@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.186

package/src/server/rsc-entry/error-renderer.ts

@@ -17,14 +17,17 @@ import { renderToReadableStream } from '../../rsc-runtime/rsc.js';
 
 import type { RouteMatch } from '../pipeline.js';
 import { logRenderError } from '../logger.js';
+import { appVisibleSearch } from '../../shared/rsc-cache-key.js';
+import { getSlotParamsForClient } from '../request-context.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { DenySignal, RenderError } from '../primitives.js';
 import type { ClientBootstrapConfig } from '../html-injectors.js';
 import { flightInitScript, htmlEscapeJsonString } from '../flight-scripts.js';
 import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.js';
-import type { LayoutEntry } from '../deny-renderer.js';
+import type { DefaultPageRenderer, LayoutEntry } from '../deny-renderer.js';
 import type { NavContext } from '../ssr-bridge-types.js';
 import { createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { withPublishedParams } from '../publish-params.js';
 import { getCookiesForSsr } from '../cookie-context.js';
 import { callSsr } from './ssr-bridge.js';
 import { teeWithErrorPropagation } from '../stream-utils.js';
@@ -34,6 +37,8 @@ import type { SerializableError } from '../../client/error-reconstituter.js';
 import { loadModule } from '../safe-load.js';
 import { sourceMapError } from '../dev-source-map.js';
 import { isMdxFilePath as isMdxFile } from '../utils/mdx-file.js';
+import { defaultStatusPageResponse } from '../default-status-page.js';
+import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.js';
 
 /**
  * A manifest file reference with lazy import and path.
@@ -155,6 +160,18 @@ function toSerializableError(error: unknown): SerializableError {
  * All error pages (TSX and MDX) go through RSC → SSR:
  * - TSX: ErrorReconstituter wrapper converts SerializableError → real Error
  * - MDX: Plain props ({ status }), no wrapper needed
+ *
+ * ...except for a client-navigation request, which gets the hard-navigate
+ * envelope instead. Every tier below produces an HTML document, and the
+ * client's Flight decoder is waiting for `text/x-component`; handing it HTML
+ * crashes the decode. The check lives here rather than at the call sites
+ * because it holds for all five of them, and the deny path's equivalent split
+ * (`renderDenyPage` / `renderDenyPageAsRsc`) had already been forgotten at one
+ * of this function's — the synchronous render-error exit in `render-route.ts`
+ * (TIM-1322). Four of the five are unreachable for an RSC request today
+ * (`render-route.ts` returns the payload before it reaches SSR, and
+ * `outcomeToResponse` answers RSC errors itself), so this fires on one path
+ * and guards the rest against drift.
  */
 export async function renderErrorPage(
   error: unknown,
@@ -167,6 +184,13 @@ export async function renderErrorPage(
   clientBootstrap: ClientBootstrapConfig,
   globalError?: GlobalErrorFile
 ): Promise<Response> {
+  // The error itself is not logged here — every producer of a `renderError`
+  // signal already logged it at the point it was caught (`rsc-stream.ts`'s
+  // `onError`, `outcomeToResponse`), so a log on this exit would double up.
+  if (isRscPayloadRequest(req)) {
+    return rscErrorEnvelope(status, responseHeaders);
+  }
+
   // Source-map the error's stack trace in dev mode so the error page
   // shows original source positions instead of transpiled/bundled ones.
   // See TIM-811.
@@ -187,9 +211,13 @@ export async function renderErrorPage(
     );
   }
 
-  // Tier 3: No error component found at any level — bare response
+  // Tier 3: No error component found at any level — framework default page.
+  // The deny chain's terminal is the same page, so an app with no error files
+  // gets a readable status page for both 4xx and 5xx rather than a blank
+  // document. It carries the status and nothing else — never the error
+  // (design/13-security.md principle 4). See TIM-1258.
   if (!resolution) {
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 
   const { component: errorComponent, segmentIndex, isMdx } = resolution;
@@ -257,9 +285,12 @@ async function renderErrorPageViaRsc(
     element = h(component, null, element);
   }
 
-  // Render through RSC → SSR (same path as deny pages)
+  // Render through RSC → SSR (same path as deny pages) — including the params
+  // wrap, which every payload the server sends needs. An error page on a
+  // dynamic route reads params like any other page, and SSR would get them
+  // from the request ALS while the hydrated client got an empty record.
   try {
-    const rscStream = renderToReadableStream(element, {
+    const rscStream = renderToReadableStream(withPublishedParams(element), {
       signal: req.signal,
       onError(err: unknown) {
         logRenderError({ method: req.method, path: url.pathname, error: err });
@@ -269,32 +300,35 @@ async function renderErrorPageViaRsc(
 
     const [ssrStream, inlineStream] = teeWithErrorPropagation(rscStream);
 
