@timber-js/app 0.2.0-alpha.133 → 0.2.0-alpha.135

package/src/server/pipeline-interception.ts

@@ -24,6 +24,7 @@ export interface InterceptionMatchResult {
  * followed by '/' or be an exact match.
  */
 function hasSegmentPrefix(pathname: string, prefix: string): boolean {
+  if (prefix === '/') return true;
   if (!pathname.startsWith(prefix)) return false;
   return pathname.length === prefix.length || pathname[prefix.length] === '/';
 }

package/src/server/pipeline-phases.ts

@@ -82,7 +82,7 @@ export async function runProxyPhase(
   try {
     const proxyExport = await getProxy();
     const proxyFn = () =>
-      runProxy(proxyExport, req, () => handleRequest(config, req, method, path));
+      runProxy(proxyExport, req, () => handleRequest(config, req, method, path, true));
     const response = await withSpan('timber.proxy', {}, () =>
       detailed ? withTiming('proxy', 'proxy.ts', proxyFn) : proxyFn()
     );
@@ -214,33 +214,44 @@ export async function runRenderPhase(
  *
  * Used both as the top-level entry (when no proxy.ts is configured) and as
  * the `next()` continuation passed to `runProxy()`.
+ *
+ * @param pathIsCanonical When true, `path` has already been canonicalized by
+ *   `createPipeline` — skip re-canonicalization to prevent double-decode.
+ *   When false (default), runs canonicalize as a safety net for direct callers.
  */
 export async function handleRequest(
   config: PipelineConfig,
   req: Request,
   method: string,
-  path: string
+  path: string,
+  pathIsCanonical?: boolean
 ): Promise<Response> {
   const stripTrailingSlash = config.stripTrailingSlash ?? true;
 
-  // Stage 1: URL canonicalization (belt-and-suspenders).
-  // The primary canonicalization runs in createPipeline before proxy.ts
-  // (design/07-routing.md §"URL Canonicalization & Security"). This second
-  // pass is a safety net for direct callers (tests, non-pipeline usage) —
-  // on already-canonical paths from createPipeline it's a cheap no-op.
-  const url = new URL(req.url);
-  const result = canonicalize(url.pathname, stripTrailingSlash);
-  if (!result.ok) {
-    if (isDebug()) {
-      console.warn(
-        `[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${result.status}\n` +
-          `  This usually means the URL contains encoded separators (%2f, %5c),\n` +
-          `  null bytes (%00), path traversal (..), or malformed percent-encoding.`
-      );
+  // Stage 1: URL canonicalization.
+  // When pathIsCanonical is true, createPipeline has already run canonicalize()
+  // and passed the result as `path`. Re-canonicalizing would double-decode
+  // percent-encoded characters (e.g., %61dmin → admin). See TIM-1004.
+  //
+  // When pathIsCanonical is false, this is a safety net for direct callers
+  // (tests, non-pipeline usage) that haven't pre-canonicalized.
+  let canonicalPathname: string;
+  if (pathIsCanonical) {
+    canonicalPathname = path;
+  } else {
+    const result = canonicalize(path, stripTrailingSlash);
+    if (!result.ok) {
+      if (isDebug()) {
+        console.warn(
+          `[timber] URL canonicalization rejected ${method} ${path} — responding with ${result.status}\n` +
+            `  This usually means the URL contains encoded separators (%2f, %5c),\n` +
+            `  null bytes (%00), path traversal (..), or malformed percent-encoding.`
+        );
+      }
+      return new Response(null, { status: result.status });
     }
-    return new Response(null, { status: result.status });
+    canonicalPathname = result.pathname;
   }
-  const canonicalPathname = result.pathname;
 
   // Stage 1b: Metadata route matching — runs before regular route matching.
   // Metadata routes skip middleware.ts and access.ts (public endpoints for crawlers).
@@ -377,7 +388,7 @@ export async function handleRequest(
     if (isDebug()) {
       console.warn(
         `[timber] No route matched for pathname: ${canonicalPathname}\n` +
-          `  Raw URL: ${url.pathname}\n` +
+          `  Input path: ${path}\n` +
           `  Method: ${method}`
       );
     }

package/src/server/pipeline.ts

@@ -327,13 +327,39 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   path: canonicalPath,
                 });
               } else {
-                result = await handleRequest(config, canonicalReq, method, canonicalPath);
+                result = await handleRequest(config, canonicalReq, method, canonicalPath, true);
               }
 
