@timber-js/app 0.2.0-alpha.186 → 0.2.0-alpha.187

package/dist/server/access-gate.d.ts

@@ -17,18 +17,29 @@ import type { ReactNode } from 'react';
 /**
  * Framework-injected access gate for segments.
  *
- * When a pre-computed `verdict` prop is provided (from the pre-render pass
- * in route-element-builder.ts), AccessGate replays it synchronously — no
- * async, no re-execution of access.ts, immune to Suspense timing. The OTEL
- * span was already emitted during the pre-render pass.
- *
- * When no verdict is provided (backward compat with tree-builder.ts),
- * AccessGate calls accessFn directly with OTEL instrumentation.
+ * Calls accessFn during render — inside `renderToReadableStream`, sharing
+ * the same `React.cache` scope as layouts and pages. A `requireUser()`
+ * call in access.ts populates the cache; the same call in any layout is
+ * a free hit. Access executes exactly once per request. See TIM-1363.
  *
  * access.ts is a pure gate — return values are discarded. The layout below
  * gets the same data by calling the same cached functions (React.cache dedup).
+ *
+ * On denial the gate renders the matching deny page only when this segment
+ * owns it. Because the gate is wrapped OUTSIDE its own layout, that render
+ * omits the denying segment's layout — deliberate, and the one place the
+ * in-tree path diverges from `renderDenyPage`'s inclusive slice: a layout
+ * whose access.ts denied must never run and serialize protected data into
+ * the Flight stream (TIM-1074). An ancestor-owned page is hoisted instead,
+ * because the gate also sits inside every layout above it and rendering
+ * here would wrap the deny page in all of them (TIM-1356).
+ *
+ * For skipped segments (skippedSegment=true), deny pages are NOT rendered
+ * in-tree — the client's cached layout chrome would wrap them incorrectly.
+ * Instead, the deny is recorded in ALS and rethrown so the response path
+ * can return rscErrorEnvelope for a client hard-navigate.
  */
-export declare function AccessGate(props: AccessGateProps): ReactNode | Promise<ReactNode>;
+export declare function AccessGate(props: AccessGateProps): Promise<ReactNode>;
 /**
  * Framework-injected access gate for parallel slots.
  *

package/dist/server/access-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-gate.d.ts","sourceRoot":"","sources":["../../src/server/access-gate.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAK9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIvC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAuBjF;AAiDD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CA6EnF"}
+{"version":3,"file":"access-gate.d.ts","sourceRoot":"","sources":["../../src/server/access-gate.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAK9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrE;AA2DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CA6EnF"}

package/dist/server/action-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAItE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAMrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CA6EzC"}
+{"version":3,"file":"action-handler.d.ts","sourceRoot":"","sources":["../../src/server/action-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAItE,OAAO,EAAwC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAOrD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,0BAA0B;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gDAAgD;IAChD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAarD;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,CA6EzC"}

package/dist/server/als-registry.d.ts

@@ -111,6 +111,22 @@ export interface RequestContextStore {
      * context for render-phase errors without module-level shared state.
      */
     debugComponentsGetter?: () => DebugComponentEntry[];
+    /**
+     * Index of the first segment whose AccessGate denied during render.
+     * Recorded by AccessGate when it catches a DenySignal so post-render
+     * consumers (buildSegmentInfo, X-Timber-Segments header) can bound
+     * the segment list without a pre-render access pass. Infinity when
+     * no segment denied. See TIM-1363.
+     */
+    _firstDeniedSegmentIndex?: number;
+    /**
+     * Metadata entries collected during render by MetadataCollector.
+     * Populated per-segment in tree order (root→page) during
+     * renderToReadableStream. MetadataHead reads all entries,
+     * merges them, and renders Float-hoisted head elements.
+     * See TIM-1363, design/16-metadata.md.
+     */
+    _metadataEntries?: import('./metadata.js').SegmentMetadataEntry[];
 }
 /** A single outgoing cookie entry in the cookie jar. */
 export interface CookieEntry {

