@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.187

package/src/server/route-handler.ts

@@ -11,6 +11,7 @@
 import type { RouteContext } from './types.js';
 import { logRouteError } from './logger.js';
 import { DenySignal, RedirectSignal } from './primitives.js';
+import { stripHeadBody } from './head-response.js';
 
 // ─── Types ───────────────────────────────────────────────────────────────
 
@@ -89,18 +90,17 @@ export async function handleRouteRequest(mod: RouteModule, ctx: RouteContext): P
     });
   }
 
-  // HEAD fallback — run GET, strip body
+  // HEAD fallback — dispatch to GET when the module exports no HEAD, so the
+  // headers are the ones a GET would produce. The body is stripped by the
+  // shared helper (also applied at the pipeline exit, where it is a no-op the
+  // second time) rather than open-coded here — one implementation means the
+  // discarded stream is cancelled on every path. See TIM-1324.
   if (method === 'HEAD') {
     if (mod.HEAD) {
-      return runHandler(mod.HEAD, ctx);
+      return stripHeadBody(await runHandler(mod.HEAD, ctx), method);
     }
     if (mod.GET) {
-      const res = await runHandler(mod.GET, ctx);
-      // Return headers + status but no body
-      return new Response(null, {
-        status: res.status,
-        headers: res.headers,
-      });
+      return stripHeadBody(await runHandler(mod.GET, ctx), method);
     }
   }
 

package/src/server/route-matcher.ts

@@ -83,10 +83,27 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
   const result = matchUrlParts(root, parts);
   if (!result) return null;
 
-  // Collect middleware from all segments in the chain, root to leaf.
-  // Each middleware is lazy-loaded via dynamic import on first invocation.
+  return {
+    segments: result.chain,
+    segmentParams: result.params,
+    middlewareChain: collectMiddlewareChain(result.chain),
+  };
+}
+
+/**
+ * Collect middleware from a matched segment chain, root to leaf.
+ *
+ * Each entry is lazy-loaded via dynamic import on first invocation.
+ *
+ * Shared with the children-path interception resolver
+ * (`children-interception.ts`), which assembles a chain from the tree rather
+ * than from a pathname but produces the same kind of `RouteMatch` — every
+ * `middleware.ts` above an intercepted page must run exactly as it does for
+ * the canonical route.
+ */
+export function collectMiddlewareChain(chain: ManifestSegmentNode[]): MiddlewareFn[] {
   const middlewareChain: MiddlewareFn[] = [];
-  for (const segment of result.chain) {
+  for (const segment of chain) {
     if (segment.middleware) {
       const loader = segment.middleware.load;
       middlewareChain.push(async (ctx) => {
@@ -97,12 +114,7 @@ function matchPathname(root: ManifestSegmentNode, pathname: string): RouteMatch
       });
     }
   }
-
-  return {
-    segments: result.chain,
-    segmentParams: result.params,
-    middlewareChain,
-  };
+  return middlewareChain;
 }
 