-    // Build params bootstrap script so useSegmentParams() works on hydration.
-    // Without this, error pages on dynamic routes hydrate with empty params.
-    const paramsScript =
-      Object.keys(match.segmentParams).length === 0
-        ? ''
-        : `<script>self.__timber_params=${htmlEscapeJsonString(JSON.stringify(match.segmentParams))}</script>`;
+    // Params ride the payload root, beside the tree, so there is no
+    // bootstrap script. Read here for the SSR-side ALS context below.
+    const slotParams = getSlotParamsForClient();
 
     const navContext: NavContext = {
       pathname: url.pathname,
       segmentParams: match.segmentParams,
-      searchParams: Object.fromEntries(url.searchParams),
+      searchParams: Object.fromEntries(appVisibleSearch(url).params),
+      slotParams,
       statusCode: status,
       responseHeaders,
-      headHtml: paramsScript + flightInitScript(),
+      headHtml: flightInitScript(),
       bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
       rscStream: inlineStream,
       signal: req.signal,
       cookies: getCookiesForSsr(),
     };
 
-    return callSsr(ssrStream, navContext);
+    // `await` inside the try on purpose: SSR of the error page fails
+    // asynchronously far more often than synchronously, and returning the
+    // promise bare let every such rejection escape this guard.
+    return await callSsr(ssrStream, navContext);
   } catch (renderError) {
-    // Error page itself failed to render — fall through to bare response.
-    // This guards against recursive errors in user error page code.
+    // The error page itself failed to render — guards against recursive
+    // errors in user error page code. Terminates in the framework default
+    // page, not a blank body: a crashing error page is precisely when the
+    // reader has nothing else to go on (TIM-1258).
     logRenderError({ method: req.method, path: url.pathname, error: renderError });
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 }
 
@@ -315,11 +349,12 @@ async function renderGlobalErrorPage(
   responseHeaders: Headers,
   clientBootstrap: ClientBootstrapConfig
 ): Promise<Response> {
-  // .catch: if global-error.tsx fails to load, fall through to bare response.
-  // This is the last tier — no further recovery. See TIM-584.
+  // .catch: if global-error.tsx fails to load or exports no component, it is
+  // not a usable Tier 2 match — fall through to the framework default page
+  // rather than a blank body. See TIM-584, TIM-1258.
   const mod = await loadModule(globalError).catch(() => null);
   if (!mod?.default) {
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 
   const component = mod.default as (...args: unknown[]) => unknown;
@@ -350,15 +385,18 @@ export async function renderNoMatchPage(
   req: Request,
   rootSegment: ManifestSegmentNode,
   responseHeaders: Headers,
-  clientBootstrap: ClientBootstrapConfig
+  clientBootstrap: ClientBootstrapConfig,
+  defaultPage?: DefaultPageRenderer
 ): Promise<Response> {
   const segments = [rootSegment];
 
-  // Load root layout if present
+  // Load root layout if present. A layout that fails to import or evaluate
+  // must not take the 404 down with it — render the status page unwrapped,
+  // as renderFallbackError does for the same reason.
   const layoutComponents: LayoutEntry[] = [];
   if (rootSegment.layout) {
-    const mod = await loadModule(rootSegment.layout);
-    if (mod.default) {
+    const mod = await loadModule(rootSegment.layout).catch(() => null);
+    if (mod?.default) {
       layoutComponents.push({
         component: mod.default as (...args: unknown[]) => unknown,
         segment: rootSegment,
@@ -389,6 +427,7 @@ export async function renderNoMatchPage(
     responseHeaders,
     clientBootstrap,
     createDebugChannelSink,
-    callSsr
+    callSsr,
+    defaultPage
   );
 }

