@timber-js/app 0.2.0-alpha.186 → 0.2.0-alpha.187

package/src/server/rsc-entry/error-renderer.ts

@@ -26,7 +26,8 @@ import { flightInitScript, htmlEscapeJsonString } from '../flight-scripts.js';
 import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.js';
 import type { DefaultPageRenderer, LayoutEntry } from '../deny-renderer.js';
 import type { NavContext } from '../ssr-bridge-types.js';
-import { createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { createDebugChannelSink } from './helpers.js';
+import { isRscRequest } from '../../shared/rsc-media-type.js';
 import { withPublishedParams } from '../publish-params.js';
 import { getCookiesForSsr } from '../cookie-context.js';
 import { callSsr } from './ssr-bridge.js';
@@ -72,9 +73,12 @@ interface ErrorFileResolution {
  */
 async function resolveErrorFile(
   status: number,
-  segments: ManifestSegmentNode[]
+  segments: ManifestSegmentNode[],
+  maxIndex?: number
 ): Promise<ErrorFileResolution | null> {
-  for (let i = segments.length - 1; i >= 0; i--) {
+  const start =
+    maxIndex !== undefined ? Math.min(segments.length - 1, maxIndex) : segments.length - 1;
+  for (let i = start; i >= 0; i--) {
     const segment = segments[i];
 
     if (segment.statusFiles) {
@@ -131,9 +135,14 @@ async function resolveErrorFile(
 function getLayoutsForErrorFile(
   segments: ManifestSegmentNode[],
   layoutComponents: LayoutEntry[],
-  foundSegmentIndex: number
+  foundSegmentIndex: number,
+  firstDeniedIndex = Infinity
 ): LayoutEntry[] {
-  const resolvedSegments = new Set(segments.slice(0, foundSegmentIndex + 1));
+  // Clamp so a denied segment's layout never wraps the error page.
+  // The file resolution is unbounded (errors may use leaf files), but the
+  // layout wrapping must still respect the denial boundary. TIM-1358.
+  const ceiling = Math.min(foundSegmentIndex, firstDeniedIndex - 1);
+  const resolvedSegments = new Set(segments.slice(0, ceiling + 1));
   return layoutComponents.filter((lc) => resolvedSegments.has(lc.segment));
 }
 
@@ -182,12 +191,13 @@ export async function renderErrorPage(
   match: RouteMatch,
   responseHeaders: Headers,
   clientBootstrap: ClientBootstrapConfig,
-  globalError?: GlobalErrorFile
+  globalError?: GlobalErrorFile,
+  firstDeniedIndex = Infinity
 ): Promise<Response> {
   // The error itself is not logged here — every producer of a `renderError`
   // signal already logged it at the point it was caught (`rsc-stream.ts`'s
   // `onError`, `outcomeToResponse`), so a log on this exit would double up.
-  if (isRscPayloadRequest(req)) {
+  if (isRscRequest(req)) {
     return rscErrorEnvelope(status, responseHeaders);
   }
 
@@ -195,8 +205,13 @@ export async function renderErrorPage(
   // shows original source positions instead of transpiled/bundled ones.
   // See TIM-811.
   sourceMapError(error);
-  // Walk segments from leaf to root to find the error component
-  const resolution = await resolveErrorFile(status, segments);
+  // Walk segments from leaf to root to find the error component.
+  // When firstDeniedIndex is finite, bound the walk so error files below
+  // the denied segment are not selected — matching the deny renderer's
+  // behavior. For plain errors (firstDeniedIndex = Infinity), the full
+  // chain is searched. See TIM-1358.
+  const errorMaxIndex = firstDeniedIndex < Infinity ? firstDeniedIndex : undefined;
+  const resolution = await resolveErrorFile(status, segments, errorMaxIndex);
 
   // Tier 2: No segment-level error file — try global-error.tsx
   if (!resolution && globalError) {
@@ -221,7 +236,12 @@ export async function renderErrorPage(
   }
 
   const { component: errorComponent, segmentIndex, isMdx } = resolution;
-  const layoutsToWrap = getLayoutsForErrorFile(segments, layoutComponents, segmentIndex);
+  const layoutsToWrap = getLayoutsForErrorFile(
+    segments,
+    layoutComponents,
+    segmentIndex,
+    firstDeniedIndex
+  );
 
   return renderErrorPageViaRsc(
     error,
@@ -407,7 +427,7 @@ export async function renderNoMatchPage(
   const deny = new DenySignal(404);
   const match: RouteMatch = { segments, segmentParams: {}, middlewareChain: [] };
 
