@timber-js/app 0.2.0-alpha.134 → 0.2.0-alpha.135

package/src/server/rsc-entry/index.ts

@@ -45,11 +45,10 @@ import { buildClientScripts } from '../html-injectors.js';
 import type { InterceptionContext, PipelineConfig, RouteMatch } from '../pipeline.js';
 import { createPipeline } from '../pipeline.js';
 import { coerceSegmentParams, setGlobalSchemaCodecs } from '../param-coercion.js';
-import { setSegmentParams } from '../request-context.js';
-import { buildRouteElement } from '../route-element-builder.js';
 import type { ManifestSegmentNode } from '../route-matcher.js';
 import { createMetadataRouteMatcher, createRouteMatcher } from '../route-matcher.js';
 import { initDevTracing } from '../tracing.js';
+import { createRevalidateRendererFactory } from './revalidate-renderer.js';
 
 import { renderFallbackError as renderFallback } from '../fallback-error.js';
 import { loadInstrumentation } from '../instrumentation.js';
@@ -422,40 +421,21 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     // action POSTs) matches the page pipeline exactly. Defaults to `true`
     // both here and inside the wrapper.
     stripTrailingSlash: pipelineConfig.stripTrailingSlash,
-    buildRevalidateRenderer: (req) => async (path: string) => {
-      // Build the React element tree for the route at `path`.
-      // Returns the element tree (not serialized) so the action handler can
-      // combine it with the action result in a single renderToReadableStream call.
-      // Forward original request headers (cookies, session IDs, etc.).
-      const revalidateHeaders = new Headers(req.headers);
-      revalidateHeaders.set('Accept', 'text/x-component');
-      const revalidateReq = new Request(new URL(path, req.url), {
-        headers: revalidateHeaders,
-      });
-      const revalidateMatch = matchRoute(new URL(revalidateReq.url).pathname);
-      if (!revalidateMatch) {
-        throw new Error(`revalidatePath('${path}') — no matching route`);
-      }
-      // Coerce segment params (params.ts) before building the element tree.
-      // Without this, components receive raw strings instead of typed values.
-      await coerceSegmentParams(revalidateMatch);
-      // Set coerced params in ALS so getSegmentParams() works during the
-      // revalidation render (AccessGate reads params via ALS). Without this,
-      // AccessGate → getSegmentParams() throws because segmentParams
-      // is never set. See TIM-667.
-      setSegmentParams(revalidateMatch.segmentParams);
-      const routeResult = await buildRouteElement(
-        revalidateReq,
-        revalidateMatch,
-        undefined,
-        null,
-        (buildManifest as BuildManifest).metadataRouteHashes
-      );
-      return {
-        element: routeResult.element,
-        headElements: routeResult.headElements,
-      };
-    },
+    // Revalidation renderer — runs the target route's `middleware.ts`
+    // chain BEFORE building the element tree so a server action that
+    // revalidates a protected path honors that path's auth, tenant
+    // isolation, and request-header injection. Closes the silent-bypass
+    // bug where `revalidatePath('/admin')` from a public action would
+    // serialize the admin RSC tree without ever consulting admin's
+    // middleware. Also validates the user-supplied `path` as a local
+    // root-relative URL to reject `revalidatePath('//evil.com/admin')`
+    // and similar scheme/authority injections. See TIM-996 and
+    // design/08-forms-and-actions.md §"revalidatePath()".
+    buildRevalidateRenderer: createRevalidateRendererFactory({
+      matchRoute,
+      coerceSegmentParams,
+      buildManifest: buildManifest as BuildManifest,
+    }),
   });
 
   return { handler, pipelineConfig };

