@timber-js/app 0.2.0-alpha.9 → 0.2.0-alpha.90

package/src/server/rsc-entry/index.ts

@@ -17,45 +17,50 @@
 
 // @ts-expect-error — virtual module provided by timber-routing plugin
 import routeManifest from 'virtual:timber-route-manifest';
+// TIM-830: Populate the search-params registry eagerly so <Link> can
+// serialize flat `Partial<T>` values synchronously in RSC renders.
+// The module has side effects only — no exports consumed here.
+// @ts-expect-error — virtual module provided by timber-routing plugin
+import 'virtual:timber-search-params-registry';
 // @ts-expect-error — virtual module provided by timber-entries plugin
 import config from 'virtual:timber-config';
 // @ts-expect-error — virtual module provided by timber-build-manifest plugin
 import buildManifest from 'virtual:timber-build-manifest';
 // @ts-expect-error — virtual module provided by timber-entries plugin
 import loadUserInstrumentation from 'virtual:timber-instrumentation';
-// @ts-expect-error — virtual module provided by timber-fonts plugin
-import fontCss from 'virtual:timber-font-css';
+// @ts-expect-error — virtual module provided by timber-entries plugin
+import loadCacheHandler from 'virtual:timber-cache-handler';
 
-import type { FormRerender } from '#/server/action-handler.js';
-import { handleActionRequest, isActionRequest } from '#/server/action-handler.js';
-import type { BodyLimitsConfig } from '#/server/body-limits.js';
-import type { BuildManifest } from '#/server/build-manifest.js';
+import type { FormRerender } from '../action-handler.js';
+import { handleActionRequest, isActionRequest } from '../action-handler.js';
+import type { BodyLimitsConfig } from '../body-limits.js';
+import type { BuildManifest } from '../build-manifest.js';
 import {
-  buildCssLinkTags,
   buildFontPreloadTags,
   buildModulepreloadTags,
-  collectRouteCss,
   collectRouteFonts,
   collectRouteModulepreloads,
-} from '#/server/build-manifest.js';
-import type { LayoutEntry } from '#/server/deny-renderer.js';
-import { renderDenyPage, renderDenyPageAsRsc } from '#/server/deny-renderer.js';
-import { resolveLogMode } from '#/server/dev-logger.js';
-import { sendEarlyHints103 } from '#/server/early-hints-sender.js';
-import { collectEarlyHintHeaders } from '#/server/early-hints.js';
-import { runWithFormFlash } from '#/server/form-flash.js';
-import type { ClientBootstrapConfig } from '#/server/html-injectors.js';
-import { buildClientScripts } from '#/server/html-injectors.js';
-import type { InterceptionContext, PipelineConfig, RouteMatch } from '#/server/pipeline.js';
-import { createPipeline } from '#/server/pipeline.js';
-import { DenySignal, RedirectSignal } from '#/server/primitives.js';
-import { buildRouteElement, RouteSignalWithContext } from '#/server/route-element-builder.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import { createMetadataRouteMatcher, createRouteMatcher } from '#/server/route-matcher.js';
-import { initDevTracing } from '#/server/tracing.js';
-
-import { renderFallbackError as renderFallback } from '#/server/fallback-error.js';
-import { loadInstrumentation } from '#/server/instrumentation.js';
+} from '../build-manifest.js';
+import type { LayoutEntry } from '../deny-renderer.js';
+import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.js';
+import { resolveLogMode } from '../dev-logger.js';
+import { sendEarlyHints103 } from '../early-hints-sender.js';
+import { collectEarlyHintHeaders } from '../early-hints.js';
+import { runWithFormFlash } from '../form-flash.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import { buildClientScripts } from '../html-injectors.js';
+import type { InterceptionContext, PipelineConfig, RouteMatch } from '../pipeline.js';
+import { createPipeline, coerceSegmentParams } from '../pipeline.js';
+import { setSegmentParams } from '../request-context.js';
+import { buildRouteElement, ParamCoercionError } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+import { createMetadataRouteMatcher, createRouteMatcher } from '../route-matcher.js';
+import { initDevTracing } from '../tracing.js';
+
+import { renderFallbackError as renderFallback } from '../fallback-error.js';
+import { loadInstrumentation } from '../instrumentation.js';
+import { loadModule } from '../safe-load.js';
+import { logRenderError } from '../logger.js';
 import { handleApiRoute } from './api-handler.js';
 import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
 import {
@@ -63,33 +68,77 @@ import {
   createDebugChannelSink,
   escapeHtml,
   isRscPayloadRequest,
+  type DebugComponentEntry,
 } from './helpers.js';
-import { parseClientStateTree } from '#/server/state-tree-diff.js';
-import {
-  createResponseCache,
-  resolveResponseCacheConfig,
-  type ResponseCache,
-} from '#/server/response-cache.js';
+import { parseClientStateTree } from '../state-tree-diff.js';
 import { buildRscPayloadResponse } from './rsc-payload.js';
 import { renderRscStream } from './rsc-stream.js';
 import { renderSsrResponse } from './ssr-renderer.js';
 import { callSsr } from './ssr-bridge.js';
-import { isDebug, isDevMode, setDebugFromConfig } from '#/server/debug.js';
+import { isDebug, isDevMode, setDebugFromConfig } from '../debug.js';
+import { setSourceMapCallback } from '../dev-source-map.js';
+import { recordTiming } from '../server-timing.js';
+import { requestContextAls } from '../als-registry.js';
+import { createAutoSitemapHandler } from '../sitemap-handler.js';
+
+/**
+ * Resolve the Server-Timing mode from timber.config.ts.
+ *
+ * If the user set `serverTiming` explicitly, use that value.
+ * Otherwise: `'detailed'` in dev, `'total'` in production.
+ */
+function resolveServerTimingMode(
+  config: Record<string, unknown>,
+  isDev: boolean
+): 'detailed' | 'total' | false {
+  const userValue = config.serverTiming as 'detailed' | 'total' | false | undefined;
+  if (userValue !== undefined) return userValue;
+  return isDev ? 'detailed' : 'total';
+}
 
