@timber-js/app 0.2.0-alpha.133 → 0.2.0-alpha.135

package/src/cookies/validation.ts

@@ -104,6 +104,64 @@ function isCookieOctet(code: number): boolean {
  * This validator is for the `{ raw: true }` opt-out and for
  * `setFromHeaders` forwarding.
  */
+// ─── Cookie attribute validation ──────────────────────────────────────────
+
+/**
+ * Characters that must not appear in path or domain cookie attributes.
+ * Semicolons delimit cookie attributes on the wire, so allowing `;` in
+ * path or domain would inject extra attributes. CR/LF enable HTTP header
+ * injection.
+ */
+const ATTR_INJECTION_RE = /[;\r\n]/;
+
+const VALID_SAME_SITE = new Set(['strict', 'lax', 'none']);
+
+/**
+ * Validate cookie option attributes at runtime to prevent Set-Cookie
+ * header injection through unsanitized option values.
+ *
+ * TypeScript types enforce correct shapes at compile time, but at runtime
+ * (e.g. from untyped libraries or user-controlled config) invalid values
+ * could inject additional Set-Cookie attributes.
+ */
+export function assertValidCookieOptions(options: {
+  sameSite?: string;
+  path?: string;
+  domain?: string;
+  maxAge?: number;
+}): void {
+  if (options.sameSite !== undefined) {
+    const lower = options.sameSite.toLowerCase();
+    if (!VALID_SAME_SITE.has(lower)) {
+      throw new Error(
+        `[timber] invalid cookie sameSite value ${JSON.stringify(options.sameSite)} — ` +
+          `must be 'strict', 'lax', or 'none'.`
+      );
+    }
+  }
+  if (options.path !== undefined && ATTR_INJECTION_RE.test(options.path)) {
+    throw new Error(
+      `[timber] invalid cookie path ${JSON.stringify(options.path)} — ` +
+        `path must not contain ';', CR, or LF (Set-Cookie header injection).`
+    );
+  }
+  if (options.domain !== undefined && ATTR_INJECTION_RE.test(options.domain)) {
+    throw new Error(
+      `[timber] invalid cookie domain ${JSON.stringify(options.domain)} — ` +
+        `domain must not contain ';', CR, or LF (Set-Cookie header injection).`
+    );
+  }
+  if (
+    options.maxAge !== undefined &&
+    (typeof options.maxAge !== 'number' || !Number.isFinite(options.maxAge))
+  ) {
+    throw new Error(
+      `[timber] invalid cookie maxAge ${JSON.stringify(options.maxAge)} — ` +
+        `maxAge must be a finite number.`
+    );
+  }
+}
+
 export function assertValidCookieValue(name: string, value: string): void {
   if (typeof value !== 'string') {
     throw new Error(`[timber] cookie ${JSON.stringify(name)}: cookie value must be a string.`);

package/src/dev-tools/error-page.ts

@@ -53,6 +53,7 @@ function readSourceContext(
   contextLines = 3
 ): { lines: Array<{ num: number; text: string; highlight: boolean }>; startLine: number } | null {
   try {
+    // eslint-disable-next-line no-var-requires -- sync require needed at render time
     const { readFileSync } = require('node:fs');
     const content = readFileSync(filePath, 'utf-8');
     const allLines = content.split('\n');

package/src/fonts/virtual-modules.ts

@@ -131,6 +131,7 @@ export function generateGoogleVirtualModule(fonts: Iterable<ExtractedFont>): str
     '',
     'function createFontResult(family, config) {',
     '  return {',
+    // eslint-disable-next-line no-template-curly-in-string -- codegen output
     '    className: `timber-font-${family.toLowerCase().replace(/\\s+/g, "-")}`,',
     '    style: { fontFamily: family },',
     '    variable: config?.variable,',
@@ -171,6 +172,7 @@ export function generateLocalVirtualModule(): string {
     'export default function localFont(config) {',
     '  const family = config?.family || "Local Font";',
     '  return {',
+    // eslint-disable-next-line no-template-curly-in-string -- codegen output
     '    className: `timber-font-${family.toLowerCase().replace(/\\s+/g, "-")}`,',
     '    style: { fontFamily: family },',
     '    variable: config?.variable,',

