@timber-js/app 0.2.0-alpha.97 → 0.2.0-alpha.99

package/src/server/rsc-entry/render-route.ts

@@ -0,0 +1,304 @@
+/**
+ * Route renderer — turns a matched route into a Response.
+ *
+ * Extracted from `rsc-entry/index.ts` so the entry can stay focused on
+ * pipeline construction. This module owns the steps that happen *after*
+ * the pipeline has matched a route and before it commits a response:
+ * element-tree build, RSC Flight render, and dispatch to either the SSR
+ * HTML path or the RSC payload path. It also handles the
+ * synchronous-signal escape hatches (deny / redirect / render error
+ * thrown during stream creation) so the entry doesn't carry that logic.
+ *
+ * The function is parameterized over its dependencies — `clientBootstrap`,
+ * `clientJsDisabled`, `rootSegment`, `globalError` — so the entry passes
+ * them in once at handler-construction time and they ride along on every
+ * call. No globals, no closures over the entry's createRequestHandler
+ * scope.
+ *
+ * Design docs: 02-rendering-pipeline.md, 19-client-navigation.md.
+ */
+
+import type { BuildManifest } from '../build-manifest.js';
+import {
+  buildFontPreloadTags,
+  buildModulepreloadTags,
+  collectRouteFonts,
+  collectRouteModulepreloads,
+} from '../build-manifest.js';
+import { isDevMode } from '../debug.js';
+import type { LayoutEntry } from '../deny-renderer.js';
+import { renderDenyPage, renderDenyPageAsRsc } from '../deny-renderer.js';
+import type { ClientBootstrapConfig } from '../html-injectors.js';
+import type { InterceptionContext, RouteMatch } from '../pipeline.js';
+import { buildRouteElement, ParamCoercionError } from '../route-element-builder.js';
+import type { ManifestSegmentNode } from '../route-matcher.js';
+import { recordTiming } from '../server-timing.js';
+import { requestContextAls } from '../als-registry.js';
+import { parseClientStateTree } from '../state-tree-diff.js';
+
+import { handleApiRoute } from './api-handler.js';
+import { renderErrorPage, renderNoMatchPage } from './error-renderer.js';
+import {
+  buildRedirectResponse,
+  createDebugChannelSink,
+  escapeHtml,
+  isRscPayloadRequest,
+} from './helpers.js';
+import { buildRscPayloadResponse } from './rsc-payload.js';
+import { renderRscStream } from './rsc-stream.js';
+import { renderSsrResponse } from './ssr-renderer.js';
+import { callSsr } from './ssr-bridge.js';
+
+/**
+ * Static-per-handler dependencies for `renderRoute` — captured once at
+ * handler construction so each per-request call site only has to pass
+ * the request-specific arguments.
+ */
+export interface RenderRouteDeps {
+  clientBootstrap: ClientBootstrapConfig;
+  clientJsDisabled: boolean;
+  rootSegment: ManifestSegmentNode;
+  buildManifest: BuildManifest;
+  globalError?: { load: () => Promise<unknown>; filePath: string };
+}
+
+/**
+ * Render a matched route to an HTML Response via RSC → SSR pipeline,
+ * or return a raw RSC Flight stream for client-side navigation requests.
+ *
+ * 1. Load page/layout components from the segment chain
+ * 2. Resolve metadata
+ * 3. Render to RSC Flight stream (serializes "use client" as references)
+ * 4. If Accept: text/x-component → return RSC stream directly
+ *    Otherwise → pass RSC stream to SSR entry for HTML rendering
+ */
+export async function renderRoute(
+  req: Request,
+  match: RouteMatch,
+  responseHeaders: Headers,
+  deps: RenderRouteDeps,
+  interception?: InterceptionContext
+): Promise<Response> {
+  const { clientBootstrap, clientJsDisabled, rootSegment, buildManifest, globalError } = deps;
+  const segments = match.segments;
+  const leaf = segments[segments.length - 1];
+
+  // API routes (route.ts) — run access.ts standalone then dispatch to handler.
+  // No React render pass — AccessGate is not used, React.cache is not active.
+  // See design/04-authorization.md §"Auth in API Routes".
+  if (leaf.route && !leaf.page) {
+    return handleApiRoute(req, match, segments, responseHeaders);
+  }
+
+  // Parse X-Timber-State-Tree for RSC payload requests (client navigation).
+  // The state tree lists sync segments the client has cached — the server
+  // skips re-rendering those layouts for a smaller, faster RSC payload.
+  // Only used for RSC requests — HTML requests always get a full render.
+  // See design/19-client-navigation.md §"X-Timber-State-Tree Header"
+  const clientStateTree = isRscPayloadRequest(req) ? parseClientStateTree(req) : null;