package/dist/server/als-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA2BlE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAE7B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,mBAAmB,EAAE,CAAC;CACrD;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;CACtD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAA6D,CAAC;AAMnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAMtF,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAE3B,CAAC;AAMF,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAExB,CAAC;AAMF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAE/B,CAAC;AAMF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAmE,CAAC;AAM7F,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,yCAEhC,CAAC"}
+{"version":3,"file":"als-registry.d.ts","sourceRoot":"","sources":["../../src/server/als-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA2BlE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,wCAE7B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,uEAAuE;IACvE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,wFAAwF;IACxF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,mBAAmB,EAAE,CAAC;IACpD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,eAAe,EAAE,oBAAoB,EAAE,CAAC;CACnE;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,qBAAqB,EAAE,aAAa,CAAC;CACtD;AAMD,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,YAAY,CAAC;CACpD;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,+BAA6D,CAAC;AAMnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,oBAAoB,EAAE,WAAW,EAAE,CAAC;CACrD;AAED,yDAAyD;AACzD,eAAO,MAAM,SAAS,gCAA+D,CAAC;AAMtF,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,sCAE3B,CAAC;AAMF,sDAAsD;AACtD,eAAO,MAAM,YAAY,4DAExB,CAAC;AAMF,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAE3D,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,uCAE/B,CAAC;AAMF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,YAAY,gCAAmE,CAAC;AAM7F,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,yCAEhC,CAAC"}

package/dist/server/compress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAc7B,CAAC;AASH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BvE;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAmB1D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiC/E"}

