@timber-js/app 0.2.0-alpha.197 → 0.2.0-alpha.199

package/src/plugins/dev-server.ts

@@ -36,6 +36,7 @@ import {
   type GraphUpdateChannel,
 } from './graph-endpoint.ts';
 import { compressResponse } from '../server/compress.ts';
+import { isSsrStreamError } from '../server/primitives.ts';
 import { isMetadataRouteServePath } from '../server/metadata-routes.ts';
 import { canonicalize } from '../server/canonicalize.ts';
 import { matchUrlParts } from '../server/tree-match.ts';
@@ -401,7 +402,7 @@ function createTimberMiddleware(server: ViteDevServer, ctx: PluginContext) {
         // message; the developer needs to see the actual error (e.g.,
         // "useSegmentParams is not a function"), not the wrapper.
         const displayError =
-          error.name === 'SsrStreamError' && error.cause instanceof Error ? error.cause : error;
+          isSsrStreamError(error) && error.cause instanceof Error ? error.cause : error;
         const phase = classifyErrorPhase(displayError, projectRoot);
         sendErrorToOverlay(server, displayError, phase, projectRoot);
         respond500(res, displayError, phase, projectRoot, hmrOptions);

package/src/react-canary.d.ts

@@ -0,0 +1,2 @@
+/// <reference types="react/canary" />
+/// <reference types="react-dom/canary" />

package/src/routing/codegen-write.ts

@@ -60,6 +60,8 @@ const TIMBER_ENV_DTS = [
   '/* eslint-disable @typescript-eslint/triple-slash-reference */',
   '/// <reference path=".timber/timber-routes.d.ts" />',
   '/// <reference types="vite/client" />',
+  '/// <reference types="react/canary" />',
+  '/// <reference types="react-dom/canary" />',
   '',
 ].join('\n');
 

package/src/routing/interception.ts

@@ -109,8 +109,8 @@ export interface SlotInterceptionRewrite extends InterceptionRewriteBase {
  * either. The server resolves the owner by `interceptingScope` — a tree path,
  * which identifies exactly one directory — and builds the rendered chain as
  * `[…owner ancestors, interceptingNode, …its matched descendants]`. That is an
- * ordinary segment chain, so `tree-builder.ts` renders it with no knowledge
- * that interception happened.
+ * ordinary segment chain, so `route-element-builder.ts` renders it with no
+ * knowledge that interception happened.
  *
  * Resolving the owner from the tree rather than from a URL is what makes this
  * shape work where the modal shape cannot: `interceptingPrefix` is

package/src/routing/slot-placement.ts

@@ -15,8 +15,8 @@ import type { SegmentNode } from './types.ts';
  * Reject every parallel slot that no renderer reaches.
  *
  * **Where slots are resolved.** Two places read `segment.slots`, and both walk
- * the main route chain: `route-element-builder.ts` (the RSC render) and
- * `tree-builder.ts`. Neither is reachable from inside a slot. The slot's own
+ * the main route chain: `route-element-builder.ts` (the RSC render).
+ * It is not reachable from inside a slot. The slot's own
  * subtree is rendered by `slot-resolver.ts`, which walks the slot's matched
  * chain to apply that chain's layouts, error boundaries and access gates
  * (`wrapWithIntermediateSegments`, `wrapWithLayout`) and never reads `.slots`

package/src/server/access-gate.tsx

@@ -13,13 +13,93 @@
  * See design/04-authorization.md and design/02-rendering-pipeline.md §"AccessGate"
  */
 