               // Set response status on the root span before it ends —
               // DevSpanProcessor reads this for tree/summary output.
               await setSpanAttribute('http.response.status_code', result.status);
 
+              // Vary: Accept — CDNs must cache HTML and RSC payload responses
+              // separately for the same URL. Without this, a shared cache may
+              // serve an RSC Flight payload to a browser expecting HTML (or
+              // vice versa). See GHSA-wfc6-r584-vfw7, design/13-security.md.
+              //
+              // Vary: X-Timber-URL — intercepting route responses depend on
+              // the source URL, so caches must store them separately.
+              const varyTokens = ['Accept'];
+              if (config.interceptionRewrites?.length) {
+                varyTokens.push('X-Timber-URL');
+              }
+              const existingVary = result.headers.get('Vary');
+              const existingTokens = existingVary
+                ? existingVary
+                    .toLowerCase()
+                    .split(',')
+                    .map((t) => t.trim())
+                : [];
+              const newTokens = varyTokens.filter((t) => !existingTokens.includes(t.toLowerCase()));
+              if (newTokens.length > 0) {
+                result.headers.set(
+                  'Vary',
+                  existingVary ? `${existingVary}, ${newTokens.join(', ')}` : newTokens.join(', ')
+                );
+              }
+
               // Append Server-Timing header based on configured mode.
               // Header mutability is guaranteed by the producer-side clone
               // in `outcomeToResponse` and the metadata-route / auto-sitemap

package/src/server/primitives.ts

@@ -8,6 +8,7 @@ import { getWaitUntil as _getWaitUntil } from './waituntil-bridge.js';
 import { isDebug } from './debug.js';
 import { getRequestSearchString } from './request-context.js';
 import { mergePreservedSearchParams } from '../shared/merge-search-params.js';
+import { validateExternalRedirectUrl } from '../shared/href-validation.js';
 
 // ─── Dev-mode validation ────────────────────────────────────────────────────
 
@@ -239,6 +240,9 @@ export class RedirectSignal extends Error {
 /** Pattern matching absolute URLs: http(s):// or protocol-relative // */
 const ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
 
+// eslint-disable-next-line no-control-regex -- must match all C0 controls to prevent bypass
+const REDIRECT_CONTROL_CHARS_RE = /[\x00-\x1f]/g;
+
 /**
  * Options for redirect() — alternative to passing a bare status code.
  */
@@ -299,7 +303,14 @@ export function redirect(path: string, statusOrOptions?: number | RedirectOption
   if (status < 300 || status > 399) {
     throw new Error(`redirect() requires a 3xx status code, got ${status}.`);
   }
-  if (ABSOLUTE_URL_RE.test(path)) {
+  // Strip C0 control characters and trim whitespace before checking — browsers
+  // do this during URL resolution, so " \thttp://evil.com" resolves as absolute.
+  // Normalize for validation only: strip C0 controls, trim, then replace backslashes
+  // with forward slashes. Browsers normalize \ → / during URL resolution, so
+  // "/\evil.com" becomes "//evil.com" (protocol-relative open redirect).
+  const cleaned = path.replace(REDIRECT_CONTROL_CHARS_RE, '').trimStart().replaceAll('\\', '/');
+
+  if (ABSOLUTE_URL_RE.test(cleaned)) {
     throw new Error(
       `redirect() only accepts relative URLs. Got absolute URL: "${path}". ` +
         'Use redirectExternal(url, allowList) for external redirects.'
@@ -325,10 +336,13 @@ export function permanentRedirect(path: string, options?: Omit<RedirectOptions,
 }
 
 /**
- * Redirect to an external URL. The hostname must be in the provided allow-list.
+ * Redirect to an external URL. The origin must be in the provided allow-list.
+ *
+ * Only http: and https: schemes are permitted. The allow-list is matched
+ * against full origins (scheme + host + port), not bare hostnames.
  *
  * @param url - Absolute URL to redirect to.
- * @param allowList - Array of allowed hostnames (e.g. ['example.com', 'auth.example.com']).
+ * @param allowList - Array of allowed origins (e.g. ['https://example.com', 'https://auth.example.com']).
  * @param status - HTTP redirect status code (3xx). Defaults to 302.
  */
 export function redirectExternal(url: string, allowList: string[], status: number = 302): never {
@@ -336,21 +350,8 @@ export function redirectExternal(url: string, allowList: string[], status: numbe
     throw new Error(`redirectExternal() requires a 3xx status code, got ${status}.`);
   }
 
