@timber-js/app 0.2.0-alpha.198 → 0.2.0-alpha.199

package/src/server/deny-boundary.ts

@@ -37,8 +37,9 @@ import { createElement } from 'react';
 
 import { ErrorReconstituter } from '../client/error-reconstituter.tsx';
 import type { SerializableError } from '../client/error-reconstituter.tsx';
+import { StatusPageMarker } from '../client/status-page-marker.tsx';
 import { requestContextAls } from './als-registry.ts';
-import { DenySignal } from './primitives.ts';
+import { isDenySignal, DenySignal } from './primitives.ts';
 import { loadModule } from './safe-load.ts';
 import type { ManifestLoader } from './safe-load.ts';
 import { withSpan } from './tracing.ts';
@@ -252,22 +253,32 @@ export async function buildDenyPageChain(
  * `resolve5xx`. See TIM-1360.
  */
 export function matchDenyEntry(chain: DenyPageEntry[], status: number): DenyPageEntry | null {
-  if (status >= 500) return matchDenyEntry5xx(chain, status);
+  return matchDenyEntries(chain, status)[0] ?? null;
+}
 
+/**
+ * Return ALL deny page entries whose status filter matches, in traversal
+ * order (best match first). `matchDenyEntry` returns only the first;
+ * late addressing (TIM-1450) needs the full list so the client can find
+ * the first *reachable* owner via its ancestry context.
+ */
+export function matchDenyEntries(chain: DenyPageEntry[], status: number): DenyPageEntry[] {
+  if (status >= 500) return matchDenyEntries5xx(chain, status);
+
+  const matches: DenyPageEntry[] = [];
   for (const entry of chain) {
-    if (entry.status === status) return entry;
-    if (entry.status === 400 && status >= 400 && status <= 499) return entry;
-    if (entry.status === null) return entry;
+    if (entry.status === status) matches.push(entry);
+    else if (entry.status === 400 && status >= 400 && status <= 499) matches.push(entry);
+    else if (entry.status === null) matches.push(entry);
   }
-  return null;
+  return matches;
 }
 
 /**
  * 5xx per-segment walk: at each segment (inner→outer), check status files
  * then error.tsx before moving outward. Mirrors `resolve5xx`.
  */
-function matchDenyEntry5xx(chain: DenyPageEntry[], status: number): DenyPageEntry | null {
-  // Collect unique segment indices, sorted descending (inner→outer).
+function matchDenyEntries5xx(chain: DenyPageEntry[], status: number): DenyPageEntry[] {
   const segmentIndices: number[] = [];
   for (const entry of chain) {
     if (!segmentIndices.includes(entry.segmentIndex)) {
@@ -276,20 +287,19 @@ function matchDenyEntry5xx(chain: DenyPageEntry[], status: number): DenyPageEntr
   }
   segmentIndices.sort((a, b) => b - a);
 
+  const matches: DenyPageEntry[] = [];
   for (const seg of segmentIndices) {
-    // Status files at this segment (exact then category).
     for (const entry of chain) {
       if (entry.segmentIndex !== seg || entry.kind === 'error') continue;
-      if (entry.status === status) return entry;
-      if (entry.status === 500 && status >= 500 && status <= 599) return entry;
+      if (entry.status === status) matches.push(entry);
+      else if (entry.status === 500 && status >= 500 && status <= 599) matches.push(entry);
     }
-    // error.tsx at this segment.
     for (const entry of chain) {
       if (entry.segmentIndex !== seg || entry.kind !== 'error') continue;
-      return entry;
+      matches.push(entry);
     }
   }
-  return null;
+  return matches;
 }
 
 /**
@@ -355,7 +365,19 @@ export function renderDenyEntry(
   data: unknown
 ): React.ReactElement {
   const h = createElement as (...args: unknown[]) => React.ReactElement;
+  // Every deny page the server places — in-tree at the owning catch site, or
+  // through the fallback renderers — is a status page the client's segment
+  // cache must not learn from, and the marker is how it says so on commit.
+  // See client/status-page-marker.tsx (TIM-1495).
+  return h(StatusPageMarker, null, renderDenyPage(entry, status, data, h));
+}
 
