@timber-js/app 0.2.0-alpha.200 → 0.2.0-alpha.201

package/src/routing/convention-lint.ts

@@ -17,10 +17,9 @@
  * Design doc: 07-routing.md, 10-error-handling.md
  */
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import type { RouteFile, RouteTree, SegmentNode } from './types.ts';
 import { swallow } from '../server/logger.ts';
-import { isMdxFilePath } from '../server/utils/mdx-file.ts';
 import {
   fileDefaultExportIsLocalValue,
   fileHasAnyExport,
@@ -80,11 +79,6 @@ export function lintConventions(tree: RouteTree, appDir: string): ConventionWarn
     checkFileUseClientDirective(tree.globalError, 'global-error', warnings);
   }
 
-  // Check 8: Wildcard MDX status files (4xx.mdx, 5xx.mdx, error.mdx) that
-  // reference `props` — props resolve on deny and throw paths but are empty
-  // on the boundary path. See design/10-error-handling.md §"MDX Props by Path".
-  checkWildcardMdxProps(tree.root, warnings);
-
   return warnings;
 }
 
@@ -335,10 +329,6 @@ function checkFileDefaultExport(
  * error path. The raw message ("Functions cannot be passed directly to Client
  * Components") names neither the file nor the fix (TIM-1329).
  *
- * MDX status files are exempt: they are server components by design and the
- * renderer pre-renders them into `fallbackElement` instead. See TIM-503 and
- * `server/error-boundary-wrapper.ts`.
- *
  * `.json` status files never reach React at all, and are not in `statusFiles`.
  */
 function checkClientBoundaryFiles(node: SegmentNode, warnings: ConventionWarning[]): void {
@@ -392,17 +382,9 @@ function checkFileUseClientDirective(
   convention: string,
   warnings: ConventionWarning[]
 ): void {
-  // MDX/markdown status and error files are server components by design — the
-  // renderer pre-renders them into `fallbackElement`, so they never cross the
-  // boundary as a function.
-  //
-  // The exemption is the *complement* of the renderer's own test, using the
-  // renderer's own helper: everything `error-boundary-wrapper.ts` and
-  // `error-renderer.ts` do not treat as MDX, they pass as a component. An
-  // independent "is this a script extension?" list here would be a second
-  // expression of that fact, free to drift into a gap where a file is a
-  // component to the renderer and exempt to the linter.
-  if (isMdxFilePath(file.filePath)) return;
+  // Only script extensions need the 'use client' check — .json status files
+  // never reach React at all, and are not in `statusFiles`.
+  if (!isScriptExtension(file.extension)) return;
 
   const filePath = file.filePath;
   const label = `${convention}.${file.extension}`;
@@ -449,95 +431,6 @@ function checkFileUseClientDirective(
   });
 }
 