-  if (isRscPayloadRequest(req)) {
+  if (isRscRequest(req)) {
     return renderDenyPageAsRsc(
       deny,
       segments,

package/src/server/rsc-entry/helpers.ts

@@ -12,9 +12,6 @@ import type { SlotSkipEntry } from '../slot-resolver.js';
 import { isClientReference } from '../route-element-builder.js';
 import { isStaticRequestDependent } from '../request-dep.js';
 
-/** RSC content type for client navigation payload requests. */
-export const RSC_CONTENT_TYPE = 'text/x-component';
-
 /**
  * Create a debug channel sink that discards all debug data.
  *
@@ -205,6 +202,8 @@ export function buildSegmentInfo(
   const skippedSet = skippedSegmentKeys ? new Set(skippedSegmentKeys) : null;
   const result: SegmentInfo[] = [];
 
+  // Deepest segment that actually mounted, exclusive.
+  //
   for (let i = 0; i < segments.length; i++) {
     // A denied segment's AccessGate renders the deny page in place of the
     // layout, so this segment and everything below it never mounted. Their
@@ -259,15 +258,6 @@ export function buildSegmentInfo(
   return result;
 }
 
-/**
- * Check if a request is asking for an RSC payload (client navigation)
- * rather than full HTML. Client-side navigation sends Accept: text/x-component.
- */
-export function isRscPayloadRequest(req: Request): boolean {
-  const accept = req.headers.get('Accept') ?? '';
-  return accept.includes(RSC_CONTENT_TYPE);
-}
-
 // Re-export consolidated helpers from their single source of truth.
 // Callers within rsc-entry/ import from this file; the implementations
 // live in pipeline-helpers.ts (buildRedirectResponse) and render-utils.ts

package/src/server/rsc-entry/index.ts

@@ -25,11 +25,6 @@
 
 // @ts-expect-error — virtual module provided by timber-routing plugin
 import routeManifest from 'virtual:timber-route-manifest';
-// TIM-830: Populate the search-params registry eagerly so <Link> can
-// serialize flat `Partial<T>` values synchronously in RSC renders.
-// The module has side effects only — no exports consumed here.
-// @ts-expect-error — virtual module provided by timber-routing plugin
-import 'virtual:timber-search-params-registry';
 // @ts-expect-error — virtual module provided by timber-entries plugin
 import config from 'virtual:timber-config';
 // @ts-expect-error — virtual module provided by timber-build-manifest plugin

package/src/server/rsc-entry/render-route.ts

@@ -41,9 +41,11 @@ import { recordTiming } from '../server-timing.js';
 import { requestContextAls } from '../als-registry.js';
 import { parseClientStateTree } from '../state-tree-diff.js';
 
+import { getFirstDeniedSegmentIndex } from '../deny-boundary.js';
 import { handleApiRoute } from './api-handler.js';
 import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
-import { buildRedirectResponse, createDebugChannelSink, isRscPayloadRequest } from './helpers.js';
+import { buildRedirectResponse, createDebugChannelSink } from './helpers.js';
+import { isRscRequest } from '../../shared/rsc-media-type.js';
 import { buildRscPayloadResponse } from './rsc-payload.js';
 import { renderRscStream } from './rsc-stream.js';
 import { renderSsrResponse } from './ssr-renderer.js';
@@ -97,7 +99,7 @@ export async function renderRoute(
   // Only used for RSC requests — HTML requests always get a full render.
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
   const clientStateTree =
-    deps.clientSegmentCache && isRscPayloadRequest(req) ? parseClientStateTree(req) : null;
+    deps.clientSegmentCache && isRscRequest(req) ? parseClientStateTree(req) : null;
 
   // Build the React element tree — runs access checks eagerly to gate
   // metadata resolution (TIM-1027), then loads modules and resolves
@@ -146,7 +148,6 @@ export async function renderRoute(
     skippedSegments,
     shellSettled,
     slotSkipInfo,
-    firstDeniedIndex,
   } = routeResult;
 
