@timber-js/app 0.2.0-alpha.184 → 0.2.0-alpha.186

package/src/server/route-element-builder.ts

@@ -34,7 +34,10 @@ import {
 } from './deny-boundary.js';
 import type { DenyPageEntry } from './deny-boundary.js';
 import { LAYOUT_CHILDREN_SLOT } from './prebuilt/slots.js';
-import { resolveSlotProps, extractUrlParts, type SlotSkipEntry } from './slot-resolver.js';
+import { resolveSlotProps, publishSlotSegmentParams, type SlotSkipEntry } from './slot-resolver.js';
+import { consumedUrlParts } from './chain-url-parts.js';
+import { withPublishedParams } from './publish-params.js';
+import type { RscPayloadRoot } from '../shared/payload-root.js';
 import { SegmentProvider } from '../client/segment-context.js';
 import { SegmentOutlet } from '../client/segment-outlet.js';
 import { SlotOutlet } from '../client/slot-outlet.js';
@@ -42,93 +45,16 @@ import { SlotsProvider } from '../client/slot-provider.js';
 
 import { wrapSegmentWithErrorBoundaries } from './error-boundary-wrapper.js';
 import type { InterceptionContext } from './pipeline.js';
+import { shouldSkipSegment, type ClientStateTree } from './state-tree-diff.js';
+import { truncateSkippableForChangedSlots } from './skippable-prefix.js';
 import {
-  shouldSkipSegment,
-  shouldSkipSlot,
   computeSegmentKeys,
+  computeSegmentTreePaths,
   computeSlotKey,
-  type ClientStateTree,
-} from './state-tree-diff.js';
+} from '../routing/segment-keys.js';
 import { headElementsToReact } from './metadata.js';
 import { loadModule } from './safe-load.js';
 
-/**
- * Truncate the skippable prefix when a skippable layout has slots whose
- * content changed between the departing and destination URLs (TIM-1232).
- *
- * Without this, changed slots at skipped layouts are never sent to the
- * client — the `continue` in the main loop skips slot resolution entirely.
- * Removing the segment from the skippable set forces it to render with
- * its slots. The prefix must stay contiguous, so all segments after the
- * first changed-slot segment are also removed.
- */
-function truncateSkippableForChangedSlots(
-  skippableSet: Set<number>,
-  segments: ManifestSegmentNode[],
-  segmentKeys: string[],
-  match: RouteMatch,
-  clientStateTree: ClientStateTree,
-  req: Request
-): void {
-  const departingUrl = req.headers.get('X-Timber-URL');
-  let depParsed: URL | null = null;
-  if (departingUrl) {
-    try {
-      depParsed = new URL(departingUrl, 'http://localhost');
-    } catch {
-      skippableSet.clear();
-      return;
-    }
-  }
-  const destPathname = new URL(req.url, 'http://localhost').pathname;
-  const depPathname = depParsed?.pathname ?? null;
-  const split = (p: string) => (p === '/' ? [] : p.slice(1).split('/'));
-  const destAll = split(destPathname);
-  const depAll = depPathname ? split(depPathname) : null;
-  const clientSlots = clientStateTree.slots ?? null;
-  const rawParams = match.rawSegmentParams ?? match.segmentParams ?? {};
-
-  for (let i = 0; i < segments.length; i++) {
-    if (!skippableSet.has(i)) continue;
-    const segment = segments[i];
-    const slotEntries = Object.entries(segment.slots ?? {});
-    if (slotEntries.length === 0) continue;
-
-    const segIdx = match.segments.indexOf(segment);
-    const parents =
-      segIdx >= 0 ? match.segments.slice(0, segIdx + 1).filter((s) => s.segmentName !== '') : [];
-    const sliceAt = extractUrlParts(parents, rawParams).length;
-    const destParts = destAll.slice(sliceAt);
-    const depParts = depAll ? depAll.slice(sliceAt) : null;
-    let parentChanged = false;
-    if (depAll) {
-      const dp = depAll.slice(0, sliceAt),
-        dd = destAll.slice(0, sliceAt);
-      parentChanged = dp.length !== dd.length || dp.some((p, j) => p !== dd[j]);
-    }
-
-    for (const [slotName, slotNode] of slotEntries) {
-      const m = slotNode as ManifestSegmentNode;
-      const k = computeSlotKey(segmentKeys[i], `@${slotName}`);
-      if (
-        m.children.some((c) => c.segmentType === 'intercepting') ||
-        parentChanged ||
-        depParts === null ||
-        !shouldSkipSlot({
-          slotKey: k,
-          clientSlots,
-          slotNode: m,
-          departingUrlParts: depParts,
-          destinationUrlParts: destParts,
-        })
-      ) {
-        for (let j = i; j < segments.length; j++) skippableSet.delete(j);
-        return;
-      }
-    }
-  }
-}
-
 /**
  * Replace the outermost SegmentOutlet in a partial payload with its
  * SegmentProvider child. Walks through AccessGate wrappers (which sit
@@ -175,6 +101,28 @@ const CLIENT_REFERENCE_TAG = Symbol.for('react.client.reference');
  * function. Client components must go through createElement only — they are
  * serialized as references in the RSC Flight stream, not executed on the server.
  */
+/**
+ * The `segments` array handed to a layout's `SegmentProvider` — the value
+ * `useSelectedLayoutSegment(s)` reads.
+ *
+ * Only its **length** matters: both hooks take `segments.length` as a depth and
+ * index the live pathname with it. So this is really "how many URL parts had
+ * been consumed by the time this layout rendered", which is
+ * `consumedUrlParts` — the same derivation slot matching and the slot-skip
+ * slicing use, so a layout and the slots beside it cannot disagree about how
+ * deep they are. The root consumes nothing → `['']`, length 1.
+ *
+ * @internal — exported for tests; production has exactly one caller.
+ */
+export function computeLayoutSegmentPath(
+  segments: ManifestSegmentNode[],
+  index: number,
+  match: RouteMatch
+): string[] {
+  const parts = consumedUrlParts(segments, index, match);
+  return parts.length === 0 ? [''] : ['', ...parts];
+}
+
 export function isClientReference(component: unknown): boolean {
   return (
     component != null &&
@@ -217,8 +165,12 @@ export interface LayoutComponentEntry {
 
