@timber-js/app 0.2.0-alpha.166 → 0.2.0-alpha.168

package/src/plugins/fonts.ts

@@ -18,6 +18,7 @@
  * Design doc: 24-fonts.md
  */
 
+import { parseAst } from 'vite';
 import type { Plugin, ResolvedConfig, ViteDevServer } from 'vite';
 import type { PluginContext } from '../plugin-context.js';
 import {
@@ -224,6 +225,35 @@ export function timberFonts(ctx: PluginContext): Plugin {
      */
     buildStart() {},
 
+    /**
+     * Prune stale font entries when a module that previously imported fonts
+     * no longer contains any font import. The transform hook's `filter.code`
+     * skips such modules, so without this hook the old entries would persist
+     * until dev restart. See TIM-1087.
+     */
+    async hotUpdate({ type, file, read }) {
+      if (!pipeline.hasImporter(file)) return;
+      if (type === 'delete') {
+        pipeline.pruneImporter(file);
+        return;
+      }
+      const code = await read();
+      const hasFontImport =
+        code.includes('@timber/fonts/') ||
+        code.includes('@timber-js/app/fonts/') ||
+        code.includes('next/font/');
+      if (hasFontImport) return;
+      // Only prune if the new source parses successfully. A syntax error
+      // means the HMR update will fail and the old module stays active —
+      // pruning would leave it without font CSS until the next valid save.
+      try {
+        parseAst(code, { lang: 'tsx' });
+      } catch {
+        return;
+      }
+      pipeline.pruneImporter(file);
+    },
+
     /**
      * Scan source files for font function calls and extract static config.
      *

package/src/plugins/server-bundle.ts

@@ -19,23 +19,15 @@ import type { Plugin } from 'vite';
 // Listing explicitly silences Vite's "Automatically externalized" warnings.
 const NODE_BUILTINS: string[] = builtinModules.flatMap((m) => [m, `node:${m}`]);
 
-// Build-time-only packages that must never be bundled into the runtime
-// server environments. With `noExternal: true` rolldown otherwise follows
-// the transitive graph through the user's `timber.config.ts` (loaded by the
-// `virtual:timber-cache-handler` dynamic import) into adapter code, dragging
-// build tooling into the prod server bundle. The most visible symptom is
-// rolldown trying to parse `fsevents.node` as JS and failing with
-// `[UNLOADABLE_DEPENDENCY] … stream did not contain valid UTF-8`.
+// Packages that must never be bundled into the runtime server environments.
+// With `noExternal: true`, rolldown follows all transitive imports. These
+// are build-time-only tools that have no runtime use in a server bundle.
 //
-//   - `nitro`, `@mdx-js/rollup`              — build-time tooling reachable
-//     transitively through adapter modules and timber's own MDX activation.
-//   - `rollup`                                — pulled in by nitro and
-//     @mdx-js/rollup; declares `fsevents` as an optional native dep.
-//   - `fsevents`, `chokidar`                  — native/optional deps of
-//     rollup/vite. They are macOS-only file watchers with no runtime use
-//     in a server bundle.
+// The primary leak path (TIM-988) — `virtual:timber-cache-handler` importing
+// `timber.config.ts` and pulling in adapter/MDX deps — was eliminated by
+// TIM-1211: the cache handler virtual module now imports `timber.cache.ts`
+// instead. These externals are retained as defense-in-depth.
 //
-// Mirrored on both rsc and ssr environments. See TIM-988.
 // Cloudflare runtime modules (cloudflare:workers, cloudflare:sockets, etc.)
 // available at runtime on Workers but must not be bundled.
 const CLOUDFLARE_BUILTINS = [

package/src/routing/scanner.ts

@@ -232,6 +232,13 @@ function scanSegmentFiles(dirPath: string, node: SegmentNode, extSet: Set<string
     // See design/16-metadata.md §"Metadata Routes"
     const metaInfo = classifyMetadataRoute(entry);
     if (metaInfo) {
+      if (!metaInfo.nestable && node.segmentName !== '') {
+        throw new Error(
+          `Build error: '${name}' is a root-only metadata convention and must be in the app root directory.\n` +
+            `  File: ${fullPath}\n` +
+            `  Move this file to the app root (not a route group or nested segment).`
+        );
+      }
       if (!node.metadataRoutes) {
         node.metadataRoutes = {};
       }

package/src/server/action-client.ts

@@ -8,7 +8,7 @@
  *   1. Direct call: action(input) → Promise<ActionResult>
  *   2. React useActionState: (prevState, formData) => Promise<ActionResult>
  *
- * See design/08-forms-and-actions.md §"Middleware for Server Actions"
+ * See design/08-forms-and-actions.md §"Middleware and Server Actions"
  */
 
