@timber-js/app 0.2.0-alpha.192 → 0.2.0-alpha.195

package/src/routing/scanner.ts

@@ -17,15 +17,15 @@ import type {
   RouteFile,
   ScannerConfig,
   InterceptionMarker,
-} from './types.js';
-import { classifySegment, effectiveUrlSegment } from './segment-classify.js';
-import { validateInterceptionPlacement, computeInterceptedBase } from './interception.js';
-import { validateRouteGroupCollisions } from './collision-spaces.js';
-import { validateSlotPlacement } from './slot-placement.js';
-import { DEFAULT_PAGE_EXTENSIONS } from './types.js';
-import { classifyMetadataRoute, isDynamicMetadataExtension } from '../server/metadata-routes.js';
-import { swallow } from '../server/logger.js';
-import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.js';
+} from './types.ts';
+import { classifySegment, effectiveUrlSegment } from './segment-classify.ts';
+import { validateInterceptionPlacement, computeInterceptedBase } from './interception.ts';
+import { validateRouteGroupCollisions } from './collision-spaces.ts';
+import { validateSlotPlacement } from './slot-placement.ts';
+import { DEFAULT_PAGE_EXTENSIONS } from './types.ts';
+import { classifyMetadataRoute, isDynamicMetadataExtension } from '../server/metadata-routes.ts';
+import { swallow } from '../server/logger.ts';
+import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.ts';
 
 /**
  * File convention names that use pageExtensions (can be .tsx, .ts, .jsx, .js, .mdx, etc.)
@@ -44,6 +44,30 @@ const FIXED_CONVENTIONS = new Set(['middleware', 'access', 'route']);
  */
 const STATUS_CODE_PATTERN = /^(\d{3}|[45]xx)$/;
 
+/**
+ * Whether a basename + extension pair is a route-convention file the
+ * framework itself imports: page/layout/error/default/denied and
+ * global-error on pageExtensions, middleware/access/route/proxy on
+ * .ts/.tsx/.js/.jsx only, and status-code files (404, 4xx, …) on
+ * pageExtensions or .json — mirroring this scanner's own recognition
+ * rules per family.
+ *
+ * Exported for the analyze classifier so its provisional classification
+ * (design/47 §2) derives from the scanner's real conventions instead of
+ * a duplicate list that can drift.
+ */
+export function isRouteConventionFile(
+  base: string,
+  ext: string,
+  pageExtensions: readonly string[] = DEFAULT_PAGE_EXTENSIONS
+): boolean {
+  const isPageExt = pageExtensions.includes(ext);
+  if ((PAGE_EXT_CONVENTIONS.has(base) || base === 'global-error') && isPageExt) return true;
+  if ((FIXED_CONVENTIONS.has(base) || base === 'proxy') && /^[jt]sx?$/.test(ext)) return true;
+  if (STATUS_CODE_PATTERN.test(base) && (isPageExt || ext === 'json')) return true;
+  return false;
+}
+
 /**
  * Scan the app/ directory and build the route tree.
  *

package/src/routing/schema-validation.ts

@@ -7,10 +7,10 @@
  * Design doc: design/41-global-params.md
  */
 
-import { readFileCached } from './file-cache.js';
-import type { RouteTree, SegmentNode } from './types.js';
-import { findSchemaFile, parseExistingSchemaKeys } from '../cli-schema-sync.js';
-import { classifyUrlSegment } from './segment-classify.js';
+import { readFileCached } from './file-cache.ts';
+import type { RouteTree, SegmentNode } from './types.ts';
+import { findSchemaFile, parseExistingSchemaKeys } from '../cli-schema-sync.ts';
+import { classifyUrlSegment } from './segment-classify.ts';
 
 export interface SchemaWarning {
   type: 'stale-key' | 'missing-key' | 'bracket-mismatch';