-// ─── Check: Wildcard MDX Props ──────────────────────────────────────────────
-
-/**
- * Wildcard status file keys in `statusFiles` whose props differ by path.
- * `error` is not here — the scanner stores it in `node.error`, not
- * `node.statusFiles`, and the check handles it separately below.
- */
-const WILDCARD_MDX_STATUS_KEYS = new Set(['4xx', '5xx']);
-
-/**
- * Warn when a wildcard MDX status file (`4xx.mdx`, `5xx.mdx`, `error.mdx`)
- * appears to reference `props` in its source.
- *
- * These files are pre-rendered into `fallbackElement` on the error-boundary
- * path, before the error happens, so they receive empty or partial props.
- * On the deny and error-renderer paths they receive the real props. An author
- * writing `{props.status}` gets the number on some paths and `undefined` on
- * others — same source, different output.
- *
- * A text scan for `props` is acceptable here because the check is `level:
- * 'warn'` — a false positive costs a printed line, not a refused build. A
- * sound check would need the MDX compiler, which is optional, async, and
- * scoped to the RSC environment. See TIM-1333.
- *
- * Exact-code MDX files (e.g. `503.mdx`) are unaffected — all four paths
- * agree on their status.
- */
-function checkWildcardMdxProps(node: SegmentNode, warnings: ConventionWarning[]): void {
-  if (node.statusFiles) {
-    for (const [key, file] of Object.entries(node.statusFiles)) {
-      if (WILDCARD_MDX_STATUS_KEYS.has(key) && isMdxFilePath(file.filePath)) {
-        checkMdxFileForProps(file.filePath, key, warnings);
-      }
-    }
-  }
-  if (node.error && isMdxFilePath(node.error.filePath)) {
-    checkMdxFileForProps(node.error.filePath, 'error', warnings);
-  }
-
-  for (const child of node.children) {
-    checkWildcardMdxProps(child, warnings);
-  }
-  for (const slot of Object.values(node.slots)) {
-    checkWildcardMdxProps(slot, warnings);
-  }
-}
-
-/**
- * Check if an MDX file's source appears to reference `props`.
- *
- * MDX passes a `props` object to the default export function. A reference to
- * `props.status` or `props.dangerouslyPassData` in a wildcard file works on
- * the deny/throw paths but renders `undefined` on the boundary path.
- */
-function checkMdxFileForProps(
-  filePath: string,
-  convention: string,
-  warnings: ConventionWarning[]
-): void {
-  let source: string;
-  try {
-    source = readFileSync(filePath, 'utf-8');
-  } catch {
-    return;
-  }
-
-  // MDX exposes props via the default export: export default function(props) { ... }
-  // and via JSX expressions: {props.status}. A text scan is intentionally
-  // broad — false positives are cheap at warn level.
-  if (!/\bprops\b/.test(source)) return;
-
-  const label = `${convention}.${filePath.endsWith('.md') ? 'md' : 'mdx'}`;
-  warnings.push({
-    id: `MDX_WILDCARD_PROPS:${filePath}`,
-    summary: `${label} references props, which are empty on the error boundary path: ${filePath}`,
-    details:
-      `  File: ${filePath}\n\n` +
-      `  Wildcard MDX status files (${convention}.mdx) are pre-rendered into\n` +
-      '  fallbackElement before the error occurs. On that path, props are\n' +
-      `  empty${convention === 'error' ? '' : ' (no status, no dangerouslyPassData)'}. On the deny() and error-renderer\n` +
-      '  paths, props.status resolves correctly.\n\n' +
-      '  If this file uses only static content and "props" appears in prose,\n' +
-      '  this warning is a false positive — ignore it.\n\n' +
-      '  To fix: Use only static content in wildcard MDX status files, or\n' +
-      '  use an exact-code file (e.g. 404.mdx) where all paths agree.\n',
-    level: 'warn',
-  });
-}
-
 // ─── Check: App Directory Exists ────────────────────────────────────────────
 
 /**

package/src/routing/scanner.ts

@@ -29,8 +29,9 @@ import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.ts';
 
 /**
  * File convention names that use pageExtensions (can be .tsx, .ts, .jsx, .js, .mdx, etc.)
+ * `error` is excluded — it only accepts script extensions (TIM-1505).
  */
-const PAGE_EXT_CONVENTIONS = new Set(['page', 'layout', 'error', 'default', 'denied']);
+const PAGE_EXT_CONVENTIONS = new Set(['page', 'layout', 'default', 'denied']);
 
 /**
  * File convention names that are always .ts/.tsx (never .mdx etc.)
@@ -46,10 +47,10 @@ const STATUS_CODE_PATTERN = /^(\d{3}|[45]xx)$/;
 
 /**
  * Whether a basename + extension pair is a route-convention file the
- * framework itself imports: page/layout/error/default/denied and
- * global-error on pageExtensions, middleware/access/route/proxy on
- * .ts/.tsx/.js/.jsx only, and status-code files (404, 4xx, …) on
- * pageExtensions or .json — mirroring this scanner's own recognition
+ * framework itself imports: page/layout/default/denied on pageExtensions,
+ * error/global-error and status-code files on script extensions only,
+ * middleware/access/route/proxy on .ts/.tsx/.js/.jsx only, and
+ * status-code .json files — mirroring this scanner's own recognition
  * rules per family.
  *
  * Exported for the analyze classifier so its provisional classification
@@ -62,9 +63,11 @@ export function isRouteConventionFile(
   pageExtensions: readonly string[] = DEFAULT_PAGE_EXTENSIONS
 ): boolean {
   const isPageExt = pageExtensions.includes(ext);
-  if ((PAGE_EXT_CONVENTIONS.has(base) || base === 'global-error') && isPageExt) return true;
-  if ((FIXED_CONVENTIONS.has(base) || base === 'proxy') && /^[jt]sx?$/.test(ext)) return true;
-  if (STATUS_CODE_PATTERN.test(base) && (isPageExt || ext === 'json')) return true;
+  const isScriptExt = /^[jt]sx?$/.test(ext);
+  if (PAGE_EXT_CONVENTIONS.has(base) && isPageExt) return true;
+  if ((base === 'error' || base === 'global-error') && isScriptExt) return true;
+  if ((FIXED_CONVENTIONS.has(base) || base === 'proxy') && isScriptExt) return true;
+  if (STATUS_CODE_PATTERN.test(base) && (isScriptExt || ext === 'json')) return true;
   return false;
 }
 
