport(filePath: string): PrerenderExportValue | undefined {
+  if (!existsSync(filePath)) return undefined;
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return undefined;
+
+    for (const stmt of program.body) {
+      if (stmt.type !== 'ExportNamedDeclaration') continue;
+      if (stmt.exportKind === 'type') continue;
+      if (!stmt.declaration) continue;
+      const decl = stmt.declaration;
+      if (decl.type !== 'VariableDeclaration') continue;
+      const declarations = decl.declarations as
+        | Array<{
+            id?: { name?: string };
+            init?: AstNode;
+          }>
+        | undefined;
+      if (!declarations) continue;
+      for (const d of declarations) {
+        if (d.id?.name !== 'prerender' || !d.init) continue;
+        const init = d.init as any;
+        if (init.type === 'Literal' && typeof init.value === 'boolean') {
+          return init.value;
+        }
+        if (init.type === 'ObjectExpression') {
+          const obj = extractObjectLiteral(init);
+          if (!obj) return undefined;
+          const result: { ttl?: number; tags?: string[] } = {};
+          if ('ttl' in obj && typeof obj.ttl === 'number') result.ttl = obj.ttl;
+          if (
+            'tags' in obj &&
+            Array.isArray(obj.tags) &&
+            obj.tags.every((t: unknown) => typeof t === 'string')
+          ) {
+            result.tags = obj.tags as string[];
+          }
+          return result;
+        }
+        return undefined;
+      }
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Check if a file starts with a specific directive (e.g. "use client").
+ * Directives are string literal expression statements at the top of the file.
+ */
+export function fileHasDirective(filePath: string, directive: string): boolean {
+  if (!existsSync(filePath)) return false;
+  try {
+    const source = readFileCached(filePath);
+    const program = tryParse(source);
+    if (!program) return false;
+    for (const stmt of program.body) {
+      if (stmt.type !== 'ExpressionStatement') break;
+      const expr = (stmt as any).expression;
+      if (expr?.type !== 'Literal' || typeof expr.value !== 'string') break;
+      if (expr.value === directive) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}

package/src/routing/manifest-codegen.ts

@@ -11,8 +11,8 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { collectInterceptionRewrites } from './interception.js';
+import { fileHasExport } from './export-detect.js';
 import type { RouteTree, SegmentNode, RouteFile } from './types.js';
-import { readFileCached } from './file-cache.js';
 
 // ── Single-file conventions ─────────────────────────────────────────────
 // Each entry maps to a node property that holds a single RouteFile.
@@ -236,16 +236,7 @@ export function generateSearchParamsRegistryModule(tree: RouteTree): string {
 }
 
 function fileHasSearchParamsExport(filePath: string): boolean {
-  try {
-    if (!existsSync(filePath)) return false;
-    const content = readFileCached(filePath);
-    return (
-      /export\s+(const|let|var)\s+searchParams\b/.test(content) ||
-      /export\s*\{[^}]*\bsearchParams\b[^}]*\}/.test(content)
-    );
-  } catch {
-    return false;
-  }
+  return fileHasExport(filePath, 'searchParams');
 }
 
 // ── Schema module ───────────────────────────────────────────────────────

package/src/rsc-runtime/rsc.ts

@@ -18,4 +18,11 @@ export {
   decodeAction,
   encryptActionBoundArgs,
   decryptActionBoundArgs,
+  // Flight client running INSIDE the RSC environment — decodes a cached
+  // flight payload back into React elements. Client references revive as
+  // re-serializable reference proxies via plugin-rsc's server-decode
+  // manifest (registerClientReference under the hood). Used by the
+  // prebuilt component runtime (TIM-1140); same mechanism as Next.js
+  // "use cache" (use-cache-wrapper.ts).
+  createFromReadableStream,
 } from '@vitejs/plugin-rsc/rsc';

package/src/server/action-handler.ts

@@ -35,7 +35,6 @@ import {
 } from './sensitive-fields.js';
 import type { FormFlashData } from './form-flash.js';
 import { checkVersionSkew, applyReloadHeaders } from './version-skew.js';
-import { encodeHeadHeader, HEAD_HEADER } from '../shared/head-header.js';
 import { logActionError } from './logger.js';
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -300,17 +299,9 @@ async function handleRscAction(
       _tree: result.revalidation.element,
     };
     headers['X-Timber-Revalidation'] = '1';
-    // Forward head elements (percent-encoded JSON) so the client can update
-    // <head>. Raw JSON.stringify is NOT safe here: header values must be
-    // ByteStrings, so a title with an em dash or emoji would make
-    // `new Response(...)` throw — a 500 after the action's mutation already
-    // committed, dropping Set-Cookie too. See TIM-1058.
-    if (result.revalidation.headElements.length > 0) {
-      const encodedHead = encodeHeadHeader(result.revalidation.headElements);
-      if (encodedHead !== null) {
-        headers[HEAD_HEADER] = encodedHead;
-      }
-    }
+    // Metadata (<title>/<meta>/<link>) now rides the revalidation element
+    // tree as React elements — React 19 Float manages them in document.head
+    // during client rendering. No X-Timber-Head header needed. See TIM-1151.
   } else {
     payload = result.actionResult;
   }
@@ -347,19 +338,6 @@ async function handleFormAction(
     return new Response(null, { status: fieldResult.status });
   }
 