package/src/server/rsc-entry/helpers.ts

@@ -6,7 +6,8 @@
 
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { swallow } from '../logger.js';
-import { computeSegmentKeys } from '../state-tree-diff.js';
+import { computeSegmentKeys, computeSegmentTreePaths } from '../../routing/segment-keys.js';
+import type { SegmentInfo } from '../../shared/segment-info.js';
 import type { SlotSkipEntry } from '../slot-resolver.js';
 import { isClientReference } from '../route-element-builder.js';
 import { isStaticRequestDependent } from '../request-dep.js';
@@ -180,16 +181,6 @@ export function parseDebugRows(text: string): DebugComponentEntry[] {
  *
  * See design/07-routing.md §"Server Diffing Rules".
  */
-interface SegmentInfoEntry {
-  path: string;
-  segmentId?: string;
-  isRequestDependent: boolean;
-  slot?: boolean;
-  parentSegment?: string;
-  denied?: boolean;
-  skipped?: boolean;
-}
-
 export function buildSegmentInfo(
   segments: ManifestSegmentNode[],
   layoutComponents: Array<{
@@ -197,17 +188,32 @@ export function buildSegmentInfo(
     segment: ManifestSegmentNode;
   }>,
   slotSkipInfo?: SlotSkipEntry[],
-  skippedSegmentKeys?: string[]
-): SegmentInfoEntry[] {
+  skippedSegmentKeys?: string[],
+  firstDeniedIndex = Infinity
+): SegmentInfo[] {
   const layoutBySegment = new Map(
     layoutComponents.map(({ component, segment }) => [segment, component])
   );
 
   const segmentKeys = computeSegmentKeys(segments);
+  // The scope identity interception compares against. Emitted for every
+  // layout-bearing segment, which is exactly the set that can own a scope:
+  // slots are only resolved for segments whose layout renders
+  // (`route-element-builder.ts`), so a segment with no layout can never hold
+  // an intercepting slot. See TIM-1282.
+  const treePaths = computeSegmentTreePaths(segments);
   const skippedSet = skippedSegmentKeys ? new Set(skippedSegmentKeys) : null;
-  const result: SegmentInfoEntry[] = [];
+  const result: SegmentInfo[] = [];
 
   for (let i = 0; i < segments.length; i++) {
+    // A denied segment's AccessGate renders the deny page in place of the
+    // layout, so this segment and everything below it never mounted. Their
+    // layouts were still loaded — `layoutComponents` holds every module the
+    // chain pulled in, not every component that rendered — so without this
+    // the client is told it has a tree it does not, and `treePaths` reports a
+    // slot owner whose slot was never resolved (TIM-1282).
+    if (i >= firstDeniedIndex) break;
+
     const segment = segments[i];
     const component = layoutBySegment.get(segment);
 
@@ -225,8 +231,9 @@ export function buildSegmentInfo(
       isRequestDependent = true;
     }
 
-    const entry: SegmentInfoEntry = {
+    const entry: SegmentInfo = {
       path: segment.urlPath,
+      treePath: treePaths[i],
       isRequestDependent,
     };
     if (segmentId !== segment.urlPath) {
@@ -237,7 +244,7 @@ export function buildSegmentInfo(
 
   if (slotSkipInfo) {
     for (const slot of slotSkipInfo) {
-      const entry: SegmentInfoEntry = {
+      const entry: SegmentInfo = {
         path: slot.slotKey,
         isRequestDependent: slot.isRequestDependent,
         slot: true,
@@ -270,3 +277,11 @@ export { isAbortError } from '../render-utils.js';
 
 // escapeHtml is now imported from server/utils/escape-html.ts
 export { escapeHtml } from '../utils/escape-html.js';
+
+// Params no longer travel beside the payload. The payload root is the
+// outermost node of every tree the server sends (`server/publish-params.ts`),
+// so the record arrives as props React Flight serializes — which is what
+// makes a `Date`- or `bigint`-valued codec result survive the trip, where
+// `JSON.stringify` flattened it or threw. The response headers, the inline
+// bootstrap scripts, and the two build-time manifest fields that used to
+// carry it are all gone. See TIM-1294, design/41-global-params.md.

package/src/server/rsc-entry/index.ts

@@ -54,6 +54,7 @@ import type { InterceptionContext, PipelineConfig, RouteMatch } from '../pipelin
 import { createPipeline } from '../pipeline.js';
 import { coerceSegmentParams, setGlobalSchemaCodecs } from '../param-coercion.js';
 import { createMetadataRouteMatcher, createRouteMatcher } from '../route-matcher.js';
+import { createInterceptedRouteMatcher } from '../children-interception.js';
 import { initDevTracing } from '../tracing.js';
 import { createRevalidateRendererFactory } from './revalidate-renderer.js';
 
