@timber-js/app 0.2.0-alpha.209 → 0.2.0-alpha.210

package/src/server/error-boundary-wrapper.ts

@@ -62,9 +62,13 @@ export interface ErrorBoundaryProps {
 }
 
 /**
- * How to load a route file's module. Only `default` is read. The server
- * injects `loadFallbackModule`, which reports a failed load and returns
- * `null`, so a broken status or error page is never skipped silently.
+ * How to load a route file's module. Only `default` is read. A module that
+ * fails to load resolves to `null` — the loader must not reject, because
+ * building an error boundary must not itself throw (TIM-584). The server
+ * injects `loadFallbackModule`, which logs and reports the failed load before
+ * returning `null`, so a broken status or error page is never skipped
+ * silently (TIM-1458). The walk deliberately does not catch a rejection:
+ * a catch here would be the silent skip.
  */
 type BoundaryModuleLoader<TFile> = (
   file: TFile
@@ -74,7 +78,7 @@ type BoundaryModuleLoader<TFile> = (
 export interface ErrorBoundaryWrapConfig<TFile, TElement> {
   /** `React.createElement` or an equivalent element factory. */
   createElement: (type: unknown, props: object) => TElement;
-  /** Loads a route file's module. Failures skip the boundary — see below. */
+  /** Loads a route file's module; resolves to `null` when it fails. See `BoundaryModuleLoader`. */
   loadModule: BoundaryModuleLoader<TFile>;
   /**
    * The error boundary component to instantiate (`TimberErrorBoundary`, or a
@@ -93,8 +97,8 @@ export interface ErrorBoundaryWrapConfig<TFile, TElement> {
  * Load a status/error file's component, or `null` if the boundary should be skipped.
  *
  * Two ways to get `null`, both deliberate:
- *   - the module fails to load (syntax error in the error page) — building an
- *     error boundary must not itself throw, so the boundary is skipped (TIM-584);
+ *   - the module fails to load (syntax error in the error page) — the loader
+ *     has already logged and reported it and resolved to `null`;
  *   - the default export is not a valid React component type, which would
  *     otherwise crash inside `createElement`.
  */
@@ -102,12 +106,7 @@ async function loadBoundaryComponent<TFile>(
   file: TFile,
   loadModule: BoundaryModuleLoader<TFile>
 ): Promise<LoadedComponent | null> {
-  let mod: { default?: unknown } | null;
-  try {
-    mod = await loadModule(file);
-  } catch {
-    return null;
-  }
+  const mod = await loadModule(file);
   return isValidElementType(mod?.default) ? mod.default : null;
 }
 

package/src/server/fallback-error.ts

@@ -21,8 +21,7 @@ import type { ClientBootstrapConfig } from './html-injectors.ts';
 import type { LayoutEntry } from './deny-renderer.ts';
 import type { GlobalErrorFile } from './rsc-entry/error-renderer.ts';
 import { swallow } from './logger.ts';
-import { reportRenderError } from './pipeline-helpers.ts';
-import { loadModule } from './safe-load.ts';
+import { loadFallbackModule } from './pipeline-helpers.ts';
 
 /**
  * Render a fallback error page when the render pipeline throws.
@@ -58,25 +57,18 @@ export async function renderFallbackError(
   const { renderErrorPage } = await import('./rsc-entry/error-renderer.ts');
   const segments = [rootSegment];
   const layoutComponents: LayoutEntry[] = [];
-  // Wrap layout loading in try/catch — if the root layout module itself
-  // crashes (evaluation failure, syntax error, etc.), we still want to
-  // reach renderErrorPage so it can fall through to global-error.tsx
-  // (Tier 2), which renders without any layout wrapping.
-  try {
-    if (rootSegment.layout) {
-      const mod = await loadModule(rootSegment.layout);
-      if (mod.default) {
-        layoutComponents.push({
-          component: mod.default as (...args: unknown[]) => unknown,
-          segment: rootSegment,
-        });
-      }
-    }
-  } catch (layoutError) {
-    // Layout failed to load — proceed without it. renderErrorPage will
-    // attempt segment-level error pages (without layout wrapping) and
-    // then fall through to global-error.tsx if those also fail.
-    reportRenderError(layoutError, req, { segments: match?.segments });
+  // If the root layout module itself fails to load (evaluation failure,
+  // syntax error), proceed without it: renderErrorPage still tries the
+  // segment-level error pages (without layout wrapping) and then falls
+  // through to global-error.tsx. loadFallbackModule logs and reports it.
+  const mod = rootSegment.layout
+    ? await loadFallbackModule(rootSegment.layout, req, match?.segments)
+    : null;
+  if (mod?.default) {
+    layoutComponents.push({
+      component: mod.default as (...args: unknown[]) => unknown,
+      segment: rootSegment,
+    });
   }
   const rootMatch: RouteMatch = {
     segments,