 // Dev-only pipeline error handler, set by the dev server after import.
 // In production this is always undefined — no overhead.
-let _devPipelineErrorHandler: ((error: Error, phase: string) => void) | undefined;
+// The third argument provides RSC debug component data (from the Flight
+// debug channel) when available — used by the error overlay to show the
+// server component tree context for render errors.
+let _devPipelineErrorHandler:
+  | ((error: Error, phase: string, debugComponents?: DebugComponentEntry[]) => void)
+  | undefined;
 
 /**
  * Set the dev pipeline error handler.
  *
  * Called by the dev server after importing this module to wire pipeline
  * errors into the Vite browser error overlay. No-op in production.
+ *
+ * The handler receives an optional third argument with RSC debug component
+ * info — component names, environments, and stack frames from the Flight
+ * debug channel. This is only populated for render-phase errors.
  */
-export function setDevPipelineErrorHandler(handler: (error: Error, phase: string) => void): void {
+export function setDevPipelineErrorHandler(
+  handler: (error: Error, phase: string, debugComponents?: DebugComponentEntry[]) => void
+): void {
   _devPipelineErrorHandler = handler;
 }
 
+/**
+ * Set the dev source-map handler.
+ *
+ * Called by the dev server after importing this module to wire Vite's
+ * module graph source-mapping into the error rendering pipeline. Errors
+ * rendered by renderErrorPage / renderFallbackError will have their
+ * stack traces rewritten to show original source positions.
+ *
+ * No-op in production.
+ */
+export function setDevSourceMapHandler(handler: (error: Error) => void): void {
+  setSourceMapCallback(handler);
+}
+
+// Dev-only: debug components getter is stored per-request in ALS
+// (RequestContextStore.debugComponentsGetter) to avoid cross-request
+// race conditions. See TIM-557.
+
 /**
  * Create the RSC request handler from the route manifest.
  *
@@ -103,13 +152,25 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
   // See design/17-logging.md §"register() — Server Startup"
   await loadInstrumentation(loadUserInstrumentation);
 