package/src/index.ts

@@ -29,6 +29,7 @@ import { timberReactProd } from './plugins/react-prod';
 import { timberChunks } from './plugins/chunks';
 import { clientChunkGroup } from './plugins/client-chunks';
 import { timberServerBundle } from './plugins/server-bundle';
+import { timberCacheTransform } from './plugins/cache';
 import { timberCloudflareWasm } from './plugins/cloudflare-wasm';
 import { timberAdapterBuild } from './plugins/adapter-build';
 import { timberBuildReport } from './plugins/build-report';
@@ -70,7 +71,7 @@ export type { Metadata, MetadataRoute, MetadataHandler, MetadataResult } from '.
  * This interface is empty by default and populated via codegen.
  * See design/09-typescript.md §"Typed Routes".
  */
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type, typescript/no-empty-interface
 export interface Routes {}
 
 /**
@@ -464,8 +465,10 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
       // Validate config and check peer dependencies at startup.
       // Errors are logged to stderr but don't block startup — Vite may
       // still work partially, and the errors guide the user to fix things.
+      /* eslint-disable no-var-requires -- sync require for startup validation */
       const { validateConfig, formatConfigErrors, checkPeerDependencies, formatMissingPeers } =
         require('./config-validation.js') as typeof import('./config-validation.js');
+      /* eslint-enable no-var-requires */
 
       const configErrors = validateConfig(ctx.config);
       if (configErrors.length > 0) {
@@ -530,6 +533,7 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
     timberStaticBuild(ctx),
     timberFonts(ctx),
     timberMdx(ctx),
+    timberCacheTransform(ctx),
     timberContent(ctx),
     timberServerBundle(), // Bundle all deps in server environments for prod
     timberCloudflareWasm(ctx), // Externalize WASM for Cloudflare Workers

package/src/params/define-schema.ts

@@ -57,6 +57,7 @@ export type CodecForKey<K extends string> = K extends `[[...${string}]]`
  * Registry interface augmented by codegen with known filesystem bracket keys.
  * When empty (no codegen yet), ValidDynamicSegmentKeys falls back to string.
  */
+// eslint-disable-next-line typescript/no-empty-interface -- augmented by codegen
 export interface ValidDynamicSegmentKeysRegistry {}
 