package/src/server/form-flash.ts

@@ -11,7 +11,7 @@
  *
  * The flash data is server-side only — never serialized to cookies or headers.
  *
- * See design/08-forms-and-actions.md §"No-JS Error Round-Trip"
+ * See design/08-forms-and-actions.md §"No-JS Result Round-Trip"
  */
 
 import type { ValidationErrors } from './action-client.ts';

package/src/server/logger.ts

@@ -72,9 +72,10 @@ function withTraceContext(data?: Record<string, unknown>): Record<string, unknow
  * so this line is the only place the rejected origin is visible (TIM-1459).
  * `detail` names the observed origin and, where one exists, the expected one.
  *
- * The CSRF gate runs at the pipeline boundary, before the pipeline opens its
- * trace scope, so a rejection mints its own `trace_id` — the field is always
- * present (design/17-logging.md §"trace_id is Always Set").
+ * The gate runs inside the pipeline's trace scope, so the line carries the
+ * request's `trace_id`. A caller outside any scope still gets one minted
+ * here — the field is always present (design/17-logging.md §"trace_id is
+ * Always Set").
  */
 export function logCsrfRejected(
   detail: string,
@@ -146,6 +147,21 @@ export function logRenderError(data: {
   _logger.error('unhandled render-phase error', withTraceContext(data));
 }
 
+/**
+ * Log a status page, error page, `global-error.tsx` or fallback layout that
+ * failed to load and was skipped: the next fallback tier answers in its place.
+ * Level: error — a boundary that vanished is a bug in the app, even though the
+ * request still gets a page. The caller writes it once per file and failure.
+ */
+export function logSkippedModule(data: {
+  method: string;
+  path: string;
+  file: string;
+  error: unknown;
+}): void {
+  _logger.error('route file failed to load and was skipped', withTraceContext(data));
+}
+
 /** Log proxy.ts uncaught error. Level: error. */
 export function logProxyError(data: { error: unknown }): void {
   _logger.error('proxy.ts threw uncaught error', withTraceContext(data));

package/src/server/metadata-collector.ts

@@ -116,6 +116,8 @@ export function MetadataCollector(props: MetadataCollectorProps): ReactNode {
 
 export interface MetadataHeadProps {
   segments: ManifestSegmentNode[];
+  /** The matcher's raw (pre-coercion) params — fill the owning segment's URL for auto-links. */
+  rawSegmentParams: Record<string, string | string[]>;
   requestUrl: string;
   metadataRouteHashes?: Record<string, string>;
 }
@@ -139,7 +141,7 @@ export interface MetadataHeadProps {
  * See TIM-1367 for the concurrent resolution design.
  */
 export async function MetadataHead(props: MetadataHeadProps): Promise<ReactNode> {
-  const { segments, requestUrl, metadataRouteHashes } = props;
+  const { segments, rawSegmentParams, requestUrl, metadataRouteHashes } = props;
   const deferredEntries = getDeferredMetadataEntries();
 