-  // Check if this is actually a React server action form.
-  // If there's no $ACTION_REF_* or $ACTION_KEY, it's a regular form POST
-  // that should be handled by the route's route handler, not here.
-  // React uses `$ACTION_REF_` + identifierPrefix — since we don't set one,
-  // the suffix is empty. Check for any key starting with $ACTION_REF_ or $ACTION_ID_.
-  const allKeys = [...formData.keys()];
-  const hasActionField = allKeys.some(
-    (k) => k.startsWith('$ACTION_REF_') || k.startsWith('$ACTION_ID_')
-  );
-  if (!hasActionField && !formData.has('$ACTION_KEY')) {
-    return null;
-  }
-
   // Capture submitted values for re-render on validation failure.
   // Parse before decodeAction consumes the FormData, then strip sensitive
   // fields (passwords, tokens, CVV, etc.) so they are never rendered back
@@ -371,8 +349,14 @@ async function handleFormAction(
   const submittedValues = stripSensitiveFields(parseFormData(formData), sensitivePredicate);
 
   // decodeAction resolves the action function from the form data's hidden fields.
-  // It returns a bound function with the form data already applied.
-  const actionFn = (await decodeAction(formData)) as (...args: unknown[]) => Promise<unknown>;
+  // Returns null when no $ACTION_REF_/$ACTION_ID_ fields are present — meaning
+  // this is a regular form POST, not a React server action.
+  const actionFn = (await decodeAction(formData)) as
+    | ((...args: unknown[]) => Promise<unknown>)
+    | null;
+  if (!actionFn) {
+    return null;
+  }
 
   // Execute the action — no additional args needed (form data is already bound).
   // Errors are caught to prevent stack traces from leaking in the response.

package/src/server/actions.ts

@@ -18,16 +18,12 @@ import { cache } from '../cache/cache-api';
 import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
-import type { HeadElementPayload } from '../shared/head-header.js';
-
 // ─── Types ───────────────────────────────────────────────────────────────
 
 /** Result of rendering a revalidation — element tree before RSC serialization. */
 export interface RevalidationResult {
   /** React element tree (pre-serialization — passed to renderToReadableStream). */
   element: unknown;
-  /** Resolved head elements for metadata (forwarded via X-Timber-Head). */
-  headElements: HeadElementPayload[];
 }
 
 /** Renderer function that builds a React element tree for a given path. */
@@ -168,6 +164,9 @@ export async function executeAction(
   // rsc-entry when timber.config.ts provides a cacheHandler; otherwise falls
   // back to in-memory LRU (TIM-599).
   if (state.tags.length > 0) {
+    // cache.invalidate handles both data-cache clearing AND component-seed
+    // tombstone writes (design/45 §ISR mechanics) — no separate tombstone
+    // step needed here.
     await Promise.all(state.tags.map((tag) => cache.invalidate({ tag })));
   }
 

package/src/server/als-registry.ts

@@ -150,6 +150,13 @@ export interface TraceStore {
   traceId: string;
   /** OTEL span ID if available, undefined otherwise. */
   spanId?: string;
+  /**
+   * Innermost active native platform span (e.g. Cloudflare's `Span` from
+   * tracing.enterSpan()). Tracked so setSpanAttribute() can set attributes
+   * after span creation — the platform API has no getActiveSpan() equivalent.
+   * Saved/restored by withSpan() around each callback. See TIM-1135.
+   */
+  platformSpan?: import('./tracing.js').PlatformSpan;
 }
 
 /** @internal — import via tracing.ts public API */

package/src/server/cookie-parsing.ts

@@ -9,8 +9,14 @@
  * live in the API surface — `cookie-context.ts` invokes them at every
  * jar entry point so the smuggling-primitive invariant from TIM-868
  * is enforced regardless of which path produced the bytes).
+ *
+ * Delegates to the `cookie` package (RFC 6265, dependency-free,
+ * browser-safe) for wire codecs. Adapts at the boundary to preserve
+ * timber's Map-based API and never-throw contract.
  */
 