@@ -307,38 +308,45 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
       );
     },
     renderNoMatch: async (req: Request, responseHeaders: Headers) => {
-      const response = await renderNoMatchPage(
-        req,
-        manifest.root,
-        responseHeaders,
-        clientBootstrap
-      );
-
-      // In dev mode, if the pipeline returned a bare 404 (no body — meaning
-      // no user-defined 404.tsx was found), replace it with a helpful dev
-      // page that lists available routes and suggests similar paths.
-      // Only for GET requests that accept HTML — HEAD/API/RSC clients
-      // should receive the bare 404 without an HTML body (TIM-793).
+      // In dev mode, when the app authored no 404 page, substitute a helpful
+      // page listing available routes and suggesting similar paths in place
+      // of the framework default. Only for GET requests that accept HTML —
+      // HEAD/API/RSC clients must not receive an HTML body (TIM-793).
+      //
+      // This is passed *into* the chain rather than applied to its result:
+      // the old version detected "no user-defined 404.tsx" by testing the
+      // response for an empty body, which stopped being true once the chain
+      // grew a real terminal (TIM-1258).
       const acceptsHtml = (req.headers.get('accept') ?? '').includes('text/html');
-      if (isDev && !response.body && req.method === 'GET' && acceptsHtml) {
-        const { generateDev404Page, collectRoutes } = await import('../../dev-tools/404-page.js');
-        const routes = collectRoutes(manifest.root);
-        const pathname = new URL(req.url).pathname;
-        // devHmrOptions is set by the dev server after this module is
-        // imported (read at request time, not closure-capture time).
-        const html = generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
-        return new Response(html, {
-          status: 404,
-          headers: {
-            ...Object.fromEntries(responseHeaders.entries()),
-            'content-type': 'text/html; charset=utf-8',
-          },
-        });
-      }
+      const wantsDev404 = isDev && req.method === 'GET' && acceptsHtml;
+
+      // The dev page is loaded up front: the chain's terminal is synchronous,
+      // and dev-tools must stay out of the production bundle (dynamic import).
+      const devPage = wantsDev404
+        ? await import('../../dev-tools/404-page.js').catch(() => null)
+        : null;
+
+      const defaultPage = devPage
+        ? (_status: number, headers: Headers) => {
+            const routes = devPage.collectRoutes(manifest.root);
+            const pathname = new URL(req.url).pathname;
+            // devHmrOptions is set by the dev server after this module is
+            // imported (read at request time, not closure-capture time).
+            const html = devPage.generateDev404Page(pathname, routes, pipelineConfig.devHmrOptions);
+            return new Response(html, {
+              status: 404,
+              headers: {
+                ...Object.fromEntries(headers.entries()),
+                'content-type': 'text/html; charset=utf-8',
+              },
+            });
+          }
+        : undefined;
 
-      return response;
+      return renderNoMatchPage(req, manifest.root, responseHeaders, clientBootstrap, defaultPage);
     },
     interceptionRewrites: manifest.interceptionRewrites,
+    matchInterceptedRoute: createInterceptedRouteMatcher(manifest.root),
     // Slow request threshold from timber.config.ts. Default 3000ms, 0 to disable.
     // See design/17-logging.md §"slowRequestMs"
     slowRequestMs: (runtimeConfig as Record<string, unknown>).slowRequestMs as number | undefined,

package/src/server/rsc-entry/render-route.ts

@@ -140,12 +140,13 @@ export async function renderRoute(
   });
 
   const {
-    element,
+    payload,
     layoutComponents,
     deferSuspenseFor,
     skippedSegments,
     shellSettled,
     slotSkipInfo,
+    firstDeniedIndex,
   } = routeResult;
 
   // Build head HTML for injection into the SSR output.
@@ -199,7 +200,7 @@ export async function renderRoute(
 
   // Render to RSC Flight stream with signal tracking.
   const _rscStart = performance.now();
-  const { rscStream, signals, getDebugComponents } = renderRscStream(element, req);
+  const { rscStream, signals, getDebugComponents } = renderRscStream(payload, req);
   if (shellSettled) signals.shellSettled = shellSettled;
 