 /**

package/src/plugins/cache.ts

@@ -0,0 +1,180 @@
+/**
+ * timber-cache-transform — Vite plugin that injects stable callsite IDs
+ * into `cache()` calls imported from `@timber-js/app/cache`.
+ *
+ * Without this plugin, cache keys use a process-local counter (fnIdCounter)
+ * which is unstable across cold starts in serverless/multi-instance
+ * deployments. With a shared CacheHandler (Redis/KV), colliding counters
+ * cause cache key poisoning — serving one route's cached data to another.
+ *
+ * The plugin transforms:
+ *   cache(fn, opts)  →  cache(fn, opts, "stable-id")
+ *
+ * where stable-id = fnv1a(relativeModulePath + ":cache:" + callIndex).
+ *
+ * See TIM-997, design/06-caching.md §"Cache Key Security".
+ */
+
+import { relative } from 'node:path';
+import MagicString from 'magic-string';
+import { parseAst } from 'vite';
+import type { Plugin } from 'vite';
+import type { PluginContext } from '../plugin-context.js';
+import { fnv1aHash } from '../cache/fast-hash.js';
+
+const CACHE_MODULE_SOURCES = new Set(['@timber-js/app/cache', 'timber/cache']);
+
+interface PositionedNode {
+  type: string;
+  start: number;
+  end: number;
+  [key: string]: unknown;
+}
+
+interface IdentifierNode extends PositionedNode {
+  type: 'Identifier';
+  name: string;
+}
+
+interface ImportDeclarationNode extends PositionedNode {
+  type: 'ImportDeclaration';
+  source: { value: string };
+  specifiers: Array<
+    PositionedNode & {
+      type: string;
+      local: IdentifierNode;
+      imported?: IdentifierNode;
+    }
+  >;
+}
+
+interface CallExpressionNode extends PositionedNode {
+  type: 'CallExpression';
+  callee: PositionedNode;
+  arguments: PositionedNode[];
+}
+
+interface ProgramNode extends PositionedNode {
+  type: 'Program';
+  body: PositionedNode[];
+}
+
+/**
+ * Find the local binding name(s) for `cache` imported from the cache module.
+ */
+function findCacheBindings(program: ProgramNode): Set<string> {
+  const bindings = new Set<string>();
+  for (const stmt of program.body) {
+    if (stmt.type !== 'ImportDeclaration') continue;
+    const decl = stmt as unknown as ImportDeclarationNode;
+    if (!CACHE_MODULE_SOURCES.has(decl.source.value)) continue;
+    for (const spec of decl.specifiers) {
+      if (spec.type !== 'ImportSpecifier') continue;
+      const importedName = spec.imported?.name ?? spec.local.name;
+      if (importedName === 'cache') {
+        bindings.add(spec.local.name);
+      }
+    }
+  }
+  return bindings;
+}
+
+/**
+ * Recursively walk AST nodes to find cache() call expressions.
+ *
+ * cache() is typically called at module scope, but we also handle calls
+ * inside functions/blocks for completeness.
+ */
+function findCacheCallSites(
+  node: PositionedNode,
+  cacheBindings: Set<string>,
+  results: CallExpressionNode[]
+): void {
+  if (node.type === 'CallExpression') {
+    const call = node as unknown as CallExpressionNode;
+    if (
+      call.callee.type === 'Identifier' &&
+      cacheBindings.has((call.callee as IdentifierNode).name) &&
+      call.arguments.length === 2
+    ) {
+      results.push(call);
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end') continue;
+    const val = node[key];
+    if (val && typeof val === 'object') {
+      if (Array.isArray(val)) {
+        for (const item of val) {
+          if (item && typeof item === 'object' && typeof item.type === 'string') {
+            findCacheCallSites(item as PositionedNode, cacheBindings, results);
+          }
+        }
+      } else if (typeof (val as PositionedNode).type === 'string') {
+        findCacheCallSites(val as PositionedNode, cacheBindings, results);
+      }
+    }
+  }
+}
+
+/**
+ * Generate a stable callsite ID from a module path and call index.
+ *
+ * The ID is an FNV-1a hash of the relative module path + call index,
+ * providing a deterministic identifier that is:
+ * - Stable across cold starts of the same build
+ * - Unique across different modules
+ * - Unique across multiple cache() calls within the same module
+ */
+function generateStableId(relativeModulePath: string, callIndex: number): string {
+  return fnv1aHash(`${relativeModulePath}:cache:${callIndex}`);
+}
+
+export function timberCacheTransform(ctx: PluginContext): Plugin {
+  return {
+    name: 'timber-cache-transform',
+
+    transform(code, id) {
+      if (!code.includes('@timber-js/app/cache') && !code.includes('timber/cache')) return;
+      // Skip node_modules (don't transform third-party code)
+      if (id.includes('node_modules')) return;
+
+      let program: ProgramNode;
+      try {
+        program = parseAst(code, { lang: 'tsx' }) as unknown as ProgramNode;
+      } catch {
+        return;
+      }
+
+      const cacheBindings = findCacheBindings(program);
+      if (cacheBindings.size === 0) return;
+
+      const callSites: CallExpressionNode[] = [];
+      findCacheCallSites(program, cacheBindings, callSites);
+      if (callSites.length === 0) return;
+
+      // Sort by position in file for deterministic call indices
+      callSites.sort((a, b) => a.start - b.start);
+
+      const root = ctx.root || process.cwd();
+      const relPath = relative(root, id);
+      const s = new MagicString(code);
+
+      for (let i = 0; i < callSites.length; i++) {
+        const call = callSites[i];
+        const stableId = generateStableId(relPath, i);
+        // Insert the stable ID as the 3rd argument just before the closing ')'
+        const insertPos = call.end - 1;
+        s.appendLeft(insertPos, `, "${stableId}"`);
+      }
+
+      return {
+        code: s.toString(),
+        map: s.generateMap({ hires: 'boundary' }),
+      };
+    },
+  };
+}
+
+// Exported for testing
+export { generateStableId };