@@ -91,8 +94,9 @@ export function scanRoutes(appDir: string, config: ScannerConfig = {}): RouteTre
 
   // Check for global-error.{tsx,ts,jsx,js} at app root.
   // Tier 2 error page — renders standalone (no layouts) when no segment-level
-  // error file is found. See design/10-error-handling.md §"Tier 2".
-  const globalErrorFile = findPageExtFile(appDir, 'global-error', extSet);
+  // error file is found. Script extensions only — MDX not supported (TIM-1505).
+  // See design/10-error-handling.md §"Tier 2".
+  const globalErrorFile = findScriptExtFile(appDir, 'global-error');
   if (globalErrorFile) {
     tree.globalError = globalErrorFile;
   }
@@ -197,9 +201,9 @@ function scanSegmentFiles(dirPath: string, node: SegmentNode, extSet: Set<string
     const ext = extname(entry).slice(1); // remove leading dot
     const name = basename(entry, `.${ext}`);
 
-    // Page-extension conventions (page, layout, error, default, denied)
+    // Page-extension conventions (page, layout, default, denied)
     if (PAGE_EXT_CONVENTIONS.has(name) && extSet.has(ext)) {
-      const key = name as 'page' | 'layout' | 'error' | 'default' | 'denied';
+      const key = name as 'page' | 'layout' | 'default' | 'denied';
       const existing = node[key];
       if (existing) {
         throwDuplicateConvention(name, existing.filePath, fullPath);
@@ -208,6 +212,16 @@ function scanSegmentFiles(dirPath: string, node: SegmentNode, extSet: Set<string
       continue;
     }
 
+    // error.tsx — script extensions only, not MDX/MD (TIM-1505).
+    if (name === 'error' && /^[jt]sx?$/.test(ext)) {
+      const existing = node.error;
+      if (existing) {
+        throwDuplicateConvention('error', existing.filePath, fullPath);
+      }
+      node.error = { filePath: fullPath, extension: ext };
+      continue;
+    }
+
     // Fixed conventions (middleware, access, route) — only
     // .ts/.tsx/.js/.jsx, never pageExtensions like .mdx. The regex is
     // anchored: mts/cts/mjs/cjs (and stray tail matches like `.foots`)
@@ -232,8 +246,8 @@ function scanSegmentFiles(dirPath: string, node: SegmentNode, extSet: Set<string
       continue;
     }
 
-    // Status-code files (401.tsx, 4xx.tsx, 503.tsx, 5xx.tsx)
-    if (STATUS_CODE_PATTERN.test(name) && extSet.has(ext)) {
+    // Status-code files (401.tsx, 4xx.tsx, 503.tsx, 5xx.tsx) — script extensions only (TIM-1505)
+    if (STATUS_CODE_PATTERN.test(name) && /^[jt]sx?$/.test(ext)) {
       if (!node.statusFiles) {
         node.statusFiles = {};
       }
@@ -652,15 +666,12 @@ function findFixedFile(dirPath: string, name: string): RouteFile | undefined {
 }
 
 /**
- * Find a file using the configured page extensions (tsx, ts, jsx, js, mdx, etc.).
- * Used for app-root conventions like global-error that aren't per-segment.
+ * Find a file with script extensions (tsx, ts, jsx, js) in a directory.
+ * Used for app-root conventions like global-error that only accept script
+ * extensions (TIM-1505).
  */
-function findPageExtFile(
-  dirPath: string,
-  name: string,
-  extSet: Set<string>
-): RouteFile | undefined {
-  for (const ext of extSet) {
+function findScriptExtFile(dirPath: string, name: string): RouteFile | undefined {
+  for (const ext of ['tsx', 'ts', 'jsx', 'js']) {
     const fullPath = join(dirPath, `${name}.${ext}`);
     try {
       if (statSync(fullPath).isFile()) {