package/src/server/rsc-entry/revalidate-renderer.ts

@@ -0,0 +1,344 @@
+/**
+ * Revalidation renderer — builds the React element tree for the target
+ * path requested by `revalidatePath()` from inside a server action, with
+ * the same security guarantees as a normal route render.
+ *
+ * Before this module existed, `revalidatePath()` matched the route, coerced
+ * params, and called `buildRouteElement()` directly. That bypassed the
+ * target route's `middleware.ts` chain entirely. An action that revalidated
+ * a higher-privilege or user-controlled path could leak an authenticated
+ * RSC tree to the action submitter even when middleware on that path
+ * would have denied them.
+ *
+ * The fix (TIM-996) is to run the target route's middleware chain inside
+ * a fresh `runWithRequestContext` scope BEFORE building the element tree,
+ * propagate `DenySignal` and `RedirectSignal` to `executeAction`, drop the
+ * revalidation when middleware returns a short-circuit `Response`, and
+ * lift the request-header overlay onto the action's ALS store so the
+ * revalidated component render sees middleware-injected headers via
+ * `getHeaders()`.
+ *
+ * The input `path` is also validated as a local root-relative pathname so
+ * `revalidatePath('//evil.com/admin')` and similar scheme/authority
+ * injections cannot smuggle a foreign host through `new URL(path, base)`.
+ *
+ * See design/08-forms-and-actions.md §"revalidatePath()" and
+ * design/13-security.md §"Server actions silently bypass middleware".
+ */
+
+import type { BuildManifest } from '../build-manifest.js';
+import { canonicalize } from '../canonicalize.js';
+import { getCookiesForSsr, seedRequestCookies } from '../cookie-context.js';
+import { logRenderError } from '../logger.js';
+import type { RouteMatch, RouteMatcher } from '../pipeline.js';
+import { DenySignal, RedirectSignal } from '../primitives.js';
+import { applyRequestHeaderOverlay, setSegmentParams } from '../request-context.js';
+import { requestContextAls } from '../als-registry.js';
+import { buildRouteElement } from '../route-element-builder.js';
+import type { RevalidateRenderer, RevalidationResult } from '../actions.js';
+
+import { runMiddlewareForAction, type CoerceSegmentParamsFn } from './action-middleware-runner.js';
+
+/**
+ * Sentinel thrown when revalidation cannot proceed because middleware
+ * returned a short-circuit `Response` (a non-redirect HTTP response that
+ * we cannot translate back to an element tree). `executeAction` catches
+ * this and drops the revalidation — the action result is still delivered,
+ * but no `_tree` is piggybacked onto the response. The matching name
+ * `RevalidationDropped` is exported so callers can identify it via
+ * `instanceof` without leaking the message text to clients.
+ */
+export class RevalidationDropped extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'RevalidationDropped';
+  }
+}
+
+/** Result of validating a `revalidatePath()` argument. */
+type PathValidation =
+  | { ok: true; pathname: string; search: string }
+  | { ok: false; reason: string };
+
+/**
+ * Validate a `revalidatePath()` argument.
+ *
+ * Accepts local root-relative pathnames only. Rejects anything that
+ * `new URL(path, base)` would resolve to a different host or scheme:
+ *
+ *   - Empty / non-string input
+ *   - Anything not starting with `/` (relative, scheme-bearing, etc.)
+ *   - Protocol-relative `//evil.com/admin` — resolves to scheme://evil.com
+ *   - Backslash-prefixed `/\evil.com` — some clients fold `\` into `/`
+ *   - Control characters and null bytes
+ *   - Paths that fail canonicalization (encoded separators, `..` escaping
+ *     root, malformed percent-encoding)
+ *
+ * The pathname is canonicalized so the rest of the renderer matches the
+ * same shape the page pipeline matches.
+ */
+export function validateRevalidatePath(path: unknown): PathValidation {
+  if (typeof path !== 'string' || path.length === 0) {
+    return { ok: false, reason: 'must be a non-empty string' };
+  }
+  if (!path.startsWith('/')) {
+    return { ok: false, reason: 'must start with "/" (root-relative path)' };
+  }
+  if (path.startsWith('//')) {
+    return { ok: false, reason: 'must not start with "//" (protocol-relative URL)' };
+  }
+  if (path.startsWith('/\\')) {
+    return { ok: false, reason: 'must not start with "/\\" (backslash injection)' };
+  }
+  for (let i = 0; i < path.length; i++) {
+    const code = path.charCodeAt(i);
+    if (code <= 0x1f || code === 0x7f) {
+      return { ok: false, reason: 'must not contain control characters' };
+    }
+  }
+  const hashIndex = path.indexOf('#');
+  // Fragments are meaningless server-side and would not be sent back to
+  // the client on revalidation anyway. Drop them silently before splitting
+  // the query so a `#` cannot smuggle additional path content past the
+  // canonicalizer.
+  const noFragment = hashIndex >= 0 ? path.slice(0, hashIndex) : path;
+  const queryIndex = noFragment.indexOf('?');
+  const pathnameOnly = queryIndex >= 0 ? noFragment.slice(0, queryIndex) : noFragment;
+  const search = queryIndex >= 0 ? noFragment.slice(queryIndex) : '';
+  const canonical = canonicalize(pathnameOnly, true);
+  if (!canonical.ok) {
+    return { ok: false, reason: `failed URL canonicalization (status ${canonical.status})` };
+  }
+  return { ok: true, pathname: canonical.pathname, search };
+}
+
+/**
+ * Serialize a cookie map into a `Cookie:` request header value