package/src/routing/link-codegen.ts

@@ -45,15 +45,15 @@ export function buildResolvedPattern(route: RouteEntry): string | null {
   const parts = route.urlPath.split('/');
   const templateParts = parts.map((part) => {
     if (part.startsWith('[[...') && part.endsWith(']]')) {
-      // Optional catch-all — matches any trailing path
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     if (part.startsWith('[...') && part.endsWith(']')) {
-      // Catch-all — matches one or more segments
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     if (part.startsWith('[') && part.endsWith(']')) {
-      // Dynamic segment
+      // eslint-disable-next-line no-template-curly-in-string -- codegen output
       return '${string}';
     }
     return part;
@@ -118,8 +118,10 @@ export function formatLinkCatchAllOverloads(): string[] {
 
   // ExternalHref inlined here rather than referenced as an exported
   // alias so the generated .d.ts stands alone without source imports.
+  /* eslint-disable no-template-curly-in-string -- codegen output */
   const externalHref =
     '`http://${string}` | `https://${string}` | `mailto:${string}` | `tel:${string}` | `ftp://${string}` | `//${string}` | `#${string}` | `?${string}`';
+  /* eslint-enable no-template-curly-in-string */
 
   lines.push('  // Typed Link overloads — catch-all (block 2 / emitted second)');
   lines.push('  interface LinkFunction {');

package/src/schema-bridge.ts

@@ -109,8 +109,9 @@ export function isCodec(value: unknown): value is Codec<unknown> {
 export function fromSchema<T>(schema: StandardSchemaV1<T>): Codec<T> {
   return {
     parse(value: string | string[] | undefined): T {
-      // For array inputs, take the last value (consistent with URLSearchParams.get())
-      const input = Array.isArray(value) ? value[value.length - 1] : value;
+      // For array inputs (duplicate query keys), use the first value.
+      // Browsers and URLSearchParams.get() return the first occurrence.
+      const input = Array.isArray(value) ? value[0] : value;
 
       // Try parsing the raw value
       const result = validateSync(schema, input);

package/src/server/action-client.ts

@@ -510,26 +510,38 @@ function logValidationFailure(errors: ValidationErrors): void {
  * Returns validation errors keyed by field name, or null if all files are ok.
  */
 function validateFileSizes(input: Record<string, unknown>, limit: number): ValidationErrors | null {
-  const errors: ValidationErrors = {};
   const limitKb = Math.round(limit / 1024);
   const limitLabel =
     limit >= 1024 * 1024 ? `${Math.round(limit / (1024 * 1024))}MB` : `${limitKb}KB`;
 