 // ─── Metadata Route Matcher ─────────────────────────────────────────────

package/src/server/rsc-cache-key-guard.ts

@@ -0,0 +1,164 @@
+/**
+ * Origin-side binding of the `_rsc` cache key to the request that produced
+ * the response (TIM-1268).
+ *
+ * The key is deterministic, and deliberately so — that is what makes RSC
+ * payloads cacheable. But deterministic also means *predictable*: anyone can
+ * compute the key another client will request. Without this guard, a caller
+ * could request `/about?_rsc=<victim's key>` while sending its own
+ * `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+ * environment this feature targets — would store that variant under the
+ * victim's key. Every subsequent legitimate navigation would then be served
+ * a payload rendered for someone else's segment tree or deployment.
+ *
+ * The guard is a *storability* rule, not a rejection: if the claimed key
+ * does not match the key derived from the received headers, the response
+ * loses its shared-cache directives. Mismatched requests are still served
+ * normally, they just cannot be stored for anyone else.
+ *
+ * Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+ * right, costs a round trip on every legitimate miss, and would make the
+ * server's behaviour depend on a parameter it otherwise never reads. This
+ * rule closes the same hole by making the poisoned entry unstorable at the
+ * source, in the response the developer already has to opt into sharing.
+ *
+ * See design/19-client-navigation.md §"The `_rsc` cache key".
+ */
+
+import { rscCacheKey, isRscCacheKeyShape, RSC_KEY_PARAM } from '../shared/rsc-cache-key.js';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+
+/**
+ * Legacy shared-cache control fields that predate RFC 9213 and so do not
+ * follow the `<target>-Cache-Control` naming pattern — the one part of this
+ * rule that cannot be matched by shape. `X-Accel-Expires` is nginx
+ * `proxy_cache`, which gives it precedence over `Cache-Control`.
+ *
+ * A closed historical set, unlike the vendor `*-Cache-Control` names, which
+ * keep being minted and are handled by pattern below.
+ */
+const LEGACY_CDN_CACHE_HEADERS = ['Surrogate-Control', 'Edge-Control', 'X-Accel-Expires'];
+
+/**
+ * Whether a response header overrides `Cache-Control` at a shared cache.
+ *
+ * Matched by *shape*, not by vendor name. RFC 9213 defines targeted fields
+ * as `<target>-Cache-Control`, and every CDN spells its own: `CDN-`,
+ * `Cloudflare-CDN-`, `Netlify-CDN-`, `Vercel-CDN-`, and whichever ships
+ * next. A vendor list here is a denylist with an unbounded tail — it was
+ * extended twice during review, each time by one name, which is the signal
+ * that enumeration is the wrong shape. The suffix rule is total.
+ *
+ * `Cache-Control` itself does not match (no `-` prefix) and is replaced
+ * separately.
+ */
+function isSharedCacheOverride(name: string): boolean {
+  const lowered = name.toLowerCase();
+  return (
+    lowered.endsWith('-cache-control') ||
+    LEGACY_CDN_CACHE_HEADERS.some((legacy) => legacy.toLowerCase() === lowered)
+  );
+}
+
+/**
+ * Whether the request's `_rsc` parameter matches the key derived from its
+ * own headers.
+ *
+ * Requests without the parameter are not claiming a key at all, so they are
+ * left alone — the bare document URL is the developer's declared territory
+ * (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+ * whose value could not be one of our digests: `_rsc` is not reserved, and
+ * an application that already uses it for its own search state
+ * (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+ * guard that mistook that for a forgery.
+ */
+export async function hasValidRscCacheKey(req: Request): Promise<boolean> {
+  // Fast path: this runs on every request, and the overwhelming majority
+  // (document requests) have no query string at all. Keyed on `?` and not
+  // on the literal `_rsc=`, because a substring test is not a parse: a
+  // request for `?%5Frsc=<key>` carries no literal `_rsc=`, yet
+  // `URLSearchParams` decodes it to one — and a cache that canonicalizes
+  // percent-encoded unreserved characters in its key while forwarding the
+  // original URL would store the response under the decoded, claimed key.
+  // The only sound fast path is one that cannot answer "no key" wrongly.
+  if (!req.url.includes('?')) return true;
+  let values: string[];
+  try {
+    values = new URL(req.url).searchParams.getAll(RSC_KEY_PARAM);
+  } catch {
+    // Unparseable URL — nothing to validate, and nothing safe to assume.
+    return false;
+  }
+  // Every value, not the first. An application that owns `_rsc` for its own
+  // search state makes the client emit `?_rsc=foo&_rsc=<key>` — reading only
+  // the first would see `foo`, exempt it as application data, and never
+  // check the real key sitting beside it.
+  const claims = values.filter(isRscCacheKeyShape);
+  if (claims.length === 0) return true;
+  const expected = await rscCacheKey((name) => req.headers.get(name));
+  // No digest available means the claim is unverifiable, which is not the
+  // same as verified. Every server runtime timber targets has
+  // `crypto.subtle`, so this is a guard against a future one that does not.
+  if (expected === null) return false;
+  // All of them, because at most one can be legitimate and a cache keys on
+  // the whole query string — a second, mismatched key would ride along
+  // inside an address that otherwise looks validated.
+  return claims.every((claim) => claim === expected);
+}
+
+/**
+ * Ensure a Flight payload can never be interpreted as a document.
+ *
+ * Applied here, at the pipeline's single exit, rather than where each
+ * payload response is built. Six places build one — the success path, three
+ * in `deny-renderer.ts`, the action paths — and hardening them one at a time
+ * is how you end up hardening five of six. The response is Flight if it says
+ * it is; that is the only test that covers every producer, including ones
+ * added later.
+ *
+ * Matters because the payload URL is observable and, on a shared-cache hit,
+ * the origin is never consulted — so a top-level navigation can be handed
+ * these bytes with no request-time check available. See design/13-security.md
+ * #36c.
+ */
+export function hardenRscPayloadResponse(response: Response): void {
+  const contentType = response.headers.get('content-type');
+  if (!contentType) return;
+  if (contentType.split(';')[0].trim().toLowerCase() !== RSC_CONTENT_TYPE) return;
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+}
+
+/**
+ * Make a response unstorable by any shared cache when its request claimed an
+ * `_rsc` key that does not match its own headers.
+ *
+ * The end state is unconditional and therefore statable: **a mismatched
+ * response is never stored by any cache.** Every targeted cache-control
+ * field is removed and `Cache-Control` is replaced outright, rather than
+ * downgrading only when a shared directive is spotted. Conditional variants
+ * of this were tried and were wrong twice over — they missed the CDN-
+ * specific headers, and leaving `Cache-Control` alone when it looked
+ * harmless lets a CDN apply heuristic caching to a response that has none.
+ *
+ * The cost is that a mismatched request loses developer-chosen *browser*
+ * caching too. That is a request no timber client ever makes.
+ *
+ * Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+ * they address stored entries, and this response is not stored.
+ *
+ * Mutates `response.headers` in place; the pipeline guarantees mutable
+ * headers at this point (see TIM-866).
+ */
+export async function enforceRscCacheKey(req: Request, response: Response): Promise<void> {
+  if (await hasValidRscCacheKey(req)) return;
+  // Collected before deleting — mutating Headers while iterating its live
+  // key iterator can skip entries.
+  const overrides: string[] = [];
+  for (const name of response.headers.keys()) {
+    if (isSharedCacheOverride(name)) overrides.push(name);
+  }
+  for (const name of overrides) {
+    response.headers.delete(name);
+  }
+  response.headers.set('Cache-Control', 'private, no-store');
+}