+function renderDenyPage(
+  entry: DenyEntryShape,
+  status: number,
+  data: unknown,
+  h: (...args: unknown[]) => React.ReactElement
+): React.ReactElement {
   if (entry.kind !== 'error') {
     return h(entry.component, { status, dangerouslyPassData: data });
   }
@@ -391,15 +413,16 @@ export function renderDenyEntry(
  * file, bare when nothing matched at all.
  *
  * `setDenyStatus` runs on the hoist path too, and must run *before* the
- * throw: on the RSC payload path no boundary executes server-side, so the
- * ALS status is the only thing standing between the response and a 200
- * (`rsc-payload.ts` reads it after the stream settles).
+ * throw: on the document path the hoisted row fails the Fizz shell and the
+ * re-render fallback serves the page, and the ALS status is what the
+ * pipeline commits for it. The RSC payload path never reads it — a Flight
+ * payload response is always 200 and the row itself carries the deny (TIM-1495).
  *
  * Either branch leaves part of the matched chain unmounted — hoisting sends
  * the render to a boundary that discards everything below it, and a layout
  * that denies returns the deny page instead of its own child outlet. What the
- * response then says about the tree is decided from the deny status alone in
- * `rsc-payload.ts`, not tracked here; see the note there for why.
+ * client then learns about the tree is decided by the boundary that renders
+ * the page, at the commit that puts it on screen (`navigation-commit.ts`).
  */
 export function handleCaughtDeny(
   chain: DenyPageEntry[] | undefined,
@@ -414,7 +437,7 @@ export function handleCaughtDeny(
   }
   if (placement?.kind === 'hoist') {
     setDenyStatus(error.status);
-    error.ownerKey = placement.ownerKey;
+    error.owners = [placement.ownerKey];
   }
   throw error;
 }
@@ -440,7 +463,6 @@ export async function PageDenyBoundary({
   route,
   denyPages,
   segmentKey,
-  onSettled,
 }: {
   /** The page server component function. */
   Page: (...args: unknown[]) => unknown;
@@ -454,19 +476,15 @@ export async function PageDenyBoundary({
    * chain matched further up is hoisted to its owner.
    */
   segmentKey: string;
-  /** Called when the page component finishes (success or deny). See TIM-1045. */
-  onSettled?: () => void;
 }): Promise<React.ReactElement> {
   try {
     const result = await withSpan('timber.page', { 'timber.route': route }, () => Page({}));
     return result as React.ReactElement;
   } catch (error: unknown) {
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       return handleCaughtDeny(denyPages, error, segmentKey);
     }
     throw error;
-  } finally {
-    onSettled?.();
   }
 }
 
@@ -475,13 +493,12 @@ export async function PageDenyBoundary({
 /**
  * Set the deny status in the request context ALS.
  * Called from AccessGate / PageDenyBoundary when a DenySignal is caught.
- * The pipeline reads this after render to set the HTTP status code.
+ * The document path reads this after render to set the HTTP status code.
  */
 export function setDenyStatus(status: number): void {
   const store = requestContextAls.getStore();
   if (store) {
     store.denyStatus = status;
-    store.onDenyStatus?.();
   }
 }
 

package/src/server/deny-renderer.ts

@@ -32,7 +32,7 @@ import { resolveMetadata, renderMetadataToElements } from './metadata.ts';
 import { headElementsToReact } from './metadata.ts';
 import { resolveStatusFile } from './status-code-resolver.ts';
 import { defaultStatusPageResponse } from './default-status-page.ts';
-import { rscErrorEnvelope } from '../shared/rsc-error-envelope.ts';
+import { rscErrorEnvelope } from './rsc-error-envelope.ts';
 import type { ManifestSegmentNode } from './route-matcher.ts';
 import type { RouteMatch } from './pipeline.ts';
 import type { NavContext } from './ssr-bridge-types.ts';
@@ -327,8 +327,12 @@ export async function renderDenyPageAsRsc(
   });
 
   responseHeaders.set('content-type', `${RSC_CONTENT_TYPE}; charset=utf-8`);
+  // 200, like every Flight payload response: the deny is the page in the body, and
+  // the client router — the only reader of this status — renders what it is
+  // sent. See design/04-authorization.md §"Status codes on the RSC payload
+  // path" (TIM-1495).
   return new Response(rscStream, {
-    status: deny.status,
+    status: 200,
     headers: responseHeaders,
   });
 }