-  for (const [key, value] of Object.entries(input)) {
-    if (value instanceof File && value.size > limit) {
-      errors[key] = [
-        `File "${value.name}" (${formatSize(value.size)}) exceeds the ${limitLabel} limit`,
-      ];
-    } else if (Array.isArray(value)) {
-      const oversized = value.filter((item) => item instanceof File && item.size > limit);
-      if (oversized.length > 0) {
-        errors[key] = oversized.map(
-          (f: File) => `File "${f.name}" (${formatSize(f.size)}) exceeds the ${limitLabel} limit`
-        );
+  const errors: ValidationErrors = {};
+
+  function walk(obj: Record<string, unknown>, prefix: string): void {
+    for (const [key, value] of Object.entries(obj)) {
+      const path = prefix ? `${prefix}.${key}` : key;
+      if (value instanceof File && value.size > limit) {
+        errors[path] = [
+          `File "${value.name}" (${formatSize(value.size)}) exceeds the ${limitLabel} limit`,
+        ];
+      } else if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          const item = value[i];
+          const itemPath = `${path}[${i}]`;
+          if (item instanceof File && item.size > limit) {
+            (errors[itemPath] ??= []).push(
+              `File "${item.name}" (${formatSize(item.size)}) exceeds the ${limitLabel} limit`
+            );
+          } else if (typeof item === 'object' && item !== null && !(item instanceof File)) {
+            walk(item as Record<string, unknown>, itemPath);
+          }
+        }
+      } else if (typeof value === 'object' && value !== null && !(value instanceof File)) {
+        walk(value as Record<string, unknown>, path);
       }
     }
   }
 
+  walk(input, '');
   return Object.keys(errors).length > 0 ? errors : null;
 }
 
@@ -545,7 +557,13 @@ function stripFiles(value: unknown): Record<string, unknown> | undefined {
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
     if (v instanceof File) continue;
     if (Array.isArray(v)) {
-      result[k] = v.filter((item) => !(item instanceof File));
+      result[k] = v
+        .filter((item) => !(item instanceof File))
+        .map((item) =>
+          typeof item === 'object' && item !== null && !(item instanceof File)
+            ? (stripFiles(item) ?? {})
+            : item
+        );
     } else if (typeof v === 'object' && v !== null && !(v instanceof File)) {
       result[k] = stripFiles(v) ?? {};
     } else {

package/src/server/actions.ts

@@ -15,7 +15,7 @@
  */
 
 import { getCacheHandler } from '../cache/handler-store';
-import { RedirectSignal } from './primitives';
+import { DenySignal, RedirectSignal } from './primitives';
 import { withSpan } from './tracing';
 import { revalidationAls, type RevalidationState } from './als-registry.js';
 
@@ -178,11 +178,28 @@ export async function executeAction(
       revalidation = await config.renderer(path);
     } catch (renderError) {
       if (renderError instanceof RedirectSignal) {
-        // Revalidation triggered a redirect (e.g., session expired)
+        // Revalidation triggered a redirect (e.g., session expired,
+        // middleware on the target path called `redirect()`).
         redirectTo = renderError.location;
         redirectStatus = renderError.status;
+      } else if (renderError instanceof DenySignal) {
+        // Target path's middleware/access denied this user.
+        //
+        // Dropping the revalidation here is the security boundary added
+        // in TIM-996: without this branch, a DenySignal would fall into
+        // the `console.error` path AND the element tree would have
+        // already been built and serialized — leaking a privileged RSC
+        // payload to the action submitter. By the time the signal
+        // surfaces, the renderer has thrown BEFORE building the tree,
+        // so we simply drop `revalidation` and ship the action result
+        // alone. The action itself still succeeded.
+        console.error(
+          `[timber] revalidatePath dropped — target middleware denied (status ${renderError.status})`
+        );
       } else {
-        // Log but don't fail the action — revalidation is best-effort
+        // Log but don't fail the action — revalidation is best-effort.
+        // Includes input-validation rejections from the renderer
+        // (e.g., revalidatePath('//evil.com/admin')).
         console.error('[timber] revalidatePath render failed:', renderError);
       }
     }

package/src/server/body-limits.ts

@@ -53,6 +53,9 @@ export function parseBodySize(size: string): number {
   }
 }
 
+/** Strict integer pattern: one or more digits, nothing else. */
+const STRICT_INTEGER_RE = /^\d+$/;
+
 /** Check whether a request body exceeds the configured size limit (stateless, no ALS). */
 export function enforceBodyLimits(
   req: Request,
@@ -66,11 +69,16 @@ export function enforceBodyLimits(
     return { ok: false, status: 411 };
   }
 
