@decocms/tanstack 8.0.0 → 8.1.0-next.0

package/src/sdk/workerEntry.test.ts

@@ -1,7 +1,13 @@
-import { setBlocks } from "@decocms/blocks/cms";
-import { afterEach, describe, expect, it } from "vitest";
+import { computeRevision, revisionKey, setBlocks, snapshotKey } from "@decocms/blocks/cms";
+import {
+  __resetAutoconfigStateForTests,
+  autoconfigApps,
+} from "@decocms/blocks-admin/apps/autoconfig";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { segmentToken } from "./cdnSegment";
 import { __resetKvHydrationStateForTests } from "./kvHydration";
 import {
+  buildEnforcedCsp,
   buildGeoCacheParam,
   createDecoWorkerEntry,
   DECO_ADMIN_FRAME_ANCESTORS,
@@ -214,7 +220,9 @@ describe("CMS redirects", () => {
         redirects: [{ from: "/old", to: "/new", type: "permanent" }],
       },
     });
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(new Request("https://example.com/old"), EMPTY_ENV, MOCK_CTX);
     expect(res.status).toBe(301);
     expect(res.headers.get("Location")).toBe("/new");
@@ -227,7 +235,9 @@ describe("CMS redirects", () => {
         redirects: [{ from: "/old", to: "/new", type: "permanent" }],
       },
     });
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(
       new Request("https://example.com/old?asJson"),
       EMPTY_ENV,
@@ -244,7 +254,9 @@ describe("CMS redirects", () => {
         redirects: [{ from: "/promo", to: "/promoção", type: "temporary" }],
       },
     });
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(new Request("https://example.com/promo"), EMPTY_ENV, MOCK_CTX);
     expect(res.status).toBe(302);
     expect(res.headers.get("Location")).toBe("/promo%C3%A7%C3%A3o");
@@ -257,7 +269,9 @@ describe("CMS redirects", () => {
         redirects: [{ from: "/promo", to: "/sale", type: "temporary" }],
       },
     });
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(new Request("https://example.com/promo"), EMPTY_ENV, MOCK_CTX);
     expect(res.status).toBe(302);
     expect(res.headers.get("Location")).toBe("/sale");
@@ -270,14 +284,18 @@ describe("CMS redirects", () => {
         redirects: [{ from: "/old", to: "/new", type: "permanent" }],
       },
     });
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(new Request("https://example.com/other"), EMPTY_ENV, MOCK_CTX);
     expect(res.status).toBe(200);
   });
 
   it("picks up new redirects after setBlocks hot-reload", async () => {
     setBlocks({});
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
 
     // First request with no redirects — falls through
     const res1 = await worker.fetch(new Request("https://example.com/v1"), EMPTY_ENV, MOCK_CTX);
@@ -313,7 +331,9 @@ describe("degraded origin (anti-cache-poisoning)", () => {
           headers: { "X-Deco-Degraded": "true" },
         }),
     };
-    const worker = createDecoWorkerEntry(degradedEntry, { observability: false });
+    const worker = createDecoWorkerEntry(degradedEntry, {
+      observability: false,
+    });
     const res = await worker.fetch(
       new Request("https://example.com/some-category"),
       EMPTY_ENV,
@@ -327,7 +347,9 @@ describe("degraded origin (anti-cache-poisoning)", () => {
 
   it("serves a healthy 200 origin without the degraded bypass", async () => {
     setBlocks({});
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     const res = await worker.fetch(
       new Request("https://example.com/some-category"),
       EMPTY_ENV,
@@ -392,11 +414,86 @@ describe("security headers — frame-ancestors default", () => {
   });
 
   it("omits all security headers when securityHeaders is false", async () => {
-    const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, { securityHeaders: false });
+    const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
+      securityHeaders: false,
+    });
     const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
     expect(res.headers.get("Content-Security-Policy")).toBeNull();
     expect(res.headers.get("X-Content-Type-Options")).toBeNull();
   });
+
+  it("keeps report-only by default even when a site passes csp (cspMode unset)", async () => {
+    const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
+      csp: ["default-src 'self'"],
+    });
+    const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
+    expect(res.headers.get("Content-Security-Policy")).toBe(DEFAULT_FRAME_ANCESTORS_CSP);
+    expect(res.headers.get("Content-Security-Policy-Report-Only")).toBe("default-src 'self'");
+  });
+
+  it("enforce mode emits a nonce CSP (no report-only, no unsafe-inline) on a no-store HTML response", async () => {
+    const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
+      csp: ["default-src 'self'", "script-src 'self' 'unsafe-inline' https://gtm.example"],
+      cspMode: "enforce",
+    });
+    const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
+    const csp = res.headers.get("Content-Security-Policy") ?? "";
+    // Promoted to enforced — report-only is gone.