-import { DenySignal, RedirectSignal } from './primitives.ts';
-import type { AccessGateProps, SlotAccessGateProps } from './tree-builder.ts';
+import { isDenySignal, isRedirectSignal, DenySignal, RedirectSignal } from './primitives.ts';
 import { withSpan, setSpanAttribute } from './tracing.ts';
 import { isDebug } from './debug.ts';
 import type { DenyPageEntry } from './deny-boundary.ts';
 import { handleCaughtDeny, setFirstDeniedSegmentIndex } from './deny-boundary.ts';
 import type { ReactNode } from 'react';
+import type { LoadedComponent } from './utils/element-type.ts';
+
+// ─── Types ─────────────────────────────────────────────────────────────────
+
+/**
+ * Function that creates a React element. Matches React.createElement signature.
+ *
+ * `props` is typed as `object | null` rather than `Record<string, unknown>` so
+ * that interface types with known keys (e.g. `AccessGateProps`,
+ * `ErrorBoundaryProps`) flow through without an explicit index-signature cast.
+ */
+export type CreateElement = (
+  type: unknown,
+  props: object | null,
+  ...children: unknown[]
+) => ReactNode;
+
+/**
+ * Framework-injected access gate component.
+ *
+ * When `verdict` is provided (from the pre-render pass), AccessGate replays
+ * the stored result synchronously — no re-execution, no async, immune to
+ * Suspense timing. When `verdict` is absent, falls back to calling `accessFn`
+ * (backward compat for construction sites that don't run a pre-render pass).
+ */
+export interface AccessGateProps {
+  accessFn: () => unknown;
+  /** Segment name for dev logging (e.g. "authenticated", "dashboard"). */
+  segmentName?: string;
+  /**
+   * Segment key of the gated segment (`computeSegmentKeys`). Decides whether
+   * a matched deny page renders here or is hoisted to the segment that owns
+   * it. Omitted by construction sites that build no deny chains — with no
+   * chain there is nothing to place. See TIM-1356.
+   */
+  segmentKey?: string;
+  /**
+   * Index of this segment in the matched segment chain. Recorded in ALS
+   * when the gate catches a DenySignal so post-render consumers
+   * (buildSegmentInfo, X-Timber-Segments) can bound the segment list
+   * without a pre-render access pass. See TIM-1363.
+   */
+  segmentIndex?: number;
+  /**
+   * Deny page fallback chain. When provided and a DenySignal is caught,
+   * AccessGate renders the matching deny page in-tree instead of throwing.
+   * This prevents the error from reaching React Flight, eliminating the
+   * second render pass. See TIM-666.
+   *
+   * Omitted for skipped segments — a deny there must hard-navigate to
+   * avoid rendering the deny page inside cached layout chrome (TIM-1074).
+   */
+  denyPages?: DenyPageEntry[];
+  /**
+   * When true, this gate wraps a skipped segment. On deny, the gate
+   * records the deny in ALS and rethrows so the response path can
+   * return rscErrorEnvelope for a client hard-navigate.
+   */
+  skippedSegment?: boolean;
+  children: ReactNode;
+}
+
+/**
+ * Framework-injected slot access gate component.
+ * On denial, renders denied.tsx → default.tsx → null instead of failing the page.
+ *
+ * DeniedComponent is passed instead of a pre-built element so that
+ * SlotAccessGate can forward DenySignal.data as dangerouslyPassData
+ * and slotName as the slot prop after catching the signal.
+ */
+export interface SlotAccessGateProps {
+  accessFn: () => unknown;
+  /** The denied.tsx component (not a pre-built element). null if no denied.tsx exists. */
+  DeniedComponent: LoadedComponent | null;
+  /** Slot directory name without @ prefix (e.g. "admin", "sidebar"). */
+  slotName: string;
+  /** createElement function for building elements dynamically. */
+  createElement: CreateElement;
+  defaultFallback: ReactNode;
+  children: ReactNode;
+}
 
 // ─── AccessGate ─────────────────────────────────────────────────────────────
 
@@ -49,16 +129,8 @@ import type { ReactNode } from 'react';
  * can return rscErrorEnvelope for a client hard-navigate.
  */
 export function AccessGate(props: AccessGateProps): Promise<ReactNode> {
-  const {
-    accessFn,
-    segmentName,
-    segmentKey,
-    segmentIndex,
-    denyPages,
-    skippedSegment,
-    onSettled,
-    children,
-  } = props;
+  const { accessFn, segmentName, segmentKey, segmentIndex, denyPages, skippedSegment, children } =
+    props;
 
