@rangojs/router 0.0.0-experimental.8 → 0.0.0-experimental.8a4d0430

package/src/cache/cf/cf-cache-store.ts

@@ -1,4 +1,4 @@
-/// <reference path="../../vite/version.d.ts" />
+/// <reference path="../../vite/plugins/version.d.ts" />
 
 // Extend CacheStorage with Cloudflare's default cache property
 declare global {
@@ -25,12 +25,19 @@ import type {
   CachedEntryData,
   CacheDefaults,
   CacheGetResult,
+  CacheItemResult,
+  CacheItemOptions,
 } from "../types.js";
 import {
-  getRequestContext,
+  _getRequestContext,
   type RequestContext,
 } from "../../server/request-context.js";
 import { VERSION } from "@rangojs/router:version";
+import {
+  resolveTtl,
+  resolveSwrWindow,
+  DEFAULT_FUNCTION_TTL,
+} from "../cache-policy.js";
 
 // ============================================================================
 // Constants
@@ -124,7 +131,7 @@ export interface CFCacheStoreOptions<TEnv = unknown> {
    * @example Using cookies for locale-aware caching
    * ```typescript
    * keyGenerator: (ctx, defaultKey) => {
-   *   const locale = ctx.cookie('locale') || 'en';
+   *   const locale = cookies().get('locale')?.value || 'en';
    *   return `${locale}:${defaultKey}`;
    * }
    * ```
@@ -176,13 +183,13 @@ export class CFCacheStore<TEnv = unknown> implements SegmentCacheStore<TEnv> {
 
   /**
    * Derive base URL from request hostname via requestContext.
-   * Uses internal fallback for dev/preview environments.
+   * Uses internal fallback for dev/preview environments and untrusted hostnames.
    * @internal
    */
   private deriveBaseUrl(): string {
     const fallback = "https://rsc-cache.internal.com/";
 
-    const ctx = getRequestContext();
+    const ctx = _getRequestContext();
     if (!ctx?.request) {
       return fallback;
     }
@@ -201,6 +208,12 @@ export class CFCacheStore<TEnv = unknown> implements SegmentCacheStore<TEnv> {
         return fallback;
       }
 
+      // Validate hostname: must be a valid domain (alphanumeric, hyphens, dots)
+      // to prevent host header injection into cache keys
+      if (!/^[a-zA-Z0-9.-]+$/.test(hostname) || hostname.length > 253) {
+        return fallback;
+      }
+
       // Use actual hostname for production
       return `https://${hostname}/`;
     } catch {
@@ -291,7 +304,7 @@ export class CFCacheStore<TEnv = unknown> implements SegmentCacheStore<TEnv> {
       const request = this.keyToRequest(key);
 
       // Extended TTL covers SWR window
-      const swrWindow = swr ?? this.defaults?.swr ?? 0;
+      const swrWindow = resolveSwrWindow(swr, this.defaults);
       const totalTtl = ttl + swrWindow;
       const staleAt = Date.now() + ttl * 1000;
 
@@ -381,7 +394,7 @@ export class CFCacheStore<TEnv = unknown> implements SegmentCacheStore<TEnv> {
       const request = this.keyToRequest(`doc:${key}`);
 
       // Extended TTL covers SWR window
-      const swrWindow = swr ?? this.defaults?.swr ?? 0;
+      const swrWindow = resolveSwrWindow(swr, this.defaults);
       const totalTtl = ttl + swrWindow;
       const staleAt = Date.now() + ttl * 1000;
 
@@ -412,6 +425,105 @@ export class CFCacheStore<TEnv = unknown> implements SegmentCacheStore<TEnv> {
     }
   }
 