package/dist/server/deny-boundary.d.ts

@@ -8,10 +8,14 @@
  *    `DenyPageEntry` records ordered by specificity (specific status →
  *    category catch-all → `error.tsx`).
  *
- * 2. **Runtime matching** (`renderMatchingDenyPage`) — picks the first
- *    chain entry whose status filter matches the thrown DenySignal and
- *    returns a React element for the matching component. Used by
- *    `AccessGate` and `PageDenyBoundary` when they catch a deny.
+ * 2. **Runtime matching and placement** (`matchDenyEntry`, `placeDenyPage`,
+ *    `handleCaughtDeny`) — picks the first chain entry whose status filter
+ *    matches the thrown DenySignal, then decides whether the catch site may
+ *    render it where it stands. A chain spans the catcher outward to root,
+ *    so a match may belong to an ancestor segment; rendering it in place
+ *    would wrap it in every layout in between. Ancestor-owned matches are
+ *    re-thrown with `ownerKey` stamped on the signal so the error boundary
+ *    at the owning segment renders it. See TIM-1356.
  *
  * 3. **The page boundary itself** (`PageDenyBoundary`) — the async server
  *    component that wraps a server-component page, calls it, and catches
@@ -28,6 +32,7 @@
  *
  * See design/04-authorization.md, design/10-error-handling.md, TIM-666.
  */
+import { DenySignal } from './primitives.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
 /** A single entry in the deny page fallback chain. */
 export interface DenyPageEntry {
@@ -43,27 +48,116 @@ export interface DenyPageEntry {
     kind: 'status' | 'error';
     /** MDX files are server components — rendered with plain props, never ErrorReconstituter. */
     isMdx: boolean;
+    /**
+     * Position in the segment chain (0 = root, ascending toward leaf).
+     * Used by `matchDenyEntry` to reconstruct per-segment ordering for 5xx
+     * statuses — `resolve5xx` walks per-segment (status files then error.tsx
+     * at each segment before moving outward), while the chain is stored in
+     * the 4xx two-pass order. Without this, `deny(503)` resolves to a
+     * different file depending on which path serves it. See TIM-1360.
+     */
+    segmentIndex: number;
+    /**
+     * Segment key of the segment whose directory holds this file — where the
+     * deny page must render, which is not necessarily where it was caught.
+     *
+     * A chain flattens every segment from the catcher outward to root, so
+     * without this a catcher cannot tell a file it owns from an ancestor's,
+     * and renders both at its own position — wrapping the deny page in every
+     * layout in between (TIM-1356).
+     *
+     * A **key**, not an index: `computeSegmentKeys` produces the identity the
+     * client segment cache already navigates by, and it survives the trip
+     * through the Flight digest to a boundary the client mounted on an
+     * earlier navigation. A chain position would not — depth varies with
+     * route groups and interception.
+     *
+     * It inherits that key's known collision rather than fixing it: keys reset
+     * to `urlPath` at each URL-visible segment, so `(browse)/feed` and
+     * `(landing)/feed` are both `/feed` (see `routing/segment-keys.ts`). Two
+     * such branches are already indistinguishable to the skip decision and the
+     * client cache, so a deny addressed across them can land in the wrong
+     * branch's layout. Fixing that means fixing the key for every reader, not
+     * minting a second identity here.
+     */
+    ownerKey: string;
 }
+/**
+ * What `renderDenyEntry` needs to build the element: which component, and
+ * which props contract it expects. Deliberately excludes `ownerKey` — the
+ * re-render fallback path builds an entry from a `resolveStatusFile`
+ * resolution that already carries the position, and would otherwise have to
+ * invent an owner it never reads.
+ */
+export type DenyEntryShape = Pick<DenyPageEntry, 'component' | 'kind' | 'isMdx'>;
+/**
+ * Where a matched deny page must render, relative to the catcher that
+ * matched it.
+ *
+ * `render` — the catcher owns the file and is already at the right
+ * position. `hoist` — an ancestor owns it; the catcher must re-throw so the
+ * boundary at `ownerKey` renders it, outside the layouts in between.
+ */
+export type DenyPlacement = {
+    kind: 'render';
+    element: React.ReactElement;
+} | {
+    kind: 'hoist';
+    ownerKey: string;
+};
 /**
  * Build the deny page fallback chain from the segment chain.
  *
  * Walks segments from `startIndex` outward (toward root) and collects
  * status-code file components in fallback order:
  * 1. Specific status files (403.tsx, 404.tsx) — exact match
- * 2. Category catch-alls (4xx.tsx) — matches any 4xx
+ * 2. Category catch-alls (4xx.tsx, 5xx.tsx) — matches any in category
  * 3. error.tsx — catches everything
  *
- * Each segment is checked in this order. The chain is ordered so the
- * FIRST match wins at catch time. This mirrors resolveStatusFile's 4xx
- * component chain (status-code-resolver.ts) — the two walks must stay in
- * sync or in-tree and re-render deny paths resolve different files.
+ * The chain is stored in the 4xx two-pass order (all status files across
+ * segments, then all error.tsx), which mirrors `resolve4xx`. For 5xx,
+ * `matchDenyEntry` reconstructs the per-segment walk from each entry's
+ * `segmentIndex` — matching `resolve5xx`'s single-pass ordering where a
+ * leaf `error.tsx` beats a root `5xx.tsx`. See TIM-1360.
  */
-export declare function buildDenyPageChain(segments: ManifestSegmentNode[], startIndex: number): Promise<DenyPageEntry[]>;
+export declare function buildDenyPageChain(segments: ManifestSegmentNode[], startIndex: number, segmentKeys: string[]): Promise<DenyPageEntry[]>;
 /**
- * Find the first deny page in the chain that matches the given status code.
- * Returns a React element for the matching component, or null if no match.
