@timber-js/app 0.2.0-alpha.170 → 0.2.0-alpha.172

package/src/server/rsc-entry/helpers.ts

@@ -7,6 +7,8 @@
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { swallow } from '../logger.js';
 import { computeSegmentKeys } from '../state-tree-diff.js';
+import type { SlotSkipEntry } from '../slot-resolver.js';
+import { isClientReference } from '../route-element-builder.js';
 
 /** RSC content type for client navigation payload requests. */
 export const RSC_CONTENT_TYPE = 'text/x-component';
@@ -166,43 +168,76 @@ export function parseDebugRows(text: string): DebugComponentEntry[] {
 
 /**
  * Build segment metadata for the X-Timber-Segments response header.
- * Describes the rendered segment chain with async status, enabling
- * the client to populate its segment cache for state tree diffing.
+ * Describes the rendered segment chain with request-dependency status,
+ * enabling the client to populate its segment cache for state tree diffing.
+ *
+ * Request-dependency is determined by render-time taint tracking via
+ * runInTaintScope(). If taint results are available (RSC payload path),
+ * segments/slots that called getHeaders()/getSearchParams()/cookies()
+ * are marked request-dependent. Missing taint data (SSR path) defaults
+ * to true (safe fallback — never incorrectly cached).
  *
- * Async detection: server components defined as `async function` have
- * constructor.name === 'AsyncFunction'. These layouts always re-render
- * on navigation (they may depend on request context like cookies/params).
  * See design/07-routing.md §"Server Diffing Rules".
  */
+interface SegmentInfoEntry {
+  path: string;
+  segmentId?: string;
+  isRequestDependent: boolean;
+  slot?: boolean;
+  parentSegment?: string;
+  denied?: boolean;
+}
+
 export function buildSegmentInfo(
   segments: ManifestSegmentNode[],
   layoutComponents: Array<{
     component: (...args: unknown[]) => unknown;
     segment: ManifestSegmentNode;
-  }>
-): Array<{ path: string; segmentId?: string; isAsync: boolean }> {
+  }>,
+  slotSkipInfo?: SlotSkipEntry[],
+  taintResults?: Map<string, boolean>,
+  orphanTaint?: boolean,
+  skippedSegmentKeys?: string[]
+): SegmentInfoEntry[] {
   const layoutBySegment = new Map(
     layoutComponents.map(({ component, segment }) => [segment, component])
   );
 
   const segmentKeys = computeSegmentKeys(segments);
-  const result: Array<{ path: string; segmentId?: string; isAsync: boolean }> = [];
+  const skippedSet = skippedSegmentKeys ? new Set(skippedSegmentKeys) : null;
+  const result: SegmentInfoEntry[] = [];
 
   for (let i = 0; i < segments.length; i++) {
     const segment = segments[i];
     const component = layoutBySegment.get(segment);
 
-    // Only emit entries for segments with layouts. Layoutless segments
-    // have no SegmentOutlet and must not appear in the client's merge
-    // target search (buildSegmentUpdates).
     if (!component) continue;
 
-    const isAsync = component.constructor?.name === 'AsyncFunction';
     const segmentId = segmentKeys[i];
+    let isRequestDependent: boolean;
+    if (isClientReference(component)) {
+      // Client components never execute on the server — they can't
+      // call getHeaders()/cookies()/getSearchParams(). Always cacheable.
+      isRequestDependent = false;
+    } else if (orphanTaint) {
+      isRequestDependent = true;
+    } else if (taintResults?.has(segmentId)) {
+      isRequestDependent = taintResults.get(segmentId)!;
+    } else if (skippedSet?.has(segmentId)) {
+      // Skipped segments have no taint data (runInTaintScope never ran).
+      // They're safe to mark non-request-dependent: a segment is only
+      // skippable because the client's state tree listed it, and the
+      // client only serializes non-request-dependent segments.
+      isRequestDependent = false;
+    } else {
+      // No taint data (SSR path or segment not yet rendered).
+      // Default to true — safe fallback that degrades to current behavior.
+      isRequestDependent = true;
+    }
 