+    expect(res.headers.get("Content-Security-Policy-Report-Only")).toBeNull();
+    expect(csp).toContain("default-src 'self'");
+    // script-src hardened: unsafe-inline dropped, per-request nonce +
+    // inline-speculation-rules added, the host allowlist kept.
+    expect(csp).toMatch(/script-src[^;]*'nonce-[A-Za-z0-9+/=]+'/);
+    expect(csp).toContain("'inline-speculation-rules'");
+    expect(csp).toContain("https://gtm.example");
+    expect(csp).not.toContain("'unsafe-inline'");
+    // Framing protection preserved.
+    expect(csp).toContain("frame-ancestors");
+  });
+
+  it("enforce mode leaves 'unsafe-eval' in place (opt-out is explicit)", async () => {
+    const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
+      csp: ["script-src 'self' 'unsafe-inline' 'unsafe-eval'"],
+      cspMode: "enforce",
+    });
+    const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
+    const csp = res.headers.get("Content-Security-Policy") ?? "";
+    expect(csp).toContain("'unsafe-eval'");
+    expect(csp).not.toContain("'unsafe-inline'");
+  });
+});
+
+describe("buildEnforcedCsp", () => {
+  const FA = "frame-ancestors 'self' https://studio.decocms.com";
+
+  it("hardens script-src: drops unsafe-inline, adds nonce + inline-speculation-rules, keeps hosts + unsafe-eval", () => {
+    const csp = buildEnforcedCsp(
+      ["script-src 'self' 'unsafe-inline' 'unsafe-eval' https://gtm.example"],
+      FA,
+      "abc123",
+    );
+    expect(csp).toContain("script-src");
+    expect(csp).toContain("'self'");
+    expect(csp).toContain("https://gtm.example");
+    expect(csp).toContain("'unsafe-eval'");
+    expect(csp).toContain("'nonce-abc123'");
+    expect(csp).toContain("'inline-speculation-rules'");
+    expect(csp).not.toContain("'unsafe-inline'");
+    expect(csp).toContain(FA);
+  });
+
+  it("adds a script-src when the site declared none", () => {
+    const csp = buildEnforcedCsp(["default-src 'self'"], FA, "n0nce");
+    expect(csp).toContain("default-src 'self'");
+    expect(csp).toContain("script-src 'self' 'nonce-n0nce' 'inline-speculation-rules'");
+    expect(csp).toContain(FA);
+  });
+
+  it("drops any frame-ancestors from the site csp in favour of the canonical one", () => {
+    const csp = buildEnforcedCsp(["frame-ancestors 'none'", "default-src 'self'"], FA, "x");
+    expect(csp).not.toContain("frame-ancestors 'none'");
+    expect(csp).toContain(FA);
+  });
 });
 
 describe("POST /_cache/purge-loaders", () => {
@@ -406,9 +503,14 @@ describe("POST /_cache/purge-loaders", () => {
   });
 
   const purge = (env: Record<string, unknown>, headers: Record<string, string> = {}) => {
-    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+    });
     return worker.fetch(
-      new Request("https://example.com/_cache/purge-loaders", { method: "POST", headers }),
+      new Request("https://example.com/_cache/purge-loaders", {
+        method: "POST",
+        headers,
+      }),
       env,
       MOCK_CTX,
     );
@@ -436,7 +538,9 @@ describe("POST /_cache/purge-loaders", () => {
       purgeTokenEnv: false,
     });
     const res = await worker.fetch(
-      new Request("https://example.com/_cache/purge-loaders", { method: "POST" }),
+      new Request("https://example.com/_cache/purge-loaders", {
+        method: "POST",
+      }),
       EMPTY_ENV,
       MOCK_CTX,
     );
@@ -461,7 +565,11 @@ describe("X-Cache-Segment — custom SegmentKey fields (#284)", () => {
   it("includes a custom segment field in X-Cache-Segment instead of dropping it", async () => {
     const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