package/src/server/access-gate.tsx

@@ -86,7 +86,7 @@ export interface AccessGateProps {
  * On denial, renders denied.tsx → default.tsx → null instead of failing the page.
  *
  * DeniedComponent is passed instead of a pre-built element so that
- * SlotAccessGate can forward DenySignal.data as dangerouslyPassData
+ * SlotAccessGate can forward DenySignal.data as the data prop
  * and slotName as the slot prop after catching the signal.
  */
 export interface SlotAccessGateProps {
@@ -205,7 +205,7 @@ async function accessGateFallback(
  * a protocol concern. The parent layout and sibling slots still render.
  *
  * DeniedComponent is passed instead of a pre-built element so that
- * DenySignal.data can be forwarded as the dangerouslyPassData prop
+ * DenySignal.data can be forwarded as the data prop
  * and the slot name can be passed as the slot prop. See TIM-488.
  *
  * redirect() in slot access.ts is a dev-mode error — redirecting from a
@@ -276,6 +276,6 @@ function buildDeniedFallback(
   if (!DeniedComponent) return null;
   return createElement(DeniedComponent, {
     slot: slotName,
-    dangerouslyPassData: data,
+    data,
   });
 }

package/src/server/deny-boundary.ts

@@ -44,7 +44,6 @@ import { loadModule } from './safe-load.ts';
 import type { ManifestLoader } from './safe-load.ts';
 import { withSpan } from './tracing.ts';
 import { isValidElementType, type LoadedComponent } from './utils/element-type.ts';
-import { isMdxFilePath } from './utils/mdx-file.ts';
 import type { ManifestSegmentNode } from './route-matcher.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
@@ -61,8 +60,6 @@ export interface DenyPageEntry {
    * { error, digest, reset } contract, not bare deny props. See TIM-1081.
    */
   kind: 'status' | 'error';
-  /** MDX files are server components — rendered with plain props, never ErrorReconstituter. */
-  isMdx: boolean;
   /**
    * Position in the segment chain (0 = root, ascending toward leaf).
    * Used by `matchDenyEntry` to reconstruct per-segment ordering for 5xx
@@ -105,7 +102,7 @@ export interface DenyPageEntry {
  * resolution that already carries the position, and would otherwise have to
  * invent an owner it never reads.
  */
-export type DenyEntryShape = Pick<DenyPageEntry, 'component' | 'kind' | 'isMdx'>;
+export type DenyEntryShape = Pick<DenyPageEntry, 'component' | 'kind'>;
 
 /**
  * Where a matched deny page must render, relative to the catcher that
@@ -185,7 +182,6 @@ export async function buildDenyPageChain(
               status,
               component,
               kind: 'status',
-              isMdx: isMdxFilePath(file.filePath),
               segmentIndex: i,
               ownerKey: segmentKeys[i],
             });
@@ -204,7 +200,6 @@ export async function buildDenyPageChain(
             status: categoryStatus,
             component,
             kind: 'status',
-            isMdx: isMdxFilePath(file.filePath),
             segmentIndex: i,
             ownerKey: segmentKeys[i],
           });
@@ -225,7 +220,6 @@ export async function buildDenyPageChain(
           status: null,
           component,
           kind: 'error',
-          isMdx: isMdxFilePath(segment.error.filePath),
           segmentIndex: i,
           ownerKey: segmentKeys[i],
         });
@@ -333,13 +327,6 @@ export function placeDenyPage(
   if (!entry) return null;
 
   if (entry.ownerKey !== selfKey) {
-    // An MDX owner cannot be addressed. Its boundary holds a `fallbackElement`
-    // pre-rendered at tree-build time — before this status or its data
-    // existed — so hoisting to it would render a page that never learns what
-    // was denied (a category `4xx.mdx` gets no `status` prop at all). Leave it
-    // unaddressed so the re-render fallback serves it, which is the documented
-    // MDX path and resolves the position correctly on its own. See TIM-503.
-    if (entry.isMdx) return null;
     return { kind: 'hoist', ownerKey: entry.ownerKey };
   }
 