-  const bodySize = Number.parseInt(contentLength, 10);
-  if (Number.isNaN(bodySize)) {
+  // Reject malformed values: multiple values ("100, 999999"), negative numbers,
+  // floats ("100.5"), or non-numeric strings. parseInt would silently parse
+  // the first number from "100, 999999" as 100, letting the real body through.
+  const trimmed = contentLength.trim();
+  if (!STRICT_INTEGER_RE.test(trimmed)) {
     return { ok: false, status: 411 };
   }
 
+  const bodySize = Number.parseInt(trimmed, 10);
+
   const limit = resolveLimit(kind, config);
   return bodySize <= limit ? { ok: true } : { ok: false, status: 413 };
 }

package/src/server/cookie-context.ts

@@ -14,7 +14,11 @@
 
 import { requestContextAls, type RequestContextStore } from './als-registry.js';
 import { isDebug } from './debug.js';
-import { assertValidCookieName, assertValidCookieValue } from '../cookies/validation.js';
+import {
+  assertValidCookieName,
+  assertValidCookieValue,
+  assertValidCookieOptions,
+} from '../cookies/validation.js';
 import {
   parseCookieHeader,
   parseSetCookie,
@@ -27,7 +31,7 @@ import {
 // `getCookies()`. The pure shared module lives in `cookies/validation.ts`
 // so the client `useCookie` hook can use the same checks without pulling
 // in the server ALS code.
-export { assertValidCookieName, assertValidCookieValue };
+export { assertValidCookieName, assertValidCookieValue, assertValidCookieOptions };
 
 // ─── Public API ───────────────────────────────────────────────────────────
 
@@ -137,6 +141,7 @@ export function getCookieJar(): RequestCookies {
       const { raw: _raw, ...attributeOptions } = options ?? {};
       void _raw;
       const opts = { ...DEFAULT_COOKIE_OPTIONS, ...attributeOptions };
+      assertValidCookieOptions(opts);
       store.cookieJar.set(name, { name, value: wireValue, options: opts });
       // Read-your-own-writes: store the DECODED logical value so that
       // subsequent `cookies().get(name)` in the same request returns

package/src/server/cookie-parsing.ts

@@ -33,7 +33,7 @@ export function parseCookieHeader(header: string): Map<string, string> {
     if (eqIndex === -1) continue;
     const name = pair.slice(0, eqIndex).trim();
     const value = pair.slice(eqIndex + 1).trim();
-    if (name) {
+    if (name && !map.has(name)) {
       map.set(name, safeDecodeCookieValue(value));
     }
   }

package/src/server/csrf.ts

@@ -28,12 +28,36 @@ const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 // ─── Implementation ───────────────────────────────────────────────────────
 
 /**
- * Validate the Origin header against the request's Host.
+ * Derive the request's scheme from trusted sources.
+ *
+ * Priority:
+ * 1. X-Forwarded-Proto (set by reverse proxies / load balancers)
+ * 2. Request URL protocol
+ *
+ * Falls back to 'https' (fail closed) if neither is available.
+ */
+function deriveRequestScheme(req: Request): string {
+  const forwarded = req.headers.get('X-Forwarded-Proto');
+  if (forwarded) {
+    const proto = forwarded.split(',')[0].trim().toLowerCase();
+    if (proto === 'http' || proto === 'https') return proto;
+  }
+
+  try {
+    return new URL(req.url).protocol.replace(':', '');
+  } catch {
+    return 'https';
+  }
+}
+
+/**
+ * Validate the Origin header against the request's full origin
+ * (scheme + host + port).
  *
  * For mutation methods (POST, PUT, PATCH, DELETE):
  * - If `csrf: false`, skip validation.
  * - If `allowedOrigins` is set, Origin must match one exactly (no wildcards).
- * - Otherwise, Origin's host must match the request's Host header.
+ * - Otherwise, Origin must match the derived request origin.
  *
  * Safe methods (GET, HEAD, OPTIONS) always pass.
  */
@@ -67,13 +91,22 @@ export function validateCsrf(req: Request, config: CsrfConfig): CsrfResult {
     return { ok: false, status: 403 };
   }
 