       observability: false,
-      buildSegment: () => ({ device: "desktop", regionId: "RJ", delivery: "store-42" }),
+      buildSegment: () => ({
+        device: "desktop",
+        regionId: "RJ",
+        delivery: "store-42",
+      }),
     });
     const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
     expect(res.headers.get("X-Cache-Segment")).toBe("desktop|r=RJ|delivery=store-42");
@@ -487,9 +595,439 @@ describe("X-Cache-Segment — custom SegmentKey fields (#284)", () => {
   it("keeps the existing hash format for segments using only known fields (back-compat)", async () => {
     const worker = createDecoWorkerEntry(HTML_SERVER_ENTRY, {
       observability: false,
-      buildSegment: () => ({ device: "desktop", salesChannel: "1", flags: ["b", "a"] }),
+      buildSegment: () => ({
+        device: "desktop",
+        salesChannel: "1",
+        flags: ["b", "a"],
+      }),
     });
     const res = await worker.fetch(new Request("https://example.com/"), EMPTY_ENV, MOCK_CTX);
     expect(res.headers.get("X-Cache-Segment")).toBe("desktop|sc=1|f=a,b");
   });
 });
+
+describe("draft preview (pull-based)", () => {
+  const POINTER = "abc.localhost:1234/api/o/decofile/m/main?token=t@v1";
+  const SANDBOX_URL = "http://abc.localhost:1234/api/o/decofile/m/main?token=t";
+  const DRAFT_BLOCKS = {
+    "pages-home": { name: "home", path: "/", title: "DRAFTED" },
+  };
+
+  // A serverEntry that reflects the currently-loaded home title, so a test can
+  // prove the draft override actually reached the render (not just the headers).
+  const REFLECT_ENTRY = {
+    fetch: async () => {
+      const { loadBlocks } = await import("@decocms/blocks/cms");
+      const home = (loadBlocks()["pages-home"] as { title?: string } | undefined) ?? {};
+      return new Response(home.title ?? "PUBLISHED", { status: 200 });
+    },
+  };
+
+  let realFetch: typeof fetch;
+  afterEach(async () => {
+    globalThis.fetch = realFetch;
+    const { setDraftPreviewHosts, clearDraftCache } = await import("@decocms/blocks/cms");
+    setDraftPreviewHosts([]);
+    clearDraftCache();
+    __resetKvHydrationStateForTests();
+    setBlocks({});
+  });
+
+  async function enable() {
+    const { setDraftPreviewHosts, clearDraftCache } = await import("@decocms/blocks/cms");
+    setBlocks({
+      "pages-home": { name: "home", path: "/", title: "PUBLISHED" },
+    });
+    setDraftPreviewHosts(["example.com"]);
+    clearDraftCache();
+    realFetch = globalThis.fetch;
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      if (String(input) === SANDBOX_URL) {
+        return new Response(JSON.stringify(DRAFT_BLOCKS), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      }
+      throw new Error(`unexpected fetch: ${String(input)}`);
+    }) as unknown as typeof fetch;
+  }
+
+  it("binds the draft, bypasses the edge cache, and stamps the anti-leak headers", async () => {
+    await enable();
+    const worker = createDecoWorkerEntry(REFLECT_ENTRY, {
+      observability: false,
+    });
+    const res = await worker.fetch(
+      new Request(`https://example.com/?__draft=${POINTER}`, {
+        headers: { host: "example.com" },
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+
+    // The render saw the merged draft decofile.
+    expect(await res.text()).toBe("DRAFTED");
+    // Never cached under the shared URL.
+    expect(res.headers.get("X-Cache")).toBe("BYPASS");
+    expect(res.headers.get("Cache-Control")).toContain("no-store");
+    expect(res.headers.get("X-Robots-Tag")).toBe("noindex, nofollow");
+    // Entry persists the navigation cookie.