+ * Find the first deny page in the chain whose status filter matches.
+ * Returns null when nothing in the chain accepts this status.
+ *
+ * For 4xx statuses, the chain's stored order is correct: every status file
+ * across all segments (inner→outer) before any error.tsx — so a root
+ * `404.tsx` beats a leaf `error.tsx`. This matches `resolve4xx`.
+ *
+ * For 5xx statuses, the match walks per-segment (inner→outer): at each
+ * segment, status files (`503.tsx` → `5xx.tsx`) then `error.tsx`, before
+ * moving to the next segment outward. A leaf `error.tsx` therefore beats a
+ * root `5xx.tsx` — the intentional inverse of the 4xx chain, matching
+ * `resolve5xx`. See TIM-1360.
+ */
+export declare function matchDenyEntry(chain: DenyPageEntry[], status: number): DenyPageEntry | null;
+/**
+ * Decide where the deny page for `status` renders, from the perspective of
+ * the catch site at `selfKey`.
+ *
+ * The match itself is unchanged — first entry in fallback order wins, so
+ * every path picks the same file. What this adds is the position: a chain
+ * built at segment i spans i outward to root, so a matched entry is owned
+ * either by the catcher or by one of its ancestors.
+ *
+ * - Owned by the catcher → `render`. The catcher already sits at the
+ *   owning segment's position.
+ * - Owned by an ancestor → `hoist`. Rendering here would wrap the deny page
+ *   in every layout between the owner and the catcher. The caller re-throws
+ *   with `ownerKey` stamped on the signal so the boundary at that segment
+ *   renders it instead — inside the owner's layout, outside the rest.
+ *
+ * Returns null when no entry matches; the caller re-throws unannotated and
+ * the re-render fallback resolves it.
+ *
+ * See design/04-authorization.md §"Where a Deny Page Renders", TIM-1356.
  */
-export declare function renderMatchingDenyPage(chain: DenyPageEntry[], status: number, data: unknown): React.ReactElement | null;
+export declare function placeDenyPage(chain: DenyPageEntry[], status: number, data: unknown, selfKey: string | undefined): DenyPlacement | null;
 /**
  * Build the element for a matched deny chain entry with the props contract
  * the file's convention documents:
@@ -75,7 +169,27 @@ export declare function renderMatchingDenyPage(chain: DenyPageEntry[], status: n
  *   error.message) crashes — turning a clean deny(404) into a 500. TIM-1081.
  * - error.mdx: plain { status } — server component, static content.
  */
-export declare function renderDenyEntry(entry: DenyPageEntry, status: number, data: unknown): React.ReactElement;
+export declare function renderDenyEntry(entry: DenyEntryShape, status: number, data: unknown): React.ReactElement;
+/**
+ * The whole of what an in-tree catch site does with a `DenySignal`, shared
+ * by all three of them (`PageDenyBoundary`, `TracedLayout`, `AccessGate`).
+ *
+ * Returns the deny page element when this catch site owns the matched file.
+ * Otherwise it throws — annotated with `ownerKey` when an ancestor owns the
+ * file, bare when nothing matched at all.
+ *
+ * `setDenyStatus` runs on the hoist path too, and must run *before* the
+ * throw: on the RSC payload path no boundary executes server-side, so the
+ * ALS status is the only thing standing between the response and a 200
+ * (`rsc-payload.ts` reads it after the stream settles).
+ *
+ * Either branch leaves part of the matched chain unmounted — hoisting sends
+ * the render to a boundary that discards everything below it, and a layout
+ * that denies returns the deny page instead of its own child outlet. What the
+ * response then says about the tree is decided from the deny status alone in
+ * `rsc-payload.ts`, not tracked here; see the note there for why.
+ */
+export declare function handleCaughtDeny(chain: DenyPageEntry[] | undefined, error: DenySignal, selfKey: string | undefined): React.ReactElement;
 /**
  * Async server component that wraps a page call with DenySignal catching.
  *
@@ -90,13 +204,19 @@ export declare function renderDenyEntry(entry: DenyPageEntry, status: number, da
  * No error reaches React Flight — the Flight stream is clean, SSR succeeds,
  * and the entire request uses a single renderToReadableStream call.
  */
-export declare function PageDenyBoundary({ Page, route, denyPages, onSettled, }: {
+export declare function PageDenyBoundary({ Page, route, denyPages, segmentKey, onSettled, }: {
     /** The page server component function. */
     Page: (...args: unknown[]) => unknown;
     /** Route path for OTEL tracing. */
     route: string;
     /** Deny page fallback chain from the segment chain. */
     denyPages: DenyPageEntry[];
+    /**
+     * Segment key of the leaf. The page renders inside the leaf's layout, so
+     * a leaf-owned deny page is already at the right position; anything the
+     * chain matched further up is hoisted to its owner.
+     */
+    segmentKey: string;
     /** Called when the page component finishes (success or deny). See TIM-1045. */
     onSettled?: () => void;
 }): Promise<React.ReactElement>;
@@ -111,4 +231,17 @@ export declare function setDenyStatus(status: number): void;
  * Returns undefined if no deny was caught during render.
  */
 export declare function getDenyStatus(): number | undefined;
+/**
+ * Record the first denied segment index in the request context ALS.
+ * Called from AccessGate when a DenySignal is caught during render.
+ * Only the first (shallowest) denial is recorded — deeper denials are
+ * unreachable because the gate short-circuits the subtree.
+ * See TIM-1363.
+ */
+export declare function setFirstDeniedSegmentIndex(index: number): void;
+/**
+ * Read the first denied segment index from the request context ALS.
+ * Returns Infinity if no segment denied during render.
+ */
+export declare function getFirstDeniedSegmentIndex(): number;
 //# sourceMappingURL=deny-boundary.d.ts.map