   // Build head HTML for injection into the SSR output.
@@ -225,14 +226,15 @@ export async function renderRoute(
   // Synchronous deny — deny() in a non-async component throws during
   // renderToReadableStream creation, caught in the try/catch above.
   if (signals.denySignal) {
-    if (isRscPayloadRequest(req)) {
+    if (isRscRequest(req)) {
       return renderDenyPageAsRsc(
         signals.denySignal,
         segments,
         layoutComponents as LayoutEntry[],
         req,
         responseHeaders,
-        createDebugChannelSink
+        createDebugChannelSink,
+        getFirstDeniedSegmentIndex()
       );
     }
     return renderDenyPage(
@@ -244,7 +246,9 @@ export async function renderRoute(
       responseHeaders,
       clientBootstrap,
       createDebugChannelSink,
-      callSsr
+      callSsr,
+      undefined,
+      getFirstDeniedSegmentIndex()
     );
   }
 
@@ -264,14 +268,15 @@ export async function renderRoute(
       match,
       responseHeaders,
       clientBootstrap,
-      globalError
+      globalError,
+      getFirstDeniedSegmentIndex()
     );
   }
 
   // For RSC payload requests (client navigation), return the RSC Flight
   // stream directly — skip SSR HTML rendering entirely.
   // See design/19-client-navigation.md §"RSC Payload Handling"
-  if (isRscPayloadRequest(req)) {
+  if (isRscRequest(req)) {
     return buildRscPayloadResponse(
       req,
       rscStream!,
@@ -280,8 +285,7 @@ export async function renderRoute(
       layoutComponents,
       responseHeaders,
       skippedSegments,
-      slotSkipInfo,
-      firstDeniedIndex
+      slotSkipInfo
     );
   }
 
@@ -300,6 +304,5 @@ export async function renderRoute(
     deferSuspenseFor,
     globalError,
     slotSkipInfo,
-    firstDeniedIndex,
   });
 }

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -40,6 +40,7 @@ import { buildRouteElement } from '../route-element-builder.js';
 import type { RevalidateRenderer, RevalidationResult } from '../actions.js';
 
 import { runMiddlewareForAction, type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.js';
 
 /**
  * Sentinel thrown when revalidation cannot proceed because middleware
@@ -214,7 +215,7 @@ export function createRevalidateRendererFactory(
       revalidateUrl.pathname = validation.pathname;
       revalidateUrl.search = validation.search;
       const revalidateHeaders = new Headers(req.headers);
-      revalidateHeaders.set('Accept', 'text/x-component');
+      revalidateHeaders.set('Accept', RSC_CONTENT_TYPE);
       // Snapshot the action's post-mutation cookie map (deletions
       // included) and serialize it into a `Cookie:` header value the
       // target middleware can read off `ctx.req.headers.get('cookie')`.

package/src/server/rsc-entry/rsc-payload.ts

@@ -15,17 +15,22 @@ import type { LayoutComponentEntry } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import type { SlotSkipEntry } from '../slot-resolver.js';
 
-import {
-  buildRedirectResponse,
-  buildSegmentInfo,
-  createDebugChannelSink,
-  RSC_CONTENT_TYPE,
-} from './helpers.js';
+import { buildRedirectResponse, buildSegmentInfo, createDebugChannelSink } from './helpers.js';
+import { RSC_CONTENT_TYPE } from '../../shared/rsc-media-type.js';
 
 import { rscErrorEnvelope } from '../../shared/rsc-error-envelope.js';
 
 import type { RenderSignals } from './rsc-stream.js';
 
+/**
+ * Ceiling on waiting for a first chunk that is already in flight, used only
+ * when an addressed deny won the race against it. Matches the 50ms ceiling
+ * documented for the race itself: long enough that the error row — which is
+ * what the render just produced — arrives, short enough that a stalled stream
+ * cannot hold the response open.
+ */
+const FIRST_CHUNK_CEILING_MS = 50;
+
 /**
  * Build an RSC payload Response for a client-side navigation request.
  *
@@ -43,9 +48,7 @@ export async function buildRscPayloadResponse(
   layoutComponents: LayoutComponentEntry[],
   responseHeaders: Headers,
   skippedSegments?: string[],
-  slotSkipInfo?: SlotSkipEntry[],
-  /** Index of the first denied segment — see RouteElementResult.firstDeniedIndex. */
-  firstDeniedIndex = Infinity
+  slotSkipInfo?: SlotSkipEntry[]
 ): Promise<Response> {
   // Read the first chunk from the RSC stream before committing headers.
   // Race the first read against signal detection — if an async component
@@ -72,10 +75,18 @@ export async function buildRscPayloadResponse(
     | { type: 'data'; chunk: ReadableStreamReadResult<Uint8Array> }
     | { type: 'signal' };
 