package/src/server/error-boundary-wrapper.ts

@@ -7,13 +7,11 @@
  *
  *   - `route-element-builder.ts` / `slot-resolver.ts` — the request-time
  *     renderer, walking the runtime manifest (`SegmentNode<ManifestFile>`).
- *   - `tree-builder.ts` — the build-time tree walker
- *     (`SegmentNode<RouteFile>`), with its loader and `createElement` injected.
  *
  * `errorBoundaryComponent` is injected rather than imported: `TimberErrorBoundary`
  * is a `'use client'` module, and importing it here would pull client code into
- * every consumer — including `tree-builder.ts`, which the server barrel reaches.
- * `tests/use-client-pipeline.test.ts` walks the import graph to enforce this.
+ * every consumer. `tests/use-client-pipeline.test.ts` walks the import graph
+ * from this file to enforce that no `client/` module is reachable at any depth.
  *
  * See design/10-error-handling.md §"Status-Code File Variants".
  */
@@ -54,6 +52,21 @@ export interface ErrorBoundaryProps {
    * every owner-addressed deny. See TIM-1356.
    */
   segmentKey?: string;
+  /**
+   * Catch denies only; re-throw every other error. Set on the copy of a
+   * segment's boundaries that sits outside its layout, which exists to give a
+   * deny thrown from the layout's own chrome a catcher at the right position
+   * without changing where a 5xx from that chrome goes. See TIM-1450.
+   */
+  denyOnly?: boolean;
+  /**
+   * The boundary belongs to a parallel slot. A slot degrading is the page
+   * staying: its status pages never set the document status and never tell
+   * the segment cache the main route's chain is gone. Set on every boundary
+   * a slot's files declare, not only the catch-all outside them — the
+   * identity is the slot's, not the file's (codex on #1138).
+   */
+  isSlotBoundary?: boolean;
   children: ReactNode;
 }
 
@@ -75,6 +88,10 @@ export interface ErrorBoundaryWrapConfig<TFile, TElement> {
   errorBoundaryComponent: unknown;
   /** Segment key stamped on every boundary this walk creates. See `ErrorBoundaryProps`. */
   segmentKey?: string;
+  /** Stamped on every boundary this walk creates. See `ErrorBoundaryProps`. */
+  denyOnly?: boolean;
+  /** Stamped on every boundary this walk creates. See `ErrorBoundaryProps`. */
+  isSlotBoundary?: boolean;
 }
 
 /**
@@ -122,6 +139,8 @@ function wrapInBoundary<TFile extends BoundaryFile, TElement extends ReactNode>(
     : { fallbackComponent: Component, children: element };
   if (status !== undefined) props.status = status;
   if (config.segmentKey !== undefined) props.segmentKey = config.segmentKey;
+  if (config.denyOnly) props.denyOnly = true;
+  if (config.isSlotBoundary) props.isSlotBoundary = true;
   return config.createElement(config.errorBoundaryComponent, props);
 }
 

package/src/server/error-response-headers.ts

@@ -0,0 +1,18 @@
+import { preventResponseCaching } from './response-cache-policy.ts';
+
+/** Preserve request-wide metadata when replacing a failed response body. */
+export function errorResponseHeaders(responseHeaders?: Headers): Headers {
+  const headers = new Headers(responseHeaders);
+  // These describe the abandoned body, not the replacement empty/JSON body.
+  headers.delete('Content-Length');
+  headers.delete('Content-Encoding');
+  headers.delete('Transfer-Encoding');
+  // A transient failure must not inherit the success page's cache lifetime
+  // or validators, including CDN overrides of Cache-Control.
+  preventResponseCaching(headers);
+  headers.delete('ETag');
+  headers.delete('Last-Modified');
+  headers.delete('Expires');
+  headers.delete('Age');
+  return headers;
+}

package/src/server/internal.ts

@@ -60,21 +60,13 @@ export type { ProxyFn, ProxyExport } from './proxy.ts';
 export { runMiddleware } from './middleware-runner.ts';
 export type { MiddlewareFn } from './middleware-runner.ts';
 
-// ── Tree Builder ─────────────────────────────────────────────────────────
-export { buildElementTree } from './tree-builder.ts';
-export type {
-  TreeBuilderConfig,
-  TreeBuildResult,
-  LoadedModule,
-  ModuleLoader,
-  AccessGateProps,
-  SlotAccessGateProps,
-} from './tree-builder.ts';
+// ── Element Tree Types ──────────────────────────────────────────────────
 export type { LoadedComponent } from './utils/element-type.ts';
 export type { ErrorBoundaryProps } from './error-boundary-wrapper.ts';
 
 // ── Access Gates ─────────────────────────────────────────────────────────
 export { AccessGate, SlotAccessGate } from './access-gate.tsx';
+export type { AccessGateProps, SlotAccessGateProps, CreateElement } from './access-gate.tsx';
 