package/src/server/rsc-entry/api-handler.ts

@@ -11,6 +11,7 @@ import type { ManifestSegmentNode } from '../route-matcher.js';
 import { loadModule } from '../safe-load.js';
 import { DenySignal, RedirectSignal } from '../primitives.js';
 import { handleRouteRequest } from '../route-handler.js';
+import { stripHeadBody } from '../head-response.js';
 import type { RouteModule } from '../route-handler.js';
 import type { RouteContext } from '../types.js';
 
@@ -89,9 +90,10 @@ export async function handleApiRoute(
  * method handler into the proper API response: DenySignal → JSON status-file
  * chain via `renderApiDeny`, RedirectSignal → bare 3xx with Location header.
  *
- * For HEAD requests, strip the deny body to preserve HEAD semantics — the
- * normal HEAD path in `handleRouteRequest` strips bodies after the handler
- * returns, but signals bypass that codepath.
+ * For HEAD requests, strip the deny body to preserve HEAD semantics — signals
+ * bypass the HEAD path in `handleRouteRequest`, so this exit needs its own
+ * call. Shares `stripHeadBody` with that path and with the pipeline exit; the
+ * pipeline applying it again downstream is a no-op (TIM-1324).
  *
  * Returns `null` for non-signal errors so the caller knows to rethrow.
  */
@@ -102,11 +104,7 @@ async function translateApiSignal(
   responseHeaders: Headers
 ): Promise<Response | null> {
   if (error instanceof DenySignal) {
-    const res = await renderApiDeny(error, segments, responseHeaders);
-    if (req.method.toUpperCase() === 'HEAD') {
-      return new Response(null, { status: res.status, headers: res.headers });
-    }
-    return res;
+    return stripHeadBody(await renderApiDeny(error, segments, responseHeaders), req.method);
   }
   if (error instanceof RedirectSignal) {
     responseHeaders.set('Location', error.location);

package/src/server/rsc-entry/deny-fallback.ts

@@ -17,7 +17,8 @@ import { logRenderError } from '../logger.js';
 import type { PipelineConfig, RouteMatch } from '../pipeline.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { loadModule } from '../safe-load.js';
-import { createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { createDebugChannelSink } from './helpers.js';
+import { isRscRequest } from '../../shared/rsc-media-type.js';
 import { callSsr } from './ssr-bridge.js';
 