package/src/routing/segment-classify.ts

@@ -22,8 +22,8 @@
  * See design/07-routing.md §"Route Segments"
  */
 
-import type { InterceptionMarker, SegmentType } from './types.js';
-import { INTERCEPTION_MARKERS } from './types.js';
+import type { InterceptionMarker, SegmentType } from './types.ts';
+import { INTERCEPTION_MARKERS } from './types.ts';
 
 export type UrlSegment =
   | { kind: 'static'; value: string }

package/src/routing/segment-codegen.ts

@@ -10,7 +10,7 @@
 
 import { writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import type { RouteTree, SegmentNode } from './types.js';
+import type { RouteTree, SegmentNode } from './types.ts';
 
 /** Info carried per directory for type generation. */
 export interface SegmentInfo {

package/src/routing/segment-keys.ts

@@ -23,7 +23,7 @@
  * URL path and the segment classification, never on file payloads.
  */
 
-import type { CoercedParams } from '../shared/param-value.js';
+import type { CoercedParams } from '../shared/param-value.ts';
 
 export interface SegmentKeyInput {
   urlPath: string;

package/src/routing/slot-placement.ts

@@ -9,7 +9,7 @@
  * See design/07-routing.md §"Parallel Routes".
  */
 
-import type { SegmentNode } from './types.js';
+import type { SegmentNode } from './types.ts';
 
 /**
  * Reject every parallel slot that no renderer reaches.

package/src/routing/walkers.ts

@@ -14,7 +14,7 @@
  * local; the other two now share `collectLeafRoutes` from this file.
  */
 
-import type { SegmentNode } from './types.js';
+import type { SegmentNode } from './types.ts';
 
 /** A leaf route discovered while walking the segment tree. */
 export interface LeafRoute<TFile> {

package/src/rsc-runtime/transforms.ts

@@ -0,0 +1,13 @@
+/**
+ * Transforms Adapter — Re-exports from @vitejs/plugin-rsc/transforms.
+ *
+ * This module insulates the rest of the framework from direct imports of
+ * @vitejs/plugin-rsc. The plugin is pre-1.0 and its API surface will change.
+ * By routing all transform-helper imports through this single file, a
+ * breaking upstream change only requires updating one place.
+ *
+ * Keep this as thin pass-through re-exports — the value is the single choke
+ * point, not abstraction.
+ */
+
+export { hasDirective } from '@vitejs/plugin-rsc/transforms';

package/src/rsc-runtime/vendor-types.d.ts

@@ -5,3 +5,15 @@ declare module '@vitejs/plugin-rsc/vendor/react-server-dom/client.node' {
     options?: Record<string, unknown>
   ): React.ReactNode;
 }
+
+declare module '@vitejs/plugin-rsc/vendor/react-server-dom/server.edge' {
+  export function renderToReadableStream(
+    model: unknown,
+    manifest: unknown,
+    options?: {
+      signal?: AbortSignal;
+      onError?: (error: unknown) => string | void;
+      onPostpone?: (reason: string) => void;
+    }
+  ): ReadableStream<Uint8Array>;
+}

package/src/schema-bridge.ts

@@ -24,7 +24,7 @@
  * Design doc: design/23a-search-params-triage.md §"Unify Codec<T> type"
  */
 
-import type { Codec } from './codec.js';
+import type { Codec } from './codec.ts';
 
 // ---------------------------------------------------------------------------
 // Standard Schema interface (subset)

package/src/search-params/define.ts

@@ -10,18 +10,18 @@
  * Design doc: design/23-search-params.md §"defineSearchParams — The Factory"
  */
 
