@decocms/blocks 7.62.3 → 7.62.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.62.3",
+  "version": "7.62.5",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/sdk/cachedLoader.ts

@@ -78,7 +78,6 @@ export interface LoaderModule<TProps = any, TResult = any> {
   cacheKey?: (props: TProps, req?: Request) => string | null;
 }
 
-
 interface CacheEntry<T = unknown> {
   value: T;
   createdAt: number;
@@ -102,16 +101,41 @@ const DEFAULT_MAX_AGE = 60_000;
 const DEFAULT_MAX_CACHE_BYTES = 32 * 1024 * 1024;
 
 function resolveMaxBytes(): number {
-  const env = typeof globalThis.process !== "undefined"
-    ? globalThis.process.env
-    : undefined;
+  const env = typeof globalThis.process !== "undefined" ? globalThis.process.env : undefined;
   const raw = env?.DECO_LOADER_CACHE_MAX_BYTES;
   if (!raw) return DEFAULT_MAX_CACHE_BYTES;
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_CACHE_BYTES;
 }
 
-const MAX_CACHE_BYTES = resolveMaxBytes();
+let maxCacheBytes = resolveMaxBytes();
+
+/**
+ * Override the loader cache byte cap at runtime.
+ *
+ * The `DECO_LOADER_CACHE_MAX_BYTES` env override above only lands when the
+ * Worker's `compatibility_date` is new enough for `nodejs_compat` to populate
+ * `process.env`. Verified in workerd: with `2024-09-23` it is empty both at
+ * module scope and inside the handler; with `2025-06-01` it is populated. Sites
+ * pinned to an older date — a common thing to do, since the date also gates
+ * behaviour flags they may have tuned deliberately — had a documented knob that
+ * silently did nothing.
+ *
+ * Call this from the site's `setup.ts`, before any loader is wrapped.
+ *
+ * Sizing note: the cap is per ISOLATE, not per site, and a Worker isolate has
+ * 128 MB total, shared with the bundle, the V8 heap and the render working set.
+ * Setting it at or near 128 MB does not give headroom — it removes the ceiling.
+ */
+export function setLoaderCacheMaxBytes(bytes: number): void {
+  if (!Number.isFinite(bytes) || bytes <= 0) return;
+  maxCacheBytes = bytes;
+}
+
+/** Current byte cap — exported for diagnostics and tests. */
+export function getLoaderCacheMaxBytes(): number {
+  return maxCacheBytes;
+}
 
 const cache = new Map<string, CacheEntry>();
 let cacheBytes = 0;
@@ -162,13 +186,11 @@ function deleteCacheEntry(key: string) {
 }
 
 function evictIfNeeded() {
-  if (cacheBytes <= MAX_CACHE_BYTES) return;
-  const oldest = [...cache.entries()].sort(
-    (a, b) => a[1].createdAt - b[1].createdAt,
-  );
+  if (cacheBytes <= maxCacheBytes) return;
+  const oldest = [...cache.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
   for (const [key] of oldest) {
     deleteCacheEntry(key);
-    if (cacheBytes <= MAX_CACHE_BYTES) break;
+    if (cacheBytes <= maxCacheBytes) break;
   }
 }
 
@@ -246,11 +268,10 @@ export function createCachedLoader<TProps, TResult>(
       recordCacheMetric(false, name, undefined, "cachedLoader");
       const devStart = performance.now();
       const promise = withInflightTimeout(
-        withTracing(
-          "deco.cachedLoader",
-          () => loaderFn(props),
-          { "deco.loader": name, "deco.cache.policy": "no-cache-dev" },
-        ),
+        withTracing("deco.cachedLoader", () => loaderFn(props), {
+          "deco.loader": name,
+          "deco.cache.policy": "no-cache-dev",
+        }),
         `cachedLoader:dev ${cacheKey}`,
       )
         .then((r) => {
@@ -374,7 +395,6 @@ export function createCachedLoader<TProps, TResult>(
   };
 }
 
-
 // ---------------------------------------------------------------------------
 // Module loader dedup (the `@decocms/apps` cache/cacheKey convention)
 //
@@ -404,11 +424,12 @@ export function createCachedLoaderFromModule<TProps, TResult>(
   name: string,
   mod: LoaderModule<TProps, TResult>,
 ): (props: TProps, req?: Request) => Promise<TResult> {
-  const policy: CachePolicy = typeof mod.cache === "string"
-    ? mod.cache
-    : mod.cache && typeof mod.cache === "object"
-      ? "stale-while-revalidate"
-      : "no-store";
+  const policy: CachePolicy =
+    typeof mod.cache === "string"
+      ? mod.cache
+      : mod.cache && typeof mod.cache === "object"
+        ? "stale-while-revalidate"
+        : "no-store";
 