 /** Result of building a route element tree. */
 export interface RouteElementResult {
-  /** The React element tree (page wrapped in layouts, access gates, error boundaries). */
-  element: React.ReactElement;
+  /**
+   * The payload root: the React element tree (page wrapped in layouts, access
+   * gates, error boundaries) plus the params it rendered with, as siblings.
+   * See shared/payload-root.ts for why params are not a wrapper around it.
+   */
+  payload: RscPayloadRoot;
   /** Layout components loaded along the segment chain. */
   layoutComponents: LayoutComponentEntry[];
   /** Segments from the route match. */
@@ -247,6 +199,17 @@ export interface RouteElementResult {
    * enabling the client to populate its segment cache with slot entries.
    */
   slotSkipInfo: SlotSkipEntry[];
+  /**
+   * Index of the first segment whose `access.ts` denied, or `Infinity`.
+   *
+   * AccessGate sits OUTSIDE the layout, so a denial means this segment and
+   * everything below it never rendered — no layout, no slots. It is the
+   * boundary of the tree that actually exists, which is why
+   * `collectMetadataRouteHeadElements` already filters on it and why
+   * `buildSegmentInfo` must too: the layouts were still *loaded*, so a list
+   * built from `layoutComponents` describes more than what mounted.
+   */
+  firstDeniedIndex: number;
 }
 
 // ─── Module Processing Helpers ─────────────────────────────────────────────
@@ -554,6 +517,10 @@ export async function buildRouteElement(
   // the same keys are used for skip decisions, SegmentOutlet props, and
   // the X-Timber-Segments header (via buildSegmentInfo).
   const segmentKeys = computeSegmentKeys(segments);
+  // The directory path of each segment — the key `setSlotParams` and codegen
+  // both use for a slot beneath it, and the identity interception scoping
+  // compares against. One derivation, so a slot cannot be keyed two ways.
+  const segmentTreePaths = computeSegmentTreePaths(segments);
 
   // Pre-compute the contiguous skippable prefix (top-down).
   //
@@ -645,8 +612,27 @@ export async function buildRouteElement(
 