-import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.js';
-import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.js';
-import type { StandardSchemaV1 } from '../schema-bridge.js';
-import type { Codec } from '../codec.js';
+import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.ts';
+import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.ts';
+import type { StandardSchemaV1 } from '../schema-bridge.ts';
+import type { Codec } from '../codec.ts';
 // Server-only reference for .get() — avoids pulling server ALS into client
 // bundles. In client environments, .get() throws before reaching this code
 // path. The slot lives in its own leaf module so that `request-context.ts`
 // can register the getter without importing this file, which would drag
 // `nuqs` into every server entry (TIM-1298). See shared/als-slots.ts.
-import { getSearchParamsFromAls } from '../shared/als-slots.js';
-import { parseTotal } from './parse-total.js';
-import { serializedEqual } from './serialize-equal.js';
+import { getSearchParamsFromAls } from '../shared/als-slots.ts';
+import { parseTotal } from './parse-total.ts';
+import { serializedEqual } from './serialize-equal.ts';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -186,7 +186,7 @@ export interface SearchParamsDefinition<T extends Record<string, unknown>> {
 
 // StandardSchemaV1 is imported from schema-bridge.ts — single source of truth.
 // Re-export for consumers that import it from this module.
-export type { StandardSchemaV1 } from '../schema-bridge.js';
+export type { StandardSchemaV1 } from '../schema-bridge.ts';
 
 // ---------------------------------------------------------------------------
 // Type-level helpers

package/src/search-params/index.ts

@@ -16,13 +16,13 @@ export type {
   SetParamsOptions,
   QueryStatesOptions,
   StandardSchemaV1,
-} from './define.js';
-export { defineSearchParams } from './define.js';
+} from './define.ts';
+export { defineSearchParams } from './define.ts';
 
 // Codec bridges moved to @timber-js/app/codec
 // Import fromSchema / fromArraySchema from '@timber-js/app/codec' instead.
 
 // Codec wrappers
-export { withDefault, withUrlKey } from './wrappers.js';
+export { withDefault, withUrlKey } from './wrappers.ts';
 
 // Runtime registry (route-scoped useQueryStates)

package/src/search-params/wrappers.ts

@@ -13,9 +13,9 @@ import type {
   SearchParamCodec,
   SearchParamCodecWithUrlKey,
   SearchParamField,
-} from './define.js';
-import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.js';
-import { parseTotal } from './parse-total.js';
+} from './define.ts';
+import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.ts';
+import { parseTotal } from './parse-total.ts';
 
 // ---------------------------------------------------------------------------
 // withDefault

package/src/server/access-gate.tsx

@@ -13,12 +13,12 @@
  * See design/04-authorization.md and design/02-rendering-pipeline.md §"AccessGate"
  */
 
-import { DenySignal, RedirectSignal } from './primitives.js';
-import type { AccessGateProps, SlotAccessGateProps } from './tree-builder.js';
-import { withSpan, setSpanAttribute } from './tracing.js';
-import { isDebug } from './debug.js';
-import type { DenyPageEntry } from './deny-boundary.js';
-import { handleCaughtDeny, setFirstDeniedSegmentIndex } from './deny-boundary.js';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import type { AccessGateProps, SlotAccessGateProps } from './tree-builder.ts';
+import { withSpan, setSpanAttribute } from './tracing.ts';
+import { isDebug } from './debug.ts';
+import type { DenyPageEntry } from './deny-boundary.ts';
+import { handleCaughtDeny, setFirstDeniedSegmentIndex } from './deny-boundary.ts';
 import type { ReactNode } from 'react';
 
 // ─── AccessGate ─────────────────────────────────────────────────────────────

package/src/server/action-client.ts

@@ -220,16 +220,16 @@ async function runActionMiddleware<TCtx>(
 }
 
 // Re-export parseFormData for use throughout the framework
-import { parseFormData } from './form-data.js';
-import { formatSize } from '../utils/format.js';
-import { isDebug, isDevMode } from './debug.js';
-import { RedirectSignal, DenySignal } from './primitives.js';
+import { parseFormData } from './form-data.ts';
+import { formatSize } from '../utils/format.ts';
+import { isDebug, isDevMode } from './debug.ts';
+import { RedirectSignal, DenySignal } from './primitives.ts';
 import {
   stripSensitiveFields,
   resolveSensitivePredicate,
   getGlobalSensitiveFieldsConfig,
   type SensitiveFieldsOption,
-} from './sensitive-fields.js';
+} from './sensitive-fields.ts';
 