 /**
@@ -67,7 +68,7 @@ export function createDenyFallbackRenderer(options: {
     // decoder breaks navigation, so dispatch to the RSC renderer when the
     // request is an RSC payload request — mirroring the normal render path.
     // See design/19-client-navigation.md §"RSC Payload Handling" and TIM-823.
-    if (isRscPayloadRequest(req)) {
+    if (isRscRequest(req)) {
       return renderDenyPageAsRsc(
         deny,
         chain,

package/src/server/rsc-entry/error-renderer.ts

@@ -17,14 +17,18 @@ import { renderToReadableStream } from '../../rsc-runtime/rsc.js';
 
 import type { RouteMatch } from '../pipeline.js';
 import { logRenderError } from '../logger.js';
+import { appVisibleSearch } from '../../shared/rsc-cache-key.js';
+import { getSlotParamsForClient } from '../request-context.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { DenySignal, RenderError } from '../primitives.js';
 import type { ClientBootstrapConfig } from '../html-injectors.js';
 import { flightInitScript, htmlEscapeJsonString } from '../flight-scripts.js';
 import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.js';
-import type { LayoutEntry } from '../deny-renderer.js';
+import type { DefaultPageRenderer, LayoutEntry } from '../deny-renderer.js';
 import type { NavContext } from '../ssr-bridge-types.js';
-import { createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { createDebugChannelSink } from './helpers.js';
+import { isRscRequest } from '../../shared/rsc-media-type.js';
+import { withPublishedParams } from '../publish-params.js';
 import { getCookiesForSsr } from '../cookie-context.js';
 import { callSsr } from './ssr-bridge.js';
 import { teeWithErrorPropagation } from '../stream-utils.js';
@@ -34,6 +38,8 @@ import type { SerializableError } from '../../client/error-reconstituter.js';
 import { loadModule } from '../safe-load.js';
 import { sourceMapError } from '../dev-source-map.js';
 import { isMdxFilePath as isMdxFile } from '../utils/mdx-file.js';
+import { defaultStatusPageResponse } from '../default-status-page.js';
+import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.js';
 
 /**
  * A manifest file reference with lazy import and path.
@@ -67,9 +73,12 @@ interface ErrorFileResolution {
  */
 async function resolveErrorFile(
   status: number,
-  segments: ManifestSegmentNode[]
+  segments: ManifestSegmentNode[],
+  maxIndex?: number
 ): Promise<ErrorFileResolution | null> {
-  for (let i = segments.length - 1; i >= 0; i--) {
+  const start =
+    maxIndex !== undefined ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+  for (let i = start; i >= 0; i--) {
     const segment = segments[i];
 
     if (segment.statusFiles) {
@@ -126,9 +135,14 @@ async function resolveErrorFile(
 function getLayoutsForErrorFile(
   segments: ManifestSegmentNode[],
   layoutComponents: LayoutEntry[],
-  foundSegmentIndex: number
+  foundSegmentIndex: number,
+  firstDeniedIndex = Infinity
 ): LayoutEntry[] {
-  const resolvedSegments = new Set(segments.slice(0, foundSegmentIndex + 1));
+  // Clamp so a denied segment's layout never wraps the error page.
+  // The file resolution is unbounded (errors may use leaf files), but the
+  // layout wrapping must still respect the denial boundary. TIM-1358.
+  const ceiling = Math.min(foundSegmentIndex, firstDeniedIndex - 1);
+  const resolvedSegments = new Set(segments.slice(0, ceiling + 1));
   return layoutComponents.filter((lc) => resolvedSegments.has(lc.segment));
 }
 