 // ── Status-Code Resolver ─────────────────────────────────────────────────
 export { resolveStatusFile, resolveSlotDenied } from './status-code-resolver.ts';

package/src/server/metadata-collector.ts

@@ -64,9 +64,6 @@ interface MetadataSettleProps {
  * children. Its sole job is error ownership: awaiting the metadata
  * promise so that rejections surface at THIS tree position (caught by
  * the owning segment's error boundary, not MetadataHead's).
- *
- * Shell settlement (onSettled) is handled by the collector attaching
- * directly to the promise — unconditional on render progress.
  */
 async function MetadataSettle(props: MetadataSettleProps): Promise<ReactNode> {
   await props.promise;
@@ -79,7 +76,6 @@ export interface MetadataCollectorProps {
   metadataExport: Metadata | (() => Promise<Metadata>);
   segmentName: string;
   isPage: boolean;
-  onSettled?: () => void;
   children: ReactNode;
 }
 
@@ -92,13 +88,11 @@ export interface MetadataCollectorProps {
  * Static metadata objects are pushed synchronously (no side effects).
  * Dynamic metadata functions are started (not awaited) and pushed as
  * promises — React descends into children immediately while the I/O
- * runs concurrently (TIM-1367). Shell settlement (onSettled) is
- * attached directly to the promise so it fires unconditionally. A
- * sibling MetadataSettle component awaits the promise for error
- * ownership only.
+ * runs concurrently (TIM-1367). A sibling MetadataSettle component
+ * awaits the promise for error ownership.
  */
 export function MetadataCollector(props: MetadataCollectorProps): ReactNode {
-  const { metadataExport, segmentName, isPage, onSettled, children } = props;
+  const { metadataExport, segmentName, isPage, children } = props;
 
   if (typeof metadataExport === 'function') {
     const promise = withSpan('timber.metadata', { 'timber.segment': segmentName }, () =>
@@ -108,14 +102,6 @@ export function MetadataCollector(props: MetadataCollectorProps): ReactNode {
     // both attach handlers, but a fast-rejecting promise can fire
     // Node's unhandledRejection before they do.
     promise.catch(() => {});
-    // Shell settlement: unconditional on render progress. If React
-    // never reaches MetadataSettle (e.g., parent error boundary fires
-    // first), the HTTP status still commits on time.
-    if (onSettled)
-      promise.then(
-        () => onSettled(),
-        () => onSettled()
-      );
 
     getDeferredMetadataEntries().push({ metadata: promise, isPage });
 
@@ -123,7 +109,6 @@ export function MetadataCollector(props: MetadataCollectorProps): ReactNode {
   }
 
   getDeferredMetadataEntries().push({ metadata: metadataExport, isPage });
-  onSettled?.();
   return children;
 }
 

package/src/server/param-coercion.ts

@@ -7,9 +7,9 @@
  * the revalidation renderer in `rsc-entry/index.ts`) without pulling
  * the entire pipeline phase module along with it.
  *
- * The function throws `ParamCoercionError` from `route-element-builder.ts`
- * on any codec failure; the pipeline catches that and dispatches to the
- * 404 page. See design/07-routing.md §"Where Coercion Runs".
+ * The function throws `ParamCoercionError` (defined below) on any codec
+ * failure; the pipeline catches that and dispatches to the 404 page.
+ * See design/07-routing.md §"Where Coercion Runs".
  */
 
 import type { Codec } from '../codec.ts';
@@ -18,7 +18,16 @@ import { effectiveUrlSegment } from '../routing/segment-classify.ts';
 import { toBracketKey } from '../params/resolve-schema.ts';
 import type { RouteMatch } from './pipeline.ts';
 import { normalizeParamValue, type CoercedParams } from '../shared/param-value.ts';
-import { ParamCoercionError } from './route-element-builder.ts';
+/**
+ * Thrown when an app/schema.ts segment-param codec's parse() fails.
+ * The pipeline catches this and responds with 404.
+ */
+export class ParamCoercionError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ParamCoercionError';
+  }
+}
 import { isDebug } from './debug.ts';
 