+ * (`name1=value1; name2=value2`).
+ *
+ * Cookie values are RFC 6265 cookie-octet (no `;`, no `,`, no whitespace,
+ * no `"` / `\`) by construction — `assertValidCookieValue()` rejects
+ * anything else at write time. Names are validated similarly. Joining
+ * with `; ` is therefore safe and cannot be used to smuggle additional
+ * cookies via a malformed value.
+ */
+function serializeCookieMap(cookies: Map<string, string>): string {
+  const parts: string[] = [];
+  cookies.forEach((value, name) => {
+    parts.push(`${name}=${value}`);
+  });
+  return parts.join('; ');
+}
+
+/** Dependencies for the revalidate renderer factory. */
+export interface RevalidateRendererDeps {
+  matchRoute: RouteMatcher;
+  coerceSegmentParams: CoerceSegmentParamsFn;
+  buildManifest: BuildManifest;
+}
+
+/**
+ * Build a per-request `RevalidateRenderer`.
+ *
+ * The returned renderer:
+ *   1. Validates the requested path.
+ *   2. Matches the canonicalized path against the route tree.
+ *   3. Coerces segment params via the matched chain's `params.ts` codecs.
+ *   4. Runs the matched route's `middleware.ts` chain inside a fresh
+ *      `runWithRequestContext` scope (via `runMiddlewareForAction`).
+ *      Deny/redirect signals are re-thrown so `executeAction` can apply
+ *      its existing redirect handling and the new deny-drop behavior.
+ *      A short-circuit `Response` becomes `RevalidationDropped`.
+ *   5. Lifts the request-header overlay onto the OUTER action's ALS store
+ *      so the revalidated component render (which happens later inside
+ *      `renderToReadableStream` in the action's scope) observes
+ *      middleware-injected headers via `getHeaders()`. Acceptable because
+ *      revalidation runs after the action body has returned — the only
+ *      remaining ALS readers are render-phase code that should see the
+ *      same overlay a normal page render would see.
+ *   6. Builds and returns the route element tree, ready for the action
+ *      handler to serialize alongside the action result.
+ *
+ * Cookies set inside the revalidation middleware are intentionally NOT
+ * propagated to the action response. The middleware on a *different* path
+ * setting cookies via the action's response is surprising semantics; the
+ * scoped cookie jar on the inner ALS run is discarded with the scope.
+ * The primary security boundary closed here is auth — `deny()` from the
+ * target's middleware now prevents the revalidated tree from leaking.
+ */
+export function createRevalidateRendererFactory(
+  deps: RevalidateRendererDeps
+): (req: Request) => RevalidateRenderer {
+  return (req: Request): RevalidateRenderer => {
+    return async (path: string): Promise<RevalidationResult> => {
+      // ── 1. Validate the path ────────────────────────────────────────
+      const validation = validateRevalidatePath(path);
+      if (!validation.ok) {
+        // Throwing a typed error here drops the revalidation. We do not
+        // surface the message to the client (logRenderError sinks it).
+        const err = new RevalidationDropped(
+          `revalidatePath(${JSON.stringify(path)}) rejected: ${validation.reason}`
+        );
+        logRenderError({ method: req.method, path: new URL(req.url).pathname, error: err });
+        throw err;
+      }
+
+      // ── 2. Build the revalidation Request on the canonical pathname ─
+      //
+      // Use the canonical pathname (not the raw input) so the rebuilt
+      // URL cannot carry a hostile authority — `new URL('//evil.com/x',
+      // base)` would otherwise resolve to scheme://evil.com/x. Forward
+      // the original action request's headers (session IDs, accept-
+      // language, etc.) so middleware on the target route sees the same
+      // identity the action did.
+      //
+      // The `Cookie:` header is REBUILT from the action's
+      // read-your-own-writes cookie state rather than copied from the
+      // inbound request. An action that rotates the session via
+      // `getCookieJar().set('session', newToken)` and then calls
+      // `revalidatePath('/dashboard')` should have the target route's
+      // middleware see the NEW session — otherwise a session-rotation
+      // action would succeed only to have the piggybacked revalidation
+      // redirect to /login. `getCookieJar()` writes only update the ALS
+      // jar, not the immutable `Request.headers`, so without this step
+      // middleware reading `ctx.req.headers.get('cookie')` sees stale
+      // values. Codex P2.
+      const baseUrl = new URL(req.url);
+      const revalidateUrl = new URL(baseUrl.origin);
+      revalidateUrl.pathname = validation.pathname;
+      revalidateUrl.search = validation.search;
+      const revalidateHeaders = new Headers(req.headers);
+      revalidateHeaders.set('Accept', 'text/x-component');
+      // Snapshot the action's post-mutation cookie map (deletions
+      // included) and serialize it into a `Cookie:` header value the
+      // target middleware can read off `ctx.req.headers.get('cookie')`.
+      // Only attempt this inside a request context — `getCookiesForSsr`
+      // throws otherwise — and bail out gracefully if no context is
+      // active (the legacy call-site contract permitted this).
+      const inRequestContext = Boolean(requestContextAls.getStore());
+      const ryw = inRequestContext ? getCookiesForSsr() : new Map<string, string>();
+      if (inRequestContext) {
+        if (ryw.size === 0) {