+  // ============================================================================
+  // Function Cache Methods (for "use cache" directive)
+  // ============================================================================
+
+  /**
+   * Get a cached function result by key.
+   * Follows the same SWR pattern as get() for segment caching.
+   */
+  async getItem(key: string): Promise<CacheItemResult | null> {
+    try {
+      const cache = await this.getCache();
+      const request = this.keyToRequest(`fn:${key}`);
+      const response = await cache.match(request);
+
+      if (!response) return null;
+
+      const staleAt = Number(
+        response.headers.get(CACHE_STALE_AT_HEADER) ?? "0",
+      );
+      const status = response.headers.get(CACHE_STATUS_HEADER);
+      const age = Number(response.headers.get("age") ?? "0");
+
+      const isStale = staleAt > 0 && Date.now() > staleAt;
+      const isRevalidating =
+        status === "REVALIDATING" && age < MAX_REVALIDATION_INTERVAL;
+
+      const data = (await response.json()) as {
+        value: string;
+        handles?: Record<string, Record<string, unknown[]>>;
+      };
+
+      if (!isStale || isRevalidating) {
+        return {
+          value: data.value,
+          handles: data.handles,
+          shouldRevalidate: false,
+        };
+      }
+
+      // Stale and needs revalidation — mark REVALIDATING atomically
+      const headers = new Headers(response.headers);
+      headers.set(CACHE_STATUS_HEADER, "REVALIDATING");
+      await cache.put(
+        request,
+        new Response(JSON.stringify(data), { status: 200, headers }),
+      );
+
+      return {
+        value: data.value,
+        handles: data.handles,
+        shouldRevalidate: true,
+      };
+    } catch (error) {
+      console.error("[CFCacheStore] getItem failed:", error);
+      return null;
+    }
+  }
+
+  /**
+   * Store a function result with TTL and optional SWR window.
+   */
+  async setItem(
+    key: string,
+    value: string,
+    options?: CacheItemOptions,
+  ): Promise<void> {
+    try {
+      const cache = await this.getCache();
+      const request = this.keyToRequest(`fn:${key}`);
+
+      const ttl = resolveTtl(options?.ttl, this.defaults, DEFAULT_FUNCTION_TTL);
+      const swrWindow = resolveSwrWindow(options?.swr, this.defaults);
+      const totalTtl = ttl + swrWindow;
+      const staleAt = Date.now() + ttl * 1000;
+
+      const body = JSON.stringify({ value, handles: options?.handles });
+      const response = new Response(body, {
+        headers: {
+          "Content-Type": "application/json",
+          "Cache-Control": `public, max-age=${totalTtl}`,
+          [CACHE_STALE_AT_HEADER]: String(staleAt),
+          [CACHE_STATUS_HEADER]: "HIT",
+        },
+      });
+
+      const putPromise = cache.put(request, response);
+
+      if (this.waitUntil) {
+        this.waitUntil(async () => {
+          await putPromise;
+        });
+      } else {
+        await putPromise;
+      }
+    } catch (error) {
+      console.error("[CFCacheStore] setItem failed:", error);
+    }
+  }
+
   /**
    * Convert string key to Request object for CF Cache API.
    * Includes version in URL if specified (for cache invalidation on code changes).

package/src/cache/cf/index.ts

@@ -13,7 +13,13 @@
 export { CFCacheStore, type CFCacheStoreOptions } from "./cf-cache-store.js";
 
 // Header constants for debugging and inspection
-export { CACHE_STALE_AT_HEADER, CACHE_STATUS_HEADER } from "./cf-cache-store.js";
+export {
+  CACHE_STALE_AT_HEADER,
+  CACHE_STATUS_HEADER,
+} from "./cf-cache-store.js";
 
 // Internal exports (re-exported for backwards compatibility, marked @internal in source)
-export { type CacheStatus, MAX_REVALIDATION_INTERVAL } from "./cf-cache-store.js";
+export {
+  type CacheStatus,
+  MAX_REVALIDATION_INTERVAL,
+} from "./cf-cache-store.js";

package/src/cache/document-cache.ts

@@ -13,6 +13,8 @@
 
 import type { MiddlewareFn, MiddlewareContext } from "../router/middleware.js";
 import { getRequestContext } from "../server/request-context.js";
+import { sortedSearchString } from "./cache-key-utils.js";
+import { runBackground } from "./background-task.js";
 
 // ============================================================================
 // Constants
@@ -110,15 +112,24 @@ function addCacheStatusHeader(
 }
 
 /**
- * Run onResponse callbacks registered on the request context
+ * Drain and run onResponse callbacks registered on the request context.
+ * Mirrors the drain semantics of finalizeResponse() in rsc/helpers.ts:
+ * callbacks are spliced out so they fire at most once per request.
  */
-function runOnResponseCallbacks(
+function drainOnResponseCallbacks(
   response: Response,
-  callbacks: Array<(response: Response) => Response>,
+  requestCtx:
+    | { _onResponseCallbacks: Array<(r: Response) => Response> }
+    | undefined,
 ): Response {
+  if (!requestCtx || requestCtx._onResponseCallbacks.length === 0) {
+    return response;
+  }
+  const callbacks = requestCtx._onResponseCallbacks;
+  requestCtx._onResponseCallbacks = [];
   let result = response;
   for (const callback of callbacks) {
-    result = callback(result);
+    result = callback(result) ?? result;
   }
   return result;
 }
@@ -185,9 +196,7 @@ export function createDocumentCacheMiddleware<TEnv = any>(
 ): MiddlewareFn<TEnv> {
   const { skipPaths = [], keyGenerator, isEnabled, debug = false } = options;
 