 // ---------------------------------------------------------------------------

package/src/server/pipeline-outcome.ts

@@ -26,15 +26,40 @@ import {
 import { markResponseFlushed } from './request-context.ts';
 import { RedirectSignal, DenySignal } from './primitives.ts';
 import { isDebug } from './debug.ts';
-import { rscErrorEnvelope } from '../shared/rsc-error-envelope.ts';
+import { errorResponseHeaders } from './error-response-headers.ts';
+import { rscErrorEnvelope } from './rsc-error-envelope.ts';
 import { isRscRequest } from '../shared/rsc-media-type.ts';
 import type { PipelineConfig, RouteMatch } from './pipeline.ts';
 
 // ─── Helpers ───────────────────────────────────────────────────────────────
 
-function rscErrorResponse(isRsc: boolean, status: number, headers?: Headers): Response {
-  if (!isRsc) return new Response(null, { status });
-  return rscErrorEnvelope(status, headers);
+function rscErrorResponse(isRsc: boolean, status: number, headers: Headers): Response {
+  if (isRsc) return rscErrorEnvelope(status, headers);
+  return new Response(null, { status, headers: errorResponseHeaders(headers) });
+}
+
+/**
+ * Resolve the header bag a signal/error outcome is written onto, with the
+ * cookie jar applied exactly once.
+ *
+ * Ownership rule (design/49 §P0b): the phase that owns `responseHeaders`
+ * applies the jar to it once; the translator applies it only for outcomes
+ * that arrive without it. Render-phase outcomes already carry the jar —
+ * `runRenderPhase()` applies it on entry, with or without a middleware
+ * chain — so re-applying here emitted every middleware `Set-Cookie` twice
+ * (TIM-1491).
+ *
+ * The guard is "not render", not "only middleware": proxy-phase signals
+ * reach the translator with no `responseHeaders` at all, and for a
+ * `proxy.ts` that awaits `next()` and then throws, this is the only place
+ * the cookies downstream middleware set can reach the wire
+ * (design/29-cookies.md §"proxy.ts Cookie Access"). Middleware-phase
+ * signals throw before that phase's own application, so they need it too.
+ */
+function outcomeHeaders(outcome: PhaseOutcome, ctx: OutcomeContext): Headers {
+  const headers = ctx.responseHeaders ?? new Headers();
+  if (outcome.phase !== 'render') applyCookieJar(headers);
+  return headers;
 }
 
 // ─── Phase Outcome ─────────────────────────────────────────────────────────
@@ -100,14 +125,12 @@ export async function outcomeToResponse(
     }
 
     case 'redirect': {
-      const headers = ctx.responseHeaders ?? new Headers();
-      applyCookieJar(headers);
+      const headers = outcomeHeaders(outcome, ctx);
       return buildRedirectResponse(outcome.signal, ctx.req, headers);
     }
 
     case 'deny': {
-      const headers = ctx.responseHeaders ?? new Headers();
-      applyCookieJar(headers);
+      const headers = outcomeHeaders(outcome, ctx);
       if (config.renderDenyFallback) {
         try {
           // Clone user-supplied deny-page responses so downstream
@@ -149,7 +172,7 @@ export async function outcomeToResponse(
         await fireOnRequestError(outcome.error, ctx.req, 'proxy');
         if (config.onPipelineError && outcome.error instanceof Error)
           config.onPipelineError(outcome.error, 'proxy');
-        return rscErrorResponse(isRsc, 500);
+        return rscErrorResponse(isRsc, 500, outcomeHeaders(outcome, ctx));
       }
 
       if (outcome.phase === 'middleware') {
@@ -158,11 +181,10 @@ export async function outcomeToResponse(
         if (config.onPipelineError && outcome.error instanceof Error) {
           config.onPipelineError(outcome.error, 'middleware');
         }
-        return rscErrorResponse(isRsc, 500);
+        return rscErrorResponse(isRsc, 500, outcomeHeaders(outcome, ctx));
       }
 
-      const headers = ctx.responseHeaders ?? new Headers();
-      applyCookieJar(headers);
+      const headers = outcomeHeaders(outcome, ctx);
       logRenderError({ method: ctx.method, path: ctx.path, error: outcome.error });
       await fireOnRequestError(outcome.error, ctx.req, 'render');
       if (config.onPipelineError && outcome.error instanceof Error)
@@ -190,7 +212,7 @@ export async function outcomeToResponse(
             config.onPipelineError(fallbackRenderError, 'render');
         }
       }
-      return new Response(null, { status: 500 });
+      return rscErrorResponse(false, 500, headers);
     }
   }
 }