+
+  // Build the React element tree — loads modules, collects access checks,
+  // resolves metadata. Access checks are NOT run here — they run inside
+  // AccessPreRunner during renderToReadableStream so that access.ts and
+  // render components share the same React.cache scope (TIM-662).
+  //
+  // DenySignal/RedirectSignal from access checks are caught by onError
+  // during stream consumption and handled by renderSsrResponse /
+  // buildRscPayloadResponse.
+  let routeResult;
+  const _buildStart = performance.now();
+  try {
+    routeResult = await buildRouteElement(req, match, interception, clientStateTree);
+  } catch (error) {
+    // Param coercion failed — render the custom 404 page (status files / not-found).
+    // Previously returned a bare Response(null, { status: 404 }) which bypassed
+    // custom not-found pages. Now routes through renderNoMatchPage so apps with
+    // 404.tsx / not-found status files render their custom page.
+    if (error instanceof ParamCoercionError) {
+      return renderNoMatchPage(req, rootSegment, responseHeaders, clientBootstrap);
+    }
+    // No PageComponent found — same treatment as param coercion: render custom 404.
+    if (error instanceof Error && error.message.startsWith('No page component')) {
+      return renderNoMatchPage(req, rootSegment, responseHeaders, clientBootstrap);
+    }
+    throw error;
+  }
+
+  const _buildEnd = performance.now();
+  recordTiming({
+    name: 'build',
+    dur: Math.round(_buildEnd - _buildStart),
+    desc: 'build element tree',
+  });
+
+  const { element, headElements, layoutComponents, deferSuspenseFor, skippedSegments } =
+    routeResult;
+
+  // Build head HTML for injection into the SSR output.
+  // Collects CSS, fonts, and modulepreload from the build manifest for matched segments.
+  // In dev mode the manifest is empty — Vite HMR handles CSS/JS.
+  //
+  // Link headers (for 103 Early Hints) are emitted by the earlyHints pipeline
+  // stage before middleware runs. Here we only emit the <head> HTML fallback tags
+  // — these ensure resources load even on platforms without Early Hints support.
+  let headHtml = '';
+
+  // CSS is handled by the RSC plugin via ReactDOM.preinit() with
+  // data-precedence attributes. This injects <link rel="stylesheet">
+  // tags during the RSC render phase — before our headHtml injection.
+  // We do NOT emit additional <link rel="stylesheet"> tags here because:
+  // 1. React's Float system deduplicates them, making ours redundant
+  // 2. The duplicate reference confuses React's client-side preload
+  //    deduplication, causing "preload ignored" browser warnings
+  //
+  // CSS URLs are still collected for Early Hints (Link headers) in
+  // buildEarlyHintsHeaders() — those are HTTP headers, not DOM elements,
+  // so they don't conflict with Float.
+
+  // Font CSS is NOT inlined here anymore (TIM-828). The transform hook
+  // injects a side-effect `import 'virtual:timber-font-css/<hash>.css'`
+  // into each file that calls a font function. @vitejs/plugin-rsc's
+  // `collectCss` walks the RSC module graph, finds the virtual CSS
+  // module, and React Float `preinit()`s it as
+  // `<link rel="stylesheet" data-rsc-css-href=...>` — the same path
+  // component CSS rides on. Dev and production share a single path,
+  // with no `globalThis` channel and no dev/prod skew.
+  //
+  // Font preload hints (distinct from the @font-face CSS) still flow
+  // through `BuildManifest.fonts[importer]` and are emitted below plus
+  // as 103 Early Hints via `buildEarlyHintsHeaders()`.
+  const fontEntries = collectRouteFonts(segments, buildManifest);
+  if (fontEntries.length > 0) {
+    headHtml += buildFontPreloadTags(fontEntries);
+  }
+
+  // Skip modulepreload tags when client JavaScript is disabled — no JS to preload.
+  if (!clientJsDisabled) {
+    const preloadUrls = collectRouteModulepreloads(segments, buildManifest);
+    if (preloadUrls.length > 0) {
+      headHtml += buildModulepreloadTags(preloadUrls);
+    }
+  }
+
+  for (const el of headElements) {
+    if (el.tag === 'title' && el.content) {
+      headHtml += `<title>${escapeHtml(el.content)}</title>`;
+    } else if (el.attrs) {
+      const attrs = Object.entries(el.attrs)
+        .filter(([, v]) => v != null)
+        .map(([k, v]) => `${k}="${escapeHtml(v as string)}"`)
+        .join(' ');
+      headHtml += `<${el.tag} ${attrs}>`;
+    }
+  }
+