+    const cookie = res.headers.get("set-cookie") ?? "";
+    expect(cookie).toContain("__deco_draft=");
+    expect(cookie).toContain("SameSite=None");
+    expect(cookie).toContain("Partitioned");
+  });
+
+  it("carries the draft across navigation via the cookie alone", async () => {
+    await enable();
+    const worker = createDecoWorkerEntry(REFLECT_ENTRY, {
+      observability: false,
+    });
+    const res = await worker.fetch(
+      new Request("https://example.com/other", {
+        headers: { host: "example.com", cookie: `__deco_draft=${POINTER}` },
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(await res.text()).toBe("DRAFTED");
+    expect(res.headers.get("X-Cache")).toBe("BYPASS");
+  });
+
+  it("is structurally inert on a non-preview host", async () => {
+    await enable(); // allowlist = example.com only
+    const worker = createDecoWorkerEntry(REFLECT_ENTRY, {
+      observability: false,
+    });
+    const res = await worker.fetch(
+      new Request(`https://prod.example/?__draft=${POINTER}`, {
+        headers: { host: "prod.example" },
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(await res.text()).toBe("PUBLISHED");
+    expect(res.headers.get("X-Robots-Tag")).toBeNull();
+    expect(res.headers.get("set-cookie")).toBeNull();
+  });
+
+  it("stays inert on any host when no allowlist is configured", async () => {
+    setBlocks({
+      "pages-home": { name: "home", path: "/", title: "PUBLISHED" },
+    });
+    const worker = createDecoWorkerEntry(REFLECT_ENTRY, {
+      observability: false,
+    });
+    const res = await worker.fetch(
+      new Request(`https://example.com/?__draft=${POINTER}`, {
+        headers: { host: "example.com" },
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(await res.text()).toBe("PUBLISHED");
+    expect(res.headers.get("X-Robots-Tag")).toBeNull();
+  });
+});
+
+describe('cdnCacheControl: "serverfn-segment"', () => {
+  const BUILD = "abc123";
+  const ENV = { BUILD_HASH: BUILD };
+  // The token is a hash the server issues, so tests derive it the same way the
+  // worker does instead of hardcoding a shape.
+  const tok = (seg: string) => segmentToken(seg, false, BUILD) as string;
+
+  function worker(overrides: Record<string, unknown> = {}) {
+    return createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "serverfn-segment",
+      buildSegment: (req: Request) => ({
+        device: req.headers.get("user-agent")?.includes("iPhone")
+          ? ("mobile" as const)
+          : ("desktop" as const),
+        ...(req.headers.get("cookie")?.includes("auth=1") ? { loggedIn: true } : {}),
+      }),
+      ...overrides,
+    });
+  }
+
+  const sfnUrl = (marker?: string) =>
+    `https://example.com/_serverFn/loadCmsPage${marker ? `?__cseg=${marker}` : ""}`;
+
+  async function cdnHeader(url: string, headers: Record<string, string> = {}) {
+    const res = await worker().fetch(new Request(url, { headers }), ENV, MOCK_CTX);
+    return res.headers.get("CDN-Cache-Control");
+  }
+
+  it("releases the CDN when the marker matches the recomputed segment", async () => {
+    expect(await cdnHeader(sfnUrl(tok("desktop")))).toMatch(/^public, max-age=\d+$/);
+  });
+
+  it("keeps no-store without a marker (bot, curl, old client)", async () => {
+    expect(await cdnHeader(sfnUrl())).toBe("no-store");
+  });
+
+  it("keeps no-store when the marker is for another device", async () => {
+    // The forged/diverging case: a desktop request claiming a mobile entry
+    // would let the CDN serve mobile HTML to desktop.
+    expect(await cdnHeader(sfnUrl(tok("mobile")))).toBe("no-store");
+  });
+
+  it("keeps no-store when the marker is from an older build", async () => {
+    // Deploying does not purge the CDN, so a stale build token must not match.
+    expect(await cdnHeader(sfnUrl(segmentToken("desktop", false, "oldbuild") as string))).toBe(
+      "no-store",
+    );
+  });
+
+  it("keeps no-store when there is no build hash", async () => {
+    const res = await worker().fetch(new Request(sfnUrl(tok("desktop"))), {}, MOCK_CTX);
+    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+
+  it("keeps no-store for a bot UA even with a valid marker", async () => {
+    // Bots render every section eagerly (~10x payload). Sharing one CDN entry
+    // would serve that to humans, or the deferred one to crawlers.