   // Resolve all deferred metadata concurrently. Rejected entries are
@@ -166,6 +168,7 @@ export async function MetadataHead(props: MetadataHeadProps): Promise<ReactNode>
     Infinity,
     resolved,
     new URL(requestUrl),
+    rawSegmentParams,
     metadataRouteHashes
   );
   headElements.push(...autoLinked);

package/src/server/metadata-routes.ts

@@ -14,6 +14,7 @@ import { randomUUID } from 'node:crypto';
 import type { HeadElement } from './metadata.ts';
 import type { Metadata } from './types.ts';
 import type { ManifestSegmentNode } from './route-matcher.ts';
+import { extractUrlParts } from './chain-url-parts.ts';
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -357,6 +358,17 @@ function getDevNonce(): string {
  * emits HeadElement descriptors for <link> and <meta> tags that React Float
  * hoists into <head>.
  *
+ * A metadata file is served under the URL of the segment that owns it, not
+ * under every descendant URL: a root `app/icon.tsx` rendered on `/map` links
+ * `/icon.png`, and `app/posts/[id]/opengraph-image.tsx` on `/posts/42/comments`
+ * links `/posts/42/opengraph-image.png`. The owner's prefix is the URL parts
+ * the chain has consumed through that segment (`extractUrlParts`, the same
+ * walk slot matching uses), filled with the request's raw param values — the
+ * parts the metadata route matcher walks back to the same owner.
+ *
+ * Segments at or below an intercepting segment are skipped: the metadata
+ * matcher only walks the canonical tree, so nothing serves their files.
+ *
  * See design/16-metadata.md §"Auto-Linking"
  */
 export function collectMetadataRouteHeadElements(
@@ -364,12 +376,12 @@ export function collectMetadataRouteHeadElements(
   firstDeniedIndex: number,
   resolvedMetadata: Metadata,
   requestUrl: URL,
+  rawSegmentParams: Record<string, string | string[]>,
   metadataRouteHashes?: Record<string, string>
 ): HeadElement[] {
   const elements: HeadElement[] = [];
   const hasUserOgImage = Boolean(resolvedMetadata.openGraph?.images);
   const hasUserTwitterImage = Boolean(resolvedMetadata.twitter?.images);
-  const requestPathname = requestUrl.pathname;
   // In dev mode, use the request origin so OG URLs resolve to localhost.
   // In production, use metadataBase (the canonical domain).
   const ogBase =
@@ -377,27 +389,30 @@ export function collectMetadataRouteHeadElements(
       ? new URL(requestUrl.origin)
       : resolvedMetadata.metadataBase;
 
-  for (let si = 0; si < segments.length; si++) {
+  const interceptingIndex = segments.findIndex((s) => s.segmentType === 'intercepting');
+  const servedDepth = interceptingIndex === -1 ? segments.length : interceptingIndex;
+
+  for (let si = 0; si < servedDepth; si++) {
     const segment = segments[si];
     if (!segment.metadataRoutes) continue;
     if (si >= firstDeniedIndex) continue;
+    // Params are canonical (decoded) values; encode each part so the href
+    // canonicalizes back to the pathname the matcher resolves to this owner.
+    const segmentPrefix = extractUrlParts(segments.slice(0, si + 1), rawSegmentParams)
+      .map((part) => `/${encodeURIComponent(part)}`)
+      .join('');
     for (const baseName of Object.keys(segment.metadataRoutes)) {
       const convention = METADATA_ROUTE_CONVENTIONS[baseName];
       if (!convention) continue;
       if (!convention.nestable && segment.urlPath !== '/') continue;
       if (convention.type === 'opengraph-image' && hasUserOgImage) continue;
-      const resolvedPrefix = convention.nestable
-        ? requestPathname === '/'
-          ? ''
-          : requestPathname
-        : '';
       const metaFile = segment.metadataRoutes[baseName];
       const fileServePath = metaFile?.filePath
         ? resolveServePathForFile(baseName, metaFile.filePath)
         : convention.serveExtension
           ? `${convention.servePath}.${convention.serveExtension}`
           : convention.servePath;
-      let href = `${resolvedPrefix}/${fileServePath}`;
+      let href = `${segmentPrefix}/${fileServePath}`;
       if (convention.type === 'opengraph-image') {
         const fileHash = metaFile?.filePath ? metadataRouteHashes?.[metaFile.filePath] : undefined;
         const cacheBust = fileHash ?? getDevNonce();