+  // In dev mode, inject the browser log forwarding script so console
+  // errors/warnings from the browser appear in the server terminal.
+  // Set by timber-dev-browser-logs plugin via globalThis (TIM-575).
+  if (isDevMode()) {
+    const devLogScript = (globalThis as Record<string, unknown>).__timber_dev_browser_log_script as
+      | string
+      | undefined;
+    if (devLogScript) {
+      headHtml += devLogScript;
+    }
+  }
+
+  // Render to RSC Flight stream with signal tracking.
+  const _rscStart = performance.now();
+  const { rscStream, signals, getDebugComponents } = renderRscStream(element, req);
+
+  // Store the debug components getter in ALS so onPipelineError can
+  // include component tree context for render-phase errors (dev mode only).
+  // Per-request via ALS — no cross-request race. See TIM-557.
+  const alsStore = requestContextAls.getStore();
+  if (alsStore) {
+    alsStore.debugComponentsGetter = getDebugComponents;
+  }
+  recordTiming({
+    name: 'rsc-init',
+    dur: Math.round(performance.now() - _rscStart),
+    desc: 'RSC stream init',
+  });
+
+  // Synchronous redirect — redirect() in access.ts or a non-async component
+  // throws during renderToReadableStream creation. Return HTTP redirect.
+  if (signals.redirectSignal) {
+    return buildRedirectResponse(req, signals.redirectSignal, responseHeaders);
+  }
+
+  // Synchronous deny — deny() in a non-async component throws during
+  // renderToReadableStream creation, caught in the try/catch above.
+  if (signals.denySignal) {
+    if (isRscPayloadRequest(req)) {
+      return renderDenyPageAsRsc(
+        signals.denySignal,
+        segments,
+        layoutComponents as LayoutEntry[],
+        responseHeaders,
+        createDebugChannelSink
+      );
+    }
+    return renderDenyPage(
+      signals.denySignal,
+      segments,
+      layoutComponents as LayoutEntry[],
+      req,
+      match,
+      responseHeaders,
+      clientBootstrap,
+      createDebugChannelSink,
+      callSsr
+    );
+  }
+
+  // Synchronous render error — renderToReadableStream threw before
+  // creating the stream. Render the error page with correct 5xx status.
+  // (Async render errors are tracked in onError and handled after SSR.)
+  if (signals.renderError && !rscStream) {
+    return renderErrorPage(
+      signals.renderError.error,
+      signals.renderError.status,
+      segments,
+      layoutComponents as LayoutEntry[],
+      req,
+      match,
+      responseHeaders,
+      clientBootstrap,
+      globalError
+    );
+  }
+
+  // For RSC payload requests (client navigation), return the RSC Flight
+  // stream directly — skip SSR HTML rendering entirely.
+  // See design/19-client-navigation.md §"RSC Payload Handling"
+  if (isRscPayloadRequest(req)) {
+    return buildRscPayloadResponse(
+      req,
+      rscStream!,
+      signals,
+      segments,
+      layoutComponents,
+      headElements,
+      match,
+      responseHeaders,
+      skippedSegments
+    );
+  }
+
+  // Pipe through SSR for HTML rendering with streaming Suspense support.
+  return renderSsrResponse({
+    req,
+    rscStream: rscStream!,
+    signals,
+    segments,
+    layoutComponents,
+    match,
+    responseHeaders,
+    clientBootstrap,
+    clientJsDisabled,
+    headHtml,
+    deferSuspenseFor,
+    globalError,
+  });
+}

package/src/server/rsc-entry/rsc-payload.ts

@@ -205,7 +205,7 @@ export async function buildRscPayloadResponse(
   // Check if a DenySignal was caught in-tree by AccessGate or
   // PageDenyBoundary. The deny page is in the Flight stream as a normal
   // element — use the deny status for the HTTP response. See TIM-666.
-  const { getDenyStatus } = await import('../deny-page-resolver.js');
+  const { getDenyStatus } = await import('../deny-boundary.js');
   const denyStatus = getDenyStatus();
 
   return new Response(patchedStream, {

package/src/server/rsc-entry/ssr-renderer.ts

@@ -28,8 +28,8 @@ import {
   createDebugChannelSink,
   isAbortError,
 } from './helpers.js';
-import { getCookiesForSsr } from '../request-context.js';
-import { getDenyStatus } from '../deny-page-resolver.js';
+import { getCookiesForSsr } from '../cookie-context.js';
+import { getDenyStatus } from '../deny-boundary.js';
 import { renderErrorPage, type GlobalErrorFile } from './error-renderer.js';
 import { callSsr } from './ssr-bridge.js';
 import type { RenderSignals } from './rsc-stream.js';