   // Slot caching: the departing URL (X-Timber-URL header) and the
   // destination URL (request URL) are compared to determine which
-  // slots' content has changed. Full URLs (with search) are passed
-  // so slot pages reading getSearchParams() are correctly re-rendered.
+  // slots' content has changed.
+  //
+  // Pathnames only. The client sends `X-Timber-URL` as a pathname
+  // (`client/router.ts` takes `.pathname` on both branches) and
+  // `slot-resolver.ts` reads `.pathname` from both sides, so search
+  // params take no part in the skip decision.
+  //
+  // Nothing here can tell whether a slot's content depends on the query.
+  // What is supposed to make that safe lives elsewhere: a slot whose server
+  // render varies with the query must reach it through a request accessor
+  // (page components are built with no props), which the request-dep analysis
+  // is meant to catch — and that analysis is incomplete for accessors reached
+  // through indirection, so this is currently a real staleness hole. See
+  // TIM-1291 and design/19-client-navigation.md. A slot whose *client* subtree
+  // varies with the query reads useSearchParams(), which re-renders from
+  // NavigationContext whether or not the slot was skipped; that half is
+  // unconditional.
+  //
+  // Do not add search to the comparison by sending the full departing URL:
+  // the header is hashed into the public `_rsc` cache key (TIM-1268),
+  // and a digest does not anonymize a guessable query string.
   const departingUrl = req.headers.get('X-Timber-URL');
   const destinationUrl = req.url;
   const slotSkipInfo: SlotSkipEntry[] = [];
@@ -661,6 +647,14 @@ export async function buildRouteElement(
       // Record for X-Timber-Skipped-Segments header (outermost first, so prepend).
       skippedSegments.unshift(segmentKeys[i]);
 
+      // A skipped layout never reaches resolveSlotProps below, but its slots
+      // stay mounted on the client — so their params still have to be
+      // published, or useSegmentParams(slotPath) falls back to the main
+      // route's record after any navigation that skipped their parent
+      // (TIM-1285). Params only: nothing renders and no access chain runs,
+      // because an unchanged slot is what made this layout skippable.
+      publishSlotSegmentParams(segment, match, destinationUrl, segmentTreePaths[i]);
+
       // SECURITY: Even though the layout is skipped, AccessGate MUST still
       // wrap the element tree. access.ts runs on every navigation regardless
       // of cached layouts or state tree content.
@@ -705,13 +699,7 @@ export async function buildRouteElement(
       // so slot props are never consumed. Resolving them is wasted work
       // and could trigger side effects in slot access.ts functions.
       const segmentId = segmentKeys[i];
-      const parentTreePath =
-        '/' +
-        segments
-          .slice(0, i + 1)
-          .map((s) => s.segmentName)
-          .filter(Boolean)
-          .join('/');
+      const parentTreePath = segmentTreePaths[i];
       const slotProps =
         i >= firstDeniedIndex
           ? {}
@@ -728,10 +716,7 @@ export async function buildRouteElement(
               slotSkipInfo,
             });
 
-      // '/'.split('/') → ['', ''] (length 2), but root should be [''] (length 1).
-      // The extra empty string makes useSelectedLayoutSegment skip the first URL segment.
-      const rawPath = segment.urlPath.split('/');
-      const segmentPath = rawPath.length === 2 && rawPath[1] === '' ? [''] : rawPath;
+      const segmentPath = computeLayoutSegmentPath(segments, i, match);
       const parallelRouteKeys = Object.keys(segment.slots ?? {});
 
       // Build the layout element.
@@ -854,13 +839,19 @@ export async function buildRouteElement(
     shellSettled = Promise.race([Promise.all(shellPromises).then(() => {}), shortCircuit]);
   }
 
+  // Publish the request's params beside the finished tree, as the payload's
+  // root row. Last, because the partial-navigation rewrite above rebuilds the
+  // tree and this takes it as it finally stands.
+  const payload = withPublishedParams(element);
+
   return {
-    element,
+    payload,
     layoutComponents,
     segments,
     deferSuspenseFor,
     skippedSegments,
     shellSettled,
     slotSkipInfo,
+    firstDeniedIndex,
   };
 }

package/src/server/route-handler.ts

@@ -11,6 +11,7 @@
 import type { RouteContext } from './types.js';
 import { logRouteError } from './logger.js';
 import { DenySignal, RedirectSignal } from './primitives.js';
+import { stripHeadBody } from './head-response.js';
 