package/dist/server/deny-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deny-boundary.d.ts","sourceRoot":"","sources":["../../src/server/deny-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,6FAA6F;IAC7F,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAiE1B;AAID;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,aAAa,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,KAAK,CAAC,YAAY,GAAG,IAAI,CAgB3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,KAAK,CAAC,YAAY,CA2BpB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,IAAI,EACJ,KAAK,EACL,SAAS,EACT,SAAS,GACV,EAAE;IACD,0CAA0C;IAC1C,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IACtC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAgB9B;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD"}
+{"version":3,"file":"deny-boundary.d.ts","sourceRoot":"","sources":["../../src/server/deny-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAOH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAM7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C;;;;OAIG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,6FAA6F;IAC7F,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AA2BxC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAuE1B;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAS3F;AAgCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,aAAa,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,aAAa,GAAG,IAAI,CAkBtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,KAAK,CAAC,YAAY,CA2BpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,aAAa,EAAE,GAAG,SAAS,EAClC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,KAAK,CAAC,YAAY,CAYpB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,EACV,SAAS,GACV,EAAE;IACD,0CAA0C;IAC1C,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IACtC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAY9B;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAK9D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}

package/dist/server/deny-renderer.d.ts

@@ -49,12 +49,12 @@ export type DefaultPageRenderer = (status: number, responseHeaders: Headers) =>
  * on format preference. Returns an HTML Response (component), a JSON Response,
  * or the framework default status page.
  */
-export declare function renderDenyPage(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, createDebugChannelSink: DebugChannelFactory, callSsr: CallSsrFn, defaultPage?: DefaultPageRenderer): Promise<Response>;
+export declare function renderDenyPage(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, match: RouteMatch, responseHeaders: Headers, clientBootstrap: ClientBootstrapConfig, createDebugChannelSink: DebugChannelFactory, callSsr: CallSsrFn, defaultPage?: DefaultPageRenderer, firstDeniedIndex?: number): Promise<Response>;
 /**
  * Render a status-code error page as a raw RSC Flight stream for client navigation.
  *
  * Same as renderDenyPage but skips SSR — returns the RSC stream directly
  * so the client can reconcile the error page into the existing DOM.
  */
-export declare function renderDenyPageAsRsc(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, responseHeaders: Headers, createDebugChannelSink: DebugChannelFactory): Promise<Response>;
+export declare function renderDenyPageAsRsc(deny: DenySignal, segments: ManifestSegmentNode[], layoutComponents: LayoutEntry[], req: Request, responseHeaders: Headers, createDebugChannelSink: DebugChannelFactory, firstDeniedIndex?: number): Promise<Response>;
 //# sourceMappingURL=deny-renderer.d.ts.map

package/dist/server/deny-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deny-renderer.d.ts","sourceRoot":"","sources":["../../src/server/deny-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAe7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAOjE,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM;IACtC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CACtB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,KACnB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAiCvB;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC;AAEhG;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,sBAAsB,EAAE,mBAAmB,EAC3C,OAAO,EAAE,SAAS,EAClB,WAAW,CAAC,EAAE,mBAAmB,GAChC,OAAO,CAAC,QAAQ,CAAC,CA0HnB;AAgBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,sBAAsB,EAAE,mBAAmB,GAC1C,OAAO,CAAC,QAAQ,CAAC,CA2CnB"}
+{"version":3,"file":"deny-renderer.d.ts","sourceRoot":"","sources":["../../src/server/deny-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAe7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAKjE,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM;IACtC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CACtB,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,EACrC,UAAU,EAAE,UAAU,KACnB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAgCvB;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC;AAEhG;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,eAAe,EAAE,qBAAqB,EACtC,sBAAsB,EAAE,mBAAmB,EAC3C,OAAO,EAAE,SAAS,EAClB,WAAW,CAAC,EAAE,mBAAmB,EACjC,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAmInB;AAgBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,gBAAgB,EAAE,WAAW,EAAE,EAC/B,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,EACxB,sBAAsB,EAAE,mBAAmB,EAC3C,gBAAgB,SAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA6CnB"}