 // ─── ActionError ─────────────────────────────────────────────────────────

package/src/server/als-registry.ts

@@ -127,6 +127,13 @@ export interface RequestContextStore {
    * See TIM-666.
    */
   denyStatus?: number;
+  /**
+   * Callback fired when setDenyStatus() is called. Used by shellSettled
+   * to short-circuit when any component catches a DenySignal in-tree,
+   * regardless of which component caught it (AccessGate, TracedLayout,
+   * or PageDenyBoundary). See TIM-1208.
+   */
+  onDenyStatus?: () => void;
   /**
    * Dev-only: getter for the current request's RSC debug components.
    * Set by renderRoute() so onPipelineError can include component tree

package/src/server/deny-boundary.ts

@@ -262,6 +262,7 @@ export async function PageDenyBoundary({
   Page,
   route,
   denyPages,
+  onSettled,
 }: {
   /** The page server component function. */
   Page: (...args: unknown[]) => unknown;
@@ -269,10 +270,10 @@ export async function PageDenyBoundary({
   route: string;
   /** Deny page fallback chain from the segment chain. */
   denyPages: DenyPageEntry[];
+  /** Called when the page component finishes (success or deny). See TIM-1045. */
+  onSettled?: () => void;
 }): Promise<React.ReactElement> {
   try {
-    // Call the page as an async function — same as React Flight does.
-    // Wrap in OTEL span for tracing (replaces the TracedPage wrapper).
     const result = await withSpan('timber.page', { 'timber.route': route }, () => Page({}));
     return result as React.ReactElement;
   } catch (error: unknown) {
@@ -283,8 +284,9 @@ export async function PageDenyBoundary({
         return denyElement;
       }
     }
-    // Non-deny errors (RedirectSignal, runtime errors) propagate normally.
     throw error;
+  } finally {
+    onSettled?.();
   }
 }
 
@@ -299,6 +301,7 @@ export function setDenyStatus(status: number): void {
   const store = requestContextAls.getStore();
   if (store) {
     store.denyStatus = status;
+    store.onDenyStatus?.();
   }
 }
 

package/src/server/middleware-runner.ts

@@ -57,47 +57,3 @@ export async function runMiddlewareChain(
   }
   return undefined;
 }
-
-// ─── Per-Request Middleware Bypass ─────────────────────────────────────────
-
-/**
- * Per-request marker for synthetic re-render requests that should NOT
- * re-execute `middleware.ts`. The action-dispatch wrapper runs middleware
- * once on the inbound action POST; when validation fails on the no-JS
- * path, it builds a synthetic GET that flows through the normal pipeline
- * to render the page with `getFormFlash()` data. Without this marker, the
- * pipeline would run middleware a second time on that synthetic GET.
- *
- * The set is keyed by the synthetic Request object itself, so the entry
- * lives exactly as long as the request and is garbage-collected with it.
- * Cannot be set or detected by user code — there is no header, no URL
- * parameter, nothing on the wire that an attacker could spoof.
- *
- * See TIM-871.
- *
- * @internal — framework use only.
- */
-const middlewareBypassRequests = new WeakSet<Request>();
-
-/**
- * Mark a request so the pipeline skips its middleware phase.
- *
- * Used by `wrap-action-dispatch.ts` for the no-JS form-rerender path.
- *
- * @internal
- */
-export function markRequestBypassMiddleware(req: Request): void {
-  middlewareBypassRequests.add(req);
-}
-
-/**
- * Check whether a request was marked to bypass middleware.
- *
- * Called by `handleRequest` in pipeline-phases.ts before invoking the
- * middleware phase. Returns false for any request not explicitly marked.
- *
- * @internal
- */
-export function shouldBypassMiddleware(req: Request): boolean {
-  return middlewareBypassRequests.has(req);
-}