-  // Initialize cookie signing secrets from config (design/29-cookies.md §"Signed Cookies")
-  const cookieSecrets = (runtimeConfig as Record<string, unknown>).cookieSecrets as
-    | string[]
+  // Initialize deployment ID for version skew detection (TIM-446).
+  // The manifest init module sets globalThis.__TIMBER_DEPLOYMENT_ID__ at startup.
+  // In dev mode this is undefined — skew checks are skipped.
+  const deploymentId = (globalThis as Record<string, unknown>).__TIMBER_DEPLOYMENT_ID__ as
+    | string
     | undefined;
-  if (cookieSecrets?.length) {
-    const { setCookieSecrets } = await import('#/server/request-context.js');
-    setCookieSecrets(cookieSecrets);
+  if (deploymentId) {
+    const { setDeploymentId } = await import('../version-skew.js');
+    setDeploymentId(deploymentId);
+  }
+
+  // Wire the configured cache handler into the module-level singleton (TIM-599).
+  // The cacheHandler is a class instance (e.g. RedisCacheHandler) that can't be
+  // JSON-serialized into virtual:timber-config. Instead, virtual:timber-cache-handler
+  // dynamically imports the user's timber.config.ts and extracts the handler.
+  const userCacheHandler = await loadCacheHandler();
+  if (userCacheHandler) {
+    const { setCacheHandler } = await import('../../cache/handler-store.js');
+    setCacheHandler(userCacheHandler as Parameters<typeof setCacheHandler>[0]);
   }
 
   const matchRoute = createRouteMatcher(manifest);
@@ -136,6 +197,18 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     setDebugFromConfig(true);
   }
 
+  // Wire the global sensitive-field stripping config so `createActionClient`
+  // instances in user code pick up `forms.stripSensitiveFields` from
+  // `timber.config.ts` without needing to plumb config through each action.
+  // See TIM-816 and design/08-forms-and-actions.md §"Validation errors".
+  const formsConfig = (runtimeConfig as Record<string, unknown>).forms as
+    | { stripSensitiveFields?: import('../sensitive-fields.js').SensitiveFieldsOption }
+    | undefined;
+  if (formsConfig) {
+    const { setGlobalSensitiveFieldsConfig } = await import('../sensitive-fields.js');
+    setGlobalSensitiveFieldsConfig(formsConfig.stripSensitiveFields);
+  }
+
   // Two separate flags for two different security levels:
   //
   // isDev (isDevMode) — gates client-visible behavior: dev error pages with
@@ -166,17 +239,6 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
 
   const typedBuildManifest = buildManifest as BuildManifest;
 