   // Store the debug components getter in ALS so onPipelineError can
@@ -250,6 +251,9 @@ export async function renderRoute(
   // Synchronous render error — renderToReadableStream threw before
   // creating the stream. Render the error page with correct 5xx status.
   // (Async render errors are tracked in onError and handled after SSR.)
+  // An RSC payload request gets the hard-navigate envelope rather than an
+  // error page — `renderErrorPage` owns that branch, so every one of its call
+  // sites is covered rather than this one alone (TIM-1322).
   if (signals.renderError && !rscStream) {
     return renderErrorPage(
       signals.renderError.error,
@@ -274,10 +278,10 @@ export async function renderRoute(
       signals,
       segments,
       layoutComponents,
-      match,
       responseHeaders,
       skippedSegments,
-      slotSkipInfo
+      slotSkipInfo,
+      firstDeniedIndex
     );
   }
 
@@ -296,5 +300,6 @@ export async function renderRoute(
     deferSuspenseFor,
     globalError,
     slotSkipInfo,
+    firstDeniedIndex,
   });
 }

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -342,7 +342,7 @@ export function createRevalidateRendererFactory(
         deps.buildManifest.metadataRouteHashes
       );
       return {
-        element: routeResult.element,
+        payload: routeResult.payload,
       };
     };
   };

package/src/server/rsc-entry/rsc-payload.ts

@@ -10,7 +10,6 @@
 
 import type { LayoutEntry } from '../deny-renderer.js';
 import { renderDenyPageAsRsc } from '../deny-renderer.js';
-import type { RouteMatch } from '../pipeline.js';
 import type { RedirectSignal } from '../primitives.js';
 import type { LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
@@ -23,6 +22,8 @@ import {
   RSC_CONTENT_TYPE,
 } from './helpers.js';
 
+import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.js';
+
 import type { RenderSignals } from './rsc-stream.js';
 
 /**
@@ -40,10 +41,11 @@ export async function buildRscPayloadResponse(
   signals: RenderSignals,
   segments: ManifestSegmentNode[],
   layoutComponents: LayoutComponentEntry[],
-  match: RouteMatch,
   responseHeaders: Headers,
   skippedSegments?: string[],
-  slotSkipInfo?: SlotSkipEntry[]
+  slotSkipInfo?: SlotSkipEntry[],
+  /** Index of the first denied segment — see RouteElementResult.firstDeniedIndex. */
+  firstDeniedIndex = Infinity
 ): Promise<Response> {
   // Read the first chunk from the RSC stream before committing headers.
   // Race the first read against signal detection — if an async component
@@ -82,12 +84,7 @@ export async function buildRscPayloadResponse(
     // SSR-rendered error page. See design/10-error-handling.md.
     reader.cancel().catch(() => {});
     signals.onSignal = undefined;
-    responseHeaders.set('X-Timber-Error', '1');
-    responseHeaders.set('content-type', 'application/json; charset=utf-8');
-    return new Response(JSON.stringify({ error: true, status: 500 }), {
-      status: 500,
-      headers: responseHeaders,
-    });
+    return rscErrorEnvelope(500, responseHeaders);
   }
 
   // If data arrived first, still check signals — they may have fired
@@ -143,15 +140,7 @@ export async function buildRscPayloadResponse(
   // §"Error Page Rendering for Client Navigation".
   if (signals.renderError) {
     reader.cancel().catch(() => {});
-    responseHeaders.set('X-Timber-Error', '1');
-    responseHeaders.set('content-type', 'application/json; charset=utf-8');
-    return new Response(
-      JSON.stringify({
-        error: true,
-        status: signals.renderError.status,
-      }),
-      { status: signals.renderError.status, headers: responseHeaders }
-    );
+    return rscErrorEnvelope(signals.renderError.status, responseHeaders);
   }
 
   // Extract the first chunk from the race result.
@@ -200,7 +189,13 @@ export async function buildRscPayloadResponse(
   // for state tree diffing on subsequent navigations. Request-dependency
   // is determined by static module-graph analysis (not runtime taint).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
-  const segmentInfo = buildSegmentInfo(segments, layoutComponents, slotSkipInfo, skippedSegments);
+  const segmentInfo = buildSegmentInfo(
+    segments,
+    layoutComponents,
+    slotSkipInfo,
+    skippedSegments,
+    firstDeniedIndex
+  );
   responseHeaders.set('X-Timber-Segments', JSON.stringify(segmentInfo));
 
   // Send skipped segments so the client can merge the partial RSC payload
@@ -209,12 +204,6 @@ export async function buildRscPayloadResponse(
     responseHeaders.set('X-Timber-Skipped-Segments', JSON.stringify(skippedSegments));
   }
 