package/src/server/pipeline-helpers.ts

@@ -20,16 +20,52 @@ import { getTraceId } from './tracing.ts';
 import { requestContextAls } from './als-registry.ts';
 import { RedirectSignal } from './primitives.ts';
 import { isControlFlowSignal } from './signal-identity.ts';
-import { logRenderError, swallow } from './logger.ts';
+import { logRenderError, logSkippedModule, swallow } from './logger.ts';
 import { isAbortError } from './render-utils.ts';
 import { loadModule, ModuleLoadError, type ManifestLoader } from './safe-load.ts';
 import { getWaitUntil } from './waituntil-bridge.ts';
-import { isApiRouteChain, type ManifestSegmentNode } from './route-matcher.ts';
-import type { ProxyConfig } from './pipeline.ts';
+import { isApiRouteChain, isCsrfExemptRoute, type ManifestSegmentNode } from './route-matcher.ts';
+import type { ProxyConfig, RouteMatcher } from './pipeline.ts';
+import { csrfRejectionResponse, validateCsrf, type CsrfConfig } from './csrf.ts';
 import type { PhaseName } from './pipeline-outcome.ts';
 
 // ─── Prototype-Pollution-Safe Sanitizer ────────────────────────────────────
 
+// ─── CSRF Gate ─────────────────────────────────────────────────────────────
+
+/**
+ * The pipeline-boundary CSRF gate: the 403 to answer with, or null to go on.
+ *
+ * Runs on every request after canonicalization and before proxy.ts, so it
+ * covers route.ts handlers and server actions alike, and no user code has
+ * run when it decides. The per-route exemption is looked up only for a
+ * request the check would reject — the common accepted request never pays
+ * for a match. The lookup uses the pipeline's own matcher on the canonical
+ * path, the same match `handleRequest` dispatches on, and reads a flag the
+ * scanner took from route.ts source, so deciding it loads no module.
+ *
+ * A matcher that throws leaves the request unexempted: fail closed.
+ *
+ * See design/08-forms-and-actions.md §"CSRF Protection".
+ */
+export function csrfGate(
+  req: Request,
+  canonicalPath: string,
+  csrf: CsrfConfig,
+  matchRoute: RouteMatcher
+): Response | null {
+  const result = validateCsrf(req, csrf);
+  if (result.ok) return null;
+  let exempt = false;
+  try {
+    const match = matchRoute(canonicalPath);
+    exempt = match !== null && isCsrfExemptRoute(match.segments);
+  } catch (err) {
+    swallow(err, 'csrf gate: route match for exemption lookup threw');
+  }
+  return exempt ? null : csrfRejectionResponse(req, result);
+}
+
 // ─── Proxy Resolver ────────────────────────────────────────────────────────
 
 /**
@@ -338,18 +374,63 @@ export function reportRenderError(
  * taking the page down. Every such load goes through here, whether it builds
  * a boundary for a normal render or a fallback page, so a broken module is
  * never skipped silently.
+ *
+ * Logged and reported once per broken file, not once per request: every
+ * request that renders under a broken `error.tsx` loads it again (TIM-1458).
+ * See `skippedFiles` for how "the same failure" is recognised. The first
+ * request to hit a failure is the one that reports it; if that request has
+ * already aborted, `fireOnRequestError()` drops the report and the failure is
+ * only logged.
+ *
+ * Never rejects, including when a user logger throws: building an error
+ * boundary must not itself throw (TIM-584), and the boundary walk does not
+ * catch for it.
  */
-export function loadFallbackModule(
+export async function loadFallbackModule(
   file: ManifestLoader,
   req: Request,
   segments?: readonly ManifestSegmentNode[]
 ): Promise<Record<string, unknown> | null> {
-  return loadModule(file).catch((loadError: unknown) => {
-    reportRenderError(loadError, req, { segments });
-    return null;
-  });
+  let loadError: unknown;
+  try {
+    const mod = await loadModule(file);
+    skippedFiles.delete(file.filePath);
+    return mod;
+  } catch (error) {
+    loadError = error;
+  }
+  const failure = loadError instanceof Error ? loadError.message : String(loadError);
+  if (skippedFiles.get(file.filePath) === failure) return null;
+  skippedFiles.set(file.filePath, failure);
+  try {
+    logSkippedModule({
+      method: req.method,
+      path: new URL(req.url).pathname,
+      file: file.filePath,
+      error: loadError,
+    });
+  } catch (logError) {
+    swallow(logError, 'logger.error threw while logging a skipped route file');
+  }
+  fireInBackground(fireOnRequestError(loadError, req, 'render', segments));
+  return null;
 }
 