package/src/server/param-coercion.ts

@@ -132,6 +132,7 @@ export async function coerceSegmentParams(match: RouteMatch): Promise<void> {
       if (!codec) continue; // no codec in schema → keep raw string
 
       const key = segment.paramName;
+      if (!(key in mergeTarget)) continue;
       try {
         mergeTarget[key] = sanitizeParamValue(codec.parse(mergeTarget[key] as string | string[]));
       } catch (err) {

package/src/server/pipeline-phases.ts

@@ -14,7 +14,7 @@
 
 import { canonicalize } from './canonicalize.js';
 import { runProxy } from './proxy.js';
-import { runMiddlewareChain, shouldBypassMiddleware } from './middleware-runner.js';
+import { runMiddlewareChain } from './middleware-runner.js';
 import { withTiming } from './server-timing.js';
 import {
   applyRequestHeaderOverlay,
@@ -66,8 +66,11 @@ function validateInterceptionHeader(raw: string, stripTrailingSlash: boolean): s
 // ─── Phase: Proxy ──────────────────────────────────────────────────────────
 
 /**
- * Run the proxy.ts phase. Calls user proxy code and uses `handleRequest` as
- * the inner `next()` continuation. The proxy resolver was picked at pipeline
+ * Run the proxy.ts phase. Calls user proxy code with a `next()` continuation.
+ *
+ * When `next` is provided, it replaces the default `handleRequest` as the
+ * continuation — this lets the pipeline inject action dispatch between proxy
+ * and route matching (TIM-1213). The proxy resolver was picked at pipeline
  * construction time so the hot path sees no per-request branching on the
  * `ProxyConfig` discriminant.
  */
@@ -76,13 +79,14 @@ export async function runProxyPhase(
   getProxy: ProxyResolver,
   req: Request,
   method: string,
-  path: string
+  path: string,
+  next?: () => Promise<Response>
 ): Promise<PhaseOutcome> {
   const detailed = config.serverTiming === 'detailed';
   try {
     const proxyExport = await getProxy();
-    const proxyFn = () =>
-      runProxy(proxyExport, req, () => handleRequest(config, req, method, path, true));
+    const continuation = next ?? (() => handleRequest(config, req, method, path, true));
+    const proxyFn = () => runProxy(proxyExport, req, continuation);
     const response = await withSpan('timber.proxy', {}, () =>
       detailed ? withTiming('proxy', 'proxy.ts', proxyFn) : proxyFn()
     );
@@ -514,14 +518,8 @@ export async function handleRequest(
       .join('/') || '/';
   setMatchedSegmentPath(segmentPath.startsWith('/') ? segmentPath : `/${segmentPath}`);
 
-  // Bypass middleware for synthetic re-render requests built by the
-  // action-dispatch wrapper after a no-JS form validation failure.
-  // The wrapper has already executed middleware once on the inbound POST;
-  // running it again on the rerender GET would double-execute auth, rate
-  // limiting, and request-header injection. See TIM-871.
-  const skipMiddleware = shouldBypassMiddleware(req);
   const outcome =
-    !skipMiddleware && match.middlewareChain.length > 0
+    match.middlewareChain.length > 0
       ? await runMiddlewarePhase(config, req, match, responseHeaders, requestHeaderOverlay, {
           canonicalPathname,
           interception,

package/src/server/pipeline.ts

@@ -238,6 +238,29 @@ export interface PipelineConfig {
      */
     match?: RouteMatch
   ) => Response | Promise<Response>;
+
+  /**
+   * Server action dispatch — called after proxy.ts runs for POST requests
+   * that look like server actions. Returns a Response if the request was
+   * handled as an action, or null to fall through to normal routing.
+   *
+   * `canonicalPath` is the already-decoded canonical pathname — the same
+   * value that `handleRequest` and `matchRoute` use. Do NOT re-derive it
+   * from `req.url` (which re-encodes).
+   *
+   * The `reenter` parameter is the full pipeline function (including proxy,
+   * ALS, tracing) for the no-JS validation rerender path — the synthetic
+   * GET flows through the complete pipeline.
+   *
+   * Moved into the pipeline (TIM-1213) so proxy.ts runs on action POSTs,
+   * matching the design doc contract: "proxy.ts runs on every request,
+   * no exclusions."
+   */
+  dispatchAction?: (
+    req: Request,
+    canonicalPath: string,
+    reenter: (req: Request) => Promise<Response>
+  ) => Promise<Response | null>;
 }
 