+  // Retained rather than inlined into the race below. When a signal wins, the
+  // usual answer is to cancel — but an ADDRESSED deny is one whose error row
+  // the client's boundary is going to render, so that payload has to survive
+  // (TIM-1356). Taking delivery of the read already in flight is not the
+  // "bare read() after a signal won" the async rules forbid; issuing a second
+  // one would be. It still gets a ceiling below.
+  const pendingRead = reader.read();
+
   let first: RaceResult;
   try {
     first = await Promise.race([
-      reader.read().then((chunk) => ({ type: 'data' as const, chunk })),
+      pendingRead.then((chunk) => ({ type: 'data' as const, chunk })),
       signalDetected.then(() => ({ type: 'signal' as const })),
     ]);
   } catch (_readError) {
@@ -121,15 +132,42 @@ export async function buildRscPayloadResponse(
     reader.cancel().catch(() => {});
     return buildRedirectResponse(trackedRedirect, req, responseHeaders);
   }
-  if (signals.denySignal) {
+  // An addressed deny needs no fallback: the payload already carries its error
+  // row, aimed at the boundary the client has mounted at that segment, which
+  // renders it. Cancelling would throw a finished render away and re-run the
+  // whole route — the exact cost TIM-666 removed. The status still lands,
+  // because the catch site called setDenyStatus() before re-throwing (read
+  // below via getDenyStatus).
+  //
+  // The question is asked of `unplacedDeny`, not of `denySignal.ownerKey`,
+  // because one render can produce both kinds and `denySignal` holds only one
+  // of them. A deny nothing could place has no boundary that may claim it, so
+  // its row would otherwise stream to a client with nothing to render it —
+  // and it needs the fallback whether or not some other deny was addressed
+  // first. See TIM-1356.
+  if (signals.unplacedDeny) {
     reader.cancel().catch(() => {});
+
+    // A skipped segment whose access just flipped to deny marks the signal
+    // for hard-navigate: rendering a deny page here would execute the denied
+    // segment's protected layout and place it inside cached client chrome
+    // (TIM-1074). Return rscErrorEnvelope so the client hard-navigates for
+    // a clean full render with correct deny page placement. See TIM-1363.
+    if (signals.unplacedDeny._hardNavigate) {
+      return rscErrorEnvelope(signals.unplacedDeny.status, responseHeaders);
+    }
+
+    // Read the denied segment index from ALS — set by AccessGate during
+    // render. See TIM-1358, TIM-1365.
+    const { getFirstDeniedSegmentIndex: getDeniedIdx } = await import('../deny-boundary.js');
     return renderDenyPageAsRsc(
-      signals.denySignal,
+      signals.unplacedDeny,
       segments,
       layoutComponents as LayoutEntry[],
       req,
       responseHeaders,
-      createDebugChannelSink
+      createDebugChannelSink,
+      getDeniedIdx()
     );
   }
 