-  let hostname: string;
-  try {
-    hostname = new URL(url).hostname;
-  } catch {
-    throw new Error(`redirectExternal() received an invalid URL: "${url}"`);
-  }
-
-  if (!allowList.includes(hostname)) {
-    throw new Error(
-      `redirectExternal() target "${hostname}" is not in the allow-list. ` +
-        `Allowed: [${allowList.join(', ')}]`
-    );
-  }
-
-  throw new RedirectSignal(url, status);
+  const canonicalUrl = validateExternalRedirectUrl(url, allowList);
+  throw new RedirectSignal(canonicalUrl, status);
 }
 
 // ─── RenderError ────────────────────────────────────────────────────────────

package/src/server/route-element-builder.ts

@@ -67,10 +67,12 @@ function replaceOutermostSegmentOutlet(
   const props = element.props as Record<string, unknown>;
   if (element.type === AccessGate && props.children) {
     const inner = replaceOutermostSegmentOutlet(props.children as React.ReactElement, replacement);
+    /* eslint-disable react/no-children-prop -- createElement API */
     return createElement(element.type as React.FunctionComponent<Record<string, unknown>>, {
       ...props,
       children: inner,
     });
+    /* eslint-enable react/no-children-prop */
   }
   return element;
 }

package/src/server/rsc-entry/error-renderer.ts

@@ -152,10 +152,11 @@ function getLayoutsForErrorFile(
  */
 function toSerializableError(error: unknown): SerializableError {
   const err = error instanceof Error ? error : new Error(String(error));
+  const devMode = isDevMode();
   return {
-    message: err.message,
-    name: err.name,
-    ...(isDevMode() && err.stack ? { stack: err.stack } : {}),
+    message: devMode ? err.message : 'An unexpected error occurred.',
+    name: devMode ? err.name : 'Error',
+    ...(devMode && err.stack ? { stack: err.stack } : {}),
   };
 }
 

package/src/server/rsc-entry/index.ts

@@ -45,11 +45,10 @@ import { buildClientScripts } from '../html-injectors.js';
 import type { InterceptionContext, PipelineConfig, RouteMatch } from '../pipeline.js';
 import { createPipeline } from '../pipeline.js';
 import { coerceSegmentParams, setGlobalSchemaCodecs } from '../param-coercion.js';
-import { setSegmentParams } from '../request-context.js';
-import { buildRouteElement } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { createMetadataRouteMatcher, createRouteMatcher } from '../route-matcher.js';
 import { initDevTracing } from '../tracing.js';
+import { createRevalidateRendererFactory } from './revalidate-renderer.js';
 
 import { renderFallbackError as renderFallback } from '../fallback-error.js';
 import { loadInstrumentation } from '../instrumentation.js';
@@ -422,40 +421,21 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     // action POSTs) matches the page pipeline exactly. Defaults to `true`
     // both here and inside the wrapper.
     stripTrailingSlash: pipelineConfig.stripTrailingSlash,
-    buildRevalidateRenderer: (req) => async (path: string) => {
-      // Build the React element tree for the route at `path`.
-      // Returns the element tree (not serialized) so the action handler can
-      // combine it with the action result in a single renderToReadableStream call.
-      // Forward original request headers (cookies, session IDs, etc.).
-      const revalidateHeaders = new Headers(req.headers);
-      revalidateHeaders.set('Accept', 'text/x-component');
-      const revalidateReq = new Request(new URL(path, req.url), {
-        headers: revalidateHeaders,
-      });
-      const revalidateMatch = matchRoute(new URL(revalidateReq.url).pathname);
-      if (!revalidateMatch) {
-        throw new Error(`revalidatePath('${path}') — no matching route`);
-      }
-      // Coerce segment params (params.ts) before building the element tree.
-      // Without this, components receive raw strings instead of typed values.
-      await coerceSegmentParams(revalidateMatch);
-      // Set coerced params in ALS so getSegmentParams() works during the
-      // revalidation render (AccessGate reads params via ALS). Without this,
-      // AccessGate → getSegmentParams() throws because segmentParams
-      // is never set. See TIM-667.
-      setSegmentParams(revalidateMatch.segmentParams);
-      const routeResult = await buildRouteElement(
-        revalidateReq,
-        revalidateMatch,
-        undefined,
-        null,
-        (buildManifest as BuildManifest).metadataRouteHashes
-      );
-      return {
-        element: routeResult.element,
-        headElements: routeResult.headElements,
-      };
-    },
+    // Revalidation renderer — runs the target route's `middleware.ts`
+    // chain BEFORE building the element tree so a server action that
+    // revalidates a protected path honors that path's auth, tenant
+    // isolation, and request-header injection. Closes the silent-bypass
+    // bug where `revalidatePath('/admin')` from a public action would
+    // serialize the admin RSC tree without ever consulting admin's
+    // middleware. Also validates the user-supplied `path` as a local
+    // root-relative URL to reject `revalidatePath('//evil.com/admin')`
+    // and similar scheme/authority injections. See TIM-996 and
+    // design/08-forms-and-actions.md §"revalidatePath()".
+    buildRevalidateRenderer: createRevalidateRendererFactory({
+      matchRoute,
+      coerceSegmentParams,
+      buildManifest: buildManifest as BuildManifest,
+    }),
   });
 