 // ─── Types ───────────────────────────────────────────────────────────────
 
@@ -89,18 +90,17 @@ export async function handleRouteRequest(mod: RouteModule, ctx: RouteContext): P
     });
   }
 
-  // HEAD fallback — run GET, strip body
+  // HEAD fallback — dispatch to GET when the module exports no HEAD, so the
+  // headers are the ones a GET would produce. The body is stripped by the
+  // shared helper (also applied at the pipeline exit, where it is a no-op the
+  // second time) rather than open-coded here — one implementation means the
+  // discarded stream is cancelled on every path. See TIM-1324.
   if (method === 'HEAD') {
     if (mod.HEAD) {
-      return runHandler(mod.HEAD, ctx);
+      return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
     }
     if (mod.GET) {
-      const res = await runHandler(mod.GET, ctx);
-      // Return headers + status but no body
-      return new Response(null, {
-        status: res.status,
-        headers: res.headers,
-      });
+      return stripHeadBody(await runHandler(mod.GET, ctx), method);
     }
   }
 

package/src/server/route-matcher.ts

@@ -83,10 +83,27 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
   const result = matchUrlParts(root, parts);
   if (!result) return null;
 
-  // Collect middleware from all segments in the chain, root to leaf.
-  // Each middleware is lazy-loaded via dynamic import on first invocation.
+  return {
+    segments: result.chain,
+    segmentParams: result.params,
+    middlewareChain: collectMiddlewareChain(result.chain),
+  };
+}
+
+/**
+ * Collect middleware from a matched segment chain, root to leaf.
+ *
+ * Each entry is lazy-loaded via dynamic import on first invocation.
+ *
+ * Shared with the children-path interception resolver
+ * (`children-interception.ts`), which assembles a chain from the tree rather
+ * than from a pathname but produces the same kind of `RouteMatch` — every
+ * `middleware.ts` above an intercepted page must run exactly as it does for
+ * the canonical route.
+ */
+export function collectMiddlewareChain(chain: ManifestSegmentNode[]): MiddlewareFn[] {
   const middlewareChain: MiddlewareFn[] = [];
-  for (const segment of result.chain) {
+  for (const segment of chain) {
     if (segment.middleware) {
       const loader = segment.middleware.load;
       middlewareChain.push(async (ctx) => {
@@ -97,12 +114,7 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
       });
     }
   }
-
-  return {
-    segments: result.chain,
-    segmentParams: result.params,
-    middlewareChain,
-  };
+  return middlewareChain;
 }
 