-    const entry: { path: string; segmentId?: string; isAsync: boolean } = {
+    const entry: SegmentInfoEntry = {
       path: segment.urlPath,
-      isAsync,
+      isRequestDependent,
     };
     if (segmentId !== segment.urlPath) {
       entry.segmentId = segmentId;
@@ -210,6 +245,25 @@ export function buildSegmentInfo(
     result.push(entry);
   }
 
+  if (slotSkipInfo) {
+    for (const slot of slotSkipInfo) {
+      let slotRequestDependent = slot.isRequestDependent;
+      if (orphanTaint) {
+        slotRequestDependent = true;
+      } else if (taintResults?.has(slot.slotKey)) {
+        slotRequestDependent = taintResults.get(slot.slotKey)!;
+      }
+      const entry: SegmentInfoEntry = {
+        path: slot.slotKey,
+        isRequestDependent: slotRequestDependent,
+        slot: true,
+        parentSegment: slot.parentSegmentId,
+      };
+      if (slot.denied) entry.denied = true;
+      result.push(entry);
+    }
+  }
+
   return result;
 }
 

package/src/server/rsc-entry/render-route.ts

@@ -139,8 +139,14 @@ export async function renderRoute(
     desc: 'build element tree',
   });
 
-  const { element, layoutComponents, deferSuspenseFor, skippedSegments, shellSettled } =
-    routeResult;
+  const {
+    element,
+    layoutComponents,
+    deferSuspenseFor,
+    skippedSegments,
+    shellSettled,
+    slotSkipInfo,
+  } = routeResult;
 
   // Build head HTML for injection into the SSR output.
   // Collects CSS, fonts, and modulepreload from the build manifest for matched segments.
@@ -270,7 +276,8 @@ export async function renderRoute(
       layoutComponents,
       match,
       responseHeaders,
-      skippedSegments
+      skippedSegments,
+      slotSkipInfo
     );
   }
 
@@ -288,5 +295,6 @@ export async function renderRoute(
     headHtml,
     deferSuspenseFor,
     globalError,
+    slotSkipInfo,
   });
 }

package/src/server/rsc-entry/rsc-payload.ts

@@ -14,6 +14,7 @@ import type { RouteMatch } from '../pipeline.js';
 import type { RedirectSignal } from '../primitives.js';
 import type { LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
+import type { SlotSkipEntry } from '../slot-resolver.js';
 
 import {
   buildRedirectResponse,
@@ -21,6 +22,7 @@ import {
   createDebugChannelSink,
   RSC_CONTENT_TYPE,
 } from './helpers.js';
+import { requestContextAls } from '../als-registry.js';
 import type { RenderSignals } from './rsc-stream.js';
 
 /**
@@ -40,7 +42,8 @@ export async function buildRscPayloadResponse(
   layoutComponents: LayoutComponentEntry[],
   match: RouteMatch,
   responseHeaders: Headers,
-  skippedSegments?: string[]
+  skippedSegments?: string[],
+  slotSkipInfo?: SlotSkipEntry[]
 ): Promise<Response> {
   // Read the first chunk from the RSC stream before committing headers.
   // Race the first read against signal detection — if an async component
@@ -194,9 +197,19 @@ export async function buildRscPayloadResponse(
   // client rendering. No X-Timber-Head header needed. See TIM-1151.
 
   // Send segment metadata so the client can populate its segment cache
-  // for state tree diffing on subsequent navigations.
+  // for state tree diffing on subsequent navigations. On the RSC payload
+  // path, taint results are available because the shell has rendered by
+  // the time we reach this point (first chunk already read from the stream).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  const segmentInfo = buildSegmentInfo(segments, layoutComponents);
+  const store = requestContextAls.getStore();
+  const segmentInfo = buildSegmentInfo(
+    segments,
+    layoutComponents,
+    slotSkipInfo,
+    store?.taintResults,
+    store?.orphanTaint,
+    skippedSegments
+  );
   responseHeaders.set('X-Timber-Segments', JSON.stringify(segmentInfo));
 