+    expect(
+      await cdnHeader(sfnUrl(tok("desktop")), {
+        "user-agent": "Mozilla/5.0 (compatible; Googlebot/2.1)",
+      }),
+    ).toBe("no-store");
+  });
+
+  it("keeps no-store for an A/B cohort cookie even with a valid marker", async () => {
+    expect(
+      await cdnHeader(sfnUrl(tok("desktop")), {
+        cookie: "deco_segment=eyJhY3RpdmUiOlsiYSJdfQ==",
+      }),
+    ).toBe("no-store");
+  });
+
+  it("keeps no-store for a logged-in request", async () => {
+    expect(await cdnHeader(sfnUrl(tok("desktop")), { cookie: "auth=1" })).toBe("no-store");
+  });
+
+  it("keeps no-store on HTML documents — they carry no marker", async () => {
+    expect(await cdnHeader("https://example.com/some-category")).toBe("no-store");
+  });
+
+  // NOTE: the end-to-end geo case is not exercised here. `injectGeoCookies`
+  // rebuilds the Request, and `new Request(req, init)` only carries `cf`
+  // through on workerd — under Node it is dropped, so a test would assert the
+  // absence of geo rather than its handling. The unit case below covers the
+  // property that matters, and the real path is verified against a built site.
+  it("never lets two regions share a token", () => {
+    // The leak this guards: RJ and SP resolving to the same colo must not
+    // share an entry, since their regionalized pricing and stock differ.
+    expect(tok("desktop|geo=BR|RJ")).not.toBe(tok("desktop|geo=BR|SP"));
+  });
+
+  it("keeps no-store without buildSegment, since the logged-in bypass is inert", async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "serverfn-segment",
+    });
+    const res = await w.fetch(new Request(sfnUrl(tok("desktop"))), ENV, MOCK_CTX);
+    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+});
+
+describe("cdnCacheControl default", () => {
+  const BUILD_D = "abc123";
+  const tokD = (seg: string) => segmentToken(seg, false, BUILD_D) as string;
+
+  // The default flipped from "no-store" to "serverfn-segment". That is only
+  // safe because it is inert until a verified marker arrives — these two tests
+  // are what make that claim checkable rather than asserted in a comment.
+  it("is inert for a client that never sends a marker", async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      buildSegment: () => ({ device: "desktop" as const }),
+    });
+    const html = await w.fetch(
+      new Request("https://example.com/"),
+      { BUILD_HASH: BUILD_D },
+      MOCK_CTX,
+    );
+    expect(html.headers.get("CDN-Cache-Control")).toBe("no-store");
+
+    const sfn = await w.fetch(
+      new Request("https://example.com/_serverFn/loadCmsPage"),
+      { BUILD_HASH: BUILD_D },
+      MOCK_CTX,
+    );
+    expect(sfn.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+
+  it("engages once the client sends a valid marker, with no site config", async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      buildSegment: () => ({ device: "desktop" as const }),
+    });
+    const res = await w.fetch(
+      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=${tokD("desktop")}`),
+      { BUILD_HASH: BUILD_D },
+      MOCK_CTX,
+    );
+    expect(res.headers.get("CDN-Cache-Control")).toMatch(/^public, max-age=\d+$/);
+  });
+
+  it('still honours an explicit opt-out with "no-store"', async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "no-store",
+      buildSegment: () => ({ device: "desktop" as const }),
+    });
+    const res = await w.fetch(
+      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=${tokD("desktop")}`),
+      { BUILD_HASH: BUILD_D },
+      MOCK_CTX,
+    );
+    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+});
+
+describe("CDN-Cache-Control at the single response exit", () => {
+  it("defaults to no-store on early returns that never reach dressResponse", async () => {
+    // `?asJson` returns the fully resolved page — loaders run with the caller's
+    // cookies — and returns before dressResponse, so it expresses no opinion on
+    // CDN caching. Without a default here it would inherit whatever the CDN
+    // decides for a 200 with no cache directives.
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    const res = await w.fetch(
+      new Request("https://example.com/some-category?asJson"),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+
+  it("leaves a value dressResponse already decided", async () => {
+    // The cacheable path is the one branch that reasoned about whether the CDN
+    // key matches the worker key — the default must not stomp it.