+/**
+ * The failure each broken fallback file was last logged with, keyed by the
+ * file and compared by message — not by error identity. In Vite dev a file
+ * that fails to transform (a syntax error) is fetched again on every import,
+ * and the module runner revives the server's error as a new `Error` each
+ * time (`reviveInvokeError`), so identity never repeats; the message does.
+ * Keyed by file so two files skipped over one broken import each log.
+ *
+ * A successful load clears the file's entry, so fixing a file and breaking
+ * it again — even with the same message — logs again. An edit that changes
+ * the error changes the message and logs too. It grows with the number of
+ * broken files, not with requests.
+ */
+const skippedFiles = new Map<string, string>();
+
 /**
  * Run a `cache.component` stale-while-revalidate re-render as a singleflight
  * body, and log and report its failure once for the flight. The stale

package/src/server/pipeline.ts

@@ -2,7 +2,7 @@
  * Request pipeline — the central dispatch for all timber.js requests.
  *
  * Pipeline stages (in order):
- *   proxy.ts → canonicalize → route match → 103 Early Hints → middleware.ts → render
+ *   canonicalize → CSRF gate → proxy.ts → route match → 103 Early Hints → middleware.ts → render
  *
  * The phase functions live in `pipeline-phases.ts` so each phase can be
  * tested in isolation. The terminal `outcomeToResponse` translator and
@@ -32,7 +32,8 @@ import {
 import { logRequestReceived, logRequestCompleted, logSlowRequest } from './logger.ts';
 import { DenySignal } from './primitives.ts';
 import type { ManifestSegmentNode } from './route-matcher.ts';
-import { makeProxyResolver } from './pipeline-helpers.ts';
+import { csrfGate, makeProxyResolver } from './pipeline-helpers.ts';
+import type { CsrfConfig } from './csrf.ts';
 import { handleRequest, runProxyPhase } from './pipeline-phases.ts';
 import { outcomeToResponse } from './pipeline-outcome.ts';
 import { canonicalize } from './canonicalize.ts';
@@ -131,6 +132,12 @@ export interface PipelineConfig {
   proxy?: ProxyConfig | ProxyExport;
   /** Route matcher — resolves a canonical pathname to a RouteMatch. */
   matchRoute: RouteMatcher;
+  /**
+   * CSRF configuration (`allowedOrigins`, the `csrf: false` switch). The
+   * gate is on when this is omitted — protection is never opt-in. See
+   * design/08-forms-and-actions.md §"CSRF Protection".
+   */
+  csrf?: CsrfConfig;
   /** Metadata route matcher — resolves metadata route pathnames (sitemap.xml, robots.txt, etc.) */
   matchMetadataRoute?: MetadataRouteMatcher;
   /** Renderer — produces the final Response for a matched route. */
@@ -341,6 +348,10 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                         `  null bytes (%00), path traversal (..), or malformed percent-encoding.`
                     );
                   }
+                  // Early returns set the span status themselves: the shared
+                  // assignment below never runs for them, and a span with
+                  // none reads as 200 in DevSpanProcessor.
+                  await setSpanAttribute('http.response.status_code', canonResult.status);
                   return new Response(null, { status: canonResult.status });
                 }
                 const canonicalPath = canonResult.pathname;
@@ -355,6 +366,20 @@ export function createPipeline(config: PipelineConfig): (req: Request) => Promis
                   canonicalReq = new Request(canonicalUrl.toString(), req);
                 }
 