@@ -352,9 +339,9 @@ export function placeDenyPage(
  * Build the element for a matched deny chain entry with the props contract
  * the file's convention documents:
  *
- * - Status-code files: { status, dangerouslyPassData }
+ * - Status-code files: { status, data }
  * - error.tsx (TSX): { error, digest, reset } via ErrorReconstituter, plus
- *   { status, dangerouslyPassData } for dual-shape implementations. Without
+ *   { status, data } for dual-shape implementations. Without
  *   the Error prop, any error.tsx written per the docs (reading
  *   error.message) crashes — turning a clean deny(404) into a 500. TIM-1081.
  * - error.mdx: plain { status } — server component, static content.
@@ -379,12 +366,7 @@ function renderDenyPage(
   h: (...args: unknown[]) => React.ReactElement
 ): React.ReactElement {
   if (entry.kind !== 'error') {
-    return h(entry.component, { status, dangerouslyPassData: data });
-  }
-
-  // MDX error pages receive plain props — no Error serialization possible.
-  if (entry.isMdx) {
-    return h(entry.component, { status });
+    return h(entry.component, { status, data });
   }
 
   // The message is derived solely from the status code (already on the
@@ -400,7 +382,7 @@ function renderDenyPage(
     reset: undefined,
     component: entry.component,
     status,
-    dangerouslyPassData: data,
+    data,
   });
 }
 

package/src/server/deny-renderer.ts

@@ -26,7 +26,6 @@ import { renderDenyEntry, type DenyEntryShape } from './deny-boundary.ts';
 import { getCookiesForSsr } from './cookie-context.ts';
 import { logRenderError } from './logger.ts';
 import { loadModule } from './safe-load.ts';
-import { isMdxFilePath } from './utils/mdx-file.ts';
 import { isDebug } from './debug.ts';
 import { resolveMetadata, renderMetadataToElements } from './metadata.ts';
 import { headElementsToReact } from './metadata.ts';
@@ -51,7 +50,6 @@ export interface LayoutEntry {
 
 /** Callback to create a debug channel sink for RSC rendering. */
 export type DebugChannelFactory = () => {
-  readable: ReadableStream;
   writable: WritableStream;
 };
 
@@ -86,7 +84,6 @@ function buildDenyElement(
   const entry: DenyEntryShape = {
     component,
     kind: resolutionKind === 'error' ? 'error' : 'status',
-    isMdx: isMdxFilePath(filePath),
   };
   return renderDenyEntry(entry, deny.status, deny.data);
 }
@@ -183,7 +180,7 @@ export async function renderDenyPage(
   const ErrorPageComponent = mod.default as (...args: unknown[]) => unknown;
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  // 4xx status-code pages receive { status, dangerouslyPassData }; an
+  // 4xx status-code pages receive { status, data }; an
   // error.tsx match gets { error, digest, reset } via ErrorReconstituter.
   // See design/10-error-handling.md §"Status-Code File Props" and TIM-1081.
   let element = buildDenyElement(
@@ -365,9 +362,9 @@ async function renderDenyPageJson(
   // A .json status file that fails to load is not a usable match — return
   // null so the caller continues to the framework default rather than
   // rejecting out of the chain.
-  // Dev warning: deny(status, data) carries data but JSON status files are
-  // static bodies — the data is silently dropped. The same deny() would
-  // deliver the data to a .tsx file's dangerouslyPassData prop. See
+  // Dev warning: deny(status, { dangerouslyPassData }) carries data but JSON
+  // status files are static bodies — the data is silently dropped. The same
+  // deny() would deliver the data to a .tsx file's data prop. See
   // design/10-error-handling.md §"Status-Code File Variants".
   if (isDebug() && deny.data !== undefined) {
     console.warn(

package/src/server/error-boundary-wrapper.ts

@@ -2,11 +2,10 @@
  * Error boundary wrapper — wraps a React element in the error boundaries
  * declared by a route segment (`{status}.tsx`, `4xx.tsx`/`5xx.tsx`, `error.tsx`).
  *
- * This is the single implementation of that walk. It is driven by both
- * construction sites:
+ * This is the single implementation of that walk. It is driven by the
+ * request-time renderer walking the runtime manifest (`SegmentNode<ManifestFile>`):
  *
- *   - `route-element-builder.ts` / `slot-resolver.ts` — the request-time
- *     renderer, walking the runtime manifest (`SegmentNode<ManifestFile>`).
+ *   - `route-element-builder.ts` / `slot-resolver.ts`
  *
  * `errorBoundaryComponent` is injected rather than imported: `TimberErrorBoundary`
  * is a `'use client'` module, and importing it here would pull client code into
@@ -19,12 +18,6 @@
 import type { ReactNode } from 'react';
 import type { SegmentNode } from '../routing/types.ts';
 import { isValidElementType, type LoadedComponent } from './utils/element-type.ts';
-import { isMdxFilePath } from './utils/mdx-file.ts';
-
-/** The minimum a route file must carry for the walk: a path to classify as MDX. */
-interface BoundaryFile {
-  filePath: string;
-}
 