 // ─── Pipeline ──────────────────────────────────────────────────────────────
@@ -265,7 +288,11 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
   // Logged with each request for diagnosing resource contention.
   let activeRequests = 0;
 
-  return async (req: Request): Promise<Response> => {
+  // Self-reference for re-entry — the no-JS validation rerender path
+  // passes a synthetic GET back through the full pipeline (including
+  // proxy, ALS, tracing). The inner closure captures `pipelineFn` by
+  // name; by the time it's invoked, the const binding is initialized.
+  const pipelineFn = async (req: Request): Promise<Response> => {
     const url = new URL(req.url);
     const method = req.method;
     const path = url.pathname;
@@ -325,6 +352,24 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                 canonicalReq = new Request(canonicalUrl.toString(), req);
               }
 
+              // Build the inner handler — runs after proxy, before route
+              // matching. Checks for server action POSTs and dispatches them
+              // without entering the route match → middleware → render chain.
+              // Falls through to handleRequest for normal route handling.
+              // TIM-1213: action dispatch is now INSIDE the pipeline so
+              // proxy.ts runs on every request, including action POSTs.
+              const innerHandler = async (): Promise<Response> => {
+                if (config.dispatchAction) {
+                  const actionResult = await config.dispatchAction(
+                    canonicalReq,
+                    canonicalPath,
+                    pipelineFn
+                  );
+                  if (actionResult) return actionResult;
+                }
+                return handleRequest(config, canonicalReq, method, canonicalPath, true);
+              };
+
               let result: Response;
               if (proxyResolver) {
                 const outcome = await runProxyPhase(
@@ -332,7 +377,8 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   proxyResolver,
                   canonicalReq,
                   method,
-                  canonicalPath
+                  canonicalPath,
+                  innerHandler
                 );
                 result = await outcomeToResponse(config, outcome, {
                   req: canonicalReq,
@@ -340,7 +386,7 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   path: canonicalPath,
                 });
               } else {
-                result = await handleRequest(config, canonicalReq, method, canonicalPath, true);
+                result = await innerHandler();
               }
 
               // Set response status on the root span before it ends —
@@ -427,4 +473,6 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
       });
     });
   };
+
+  return pipelineFn;
 }

package/src/server/route-element-builder.ts

@@ -34,6 +34,7 @@ function getDevNonce(): string {
 }
 import { DenySignal, RedirectSignal } from './primitives.js';
 import { AccessGate } from './access-gate.js';
+import { requestContextAls } from './als-registry.js';
 import {
   PageDenyBoundary,
   buildDenyPageChain,
@@ -177,6 +178,15 @@ export interface RouteElementResult {
    * See design/19-client-navigation.md §"X-Timber-State-Tree Header"
    */
   skippedSegments: string[];
+  /**
+   * Resolves when every deny-capable shell component (PageDenyBoundary and
+   * each TracedLayout with a deny page chain) has finished executing, OR
+   * immediately when any of them catches a DenySignal in-tree (the HTTP
+   * status is known at that point; inner components may never run).
+   * Undefined when the route has no deny-capable server components.
+   * See TIM-1045 (pages), TIM-1208 (layouts).
+   */
+  shellSettled?: Promise<void>;
 }
 