 // ─── Metadata Route Matcher ─────────────────────────────────────────────

package/src/server/rsc-cache-key-guard.ts

@@ -0,0 +1,170 @@
+/**
+ * Origin-side binding of the `_rsc` cache key to the request that produced
+ * the response (TIM-1268).
+ *
+ * The key is deterministic, and deliberately so — that is what makes RSC
+ * payloads cacheable. But deterministic also means *predictable*: anyone can
+ * compute the key another client will request. Without this guard, a caller
+ * could request `/about?_rsc=<victim's key>` while sending its own
+ * `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+ * environment this feature targets — would store that variant under the
+ * victim's key. Every subsequent legitimate navigation would then be served
+ * a payload rendered for someone else's segment tree or deployment.
+ *
+ * The guard is a *storability* rule, not a rejection: if the claimed key
+ * does not match the key derived from the received headers, the response
+ * loses its shared-cache directives. Mismatched requests are still served
+ * normally, they just cannot be stored for anyone else.
+ *
+ * Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+ * right, costs a round trip on every legitimate miss, and would make the
+ * server's behaviour depend on a parameter it otherwise never reads. This
+ * rule closes the same hole by making the poisoned entry unstorable at the
+ * source, in the response the developer already has to opt into sharing.
+ *
+ * See design/19-client-navigation.md §"The `_rsc` cache key".
+ */
+
+import { rscCacheKey, isRscCacheKeyShape, RSC_KEY_PARAM } from '../shared/rsc-cache-key.js';
+
+/**
+ * Legacy shared-cache control fields that predate RFC 9213 and so do not
+ * follow the `<target>-Cache-Control` naming pattern — the one part of this
+ * rule that cannot be matched by shape. `X-Accel-Expires` is nginx
+ * `proxy_cache`, which gives it precedence over `Cache-Control`.
+ *
+ * A closed historical set, unlike the vendor `*-Cache-Control` names, which
+ * keep being minted and are handled by pattern below.
+ */
+const LEGACY_CDN_CACHE_HEADERS = ['Surrogate-Control', 'Edge-Control', 'X-Accel-Expires'];
+
+/**
+ * Whether a response header overrides `Cache-Control` at a shared cache.
+ *
+ * Matched by *shape*, not by vendor name. RFC 9213 defines targeted fields
+ * as `<target>-Cache-Control`, and every CDN spells its own: `CDN-`,
+ * `Cloudflare-CDN-`, `Netlify-CDN-`, `Vercel-CDN-`, and whichever ships
+ * next. A vendor list here is a denylist with an unbounded tail — it was
+ * extended twice during review, each time by one name, which is the signal
+ * that enumeration is the wrong shape. The suffix rule is total.
+ *
+ * `Cache-Control` itself does not match (no `-` prefix) and is replaced
+ * separately.
+ */
+function isSharedCacheOverride(name: string): boolean {
+  const lowered = name.toLowerCase();
+  return (
+    lowered.endsWith('-cache-control') ||
+    LEGACY_CDN_CACHE_HEADERS.some((legacy) => legacy.toLowerCase() === lowered)
+  );
+}
+
+/**
+ * Whether the request's `_rsc` parameter matches the key derived from its
+ * own headers.
+ *
+ * Requests without the parameter are not claiming a key at all, so they are
+ * left alone — the bare document URL is the developer's declared territory
+ * (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+ * whose value could not be one of our digests: `_rsc` is not reserved, and
+ * an application that already uses it for its own search state
+ * (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+ * guard that mistook that for a forgery.
+ */
+export async function hasValidRscCacheKey(req: Request): Promise<boolean> {
+  // Fast path: this runs on every request, and the overwhelming majority
+  // (document requests) have no query string at all. Keyed on `?` and not
+  // on the literal `_rsc=`, because a substring test is not a parse: a
+  // request for `?%5Frsc=<key>` carries no literal `_rsc=`, yet
+  // `URLSearchParams` decodes it to one — and a cache that canonicalizes
+  // percent-encoded unreserved characters in its key while forwarding the
+  // original URL would store the response under the decoded, claimed key.
+  // The only sound fast path is one that cannot answer "no key" wrongly.
+  if (!req.url.includes('?')) return true;
+  let values: string[];
+  try {
+    values = new URL(req.url).searchParams.getAll(RSC_KEY_PARAM);
+  } catch {
+    // Unparseable URL — nothing to validate, and nothing safe to assume.
+    return false;
+  }
+  // Every value, not the first. An application that owns `_rsc` for its own
+  // search state makes the client emit `?_rsc=foo&_rsc=<key>` — reading only
+  // the first would see `foo`, exempt it as application data, and never
+  // check the real key sitting beside it.
+  const claims = values.filter(isRscCacheKeyShape);
+  if (claims.length === 0) return true;
+  const expected = await rscCacheKey((name) => req.headers.get(name));
+  // No digest available means the claim is unverifiable, which is not the
+  // same as verified. Every server runtime timber targets has
+  // `crypto.subtle`, so this is a guard against a future one that does not.
+  if (expected === null) return false;
+  // All of them, because at most one can be legitimate and a cache keys on
+  // the whole query string — a second, mismatched key would ride along
+  // inside an address that otherwise looks validated.
+  return claims.every((claim) => claim === expected);
+}
+
+/**
+ * Media type of a Flight payload. Also spelled in `rsc-entry/helpers.ts`,
+ * `deny-renderer.ts`, `action-handler.ts`, and `client/rsc-fetch.ts` — that
+ * duplication predates this module and is tracked separately.
+ */
+const RSC_MEDIA_TYPE = 'text/x-component';
+
+/**
+ * Ensure a Flight payload can never be interpreted as a document.
+ *
+ * Applied here, at the pipeline's single exit, rather than where each
+ * payload response is built. Six places build one — the success path, three
+ * in `deny-renderer.ts`, the action paths — and hardening them one at a time
+ * is how you end up hardening five of six. The response is Flight if it says
+ * it is; that is the only test that covers every producer, including ones
+ * added later.
+ *
+ * Matters because the payload URL is observable and, on a shared-cache hit,
+ * the origin is never consulted — so a top-level navigation can be handed
+ * these bytes with no request-time check available. See design/13-security.md
+ * #36c.
+ */
+export function hardenRscPayloadResponse(response: Response): void {
+  const contentType = response.headers.get('content-type');
+  if (!contentType) return;
+  if (contentType.split(';')[0].trim().toLowerCase() !== RSC_MEDIA_TYPE) return;
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+}
+
+/**
+ * Make a response unstorable by any shared cache when its request claimed an
+ * `_rsc` key that does not match its own headers.
+ *
+ * The end state is unconditional and therefore statable: **a mismatched
+ * response is never stored by any cache.** Every targeted cache-control
+ * field is removed and `Cache-Control` is replaced outright, rather than
+ * downgrading only when a shared directive is spotted. Conditional variants
+ * of this were tried and were wrong twice over — they missed the CDN-
+ * specific headers, and leaving `Cache-Control` alone when it looked
+ * harmless lets a CDN apply heuristic caching to a response that has none.
+ *
+ * The cost is that a mismatched request loses developer-chosen *browser*
+ * caching too. That is a request no timber client ever makes.
+ *
+ * Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+ * they address stored entries, and this response is not stored.
+ *
+ * Mutates `response.headers` in place; the pipeline guarantees mutable
+ * headers at this point (see TIM-866).
+ */
+export async function enforceRscCacheKey(req: Request, response: Response): Promise<void> {
+  if (await hasValidRscCacheKey(req)) return;
+  // Collected before deleting — mutating Headers while iterating its live
+  // key iterator can skip entries.
+  const overrides: string[] = [];
+  for (const name of response.headers.keys()) {
+    if (isSharedCacheOverride(name)) overrides.push(name);
+  }
+  for (const name of overrides) {
+    response.headers.delete(name);
+  }
+  response.headers.set('Cache-Control', 'private, no-store');
+}