+          revalidateHeaders.delete('cookie');
+        } else {
+          revalidateHeaders.set('cookie', serializeCookieMap(ryw));
+        }
+      }
+      const revalidateReq = new Request(revalidateUrl.toString(), {
+        headers: revalidateHeaders,
+      });
+      // Seed the parsed map directly so the child `runWithRequestContext`
+      // inside `runMiddlewareForAction` skips `parseCookieHeader` — the
+      // same H-3 smuggling primitive mitigated by TIM-868. The Cookie
+      // header above remains in place for code that reads
+      // `ctx.req.headers.get('cookie')` directly.
+      if (inRequestContext) {
+        seedRequestCookies(revalidateReq, new Map(ryw));
+      }
+
+      // ── 3. Match the canonical path ─────────────────────────────────
+      const match = deps.matchRoute(validation.pathname);
+      if (!match) {
+        throw new Error(`revalidatePath('${path}') — no matching route`);
+      }
+
+      // ── 4. Run middleware in a fresh ALS scope ──────────────────────
+      //
+      // We only run middleware when the matched chain has at least one
+      // entry. Routes with no middleware skip this step (no scope, no
+      // overlay) — matching the page pipeline's behavior in
+      // `handleRequest` where `runMiddlewarePhase` is gated on
+      // `middlewareChain.length > 0`.
+      let overlay: Headers | undefined;
+      if (match.middlewareChain.length > 0) {
+        const outcome = await runMiddlewareForAction(
+          revalidateReq,
+          match,
+          deps.coerceSegmentParams
+        );
+
+        if (outcome.kind === 'param-coercion-error') {
+          // Bad params on the target path — drop revalidation. The
+          // action's own response still goes back to the client.
+          throw new RevalidationDropped(
+            `revalidatePath('${path}') — segment param coercion failed`
+          );
+        }
+        if (outcome.kind === 'error') {
+          // Re-throw unhandled middleware errors so `executeAction`'s
+          // existing `console.error` fallback logs them. Not surfaced
+          // to the action client (revalidation is best-effort).
+          throw outcome.error;
+        }
+        if (outcome.kind === 'redirect') {
+          // Propagate the redirect — `executeAction` catches
+          // RedirectSignal and converts it to an action-level redirect.
+          // See actions.ts §"Process path revalidation".
+          throw outcome.signal;
+        }
+        if (outcome.kind === 'deny') {
+          // Propagate the deny — `executeAction` catches DenySignal
+          // (added in this PR) and drops the revalidation.
+          throw outcome.signal;
+        }
+        if (outcome.kind === 'short-circuit') {
+          // Middleware returned a Response directly. A redirect Response
+          // (`return Response.redirect('/login')` or a 3xx + Location)
+          // is the same outcome as throwing `redirect()` — common for
+          // session-expiry / feature-flag gates — and the action client
+          // should follow it. Translate to a `RedirectSignal` so
+          // `executeAction` surfaces it as the action redirect, matching
+          // the normal page-pipeline behavior promised in
+          // design/08-forms-and-actions.md §"revalidatePath()". Codex P2.
+          const status = outcome.response.status;
+          const location = outcome.response.headers.get('location');
+          if (status >= 300 && status < 400 && location) {
+            throw new RedirectSignal(location, status);
+          }
+          // Any other short-circuit Response (200/403/418/etc.) cannot
+          // be translated to a piggy-backed element tree. Drop the
+          // revalidation; the action result still ships.
+          throw new RevalidationDropped(
+            `revalidatePath('${path}') — middleware returned a short-circuit Response (status ${status})`
+          );
+        }
+
+        // `continue` — capture the overlay so we can apply it to the
+        // action's request-context store below. We deliberately do NOT
+        // forward `outcome.cookies` or `outcome.setCookieHeaders` here;
+        // see the module docstring for why.
+        overlay = outcome.overlay;
+      } else {
+        // No middleware on the target — still coerce params so segment
+        // params reach `setSegmentParams` typed. `runMiddlewareForAction`
+        // would have done this for us; do it manually on the bypass path.
+        await deps.coerceSegmentParams(match);
+      }
+
+      // ── 5. Lift state onto the action's ALS store ───────────────────
+      //
+      // Segment params are set unconditionally so `getSegmentParams()`
+      // inside the revalidated tree returns the target path's coerced
+      // params, not the action route's. The overlay is applied only
+      // when middleware ran and produced headers — otherwise we leave
+      // the action's `headers()` view untouched.
+      setSegmentParams(match.segmentParams);
+      if (overlay) {
+        applyRequestHeaderOverlay(overlay);
+      }
+
+      // ── 6. Build the route element tree ─────────────────────────────
+      const routeResult = await buildRouteElement(
+        revalidateReq,
+        match,
+        undefined,
+        null,
+        deps.buildManifest.metadataRouteHashes
+      );
+      return {
+        element: routeResult.element,
+        headElements: routeResult.headElements,
+      };
+    };
+  };
+}