   return { handler, pipelineConfig };

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -0,0 +1,344 @@
+/**
+ * Revalidation renderer — builds the React element tree for the target
+ * path requested by `revalidatePath()` from inside a server action, with
+ * the same security guarantees as a normal route render.
+ *
+ * Before this module existed, `revalidatePath()` matched the route, coerced
+ * params, and called `buildRouteElement()` directly. That bypassed the
+ * target route's `middleware.ts` chain entirely. An action that revalidated
+ * a higher-privilege or user-controlled path could leak an authenticated
+ * RSC tree to the action submitter even when middleware on that path
+ * would have denied them.
+ *
+ * The fix (TIM-996) is to run the target route's middleware chain inside
+ * a fresh `runWithRequestContext` scope BEFORE building the element tree,
+ * propagate `DenySignal` and `RedirectSignal` to `executeAction`, drop the
+ * revalidation when middleware returns a short-circuit `Response`, and
+ * lift the request-header overlay onto the action's ALS store so the
+ * revalidated component render sees middleware-injected headers via
+ * `getHeaders()`.
+ *
+ * The input `path` is also validated as a local root-relative pathname so
+ * `revalidatePath('//evil.com/admin')` and similar scheme/authority
+ * injections cannot smuggle a foreign host through `new URL(path, base)`.
+ *
+ * See design/08-forms-and-actions.md §"revalidatePath()" and
+ * design/13-security.md §"Server actions silently bypass middleware".
+ */
+
+import type { BuildManifest } from '../build-manifest.js';
+import { canonicalize } from '../canonicalize.js';
+import { getCookiesForSsr, seedRequestCookies } from '../cookie-context.js';
+import { logRenderError } from '../logger.js';
+import type { RouteMatch, RouteMatcher } from '../pipeline.js';
+import { DenySignal, RedirectSignal } from '../primitives.js';
+import { applyRequestHeaderOverlay, setSegmentParams } from '../request-context.js';
+import { requestContextAls } from '../als-registry.js';
+import { buildRouteElement } from '../route-element-builder.js';
+import type { RevalidateRenderer, RevalidationResult } from '../actions.js';
+
+import { runMiddlewareForAction, type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+
+/**
+ * Sentinel thrown when revalidation cannot proceed because middleware
+ * returned a short-circuit `Response` (a non-redirect HTTP response that
+ * we cannot translate back to an element tree). `executeAction` catches
+ * this and drops the revalidation — the action result is still delivered,
+ * but no `_tree` is piggybacked onto the response. The matching name
+ * `RevalidationDropped` is exported so callers can identify it via
+ * `instanceof` without leaking the message text to clients.
+ */
+export class RevalidationDropped extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'RevalidationDropped';
+  }
+}
+
+/** Result of validating a `revalidatePath()` argument. */
+type PathValidation =
+  | { ok: true; pathname: string; search: string }
+  | { ok: false; reason: string };
+
+/**
+ * Validate a `revalidatePath()` argument.
+ *
+ * Accepts local root-relative pathnames only. Rejects anything that
+ * `new URL(path, base)` would resolve to a different host or scheme:
+ *
+ *   - Empty / non-string input
+ *   - Anything not starting with `/` (relative, scheme-bearing, etc.)
+ *   - Protocol-relative `//evil.com/admin` — resolves to scheme://evil.com
+ *   - Backslash-prefixed `/\evil.com` — some clients fold `\` into `/`
+ *   - Control characters and null bytes
+ *   - Paths that fail canonicalization (encoded separators, `..` escaping
+ *     root, malformed percent-encoding)
+ *
+ * The pathname is canonicalized so the rest of the renderer matches the
+ * same shape the page pipeline matches.
+ */
+export function validateRevalidatePath(path: unknown): PathValidation {
+  if (typeof path !== 'string' || path.length === 0) {
+    return { ok: false, reason: 'must be a non-empty string' };
+  }
+  if (!path.startsWith('/')) {
+    return { ok: false, reason: 'must start with "/" (root-relative path)' };
+  }
+  if (path.startsWith('//')) {
+    return { ok: false, reason: 'must not start with "//" (protocol-relative URL)' };