 // ─── Module Processing Helpers ─────────────────────────────────────────────
@@ -398,6 +408,7 @@ export async function buildRouteElement(
   // Skip OG auto-linking when the user already declared images in metadata.
   // See design/16-metadata.md §"Auto-Linking"
   const hasUserOgImage = Boolean(resolvedMetadata.openGraph?.images);
+  const hasUserTwitterImage = Boolean(resolvedMetadata.twitter?.images);
   const requestUrl = new URL(req.url);
   const requestPathname = requestUrl.pathname;
   // In dev mode, use the request origin so OG URLs resolve to localhost.
@@ -417,7 +428,7 @@ export async function buildRouteElement(
       if (!convention) continue;
       // Non-nestable routes only auto-link from root
       if (!convention.nestable && segment.urlPath !== '/') continue;
-      // Skip auto-linking if user already declared the image in metadata
+      // Skip auto-linking entirely if user declared openGraph.images (covers both og + twitter)
       if (convention.type === 'opengraph-image' && hasUserOgImage) continue;
       // Build the href using the actual request path (not the pattern with [param]).
       // For nestable routes, the metadata route sits under the same resolved path
@@ -440,6 +451,14 @@ export async function buildRouteElement(
         href = new URL(href, ogBase).toString();
       }
       for (const autoLink of getMetadataRouteAutoLink(convention.type, href)) {
+        // Skip auto-linked twitter:image when user declared twitter.images
+        if (
+          hasUserTwitterImage &&
+          autoLink.tag === 'meta' &&
+          'name' in autoLink &&
+          autoLink.name === 'twitter:image'
+        )
+          continue;
         if (autoLink.tag === 'link') {
           const attrs: Record<string, string> = { rel: autoLink.rel, href: autoLink.href };
           if (autoLink.type) attrs.type = autoLink.type;
@@ -462,12 +481,24 @@ export async function buildRouteElement(
   // Build element tree: page wrapped in layouts (innermost to outermost)
   const h = createElement as (...args: unknown[]) => React.ReactElement;
 
-  // Build the page element.
-  // Client references ('use client' pages) must NOT be called as functions —
-  // they are proxy objects that throw when invoked. They must go through
-  // createElement only, which serializes them as client references in the
-  // RSC Flight stream. OTEL tracing is skipped for client components.
-  // See TIM-627 for the original bug.
+  // Shell settlement tracking (TIM-1045 pages, TIM-1208 layouts).
+  // ChildSegmentProvider is 'use client', so React Flight eagerly
+  // serializes both the layout and child content as independent subtrees —
+  // the page can settle before an outer layout. We need all deny-capable
+  // components to settle before committing the HTTP status.
+  //
+  // Each tracked component gets its own deferred. shellSettled resolves
+  // when ALL settle (Promise.all) OR when any in-tree deny fires
+  // (short-circuit via onDenyStatus — covers AccessGate, TracedLayout,
+  // and PageDenyBoundary without threading callbacks into each).
+  const shellPromises: Promise<void>[] = [];
+  let resolveShortCircuit: (() => void) | undefined;
+  const trackShellComponent = (): (() => void) => {
+    let resolve!: () => void;
+    shellPromises.push(new Promise<void>((r) => (resolve = r)));
+    return resolve;
+  };
+
   // Build the page element.
   // Server component pages are wrapped in PageDenyBoundary which calls
   // them as async functions and catches DenySignal — rendering the deny
@@ -482,11 +513,12 @@ export async function buildRouteElement(
   if (isClientReference(PageComponent)) {
     element = h(PageComponent, {});
   } else if (leafDenyPages && leafDenyPages.length > 0) {
-    // Server component page WITH deny page chain — wrap in PageDenyBoundary
+    const onSettled = trackShellComponent();
     element = h(PageDenyBoundary, {
       Page: PageComponent,
       route: match.segments[leafIndex]?.urlPath ?? '/',
       denyPages: leafDenyPages,
+      onSettled,
     });
   } else {
     // Server component page WITHOUT deny page chain — trace only
@@ -694,6 +726,8 @@ export async function buildRouteElement(
         // fallback path. See TIM-668, design/04-authorization.md.
         const layoutComponentRef = layoutComponent;
         const layoutDenyPages = denyPageChains.get(i);
+        const hasLayoutDenyChain = !!layoutDenyPages && layoutDenyPages.length > 0;
+        const onLayoutSettled = hasLayoutDenyChain ? trackShellComponent() : undefined;
         const TracedLayout = async (props: Record<string, unknown>) => {
           try {
             return await withSpan('timber.layout', { 'timber.segment': segmentId }, () =>
@@ -707,8 +741,11 @@ export async function buildRouteElement(
                 return denyElement;
               }
             }
-            // Non-deny errors (RedirectSignal, runtime errors) propagate normally.
+            // Non-deny errors (RedirectSignal, runtime errors) propagate normally
+            // to onError — signalDetected / renderError handling covers those.
             throw error;
+          } finally {
+            onLayoutSettled?.();
           }
         };
         layoutElement = h(TracedLayout, {
@@ -776,11 +813,24 @@ export async function buildRouteElement(
     element = replaceOutermostSegmentOutlet(element, outermostSegmentProvider);
   }
 