package/src/server/rsc-entry/ssr-renderer.ts

@@ -36,6 +36,8 @@ import { callSsr } from './ssr-bridge.js';
 import type { RenderSignals } from './rsc-stream.js';
 import { recordTiming } from '../server-timing.js';
 import { teeWithErrorPropagation } from '../stream-utils.js';
+import { addSpanEventSync } from '../tracing.js';
+import { isDevMode } from '../debug.js';
 
 /**
  * Maximum number of queueMicrotask yields during signal promotion.
@@ -46,6 +48,19 @@ import { teeWithErrorPropagation } from '../stream-utils.js';
  */
 const SIGNAL_PROMOTION_MAX_YIELDS = 5;
 
+/**
+ * Number of additional microtask yields used by the cap-reached detection
+ * phase (TIM-970). After the promotion loop burns its full cap without
+ * capturing a signal, we yield a few more times to distinguish "no signal
+ * was ever coming" (state 2) from "signal arrived one microtask past the
+ * cap" (state 3 — the silent-miss path). These yields are telemetry-only:
+ * if a late signal is observed it triggers a warn/span-event but is NOT
+ * promoted, because raising the effective promotion cap is deferred to
+ * the E.2 investigation. Without this phase, every default `deferSuspenseFor=0`
+ * render would emit a cap-reached warning even though nothing was missed.
+ */
+const SIGNAL_PROMOTION_DETECTION_EXTRA_YIELDS = 3;
+
 /**
  * Test-only observable: records how many microtask yields were consumed
  * during the last signal promotion check. Import this in tests to assert
@@ -57,6 +72,20 @@ const SIGNAL_PROMOTION_MAX_YIELDS = 5;
  */
 export const __test_only_signalPromotionDepth: { value: number } = { value: 0 };
 