+  }
+  if (path.startsWith('/\\')) {
+    return { ok: false, reason: 'must not start with "/\\" (backslash injection)' };
+  }
+  for (let i = 0; i < path.length; i++) {
+    const code = path.charCodeAt(i);
+    if (code <= 0x1f || code === 0x7f) {
+      return { ok: false, reason: 'must not contain control characters' };
+    }
+  }
+  const hashIndex = path.indexOf('#');
+  // Fragments are meaningless server-side and would not be sent back to
+  // the client on revalidation anyway. Drop them silently before splitting
+  // the query so a `#` cannot smuggle additional path content past the
+  // canonicalizer.
+  const noFragment = hashIndex >= 0 ? path.slice(0, hashIndex) : path;
+  const queryIndex = noFragment.indexOf('?');
+  const pathnameOnly = queryIndex >= 0 ? noFragment.slice(0, queryIndex) : noFragment;
+  const search = queryIndex >= 0 ? noFragment.slice(queryIndex) : '';
+  const canonical = canonicalize(pathnameOnly, true);
+  if (!canonical.ok) {
+    return { ok: false, reason: `failed URL canonicalization (status ${canonical.status})` };
+  }
+  return { ok: true, pathname: canonical.pathname, search };
+}
+
+/**
+ * Serialize a cookie map into a `Cookie:` request header value
+ * (`name1=value1; name2=value2`).
+ *
+ * Cookie values are RFC 6265 cookie-octet (no `;`, no `,`, no whitespace,
+ * no `"` / `\`) by construction — `assertValidCookieValue()` rejects
+ * anything else at write time. Names are validated similarly. Joining
+ * with `; ` is therefore safe and cannot be used to smuggle additional
+ * cookies via a malformed value.
+ */
+function serializeCookieMap(cookies: Map<string, string>): string {
+  const parts: string[] = [];
+  cookies.forEach((value, name) => {
+    parts.push(`${name}=${value}`);
+  });
+  return parts.join('; ');
+}
+
+/** Dependencies for the revalidate renderer factory. */
+export interface RevalidateRendererDeps {
+  matchRoute: RouteMatcher;
+  coerceSegmentParams: CoerceSegmentParamsFn;
+  buildManifest: BuildManifest;
+}
+
+/**
+ * Build a per-request `RevalidateRenderer`.
+ *
+ * The returned renderer:
+ *   1. Validates the requested path.
+ *   2. Matches the canonicalized path against the route tree.
+ *   3. Coerces segment params via the matched chain's `params.ts` codecs.
+ *   4. Runs the matched route's `middleware.ts` chain inside a fresh
+ *      `runWithRequestContext` scope (via `runMiddlewareForAction`).
+ *      Deny/redirect signals are re-thrown so `executeAction` can apply
+ *      its existing redirect handling and the new deny-drop behavior.
+ *      A short-circuit `Response` becomes `RevalidationDropped`.
+ *   5. Lifts the request-header overlay onto the OUTER action's ALS store
+ *      so the revalidated component render (which happens later inside
+ *      `renderToReadableStream` in the action's scope) observes
+ *      middleware-injected headers via `getHeaders()`. Acceptable because
+ *      revalidation runs after the action body has returned — the only
+ *      remaining ALS readers are render-phase code that should see the
+ *      same overlay a normal page render would see.
+ *   6. Builds and returns the route element tree, ready for the action
+ *      handler to serialize alongside the action result.
+ *
+ * Cookies set inside the revalidation middleware are intentionally NOT
+ * propagated to the action response. The middleware on a *different* path
+ * setting cookies via the action's response is surprising semantics; the
+ * scoped cookie jar on the inner ALS run is discarded with the scope.
+ * The primary security boundary closed here is auth — `deny()` from the
+ * target's middleware now prevents the revalidated tree from leaking.
+ */
+export function createRevalidateRendererFactory(
+  deps: RevalidateRendererDeps
+): (req: Request) => RevalidateRenderer {
+  return (req: Request): RevalidateRenderer => {
+    return async (path: string): Promise<RevalidationResult> => {
+      // ── 1. Validate the path ────────────────────────────────────────
+      const validation = validateRevalidatePath(path);
+      if (!validation.ok) {
+        // Throwing a typed error here drops the revalidation. We do not
+        // surface the message to the client (logRenderError sinks it).