   // Send skipped segments so the client can merge the partial RSC payload

package/src/server/rsc-entry/ssr-renderer.ts

@@ -20,6 +20,7 @@ import type { RouteMatch } from '../pipeline.js';
 import { SsrStreamError } from '../primitives.js';
 import type { LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
+import type { SlotSkipEntry } from '../slot-resolver.js';
 import type { NavContext } from '../ssr-bridge-types.js';
 
 import { htmlEscapeJsonString } from '../flight-scripts.js';
@@ -100,6 +101,7 @@ interface SsrRenderOptions {
   deferSuspenseFor: number;
   /** Tier 2 global-error.tsx file, if present in app/. */
   globalError?: GlobalErrorFile;
+  slotSkipInfo?: SlotSkipEntry[];
 }
 
 /**
@@ -168,7 +170,7 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   // Skipped when client JS is disabled — no client JS to consume it.
   const segmentScript = clientJsDisabled
     ? ''
-    : `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents)))}</script>`;
+    : `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents, opts.slotSkipInfo)))}</script>`;
 
   // Embed route params in HTML so useSegmentParams() works on initial hydration.
   // Without this, useSegmentParams() returns {} until the first client navigation.

package/src/server/slot-resolver.ts

@@ -29,6 +29,9 @@ import type { ManifestSegmentNode } from './route-matcher.js';
 import { setSlotParams } from './request-context.js';
 import { coerceSlotParams } from './param-coercion.js';
 import { matchUrlParts } from './tree-match.js';
+import { SegmentOutlet } from '../client/segment-outlet.js';
+import { computeSlotKey, shouldSkipSlot, type ClientStateTree } from './state-tree-diff.js';
+import { runInTaintScope } from './request-context.js';
 
 type CreateElementFn = (...args: unknown[]) => React.ReactElement;
 
@@ -80,7 +83,9 @@ export async function resolveSlotElement(
   match: RouteMatch,
   h: CreateElementFn,
   interception?: InterceptionContext,
-  parentTreePath?: string
+  parentTreePath?: string,
+  accessVerdicts?: SlotAccessVerdict[],
+  taintKey?: string
 ): Promise<React.ReactElement | null> {
   // When interception is active, try to match intercepting children in this
   // slot against the target pathname. If an intercepting child matches, render
@@ -131,9 +136,11 @@ export async function resolveSlotElement(
       if (isClientReference(SlotPage)) {
         element = h(SlotPage, {});
       } else {
+        const slotTaintKey = taintKey;
         const SafeSlotPage = async (props: Record<string, unknown>) => {
+          const run = async () => (SlotPage as (props: Record<string, unknown>) => unknown)(props);
           try {
-            return await (SlotPage as (props: Record<string, unknown>) => unknown)(props);
+            return slotTaintKey ? await runInTaintScope(slotTaintKey, run) : await run();
           } catch (error) {
             // RedirectSignal must propagate — the pipeline handles redirects
             // at the top level. Swallowing it here would silently return
@@ -161,7 +168,7 @@ export async function resolveSlotElement(
       // intermediate slot segments (everything between slot root and leaf).
       // Process innermost-first, same order as route-element-builder.ts
       // handles main segments. The slot root (index 0) is handled below.
-      element = await wrapWithIntermediateSegments(slotMatch.chain, element, h);
+      element = await wrapWithIntermediateSegments(slotMatch.chain, element, h, accessVerdicts);
 
       // Wrap with slot root's layout — INSIDE the access gate, so the layout
       // server component never executes when access.ts denies. See TIM-1074.
@@ -174,7 +181,7 @@ export async function resolveSlotElement(
       // On denial: denied.tsx → default.tsx → null (graceful degradation),
       // rendered WITHOUT the denied slot's own layout.
       // See design/04-authorization.md §"Slot-Level Auth".
-      element = await wrapWithAccessGate(slotNode, element, h);
+      element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts);
 
       // Wrap with slot root's error boundaries (outermost)
       element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
@@ -196,7 +203,9 @@ export async function resolveSlotElement(
     }
   }
 
-  // No matching page — render default.tsx fallback
+  // No matching page — render default.tsx fallback.
+  // Per design/02-rendering-pipeline.md: "No access check for default.tsx."
+  // Access verdicts from the eager evaluation are not applied here.
   return renderDefaultFallback(slotNode, h);
 }
 