-  const log = debug
-    ? (message: string) => console.log(message)
-    : () => {};
+  const log = debug ? (message: string) => console.log(message) : () => {};
 
   return async function documentCacheMiddleware(
     ctx: MiddlewareContext<TEnv>,
@@ -195,6 +204,11 @@ export function createDocumentCacheMiddleware<TEnv = any>(
   ): Promise<Response> {
     const url = ctx.url;
 
+    // Only cache GET requests — mutations and other methods must not be cached
+    if (ctx.request.method !== "GET") {
+      return next();
+    }
+
     // Skip RSC action requests (mutations shouldn't be cached)
     if (url.searchParams.has("_rsc_action")) {
       return next();
@@ -231,17 +245,31 @@ export function createDocumentCacheMiddleware<TEnv = any>(
     const isPartial = url.searchParams.has("_rsc_partial");
     const typeLabel = isPartial ? "RSC" : "HTML";
 
-    // Generate cache key
-    // For partial requests, include hash of client segments to prevent serving
-    // wrong cached response when navigating from different pages with different layouts
-    const clientSegments = url.searchParams.get("_rsc_segments") || "";
-    const segmentHash = isPartial && clientSegments ? `:${hashSegmentIds(clientSegments)}` : "";
-    const typeSuffix = isPartial ? ":rsc" : ":html";
-    const cacheKey = keyGenerator
-      ? keyGenerator(url) + segmentHash + typeSuffix
-      : `${url.pathname}${segmentHash}${typeSuffix}`;
+    // Track whether next() has been called so the catch block knows
+    // whether it is safe to fall through to the handler.
+    let handlerCalled = false;
 
     try {
+      // Generate cache key inside try so a throwing keyGenerator degrades
+      // gracefully to the origin handler instead of rejecting the request.
+      // This is a deliberate fail-open-to-origin policy: the fallback is
+      // "serve uncached from origin", not "use a different cache key".
+      const clientSegments = url.searchParams.get("_rsc_segments") || "";
+      const segmentHash =
+        isPartial && clientSegments ? `:${hashSegmentIds(clientSegments)}` : "";
+      const typeSuffix = isPartial ? ":rsc" : ":html";
+
+      let searchSuffix = "";
+      if (!keyGenerator) {
+        const sorted = sortedSearchString(url.searchParams);
+        if (sorted) {
+          searchSuffix = `?${sorted}`;
+        }
+      }
+
+      const cacheKey = keyGenerator
+        ? keyGenerator(url) + segmentHash + typeSuffix
+        : `${url.pathname}${searchSuffix}${segmentHash}${typeSuffix}`;
       // 1. Check cache
       const cached = await store.getResponse(cacheKey);
 
@@ -249,79 +277,75 @@ export function createDocumentCacheMiddleware<TEnv = any>(
         if (!cached.shouldRevalidate) {
           // Fresh hit - return immediately
           log(`[DocumentCache] HIT ${typeLabel}: ${url.pathname}`);
-          let response = addCacheStatusHeader(cached.response, "HIT");
-          // Run onResponse callbacks even for cache hits
-          if (requestCtx && requestCtx._onResponseCallbacks.length > 0) {
-            response = runOnResponseCallbacks(
-              response,
-              requestCtx._onResponseCallbacks,
-            );
-          }
-          return response;
+          return drainOnResponseCallbacks(
+            addCacheStatusHeader(cached.response, "HIT"),
+            requestCtx,
+          );
         }
 