@@ -155,6 +169,18 @@ function toSerializableError(error: unknown): SerializableError {
  * All error pages (TSX and MDX) go through RSC → SSR:
  * - TSX: ErrorReconstituter wrapper converts SerializableError → real Error
  * - MDX: Plain props ({ status }), no wrapper needed
+ *
+ * ...except for a client-navigation request, which gets the hard-navigate
+ * envelope instead. Every tier below produces an HTML document, and the
+ * client's Flight decoder is waiting for `text/x-component`; handing it HTML
+ * crashes the decode. The check lives here rather than at the call sites
+ * because it holds for all five of them, and the deny path's equivalent split
+ * (`renderDenyPage` / `renderDenyPageAsRsc`) had already been forgotten at one
+ * of this function's — the synchronous render-error exit in `render-route.ts`
+ * (TIM-1322). Four of the five are unreachable for an RSC request today
+ * (`render-route.ts` returns the payload before it reaches SSR, and
+ * `outcomeToResponse` answers RSC errors itself), so this fires on one path
+ * and guards the rest against drift.
  */
 export async function renderErrorPage(
   error: unknown,
@@ -165,14 +191,27 @@ export async function renderErrorPage(
   match: RouteMatch,
   responseHeaders: Headers,
   clientBootstrap: ClientBootstrapConfig,
-  globalError?: GlobalErrorFile
+  globalError?: GlobalErrorFile,
+  firstDeniedIndex = Infinity
 ): Promise<Response> {
+  // The error itself is not logged here — every producer of a `renderError`
+  // signal already logged it at the point it was caught (`rsc-stream.ts`'s
+  // `onError`, `outcomeToResponse`), so a log on this exit would double up.
+  if (isRscRequest(req)) {
+    return rscErrorEnvelope(status, responseHeaders);
+  }
+
   // Source-map the error's stack trace in dev mode so the error page
   // shows original source positions instead of transpiled/bundled ones.
   // See TIM-811.
   sourceMapError(error);
-  // Walk segments from leaf to root to find the error component
-  const resolution = await resolveErrorFile(status, segments);
+  // Walk segments from leaf to root to find the error component.
+  // When firstDeniedIndex is finite, bound the walk so error files below
+  // the denied segment are not selected — matching the deny renderer's
+  // behavior. For plain errors (firstDeniedIndex = Infinity), the full
+  // chain is searched. See TIM-1358.
+  const errorMaxIndex = firstDeniedIndex < Infinity ? firstDeniedIndex : undefined;
+  const resolution = await resolveErrorFile(status, segments, errorMaxIndex);
 
   // Tier 2: No segment-level error file — try global-error.tsx
   if (!resolution && globalError) {
@@ -187,13 +226,22 @@ export async function renderErrorPage(
     );
   }
 
-  // Tier 3: No error component found at any level — bare response
+  // Tier 3: No error component found at any level — framework default page.
+  // The deny chain's terminal is the same page, so an app with no error files
+  // gets a readable status page for both 4xx and 5xx rather than a blank
+  // document. It carries the status and nothing else — never the error
+  // (design/13-security.md principle 4). See TIM-1258.
   if (!resolution) {
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 
   const { component: errorComponent, segmentIndex, isMdx } = resolution;
-  const layoutsToWrap = getLayoutsForErrorFile(segments, layoutComponents, segmentIndex);
+  const layoutsToWrap = getLayoutsForErrorFile(
+    segments,
+    layoutComponents,
+    segmentIndex,
+    firstDeniedIndex
+  );
 
   return renderErrorPageViaRsc(
     error,
@@ -257,9 +305,12 @@ async function renderErrorPageViaRsc(
     element = h(component, null, element);
   }
 
-  // Render through RSC → SSR (same path as deny pages)
+  // Render through RSC → SSR (same path as deny pages) — including the params
+  // wrap, which every payload the server sends needs. An error page on a
+  // dynamic route reads params like any other page, and SSR would get them
+  // from the request ALS while the hydrated client got an empty record.
   try {
-    const rscStream = renderToReadableStream(element, {
+    const rscStream = renderToReadableStream(withPublishedParams(element), {
       signal: req.signal,
       onError(err: unknown) {
         logRenderError({ method: req.method, path: url.pathname, error: err });
@@ -269,32 +320,35 @@ async function renderErrorPageViaRsc(
 
     const [ssrStream, inlineStream] = teeWithErrorPropagation(rscStream);
 