@@ -221,13 +230,14 @@ export async function resolveSlotElement(
 async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
   element: React.ReactElement,
-  h: CreateElementFn
+  h: CreateElementFn,
+  accessVerdicts?: SlotAccessVerdict[]
 ): Promise<React.ReactElement> {
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
     element = await wrapSegmentWithErrorBoundaries(seg, element, h);
     element = await wrapWithLayout(seg, element, h);
-    element = await wrapWithAccessGate(seg, element, h);
+    element = await wrapWithAccessGate(seg, element, h, accessVerdicts);
   }
   return element;
 }
@@ -253,7 +263,8 @@ async function wrapWithLayout(
 async function wrapWithAccessGate(
   slotNode: ManifestSegmentNode,
   element: React.ReactElement,
-  h: CreateElementFn
+  h: CreateElementFn,
+  accessVerdicts?: SlotAccessVerdict[]
 ): Promise<React.ReactElement> {
   if (!slotNode.access) return element;
 
@@ -272,6 +283,16 @@ async function wrapWithAccessGate(
 
   const defaultFallback = await renderDefaultFallback(slotNode, h);
 
+  // Look up pre-computed verdict from eager evaluation. Only replay
+  // denial/redirect verdicts — 'pass' verdicts must NOT be replayed
+  // because the access function may warm React.cache (e.g., requireUser())
+  // for layout/page dedup, and replaying 'pass' skips the cache-warming
+  // call. 'error' verdicts are also excluded — the gate must re-run
+  // accessFn so the error reaches the slot's error boundary.
+  const preVerdict = accessVerdicts?.find(
+    (v) => v.node === slotNode && v.verdict !== 'pass' && v.verdict !== 'error'
+  );
+
   return h(SlotAccessGate, {
     accessFn,
     DeniedComponent,
@@ -279,6 +300,7 @@ async function wrapWithAccessGate(
     createElement: h,
     defaultFallback,
     children: element,
+    verdict: preVerdict?.verdict,
   });
 }
 