+/**
+ * Test-only observable: true when the promotion loop hit the cap without
+ * capturing a signal (the silent-miss path — state 3 in TIM-970). False
+ * when the loop captured a signal at any depth, when it was skipped via
+ * `_fizzAllReadyResolved`, or when no signal was ever expected at a depth
+ * shallower than the cap.
+ *
+ * Pairs with `__test_only_signalPromotionDepth`: depth alone cannot
+ * distinguish "cap hit with signal captured on yield 5" from "cap hit with
+ * signal arriving on yield 6+" — both read `.value === 5`. This flag closes
+ * that gap. See TIM-970, design/05-streaming.md §"Signal Promotion".
+ */
+export const __test_only_signalPromotionCapHit: { value: boolean } = { value: false };
+
 interface SsrRenderOptions {
   req: Request;
   rscStream: ReadableStream<Uint8Array>;
@@ -261,14 +290,61 @@ export async function renderSsrResponse(opts: SsrRenderOptions): Promise<Respons
     // See design/05-streaming.md §"deferSuspenseFor and the Hold Window"
     if (!signals.redirectSignal && !signals.denySignal && !signals.renderError) {
       let yieldsConsumed = 0;
+      let detectionConfirmedLateSignal = false;
       if (!navContext._fizzAllReadyResolved) {
+        // Promotion phase: bounded cap of SIGNAL_PROMOTION_MAX_YIELDS.
+        // Signals captured here are honored by checkCapturedSignals and
+        // become the response (redirect/deny/error page).
         for (let i = 0; i < SIGNAL_PROMOTION_MAX_YIELDS; i++) {
           await new Promise<void>((r) => queueMicrotask(r));
           yieldsConsumed++;
           if (signals.redirectSignal || signals.denySignal || signals.renderError) break;
         }
+
+        // Detection phase (TIM-970): if the promotion cap was hit without
+        // capturing a signal, yield a few more times to disambiguate state 2
+        // ("no signal was ever coming" — the common legitimate-200 case) from
+        // state 3 ("signal arrived one microtask past the cap" — the silent
+        // miss). Telemetry-only: if a late signal is observed it triggers
+        // the warning and span event but is NOT promoted. Promoting it would
+        // effectively raise the cap to MAX_YIELDS + DETECTION_EXTRA_YIELDS,
+        // which the ticket defers to the E.2 investigation. The signals are
+        // cleared so checkCapturedSignals does not pick them up.
+        if (
+          yieldsConsumed === SIGNAL_PROMOTION_MAX_YIELDS &&
+          !signals.redirectSignal &&
+          !signals.denySignal &&
+          !signals.renderError
+        ) {
+          for (let i = 0; i < SIGNAL_PROMOTION_DETECTION_EXTRA_YIELDS; i++) {
+            await new Promise<void>((r) => queueMicrotask(r));
+            if (signals.redirectSignal || signals.denySignal || signals.renderError) {
+              detectionConfirmedLateSignal = true;
+              signals.redirectSignal = null;
+              signals.denySignal = null;
+              signals.renderError = null;
+              break;
+            }
+          }
+        }
       }
       __test_only_signalPromotionDepth.value = yieldsConsumed;
+      __test_only_signalPromotionCapHit.value = detectionConfirmedLateSignal;
+
+      if (detectionConfirmedLateSignal) {
+        if (isDevMode()) {
+          console.warn(
+            `[timber] Signal promotion cap reached (${SIGNAL_PROMOTION_MAX_YIELDS} microtask yields) — a deny()/redirect()/renderError signal arrived just past the cap and was discarded. ` +
+              `Likely cause: a page using deny()/redirect() inside a deeply-wrapped async component (custom withSpan, decorators, etc.). ` +
+              `Simplify the async chain or reduce withSpan/wrapper depth. ` +
+              `See design/05-streaming.md §"Signal Promotion".`
+          );
+        }
+        addSpanEventSync('timber.ssr.signal_promotion_cap_reached', {
+          depth: SIGNAL_PROMOTION_MAX_YIELDS,
+          signal_types_checked: 'redirect,deny,renderError',
+        });
+      }
     }
 
     const promoted = checkCapturedSignals(/* skipHandledDeny */ true);