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "match-profile",
+      deviceSpecificKeys: false,
+      geoCacheKey: "off",
+    });
+    const res = await w.fetch(
+      new Request("https://example.com/some-category"),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(res.headers.get("CDN-Cache-Control")).toMatch(/^public, max-age=\d+$/);
+  });
+});
+
+describe('cdnCacheControl: "match-profile" guard', () => {
+  it("is ignored while the cache key is segmented (deviceSpecificKeys defaults to true)", async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "match-profile",
+    });
+    const res = await w.fetch(new Request("https://example.com/some-category"), {}, MOCK_CTX);
+    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  });
+
+  it("is honored only when the key really is the raw URL", async () => {
+    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      cdnCacheControl: "match-profile",
+      deviceSpecificKeys: false,
+      geoCacheKey: "off",
+    });
+    const res = await w.fetch(new Request("https://example.com/some-category"), {}, MOCK_CTX);
+    expect(res.headers.get("CDN-Cache-Control")).toMatch(/^public, max-age=\d+$/);
+  });
+});
+
+/**
+ * Fast-deploy hydration must run BEFORE `reconfigureAppsOnce()`.
+ *
+ * `reconfigureAppsOnce()` configures apps from the blocks it sees and then
+ * latches its promise forever. If it ran first, a `fastDeploy` build — whose
+ * bundled decofile is `{}` — would configure ZERO apps, and the only recovery
+ * is `setBlocks()`'s onChange listener, whose promise `setBlocks` drops
+ * unawaited. The request would proceed with no app loaders registered.
+ */
+describe("fast-deploy hydration ordering", () => {
+  // Reset BEFORE as well: both flags are module-level and latching, so an
+  // earlier test in this file that fired a request leaves `kvHydrated` true
+  // and hydration would be skipped entirely here.
+  beforeEach(() => {
+    __resetKvHydrationStateForTests();
+    __resetAutoconfigStateForTests();
+  });
+
+  afterEach(() => {
+    __resetKvHydrationStateForTests();
+    __resetAutoconfigStateForTests();
+    setBlocks({});
+  });
+
+  it("configures apps from the KV snapshot, not the stubbed bundle", async () => {
+    const KV_BLOCKS = { "deco-test": { "@type": "test-app", token: "from-kv" } };
+    const ID = "sha-ordering";
+
+    /** Blocks each configure() call observed, in order. */
+    const seen: unknown[] = [];
+    const registry = [
+      {
+        blockKey: "deco-test",
+        module: () =>
+          Promise.resolve({
+            configure: (block: unknown) => {
+              seen.push(block);
+              return Promise.resolve({
+                name: "test-app",
+                manifest: { name: "test-app", loaders: {}, actions: {} },
+                state: {},
+              });
+            },
+          }),
+      },
+    ];
+
+    // autoconfigApps and its onChange listener are server-only guarded on
+    // `typeof document`. This suite runs under jsdom, so drop `document` for
+    // the duration to exercise the worker path.
+    const realDocument = globalThis.document;
+    delete (globalThis as { document?: unknown }).document;
+    try {
+      // Simulates the stubbed server bundle: autoconfigApps runs at module init
+      // with an empty decofile, exactly as it would in a fastDeploy build.
+      setBlocks({});
+      await autoconfigApps({}, registry as never);
+      expect(seen).toEqual([]); // nothing to configure yet — this is the trap
+
+      const store = new Map<string, string>([
+        [snapshotKey(ID), JSON.stringify(KV_BLOCKS)],
+        [revisionKey(ID), computeRevision(KV_BLOCKS)],
+      ]);
+      const env = {
+        DECO_KV: {
+          get: (k: string) => Promise.resolve(store.get(k) ?? null),
+          put: () => Promise.resolve(),
+          delete: () => Promise.resolve(),
+        },
+        DECO_FAST_DEPLOY: "1",
+        DECO_DEPLOYMENT_ID: ID,
+      };
+
+      const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+      await worker.fetch(new Request("https://example.com/"), env, MOCK_CTX);
+
+      // The app must have been configured with the block that came from KV.
+      // Not asserting a call COUNT: both the onChange listener and the
+      // one-shot reinit legitimately configure, and how many passes happen is
+      // not the contract. The contract is that no pass saw the empty bundle.
+      // Deep equality, not identity: the snapshot arrives via JSON.parse, so
+      // the block is a structurally-equal copy.
+      expect(seen.length).toBeGreaterThan(0);
+      for (const block of seen) expect(block).toEqual(KV_BLOCKS["deco-test"]);
+    } finally {
+      globalThis.document = realDocument;
+    }
+  });
+});