   return accessGateFallback(
     accessFn,
@@ -67,7 +139,6 @@ export function AccessGate(props: AccessGateProps): Promise<ReactNode> {
     segmentIndex,
     skippedSegment ? undefined : denyPages,
     skippedSegment,
-    onSettled,
     children
   );
 }
@@ -83,7 +154,6 @@ async function accessGateFallback(
   segmentIndex: AccessGateProps['segmentIndex'],
   denyPages: DenyPageEntry[] | undefined,
   skippedSegment: boolean | undefined,
-  onSettled: (() => void) | undefined,
   children: ReactNode
 ): Promise<ReactNode> {
   try {
@@ -92,20 +162,20 @@ async function accessGateFallback(
         await accessFn();
         await setSpanAttribute('timber.result', 'pass');
       } catch (error: unknown) {
-        if (error instanceof DenySignal) {
+        if (isDenySignal(error)) {
           await setSpanAttribute('timber.result', 'deny');
           await setSpanAttribute('timber.deny_status', error.status);
           if (error.sourceFile) {
             await setSpanAttribute('timber.deny_file', error.sourceFile);
           }
-        } else if (error instanceof RedirectSignal) {
+        } else if (isRedirectSignal(error)) {
           await setSpanAttribute('timber.result', 'redirect');
         }
         throw error;
       }
     });
   } catch (error: unknown) {
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       if (segmentIndex !== undefined) {
         setFirstDeniedSegmentIndex(segmentIndex);
       }
@@ -120,8 +190,6 @@ async function accessGateFallback(
       }
     }
     throw error;
-  } finally {
-    onSettled?.();
   }
 
   return children;
@@ -151,7 +219,7 @@ export async function SlotAccessGate(props: SlotAccessGateProps): Promise<ReactN
   } catch (error: unknown) {
     // DenySignal → graceful degradation (denied.tsx → default.tsx → null)
     // Build the denied element dynamically so DenySignal.data is forwarded.
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       return (
         buildDeniedFallback(DeniedComponent, slotName, error.data, createElement) ??
         defaultFallback ??
@@ -163,7 +231,7 @@ export async function SlotAccessGate(props: SlotAccessGateProps): Promise<ReactN
     // Slot access should use deny(), not redirect(). Redirecting from a
     // slot would redirect the entire page, which breaks the contract that
     // slot failure is graceful degradation.
-    if (error instanceof RedirectSignal) {
+    if (isRedirectSignal(error)) {
       if (isDebug()) {
         console.error(
           '[timber] redirect() is not allowed in slot access.ts. ' +

package/src/server/action-client.ts

@@ -223,7 +223,7 @@ async function runActionMiddleware<TCtx>(
 import { parseFormData } from './form-data.ts';
 import { formatSize } from '../utils/format.ts';
 import { isDebug, isDevMode } from './debug.ts';
-import { RedirectSignal, DenySignal } from './primitives.ts';
+import { isDenySignal, isRedirectSignal } from './primitives.ts';
 import {
   stripSensitiveFields,
   resolveSensitivePredicate,
@@ -432,7 +432,7 @@ export function createActionClient<TCtx = Record<string, never>>(
         // They must propagate to executeAction() which converts them to proper
         // HTTP responses (302 redirect, 4xx deny). Catching them here would
         // wrap them as INTERNAL_ERROR and break redirect()/redirectExternal()/deny().
-        if (error instanceof RedirectSignal || error instanceof DenySignal) {
+        if (isRedirectSignal(error) || isDenySignal(error)) {
           throw error;
         }
         return handleActionError(error);

package/src/server/action-handler.ts

@@ -21,7 +21,7 @@ import {
 } from '../rsc-runtime/rsc.ts';
 
 import { validateCsrf, type CsrfConfig } from './csrf.ts';
-import { DenySignal, RedirectSignal } from './primitives.ts';
+import { isDenySignal, isRedirectSignal } from './primitives.ts';
 import { executeAction, type RevalidateRenderer } from './actions.ts';
 import { runWithRequestContext, setMutableCookieContext } from './request-context.ts';
 import { getSetCookieHeaders, getCookiesForSsr } from './cookie-context.ts';
@@ -38,6 +38,7 @@ import type { FormFlashData } from './form-flash.ts';
 import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
 import { logActionError } from './logger.ts';
 import { withTimeout, RenderTimeoutError } from './render-timeout.ts';
+import { canonicalize } from './canonicalize.ts';
 import { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -246,8 +247,14 @@ async function handleRscAction(
   // of leaking stack traces as 500s.
   let result;
   try {
+    const requestUrl = new URL(req.url);
+    // Canonicalize the request pathname so it matches the decoded form
+    // that revalidationPathMatches uses on the target side.
+    const canonical = canonicalize(requestUrl.pathname, true);
     result = await executeAction(actionFn, args, {
       renderer: config.revalidateRenderer,
+      requestPathname: canonical.ok ? canonical.pathname : requestUrl.pathname,
+      requestSearch: requestUrl.search,
     });
   } catch (error) {
     // Log full error server-side for debugging
@@ -272,13 +279,14 @@ async function handleRscAction(
       _status: result.redirectStatus ?? 302,
     };
     const rscStream = renderToReadableStream(redirectPayload);
-    return new Response(rscStream, {
-      status: 200,
-      headers: {
-        'Content-Type': RSC_CONTENT_TYPE,
-        'X-Timber-Redirect': result.redirectTo,
-      },
-    });
+    const redirectHeaders: Record<string, string> = {
+      'Content-Type': RSC_CONTENT_TYPE,
+      'X-Timber-Redirect': result.redirectTo,
+    };
+    if (result.invalidatedPaths && result.invalidatedPaths.length > 0) {
+      redirectHeaders['X-Timber-Revalidation-Path'] = result.invalidatedPaths.join(' ');
+    }
+    return new Response(rscStream, { status: 200, headers: redirectHeaders });
   }
 