package/src/server/sitemap-handler.ts

@@ -75,11 +75,33 @@ export function createAutoSitemapHandler(
   // In dev, this cache is busted by file changes (the handler is recreated
   // when the route tree changes). In production, it's generated once.
   let cachedResult: SitemapResult | null = null;
+  let inflight: Promise<SitemapResult> | null = null;
 
   async function getOrGenerateSitemap(): Promise<SitemapResult> {
     if (cachedResult) return cachedResult;
-    cachedResult = await generateSitemap(root, config, moduleLoader);
-    return cachedResult;
+    if (!inflight) {
+      inflight = generateSitemap(root, config, moduleLoader).then(
+        (result) => {
+          cachedResult = result;
+          inflight = null;
+          return result;
+        },
+        (err) => {
+          inflight = null;
+          throw err;
+        }
+      );
+    }
+    // Every caller races against its own timeout — not just the first.
+    // Per design/06-caching.md — singleflight maps must have a timeout
+    // to prevent deadlock if generateSitemap hangs.
+    const timeout = new Promise<never>((_, reject) =>
+      setTimeout(() => {
+        inflight = null;
+        reject(new Error('[timber] sitemap generation timed out'));
+      }, 30_000)
+    );
+    return Promise.race([inflight, timeout]);
   }
 
   return async (pathname: string): Promise<Response | null> => {

package/src/server/slot-resolver.ts

@@ -196,9 +196,14 @@ export async function resolveSlotElement(
 // ─── Element Wrapping Helpers ───────────────────────────────────────────────
 
 /**
- * Wrap an element with error boundaries and layouts from intermediate
- * slot segments (indices 1..n, skipping the slot root at index 0).
+ * Wrap an element with error boundaries, access gates, and layouts from
+ * intermediate slot segments (indices 1..n, skipping the slot root at index 0).
  * Processes innermost-first to match route-element-builder.ts ordering.
+ *
+ * Access gates are enforced for every intermediate segment that has access.ts,
+ * not just the slot root. Without this, nested slot children (e.g.,
+ * @admin/reports/access.ts) and intercepting route children with access.ts
+ * would bypass authorization. See TIM-999.
  */
 async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
@@ -208,6 +213,7 @@ async function wrapWithIntermediateSegments(
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
     element = await wrapSegmentWithErrorBoundaries(seg, element, h);
+    element = await wrapWithAccessGate(seg, element, h);
     element = await wrapWithLayout(seg, element, h);
   }
   return element;

package/src/server/ssr-wrappers.tsx

@@ -132,8 +132,10 @@ export function wrapSsrElement(
   const withNav = createElement(SsrNavigationProvider, null, element);
 
   // 2. TimberNuqsAdapter equivalent (wraps withNuqsSsrAdapter for the actual nuqs provider)
+  // eslint-disable-next-line react/no-children-prop -- createElement API
   const withNuqs = createElement(SsrNuqsWrapper, { searchParams, children: withNav });
 
   // 3. Outermost: NavigationRoot equivalent (PendingNavigationProvider + TopLoader)
+  // eslint-disable-next-line react/no-children-prop -- createElement API
   return createElement(SsrNavigationRoot, { hasTopLoader, children: withNuqs });
 }

package/src/server/tree-builder.ts

@@ -302,10 +302,12 @@ export async function buildElementTree(config: TreeBuilderConfig): Promise<TreeB
           }
         }
 
+        /* eslint-disable react/no-children-prop -- createElement API */
         element = createElement(LayoutComponent, {
           ...slotProps,
           children: element,
         });
+        /* eslint-enable react/no-children-prop */
       }
     }
   }

package/src/server/types.ts

@@ -34,7 +34,7 @@ export interface RouteContext {
   headers: Headers;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type, typescript/no-empty-interface
 export interface AccessContext {}
 
 export interface Metadata {
@@ -143,7 +143,7 @@ export interface Metadata {
 
 // eslint-disable-next-line @typescript-eslint/no-namespace
 export namespace MetadataRoute {
-  // eslint-disable-next-line @typescript-eslint/no-empty-object-type
+  // eslint-disable-next-line @typescript-eslint/no-empty-object-type, typescript/no-empty-interface
   export interface Sitemap extends Array<SitemapEntry> {}
   export interface SitemapEntry {
     url: string;