 /**
  * Extract validation errors from a schema error.

package/src/server/action-handler.ts

@@ -18,27 +18,27 @@ import {
   decodeReply,
   decodeAction,
   renderToReadableStream,
-} from '../rsc-runtime/rsc.js';
-
-import { validateCsrf, type CsrfConfig } from './csrf.js';
-import { DenySignal, RedirectSignal } from './primitives.js';
-import { executeAction, type RevalidateRenderer } from './actions.js';
-import { runWithRequestContext, setMutableCookieContext } from './request-context.js';
-import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.js';
-import { handleActionError } from './action-client.js';
-import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.js';
-import { parseFormData } from './form-data.js';
+} from '../rsc-runtime/rsc.ts';
+
+import { validateCsrf, type CsrfConfig } from './csrf.ts';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import { executeAction, type RevalidateRenderer } from './actions.ts';
+import { runWithRequestContext, setMutableCookieContext } from './request-context.ts';
+import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.ts';
+import { handleActionError } from './action-client.ts';
+import { enforceBodyLimits, enforceFieldLimit, type BodyLimitsConfig } from './body-limits.ts';
+import { parseFormData } from './form-data.ts';
 import {
   stripSensitiveFields,
   resolveSensitivePredicate,
   getGlobalSensitiveFieldsConfig,
   type SensitiveFieldsOption,
-} from './sensitive-fields.js';
-import type { FormFlashData } from './form-flash.js';
-import { checkVersionSkew, applyReloadHeaders } from './version-skew.js';
-import { logActionError } from './logger.js';
-import { withTimeout, RenderTimeoutError } from './render-timeout.js';
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+} from './sensitive-fields.ts';
+import type { FormFlashData } from './form-flash.ts';
+import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
+import { logActionError } from './logger.ts';
+import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
 

package/src/server/actions.ts

@@ -14,10 +14,10 @@
  * See design/08-forms-and-actions.md
  */
 
-import { cache } from '../cache/cache-api';
-import { DenySignal, RedirectSignal } from './primitives';
-import { withSpan } from './tracing';
-import { revalidationAls, type RevalidationState } from './als-registry.js';
+import { cache } from '../cache/cache-api.ts';
+import { DenySignal, RedirectSignal } from './primitives.ts';
+import { withSpan } from './tracing.ts';
+import { revalidationAls, type RevalidationState } from './als-registry.ts';
 // ─── Types ───────────────────────────────────────────────────────────────
 
 /** Result of rendering a revalidation — payload root before RSC serialization. */
@@ -33,7 +33,7 @@ export interface RevalidationResult {
 export type RevalidateRenderer = (path: string) => Promise<RevalidationResult>;
 
 // Re-export the type from the registry for public API consumers.
-export type { RevalidationState } from './als-registry.js';
+export type { RevalidationState } from './als-registry.ts';
 
 /** Options for creating the action handler. */
 export interface ActionHandlerConfig {

package/src/server/als-registry.ts

@@ -32,10 +32,10 @@
  */
 
 import '#server-only-guard';
-import type { CoercedParams } from '../shared/param-value.js';
-import type { SlotParamsRecord } from '../shared/slot-params.js';
+import type { CoercedParams } from '../shared/param-value.ts';
+import type { SlotParamsRecord } from '../shared/slot-params.ts';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import type { DebugComponentEntry } from './rsc-entry/helpers.js';
+import type { DebugComponentEntry } from './rsc-entry/helpers.ts';
 