-  // Initialize response-level caching and singleflight deduplication.
-  // See design/31-benchmarking.md for performance motivation.
-  const responseCacheRaw = (runtimeConfig as Record<string, unknown>).responseCache as
-    | { maxSize?: number; ttlMs?: number; publicOnly?: boolean }
-    | false
-    | undefined;
-  const responseCacheConfig = resolveResponseCacheConfig(responseCacheRaw);
-  const responseCache: ResponseCache | null = responseCacheConfig
-    ? createResponseCache(responseCacheConfig)
-    : null;
-
   const pipelineConfig: PipelineConfig = {
     proxyLoader: manifest.proxy?.load,
     matchRoute,
@@ -207,33 +269,125 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
       _requestHeaderOverlay: Headers,
       interception?: InterceptionContext
     ) => {
-      const doRender = () =>
-        renderRoute(req, match, responseHeaders, clientBootstrap, clientJsDisabled, interception);
-
-      // Response cache wraps the render with singleflight + LRU.
-      // Interception requests (modals) are excluded — they depend on
-      // X-Timber-URL which makes caching semantics ambiguous.
-      if (responseCache && !interception) {
-        const isRsc = (req.headers.get('Accept') ?? '').includes('text/x-component');
-        return responseCache.getOrRender(req, isRsc, doRender);
-      }
-      return doRender();
+      return renderRoute(
+        req,
+        match,
+        responseHeaders,
+        clientBootstrap,
+        clientJsDisabled,
+        interception,
+        manifest.root,
+        manifest.globalError
+      );
     },
     renderNoMatch: async (req: Request, responseHeaders: Headers) => {
-      return renderNoMatchPage(req, manifest.root, responseHeaders, clientBootstrap);
+      const response = await renderNoMatchPage(
+        req,
+        manifest.root,
+        responseHeaders,
+        clientBootstrap
+      );
+
+      // In dev mode, if the pipeline returned a bare 404 (no body — meaning
+      // no user-defined 404.tsx was found), replace it with a helpful dev
+      // page that lists available routes and suggests similar paths.
+      // Only for GET requests that accept HTML — HEAD/API/RSC clients
+      // should receive the bare 404 without an HTML body (TIM-793).
+      const acceptsHtml = (req.headers.get('accept') ?? '').includes('text/html');
+      if (isDev && !response.body && req.method === 'GET' && acceptsHtml) {
+        const { generateDev404Page, collectRoutes } = await import('../../plugins/dev-404-page.js');
+        const routes = collectRoutes(manifest.root);
+        const pathname = new URL(req.url).pathname;
+        const html = generateDev404Page(pathname, routes);
+        return new Response(html, {
+          status: 404,
+          headers: {
+            ...Object.fromEntries(responseHeaders.entries()),
+            'content-type': 'text/html; charset=utf-8',
+          },
+        });
+      }
+
+      return response;
     },
     interceptionRewrites: manifest.interceptionRewrites,
     // Slow request threshold from timber.config.ts. Default 3000ms, 0 to disable.
     // See design/17-logging.md §"slowRequestMs"
     slowRequestMs: (runtimeConfig as Record<string, unknown>).slowRequestMs as number | undefined,
-    enableServerTiming: isDev,
+    serverTiming: resolveServerTimingMode(runtimeConfig, isDev),
     onPipelineError: isDev
       ? (error: Error, phase: string) => {
-          if (_devPipelineErrorHandler) _devPipelineErrorHandler(error, phase);
+          if (_devPipelineErrorHandler) {
+            // For render-phase errors, include RSC debug component data
+            // from the Flight debug channel (if available from the current request).
+            const store = requestContextAls.getStore();
+            const debugComponents =
+              phase === 'render' && store?.debugComponentsGetter
+                ? store.debugComponentsGetter()
+                : undefined;
+            _devPipelineErrorHandler(error, phase, debugComponents);
+          }
         }
       : undefined,
+
     renderFallbackError: (error, req, responseHeaders) =>
-      renderFallback(error, req, responseHeaders, isDev, manifest.root, clientBootstrap),
+      renderFallback(
+        error,
+        req,
+        responseHeaders,
+        isDev,
+        manifest.root,
+        clientBootstrap,
+        manifest.globalError,
+        // Project root for dev error page frame classification.
+        // Not in runtimeConfig (TIM-787: leaked to client bundles).
+        // manifest.viteRoot is the resolved Vite root string — correct even
+        // when CWD differs from project root (e.g., monorepo custom root)
+        // (TIM-807). Passing manifest.root (segment tree object) here would
+        // stringify to "[object Object]" and misclassify app frames as
+        // internal, dropping source locations from the dev error page (TIM-808).
+        isDev ? manifest.viteRoot : undefined
+      ),
+    renderDenyFallback: async (deny, req, responseHeaders) => {
+      // Render the deny page (403.tsx, 404.tsx, etc.) for DenySignals
+      // that escape from middleware or the render phase. Uses the root
+      // segment to resolve status-code files and layout wrapping.
+      const segments = [
+        manifest.root,
+      ] as unknown as import('../route-matcher.js').ManifestSegmentNode[];
+      const layoutComponents: LayoutEntry[] = [];
+      try {
+        if (manifest.root.layout) {
+          const mod = await loadModule(manifest.root.layout);
+          if (mod.default) {
+            layoutComponents.push({
+              component: mod.default as (...args: unknown[]) => unknown,
+              segment:
+                manifest.root as unknown as import('../route-matcher.js').ManifestSegmentNode,
+            });
+          }
+        }
+      } catch (layoutError) {
+        // Layout failed to load — proceed without it.
+        logRenderError({ method: req.method, path: new URL(req.url).pathname, error: layoutError });
+      }
+      const match = { segments: segments as never, segmentParams: {}, middlewareChain: [] };
+      return renderDenyPage(
+        deny,
+        segments,
+        layoutComponents,
+        req,
+        match,
+        responseHeaders,
+        clientBootstrap,
+        createDebugChannelSink,
+        callSsr
+      );
+    },
+    // Auto-generated sitemap handler — enabled when sitemap.enabled is true
+    // and no user-authored sitemap exists at the app root.
+    // See design/16-metadata.md §"Auto-generated Sitemap"
+    autoSitemapHandler: createAutoSitemapHandler(manifest.root, runtimeConfig),
   };
 