   // Render the action result as an RSC stream.
@@ -289,6 +297,11 @@ async function handleRscAction(
     'Content-Type': RSC_CONTENT_TYPE,
   };
 
+  // TIM-1454: Tell the client which paths were invalidated (non-matching).
+  if (result.invalidatedPaths && result.invalidatedPaths.length > 0) {
+    headers['X-Timber-Revalidation-Path'] = result.invalidatedPaths.join(' ');
+  }
+
   if (result.revalidation) {
     // Wrapper object — Next.js-style pattern: action result + element tree
     // serialized together so React Flight handles both in one stream.
@@ -313,9 +326,9 @@ async function handleRscAction(
       signal: req.signal,
       onError(error: unknown) {
         // ??= keeps the first signal (shallowest AccessGate in top-down render).
-        if (error instanceof DenySignal) {
+        if (isDenySignal(error)) {
           serializationSignal ??= { kind: 'deny', status: error.status };
-        } else if (error instanceof RedirectSignal) {
+        } else if (isRedirectSignal(error)) {
           serializationSignal ??= {
             kind: 'redirect',
             location: error.location,

package/src/server/actions.ts

@@ -15,7 +15,8 @@
  */
 
 import { cache } from '../cache/cache-api.ts';
-import { DenySignal, RedirectSignal } from './primitives.ts';
+import { canonicalize } from './canonicalize.ts';
+import { isDenySignal, isRedirectSignal } from './primitives.ts';
 import { withSpan } from './tracing.ts';
 import { revalidationAls, type RevalidationState } from './als-registry.ts';
 // ─── Types ───────────────────────────────────────────────────────────────
@@ -24,7 +25,7 @@ import { revalidationAls, type RevalidationState } from './als-registry.ts';
 export interface RevalidationResult {
   /**
    * The payload root — tree plus the params it rendered with, exactly as an
-   * ordinary route payload. The client splits it in `applyRevalidation`.
+   * ordinary route payload. The client splits it in `applyActionResult`.
    */
   payload: unknown;
 }
@@ -39,6 +40,15 @@ export type { RevalidationState } from './als-registry.ts';
 export interface ActionHandlerConfig {
   /** Renderer for producing RSC payloads during revalidation. */
   renderer?: RevalidateRenderer;
+  /**
+   * Pathname of the page the action was submitted from. When set,
+   * revalidatePath renders are skipped for non-matching paths — the
+   * server cache is already invalidated, so the next navigation fetches
+   * fresh data. See TIM-1454.
+   */
+  requestPathname?: string;
+  /** Search string of the action request URL (e.g. `?page=1`). */
+  requestSearch?: string;
 }
 
 /** Result of handling a server action request. */
@@ -47,6 +57,12 @@ export interface ActionHandlerResult {
   actionResult: unknown;
   /** Revalidation result if revalidatePath was called (element tree, not yet serialized). */
   revalidation?: RevalidationResult;
+  /**
+   * Paths passed to `revalidatePath()` that don't match the current page
+   * (TIM-1454). The client invalidates its caches for these so the next
+   * navigation fetches fresh data.
+   */
+  invalidatedPaths?: string[];
   /** Redirect location if a RedirectSignal was thrown during revalidation. */
   redirectTo?: string;
   /** Redirect status code. */
@@ -112,6 +128,13 @@ export function revalidateTag(tag: string): void {
   }
 }
 