package/dist/server/error-boundary-wrapper.d.ts

@@ -1,23 +1,93 @@
 /**
- * Error boundary wrapper — wraps a React element in error boundaries from a route segment.
+ * Error boundary wrapper — wraps a React element in the error boundaries
+ * declared by a route segment (`{status}.tsx`, `4xx.tsx`/`5xx.tsx`, `error.tsx`).
  *
- * Extracted to allow reuse by both rsc-entry.ts and route-element-builder.ts.
- * See design/10-error-handling.md.
+ * This is the single implementation of that walk. It is driven by both
+ * construction sites:
+ *
+ *   - `route-element-builder.ts` / `slot-resolver.ts` — the request-time
+ *     renderer, walking the runtime manifest (`SegmentNode<ManifestFile>`).
+ *   - `tree-builder.ts` — the build-time tree walker
+ *     (`SegmentNode<RouteFile>`), with its loader and `createElement` injected.
+ *
+ * `errorBoundaryComponent` is injected rather than imported: `TimberErrorBoundary`
+ * is a `'use client'` module, and importing it here would pull client code into
+ * every consumer — including `tree-builder.ts`, which the server barrel reaches.
+ * `tests/use-client-pipeline.test.ts` walks the import graph to enforce this.
+ *
+ * See design/10-error-handling.md §"Status-Code File Variants".
+ */
+import type { ReactNode } from 'react';
+import type { SegmentNode } from '../routing/types.js';
+import { type LoadedComponent } from './utils/element-type.js';
+/** The minimum a route file must carry for the walk: a path to classify as MDX. */
+interface BoundaryFile {
+    filePath: string;
+}
+/**
+ * Framework-injected error boundary wrapper.
+ * Wraps content with status-code error boundary handling.
+ *
+ * Field types must agree with `TimberErrorBoundaryProps` in
+ * `client/error-boundary.tsx`. The two are kept structurally compatible by
+ * convention rather than by direct type import — this is the server-side
+ * construction site and may not import types from a 'use client' module.
  */
-import type { ManifestSegmentNode } from './route-matcher.js';
+export interface ErrorBoundaryProps {
+    /** The component to render when an error is caught (TSX status files). */
+    fallbackComponent?: LoadedComponent;
+    /** Pre-rendered fallback element (MDX status files — see TIM-503). */
+    fallbackElement?: ReactNode;
+    /** Status code filter: 400 = any 4xx, 500 = any 5xx, specific number = exact match. */
+    status?: number;
+    /**
+     * Segment key of the segment that declared this boundary. An in-tree deny
+     * catch site that matched a file it may not render in place re-throws with
+     * that file's owning key on the signal; boundaries whose key differs
+     * decline, so the deny page lands at its owner rather than at the first
+     * boundary the throw happens to pass. Unset for slot boundaries and for
+     * construction sites with no deny chains — an unkeyed boundary declines
+     * every owner-addressed deny. See TIM-1356.
+     */
+    segmentKey?: string;
+    children: ReactNode;
+}
+/** How to load a route file's module. Only `default` is read. */
+type BoundaryModuleLoader<TFile> = (file: TFile) => {
+    default?: unknown;
+} | Promise<{
+    default?: unknown;
+}>;
+/** Everything the walk needs from its host environment. */
+export interface ErrorBoundaryWrapConfig<TFile, TElement> {
+    /** `React.createElement` or an equivalent element factory. */
+    createElement: (type: unknown, props: object) => TElement;
+    /** Loads a route file's module. Failures skip the boundary — see below. */
+    loadModule: BoundaryModuleLoader<TFile>;
+    /**
+     * The error boundary component to instantiate (`TimberErrorBoundary`, or a
+     * host-specific stand-in). Injected — see the module docstring.
+     */
+    errorBoundaryComponent: unknown;
+    /** When true, skip 4xx error boundaries — deny catching handles them in-tree. See TIM-666. */
+    skipDenyBoundaries?: boolean;
+    /** Segment key stamped on every boundary this walk creates. See `ErrorBoundaryProps`. */
+    segmentKey?: string;
+}
 /**
- * Wrap an element in error boundaries defined by a route segment.
+ * Wrap an element in the error boundaries declared by a route segment.
+ *
+ * Wrapping is applied inside-out — the last wrap produces the outermost
+ * boundary — so the processing order below is innermost to outermost:
+ *
+ * 1. Specific status files (e.g. `404.tsx`, `503.tsx`) — highest priority at runtime
+ * 2. Category catch-alls (`4xx.tsx`, `5xx.tsx`)
+ * 3. `error.tsx` — catches anything not matched by a status file
  *
- * Processing order (innermost to outermost):
- * 1. Specific status files (e.g., 404.tsx, 500.tsx) — highest priority at runtime
- * 2. Category catch-alls (4xx.tsx, 5xx.tsx)
- * 3. error.tsx — catches anything not matched by status files
+ * The order is load-bearing: it decides which boundary catches a given throw.
  *
- * MDX status files are server components and cannot be passed as function
- * props to TimberErrorBoundary (a 'use client' component). Instead, they
- * are pre-rendered as elements and passed as fallbackElement. See TIM-503.
+ * See design/10-error-handling.md §"Format-Aware Fallback Chains".
  */
-export declare function wrapSegmentWithErrorBoundaries(segment: ManifestSegmentNode, element: React.ReactElement, h: (...args: unknown[]) => React.ReactElement, 
-/** When true, skip 4xx error boundaries — deny catching handles them in-tree. See TIM-666. */
-skipDenyBoundaries?: boolean): Promise<React.ReactElement>;
+export declare function wrapSegmentWithErrorBoundaries<TFile extends BoundaryFile, TElement extends ReactNode>(segment: SegmentNode<TFile>, element: TElement, config: ErrorBoundaryWrapConfig<TFile, TElement>): Promise<TElement>;
+export {};
 //# sourceMappingURL=error-boundary-wrapper.d.ts.map