+  // Compose shellSettled: resolves when ALL deny-capable components settle
+  // (Promise.all) OR immediately when any component calls setDenyStatus()
+  // (short-circuit via onDenyStatus — covers AccessGate, TracedLayout, and
+  // PageDenyBoundary). See TIM-1045, TIM-1208.
+  let shellSettled: Promise<void> | undefined;
+  if (shellPromises.length > 0) {
+    const shortCircuit = new Promise<void>((r) => (resolveShortCircuit = r));
+    const store = requestContextAls.getStore();
+    if (store) store.onDenyStatus = () => resolveShortCircuit?.();
+    shellSettled = Promise.race([Promise.all(shellPromises).then(() => {}), shortCircuit]);
+  }
+
   return {
     element,
     layoutComponents,
     segments,
     deferSuspenseFor,
     skippedSegments,
+    shellSettled,
   };
 }

package/src/server/rsc-entry/action-middleware-runner.ts

@@ -1,21 +1,21 @@
 /**
- * Middleware-on-actions runner — runs the matched route's `middleware.ts`
- * chain for an action POST inside its own `runWithRequestContext` scope
- * and returns a `MiddlewareOutcome` value the dispatcher can translate.
+ * Middleware runner for revalidation — runs a route's `middleware.ts`
+ * chain inside its own `runWithRequestContext` scope and returns a
+ * `MiddlewareOutcome` value the caller can translate.
  *
- * Lifted out of `wrap-action-dispatch.ts` (TIM-853) so the dispatcher
- * can be read top-to-bottom without scrolling past the chain runner. The
- * function is intentionally a free function (not a closure over deps)
- * so it can be unit-tested in isolation. It does not import virtual
- * modules and does not call into the action handler — it owns exactly
- * the "run middleware once" step and nothing else.
+ * Used by the revalidation renderer (TIM-996) to run the TARGET route's
+ * middleware before building the revalidated element tree, ensuring that
+ * `revalidatePath('/admin')` from a public action honors admin's auth.
  *
- * Failure modes are encoded as outcome variants rather than thrown so the
- * caller never has to wrap this in try/catch. The only thrown errors are
- * truly unexpected (programmer bugs) and propagate naturally.
+ * NOT used for action dispatch itself — per-segment middleware does not
+ * run on action POSTs (TIM-1134). Actions are dispatched by action ID,
+ * not route segment, so `proxy.ts` and `createActionClient({ middleware })`
+ * are the correct auth mechanisms.
  *
- * See TIM-871 for the full design rationale (closing the
- * CVE-2025-29927-class bug where actions silently bypass middleware).
+ * The function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. Failure modes are encoded as
+ * outcome variants rather than thrown so the caller never has to wrap
+ * this in try/catch.
  */
 
 import { getCookiesForSsr, getSetCookieHeaders } from '../cookie-context.js';

package/src/server/rsc-entry/index.ts

@@ -43,7 +43,7 @@ import { loadCdnPurgeHandler } from 'virtual:timber-cache-handler';
 // @ts-expect-error — virtual module provided by timber-routing plugin
 import globalSchemaCodecs from 'virtual:timber-schema';
 
-import { wrapPipelineWithActionDispatch } from './wrap-action-dispatch.js';
+import { wrapPipelineWithActionDispatch, buildActionDispatcher } from './wrap-action-dispatch.js';
 import type { BodyLimitsConfig } from '../body-limits.js';
 import type { BuildManifest } from '../build-manifest.js';
 import { resolveLogMode } from '../../dev-tools/logger.js';
@@ -199,6 +199,8 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     | { disabled: boolean; enableHMRInDev: boolean }
     | undefined;
   const clientJsDisabled = clientJsConfig?.disabled ?? false;
+  const clientSegmentCache =
+    ((runtimeConfig as Record<string, unknown>).clientSegmentCache as boolean) ?? false;
   const clientBootstrap = buildClientScripts({
     ...runtimeConfig,
     clientJavascript: clientJsConfig ?? { disabled: false, enableHMRInDev: false },
@@ -295,6 +297,7 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
         {
           clientBootstrap,
           clientJsDisabled,
+          clientSegmentCache,
           rootSegment: manifest.root,
           buildManifest: typedBuildManifest,
           globalError: manifest.globalError,
@@ -386,19 +389,36 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
     // and no user-authored sitemap exists at the app root.
     // See design/16-metadata.md §"Auto-generated Sitemap"
     autoSitemapHandler: createAutoSitemapHandler(manifest.root, runtimeConfig),
+
+    // Server action dispatch — runs after proxy.ts, before route matching
+    // (TIM-1213). Moved into the pipeline so proxy.ts runs on action POSTs,
+    // matching the design doc: "proxy.ts runs on every request, no exclusions."
+    // Per-segment `middleware.ts` does NOT run on action POSTs (TIM-1134).
+    dispatchAction: buildActionDispatcher({
+      csrfConfig: {
+        csrf: runtimeConfig.csrf,
+        allowedOrigins: (runtimeConfig as Record<string, unknown>).allowedOrigins as
+          | string[]
+          | undefined,
+      },
+      bodyLimits: (runtimeConfig as Record<string, unknown>).limits as BodyLimitsConfig['limits'],
+      sensitiveFields: formsConfig?.stripSensitiveFields,
+      matchRoute,
+      buildRevalidateRenderer: createRevalidateRendererFactory({
+        matchRoute,
+        coerceSegmentParams,
+        buildManifest: buildManifest as BuildManifest,
+      }),
+    }),
   };
 