+        const err = new RevalidationDropped(
+          `revalidatePath(${JSON.stringify(path)}) rejected: ${validation.reason}`
+        );
+        logRenderError({ method: req.method, path: new URL(req.url).pathname, error: err });
+        throw err;
+      }
+
+      // ── 2. Build the revalidation Request on the canonical pathname ─
+      //
+      // Use the canonical pathname (not the raw input) so the rebuilt
+      // URL cannot carry a hostile authority — `new URL('//evil.com/x',
+      // base)` would otherwise resolve to scheme://evil.com/x. Forward
+      // the original action request's headers (session IDs, accept-
+      // language, etc.) so middleware on the target route sees the same
+      // identity the action did.
+      //
+      // The `Cookie:` header is REBUILT from the action's
+      // read-your-own-writes cookie state rather than copied from the
+      // inbound request. An action that rotates the session via
+      // `getCookieJar().set('session', newToken)` and then calls
+      // `revalidatePath('/dashboard')` should have the target route's
+      // middleware see the NEW session — otherwise a session-rotation
+      // action would succeed only to have the piggybacked revalidation
+      // redirect to /login. `getCookieJar()` writes only update the ALS
+      // jar, not the immutable `Request.headers`, so without this step
+      // middleware reading `ctx.req.headers.get('cookie')` sees stale
+      // values. Codex P2.
+      const baseUrl = new URL(req.url);
+      const revalidateUrl = new URL(baseUrl.origin);
+      revalidateUrl.pathname = validation.pathname;
+      revalidateUrl.search = validation.search;
+      const revalidateHeaders = new Headers(req.headers);
+      revalidateHeaders.set('Accept', 'text/x-component');
+      // Snapshot the action's post-mutation cookie map (deletions
+      // included) and serialize it into a `Cookie:` header value the
+      // target middleware can read off `ctx.req.headers.get('cookie')`.
+      // Only attempt this inside a request context — `getCookiesForSsr`
+      // throws otherwise — and bail out gracefully if no context is
+      // active (the legacy call-site contract permitted this).
+      const inRequestContext = Boolean(requestContextAls.getStore());
+      const ryw = inRequestContext ? getCookiesForSsr() : new Map<string, string>();
+      if (inRequestContext) {
+        if (ryw.size === 0) {
+          revalidateHeaders.delete('cookie');
+        } else {
+          revalidateHeaders.set('cookie', serializeCookieMap(ryw));
+        }
+      }
+      const revalidateReq = new Request(revalidateUrl.toString(), {
+        headers: revalidateHeaders,
+      });
+      // Seed the parsed map directly so the child `runWithRequestContext`
+      // inside `runMiddlewareForAction` skips `parseCookieHeader` — the
+      // same H-3 smuggling primitive mitigated by TIM-868. The Cookie
+      // header above remains in place for code that reads
+      // `ctx.req.headers.get('cookie')` directly.
+      if (inRequestContext) {
+        seedRequestCookies(revalidateReq, new Map(ryw));
+      }
+
+      // ── 3. Match the canonical path ─────────────────────────────────
+      const match = deps.matchRoute(validation.pathname);
+      if (!match) {
+        throw new Error(`revalidatePath('${path}') — no matching route`);
+      }
+
+      // ── 4. Run middleware in a fresh ALS scope ──────────────────────
+      //
+      // We only run middleware when the matched chain has at least one
+      // entry. Routes with no middleware skip this step (no scope, no
+      // overlay) — matching the page pipeline's behavior in
+      // `handleRequest` where `runMiddlewarePhase` is gated on
+      // `middlewareChain.length > 0`.
+      let overlay: Headers | undefined;
+      if (match.middlewareChain.length > 0) {
+        const outcome = await runMiddlewareForAction(
+          revalidateReq,
+          match,
+          deps.coerceSegmentParams
+        );
+
+        if (outcome.kind === 'param-coercion-error') {
+          // Bad params on the target path — drop revalidation. The
+          // action's own response still goes back to the client.
+          throw new RevalidationDropped(