+import { parseCookie, parseSetCookie as upstreamParseSetCookie, stringifySetCookie } from 'cookie';
+
 import type { CookieEntry } from './als-registry.js';
 import type { CookieOptions } from './cookie-context.js';
 
@@ -28,14 +34,13 @@ export function parseCookieHeader(header: string): Map<string, string> {
   const map = new Map<string, string>();
   if (!header) return map;
 
-  for (const pair of header.split(';')) {
-    const eqIndex = pair.indexOf('=');
-    if (eqIndex === -1) continue;
-    const name = pair.slice(0, eqIndex).trim();
-    const value = pair.slice(eqIndex + 1).trim();
-    if (name && !map.has(name)) {
-      map.set(name, safeDecodeCookieValue(value));
-    }
+  // cookie.parseCookie returns a plain object with first-wins semantics
+  // and uses safeDecodeURIComponent by default (try/catch around
+  // decodeURIComponent, falls back to raw). This matches our contract.
+  const parsed = parseCookie(header);
+  for (const name in parsed) {
+    const value = parsed[name];
+    if (value !== undefined) map.set(name, value);
   }
 
   return map;
@@ -48,6 +53,9 @@ export function parseCookieHeader(header: string): Map<string, string> {
  * Used by both `parseCookieHeader` (incoming Cookie: header) and the
  * `setRaw` forwarding path (outgoing Set-Cookie from upstream services).
  * Total — never throws.
+ *
+ * cookie's internal decode has identical semantics but is not exported,
+ * so we keep this standalone helper.
  */
 export function safeDecodeCookieValue(raw: string): string {
   try {
@@ -57,8 +65,43 @@ export function safeDecodeCookieValue(raw: string): string {
   }
 }
 
-/** Serialize a CookieEntry into a Set-Cookie header value. */
+/**
+ * Serialize a CookieEntry into a Set-Cookie header value.
+ *
+ * Total — never throws. If the cookie package's serializer rejects
+ * the input (e.g. non-integer maxAge, forbidden chars in name/value),
+ * falls back to a minimal hand-rolled serialization so the response
+ * path is never interrupted by a codec error.
+ */
 export function serializeCookieEntry(entry: CookieEntry): string {
+  try {
+    return stringifySetCookie(
+      {
+        name: entry.name,
+        value: entry.value,
+        domain: entry.options.domain,
+        path: entry.options.path,
+        expires: entry.options.expires,
+        maxAge: entry.options.maxAge,
+        httpOnly: entry.options.httpOnly,
+        secure: entry.options.secure,
+        sameSite: entry.options.sameSite,
+        partitioned: entry.options.partitioned,
+      },
+      // timber pre-encodes values at the API surface (set() calls
+      // encodeURIComponent), so pass identity to avoid double-encoding.
+      { encode: (v: string) => v }
+    );
+  } catch {
+    // Fallback: hand-roll a minimal Set-Cookie so we never drop the
+    // header entirely. The entry-point validators in cookie-context.ts
+    // already reject truly dangerous input — this path only fires for
+    // edge-case formatting the upstream serializer is strict about.
+    return serializeCookieEntryFallback(entry);
+  }
+}
+
+function serializeCookieEntryFallback(entry: CookieEntry): string {
   const parts = [`${entry.name}=${entry.value}`];
   const opts = entry.options;
 
@@ -88,60 +131,33 @@ export function serializeCookieEntry(entry: CookieEntry): string {
 export function parseSetCookie(
   header: string
 ): { name: string; value: string; options: CookieOptions } | null {
-  const segments = header.split(';');
-  const nameValue = segments[0];
-  const eqIdx = nameValue.indexOf('=');
-  if (eqIdx <= 0) return null;
+  const parsed = upstreamParseSetCookie(header, {
+    // Don't decode — setRaw expects the wire-form value so it can
+    // re-emit verbatim and validate against cookie-octet.
+    decode: (v: string) => v,
+  });
+
+  // cookie.parseSetCookie always returns a SetCookie object, but
+  // with name/value as empty strings when the header has no `=`.
+  if (!parsed.name) return null;
 
-  const name = nameValue.slice(0, eqIdx).trim();
-  const value = nameValue.slice(eqIdx + 1).trim();
   const options: CookieOptions = {};
 