   const pipeline = createPipeline(pipelineConfig);
 
-  // Wrap the pipeline to enforce CSRF at the request boundary and intercept
-  // server action requests. By default, the wrapper also runs the matched
-  // route's `middleware.ts` chain on action POSTs, so authentication, rate
-  // limiting, tenant isolation, and request-header injection apply to
-  // actions just like they do to page renders. See TIM-871 and
-  // design/08-forms-and-actions.md §"Middleware for Server Actions".
-  //
-  // CSRF validation lives in the wrapper (not inside the action handler) so
-  // it covers route.ts API handlers as well as server actions. See LOCAL-773.
+  // Wrap the pipeline to enforce CSRF at the request boundary.
+  // CSRF validation lives in the wrapper (not inside the pipeline) so it
+  // runs before proxy.ts and covers every unsafe-method request. Server
+  // action dispatch has moved into the pipeline (TIM-1213) so proxy.ts
+  // runs on action POSTs. See LOCAL-773.
   const csrfConfig = {
     csrf: runtimeConfig.csrf,
     allowedOrigins: (runtimeConfig as Record<string, unknown>).allowedOrigins as
@@ -406,38 +426,8 @@ async function createRequestHandler(manifest: typeof routeManifest, runtimeConfi
       | undefined,
   };
 
-  const actionsConfig = (runtimeConfig as Record<string, unknown>).actions as
-    | { runMiddleware?: boolean }
-    | undefined;
-
   const handler = wrapPipelineWithActionDispatch(pipeline, {
     csrfConfig,
-    bodyLimits: (runtimeConfig as Record<string, unknown>).limits as BodyLimitsConfig['limits'],
-    sensitiveFields: formsConfig?.stripSensitiveFields,
-    matchRoute,
-    coerceSegmentParams,
-    renderDenyFallback: pipelineConfig.renderDenyFallback,
-    runMiddleware: actionsConfig?.runMiddleware,
-    // Thread the pipeline's `stripTrailingSlash` setting into the wrapper
-    // so its canonicalization step (applied before `matchRoute` for
-    // action POSTs) matches the page pipeline exactly. Defaults to `true`
-    // both here and inside the wrapper.
-    stripTrailingSlash: pipelineConfig.stripTrailingSlash,
-    // Revalidation renderer — runs the target route's `middleware.ts`
-    // chain BEFORE building the element tree so a server action that
-    // revalidates a protected path honors that path's auth, tenant
-    // isolation, and request-header injection. Closes the silent-bypass
-    // bug where `revalidatePath('/admin')` from a public action would
-    // serialize the admin RSC tree without ever consulting admin's
-    // middleware. Also validates the user-supplied `path` as a local
-    // root-relative URL to reject `revalidatePath('//evil.com/admin')`
-    // and similar scheme/authority injections. See TIM-996 and
-    // design/08-forms-and-actions.md §"revalidatePath()".
-    buildRevalidateRenderer: createRevalidateRendererFactory({
-      matchRoute,
-      coerceSegmentParams,
-      buildManifest: buildManifest as BuildManifest,
-    }),
   });
 
   return { handler, pipelineConfig };