-  // Send route params so the client can populate useSegmentParams() after
-  // SPA navigation. Without this, useSegmentParams() returns {}.
-  if (Object.keys(match.segmentParams).length > 0) {
-    responseHeaders.set('X-Timber-Params', JSON.stringify(match.segmentParams));
-  }
-
   // Check if a DenySignal was caught in-tree by AccessGate or
   // PageDenyBoundary. The deny page is in the Flight stream as a normal
   // element — use the deny status for the HTTP response. See TIM-666.

package/src/server/rsc-entry/rsc-stream.ts

@@ -11,6 +11,7 @@
  */
 
 import { renderToReadableStream } from '../../rsc-runtime/rsc.js';
+import type { RscPayloadRoot } from '../../shared/payload-root.js';
 
 import { randomUUID } from 'node:crypto';
 
@@ -74,7 +75,7 @@ export interface RscStreamResult {
 }
 
 /**
- * Render a React element tree to an RSC Flight stream.
+ * Render a payload root (tree plus its params) to an RSC Flight stream.
  *
  * The stream serializes server components as rendered output and client
  * components ("use client") as serialized references with module ID + export name.
@@ -84,7 +85,7 @@ export interface RscStreamResult {
  * fires onError during stream consumption. Signals are captured in the
  * returned `signals` object for the caller to handle.
  */
-export function renderRscStream(element: React.ReactElement, req: Request): RscStreamResult {
+export function renderRscStream(payload: RscPayloadRoot, req: Request): RscStreamResult {
   const signals: RenderSignals = {
     denySignal: null,
     redirectSignal: null,
@@ -100,7 +101,7 @@ export function renderRscStream(element: React.ReactElement, req: Request): RscS
 
   try {
     rscStream = renderToReadableStream(
-      element,
+      payload,
       {
         signal: req.signal,
         onError(error: unknown) {

package/src/server/rsc-entry/ssr-renderer.ts

@@ -14,6 +14,8 @@
 
 import type { ClientBootstrapConfig } from '../html-injectors.js';
 import { flightInitScript } from '../flight-scripts.js';
+import { appVisibleSearch } from '../../shared/rsc-cache-key.js';
+import { getSlotParamsForClient } from '../request-context.js';
 import type { LayoutEntry } from '../deny-renderer.js';
 import { renderDenyPage } from '../deny-renderer.js';
 import type { RouteMatch } from '../pipeline.js';
@@ -102,6 +104,8 @@ interface SsrRenderOptions {
   /** Tier 2 global-error.tsx file, if present in app/. */
   globalError?: GlobalErrorFile;
   slotSkipInfo?: SlotSkipEntry[];
+  /** Index of the first denied segment — see RouteElementResult.firstDeniedIndex. */
+  firstDeniedIndex?: number;
 }
 
 /**
@@ -170,26 +174,26 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   // Skipped when client JS is disabled — no client JS to consume it.
   const segmentScript = clientJsDisabled
     ? ''
-    : `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents, opts.slotSkipInfo)))}</script>`;
+    : `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents, opts.slotSkipInfo, undefined, opts.firstDeniedIndex)))}</script>`;
 
-  // Embed route params in HTML so useSegmentParams() works on initial hydration.
-  // Without this, useSegmentParams() returns {} until the first client navigation.
-  const paramsScript =
-    clientJsDisabled || Object.keys(match.segmentParams).length === 0
-      ? ''
-      : `<script>self.__timber_params=${htmlEscapeJsonString(JSON.stringify(match.segmentParams))}</script>`;
+  // Params reach the browser inside the payload — a field on the root row of
+  // the same Flight stream that is inlined for hydration. SSR itself renders
+  // only the tree, and the client components it renders read params from the
+  // ALS context seeded below, which is also where server components answer
+  // `getSegmentParams(slotPath)` from.
+  const slotParams = getSlotParamsForClient();
 
   const navContext: NavContext = {
     pathname: new URL(req.url).pathname,
     segmentParams: match.segmentParams,
-    searchParams: Object.fromEntries(new URL(req.url).searchParams),
+    searchParams: Object.fromEntries(appVisibleSearch(new URL(req.url)).params),
+    slotParams,
     statusCode: 200,
     responseHeaders,
     headHtml:
       headHtml +
       clientBootstrap.preloadLinks +
       segmentScript +
-      paramsScript +
       // Initialize __timber_f in <head> so it exists before any streaming
       // chunk scripts arrive in <body>. See flight-scripts.ts, LOCAL-415.
       (clientJsDisabled ? '' : flightInitScript()),