@@ -151,6 +189,41 @@ export async function buildRscPayloadResponse(
   let firstRead: ReadableStreamReadResult<Uint8Array>;
   if (first.type === 'data') {
     firstRead = first.chunk;
+  } else if (signals.denySignal?.ownerKey) {
+    // An addressed deny won the race before its own error row surfaced.
+    // Cancelling here would hand the client a 4xx payload with nothing in it
+    // — no row for the owning boundary to render, so the navigation shows
+    // nothing at all. Take delivery of the read already in flight instead,
+    // under a ceiling so a stalled stream still cannot hang the response.
+    const TIMED_OUT = Symbol('first-chunk-timeout');
+    const raced = await Promise.race([
+      pendingRead,
+      new Promise<typeof TIMED_OUT>((resolve) =>
+        setTimeout(() => resolve(TIMED_OUT), FIRST_CHUNK_CEILING_MS)
+      ),
+    ]);
+
+    // Missing the ceiling must not be reported as a finished stream. Under
+    // event-loop contention or slow serialization the row is late rather than
+    // absent, and fabricating `done: true` here would produce the very empty
+    // 4xx this branch exists to prevent.
+    //
+    // Nor can it fall to `renderDenyPageAsRsc`. That renderer re-resolves from
+    // the FULL leaf chain and wraps whatever it finds, ignoring `ownerKey` —
+    // so an `/admin` denial addressed to a root `4xx.tsx` would come back as
+    // `/admin/secret/403.tsx` with the denied layouts executed, which is the
+    // TIM-1074 leak TIM-1358 still owns. A deny this path already placed
+    // correctly must not be handed to it.
+    //
+    // So: hard-navigate. The document request renders the same deny through
+    // the boundary at its owner, with the placement intact. A full page load
+    // is a real cost, on a path that needs a status page and a stalled stream
+    // to reach at all.
+    if (raced === TIMED_OUT) {
+      reader.cancel().catch(() => {});
+      return rscErrorEnvelope(signals.denySignal.status, responseHeaders);
+    }
+    firstRead = raced;
   } else {
     await reader.cancel();
     firstRead = { done: true, value: undefined };
@@ -189,12 +262,29 @@ export async function buildRscPayloadResponse(
   // for state tree diffing on subsequent navigations. Request-dependency
   // is determined by static module-graph analysis (not runtime taint).
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
+  // Read the deny state before describing the tree — what mounted depends on it.
+  // Both values are recorded in ALS during render by AccessGate's catch path.
+  const { getDenyStatus, getFirstDeniedSegmentIndex } = await import('../deny-boundary.js');
+  const denyStatus = getDenyStatus();
+  const resolvedDenyIndex = getFirstDeniedSegmentIndex();
+
+  // Emitted in full even when a deny rendered, because this header answers two
+  // questions and they diverge here. The client picks its merge point out of
+  // this list (`buildSegmentUpdates`), and a partial payload with no merge
+  // point is never inserted at all — the URL commits over the stale previous
+  // UI. So it has to keep describing the chain the payload was BUILT against.
+  //
+  // What it must not also do on a deny is seed the segment cache, since the
+  // deny page replaced a subtree and part of that chain never mounted. That
+  // half is handled at the commit site from the response status, where the
+  // merge point has already been chosen. See `client/router-pipeline.ts` and
+  // TIM-1356.
   const segmentInfo = buildSegmentInfo(
     segments,
     layoutComponents,
     slotSkipInfo,
     skippedSegments,
-    firstDeniedIndex
+    resolvedDenyIndex
   );
   responseHeaders.set('X-Timber-Segments', JSON.stringify(segmentInfo));
 
@@ -204,12 +294,6 @@ export async function buildRscPayloadResponse(
     responseHeaders.set('X-Timber-Skipped-Segments', JSON.stringify(skippedSegments));
   }
 
-  // Check if a DenySignal was caught in-tree by AccessGate or
-  // PageDenyBoundary. The deny page is in the Flight stream as a normal
-  // element — use the deny status for the HTTP response. See TIM-666.
-  const { getDenyStatus } = await import('../deny-boundary.js');
-  const denyStatus = getDenyStatus();
-
   return new Response(patchedStream, {
     status: denyStatus ?? 200,
     headers: responseHeaders,