   // Only `stale-while-revalidate` (or `{ maxAge }`) opts into dedup — matching
   // `@decocms/apps`/deco, where `no-store` (the default) and `no-cache` both
@@ -459,9 +480,7 @@ export function createLoaderEntry<TProps = any, TResult = any>(
   // first-calls — exactly the N-sections-per-render case — share one import
   // instead of racing into N. Reset on failure so a transient import error can
   // retry rather than poisoning the entry forever.
-  let wrappedPromise:
-    | Promise<(props: TProps, req?: Request) => Promise<TResult>>
-    | undefined;
+  let wrappedPromise: Promise<(props: TProps, req?: Request) => Promise<TResult>> | undefined;
   return (props: TProps, req?: Request): Promise<TResult> => {
     if (!wrappedPromise) {
       wrappedPromise = importFn()
@@ -498,6 +517,6 @@ export function getLoaderCacheStats() {
     entries: cache.size,
     inflight: inflightRequests.size,
     estimatedBytes: cacheBytes,
-    maxBytes: MAX_CACHE_BYTES,
+    maxBytes: maxCacheBytes,
   };
 }

package/src/sdk/cachedLoaderMaxBytes.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { getLoaderCacheMaxBytes, setLoaderCacheMaxBytes } from "./cachedLoader";
+
+describe("loader cache byte cap", () => {
+  it("defaults to 32 MB", () => {
+    // process.env is empty in workerd unless compatibility_date is new enough,
+    // which is exactly why the setter below exists.
+    expect(getLoaderCacheMaxBytes()).toBe(32 * 1024 * 1024);
+  });
+
+  it("can be raised programmatically", () => {
+    setLoaderCacheMaxBytes(64 * 1024 * 1024);
+    expect(getLoaderCacheMaxBytes()).toBe(64 * 1024 * 1024);
+  });
+
+  it("ignores nonsense instead of disabling eviction", () => {
+    setLoaderCacheMaxBytes(64 * 1024 * 1024);
+    for (const bad of [0, -1, Number.NaN, Number.POSITIVE_INFINITY]) {
+      setLoaderCacheMaxBytes(bad);
+      expect(getLoaderCacheMaxBytes()).toBe(64 * 1024 * 1024);
+    }
+  });
+});

package/src/sdk/urlUtils.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { cleanPathForCacheKey, isTrackingParam } from "./urlUtils";
+
+describe("tracking params that used to fragment the cache key", () => {
+  // Each of these was measured missing the edge cache on every route probed on a
+  // production storefront, because it was absent from UTM_PARAMS.
+  const cases = [
+    ["GA4 campaign id", "utm_id"],
+    ["GA4 source platform", "utm_source_platform"],
+    ["Google Ads source", "gad_source"],
+    ["Google Ads iOS click id", "gbraid"],
+    ["Google Ads web-to-app click id", "wbraid"],
+    ["GA cross-domain linker", "_gl"],
+    ["Instagram", "igshid"],
+    ["Pinterest", "epik"],
+    ["Marketo", "mkt_tok"],
+    ["Yandex", "yclid"],
+  ] as const;
+
+  for (const [label, param] of cases) {
+    it(`strips ${label} (${param})`, () => {
+      expect(isTrackingParam(param)).toBe(true);
+      expect(cleanPathForCacheKey(`https://x.com/aneis?color=ouro&${param}=abc`)).toBe(
+        "/aneis?color=ouro",
+      );
+    });
+  }
+
+  it("still keeps functional params", () => {
+    for (const p of ["page", "order", "map", "PS", "filter.color", "skuId", "q"]) {
+      expect(isTrackingParam(p)).toBe(false);
+    }
+  });
+});

package/src/sdk/urlUtils.ts

@@ -25,6 +25,27 @@ const UTM_PARAMS = new Set([
   "mc_eid",
   "ttclid",
   "srsltid",
+  // GA4's newer campaign params. The five classic `utm_*` above predate them,
+  // so a GA4-tagged campaign was still fragmenting the cache key.
+  "utm_id",
+  "utm_source_platform",
+  "utm_creative_format",
+  "utm_marketing_tactic",
+  // Google Ads click ids that replaced bare `gclid` for privacy-restricted
+  // traffic (iOS/Safari), plus the source tag now appended to essentially every
+  // Google Ads click. Measured on a production storefront: each of these missed
+  // the edge cache on 3/3 routes probed, deterministically.
+  "gad_source",
+  "gad_campaignid",
+  "gbraid",
+  "wbraid",
+  // Google Analytics cross-domain linker. Sites already strip this by hand in
+  // client code, which is the tell that it shows up in real URLs.
+  "_gl",
+  "igshid",
+  "epik",
+  "mkt_tok",
+  "yclid",
 ]);
 
 /**