         // Stale hit - return cached response, revalidate in background
-        log(`[DocumentCache] STALE ${typeLabel}: ${url.pathname} (revalidating)`);
-
-        if (requestCtx) {
-          requestCtx.waitUntil(async () => {
-            try {
-              const fresh = await next();
-              const directives = shouldCacheResponse(fresh);
-
-              if (directives) {
-                await store.putResponse!(
-                  cacheKey,
-                  fresh,
-                  directives.sMaxAge!,
-                  directives.staleWhileRevalidate,
-                );
-                log(`[DocumentCache] REVALIDATED ${typeLabel}: ${url.pathname}`);
-              }
-            } catch (error) {
-              console.error(`[DocumentCache] Revalidation failed:`, error);
+        log(
+          `[DocumentCache] STALE ${typeLabel}: ${url.pathname} (revalidating)`,
+        );
+
+        runBackground(requestCtx, async () => {
+          try {
+            const fresh = await next();
+            const directives = shouldCacheResponse(fresh);
+
+            if (directives) {
+              await store.putResponse!(
+                cacheKey,
+                fresh,
+                directives.sMaxAge!,
+                directives.staleWhileRevalidate,
+              );
+              log(`[DocumentCache] REVALIDATED ${typeLabel}: ${url.pathname}`);
             }
-          });
-        }
+          } catch (error) {
+            console.error(`[DocumentCache] Revalidation failed:`, error);
+          }
+        });
 
-        let response = addCacheStatusHeader(cached.response, "STALE");
-        // Run onResponse callbacks even for stale cache hits
-        if (requestCtx && requestCtx._onResponseCallbacks.length > 0) {
-          response = runOnResponseCallbacks(
-            response,
-            requestCtx._onResponseCallbacks,
-          );
-        }
-        return response;
+        return drainOnResponseCallbacks(
+          addCacheStatusHeader(cached.response, "STALE"),
+          requestCtx,
+        );
       }
 
       // 2. Cache miss - run handler
+      handlerCalled = true;
       const originalResponse = await next();
 
       // 3. Cache if response has appropriate headers
       const directives = shouldCacheResponse(originalResponse);
 
       if (directives) {
-        log(`[DocumentCache] MISS ${typeLabel}: ${url.pathname} (caching with s-maxage=${directives.sMaxAge})`);
+        log(
+          `[DocumentCache] MISS ${typeLabel}: ${url.pathname} (caching with s-maxage=${directives.sMaxAge})`,
+        );
+
+        // If the response has no body (e.g., 200 with empty body), skip caching
+        if (!originalResponse.body) {
+          return originalResponse;
+        }
 
         // Tee the body so we can return one stream and cache the other
-        const [returnStream, cacheStream] = originalResponse.body!.tee();
+        const [returnStream, cacheStream] = originalResponse.body.tee();
 
         // Clone response for caching (non-blocking)
-        if (requestCtx) {
-          requestCtx.waitUntil(async () => {
-            try {
-              await store.putResponse!(
-                cacheKey,
-                new Response(cacheStream, originalResponse),
-                directives.sMaxAge!,
-                directives.staleWhileRevalidate,
-              );
-            } catch (error) {
-              console.error(`[DocumentCache] Cache write failed:`, error);
-            }
-          });
-        }
+        runBackground(requestCtx, async () => {
+          try {
+            await store.putResponse!(
+              cacheKey,
+              new Response(cacheStream, originalResponse),
+              directives.sMaxAge!,
+              directives.staleWhileRevalidate,
+            );
+          } catch (error) {
+            console.error(`[DocumentCache] Cache write failed:`, error);
+          }
+        });
 
         return addCacheStatusHeader(
           new Response(returnStream, originalResponse),
@@ -333,7 +357,12 @@ export function createDocumentCacheMiddleware<TEnv = any>(
       return originalResponse;
     } catch (error) {
       console.error(`[DocumentCache] Error:`, error);
-      // On any cache error, fall through to handler
+      if (handlerCalled) {
+        // Post-handler failure (e.g. body.tee()): do not call next() again
+        // as that would re-run handler side effects.
+        throw error;
+      }
+      // Pre-handler failure (cache lookup): degrade gracefully to origin
       return next();
     }
   };