+// ─── Helpers ────────────────────────────────────────────────────────────
+
+function stripFragment(path: string): string {
+  const idx = path.indexOf('#');
+  return idx >= 0 ? path.slice(0, idx) : path;
+}
+
 // ─── Action Handler ──────────────────────────────────────────────────────
 
 /**
@@ -151,7 +174,7 @@ export async function executeAction(
         () => actionFn(...args)
       );
     } catch (error) {
-      if (error instanceof RedirectSignal) {
+      if (isRedirectSignal(error)) {
         redirectTo = error.location;
         redirectStatus = error.status;
       } else {
@@ -182,39 +205,36 @@ export async function executeAction(
     }
   }
 
-  // Process path revalidation — build element tree (not yet serialized)
+  // Process path revalidation — build element tree (not yet serialized).
+  //
+  // TIM-1454: Only render the path if it matches the current page. Non-matching
+  // paths are collected as `invalidatedPaths` — the client evicts them from its
+  // caches so the next navigation fetches fresh data.
   let revalidation: RevalidationResult | undefined;
-  if (state.paths.length > 0 && config.renderer) {
-    // For now, render the first revalidated path.
-    // Multiple paths could be supported via multipart streaming in the future.
+  let invalidatedPaths: string[] | undefined;
+
+  if (state.paths.length > 0) {
     const path = state.paths[0];
-    try {
-      revalidation = await config.renderer(path);
-    } catch (renderError) {
-      if (renderError instanceof RedirectSignal) {
-        // Revalidation triggered a redirect (e.g., session expired,
-        // middleware on the target path called `redirect()`).
-        redirectTo = renderError.location;
-        redirectStatus = renderError.status;
-      } else if (renderError instanceof DenySignal) {
-        // Target path's middleware/access denied this user.
-        //
-        // Dropping the revalidation here is the security boundary added
-        // in TIM-996: without this branch, a DenySignal would fall into
-        // the `console.error` path AND the element tree would have
-        // already been built and serialized — leaking a privileged RSC
-        // payload to the action submitter. By the time the signal
-        // surfaces, the renderer has thrown BEFORE building the tree,
-        // so we simply drop `revalidation` and ship the action result
-        // alone. The action itself still succeeded.
-        console.error(
-          `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`
-        );
-      } else {
-        // Log but don't fail the action — revalidation is best-effort.
-        // Includes input-validation rejections from the renderer
-        // (e.g., revalidatePath('//evil.com/admin')).
-        console.error('[timber] revalidatePath render failed:', renderError);
+
+    if (
+      config.requestPathname &&
+      !revalidationPathMatches(path, config.requestPathname, config.requestSearch)
+    ) {
+      invalidatedPaths = [stripFragment(path)];
+    } else if (config.renderer) {
+      try {
+        revalidation = await config.renderer(path);
+      } catch (renderError) {
+        if (isRedirectSignal(renderError)) {
+          redirectTo = renderError.location;
+          redirectStatus = renderError.status;
+        } else if (isDenySignal(renderError)) {
+          console.error(
+            `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`
+          );
+        } else {
+          console.error('[timber] revalidatePath render failed:', renderError);
+        }
       }
     }
   }
@@ -222,6 +242,33 @@ export async function executeAction(
   return {
     actionResult,
     revalidation,
+    invalidatedPaths,
     ...(redirectTo ? { redirectTo, redirectStatus } : {}),
   };
 }
+
+/**
+ * Check if a `revalidatePath(path)` argument matches the request pathname.
+/**
+ * Canonicalizes the revalidated path the same way the renderer does so
+ * equivalent paths compare equal. Returns true when the paths match or
+ * when comparison is inconclusive (validation failure → render to be safe).
+ */
+function revalidationPathMatches(
+  revalidatedPath: string,
+  requestPathname: string,
+  requestSearch?: string
+): boolean {
+  const hashIdx = revalidatedPath.indexOf('#');
+  const noFragment = hashIdx >= 0 ? revalidatedPath.slice(0, hashIdx) : revalidatedPath;
+  const queryIdx = noFragment.indexOf('?');
+  const pathnameOnly = queryIdx >= 0 ? noFragment.slice(0, queryIdx) : noFragment;
+  const search = queryIdx >= 0 ? noFragment.slice(queryIdx) : '';
+  const canonical = canonicalize(pathnameOnly, true);
+  if (!canonical.ok) return true;
+  if (canonical.pathname !== requestPathname) return false;
+  // revalidatePath('/dashboard') (no search) matches any query variant.
+  // revalidatePath('/dashboard?tab=x') only matches that exact search.
+  if (search && search !== (requestSearch ?? '')) return false;
+  return true;
+}