-  for (let i = 1; i < segments.length; i++) {
-    const seg = segments[i].trim();
-    if (!seg) continue;
-    const [attrName, ...rest] = seg.split('=');
-    const key = attrName.trim().toLowerCase();
-    const val = rest.join('=').trim();
-    switch (key) {
-      case 'path':
-        options.path = val || '/';
-        break;
-      case 'domain':
-        options.domain = val;
-        break;
-      case 'max-age': {
-        // RFC 6265 §5.2.2: a non-numeric Max-Age is ignored, not fatal.
-        // Dropping NaN/Infinity here keeps this parser total and keeps
-        // `Max-Age=NaN` out of the serialized Set-Cookie header.
-        const maxAge = Number(val);
-        if (Number.isFinite(maxAge)) options.maxAge = maxAge;
-        break;
-      }
-      case 'expires':
-        options.expires = new Date(val);
-        break;
-      case 'samesite': {
-        // Unknown SameSite values are ignored (browsers treat them as
-        // unspecified) so forwarding a quirky upstream header via
-        // setFromHeaders never trips the entry-point validator.
-        const sameSite = val.toLowerCase();
-        if (sameSite === 'strict' || sameSite === 'lax' || sameSite === 'none') {
-          options.sameSite = sameSite;
-        }
-        break;
-      }
-      case 'secure':
-        options.secure = true;
-        break;
-      case 'httponly':
-        options.httpOnly = true;
-        break;
-      case 'partitioned':
-        options.partitioned = true;
-        break;
+  if (parsed.path !== undefined) options.path = parsed.path || '/';
+  if (parsed.domain !== undefined) options.domain = parsed.domain;
+  if (parsed.maxAge !== undefined && Number.isFinite(parsed.maxAge)) {
+    options.maxAge = parsed.maxAge;
+  }
+  if (parsed.expires !== undefined) options.expires = parsed.expires;
+  if (parsed.sameSite !== undefined && parsed.sameSite !== true) {
+    const sameSite = (parsed.sameSite as string).toLowerCase();
+    if (sameSite === 'strict' || sameSite === 'lax' || sameSite === 'none') {
+      options.sameSite = sameSite;
     }
   }
+  if (parsed.secure) options.secure = true;
+  if (parsed.httpOnly) options.httpOnly = true;
+  if (parsed.partitioned) options.partitioned = true;
 
-  return { name, value, options };
+  return { name: parsed.name, value: parsed.value ?? '', options };
 }

package/src/server/deny-renderer.ts

@@ -15,7 +15,7 @@
  * See design/10-error-handling.md §"Status-Code Files"
  */
 
-import { createElement } from 'react';
+import { createElement, Fragment } from 'react';
 import { renderToReadableStream } from '../rsc-runtime/rsc.js';
 
 import { DenySignal } from './primitives.js';
@@ -25,8 +25,8 @@ import { logRenderError } from './logger.js';
 import { loadModule } from './safe-load.js';
 import { isMdxFilePath } from './utils/mdx-file.js';
 import { isDebug } from './debug.js';
-import { escapeHtml } from './utils/escape-html.js';
 import { resolveMetadata, renderMetadataToElements } from './metadata.js';
+import { headElementsToReact } from './route-element-builder.js';
 import { resolveStatusFile } from './status-code-resolver.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
 import type { RouteMatch } from './pipeline.js';
@@ -166,21 +166,13 @@ export async function renderDenyPage(
     element = h(component, null, element);
   }
 
-  // Build head HTML from error page metadata (if any)
-  let headHtml = '';
+  // Embed metadata as React elements in the tree — React 19 Float hoists
+  // them into <head> during SSR. See TIM-1151.
   if (mod.metadata) {
     const resolvedMeta = resolveMetadata([{ metadata: mod.metadata as Metadata, isPage: true }]);
     const headElements = renderMetadataToElements(resolvedMeta);
-    for (const el of headElements) {
-      if (el.tag === 'title' && el.content) {
-        headHtml += `<title>${escapeHtml(el.content)}</title>`;
-      } else if (el.attrs) {
-        const attrs = Object.entries(el.attrs)
-          .map(([k, v]) => `${k}="${escapeHtml(v)}"`)
-          .join(' ');
-        headHtml += `<${el.tag} ${attrs}>`;
-      }
-    }
+    const metaEl = headElementsToReact(headElements);
+    element = h(Fragment, null, metaEl, element);
   }
 
   // Render the error page to a fresh RSC Flight stream.
@@ -200,7 +192,7 @@ export async function renderDenyPage(
     searchParams: Object.fromEntries(new URL(req.url).searchParams),
     statusCode: deny.status,
     responseHeaders,
-    headHtml: headHtml + flightInitScript(),
+    headHtml: flightInitScript(),
     bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
     rscStream: inlineStream,
     signal: req.signal,