package/src/cache/handle-capture.ts

@@ -0,0 +1,81 @@
+/**
+ * Handle Capture
+ *
+ * Captures handle pushes during cached function execution.
+ * Extracted from cache-runtime.ts so tests can import without
+ * pulling in @vitejs/plugin-rsc/rsc dependencies.
+ */
+
+import type { HandleStore } from "../server/handle-store.js";
+import type { SegmentHandleData } from "./types.js";
+
+export interface HandleCapture {
+  data: Record<string, SegmentHandleData>;
+}
+
+/**
+ * Active capture tokens per HandleStore.
+ *
+ * Instead of mutating handleStore.push (which breaks when overlapping
+ * captures finish out of order), we install a single interceptor on
+ * first use and manage a set of active capture tokens. Each push fans
+ * out to every active token. Stopping a capture simply removes the
+ * token — order does not matter.
+ */
+const activeCapturesMap = new WeakMap<HandleStore, Set<HandleCapture>>();
+
+/**
+ * One-time interceptor installation. Wraps the original push so every
+ * call fans out to all active capture tokens. Installed once per
+ * HandleStore instance; subsequent startHandleCapture calls on the
+ * same store just add tokens to the Set.
+ */
+function ensureInterceptorInstalled(handleStore: HandleStore): void {
+  if (activeCapturesMap.has(handleStore)) return;
+
+  const captures = new Set<HandleCapture>();
+  activeCapturesMap.set(handleStore, captures);
+
+  const originalPush = handleStore.push.bind(handleStore);
+  handleStore.push = (
+    handleName: string,
+    segmentId: string,
+    value: unknown,
+  ) => {
+    for (const capture of captures) {
+      if (!capture.data[segmentId]) {
+        capture.data[segmentId] = {};
+      }
+      if (!capture.data[segmentId][handleName]) {
+        capture.data[segmentId][handleName] = [];
+      }
+      capture.data[segmentId][handleName].push(value);
+    }
+    originalPush(handleName, segmentId, value);
+  };
+}
+
+/**
+ * Start capturing handle pushes for a cached function execution.
+ *
+ * Concurrency-safe: multiple overlapping captures on the same
+ * HandleStore are independent. Each capture registers a token in a
+ * Set; stopping removes it. No ordering requirement (LIFO not needed).
+ */
+export function startHandleCapture(handleStore: HandleStore): {
+  capture: HandleCapture;
+  stop: () => void;
+} {
+  ensureInterceptorInstalled(handleStore);
+
+  const capture: HandleCapture = { data: {} };
+  const captures = activeCapturesMap.get(handleStore)!;
+  captures.add(capture);
+
+  return {
+    capture,
+    stop() {
+      captures.delete(capture);
+    },
+  };
+}

package/src/cache/handle-snapshot.ts

@@ -0,0 +1,41 @@
+/**
+ * Handle Snapshot
+ *
+ * Capture and restore handle data for cached segments.
+ * Handle data (breadcrumbs, metadata from ctx.use(Handle)) is collected
+ * during segment resolution and stored alongside cached segments.
+ */
+
+import type { ResolvedSegment } from "../types.js";
+import type { HandleStore } from "../server/handle-store.js";
+import type { SegmentHandleData } from "./types.js";
+
+/**
+ * Capture handle data for a set of segments from the handle store.
+ * Used when caching segments to preserve their handle data.
+ */
+export function captureHandles(
+  segments: ResolvedSegment[],
+  handleStore: HandleStore,
+): Record<string, SegmentHandleData> {
+  const handles: Record<string, SegmentHandleData> = {};
+  for (const seg of segments) {
+    handles[seg.id] = handleStore.getDataForSegment(seg.id);
+  }
+  return handles;
+}
+
+/**
+ * Restore handle data from a cached snapshot into the handle store.
+ * Used when serving cached segments to replay their handle data.
+ */
+export function restoreHandles(
+  handles: Record<string, SegmentHandleData>,
+  handleStore: HandleStore,
+): void {
+  for (const [segId, segHandles] of Object.entries(handles)) {
+    if (Object.keys(segHandles).length > 0) {
+      handleStore.replaySegmentData(segId, segHandles);
+    }
+  }
+}

package/src/cache/index.ts

@@ -10,21 +10,6 @@
  * - CacheScope / createCacheScope - Request-scoped cache provider
  */
 
-// Generic cache store types (reserved for future extensibility)
-// These types support caching arbitrary values like Response, Stream, etc.
-// Currently unused - segment caching uses SegmentCacheStore directly.
-export type {
-  CacheStore,
-  CacheEntry,
-  CacheValue,
-  CacheValueType,
-  CachePutOptions,
-  CacheMetadata,
-} from "./types.js";
-
-// Generic memory cache (reserved for future extensibility)
-export { MemoryCacheStore } from "./memory-store.js";
-
 // Segment cache store types and implementations
 export type {
   SegmentCacheStore,