+                // Stage 0b: CSRF gate — every unsafe-method request, before
+                // proxy.ts or any other user code, and before action
+                // dispatch, so route.ts handlers are covered too (LOCAL-773).
+                const csrfRejection = csrfGate(
+                  canonicalReq,
+                  canonicalPath,
+                  config.csrf ?? {},
+                  config.matchRoute
+                );
+                if (csrfRejection) {
+                  await setSpanAttribute('http.response.status_code', csrfRejection.status);
+                  return csrfRejection;
+                }
+
                 // Build the inner handler — runs after proxy, before route
                 // matching. Checks for server action POSTs and dispatches them
                 // without entering the route match → middleware → render chain.

package/src/server/route-element-builder.ts

@@ -299,6 +299,7 @@ export async function buildRouteElement(
     null,
     h(MetadataHead, {
       segments,
+      rawSegmentParams: match.rawSegmentParams,
       requestUrl: req.url,
       metadataRouteHashes,
     }),

package/src/server/route-matcher.ts

@@ -131,6 +131,17 @@ export function isApiRouteChain(segments: readonly ManifestSegmentNode[]): boole
   return !!leaf?.route && !leaf.page;
 }
 
+/**
+ * Whether a matched chain is a route.ts handler that opted out of the CSRF
+ * check with `export const csrf = false`. Keyed on the same leaf
+ * `isApiRouteChain` dispatches on, so the exemption can only ever apply to
+ * the route.ts that will actually run — never to a page, and so never to a
+ * server action. See design/08-forms-and-actions.md §"Per-route exemption".
+ */
+export function isCsrfExemptRoute(segments: readonly ManifestSegmentNode[]): boolean {
+  return isApiRouteChain(segments) && segments[segments.length - 1]?.csrfExempt === true;
+}
+
 // ─── Metadata Route Matcher ─────────────────────────────────────────────
 
 /** Result of matching a metadata route. */

package/src/server/rsc-entry/{wrap-action-dispatch.ts → action-dispatcher.ts}

@@ -1,36 +1,28 @@
 /**
- * Action-dispatch wrapper around the route pipeline.
+ * Server action dispatcher — the `dispatchAction` callback for
+ * `PipelineConfig`.
  *
  * Extracted from rsc-entry/index.ts so the wiring can be unit-tested in
  * isolation from Vite's virtual modules.
  *
- * ## Architecture (TIM-1213)
- *
- * The wrapper is responsible for ONE thing:
- *
- *   **Pipeline-boundary CSRF validation** — runs on EVERY unsafe-method
- *   request, before any dispatch decision. This is the only line of
- *   defense for `route.ts` API handlers and server actions. See LOCAL-773.
- *
- * Server action dispatch has moved INTO the pipeline (`PipelineConfig.
- * dispatchAction`) so that `proxy.ts` runs on action POSTs — matching the
- * design doc contract: "proxy.ts runs on every request, no exclusions."
- *
- * The `buildActionDispatcher` function constructs the `dispatchAction`
- * callback that `createPipeline` calls after proxy.ts runs. It
- * encapsulates action detection, route-type check, action handler
+ * `createPipeline` calls it after proxy.ts runs (TIM-1213), so proxy.ts
+ * sees action POSTs — "proxy.ts runs on every request, no exclusions." It
+ * encapsulates action detection, the route-type check, action handler
  * dispatch, and the no-JS validation rerender path.
  *
+ * The CSRF gate is not here: it runs in `createPipeline` before proxy.ts
+ * (`csrfGate` in pipeline-helpers.ts). The action handler repeats the
+ * check as defense-in-depth, with no per-route exemption.
+ *
  * Per-segment `middleware.ts` does NOT run on action POSTs (TIM-1134).
- * Actions are dispatched by action ID, not by route segment. CSRF
- * validation runs at the pipeline boundary. Per-action auth/validation
- * belongs in `createActionClient({ middleware })`.
+ * Actions are dispatched by action ID, not by route segment. Per-action
+ * auth/validation belongs in `createActionClient({ middleware })`.
  */
 