package/src/server/rsc-entry/rsc-stream.ts

@@ -40,6 +40,18 @@ import { isDevMode } from '../debug.js';
  */
 export interface RenderSignals {
   denySignal: DenySignal | null;
+  /**
+   * The first deny that no in-tree catch site could place — no `ownerKey`, so
+   * no boundary may claim its error row and only the re-render fallback can
+   * produce a page for it.
+   *
+   * Tracked apart from `denySignal` because one render can produce both. A
+   * deep page can hoist a 404 to a boundary that will render it while an
+   * outer layout separately throws a 403 nothing matches; whichever lands in
+   * `denySignal` first, the unplaced one still needs the fallback, and
+   * deciding from `denySignal.ownerKey` alone would strand it. See TIM-1356.
+   */
+  unplacedDeny: DenySignal | null;
   redirectSignal: RedirectSignal | null;
   renderError: { error: unknown; status: number } | null;
   /**
@@ -88,6 +100,7 @@ export interface RscStreamResult {
 export function renderRscStream(payload: RscPayloadRoot, req: Request): RscStreamResult {
   const signals: RenderSignals = {
     denySignal: null,
+    unplacedDeny: null,
     redirectSignal: null,
     renderError: null,
     lastUnhandledError: null,
@@ -110,9 +123,18 @@ export function renderRscStream(payload: RscPayloadRoot, req: Request): RscStrea
           if (isAbortError(error) || req.signal?.aborted) return;
           if (error instanceof DenySignal) {
             signals.denySignal = error;
+            if (!error.ownerKey) signals.unplacedDeny ??= error;
             signals.onSignal?.();
-            // Return structured digest for client-side error boundaries
-            return JSON.stringify({ type: 'deny', status: error.status, data: error.data });
+            // Return structured digest for client-side error boundaries.
+            // `ownerKey` is set when an in-tree catch site hoisted the deny
+            // to the segment owning the matched file — it addresses the
+            // boundary that may render it. See TIM-1356.
+            return JSON.stringify({
+              type: 'deny',
+              status: error.status,
+              data: error.data,
+              ownerKey: error.ownerKey,
+            });
           }
           if (error instanceof RedirectSignal) {
             signals.redirectSignal = error;
@@ -218,6 +240,7 @@ export function renderRscStream(payload: RscPayloadRoot, req: Request): RscStrea
   } catch (error) {
     if (error instanceof DenySignal) {
       signals.denySignal = error;
+      if (!error.ownerKey) signals.unplacedDeny ??= error;
     } else if (error instanceof RedirectSignal) {
       signals.redirectSignal = error;
     } else {

package/src/server/rsc-entry/ssr-renderer.ts

@@ -33,7 +33,7 @@ import {
   isAbortError,
 } from './helpers.js';
 import { getCookiesForSsr } from '../cookie-context.js';
-import { getDenyStatus } from '../deny-boundary.js';
+import { getDenyStatus, getFirstDeniedSegmentIndex } from '../deny-boundary.js';
 import { renderErrorPage, type GlobalErrorFile } from './error-renderer.js';
 import { callSsr } from './ssr-bridge.js';
 import type { RenderSignals } from './rsc-stream.js';
@@ -104,8 +104,6 @@ interface SsrRenderOptions {
   /** Tier 2 global-error.tsx file, if present in app/. */
   globalError?: GlobalErrorFile;
   slotSkipInfo?: SlotSkipEntry[];
-  /** Index of the first denied segment — see RouteElementResult.firstDeniedIndex. */
-  firstDeniedIndex?: number;
 }
 
 /**
@@ -168,13 +166,11 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   const errorAbort = new AbortController();
   signals.onUnhandledError = () => errorAbort.abort();
 
-  // Embed segment metadata in HTML for initial hydration.
-  // The client reads this to populate its segment cache before the
-  // first navigation, enabling state tree diffing from the start.
-  // Skipped when client JS is disabled — no client JS to consume it.
-  const segmentScript = clientJsDisabled
-    ? ''
-    : `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents, opts.slotSkipInfo, undefined, opts.firstDeniedIndex)))}</script>`;
+  // Segment metadata for initial hydration: deferred to shell-flush time.
+  // The SSR entry invokes this thunk AFTER renderSsrNodeStream /
+  // renderSsrStream returns (shell ready ⇒ AccessGates settled), so
+  // getFirstDeniedSegmentIndex() returns the authoritative ALS value
+  // rather than the pre-render Infinity. See TIM-1365, TIM-1359.
 