 /**
  * Return a process-wide singleton `AsyncLocalStorage` keyed by `symbol`.
@@ -159,7 +159,7 @@ export interface RequestContextStore {
    * See TIM-1363, TIM-1367, design/16-metadata.md.
    */
   _metadataEntries?: Array<{
-    metadata: import('./types.js').Metadata | Promise<import('./types.js').Metadata | null>;
+    metadata: import('./types.ts').Metadata | Promise<import('./types.ts').Metadata | null>;
     isPage: boolean;
   }>;
 }
@@ -168,7 +168,7 @@ export interface RequestContextStore {
 export interface CookieEntry {
   name: string;
   value: string;
-  options: import('./cookie-context.js').CookieOptions;
+  options: import('./cookie-context.ts').CookieOptions;
 }
 
 // ─── Tracing ──────────────────────────────────────────────────────────────
@@ -186,7 +186,7 @@ export interface TraceStore {
    * after span creation — the platform API has no getActiveSpan() equivalent.
    * Saved/restored by withSpan() around each callback. See TIM-1135.
    */
-  platformSpan?: import('./tracing.js').PlatformSpan;
+  platformSpan?: import('./tracing.ts').PlatformSpan;
 }
 
 /** @internal — import via tracing.ts public API */
@@ -197,7 +197,7 @@ export const traceAls = getOrCreateAls<TraceStore>(Symbol.for('timber:trace-als'
 // Design doc: (dev-only performance instrumentation)
 
 export interface TimingStore {
-  entries: import('./server-timing.js').TimingEntry[];
+  entries: import('./server-timing.ts').TimingEntry[];
 }
 
 /** @internal — import via server-timing.ts public API */
@@ -224,7 +224,7 @@ export const revalidationAls = getOrCreateAls<RevalidationState>(
 // Design doc: design/08-forms-and-actions.md §"No-JS Error Round-Trip"
 
 /** @internal — import via form-flash.ts public API */
-export const formFlashAls = getOrCreateAls<import('./form-flash.js').FormFlashData>(
+export const formFlashAls = getOrCreateAls<import('./form-flash.ts').FormFlashData>(
   Symbol.for('timber:form-flash-als')
 );
 

package/src/server/asset-headers.ts

@@ -19,13 +19,13 @@
  * Design docs: 18-build-system.md, 06-caching.md
  */
 
-import { IMMUTABLE_CACHE, STATIC_CACHE } from '../adapters/shared.js';
+import { IMMUTABLE_CACHE, STATIC_CACHE } from '../adapters/shared.ts';
 
 // Re-export cache constants and generateHeadersFile from the shared adapter
 // module. The canonical definitions live in adapters/shared.ts because
 // adapters are loaded by Node before Vite's resolver is available — they
 // can only import from within their own directory.
-export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.js';
+export { IMMUTABLE_CACHE, STATIC_CACHE, generateHeadersFile } from '../adapters/shared.ts';
 
 /**
  * Regex matching Vite-hashed asset filenames.

package/src/server/chain-url-parts.ts

@@ -20,11 +20,11 @@
  * See design/07-routing.md §"Intercepting Routes".
  */
 
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch } from './pipeline.js';
-import type { CoercedParams } from '../shared/param-value.js';
-import { effectiveUrlSegment } from '../routing/segment-classify.js';
-import { computeInterceptedBase } from '../routing/interception.js';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { CoercedParams } from '../shared/param-value.ts';
+import { effectiveUrlSegment } from '../routing/segment-classify.ts';
+import { computeInterceptedBase } from '../routing/interception.ts';
 
 /**
  * Extract raw URL path parts from a segment chain.

package/src/server/children-interception.ts

@@ -29,10 +29,10 @@
  * See design/07-routing.md §"Intercepting Routes".
  */
 
-import type { RouteMatch } from './pipeline.js';
-import { collectMiddlewareChain, type ManifestSegmentNode } from './route-matcher.js';
-import { findInterceptingMatch } from './slot-interception.js';
-import { treePathNames } from '../routing/segment-keys.js';
+import type { RouteMatch } from './pipeline.ts';
+import { collectMiddlewareChain, type ManifestSegmentNode } from './route-matcher.ts';
+import { findInterceptingMatch } from './slot-interception.ts';
+import { treePathNames } from '../routing/segment-keys.ts';
 
 /**
  * Resolve a children-path interception to a complete route match.

package/src/server/compress.ts

@@ -14,7 +14,7 @@
 // fails the build with an explanatory error rather than resolving to nothing
 // on the deployed server.
 