@@ -439,3 +461,272 @@ function findInterceptingMatch(
 
   return null;
 }
+
+// ─── Slot Access Evaluation ─────────────────────────────────────────────────
+
+/** Result of eagerly evaluating one segment's access.ts. */
+export interface SlotAccessVerdict {
+  node: ManifestSegmentNode;
+  /**
+   * 'pass' — access allowed.
+   * DenySignal/RedirectSignal — access denied, replayed in SlotAccessGate.
+   * 'error' — unknown error. Forces full render. No verdict passed to
+   *   SlotAccessGate, so it calls accessFn during render and the error
+   *   reaches the slot's error boundary.
+   */
+  verdict: 'pass' | 'error' | DenySignal | RedirectSignal;
+}
+
+/**
+ * Eagerly evaluate the access chain for a slot (root + intermediate segments).
+ *
+ * Runs each access.ts top-down (outermost first). If any denies, the chain
+ * stops (shallowest failure wins, matching segment access semantics).
+ *
+ * Verdicts are stored for replay in SlotAccessGate / wrapWithIntermediateSegments
+ * so access.ts is called exactly once per request.
+ */
+async function evaluateSlotAccessChain(
+  slotRoot: ManifestSegmentNode,
+  chain: ManifestSegmentNode[]
+): Promise<SlotAccessVerdict[]> {
+  // Collect all nodes with access.ts: slot root + intermediate chain segments
+  const nodesWithAccess: ManifestSegmentNode[] = [];
+  if (slotRoot.access) nodesWithAccess.push(slotRoot);
+  for (let i = 1; i < chain.length; i++) {
+    if (chain[i].access) nodesWithAccess.push(chain[i]);
+  }
+
+  if (nodesWithAccess.length === 0) return [];
+
+  const results: SlotAccessVerdict[] = [];
+  for (const node of nodesWithAccess) {
+    const accessFn = await loadComponent(node.access!);
+    if (!accessFn) {
+      results.push({ node, verdict: 'pass' });
+      continue;
+    }
+    try {
+      await accessFn();
+      results.push({ node, verdict: 'pass' });
+    } catch (e) {
+      if (e instanceof DenySignal) {
+        results.push({ node, verdict: e });
+        break; // shallowest failure wins
+      }
+      if (e instanceof RedirectSignal) {
+        results.push({ node, verdict: e });
+        break;
+      }
+      // Unknown error — record as 'error' to force full render (blocks
+      // canSkip via accessBlocked). No verdict is passed to SlotAccessGate
+      // (wrapWithAccessGate filters 'error' out), so the gate calls
+      // accessFn during render and the error reaches the error boundary.
+      results.push({ node, verdict: 'error' });
+      break;
+    }
+  }
+  return results;
+}
+
+// ─── Slot Caching ──────────────────────────────────────────────────────────
+
+export interface SlotSkipEntry {
+  slotKey: string;
+  parentSegmentId: string;
+  /**
+   * Whether the slot's components called request accessors (getHeaders,
+   * getSearchParams, cookies) during their last render. Replaces the
+   * unreliable AsyncFunction heuristic — taint-tracked via ALS.
+   */
+  isRequestDependent: boolean;
+  /** Whether the slot's access.ts denied on this render. */
+  denied: boolean;
+}
+
+interface ResolveSlotPropsArgs {
+  segment: ManifestSegmentNode;
+  segmentId: string;
+  match: RouteMatch;
+  h: CreateElementFn;
+  interception?: InterceptionContext;
+  parentTreePath: string;
+  departingUrl: string | null;
+  destinationUrl: string;
+  clientStateTree: ClientStateTree | null;
+  slotSkipInfo: SlotSkipEntry[];
+}
+
+/**
+ * Resolve all parallel route slots for a layout, wrapping each in a
+ * SegmentOutlet for client-side caching. Slots whose matched content
+ * hasn't changed between the departing and destination URLs are rendered
+ * with `skip=true` so the client keeps its cached content.
+ */
+export async function resolveSlotProps({
+  segment,
+  segmentId,
+  match,
+  h,
+  interception,
+  parentTreePath,
+  departingUrl,
+  destinationUrl,
+  clientStateTree,
+  slotSkipInfo,
+}: ResolveSlotPropsArgs): Promise<Record<string, unknown>> {
+  const slotProps: Record<string, unknown> = {};
+  const slotEntries = Object.entries(segment.slots ?? {});
+  if (slotEntries.length === 0) return slotProps;
+
+  // Parse URLs to extract pathnames for slot skip comparison.
+  // The departing URL (X-Timber-URL) is an untrusted request header —
+  // catch parse failures and fall back to no-cache (full render).
+  const destParsed = new URL(destinationUrl, 'http://localhost');
+  let depParsed: URL | null = null;
+  if (departingUrl) {
+    try {
+      depParsed = new URL(departingUrl, 'http://localhost');
+    } catch {
+      // Malformed departing URL — disable slot skipping for this request
+    }
+  }
+  const destinationPathname = destParsed.pathname;
+  const departingPathname = depParsed?.pathname ?? null;
+
+  // Compute URL parts for slot skip comparison.
+  // Include the owning segment (segIdx + 1) to match findSlotMatch,
+  // which slices at parentIndex + 1. Filter out the root segment
+  // (segmentName === '') — it maps to '/' and doesn't consume a URL part.
+  const segIdx = match.segments.indexOf(segment);
+  const parentSegments =
+    segIdx >= 0 ? match.segments.slice(0, segIdx + 1).filter((s) => s.segmentName !== '') : [];
+  const rawParams = match.rawSegmentParams ?? match.segmentParams ?? {};