package/dist/server/error-boundary-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-boundary-wrapper.d.ts","sourceRoot":"","sources":["../../src/server/error-boundary-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D;;;;;;;;;;;GAWG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,KAAK,CAAC,YAAY,EAC3B,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,YAAY;AAC7C,8FAA8F;AAC9F,kBAAkB,UAAQ,GACzB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CA6E7B"}
+{"version":3,"file":"error-boundary-wrapper.d.ts","sourceRoot":"","sources":["../../src/server/error-boundary-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGnF,mFAAmF;AACnF,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,eAAe,CAAC;IACpC,sEAAsE;IACtE,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,iEAAiE;AACjE,KAAK,oBAAoB,CAAC,KAAK,IAAI,CACjC,IAAI,EAAE,KAAK,KACR;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE5D,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB,CAAC,KAAK,EAAE,QAAQ;IACtD,8DAA8D;IAC9D,aAAa,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC;IAC1D,2EAA2E;IAC3E,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACxC;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,SAAS,YAAY,EAC1B,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAC3B,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,GAC/C,OAAO,CAAC,QAAQ,CAAC,CA4CnB"}

package/dist/server/index.d.ts

@@ -15,5 +15,4 @@ export { getFormFlash } from './form-flash';
 export type { FormFlashData } from './form-flash';
 export { revalidatePath, revalidateTag } from './actions';
 export { getTraceId, getSpanId, withSpan, addSpanEvent } from './tracing';
-export type { ParamsDefinition, InferParamField, ParamField } from '../segment-params/define.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAMA,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKxF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGxF,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAItB,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAI1E,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAMA,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKxF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGxF,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAItB,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/server/index.js

@@ -1,6 +1,7 @@
-import { D as getSegmentParams, J as withSpan, L as isDebug, P as getCookieJar, R as isDevMode, S as waitUntil, T as getHeaders, U as getSpanId, W as getTraceId, X as formFlashAls, _ as RedirectSignal, b as redirect, g as DenySignal, x as redirectExternal, y as deny, z as addSpanEvent } from "../_chunks/logger-N7e5auP0.js";
+import { n as formFlashAls } from "../_chunks/als-registry-C6kcfprT.js";
+import { D as getSegmentParams, J as withSpan, L as isDebug, P as getCookieJar, R as isDevMode, S as waitUntil, T as getHeaders, U as getSpanId, W as getTraceId, _ as RedirectSignal, b as redirect, g as DenySignal, x as redirectExternal, y as deny, z as addSpanEvent } from "../_chunks/logger-D8xJZXIN.js";
 import { t as formatSize } from "../_chunks/format-CfwjgPz9.js";
-import { a as parseFormData, i as coerce, n as revalidatePath, r as revalidateTag } from "../_chunks/actions-C-Rw9vPc.js";
+import { a as parseFormData, i as coerce, n as revalidatePath, r as revalidateTag } from "../_chunks/actions-35jnMdeJ.js";
 //#region src/shared/redirect-type.ts
 /**
 * Next.js redirect type discriminator.