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Constants ────────────────────────────────────────────────────────────
 

package/src/server/cookie-context.ts

@@ -12,19 +12,19 @@
  * smuggling primitive that the encoding contract closes.
  */
 
-import { requestContextAls, type RequestContextStore } from './als-registry.js';
-import { isDebug } from './debug.js';
+import { requestContextAls, type RequestContextStore } from './als-registry.ts';
+import { isDebug } from './debug.ts';
 import {
   assertValidCookieName,
   assertValidCookieValue,
   assertValidCookieOptions,
-} from '../cookies/validation.js';
+} from '../cookies/validation.ts';
 import {
   parseCookieHeader,
   parseSetCookie,
   safeDecodeCookieValue,
   serializeCookieEntry,
-} from './cookie-parsing.js';
+} from './cookie-parsing.ts';
 
 // Re-export the validators so framework-internal consumers and tests can
 // import the canonical implementation from the same module that hosts

package/src/server/cookie-parsing.ts

@@ -17,8 +17,8 @@
 
 import { parseCookie, parseSetCookie as upstreamParseSetCookie, stringifySetCookie } from 'cookie';
 
-import type { CookieEntry } from './als-registry.js';
-import type { CookieOptions } from './cookie-context.js';
+import type { CookieEntry } from './als-registry.ts';
+import type { CookieOptions } from './cookie-context.ts';
 
 /**
  * Parse a Cookie header string into a Map of name → value pairs.

package/src/server/default-logger.ts

@@ -18,9 +18,9 @@
  * See design/17-logging.md §"DefaultLogger"
  */
 
-import { isDevMode, isDebug } from './debug.js';
-import { formatSsrError } from './error-formatter.js';
-import type { TimberLogger } from './logger.js';
+import { isDevMode, isDebug } from './debug.ts';
+import { formatSsrError } from './error-formatter.ts';
+import type { TimberLogger } from './logger.ts';
 
 /**
  * Format data fields as `key=value` pairs for human-readable output.

package/src/server/deny-boundary.ts

@@ -35,16 +35,16 @@
 
 import { createElement } from 'react';
 
-import { ErrorReconstituter } from '../client/error-reconstituter.js';
-import type { SerializableError } from '../client/error-reconstituter.js';
-import { requestContextAls } from './als-registry.js';
-import { DenySignal } from './primitives.js';
-import { loadModule } from './safe-load.js';
-import type { ManifestLoader } from './safe-load.js';
-import { withSpan } from './tracing.js';
-import { isValidElementType, type LoadedComponent } from './utils/element-type.js';
-import { isMdxFilePath } from './utils/mdx-file.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
+import { ErrorReconstituter } from '../client/error-reconstituter.tsx';
+import type { SerializableError } from '../client/error-reconstituter.tsx';
+import { requestContextAls } from './als-registry.ts';
+import { DenySignal } from './primitives.ts';
+import { loadModule } from './safe-load.ts';
+import type { ManifestLoader } from './safe-load.ts';
+import { withSpan } from './tracing.ts';
+import { isValidElementType, type LoadedComponent } from './utils/element-type.ts';
+import { isMdxFilePath } from './utils/mdx-file.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
 