-    // Build params bootstrap script so useSegmentParams() works on hydration.
-    // Without this, error pages on dynamic routes hydrate with empty params.
-    const paramsScript =
-      Object.keys(match.segmentParams).length === 0
-        ? ''
-        : `<script>self.__timber_params=${htmlEscapeJsonString(JSON.stringify(match.segmentParams))}</script>`;
+    // Params ride the payload root, beside the tree, so there is no
+    // bootstrap script. Read here for the SSR-side ALS context below.
+    const slotParams = getSlotParamsForClient();
 
     const navContext: NavContext = {
       pathname: url.pathname,
       segmentParams: match.segmentParams,
-      searchParams: Object.fromEntries(url.searchParams),
+      searchParams: Object.fromEntries(appVisibleSearch(url).params),
+      slotParams,
       statusCode: status,
       responseHeaders,
-      headHtml: paramsScript + flightInitScript(),
+      headHtml: flightInitScript(),
       bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
       rscStream: inlineStream,
       signal: req.signal,
       cookies: getCookiesForSsr(),
     };
 
-    return callSsr(ssrStream, navContext);
+    // `await` inside the try on purpose: SSR of the error page fails
+    // asynchronously far more often than synchronously, and returning the
+    // promise bare let every such rejection escape this guard.
+    return await callSsr(ssrStream, navContext);
   } catch (renderError) {
-    // Error page itself failed to render — fall through to bare response.
-    // This guards against recursive errors in user error page code.
+    // The error page itself failed to render — guards against recursive
+    // errors in user error page code. Terminates in the framework default
+    // page, not a blank body: a crashing error page is precisely when the
+    // reader has nothing else to go on (TIM-1258).
     logRenderError({ method: req.method, path: url.pathname, error: renderError });
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 }
 
@@ -315,11 +369,12 @@ async function renderGlobalErrorPage(
   responseHeaders: Headers,
   clientBootstrap: ClientBootstrapConfig
 ): Promise<Response> {
-  // .catch: if global-error.tsx fails to load, fall through to bare response.
-  // This is the last tier — no further recovery. See TIM-584.
+  // .catch: if global-error.tsx fails to load or exports no component, it is
+  // not a usable Tier 2 match — fall through to the framework default page
+  // rather than a blank body. See TIM-584, TIM-1258.
   const mod = await loadModule(globalError).catch(() => null);
   if (!mod?.default) {
-    return new Response(null, { status, headers: responseHeaders });
+    return defaultStatusPageResponse(status, responseHeaders);
   }
 
   const component = mod.default as (...args: unknown[]) => unknown;
@@ -350,15 +405,18 @@ export async function renderNoMatchPage(
   req: Request,
   rootSegment: ManifestSegmentNode,
   responseHeaders: Headers,
-  clientBootstrap: ClientBootstrapConfig
+  clientBootstrap: ClientBootstrapConfig,
+  defaultPage?: DefaultPageRenderer
 ): Promise<Response> {
   const segments = [rootSegment];
 
-  // Load root layout if present
+  // Load root layout if present. A layout that fails to import or evaluate
+  // must not take the 404 down with it — render the status page unwrapped,
+  // as renderFallbackError does for the same reason.
   const layoutComponents: LayoutEntry[] = [];
   if (rootSegment.layout) {
-    const mod = await loadModule(rootSegment.layout);
-    if (mod.default) {
+    const mod = await loadModule(rootSegment.layout).catch(() => null);
+    if (mod?.default) {
       layoutComponents.push({
         component: mod.default as (...args: unknown[]) => unknown,
         segment: rootSegment,
@@ -369,7 +427,7 @@ export async function renderNoMatchPage(
   const deny = new DenySignal(404);
   const match: RouteMatch = { segments, segmentParams: {}, middlewareChain: [] };
 
-  if (isRscPayloadRequest(req)) {
+  if (isRscRequest(req)) {
     return renderDenyPageAsRsc(
       deny,
       segments,
@@ -389,6 +447,7 @@ export async function renderNoMatchPage(
     responseHeaders,
     clientBootstrap,
     createDebugChannelSink,
-    callSsr
+    callSsr,
+    defaultPage
   );
 }