 /**
  * Framework-injected error boundary wrapper.
@@ -36,10 +29,8 @@ interface BoundaryFile {
  * construction site and may not import types from a 'use client' module.
  */
 export interface ErrorBoundaryProps {
-  /** The component to render when an error is caught (TSX status files). */
+  /** The component to render when an error is caught. */
   fallbackComponent?: LoadedComponent;
-  /** Pre-rendered fallback element (MDX status files — see TIM-503). */
-  fallbackElement?: ReactNode;
   /** Status code filter: 400 = any 4xx, 500 = any 5xx, specific number = exact match. */
   status?: number;
   /**
@@ -119,24 +110,15 @@ async function loadBoundaryComponent<TFile>(
 /**
  * Wrap `element` in one error boundary rendering `Component` on failure.
  *
- * MDX status files are server components and cannot be passed as function
- * props to `TimberErrorBoundary` (a 'use client' component). They are
- * pre-rendered as elements and passed as `fallbackElement` instead. See TIM-503.
- *
- * @param status      boundary status filter — omitted entirely for `error.tsx`
- * @param fallbackProps props handed to an MDX fallback when it is pre-rendered
+ * @param status boundary status filter — omitted entirely for `error.tsx`
  */
-function wrapInBoundary<TFile extends BoundaryFile, TElement extends ReactNode>(
+function wrapInBoundary<TFile, TElement extends ReactNode>(
   element: TElement,
   Component: LoadedComponent,
-  file: TFile,
   status: number | undefined,
-  fallbackProps: object,
   config: ErrorBoundaryWrapConfig<TFile, TElement>
 ): TElement {
-  const props: ErrorBoundaryProps = isMdxFilePath(file.filePath)
-    ? { fallbackElement: config.createElement(Component, fallbackProps), children: element }
-    : { fallbackComponent: Component, children: element };
+  const props: ErrorBoundaryProps = { fallbackComponent: Component, children: element };
   if (status !== undefined) props.status = status;
   if (config.segmentKey !== undefined) props.segmentKey = config.segmentKey;
   if (config.denyOnly) props.denyOnly = true;
@@ -158,10 +140,7 @@ function wrapInBoundary<TFile extends BoundaryFile, TElement extends ReactNode>(
  *
  * See design/10-error-handling.md §"Format-Aware Fallback Chains".
  */
-export async function wrapSegmentWithErrorBoundaries<
-  TFile extends BoundaryFile,
-  TElement extends ReactNode,
->(
+export async function wrapSegmentWithErrorBoundaries<TFile, TElement extends ReactNode>(
   segment: SegmentNode<TFile>,
   element: TElement,
   config: ErrorBoundaryWrapConfig<TFile, TElement>
@@ -176,7 +155,7 @@ export async function wrapSegmentWithErrorBoundaries<
       if (isNaN(status)) continue;
       const Component = await loadBoundaryComponent(file, loadModule);
       if (Component) {
-        element = wrapInBoundary(element, Component, file, status, { status }, config);
+        element = wrapInBoundary(element, Component, status, config);
       }
     }
 
@@ -186,19 +165,16 @@ export async function wrapSegmentWithErrorBoundaries<
       const Component = await loadBoundaryComponent(file, loadModule);
       if (Component) {
         const categoryStatus = key === '4xx' ? 400 : 500;
-        element = wrapInBoundary(element, Component, file, categoryStatus, {}, config);
+        element = wrapInBoundary(element, Component, categoryStatus, config);
       }
     }
   }
 