 import type { FormRerender } from '../action-handler.ts';
 import { handleActionRequest, isActionRequest } from '../action-handler.ts';
 import type { BodyLimitsConfig } from '../body-limits.ts';
-import { validateCsrf, csrfRejectionResponse, type CsrfConfig } from '../csrf.ts';
+import type { CsrfConfig } from '../csrf.ts';
 import { runWithFormFlash } from '../form-flash.ts';
 import type { RouteMatcher } from '../pipeline.ts';
 import { isApiRouteChain } from '../route-matcher.ts';
@@ -50,12 +42,6 @@ import type { RevalidateRenderer } from '../actions.ts';
  */
 export type RevalidateRendererFactory = (req: Request) => RevalidateRenderer;
 
-/** Dependencies for the CSRF wrapper. */
-export interface ActionDispatchDeps {
-  /** CSRF configuration (Origin allow-list, on/off switch). */
-  csrfConfig: CsrfConfig;
-}
-
 /** Dependencies for the action dispatcher (used inside the pipeline). */
 export interface ActionDispatcherDeps {
   /** CSRF configuration — defense-in-depth check inside the action handler. */
@@ -68,38 +54,12 @@ export interface ActionDispatcherDeps {
   buildRevalidateRenderer: RevalidateRendererFactory;
   /**
    * Route matcher — used for the route-type check that skips action
-   * detection on `route.ts` API handlers (TIM-870).
+   * detection on `route.ts` API handlers (TIM-870). Required: without it,
+   * every form POST to a route.ts would enter the action handler, whose
+   * CSRF check has no per-route exemption, and a `csrf = false` route
+   * would 403 its cross-site callbacks.
    */
-  matchRoute?: RouteMatcher;
-}
-
-// ─── CSRF Wrapper ─────────────────────────────────────────────────────────
-
-/**
- * Wrap a pipeline function with pipeline-boundary CSRF validation.
- *
- * The returned handler is the framework's outermost request entry point.
- * It validates the `Origin` header on every unsafe-method request before
- * any dispatch decision — this is the ONLY line of defense for `route.ts`
- * API handlers, which never see the action handler.
- *
- * Action dispatch has moved inside the pipeline (TIM-1213) so proxy.ts
- * runs on every request. This wrapper now only handles CSRF.
- */
-export function wrapPipelineWithActionDispatch(
-  pipeline: (req: Request) => Promise<Response>,
-  deps: ActionDispatchDeps
-): (req: Request) => Promise<Response> {
-  return async (req: Request): Promise<Response> => {
-    // Pipeline-boundary CSRF validation (LOCAL-773).
-    // Runs on EVERY unsafe-method request, before any dispatch decision.
-    const csrfResult = validateCsrf(req, deps.csrfConfig);
-    if (!csrfResult.ok) {
-      return csrfRejectionResponse(req, csrfResult);
-    }
-
-    return pipeline(req);
-  };
+  matchRoute: RouteMatcher;
 }
 
 // ─── Action Dispatcher ────────────────────────────────────────────────────
@@ -136,11 +96,9 @@ export function buildActionDispatcher(
     //
     // Use `canonicalPath` from the pipeline — NOT `new URL(req.url).pathname`,
     // which re-encodes the path. The matcher expects the decoded canonical form.
-    if (deps.matchRoute) {
-      const match = deps.matchRoute(canonicalPath);
-      if (match && isApiRouteChain(match.segments)) {
-        return null;
-      }
+    const match = deps.matchRoute(canonicalPath);
+    if (match && isApiRouteChain(match.segments)) {
+      return null;
     }
 
     // Action handler dispatch