package/src/server/deny-renderer.ts

@@ -16,31 +16,31 @@
  */
 
 import { createElement, Fragment } from 'react';
-import { renderToReadableStream } from '../rsc-runtime/rsc.js';
-
-import { DenySignal } from './primitives.js';
-import { appVisibleSearch } from '../shared/rsc-cache-key.js';
-import { getSlotParamsForClient } from './request-context.js';
-import { withPublishedParams } from './publish-params.js';
-import { renderDenyEntry, type DenyEntryShape } from './deny-boundary.js';
-import { getCookiesForSsr } from './cookie-context.js';
-import { logRenderError } from './logger.js';
-import { loadModule } from './safe-load.js';
-import { isMdxFilePath } from './utils/mdx-file.js';
-import { isDebug } from './debug.js';
-import { resolveMetadata, renderMetadataToElements } from './metadata.js';
-import { headElementsToReact } from './metadata.js';
-import { resolveStatusFile } from './status-code-resolver.js';
-import { defaultStatusPageResponse } from './default-status-page.js';
-import { rscErrorEnvelope } from '../shared/rsc-error-envelope.js';
-import type { ManifestSegmentNode } from './route-matcher.js';
-import type { RouteMatch } from './pipeline.js';
-import type { NavContext } from './ssr-bridge-types.js';
-import { flightInitScript } from './flight-scripts.js';
-import type { ClientBootstrapConfig } from './html-injectors.js';
-import type { Metadata } from './types.js';
-import { teeWithErrorPropagation } from './stream-utils.js';
-import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.js';
+import { renderToReadableStream } from '../rsc-runtime/rsc.ts';
+
+import { DenySignal } from './primitives.ts';
+import { appVisibleSearch } from '../shared/rsc-cache-key.ts';
+import { getSlotParamsForClient } from './request-context.ts';
+import { withPublishedParams } from './publish-params.ts';
+import { renderDenyEntry, type DenyEntryShape } from './deny-boundary.ts';
+import { getCookiesForSsr } from './cookie-context.ts';
+import { logRenderError } from './logger.ts';
+import { loadModule } from './safe-load.ts';
+import { isMdxFilePath } from './utils/mdx-file.ts';
+import { isDebug } from './debug.ts';
+import { resolveMetadata, renderMetadataToElements } from './metadata.ts';
+import { headElementsToReact } from './metadata.ts';
+import { resolveStatusFile } from './status-code-resolver.ts';
+import { defaultStatusPageResponse } from './default-status-page.ts';
+import { rscErrorEnvelope } from '../shared/rsc-error-envelope.ts';
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { RouteMatch } from './pipeline.ts';
+import type { NavContext } from './ssr-bridge-types.ts';
+import { flightInitScript } from './flight-scripts.ts';
+import type { ClientBootstrapConfig } from './html-injectors.ts';
+import type { Metadata } from './types.ts';
+import { teeWithErrorPropagation } from './stream-utils.ts';
+import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 /** Layout component entry for deny page wrapping. */
 export interface LayoutEntry {
@@ -357,6 +357,19 @@ async function renderDenyPageJson(
   // A .json status file that fails to load is not a usable match — return
   // null so the caller continues to the framework default rather than
   // rejecting out of the chain.
+  // Dev warning: deny(status, data) carries data but JSON status files are
+  // static bodies — the data is silently dropped. The same deny() would
+  // deliver the data to a .tsx file's dangerouslyPassData prop. See
+  // design/10-error-handling.md §"Status-Code File Variants".
+  if (isDebug() && deny.data !== undefined) {
+    console.warn(
+      `[timber] deny(${deny.status}, data) resolved to ${resolution.file.filePath}, ` +
+        `which is a static JSON file. The data argument is dropped — JSON status files ` +
+        `are returned verbatim with no interpolation. If you need the data in the ` +
+        `response, use a .tsx status file or a route handler (route.ts).`
+    );
+  }
+
   const mod = await loadModule(resolution.file).catch(() => null);
   if (!mod) return null;
   const jsonContent = mod.default ?? mod;