package/src/server/als-registry.ts

@@ -131,17 +131,11 @@ export interface RequestContextStore {
   /**
    * Set by AccessGate or PageDenyBoundary when a DenySignal is caught
    * server-side (inside the React tree, before React Flight sees it).
-   * The pipeline reads this after render to set the HTTP status code.
-   * See TIM-666.
+   * The document path reads this after render to set the HTTP status code;
+   * the RSC payload path does not read it (a Flight payload response is always 200).
+   * See TIM-666, TIM-1495.
    */
   denyStatus?: number;
-  /**
-   * Callback fired when setDenyStatus() is called. Used by shellSettled
-   * to short-circuit when any component catches a DenySignal in-tree,
-   * regardless of which component caught it (AccessGate, TracedLayout,
-   * or PageDenyBoundary). See TIM-1208.
-   */
-  onDenyStatus?: () => void;
   /**
    * Dev-only: getter for the current request's RSC debug components.
    * Set by renderRoute() so onPipelineError can include component tree

package/src/server/children-interception.ts

@@ -21,7 +21,7 @@
  *
  * The result is an ordinary `RouteMatch` whose chain runs
  * `[…owner ancestors, interceptingNode, …its matched descendants]`. Every
- * consumer downstream — `tree-builder.ts`, the element builder, access gates,
+ * consumer downstream — `route-element-builder.ts`, access gates,
  * middleware — sees a segment chain and needs to know nothing about
  * interception. That is why this feature adds no rendering path: the chain
  * *is* the feature.

package/src/server/default-status-page.ts

@@ -18,57 +18,17 @@
  * error message, no stack — see design/13-security.md principle 4.
  */
 
-/**
- * Canonical reason phrases (RFC 9110 §15) for the statuses an app is likely to
- * `deny()` with. Anything else falls back to a generic category phrase — the
- * phrase is decoration, never a place to echo caller-supplied text.
- */
-const REASON_PHRASES: Record<number, string> = {
-  400: 'Bad Request',
-  401: 'Unauthorized',
-  402: 'Payment Required',
-  403: 'Forbidden',
-  404: 'Not Found',
-  405: 'Method Not Allowed',
-  406: 'Not Acceptable',
-  408: 'Request Timeout',
-  409: 'Conflict',
-  410: 'Gone',
-  413: 'Content Too Large',
-  415: 'Unsupported Media Type',
-  418: "I'm a Teapot",
-  422: 'Unprocessable Content',
-  429: 'Too Many Requests',
-  451: 'Unavailable For Legal Reasons',
-  500: 'Internal Server Error',
-  501: 'Not Implemented',
-  502: 'Bad Gateway',
-  503: 'Service Unavailable',
-  504: 'Gateway Timeout',
-};
+import { displayStatus, statusReasonPhrase } from '../shared/status-reason-phrase.ts';
+
+// The phrase table and status clamp live in `shared/status-reason-phrase.ts`:
+// the client-form terminal (`client/deny-last-resort.tsx`) renders the same
+// words for a deny that streamed past every boundary, and one table keeps the
+// two surfaces from drifting.
+export { statusReasonPhrase };
 
 /** HTML content type used for every framework default page response. */
 export const DEFAULT_STATUS_PAGE_CONTENT_TYPE = 'text/html; charset=utf-8';
 
-/**
- * Coerce a status into something safe to put in markup.
- *
- * `DenySignal.status` is typed `number` but nothing validates it at
- * construction, and JS callers can hand us anything. Rather than escaping a
- * value that should never have been a string, collapse non-integers to 500 —
- * the page is decoration for a status already on the wire.
- */
-function displayStatus(status: number): number {
-  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : 500;
-}
-
-/** Human-readable phrase for a status code. Never caller-supplied text. */
-export function statusReasonPhrase(status: number): string {
-  const code = displayStatus(status);
-  if (REASON_PHRASES[code]) return REASON_PHRASES[code];
-  return code >= 500 ? 'Server Error' : 'Request Error';
-}
-
 /**
  * Build the framework default page for a status code as a full HTML document.
  *