+  const parentConsumedParts = extractUrlParts(parentSegments, rawParams);
+  const sliceAt = parentConsumedParts.length;
+
+  function splitPathname(pathname: string): string[] {
+    return pathname === '/' ? [] : pathname.slice(1).split('/');
+  }
+
+  const destinationAll = splitPathname(destinationPathname);
+  const departingAll = departingPathname ? splitPathname(departingPathname) : null;
+  const destinationParts = destinationAll.slice(sliceAt);
+  const departingParts = departingAll ? departingAll.slice(sliceAt) : null;
+  const clientSlots = clientStateTree?.slots ?? null;
+
+  // Check if parent segment's URL parts changed (e.g., /users/1 → /users/2).
+  let parentParamsChanged = false;
+  if (departingAll) {
+    const depParent = departingAll.slice(0, sliceAt);
+    const destParent = destinationAll.slice(0, sliceAt);
+    parentParamsChanged =
+      depParent.length !== destParent.length || depParent.some((p, i) => p !== destParent[i]);
+  }
+
+  for (const [slotName, slotNode] of slotEntries) {
+    const slotManifest = slotNode as ManifestSegmentNode;
+    const slotKey = computeSlotKey(segmentId, `@${slotName}`);
+
+    // Match the slot's sub-tree against the destination URL parts.
+    // Used for both the skip decision and eager access evaluation.
+    const destMatch = matchUrlParts(slotManifest, destinationParts);
+
+    // Seed slot params BEFORE eager access evaluation so that access.ts
+    // files calling getSegmentParams() see the slot's own coerced params,
+    // not the main route's. This is the same seeding that resolveSlotElement
+    // does, but we need it here for the eager path.
+    if (destMatch && parentTreePath && Object.keys(destMatch.params).length > 0) {
+      const slotSuffix = destMatch.chain
+        .map((s) => s.segmentName)
+        .filter(Boolean)
+        .join('/');
+      const prefix = parentTreePath === '/' ? '' : parentTreePath;
+      const fullSlotPath = `${prefix}/${slotSuffix}`;
+      const coerced = coerceSlotParams(destMatch.chain, destMatch.params);
+      setSlotParams(fullSlotPath, coerced);
+    }
+
+    // Check non-access skip conditions first. If any of these fail,
+    // the slot can't be skipped regardless of access — no need to run
+    // the eager access evaluation (which would double-run access.ts
+    // since the in-tree gate also calls it during render).
+    const hasInterceptingChildren = slotManifest.children.some(
+      (c) => c.segmentType === 'intercepting'
+    );
+    const isSkipCandidate =
+      destMatch !== null &&
+      !interception &&
+      !hasInterceptingChildren &&
+      !parentParamsChanged &&
+      departingParts !== null &&
+      shouldSkipSlot({
+        slotKey,
+        clientSlots,
+        slotNode: slotManifest,
+        departingUrlParts: departingParts,
+        destinationUrlParts: destinationParts,
+      });
+
+    // Eagerly evaluate the slot's access chain only for skip candidates.
+    // This serves two purposes:
+    // 1. Satisfies security principle #3 (auth always runs) for skipped slots
+    // 2. Determines whether access denied (denied slots must not be skipped)
+    //
+    // Non-skip-candidate slots skip eager evaluation — their access.ts
+    // runs during render via SlotAccessGate (normal path). Per design doc:
+    // "No access check for default.tsx" (destMatch null = unmatched slot).
+    const chainVerdicts = isSkipCandidate
+      ? await evaluateSlotAccessChain(slotManifest, destMatch!.chain)
+      : [];
+    const accessBlocked = chainVerdicts.some((v) => v.verdict !== 'pass');
+    const canSkip = isSkipCandidate && !accessBlocked;
+
+    if (canSkip) {
+      // Access already ran eagerly (all verdicts 'pass') — principle #3 satisfied.
+      // No gate wrapper needed.
+      slotProps[slotName] = h(SegmentOutlet, {
+        segmentPath: slotKey,
+        skip: true,
+        children: null,
+      });
+      // Skipped slots don't render, so they're not request-dependent.
+      slotSkipInfo.push({
+        slotKey,
+        parentSegmentId: segmentId,
+        isRequestDependent: false,
+        denied: false,
+      });
+    } else {
+      const resolvedElement = await resolveSlotElement(
+        slotManifest,
+        match,
+        h,
+        interception,
+        parentTreePath,
+        chainVerdicts,
+        slotKey
+      );
+      slotProps[slotName] = h(SegmentOutlet, {
+        segmentPath: slotKey,
+        children: resolvedElement,
+      });
+      // Conservative default: fully-rendered slots are marked as
+      // request-dependent. Element building doesn't execute server
+      // components (that happens during renderToReadableStream), so
+      // we can't observe whether the page/layout calls getHeaders()
+      // or cookies(). Marking as request-dependent means the client
+      // won't report the slot as cacheable, so it's always re-rendered.
+      // TODO(LOCAL-1127): Implement render-time taint tracking to
+      // allow skipping slots that don't actually read request context.
+      slotSkipInfo.push({
+        slotKey,
+        parentSegmentId: segmentId,
+        isRequestDependent: true,
+        denied: accessBlocked,
+      });
+    }
+  }
+
+  return slotProps;
+}