   // error.tsx (outermost — catches anything not matched by status files).
-  // error.tsx/error.mdx receives { error, digest, reset } props from the
-  // boundary at catch time; MDX error files are pre-rendered without them
-  // (they're static content).
   if (segment.error) {
     const Component = await loadBoundaryComponent(segment.error, loadModule);
     if (Component) {
-      element = wrapInBoundary(element, Component, segment.error, undefined, {}, config);
+      element = wrapInBoundary(element, Component, undefined, config);
     }
   }
 

package/src/server/pipeline.ts

@@ -215,6 +215,15 @@ export interface PipelineConfig {
    */
   devHmrOptions?: import('../dev-tools/dev-page-shell.ts').DevErrorHmrOptions;
 
+  /**
+   * Dev debug channel transport — sends RSC Flight debug data to the
+   * browser via HMR WebSocket for owner stack resolution in console
+   * warnings. Set by the dev server. Undefined in production.
+   *
+   * See TIM-1507, design/13-security.md §7.
+   */
+  devDebugRegistry?: import('../dev-tools/debug-channel.ts').DebugChannelRegistry;
+
   /**
    * Fallback error renderer — called when a catastrophic error escapes the
    * render phase. Produces an HTML Response instead of a bare empty 500.

package/src/server/primitives.ts

@@ -228,14 +228,17 @@ export class DenySignal extends Error {
   }
 }
 
-/** Options for deny() when using the object form. */
+/** Options for deny(). */
 export interface DenyOptions {
-  /** HTTP status code (4xx or 5xx). Default: 403. */
-  status?: number;
   /** Human-readable message (logged server-side, not sent to client). */
   message?: string;
-  /** JSON-serializable data passed as `dangerouslyPassData` prop to status-code files. */
-  data?: JsonSerializable;
+  /**
+   * JSON-serializable data forwarded as the `data` prop to status-code files
+   * and `denied.tsx`. Named `dangerouslyPassData` because this data crosses
+   * the RSC → client serialization boundary — do not pass sensitive server
+   * state (tokens, internal IDs, database rows).
+   */
+  dangerouslyPassData?: JsonSerializable;
 }
 
 /**
@@ -246,38 +249,29 @@ export interface DenyOptions {
  * - Inside Suspense (hold window): promoted to pre-flush behavior
  * - Inside Suspense (after flush): error boundary + noindex meta
  *
- * Supports both positional and object signatures:
  * ```ts
- * deny()                                          // 403 (default)
- * deny(404)                                       // 404
- * deny(503, { retry: true })                      // 503 with data
- * deny({ status: 503, message: 'Maintenance' })   // object form
+ * deny()                                                        // 403 (default)
+ * deny(404)                                                     // 404
+ * deny(503, { message: 'Maintenance' })                         // server-only log message
+ * deny(404, { dangerouslyPassData: { resourceId: params.id } }) // explicit client opt-in
  * ```
  *
  * Accepts any 4xx or 5xx status code. This replaces the need for
  * `throw new RenderError(...)` in user code — RenderError is now an
  * internal pipeline detail.
  *
- * @param statusOrOptions - Status code (number) or options object. Default: 403.
- * @param data - Optional JSON-serializable data (positional form only).
+ * @param status - HTTP status code (4xx or 5xx). Default: 403.
+ * @param options - Optional message and/or data to pass to the client.
  */
-export function deny(statusOrOptions?: number | DenyOptions, data?: JsonSerializable): never {
-  let status: number;
-  let resolvedData: JsonSerializable | undefined;
-
-  if (typeof statusOrOptions === 'object' && statusOrOptions !== null) {
-    status = statusOrOptions.status ?? 403;
-    resolvedData = statusOrOptions.data;
-  } else {
-    status = statusOrOptions ?? 403;
-    resolvedData = data;
-  }
+export function deny(status?: number, options?: DenyOptions): never {
+  const resolvedStatus = status ?? 403;
+  const resolvedData = options?.dangerouslyPassData;
 
-  if (status < 400 || status > 599) {
-    throw new Error(`deny() requires a 4xx or 5xx status code, got ${status}.`);
+  if (resolvedStatus < 400 || resolvedStatus > 599) {
+    throw new Error(`deny() requires a 4xx or 5xx status code, got ${resolvedStatus}.`);
   }
   warnIfNotSerializable(resolvedData, 'deny()');
-  throw new DenySignal(status, resolvedData);
+  throw new DenySignal(resolvedStatus, resolvedData);
 }
 
 // Single source of truth shared with the client next/navigation shim —