   const pipeline = createPipeline(pipelineConfig);
@@ -255,6 +409,7 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         bodyLimits: {
           limits: (runtimeConfig as Record<string, unknown>).limits as BodyLimitsConfig['limits'],
         },
+        sensitiveFields: formsConfig?.stripSensitiveFields,
         revalidateRenderer: async (path: string) => {
           // Build the React element tree for the route at `path`.
           // Returns the element tree (not serialized) so the action handler can
@@ -269,6 +424,14 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
           if (!revalidateMatch) {
             throw new Error(`revalidatePath('${path}') — no matching route`);
           }
+          // Coerce segment params (params.ts) before building the element tree.
+          // Without this, components receive raw strings instead of typed values.
+          await coerceSegmentParams(revalidateMatch);
+          // Set coerced params in ALS so getSegmentParams() works during
+          // the revalidation render (AccessGate reads params via ALS).
+          // Without this, AccessGate → getSegmentParams() throws because
+          // segmentParamsPromise is never set. See TIM-667.
+          setSegmentParams(revalidateMatch.segmentParams);
           const routeResult = await buildRouteElement(revalidateReq, revalidateMatch);
           return {
             element: routeResult.element,
@@ -309,7 +472,9 @@ async function renderRoute(
   responseHeaders: Headers,
   clientBootstrap: ClientBootstrapConfig,
   clientJsDisabled: boolean,
-  interception?: InterceptionContext
+  interception?: InterceptionContext,
+  rootSegment?: ManifestSegmentNode,
+  globalError?: { load: () => Promise<unknown>; filePath: string }
 ): Promise<Response> {
   const segments = match.segments as unknown as ManifestSegmentNode[];
   const leaf = segments[segments.length - 1];
@@ -328,48 +493,40 @@ async function renderRoute(
   // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
   const clientStateTree = isRscPayloadRequest(_req) ? parseClientStateTree(_req) : null;
 
-  // Build the React element tree — loads modules, runs access checks,
-  // resolves metadata. DenySignal/RedirectSignal propagate for HTTP handling.
+  // Build the React element tree — loads modules, collects access checks,
+  // resolves metadata. Access checks are NOT run here — they run inside
+  // AccessPreRunner during renderToReadableStream so that access.ts and
+  // render components share the same React.cache scope (TIM-662).
+  //
+  // DenySignal/RedirectSignal from access checks are caught by onError
+  // during stream consumption and handled by renderSsrResponse /
+  // buildRscPayloadResponse.
   let routeResult;
+  const _buildStart = performance.now();
   try {
     routeResult = await buildRouteElement(_req, match, interception, clientStateTree);
   } catch (error) {
-    // RouteSignalWithContext wraps DenySignal/RedirectSignal with layout context
-    if (error instanceof RouteSignalWithContext) {
-      const { signal, layoutComponents: lc, segments: segs } = error;
-      if (signal instanceof DenySignal) {
-        if (isRscPayloadRequest(_req)) {
-          return renderDenyPageAsRsc(
-            signal,
-            segs,
-            lc as LayoutEntry[],
-            responseHeaders,
-            createDebugChannelSink
-          );
-        }
-        return renderDenyPage(
-          signal,
-          segs,
-          lc as LayoutEntry[],
-          _req,
-          match,
-          responseHeaders,
-          clientBootstrap,
-          createDebugChannelSink,
-          callSsr
-        );
-      }
-      if (signal instanceof RedirectSignal) {
-        return buildRedirectResponse(_req, signal, responseHeaders);
-      }
+    // Param coercion failed — render the custom 404 page (status files / not-found).
+    // Previously returned a bare Response(null, { status: 404 }) which bypassed
+    // custom not-found pages. Now routes through renderNoMatchPage so apps with
+    // 404.tsx / not-found status files render their custom page.
+    if (error instanceof ParamCoercionError) {
+      return renderNoMatchPage(_req, rootSegment!, responseHeaders, clientBootstrap);
     }
-    // No PageComponent found
+    // No PageComponent found — same treatment as param coercion: render custom 404.
     if (error instanceof Error && error.message.startsWith('No page component')) {
-      return new Response(null, { status: 404 });
+      return renderNoMatchPage(_req, rootSegment!, responseHeaders, clientBootstrap);
     }
     throw error;
   }
 