-  // Extract hostname from Origin URL and compare to Host header
-  let originHost: string;
+  // Compare full origins (scheme + host + port) using URL.origin for
+  // canonical port normalization (e.g. https://x:443 → https://x).
+  let originOrigin: string;
+  try {
+    originOrigin = new URL(origin).origin;
+  } catch {
+    return { ok: false, status: 403 };
+  }
+
+  const scheme = deriveRequestScheme(req);
+  let expectedOrigin: string;
   try {
-    originHost = new URL(origin).host;
+    expectedOrigin = new URL(`${scheme}://${host}`).origin;
   } catch {
     return { ok: false, status: 403 };
   }
 
-  return originHost === host ? { ok: true } : { ok: false, status: 403 };
+  return originOrigin === expectedOrigin ? { ok: true } : { ok: false, status: 403 };
 }

package/src/server/deny-renderer.ts

@@ -228,7 +228,6 @@ export async function renderDenyPageAsRsc(
   });
 
   responseHeaders.set('content-type', `${RSC_CONTENT_TYPE}; charset=utf-8`);
-  responseHeaders.set('Vary', 'Accept');
   return new Response(rscStream, {
     status: deny.status,
     headers: responseHeaders,

package/src/server/html-injector-core.ts

@@ -309,7 +309,7 @@ export class FlightInjectorCore {
     errorSignal?: AbortSignal
   ) {
     this.rscReader = rscStream.getReader();
-    this.timeoutMs = renderTimeoutMs ?? 30_000;
+    this.timeoutMs = (renderTimeoutMs ?? 30_000) || 120_000;
     this.errorSignal = errorSignal;
     this.machine = createMachine<FlightInjectionState, FlightInjectionEvent>({
       initial: { phase: 'init' },
@@ -373,10 +373,11 @@ export class FlightInjectorCore {
         // Guard each read with a timeout so a permanently hung RSC stream
         // eventually aborts. See design/02 §"Streaming Constraints".
         const readPromise = this.rscReader.read();
-        const { done, value } =
-          this.timeoutMs > 0
-            ? await withTimeout(readPromise, this.timeoutMs, 'RSC stream read timed out')
-            : await readPromise;
+        const { done, value } = await withTimeout(
+          readPromise,
+          this.timeoutMs,
+          'RSC stream read timed out'
+        );
 
         if (done) {
           this.machine.send({ type: 'PULL_DONE' });

package/src/server/html-injectors.ts

@@ -201,16 +201,19 @@ export function createInlinedRscStream(
 ): ReadableStream<Uint8Array> {
   const rscReader = rscStream.getReader();
   const decoder = new TextDecoder('utf-8', { fatal: true });
-  const timeoutMs = renderTimeoutMs ?? 30_000;
+  // When renderTimeoutMs is 0 ("disabled"), enforce a safety ceiling
+  // so a stalled RSC stream can't hang the connection forever.
+  const timeoutMs = (renderTimeoutMs ?? 30_000) || 120_000;
 
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const readPromise = rscReader.read();
-        const { done, value } =
-          timeoutMs > 0
-            ? await withTimeout(readPromise, timeoutMs, 'RSC stream read timed out')
-            : await readPromise;
+        const { done, value } = await withTimeout(
+          readPromise,
+          timeoutMs,
+          'RSC stream read timed out'
+        );
         if (done) {
           controller.close();
           return;