   // Params reach the browser inside the payload — a field on the root row of
   // the same Flight stream that is inlined for hydration. SSR itself renders
@@ -193,10 +189,13 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     headHtml:
       headHtml +
       clientBootstrap.preloadLinks +
-      segmentScript +
       // Initialize __timber_f in <head> so it exists before any streaming
       // chunk scripts arrive in <body>. See flight-scripts.ts, LOCAL-415.
       (clientJsDisabled ? '' : flightInitScript()),
+    getHeadSegmentScript: clientJsDisabled
+      ? undefined
+      : () =>
+          `<script>self.__timber_segments=${htmlEscapeJsonString(JSON.stringify(buildSegmentInfo(segments, layoutComponents, opts.slotSkipInfo, undefined, getFirstDeniedSegmentIndex())))}</script>`,
     bootstrapScriptContent: clientBootstrap.bootstrapScriptContent,
     // Skip RSC inline stream when client JS is disabled — no client to hydrate.
     rscStream: clientJsDisabled ? undefined : inlineStream,
@@ -215,6 +214,12 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
   // The boundary renders the deny page as its fallback AND sets the correct
   // HTTP status code on navContext — no redundant renderDenyPage() needed.
   // See TIM-664, LOCAL-298.
+  // Read the denied segment index from ALS — set by AccessGate during render
+  // (setFirstDeniedSegmentIndex). See TIM-1358, TIM-1365.
+  function resolvedDeniedIndex(): number {
+    return getFirstDeniedSegmentIndex();
+  }
+
   function checkCapturedSignals(skipHandledDeny = false): Response | Promise<Response> | null {
     if (signals.redirectSignal) {
       return buildRedirectResponse(signals.redirectSignal, req, responseHeaders);
@@ -233,7 +238,9 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         responseHeaders,
         clientBootstrap,
         createDebugChannelSink,
-        callSsr
+        callSsr,
+        undefined,
+        resolvedDeniedIndex()
       );
     }
     if (signals.renderError) {
@@ -246,7 +253,8 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         match,
         responseHeaders,
         clientBootstrap,
-        globalError
+        globalError,
+        resolvedDeniedIndex()
       );
     }
     return null;
@@ -421,7 +429,9 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
           responseHeaders,
           clientBootstrap,
           createDebugChannelSink,
-          callSsr
+          callSsr,
+          undefined,
+          resolvedDeniedIndex()
         );
       }
       if (signals.renderError) {
@@ -436,7 +446,8 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
           match,
           responseHeaders,
           clientBootstrap,
-          globalError
+          globalError,
+          resolvedDeniedIndex()
         );
       }
       // No captured signal — unhandled error in the RSC stream.
@@ -454,7 +465,8 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
         match,
         responseHeaders,
         clientBootstrap,
-        globalError
+        globalError,
+        resolvedDeniedIndex()
       );
     }
 

package/src/server/slot-resolver.ts

@@ -198,7 +198,11 @@ export async function resolveSlotElement(
       element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts, scope);
 
       // Wrap with slot root's error boundaries (outermost)
-      element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
+      element = await wrapSegmentWithErrorBoundaries(slotNode, element, {
+        loadModule,
+        createElement: h,
+        errorBoundaryComponent: TimberErrorBoundary,
+      });
 
       // Catch-all error boundary: ensures slot errors NEVER propagate to the
       // parent layout. Without this, a slot without error.tsx that throws
@@ -278,7 +282,11 @@ async function wrapWithIntermediateSegments(
 ): Promise<React.ReactElement> {
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
-    element = await wrapSegmentWithErrorBoundaries(seg, element, h);
+    element = await wrapSegmentWithErrorBoundaries(seg, element, {
+      loadModule,
+      createElement: h,
+      errorBoundaryComponent: TimberErrorBoundary,
+    });
     element = await wrapWithLayout(seg, element, h, scope);
     element = await wrapWithAccessGate(seg, element, h, accessVerdicts, scope);
   }

package/src/server/ssr-bridge-types.ts

@@ -70,6 +70,18 @@ export interface NavContext {
   /** Request cookies as name→value pairs. Used by useCookie() during SSR
    *  to return correct cookie values before hydration. */
   cookies?: Map<string, string>;
+  /**
+   * Lazy thunk that produces the `<script>self.__timber_segments=…</script>`
+   * tag. Invoked by the SSR entry AFTER `renderSsrNodeStream` /
+   * `renderSsrStream` returns (shell ready ⇒ AccessGates settled), so the
+   * `getFirstDeniedSegmentIndex()` ALS value is authoritative. The result
+   * is appended to headHtml before the head injector runs.
+   *
+   * Undefined when client JS is disabled (no client to consume it).
+   * See TIM-1365, TIM-1359.
+   */
+  getHeadSegmentScript?: () => string;
+
   /**
    * Mutable flag: set by TimberErrorBoundary during SSR when it catches
    * a DenySignal (via digest). This tells the RSC entry that the denial