+  const _buildEnd = performance.now();
+  recordTiming({
+    name: 'build',
+    dur: Math.round(_buildEnd - _buildStart),
+    desc: 'build element tree',
+  });
+
   const { element, headElements, layoutComponents, deferSuspenseFor, skippedSegments } =
     routeResult;
 
@@ -383,14 +540,22 @@ async function renderRoute(
   const typedManifest = buildManifest as BuildManifest;
   let headHtml = '';
 
-  const cssUrls = collectRouteCss(segments, typedManifest);
-  if (cssUrls.length > 0) {
-    headHtml += buildCssLinkTags(cssUrls);
-  }
+  // CSS is handled by the RSC plugin via ReactDOM.preinit() with
+  // data-precedence attributes. This injects <link rel="stylesheet">
+  // tags during the RSC render phase — before our headHtml injection.
+  // We do NOT emit additional <link rel="stylesheet"> tags here because:
+  // 1. React's Float system deduplicates them, making ours redundant
+  // 2. The duplicate reference confuses React's client-side preload
+  //    deduplication, causing "preload ignored" browser warnings
+  //
+  // CSS URLs are still collected for Early Hints (Link headers) in
+  // buildEarlyHintsHeaders() — those are HTTP headers, not DOM elements,
+  // so they don't conflict with Float.
 
   // Inline font CSS as a <style> tag — @font-face rules and scoped classes.
-  // The virtual:timber-font-css module is loaded lazily, so the font registry
-  // is always populated by the time we get here (no timing issues).
+  // The font CSS is set on globalThis by the transformed font file's
+  // side-effect import of virtual:timber-font-css-register.
+  const fontCss = (globalThis as Record<string, unknown>).__timber_font_css as string | undefined;
   if (fontCss) {
     headHtml += `<style data-timber-fonts>${fontCss}</style>`;
   }
@@ -420,8 +585,34 @@ async function renderRoute(
     }
   }
 
+  // In dev mode, inject the browser log forwarding script so console
+  // errors/warnings from the browser appear in the server terminal.
+  // Set by timber-dev-browser-logs plugin via globalThis (TIM-575).
+  if (isDevMode()) {
+    const devLogScript = (globalThis as Record<string, unknown>).__timber_dev_browser_log_script as
+      | string
+      | undefined;
+    if (devLogScript) {
+      headHtml += devLogScript;
+    }
+  }
+
   // Render to RSC Flight stream with signal tracking.
-  const { rscStream, signals } = renderRscStream(element, _req);
+  const _rscStart = performance.now();
+  const { rscStream, signals, getDebugComponents } = renderRscStream(element, _req);
+
+  // Store the debug components getter in ALS so onPipelineError can
+  // include component tree context for render-phase errors (dev mode only).
+  // Per-request via ALS — no cross-request race. See TIM-557.
+  const alsStore = requestContextAls.getStore();
+  if (alsStore) {
+    alsStore.debugComponentsGetter = getDebugComponents;
+  }
+  recordTiming({
+    name: 'rsc-init',
+    dur: Math.round(performance.now() - _rscStart),
+    desc: 'RSC stream init',
+  });
 
   // Synchronous redirect — redirect() in access.ts or a non-async component
   // throws during renderToReadableStream creation. Return HTTP redirect.
@@ -466,7 +657,8 @@ async function renderRoute(
       _req,
       match,
       responseHeaders,
-      clientBootstrap
+      clientBootstrap,
+      globalError
     );
   }
 
@@ -500,15 +692,16 @@ async function renderRoute(
     clientJsDisabled,
     headHtml,
     deferSuspenseFor,
+    globalError,
   });
 }
 
 // Re-export for generated entry points (e.g., Nitro node-server/bun) to wrap
 // the handler with per-request 103 Early Hints sender via ALS.
-export { runWithEarlyHintsSender } from '#/server/early-hints-sender.js';
+export { runWithEarlyHintsSender } from '../early-hints-sender.js';
 
 // Re-export for generated entry points to wrap the handler with per-request
 // waitUntil support via ALS. See design/11-platform.md §"waitUntil()".
-export { runWithWaitUntil } from '#/server/waituntil-bridge.js';
+export { runWithWaitUntil } from '../waituntil-bridge.js';
 
 export default await createRequestHandler(routeManifest, config);