package/src/server/rsc-entry/api-handler.ts

@@ -11,6 +11,7 @@ import type { ManifestSegmentNode } from '../route-matcher.js';
 import { loadModule } from '../safe-load.js';
 import { DenySignal, RedirectSignal } from '../primitives.js';
 import { handleRouteRequest } from '../route-handler.js';
+import { stripHeadBody } from '../head-response.js';
 import type { RouteModule } from '../route-handler.js';
 import type { RouteContext } from '../types.js';
 
@@ -89,9 +90,10 @@ export async function handleApiRoute(
  * method handler into the proper API response: DenySignal → JSON status-file
  * chain via `renderApiDeny`, RedirectSignal → bare 3xx with Location header.
  *
- * For HEAD requests, strip the deny body to preserve HEAD semantics — the
- * normal HEAD path in `handleRouteRequest` strips bodies after the handler
- * returns, but signals bypass that codepath.
+ * For HEAD requests, strip the deny body to preserve HEAD semantics — signals
+ * bypass the HEAD path in `handleRouteRequest`, so this exit needs its own
+ * call. Shares `stripHeadBody` with that path and with the pipeline exit; the
+ * pipeline applying it again downstream is a no-op (TIM-1324).
  *
  * Returns `null` for non-signal errors so the caller knows to rethrow.
  */
@@ -102,11 +104,7 @@ async function translateApiSignal(
   responseHeaders: Headers
 ): Promise<Response | null> {
   if (error instanceof DenySignal) {
-    const res = await renderApiDeny(error, segments, responseHeaders);
-    if (req.method.toUpperCase() === 'HEAD') {
-      return new Response(null, { status: res.status, headers: res.headers });
-    }
-    return res;
+    return stripHeadBody(await renderApiDeny(error, segments, responseHeaders), req.method);
   }
   if (error instanceof RedirectSignal) {
     responseHeaders.set('Location', error.location);