+            `revalidatePath('${path}') — segment param coercion failed`
+          );
+        }
+        if (outcome.kind === 'error') {
+          // Re-throw unhandled middleware errors so `executeAction`'s
+          // existing `console.error` fallback logs them. Not surfaced
+          // to the action client (revalidation is best-effort).
+          throw outcome.error;
+        }
+        if (outcome.kind === 'redirect') {
+          // Propagate the redirect — `executeAction` catches
+          // RedirectSignal and converts it to an action-level redirect.
+          // See actions.ts §"Process path revalidation".
+          throw outcome.signal;
+        }
+        if (outcome.kind === 'deny') {
+          // Propagate the deny — `executeAction` catches DenySignal
+          // (added in this PR) and drops the revalidation.
+          throw outcome.signal;
+        }
+        if (outcome.kind === 'short-circuit') {
+          // Middleware returned a Response directly. A redirect Response
+          // (`return Response.redirect('/login')` or a 3xx + Location)
+          // is the same outcome as throwing `redirect()` — common for
+          // session-expiry / feature-flag gates — and the action client
+          // should follow it. Translate to a `RedirectSignal` so
+          // `executeAction` surfaces it as the action redirect, matching
+          // the normal page-pipeline behavior promised in
+          // design/08-forms-and-actions.md §"revalidatePath()". Codex P2.
+          const status = outcome.response.status;
+          const location = outcome.response.headers.get('location');
+          if (status >= 300 && status < 400 && location) {
+            throw new RedirectSignal(location, status);
+          }
+          // Any other short-circuit Response (200/403/418/etc.) cannot
+          // be translated to a piggy-backed element tree. Drop the
+          // revalidation; the action result still ships.
+          throw new RevalidationDropped(
+            `revalidatePath('${path}') — middleware returned a short-circuit Response (status ${status})`
+          );
+        }
+
+        // `continue` — capture the overlay so we can apply it to the
+        // action's request-context store below. We deliberately do NOT
+        // forward `outcome.cookies` or `outcome.setCookieHeaders` here;
+        // see the module docstring for why.
+        overlay = outcome.overlay;
+      } else {
+        // No middleware on the target — still coerce params so segment
+        // params reach `setSegmentParams` typed. `runMiddlewareForAction`
+        // would have done this for us; do it manually on the bypass path.
+        await deps.coerceSegmentParams(match);
+      }
+
+      // ── 5. Lift state onto the action's ALS store ───────────────────
+      //
+      // Segment params are set unconditionally so `getSegmentParams()`
+      // inside the revalidated tree returns the target path's coerced
+      // params, not the action route's. The overlay is applied only
+      // when middleware ran and produced headers — otherwise we leave
+      // the action's `headers()` view untouched.
+      setSegmentParams(match.segmentParams);
+      if (overlay) {
+        applyRequestHeaderOverlay(overlay);
+      }
+
+      // ── 6. Build the route element tree ─────────────────────────────
+      const routeResult = await buildRouteElement(
+        revalidateReq,
+        match,
+        undefined,
+        null,
+        deps.buildManifest.metadataRouteHashes
+      );
+      return {
+        element: routeResult.element,
+        headElements: routeResult.headElements,
+      };
+    };
+  };
+}

package/src/server/rsc-entry/rsc-payload.ts

@@ -172,10 +172,6 @@ export async function buildRscPayloadResponse(
   });
 
   responseHeaders.set('content-type', `${RSC_CONTENT_TYPE}; charset=utf-8`);
-  // Vary on Accept so CDNs cache HTML and RSC responses separately
-  // for the same URL. The client appends ?_rsc=<id> as a cache-bust,
-  // but Vary ensures correct behavior even without the query param.
-  responseHeaders.set('Vary', 'Accept');
 
   // Send resolved head elements so the client can update document.title
   // and <meta> tags after SPA navigation. See design/16-metadata.md.