package/src/server/pipeline-phases.ts

@@ -25,8 +25,8 @@ import {
 import { withSpan } from './tracing.ts';
 import { requestCspNonce } from './csp-nonce.ts';
 import { logRenderError } from './logger.ts';
-import { RedirectSignal, DenySignal } from './primitives.ts';
-import { ParamCoercionError } from './route-element-builder.ts';
+import { isDenySignal, isRedirectSignal } from './primitives.ts';
+import { ParamCoercionError } from './param-coercion.ts';
 import { checkVersionSkew, applyReloadHeaders } from './version-skew.ts';
 import { serveStaticMetadataFile, serializeSitemap } from './pipeline-metadata.ts';
 import { loadModule } from './safe-load.ts';
@@ -96,10 +96,10 @@ export async function runProxyPhase(
     );
     return { kind: 'response', phase: 'proxy', response };
   } catch (error) {
-    if (error instanceof RedirectSignal) {
+    if (isRedirectSignal(error)) {
       return { kind: 'redirect', phase: 'proxy', signal: error };
     }
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       return { kind: 'deny', phase: 'proxy', signal: error };
     }
     return { kind: 'error', phase: 'proxy', error };
@@ -169,18 +169,12 @@ export async function runMiddlewarePhase(
     // injected request headers so getHeaders() returns them downstream.
     applyRequestHeaderOverlay(requestHeaderOverlay);
 
-    // Apply cookie jar to response headers before render commits them.
-    // This preserves the historical ordering where middleware cookie writes
-    // are visible to route-handler header merging, while handler Set-Cookie
-    // values still come after middleware cookies and therefore take precedence.
-    applyCookieJar(responseHeaders);
-
     return runRenderPhase(config, req, match, responseHeaders, requestHeaderOverlay, renderContext);
   } catch (error) {
-    if (error instanceof RedirectSignal) {
+    if (isRedirectSignal(error)) {
       return { kind: 'redirect', phase: 'middleware', signal: error };
     }
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       return { kind: 'deny', phase: 'middleware', signal: error };
     }
     return { kind: 'error', phase: 'middleware', error };
@@ -192,6 +186,17 @@ export async function runMiddlewarePhase(
 /**
  * Run the render phase. Wraps the configured renderer in a span and a
  * timing scope, and translates thrown signals into outcome variants.
+ *
+ * The render phase owns `responseHeaders` from here on, so it is the one
+ * place the cookie jar is applied to that bag (design/29-cookies.md
+ * §"Applied Exactly Once"). Doing it here rather than in the middleware
+ * phase means every render-phase outcome — a 200, or a deny / redirect /
+ * error thrown from render — carries the jar whether or not a middleware
+ * chain ran, and `outcomeToResponse` can skip render-phase outcomes
+ * unconditionally (TIM-1491). Application precedes `config.render` so
+ * middleware cookie writes are visible to route-handler header merging,
+ * while handler `Set-Cookie` values still come after them and take
+ * precedence.
  */
 export async function runRenderPhase(
   config: PipelineConfig,
@@ -202,6 +207,7 @@ export async function runRenderPhase(
   { canonicalPathname, interception }: RenderContext
 ): Promise<PhaseOutcome> {
   const detailed = config.serverTiming === 'detailed';
+  applyCookieJar(responseHeaders);
   try {
     const renderFn = () =>
       config.render(req, match, responseHeaders, requestHeaderOverlay, interception);
@@ -210,10 +216,10 @@ export async function runRenderPhase(
     );
     return { kind: 'response', phase: 'render', response };
   } catch (error) {
-    if (error instanceof DenySignal) {
+    if (isDenySignal(error)) {
       return { kind: 'deny', phase: 'render', signal: error };
     }
-    if (error instanceof RedirectSignal) {
+    if (isRedirectSignal(error)) {
       return { kind: 'redirect', phase: 'render', signal: error };
     }
     return { kind: 'error', phase: 'render', error };
@@ -331,13 +337,13 @@ export async function handleRequest(
         // calls deny(404) for an unknown tenant, or a dynamic icon that
         // redirects to a CDN-hosted asset) translate to proper HTTP responses
         // instead of being logged as 500s.
-        if (error instanceof RedirectSignal) {
+        if (isRedirectSignal(error)) {
           return new Response(null, {
             status: error.status,
             headers: { Location: error.location },
           });
         }
-        if (error instanceof DenySignal) {
+        if (isDenySignal(error)) {
           return new Response(null, { status: error.status });
         }
         logRenderError({ method, path, error });